@hawcx/oauth-client 5.2.0 → 6.2.0

package/dist/management/response_signature.js

@@ -0,0 +1,170 @@
+"use strict";
+/**
+ * Verification of the management API's `X-Response-Signature` (TOB-HSDK-11).
+ *
+ * Every successful jwt-mode (Path A) management response from hx_auth carries
+ * `X-Response-Signature`: a compact JWS signed with the shared OAuth signing
+ * key that the OP publishes at `${issuer}/.well-known/jwks.json` — the same
+ * JWKS that verifies ID tokens.  Its payload is exactly
+ *
+ *   { "body_sha256": base64url(sha256(<exact response body bytes>)), "iat": <unix s> }
+ *
+ * Verifying it restores the response authentication the legacy ECIES
+ * transport always had (signature + timestamp skew on every response).
+ *
+ * Checks, all fail-closed:
+ *  - the header is present and is a compact JWS whose protected header names
+ *    a `kid`;
+ *  - `alg` is one of ES256 / ES384 / ES512 (the server's KMS key is an EC key
+ *    and the alg follows its curve).  `none`, HS*, RS*, EdDSA are rejected —
+ *    this forecloses alg-substitution / key-confusion;
+ *  - the signature verifies against the issuer JWKS (jose `RemoteJWKSet`:
+ *    cached, and refetched once when the `kid` is unknown — key rotation);
+ *  - `iat` is present and within ±clockSkewSeconds of local time;
+ *  - the payload is a response signature, not some other token minted with
+ *    the same key (TOB-HSDK-9 type confusion): `body_sha256` is required and
+ *    `aud`, `sub`, `nonce` must be absent — an ID token always carries
+ *    `aud`/`sub`;
+ *  - `body_sha256` equals base64url(sha256(raw body bytes)), compared in
+ *    constant time.  The hash is taken over the raw bytes as received, before
+ *    any decoding or JSON parsing.
+ *
+ * Failures are split so callers can react correctly:
+ *  - {@link ResponseSignatureInvalidError} (`code: 'response_signature_invalid'`)
+ *    — missing/empty header or a signature that does not verify;
+ *  - {@link ResponseSignatureUnavailableError}
+ *    (`code: 'response_signature_unavailable'`) — the signing keys could not
+ *    be obtained (JWKS fetch failed / timed out / non-200 / malformed, or the
+ *    kid is unknown while jose's refetch cooldown suppresses a refetch).  The
+ *    request may already have been applied server-side.
+ * Both subclass `DelegationResponseError` and carry fixed, non-leaky messages.
+ *
+ * Not part of the public API (not re-exported from the package index).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResponseSignatureVerifier = exports.RESPONSE_SIGNATURE_HEADER = void 0;
+const node_crypto_1 = require("node:crypto");
+const jose_1 = require("jose");
+const exceptions_1 = require("../delegation/exceptions");
+/** Response-signature header name (HTTP headers are case-insensitive). */
+exports.RESPONSE_SIGNATURE_HEADER = 'X-Response-Signature';
+/** EC algorithms the server's KMS signing key can produce — nothing else. */
+const ALLOWED_ALGS = Object.freeze(['ES256', 'ES384', 'ES512']);
+/**
+ * Claims that mark a token as something other than a response signature.
+ * Deliberately `aud` is forbidden rather than repurposed: request binding
+ * (anti-replay within the iat window) is designed server-side in
+ * hawcx/hx_auth#278 as dedicated custom claims (`req_jti` / `htm` / `htu` /
+ * `cid`), explicitly NOT `aud` — keep this list as is.
+ */
+const FORBIDDEN_CLAIMS = Object.freeze(['aud', 'sub', 'nonce']);
+/** Generic, non-leaky messages; detail (if any) is attached as `cause`. */
+const MSG_MISSING = 'Management API response is missing its signature';
+const MSG_INVALID = 'Management API response signature verification failed';
+const MSG_UNAVAILABLE = 'Management API response signature could not be verified: signing keys unavailable';
+class ResponseSignatureVerifier {
+    constructor(options) {
+        // jose handles caching (10 min max age), concurrent-fetch coalescing, and a
+        // single refetch on an unknown `kid` (rate-limited by its 30s cooldown) —
+        // the same machinery HawcxOAuth uses for ID-token verification.
+        this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(options.jwksUri), {
+            timeoutDuration: options.timeoutMs,
+        });
+        this.clockSkewSeconds = options.clockSkewSeconds;
+    }
+    /**
+     * Verify `signature` (the header value, or null when absent) over the EXACT
+     * response body bytes.  Resolves on success; throws
+     * {@link ResponseSignatureInvalidError} or
+     * {@link ResponseSignatureUnavailableError} otherwise.
+     */
+    async verify(signature, body) {
+        if (!signature) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_MISSING);
+        }
+        // Set by the key resolver when the keys could not be obtained, as opposed
+        // to a signature that was checked and found bad.
+        let keysUnavailable = false;
+        let payloadBytes;
+        try {
+            const result = await (0, jose_1.compactVerify)(signature, async (protectedHeader, token) => {
+                if (typeof protectedHeader.kid !== 'string' || protectedHeader.kid.length === 0) {
+                    throw new Error('response signature has no kid');
+                }
+                // If jose may refetch on a miss (not cooling down), a miss means the
+                // kid is absent from a freshly fetched JWKS → invalid.  If the
+                // cooldown suppresses the refetch, the kid may simply be newer than
+                // our cache (rotation) → unavailable.
+                const canRefetch = !this.jwks.coolingDown;
+                try {
+                    return await this.jwks(protectedHeader, token);
+                }
+                catch (err) {
+                    if (err instanceof jose_1.errors.JWKSNoMatchingKey) {
+                        keysUnavailable = !canRefetch;
+                    }
+                    else if (!(err instanceof jose_1.errors.JWKSMultipleMatchingKeys)) {
+                        // Fetch failure, timeout, non-200, malformed JWKS, network error.
+                        keysUnavailable = true;
+                    }
+                    throw err;
+                }
+            }, { algorithms: [...ALLOWED_ALGS] });
+            payloadBytes = result.payload;
+        }
+        catch (err) {
+            if (keysUnavailable) {
+                throw new exceptions_1.ResponseSignatureUnavailableError(MSG_UNAVAILABLE, { cause: err });
+            }
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, { cause: err });
+        }
+        let claims;
+        try {
+            const parsed = JSON.parse(Buffer.from(payloadBytes).toString('utf-8'));
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                throw new Error('payload is not a JSON object');
+            }
+            claims = parsed;
+        }
+        catch (err) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, { cause: err });
+        }
+        // Type-confusion guard (TOB-HSDK-9): only a response signature qualifies.
+        for (const claim of FORBIDDEN_CLAIMS) {
+            if (Object.prototype.hasOwnProperty.call(claims, claim)) {
+                throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                    cause: new Error(`unexpected '${claim}' claim in response signature`),
+                });
+            }
+        }
+        const claimedHash = claims['body_sha256'];
+        if (typeof claimedHash !== 'string' || claimedHash.length === 0) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error("response signature has no 'body_sha256' claim"),
+            });
+        }
+        // Freshness: `iat` required, within the configured skew either way.
+        const iat = claims['iat'];
+        if (typeof iat !== 'number' || !Number.isFinite(iat)) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error("response signature has no numeric 'iat' claim"),
+            });
+        }
+        const nowSec = Date.now() / 1000;
+        if (iat > nowSec + this.clockSkewSeconds || iat < nowSec - this.clockSkewSeconds) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error(`response signature 'iat' outside allowed skew (${this.clockSkewSeconds}s)`),
+            });
+        }
+        // Body binding: base64url(sha256(raw bytes)), no padding, constant-time.
+        const actual = Buffer.from((0, node_crypto_1.createHash)('sha256').update(body).digest('base64url').replace(/=+$/, ''), 'utf-8');
+        const claimed = Buffer.from(claimedHash, 'utf-8');
+        if (actual.length !== claimed.length || !(0, node_crypto_1.timingSafeEqual)(actual, claimed)) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error('response body does not match the signed body_sha256'),
+            });
+        }
+    }
+}
+exports.ResponseSignatureVerifier = ResponseSignatureVerifier;
+//# sourceMappingURL=response_signature.js.map

package/dist/management/response_signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response_signature.js","sourceRoot":"","sources":["../../src/management/response_signature.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;;;AAEH,6CAA0D;AAC1D,+BAA+E;AAC/E,yDAGkC;AAElC,0EAA0E;AAC7D,QAAA,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE,6EAA6E;AAC7E,MAAM,YAAY,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnF,2EAA2E;AAC3E,MAAM,WAAW,GAAG,kDAAkD,CAAC;AACvE,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAC5E,MAAM,eAAe,GACnB,mFAAmF,CAAC;AAWtF,MAAa,yBAAyB;IAIpC,YAAY,OAAyC;QACnD,4EAA4E;QAC5E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YACvD,eAAe,EAAE,OAAO,CAAC,SAAS;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,SAAwB,EAAE,IAAgB;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,0CAA6B,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,eAAe,GAAG,KAAK,CAAC;QAE5B,IAAI,YAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,oBAAa,EAChC,SAAS,EACT,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE;gBAC/B,IAAI,OAAO,eAAe,CAAC,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,CAAC;gBACD,qEAAqE;gBACrE,+DAA+D;gBAC/D,oEAAoE;gBACpE,sCAAsC;gBACtC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1C,IAAI,CAAC;oBACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,aAAU,CAAC,iBAAiB,EAAE,CAAC;wBAChD,eAAe,GAAG,CAAC,UAAU,CAAC;oBAChC,CAAC;yBAAM,IAAI,CAAC,CAAC,GAAG,YAAY,aAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;wBACjE,kEAAkE;wBAClE,eAAe,GAAG,IAAI,CAAC;oBACzB,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,EACD,EAAE,UAAU,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAClC,CAAC;YACF,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,8CAAiC,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,GAAG,MAAiC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,0EAA0E;QAC1E,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;oBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,eAAe,KAAK,+BAA+B,CAAC;iBACtE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,+CAA+C,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QAED,oEAAoE;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,+CAA+C,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACjC,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjF,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,kDAAkD,IAAI,CAAC,gBAAgB,IAAI,CAAC;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EACxE,OAAO,CACR,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,IAAA,6BAAe,EAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,qDAAqD,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AApHD,8DAoHC"}

package/dist/oauth.d.ts

@@ -17,6 +17,7 @@
  */
 import { type JWTPayload } from 'jose';
 import { ClientAssertionSigner } from './client-assertion';
+import { ProfileClient, type ProfileClientOptions } from './profile/client';
 export interface HawcxOAuthConfig {
     /** Your Hawcx config-id (sent as the `X-Config-Id` header on token exchange) */
     configId: string;
@@ -66,6 +67,46 @@ export interface HawcxOAuthIssuerConfig {
      * Spec.md §3.3.
      */
     clockToleranceSeconds?: number;
+    /**
+     * Optional custom domain (a DNS CNAME to Hawcx), e.g.
+     * `https://auth.example.com`. `scheme://host[:port]` only: https (http only
+     * for loopback), ASCII/punycode host or IP literal, no userinfo, path,
+     * query or fragment; one trailing `/` allowed. Canonicalised (lower-cased,
+     * default port dropped). `null`/`undefined` = unset. Invalid →
+     * `HawcxOAuthError` `invalid_custom_domain`, before any discovery fetch.
+     *
+     * Affects only the browser-facing URLs from {@link HawcxOAuth.buildAuthorizeUrl}
+     * and {@link HawcxOAuth.buildEndSessionUrl} (scheme + host + port swapped,
+     * path kept). Discovery, token exchange, JWKS and the `iss` check stay on
+     * the issuer.
+     */
+    customDomain?: string | null;
+}
+/** Options for {@link HawcxOAuth.buildAuthorizeUrl}. */
+export interface AuthorizeUrlOptions {
+    /** `redirect_uri` registered for the client. Required. */
+    redirectUri: string;
+    /** Opaque CSRF `state`. Required. */
+    state: string;
+    /** PKCE S256 `code_challenge`. Required. */
+    codeChallenge: string;
+    /** Optional OIDC `nonce`; pass the same value to `exchangeCode` as `expectedNonce`. */
+    nonce?: string;
+    /** Space-separated scopes (default `openid`). */
+    scope?: string;
+    /** Optional OIDC `prompt` (e.g. `login`). */
+    prompt?: string;
+    /**
+     * Additional query parameters (non-empty keys, string values). May not
+     * override any parameter the SDK sets, nor `request` / `request_uri`.
+     */
+    extraParams?: Record<string, string>;
+}
+/** Options for {@link HawcxOAuth.buildEndSessionUrl}. */
+export interface EndSessionUrlOptions {
+    postLogoutRedirectUri?: string;
+    idTokenHint?: string;
+    state?: string;
 }
 export interface JwtClaims extends JWTPayload {
     /** Subject (user ID) */
@@ -168,6 +209,8 @@ export declare class HawcxOAuth {
      * which returns a *new* configured client (this field is `readonly`).
      */
     private readonly clientAssertionSigner;
+    /** Validated custom-domain origin for browser URLs; `null` if unset or legacy mode. */
+    private readonly customDomain;
     /**
      * Construct a legacy-mode client. For discovery mode, prefer
      * {@link HawcxOAuth.fromIssuer}.
@@ -212,6 +255,14 @@ export declare class HawcxOAuth {
      * (the assertion would be silently ignored).
      */
     withClientAssertion(signer: ClientAssertionSigner): HawcxOAuth;
+    /**
+     * Client for the Hawcx profile service, built from this discovery-mode
+     * client and its {@link withClientAssertion} signer. Same as
+     * `new ProfileClient(oauth, options)`.
+     *
+     * @throws {HawcxError} in legacy mode or without a client-assertion signer.
+     */
+    profile(options?: ProfileClientOptions): ProfileClient;
     /**
      * Exchange authorization code for id_token and verified claims.
      *
@@ -257,9 +308,46 @@ export declare class HawcxOAuth {
     refreshJwks(): void;
     /**
      * @deprecated since 5.1.0 — renamed to {@link refreshJwks} for cross-SDK
-     *   consistency. Will be removed in 6.0.0. Behaviour is identical.
+     *   consistency. Will be removed in a future major version. Behaviour is identical.
      */
     clearCache(): void;
     private clearCacheWarned;
+    /**
+     * Build the browser `/authorize` URL (discovery mode only; no I/O).
+     *
+     * Base is the discovered `authorization_endpoint`; with `customDomain` set,
+     * its scheme + host + port are replaced by the custom domain's (path and any
+     * existing query kept). Sets `response_type=code`, `client_id`,
+     * `redirect_uri`, `scope` (default `openid`), `state`, `code_challenge`,
+     * `code_challenge_method=S256`, plus `nonce` / `prompt` / `extraParams`
+     * when given.
+     *
+     * @throws {HawcxOAuthError} `issuer_mode_required` in legacy mode;
+     *   `invalid_request` for a missing required option or a reserved
+     *   `extraParams` key.
+     * @throws {DiscoveryError} `invalid_discovery_document` if the discovered
+     *   `authorization_endpoint` is missing or insecure.
+     */
+    buildAuthorizeUrl(options: AuthorizeUrlOptions): string;
+    /**
+     * Build the browser RP-initiated logout URL (discovery mode only; no I/O).
+     * Base is the discovered `end_session_endpoint`, with the same
+     * `customDomain` origin swap as {@link buildAuthorizeUrl}. Always sets
+     * `client_id`; `post_logout_redirect_uri`, `id_token_hint` and `state` when given.
+     *
+     * @throws {HawcxOAuthError} `issuer_mode_required` in legacy mode.
+     * @throws {DiscoveryError} `invalid_discovery_document` if the discovered
+     *   `end_session_endpoint` is missing or insecure.
+     */
+    buildEndSessionUrl(options?: EndSessionUrlOptions | null): string;
+    /**
+     * Build a browser URL from a discovered endpoint, validated lazily (so
+     * fromIssuer keeps accepting documents without it): origin (custom domain
+     * if set, else the endpoint's) + RAW path + RAW query + `&` + SDK params.
+     * The endpoint query is copied verbatim, never re-serialised, and may not
+     * carry any of `sdkNames`; an `extraKeys` name it already carries is an
+     * `invalid_request` (RFC 6749 §3.1: no repeated parameters).
+     */
+    private browserUrl;
 }
 //# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AA6BlF,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,sBAAsB;IACrC,gHAAgH;IAChH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,sBAAsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAE/C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgB;IACjD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAE7D,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAErD,OAAO,CAAC,IAAI,CAAsD;IAElE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+B;IAErE;;;OAGG;gBACS,MAAM,EAAE,gBAAgB;IAqCpC;;;;;;;;;;;;;;;OAeG;WACU,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC;IAyH5E;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,UAAU;IA6B9D;;;;;;;;;;;;OAYG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC;IAkF1B;;;;;;;;OAQG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;IA8ElF;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAoBf;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAInB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAclB,OAAO,CAAC,gBAAgB,CAAS;CAClC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AAclF,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AA4B5E,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,sBAAsB;IACrC,gHAAgH;IAChH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiCD,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,sBAAsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAkDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAE/C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgB;IACjD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAE7D,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAErD,OAAO,CAAC,IAAI,CAAsD;IAElE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+B;IAErE,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAE7C;;;OAGG;gBACS,MAAM,EAAE,gBAAgB;IAyCpC;;;;;;;;;;;;;;;OAeG;WACU,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC;IAuI5E;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,UAAU;IA8B9D;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,aAAa;IAatD;;;;;;;;;;;;OAYG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC;IAwI1B;;;;;;;;OAQG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;IA8ElF;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAoBf;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAInB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAclB,OAAO,CAAC,gBAAgB,CAAS;IAEjC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM;IAkCvD;;;;;;;;;OASG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,GAAG,MAAM;IAUjE;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;CAwDnB"}