@hawcx/oauth-client 5.2.0 → 6.2.0

package/dist/profile/http.js

@@ -0,0 +1,295 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _ProfileHttp_o, _ProfileHttp_base;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProfileHttp = exports.isObject = void 0;
+exports.segment = segment;
+/**
+ * One request path for the profile service: bearer + `X-Config-Id`, single-
+ * segment path encoding, bounded retries for idempotent methods (transient
+ * token-endpoint failures retried for every method, same budget), one 401
+ * refresh-and-replay, no redirects, problem+json → {@link ProfileApiError}.
+ */
+const errors_1 = require("../errors");
+const url_1 = require("../internal/url");
+const errors_2 = require("./errors");
+const RETRY_METHODS = new Set(['GET', 'PUT', 'DELETE']);
+const RETRY_STATUS = new Set([408, 429, 502, 503, 504]);
+const RETRY_AFTER_CAP_MS = 30000;
+const BACKOFF_BASE_MS = 200;
+const BACKOFF_CAP_MS = 5000;
+const urlError = (message) => new errors_1.HawcxError(message);
+const isObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+exports.isObject = isObject;
+/**
+ * Validate a caller-supplied path parameter and percent-encode it as exactly
+ * one segment (`?`, `#`, `%` encoded). Empty, `.`, `..`, and anything with
+ * `/`, `\` or a control character are refused client-side: an encoded `%2F`
+ * could still be decoded into a separator by a proxy.
+ */
+function segment(value, name) {
+    if (typeof value !== 'string' ||
+        value === '' ||
+        value === '.' ||
+        value === '..' ||
+        // eslint-disable-next-line no-control-regex
+        /[/\\\u0000-\u001f\u007f]/.test(value)) {
+        throw new errors_1.HawcxError(`${name} must be a non-empty string other than '.' or '..', without '/', '\\' or control characters`);
+    }
+    return encodeURIComponent(value);
+}
+class ProfileHttp {
+    constructor(options) {
+        _ProfileHttp_o.set(this, void 0);
+        _ProfileHttp_base.set(this, void 0);
+        __classPrivateFieldSet(this, _ProfileHttp_o, {
+            ...options,
+            timeout: options.timeout ?? 10000,
+            maxRetries: options.maxRetries ?? 2,
+            sleep: options.sleep ?? (ms => new Promise(r => setTimeout(r, ms))),
+            fetch: options.fetch ?? fetch,
+            surface401: options.surface401 ?? false,
+        }, "f");
+        __classPrivateFieldSet(this, _ProfileHttp_base, (0, url_1.parseSecureBaseUrl)('baseUrl', options.baseUrl, urlError), "f");
+    }
+    /**
+     * `segments` must already be encoded literals or {@link segment} output.
+     * Returns the parsed 2xx JSON body, which must pass `opts.valid` (default:
+     * a JSON object) or a `ProfileApiError` is thrown; a 204 to any method but
+     * DELETE is `Unexpected response body`. `null` only for a DELETE answered
+     * 2xx (whatever the body), or a DELETE answered 404 after an earlier attempt
+     * of the same call may have run (no response, a 2xx whose body failed
+     * mid-read, or 504).
+     */
+    async request(method, segments, opts = {}) {
+        const o = __classPrivateFieldGet(this, _ProfileHttp_o, "f");
+        const query = new URLSearchParams();
+        for (const [k, v] of Object.entries(opts.query ?? {}))
+            if (v !== undefined)
+                query.set(k, String(v));
+        const qs = query.toString();
+        const path = `/${segments.join('/')}`;
+        // Joined via the URL guard: the result must stay on the base origin and path.
+        const url = (0, url_1.safeJoinUrl)(__classPrivateFieldGet(this, _ProfileHttp_base, "f"), qs ? `${path}?${qs}` : path, 'profile URL', urlError);
+        // For error messages: method + path only (the query may carry PII such as email).
+        const where = `${method} ${__classPrivateFieldGet(this, _ProfileHttp_base, "f").pathPrefix}${path}`;
+        const hasBody = opts.body !== undefined;
+        // Serialise once, up front: a bad body fails here with nothing sent.
+        let payload;
+        if (hasBody) {
+            try {
+                payload = JSON.stringify(opts.body);
+            }
+            catch (err) {
+                const e = new errors_1.HawcxError(`request body is not JSON-serialisable: ${err.message}`);
+                e.cause = err;
+                throw e;
+            }
+            if (payload === undefined)
+                throw new errors_1.HawcxError('request body is not JSON-serialisable');
+        }
+        const retryable = RETRY_METHODS.has(method);
+        let attempt = 0;
+        let replayed = false;
+        // Sticky for the whole call: some earlier attempt may have run server-side
+        // (sent with no HTTP response back, a 2xx whose body failed mid-read, or a
+        // 504 from the gateway).
+        let mayHaveRun = false;
+        // The 401 being replayed, while its fresh token is minted.
+        let unauthorized = null;
+        for (;;) {
+            let token;
+            try {
+                token = await o.tokens.getToken();
+            }
+            catch (err) {
+                // Nothing was sent to the profile service, so any method may retry
+                // (POST/PATCH included); it spends the same budget.
+                const transient = transientTokenError(err);
+                if (attempt < o.maxRetries && transient) {
+                    await o.sleep(backoff(attempt++));
+                    continue;
+                }
+                if (unauthorized !== null && !transient) {
+                    unauthorized.cause = err;
+                    throw unauthorized;
+                }
+                throw err;
+            }
+            unauthorized = null;
+            const headers = {
+                Authorization: `Bearer ${token}`,
+                'X-Config-Id': o.configId,
+                Accept: 'application/json',
+            };
+            if (hasBody)
+                headers['Content-Type'] = 'application/json';
+            let res;
+            let text = '';
+            let gotStatus = false;
+            try {
+                res = await o.fetch(url, {
+                    method,
+                    headers,
+                    body: payload,
+                    // A bearer token must never be replayed to wherever a 3xx points.
+                    redirect: 'manual',
+                    signal: AbortSignal.timeout(o.timeout),
+                });
+                gotStatus = true;
+                // A 2xx body that fails mid-read is a transport failure, like a dropped connection.
+                if (res.status >= 200 && res.status < 300 && res.status !== 204)
+                    text = await res.text();
+            }
+            catch (err) {
+                // Once a status line arrived the request was sent; only a fetch()
+                // rejection can be a connect-phase failure.
+                if (gotStatus || !nothingSent(err))
+                    mayHaveRun = true;
+                if (retryable && attempt < o.maxRetries) {
+                    await o.sleep(backoff(attempt++));
+                    continue;
+                }
+                const name = err?.name ?? 'Error';
+                // A 2xx arrived, so the call ran (a POST may have created the record):
+                // keep its status so the caller doesn't read it as "never connected".
+                const e = gotStatus
+                    ? new errors_2.ProfileApiError({
+                        status: res.status,
+                        title: 'Response body read failed',
+                        detail: name,
+                        requestId: (0, errors_2.requestIdFrom)(res.headers, null),
+                    })
+                    : new errors_2.ProfileApiError({ status: 0, title: name }, `0 ${name === 'TimeoutError' ? 'request timed out' : `network error (${name})`}: ${where}`);
+                e.cause = err;
+                throw e;
+            }
+            // Auth runs before any handler, so a 401 never mutated state: replay once.
+            if (res.status === 401 && !replayed) {
+                replayed = true;
+                if (o.surface401) {
+                    unauthorized = (0, errors_2.parseProblem)(401, res.headers, await res.text().catch(() => ''));
+                }
+                else {
+                    await res.body?.cancel().catch(() => { });
+                }
+                o.tokens.invalidate(token);
+                continue;
+            }
+            if (res.status >= 200 && res.status < 300) {
+                // Only DELETE (deleteUser) returns nothing: any 2xx is success, body ignored.
+                // Every other method promises a body.
+                if (method === 'DELETE')
+                    return null;
+                if (res.status === 204) {
+                    throw new errors_2.ProfileApiError({
+                        status: 204,
+                        title: 'Unexpected response body',
+                        requestId: (0, errors_2.requestIdFrom)(res.headers, null),
+                    });
+                }
+                let data;
+                let title = 'Invalid JSON response';
+                let parsed = false;
+                try {
+                    data = JSON.parse(text);
+                    parsed = true;
+                    if ((opts.valid ?? exports.isObject)(data))
+                        return data;
+                    title = 'Unexpected response body';
+                }
+                catch {
+                    // not JSON
+                }
+                throw new errors_2.ProfileApiError({
+                    status: res.status,
+                    title,
+                    requestId: (0, errors_2.requestIdFrom)(res.headers, (0, exports.isObject)(data) ? data : null),
+                    // Kept only for a markup page (a gateway or portal, starting with
+                    // '<'): any other unparseable 2xx may be a mangled profile, i.e. PII.
+                    rawBody: !parsed && /^[\s\uFEFF]*</.test(text) ? (0, errors_2.capRawBody)(text) : null,
+                });
+            }
+            // An earlier attempt may have deleted it; later answers can't rule that out.
+            if (method === 'DELETE' && res.status === 404 && mayHaveRun) {
+                await res.body?.cancel().catch(() => { });
+                return null;
+            }
+            // 504: the upstream may have run it. 502 is ambiguous too (nginx also
+            // sends it when the upstream closed mid-request), but a false "deleted"
+            // is worse than a false 404, so 502 does not set the flag.
+            if (res.status === 504)
+                mayHaveRun = true;
+            const err = (0, errors_2.parseProblem)(res.status, res.headers, await res.text().catch(() => ''));
+            if (retryable && RETRY_STATUS.has(res.status) && attempt < o.maxRetries) {
+                await o.sleep(err.retryAfter !== null
+                    ? Math.min(err.retryAfter * 1000, RETRY_AFTER_CAP_MS)
+                    : backoff(attempt));
+                attempt++;
+                continue;
+            }
+            throw err;
+        }
+    }
+}
+exports.ProfileHttp = ProfileHttp;
+_ProfileHttp_o = new WeakMap(), _ProfileHttp_base = new WeakMap();
+/**
+ * Did this fetch rejection happen before anything was sent? Checked on the
+ * error and on its `cause` (undici), reading `code` or a string `errno`
+ * (node-fetch) together with `syscall`:
+ * - syscall `connect` / `getaddrinfo`: nothing sent, whatever the code;
+ * - no syscall: nothing sent only for DNS/connect-only and TLS handshake
+ *   codes. Routing codes (EHOSTUNREACH etc.) can also hit an established
+ *   keep-alive socket, so without syscall `connect` they may have run;
+ * - syscall `read` / `write`, ECONNRESET, timeouts and unrecognised errors:
+ *   may have run.
+ */
+const CONNECT_ONLY_CODES = new Set([
+    'ECONNREFUSED',
+    'ENOTFOUND',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'ERR_SOCKET_CONNECTION_TIMEOUT',
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'UNABLE_TO_GET_ISSUER_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+]);
+const connectOnlyCode = (code) => CONNECT_ONLY_CODES.has(code) ||
+    code.startsWith('EAI_') ||
+    code.startsWith('CERT_') ||
+    code.startsWith('ERR_TLS_') ||
+    code.startsWith('ERR_SSL_');
+function notSent(e) {
+    const code = [e?.code, e?.errno].find((c) => typeof c === 'string');
+    if (code === undefined)
+        return false;
+    const syscall = e?.syscall;
+    if (syscall === 'connect' || syscall === 'getaddrinfo')
+        return true;
+    return syscall === undefined && connectOnlyCode(code);
+}
+function nothingSent(err) {
+    const e = err;
+    return notSent(e) || notSent(e?.cause);
+}
+/** Token endpoint: no HTTP response, or 408, 429, 502, 503, 504. */
+function transientTokenError(err) {
+    return (err instanceof errors_1.TokenExchangeError && (err.network || RETRY_STATUS.has(err.statusCode ?? -1)));
+}
+/** Full jitter: uniform in [0, min(cap, base * 2^attempt)]. */
+function backoff(attempt) {
+    return Math.random() * Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * 2 ** attempt);
+}
+//# sourceMappingURL=http.js.map

package/dist/profile/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/profile/http.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA+DA,0BAcC;AA7ED;;;;;GAKG;AACH,sCAA2D;AAC3D,yCAAsF;AACtF,qCAAoF;AAsCpF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACxD,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,cAAc,GAAG,IAAK,CAAC;AAE7B,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,mBAAU,CAAC,OAAO,CAAC,CAAC;AAEvD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CACnE,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAD9C,QAAA,QAAQ,YACsC;AAE3D;;;;;GAKG;AACH,SAAgB,OAAO,CAAC,KAAa,EAAE,IAAY;IACjD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,EAAE;QACZ,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,IAAI;QACd,4CAA4C;QAC5C,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,mBAAU,CAClB,GAAG,IAAI,6FAA6F,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAa,WAAW;IAItB,YAAY,OAA2B;QAH9B,iCAA0E;QAC1E,oCAAqB;QAG5B,uBAAA,IAAI,kBAAM;YACR,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAM;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACnE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;YAC7B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK;SACxC,MAAA,CAAC;QACF,uBAAA,IAAI,qBAAS,IAAA,wBAAkB,EAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAA,CAAC;IACxE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,QAAkB,EAClB,OAAuB,EAAE;QAEzB,MAAM,CAAC,GAAG,uBAAA,IAAI,sBAAG,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,8EAA8E;QAC9E,MAAM,GAAG,GAAG,IAAA,iBAAW,EAAC,uBAAA,IAAI,yBAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC1F,kFAAkF;QAClF,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,uBAAA,IAAI,yBAAM,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;QACxC,qEAAqE;QACrE,IAAI,OAA2B,CAAC;QAChC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,IAAI,mBAAU,CACtB,0CAA2C,GAAa,CAAC,OAAO,EAAE,CACnE,CAAC;gBACD,CAAyB,CAAC,KAAK,GAAG,GAAG,CAAC;gBACvC,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,mBAAU,CAAC,uCAAuC,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE5C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,2EAA2E;QAC3E,2EAA2E;QAC3E,yBAAyB;QACzB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,2DAA2D;QAC3D,IAAI,YAAY,GAA2B,IAAI,CAAC;QAChD,SAAS,CAAC;YACR,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mEAAmE;gBACnE,oDAAoD;gBACpD,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,OAAO,GAAG,CAAC,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;oBACxC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAClC,SAAS;gBACX,CAAC;gBACD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACvC,YAAoC,CAAC,KAAK,GAAG,GAAG,CAAC;oBAClD,MAAM,YAAY,CAAC;gBACrB,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM,OAAO,GAA2B;gBACtC,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,aAAa,EAAE,CAAC,CAAC,QAAQ;gBACzB,MAAM,EAAE,kBAAkB;aAC3B,CAAC;YACF,IAAI,OAAO;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAE1D,IAAI,GAAa,CAAC;YAClB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACvB,MAAM;oBACN,OAAO;oBACP,IAAI,EAAE,OAAO;oBACb,kEAAkE;oBAClE,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;iBACvC,CAAC,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC;gBACjB,oFAAoF;gBACpF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,4CAA4C;gBAC5C,IAAI,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBAAE,UAAU,GAAG,IAAI,CAAC;gBACtD,IAAI,SAAS,IAAI,OAAO,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;oBACxC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAClC,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAI,GAAa,EAAE,IAAI,IAAI,OAAO,CAAC;gBAC7C,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,CAAC,GAAG,SAAS;oBACjB,CAAC,CAAC,IAAI,wBAAe,CAAC;wBAClB,MAAM,EAAE,GAAI,CAAC,MAAM;wBACnB,KAAK,EAAE,2BAA2B;wBAClC,MAAM,EAAE,IAAI;wBACZ,SAAS,EAAE,IAAA,sBAAa,EAAC,GAAI,CAAC,OAAO,EAAE,IAAI,CAAC;qBAC7C,CAAC;oBACJ,CAAC,CAAC,IAAI,wBAAe,CACjB,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAC1B,KAAK,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,IAAI,GAAG,KAAK,KAAK,EAAE,CAC3F,CAAC;gBACL,CAAyB,CAAC,KAAK,GAAG,GAAG,CAAC;gBACvC,MAAM,CAAC,CAAC;YACV,CAAC;YAED,2EAA2E;YAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;oBACjB,YAAY,GAAG,IAAA,qBAAY,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClF,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBACD,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1C,8EAA8E;gBAC9E,sCAAsC;gBACtC,IAAI,MAAM,KAAK,QAAQ;oBAAE,OAAO,IAAS,CAAC;gBAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvB,MAAM,IAAI,wBAAe,CAAC;wBACxB,MAAM,EAAE,GAAG;wBACX,KAAK,EAAE,0BAA0B;wBACjC,SAAS,EAAE,IAAA,sBAAa,EAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;qBAC5C,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,IAAa,CAAC;gBAClB,IAAI,KAAK,GAAG,uBAAuB,CAAC;gBACpC,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACxB,MAAM,GAAG,IAAI,CAAC;oBACd,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,gBAAQ,CAAC,CAAC,IAAI,CAAC;wBAAE,OAAO,IAAS,CAAC;oBACrD,KAAK,GAAG,0BAA0B,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW;gBACb,CAAC;gBACD,MAAM,IAAI,wBAAe,CAAC;oBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,KAAK;oBACL,SAAS,EAAE,IAAA,sBAAa,EAAC,GAAG,CAAC,OAAO,EAAE,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBACnE,kEAAkE;oBAClE,sEAAsE;oBACtE,OAAO,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;iBACzE,CAAC,CAAC;YACL,CAAC;YAED,6EAA6E;YAC7E,IAAI,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC5D,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACzC,OAAO,IAAS,CAAC;YACnB,CAAC;YAED,sEAAsE;YACtE,wEAAwE;YACxE,2DAA2D;YAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,UAAU,GAAG,IAAI,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAA,qBAAY,EAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,IAAI,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;gBACxE,MAAM,CAAC,CAAC,KAAK,CACX,GAAG,CAAC,UAAU,KAAK,IAAI;oBACrB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,kBAAkB,CAAC;oBACrD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CACrB,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAvMD,kCAuMC;;AAED;;;;;;;;;;GAUG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,cAAc;IACd,WAAW;IACX,yBAAyB;IACzB,+BAA+B;IAC/B,6BAA6B;IAC7B,2BAA2B;IAC3B,iCAAiC;IACjC,2BAA2B;IAC3B,mCAAmC;CACpC,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,EAAE,CACvC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;IACvB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;IACxB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAE9B,SAAS,OAAO,CAAC,CAA8B;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACjF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,CAAC,EAAE,OAAO,CAAC;IAC3B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AACD,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,GAA+C,CAAC;IAC1D,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,GAAY;IACvC,OAAO,CACL,GAAG,YAAY,2BAAkB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;AAClF,CAAC"}

package/dist/profile/tokens.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The token-endpoint poster, i.e. `HawcxOAuth.postTokenForm` (adds
+ * `client_id` + `client_assertion`, `X-Config-Id`, no redirects, error mapping).
+ */
+export interface TokenPoster {
+    postTokenForm(body: URLSearchParams, options?: {
+        fetch?: typeof fetch;
+        timeout?: number;
+    }): Promise<Record<string, unknown>>;
+}
+export interface TokenSourceOptions {
+    fetch?: typeof fetch;
+    /** Token request timeout in ms (default: the HawcxOAuth client's `timeout`). */
+    timeout?: number;
+    /** Clock in ms; injectable for tests. */
+    now?: () => number;
+    /** Refresh before expiry (default true). Token exchange: false, re-exchanging can't extend it. */
+    refreshEarly?: boolean;
+}
+export declare const DEFAULT_PROFILE_AUDIENCE = "hx-profile";
+/**
+ * Caches one access token and refreshes it at
+ * `expiry - min(60 s, expires_in / 2)` (at expiry with `refreshEarly: false`);
+ * expiry is counted from when the request was sent. Concurrent callers share a
+ * single in-flight request. An early refresh runs in the background: every
+ * caller, the one that started it included, gets the still-valid cached token.
+ * If it fails (any error), the cached token stays in use and the next early
+ * attempt waits 30 s (or until expiry, if sooner). Token material
+ * lives in `#private` fields so it never shows up in `JSON.stringify` /
+ * `util.inspect`.
+ */
+export declare class TokenSource {
+    #private;
+    constructor(oauth: TokenPoster, grant: Record<string, string>, options?: TokenSourceOptions);
+    getToken(): Promise<string>;
+    /**
+     * Drop the cached token (e.g. after a 401) so the next call mints a new one.
+     * With `stale`, only if it is still the cached token: a concurrent refresh is kept.
+     */
+    invalidate(stale?: string): void;
+}
+/** `client_credentials`; `scope` is sent only when `scopes` is given (absent ⇒ all allowed scopes; `[]` throws). */
+export declare function machineTokenSource(oauth: TokenPoster, options?: TokenSourceOptions & {
+    scopes?: readonly string[];
+}): TokenSource;
+/** RFC 8693 exchange of the user's ID token (aud = this client) for a `profile:self` token. */
+export declare function exchangeTokenSource(oauth: TokenPoster, idToken: string, options?: TokenSourceOptions & {
+    audience?: string;
+}): TokenSource;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/profile/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/profile/tokens.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,aAAa,CACX,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,kGAAkG;IAClG,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAIrD;;;;;;;;;;GAUG;AACH,qBAAa,WAAW;;gBAWV,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAE,kBAAuB;IAQ/F,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IA6B3B;;;OAGG;IACH,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;CAwBjC;AAED,oHAAoH;AACpH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,kBAAkB,GAAG;IAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAChE,WAAW,CAWb;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAkB,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACvD,WAAW,CAcb"}

package/dist/profile/tokens.js

@@ -0,0 +1,137 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _TokenSource_instances, _TokenSource_oauth, _TokenSource_grant, _TokenSource_options, _TokenSource_now, _TokenSource_refreshEarly, _TokenSource_token, _TokenSource_refreshAt, _TokenSource_expiresAt, _TokenSource_pending, _TokenSource_start, _TokenSource_mint;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenSource = exports.DEFAULT_PROFILE_AUDIENCE = void 0;
+exports.machineTokenSource = machineTokenSource;
+exports.exchangeTokenSource = exchangeTokenSource;
+/**
+ * Access tokens for the profile service, minted at the OP token endpoint with
+ * `private_key_jwt` (RFC 7523): `client_credentials` (RFC 6749 §4.4) for the
+ * machine client, RFC 8693 token exchange of an ID token for the delegated one.
+ */
+const errors_1 = require("../errors");
+exports.DEFAULT_PROFILE_AUDIENCE = 'hx-profile';
+const MAX_SKEW_MS = 60000;
+const EARLY_REFRESH_BACKOFF_MS = 30000;
+/**
+ * Caches one access token and refreshes it at
+ * `expiry - min(60 s, expires_in / 2)` (at expiry with `refreshEarly: false`);
+ * expiry is counted from when the request was sent. Concurrent callers share a
+ * single in-flight request. An early refresh runs in the background: every
+ * caller, the one that started it included, gets the still-valid cached token.
+ * If it fails (any error), the cached token stays in use and the next early
+ * attempt waits 30 s (or until expiry, if sooner). Token material
+ * lives in `#private` fields so it never shows up in `JSON.stringify` /
+ * `util.inspect`.
+ */
+class TokenSource {
+    constructor(oauth, grant, options = {}) {
+        _TokenSource_instances.add(this);
+        _TokenSource_oauth.set(this, void 0);
+        _TokenSource_grant.set(this, void 0);
+        _TokenSource_options.set(this, void 0);
+        _TokenSource_now.set(this, void 0);
+        _TokenSource_refreshEarly.set(this, void 0);
+        _TokenSource_token.set(this, null);
+        _TokenSource_refreshAt.set(this, 0);
+        _TokenSource_expiresAt.set(this, 0);
+        _TokenSource_pending.set(this, null);
+        __classPrivateFieldSet(this, _TokenSource_oauth, oauth, "f");
+        __classPrivateFieldSet(this, _TokenSource_grant, grant, "f");
+        __classPrivateFieldSet(this, _TokenSource_options, { fetch: options.fetch, timeout: options.timeout }, "f");
+        __classPrivateFieldSet(this, _TokenSource_now, options.now ?? Date.now, "f");
+        __classPrivateFieldSet(this, _TokenSource_refreshEarly, options.refreshEarly ?? true, "f");
+    }
+    getToken() {
+        const token = __classPrivateFieldGet(this, _TokenSource_token, "f");
+        const now = __classPrivateFieldGet(this, _TokenSource_now, "f").call(this);
+        if (token !== null && now < __classPrivateFieldGet(this, _TokenSource_expiresAt, "f")) {
+            // Early refresh: in the background, nobody waits on it.
+            if (now >= __classPrivateFieldGet(this, _TokenSource_refreshAt, "f") && __classPrivateFieldGet(this, _TokenSource_pending, "f") === null)
+                __classPrivateFieldGet(this, _TokenSource_instances, "m", _TokenSource_start).call(this).catch(() => { });
+            return Promise.resolve(token);
+        }
+        return __classPrivateFieldGet(this, _TokenSource_pending, "f") ?? __classPrivateFieldGet(this, _TokenSource_instances, "m", _TokenSource_start).call(this);
+    }
+    /**
+     * Drop the cached token (e.g. after a 401) so the next call mints a new one.
+     * With `stale`, only if it is still the cached token: a concurrent refresh is kept.
+     */
+    invalidate(stale) {
+        if (stale === undefined || __classPrivateFieldGet(this, _TokenSource_token, "f") === stale)
+            __classPrivateFieldSet(this, _TokenSource_token, null, "f");
+    }
+}
+exports.TokenSource = TokenSource;
+_TokenSource_oauth = new WeakMap(), _TokenSource_grant = new WeakMap(), _TokenSource_options = new WeakMap(), _TokenSource_now = new WeakMap(), _TokenSource_refreshEarly = new WeakMap(), _TokenSource_token = new WeakMap(), _TokenSource_refreshAt = new WeakMap(), _TokenSource_expiresAt = new WeakMap(), _TokenSource_pending = new WeakMap(), _TokenSource_instances = new WeakSet(), _TokenSource_start = function _TokenSource_start() {
+    __classPrivateFieldSet(this, _TokenSource_pending, __classPrivateFieldGet(this, _TokenSource_instances, "m", _TokenSource_mint).call(this)
+        .catch((e) => {
+        // Early refresh failed: keep the still-valid token, back off.
+        const t = __classPrivateFieldGet(this, _TokenSource_token, "f");
+        const now = __classPrivateFieldGet(this, _TokenSource_now, "f").call(this);
+        if (t !== null && now < __classPrivateFieldGet(this, _TokenSource_expiresAt, "f")) {
+            __classPrivateFieldSet(this, _TokenSource_refreshAt, Math.min(now + EARLY_REFRESH_BACKOFF_MS, __classPrivateFieldGet(this, _TokenSource_expiresAt, "f")), "f");
+            return t;
+        }
+        throw e;
+    })
+        .finally(() => {
+        __classPrivateFieldSet(this, _TokenSource_pending, null, "f");
+    }), "f");
+    return __classPrivateFieldGet(this, _TokenSource_pending, "f");
+}, _TokenSource_mint = async function _TokenSource_mint() {
+    const sentAt = __classPrivateFieldGet(this, _TokenSource_now, "f").call(this);
+    // Fresh form (and so a fresh assertion / jti) per request.
+    const data = await __classPrivateFieldGet(this, _TokenSource_oauth, "f").postTokenForm(new URLSearchParams(__classPrivateFieldGet(this, _TokenSource_grant, "f")), __classPrivateFieldGet(this, _TokenSource_options, "f"));
+    const token = data.access_token;
+    if (typeof token !== 'string' || token === '') {
+        throw new errors_1.TokenExchangeError('Token response missing access_token');
+    }
+    // Numeric strings accepted; anything not finite and positive caches nothing
+    // (every call re-mints).
+    const raw = data.expires_in;
+    const seconds = typeof raw === 'number' || typeof raw === 'string' ? Number(raw) : NaN;
+    const lifetimeMs = Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : 0;
+    __classPrivateFieldSet(this, _TokenSource_token, token, "f");
+    __classPrivateFieldSet(this, _TokenSource_expiresAt, sentAt + lifetimeMs, "f");
+    __classPrivateFieldSet(this, _TokenSource_refreshAt, __classPrivateFieldGet(this, _TokenSource_refreshEarly, "f")
+        ? __classPrivateFieldGet(this, _TokenSource_expiresAt, "f") - Math.min(MAX_SKEW_MS, lifetimeMs / 2)
+        : __classPrivateFieldGet(this, _TokenSource_expiresAt, "f"), "f");
+    return token;
+};
+/** `client_credentials`; `scope` is sent only when `scopes` is given (absent ⇒ all allowed scopes; `[]` throws). */
+function machineTokenSource(oauth, options = {}) {
+    const grant = { grant_type: 'client_credentials' };
+    if (options.scopes !== undefined) {
+        if (options.scopes.length === 0) {
+            throw new errors_1.HawcxError("scopes is empty: omit scopes to use the client's default, or pass at least one scope");
+        }
+        grant.scope = options.scopes.join(' ');
+    }
+    return new TokenSource(oauth, grant, options);
+}
+/** RFC 8693 exchange of the user's ID token (aud = this client) for a `profile:self` token. */
+function exchangeTokenSource(oauth, idToken, options = {}) {
+    return new TokenSource(oauth, {
+        grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+        subject_token: idToken,
+        subject_token_type: 'urn:ietf:params:oauth:token-type:id_token',
+        requested_token_type: 'urn:ietf:params:oauth:token-type:access_token',
+        audience: options.audience ?? exports.DEFAULT_PROFILE_AUDIENCE,
+        scope: 'profile:self',
+    }, 
+    // The OP caps exp at the ID token's: an early re-exchange can't extend it.
+    { ...options, refreshEarly: false });
+}
+//# sourceMappingURL=tokens.js.map

package/dist/profile/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/profile/tokens.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA0HA,gDAcC;AAGD,kDAkBC;AA7JD;;;;GAIG;AACH,sCAA2D;AAuB9C,QAAA,wBAAwB,GAAG,YAAY,CAAC;AACrD,MAAM,WAAW,GAAG,KAAM,CAAC;AAC3B,MAAM,wBAAwB,GAAG,KAAM,CAAC;AAExC;;;;;;;;;;GAUG;AACH,MAAa,WAAW;IAWtB,YAAY,KAAkB,EAAE,KAA6B,EAAE,UAA8B,EAAE;;QAVtF,qCAAoB;QACpB,qCAA+B;QAC/B,uCAA6B;QAC7B,mCAAmB;QACnB,4CAAuB;QAChC,6BAAwB,IAAI,EAAC;QAC7B,iCAAa,CAAC,EAAC;QACf,iCAAa,CAAC,EAAC;QACf,+BAAmC,IAAI,EAAC;QAGtC,uBAAA,IAAI,sBAAU,KAAK,MAAA,CAAC;QACpB,uBAAA,IAAI,sBAAU,KAAK,MAAA,CAAC;QACpB,uBAAA,IAAI,wBAAY,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAA,CAAC;QACnE,uBAAA,IAAI,oBAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,MAAA,CAAC;QACpC,uBAAA,IAAI,6BAAiB,OAAO,CAAC,YAAY,IAAI,IAAI,MAAA,CAAC;IACpD,CAAC;IAED,QAAQ;QACN,MAAM,KAAK,GAAG,uBAAA,IAAI,0BAAO,CAAC;QAC1B,MAAM,GAAG,GAAG,uBAAA,IAAI,wBAAK,MAAT,IAAI,CAAO,CAAC;QACxB,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,GAAG,uBAAA,IAAI,8BAAW,EAAE,CAAC;YAC5C,wDAAwD;YACxD,IAAI,GAAG,IAAI,uBAAA,IAAI,8BAAW,IAAI,uBAAA,IAAI,4BAAS,KAAK,IAAI;gBAAE,uBAAA,IAAI,kDAAO,MAAX,IAAI,CAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpF,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,uBAAA,IAAI,4BAAS,IAAI,uBAAA,IAAI,kDAAO,MAAX,IAAI,CAAS,CAAC;IACxC,CAAC;IAoBD;;;OAGG;IACH,UAAU,CAAC,KAAc;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,uBAAA,IAAI,0BAAO,KAAK,KAAK;YAAE,uBAAA,IAAI,sBAAU,IAAI,MAAA,CAAC;IACvE,CAAC;CAsBF;AA5ED,kCA4EC;;IA7CG,uBAAA,IAAI,wBAAY,uBAAA,IAAI,iDAAM,MAAV,IAAI,CAAQ;SACzB,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QACpB,8DAA8D;QAC9D,MAAM,CAAC,GAAG,uBAAA,IAAI,0BAAO,CAAC;QACtB,MAAM,GAAG,GAAG,uBAAA,IAAI,wBAAK,MAAT,IAAI,CAAO,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,GAAG,uBAAA,IAAI,8BAAW,EAAE,CAAC;YACxC,uBAAA,IAAI,0BAAc,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,wBAAwB,EAAE,uBAAA,IAAI,8BAAW,CAAC,MAAA,CAAC;YAC5E,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,uBAAA,IAAI,wBAAY,IAAI,MAAA,CAAC;IACvB,CAAC,CAAC,MAAA,CAAC;IACL,OAAO,uBAAA,IAAI,4BAAS,CAAC;AACvB,CAAC,sBAUD,KAAK;IACH,MAAM,MAAM,GAAG,uBAAA,IAAI,wBAAK,MAAT,IAAI,CAAO,CAAC;IAC3B,2DAA2D;IAC3D,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,0BAAO,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,uBAAA,IAAI,0BAAO,CAAC,EAAE,uBAAA,IAAI,4BAAS,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,2BAAkB,CAAC,qCAAqC,CAAC,CAAC;IACtE,CAAC;IACD,4EAA4E;IAC5E,yBAAyB;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvF,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,uBAAA,IAAI,sBAAU,KAAK,MAAA,CAAC;IACpB,uBAAA,IAAI,0BAAc,MAAM,GAAG,UAAU,MAAA,CAAC;IACtC,uBAAA,IAAI,0BAAc,uBAAA,IAAI,iCAAc;QAClC,CAAC,CAAC,uBAAA,IAAI,8BAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG,CAAC,CAAC;QACzD,CAAC,CAAC,uBAAA,IAAI,8BAAW,MAAA,CAAC;IACpB,OAAO,KAAK,CAAC;AACf,CAAC;AAGH,oHAAoH;AACpH,SAAgB,kBAAkB,CAChC,KAAkB,EAClB,UAA+D,EAAE;IAEjE,MAAM,KAAK,GAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,mBAAU,CAClB,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,+FAA+F;AAC/F,SAAgB,mBAAmB,CACjC,KAAkB,EAClB,OAAe,EACf,UAAsD,EAAE;IAExD,OAAO,IAAI,WAAW,CACpB,KAAK,EACL;QACE,UAAU,EAAE,iDAAiD;QAC7D,aAAa,EAAE,OAAO;QACtB,kBAAkB,EAAE,2CAA2C;QAC/D,oBAAoB,EAAE,+CAA+C;QACrE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,gCAAwB;QACtD,KAAK,EAAE,cAAc;KACtB;IACD,2EAA2E;IAC3E,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CACpC,CAAC;AACJ,CAAC"}

package/dist/profile/types.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Profile service wire models. Field names are snake_case exactly as on the
+ * wire; unknown response fields are passed through untouched.
+ */
+export interface Profile {
+    tenant_id: string;
+    user_id: string;
+    email?: string | null;
+    email_verified: boolean;
+    phone?: string | null;
+    phone_verified: boolean;
+    given_name?: string | null;
+    family_name?: string | null;
+    display_name?: string | null;
+    date_of_birth?: string | null;
+    address?: Record<string, unknown> | null;
+    locale?: string | null;
+    timezone?: string | null;
+    marketing_opt_in: boolean;
+    custom_attributes: Record<string, unknown>;
+    status: string;
+    created_at: string;
+    updated_at: string;
+}
+export interface Consent {
+    consent_id: string;
+    purpose: string;
+    status: string;
+    lawful_basis?: string | null;
+    notice_version?: string | null;
+    source?: string | null;
+    created_at: string;
+}
+export interface AuditEvent {
+    event_id: string;
+    actor: string;
+    action: string;
+    resource: string;
+    before_hash?: string | null;
+    after_hash?: string | null;
+    detail?: unknown;
+    created_at: string;
+}
+export interface Page<T> {
+    items: T[];
+    /** Pass back as `cursor` for the next page; `null` on the last page. */
+    nextCursor: string | null;
+}
+export interface ConsentsPage {
+    /** Latest consent per purpose. */
+    current: Record<string, Consent>;
+    history: Consent[];
+    nextCursor: string | null;
+}
+/** Writable profile fields for the delegated `updateMe`. `null` clears, omitted = unchanged. */
+export type MyProfilePatch = Partial<{
+    given_name: string | null;
+    family_name: string | null;
+    display_name: string | null;
+    date_of_birth: string | null;
+    address: Record<string, unknown> | null;
+    locale: string | null;
+    timezone: string | null;
+}>;
+/** PATCH body for `updateUser`: `null` clears a field, an omitted key is left unchanged. */
+export type ProfilePatch = MyProfilePatch & {
+    status?: string;
+};
+/** PUT body for `replaceUser`. */
+export interface ReplaceUserInput {
+    given_name: string;
+    family_name: string;
+    display_name?: string | null;
+    date_of_birth?: string | null;
+    address?: Record<string, unknown> | null;
+    locale?: string | null;
+    timezone?: string | null;
+    status?: string;
+}
+/** POST body for `createUser`; the identity `user_id` must already exist. */
+export interface CreateUserInput extends ReplaceUserInput {
+    user_id: string;
+}
+export interface ConsentInput {
+    status: 'granted' | 'withdrawn';
+    lawful_basis?: string;
+    notice_version?: string;
+    source?: string;
+}
+export interface PageOptions {
+    cursor?: string;
+    /** 1–200, server default 50. */
+    limit?: number;
+}
+export interface ListUsersOptions extends PageOptions {
+    email?: string;
+    status?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/profile/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/profile/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,IAAI,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,wEAAwE;IACxE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,MAAM,YAAY,GAAG,cAAc,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,kCAAkC;AAClC,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/profile/types.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Profile service wire models. Field names are snake_case exactly as on the
+ * wire; unknown response fields are passed through untouched.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/profile/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/profile/types.ts"],"names":[],"mappings":";AAAA;;;GAGG"}

package/dist/stepup/client.d.ts

@@ -34,6 +34,17 @@ export interface StepUpClientPrivateKeyJwtOptions extends StepUpClientBaseOption
     apiKey?: string;
     /** JWT time-to-live in seconds (default: 60). */
     jwtTtlSeconds?: number;
+    /**
+     * OIDC issuer whose `/.well-known/jwks.json` verifies response signatures
+     * (default: `baseUrl`).  See {@link JwtBearerTransportOptions.issuer}.
+     */
+    issuer?: string;
+    /**
+     * Verify `X-Response-Signature` on every successful response (default:
+     * `true`).  Emergency escape hatch only — see
+     * {@link JwtBearerTransportOptions.verifyResponseSignature}.
+     */
+    verifyResponseSignature?: boolean;
 }
 export declare class StepUpClient {
     private transport;