@hawcx/oauth-client 6.0.0 → 6.2.0

package/CHANGELOG.md

@@ -7,6 +7,135 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.2.0] - 2026-11-02
+
+Additive, apart from these `exchangeCode` / token-endpoint behaviour changes
+(details under Changed): a 3xx from the token endpoint is no longer followed
+and throws `TokenExchangeError`; a 2xx token response that is not a JSON
+object throws `TokenExchangeError` instead of a raw `SyntaxError`/`TypeError`
+(or being returned as-is); a 2xx body cut off mid-read throws a network
+`TokenExchangeError` carrying that 2xx `statusCode`.
+
+### Added
+
+- **Profile service client.** `ProfileClient` (`oauth.profile(options?)` or
+  `new ProfileClient(oauth, options?)`), built from a discovery-mode
+  `HawcxOAuth` with a `private_key_jwt` signer. Machine methods (RFC 6749 §4.4
+  `client_credentials`): `getUser`, `listUsers`/`iterUsers`, `createUser`,
+  `updateUser`, `replaceUser`, `deleteUser`, `getConsents`, `setConsent`,
+  `getAudit`/`iterAudit`. `forUser(idToken)` returns a `UserProfileClient`
+  (RFC 8693 exchange of the ID token for a `profile:self` token): `getMe`,
+  `updateMe`, `getMyConsents`, `setMyConsent`, `getMyAudit`/`iterMyAudit`.
+  Tokens are cached with early refresh and single-flight minting; expiry is
+  counted from when the token request was sent. The early refresh runs in the
+  background, so every caller (the one that triggered it included) gets the
+  still-valid cached token; if it fails (any error, e.g. a signer error too)
+  that token stays in use and no other early refresh is tried for 30 s (or
+  until expiry, if sooner). `forUser` tokens are not refreshed early (the OP
+  caps their `exp` at the ID token's), only at expiry. A 401 is
+  replayed once with a fresh token; for `forUser`, if that re-exchange fails
+  with a non-transient token error (e.g. `invalid_grant`, the ID token has
+  expired), the original 401 `ProfileApiError` is thrown (token error as
+  `cause`); GET/PUT/DELETE retry on transient
+  failures (Retry-After honoured, capped at 30 s); a token-endpoint network
+  error, 408, 429, 502, 503 or 504 is retried for every method within the same
+  budget (no profile request was sent), with backoff only (its Retry-After is
+  ignored); POST/PATCH are otherwise never
+  retried; a DELETE answered 404 counts as success once any earlier attempt of
+  the call may have run (no HTTP response, or 504; not 502, which is
+  ambiguous but left out because a false "deleted" is worse). Errors that
+  mean nothing was sent do not count: `fetch()` rejecting with a connect/DNS
+  or TLS-handshake code (ECONNREFUSED, ENOTFOUND, EAI_*, connect timeouts,
+  CERT_*/ERR_TLS_*/ERR_SSL_*), or a routing code (EHOSTUNREACH, ENETUNREACH,
+  EHOSTDOWN, ENETDOWN, EADDRNOTAVAIL) with `syscall: 'connect'`; an injected
+  `fetch` whose errors carry none of these counts as may-have-run. A failure
+  reading a 2xx body always counts, and its error keeps the 2xx status
+  (title `Response body read failed`) rather than 0, since the call ran.
+  Redirects are not
+  followed; path parameters, and `createUser`'s `user_id`, must be one segment
+  (`/`, `\` and control characters refused). `deleteUser` counts any 2xx as
+  success, whatever its body (empty, whitespace, not JSON, not an object).
+  Iterators stop on a null, missing or empty-string `next_cursor`. An
+  explicitly empty `scopes` list throws `HawcxError` when the client is built
+  (omit `scopes` for the client's default). `timeout` (default 10000) bounds
+  each token-endpoint call too, not only profile requests, whatever the
+  `HawcxOAuth` client's own `timeout`. `ProfilePatch.status` is `string` (no
+  `null`: the server answers 422 to a null status).
+- **`forUser` is for right after sign-in.** The OP caps the delegated token's
+  `exp` at the ID token's (`id_token_ttl_seconds`, 60 s by default), so pass
+  the ID token `exchangeCode` just returned; for later work on a user's
+  profile use the machine methods with their `user_id` (the `sub` claim).
+- **`ProfileApiError`** (`HawcxError` subclass) mapped from RFC 9457
+  problem+json: `status`, `title`, `detail`, `type`, `instance`, `requestId`,
+  `retryAfter`, `missing`, `fields`, `body`, `rawBody` (the body text, capped
+  at 4096 UTF-16 code units, kept out of `message`; on a malformed 2xx only
+  when the body is a markup page starting with `<`, since any other body may
+  be a mangled profile, i.e. PII). A Kong-style `{"message"}` body
+  (no non-blank `title`/`detail`) uses `message` as `detail`; `requestId`
+  falls back to the body's `request_id`. A non-204 2xx profile body that is
+  not a JSON object (or lacks a required field), and a 204, to any method but
+  `deleteUser`, throw `ProfileApiError` "Unexpected response body"; an
+  unparseable body "Invalid JSON response".
+
+### Changed
+
+- `exchangeCode` no longer follows redirects from the token endpoint: a 3xx is
+  now a `TokenExchangeError`, so the code, PKCE verifier and client assertion
+  are never re-posted to another host. A token-endpoint network error now
+  carries the underlying error as `cause` and sets the new
+  `TokenExchangeError.network` flag (`true` when no complete HTTP response
+  came back, including a 2xx body cut off mid-read, which keeps the 2xx in
+  `statusCode`). A 2xx token response
+  that was read in full but is not a JSON object now throws a non-network
+  `TokenExchangeError` ("Invalid JSON in token response") instead of a raw
+  `SyntaxError`/`TypeError`.
+
+## [6.1.0] - 2026-10-12
+
+Additive; no behaviour change for existing callers.
+
+### Added
+
+- **Custom domains.** Optional `customDomain` on
+  `HawcxOAuth.fromIssuer(...)` (e.g. `https://auth.example.com`), validated as
+  a raw string (same rules as the Python and Java SDKs): `scheme://host[:port]`
+  only, https (http only for loopback), ASCII/punycode hostname (no `*`, `_`,
+  trailing dot, numeric-looking last label) or canonical IP literal, port
+  1-65535 without leading zeros, no userinfo, path, query, fragment,
+  whitespace, `\` or `%`; IPv6 without embedded IPv4. Canonicalised
+  (lower-cased, default port dropped, IPv6 in RFC 5952 form, loopback checked
+  on the canonical host).
+  `null`/`undefined` = unset. An invalid value throws `HawcxOAuthError`
+  (`error: 'invalid_custom_domain'`) from `fromIssuer` before any fetch. It
+  changes only the browser URLs below; discovery, token exchange, JWKS and the
+  `iss` check stay on the issuer.
+- **`buildAuthorizeUrl(options)`** builds the `/authorize` URL from the
+  discovered `authorization_endpoint`: origin (custom domain if set, else the
+  endpoint's raw scheme and authority) + the
+  endpoint's raw path and query, copied verbatim, then `response_type=code`,
+  `client_id`, `redirect_uri`, `scope` (blank → `openid`), `state`,
+  `code_challenge`, `code_challenge_method=S256`, and optional `nonce`,
+  `prompt` (blank = empty or ASCII whitespace only → omitted) and `extraParams` (non-empty keys, string values,
+  insertion order kept). `extraParams` cannot set any SDK parameter, `request`
+  or `request_uri`, nor a name already in the endpoint query. Missing or blank `redirectUri` / `state` / `codeChallenge`
+  or a bad `extraParams` entry throws `HawcxOAuthError`
+  (`error: 'invalid_request'`).
+- **`buildEndSessionUrl(options?)`** builds the logout URL from the discovered
+  `end_session_endpoint` the same way; always sends `client_id`, plus
+  `post_logout_redirect_uri`, `id_token_hint` and `state` when non-blank.
+  `null` options = `{}`.
+- Both helpers are discovery-mode only (legacy mode throws `HawcxOAuthError`,
+  `error: 'issuer_mode_required'`). A discovered endpoint that is missing, not
+  https (loopback http ok), has userinfo, no host, any `#`, a character
+  outside printable ASCII or any of `` \ " < > ^ ` { | } ``, or a query that
+  already sets one of the helper's SDK parameters (authorize: also `request`,
+  `request_uri`) throws `DiscoveryError`
+  (`error: 'invalid_discovery_document'`) when the helper is called, never
+  from `fromIssuer`, so discovery documents without these fields keep working.
+- URLs are semantically, not byte-for-byte, equal across the Node, Python and
+  Java SDKs (parameter encoding differs on e.g. `~`, `*`, space).
+- New exported types `AuthorizeUrlOptions` and `EndSessionUrlOptions`.
+
 ## [6.0.0] - 2026-10-10
 
 First public release since 5.2.0. **Major version** because of the BREAKING

package/README.md

@@ -108,6 +108,7 @@ is the discovered `token_endpoint`, and EdDSA is the only accepted algorithm.
 | Module | Purpose |
 |--------|---------|
 | **OAuth** | Token exchange and JWT verification |
+| **Profile** | Hawcx profile service: users, consents, audit (machine or on behalf of a user) |
 | **Delegation** | Server-to-server user management (MFA, devices) |
 | **Step-Up** | Step-up authentication flows |
 
@@ -130,11 +131,56 @@ const oauth = await HawcxOAuth.fromIssuer({
   clientId: 'your-client-id',          // Required: expected `aud` on id_tokens
   timeout: 10000,                       // Optional: per-request timeout in ms
   discoveryTimeout: 5000,               // Optional: discovery fetch timeout in ms
+  customDomain: 'https://auth.example.com', // Optional: custom domain origin for browser URLs (a CNAME to Hawcx)
 });
 
 oauth.discoveryMetadata; // resolved OIDC discovery doc, for diagnostics
 ```
 
+`customDomain` must be `scheme://host[:port]` only: https (http only for
+loopback), an ASCII/punycode hostname (`xn--...` for IDN) or an IP literal,
+port 1-65535 without leading zeros, no userinfo, path, query or fragment (one
+trailing `/` allowed). IPv6 literals may not embed IPv4 (no `.`). It is
+canonicalised (lower-cased, default port dropped, IPv6 in RFC 5952 form, so
+`http://[0:0::1]` becomes `http://[::1]` and counts as loopback). `null`/`undefined` means unset. An invalid value (including `''`,
+whitespace, `*.example.com` or a trailing dot) throws `HawcxOAuthError`
+(`error: 'invalid_custom_domain'`) from `fromIssuer`, before any network call.
+The SDK only checks the form: `customDomain` must also be the TXT-verified
+domain registered for your client's own tenant, set up as a DNS CNAME to Hawcx
+(Hawcx serves its certificate). Another tenant's verified domain is always refused; when the tenant has
+custom-domain enforcement on, every host other than its own verified domains
+(including IP literals and single-label hosts) is refused too.
+
+##### Custom domain
+
+When you serve Hawcx sign-in on your own domain (`auth.example.com`, a DNS
+CNAME to Hawcx), the browser must go to `/authorize` and end-session on that
+domain, while token exchange, JWKS and the `iss` check stay on the Hawcx
+issuer.
+`customDomain` swaps only the scheme + host + port of the two browser URLs;
+everything server-to-server is unchanged.
+
+```typescript
+const oauth = await HawcxOAuth.fromIssuer({
+  issuer: 'https://api.hawcx.com',
+  configId: process.env.HAWCX_CONFIG_ID!,
+  clientId: process.env.HAWCX_CLIENT_ID!,
+  customDomain: 'https://auth.example.com',
+});
+
+// {issuer}/authorize → https://auth.example.com/authorize?response_type=code&client_id=...
+const loginUrl = oauth.buildAuthorizeUrl({ redirectUri, state, codeChallenge, nonce });
+
+// Token exchange still POSTs to https://api.hawcx.com/oauth2/token
+const { claims } = await oauth.exchangeCode(code, codeVerifier, redirectUri, nonce);
+
+// {issuer}/oauth2/end_session → https://auth.example.com/oauth2/end_session?client_id=...
+const logoutUrl = oauth.buildEndSessionUrl({ postLogoutRedirectUri, idTokenHint: idToken });
+```
+
+The `nonce` passed to `buildAuthorizeUrl` must be passed again to
+`exchangeCode` (4th argument).
+
 Throws `DiscoveryError` if the discovery document is unreachable, returns
 non-2xx, isn't valid JSON, or is missing any of `token_endpoint`,
 `jwks_uri`, `id_token_signing_alg_values_supported`.
@@ -209,6 +255,61 @@ interface JwtClaims {
 }
 ```
 
+#### `buildAuthorizeUrl(options: AuthorizeUrlOptions): string`
+
+Build the browser `/authorize` URL (discovery mode only; no network I/O).
+Base is the discovered `authorization_endpoint` (`{issuer}/authorize`), with
+its origin replaced by `customDomain` when set (otherwise the endpoint's scheme
+and authority are kept exactly as discovered). Its path and query are copied
+verbatim; the SDK parameters are appended after them. The URLs are
+semantically, not byte-for-byte, equal to the Python and Java SDKs' (parameter
+encoding of e.g. `~`, `*` and space differs).
+
+```typescript
+const url = oauth.buildAuthorizeUrl({
+  redirectUri: 'https://app.example.com/auth/callback', // Required
+  state,                                                 // Required
+  codeChallenge,                                         // Required (S256)
+  nonce,                                                 // Optional, recommended; pass again to exchangeCode
+  scope: 'openid email',                                 // Optional, default 'openid'
+  prompt: 'login',                                       // Optional
+  extraParams: { login_hint: 'a@example.com' },          // Optional
+});
+```
+
+Always sets `response_type=code`, `client_id` and `code_challenge_method=S256`.
+Blank (empty or ASCII-whitespace-only: space, `\t`, `\n`, `\v`, `\f`, `\r`;
+NBSP is not blank) optional values are omitted; a blank `scope`
+becomes `openid`. `extraParams` keys must be non-empty and values strings, and
+cannot be any parameter the SDK sets, `request`, `request_uri`, or a name
+already in the endpoint's query (names are case-sensitive). Throws
+`HawcxOAuthError` (`error: 'invalid_request'`) for a missing or blank required
+option or a bad `extraParams` entry, `HawcxOAuthError`
+(`error: 'issuer_mode_required'`) in legacy mode, and `DiscoveryError`
+(`error: 'invalid_discovery_document'`) if the discovered
+`authorization_endpoint` is missing, not https, has userinfo, a `#`, any
+character outside printable ASCII or any of `` \ " < > ^ ` { | } ``, or its query
+already sets one of the SDK's parameters, `request` or `request_uri`.
+
+#### `buildEndSessionUrl(options?: EndSessionUrlOptions): string`
+
+Build the browser logout URL from the discovered `end_session_endpoint`
+(`{issuer}/oauth2/end_session`, same `customDomain` origin swap). Always sends
+`client_id`; blank options are omitted. `buildEndSessionUrl(null)` is the same
+as `buildEndSessionUrl({})`.
+
+```typescript
+const url = oauth.buildEndSessionUrl({
+  postLogoutRedirectUri: 'https://app.example.com/', // Optional
+  idTokenHint: idToken,                              // Optional
+  state,                                             // Optional
+});
+```
+
+Same errors as `buildAuthorizeUrl` for legacy mode and the discovered
+`end_session_endpoint` (whose query may not set `client_id`,
+`post_logout_redirect_uri`, `id_token_hint` or `state`).
+
 #### `refreshJwks(): void`
 
 Reset the JWKS cache so the next verification refetches keys (useful for testing
@@ -251,6 +352,122 @@ try {
 
 ---
 
+## Profile Module
+
+`ProfileClient` calls the Hawcx profile service (`{issuer}/profile/v1/...`).
+Backend only: it is built from a discovery-mode `HawcxOAuth` with a
+`private_key_jwt` signer (see [Confidential clients](#confidential-clients-private_key_jwt)).
+
+Client configuration in the Hawcx admin console:
+
+- **Machine** (`ProfileClient`): `client_credentials` with
+  `allowed_scopes` covering what you call (`users:read`, `users:write`,
+  `users:delete`, `consent:read`, `consent:write`, `audit:read`).
+- **On behalf of a user** (`forUser`): `token_exchange_scopes: ["profile:self"]`,
+  and the user's ID token must have been issued to this same client.
+
+```typescript
+import { HawcxOAuth, ClientAssertionSigner, ProfileApiError } from '@hawcx/oauth-client';
+
+const oauth = (
+  await HawcxOAuth.fromIssuer({ issuer, configId, clientId })
+).withClientAssertion(ClientAssertionSigner.ed25519FromJwk(privateJwk));
+
+const profiles = oauth.profile(); // or new ProfileClient(oauth, options)
+
+// Machine: any user in the tenant
+const user = await profiles.getUser('user-123');
+await profiles.updateUser('user-123', { display_name: 'Ada', locale: null }); // null clears, omitted = unchanged
+await profiles.setConsent('user-123', 'marketing', { status: 'granted' });
+for await (const p of profiles.iterUsers({ status: 'active' })) console.log(p.user_id);
+
+// On behalf of the user, right after sign-in with the ID token you just received
+const me = profiles.forUser(idToken);
+const mine = await me.getMe();
+await me.updateMe({ given_name: 'Ada' });
+```
+
+Machine methods: `getUser`, `listUsers`, `iterUsers`, `createUser`,
+`updateUser`, `replaceUser`, `deleteUser`, `getConsents`, `setConsent`,
+`getAudit`, `iterAudit`. User methods: `getMe`, `updateMe`, `getMyConsents`,
+`setMyConsent`, `getMyAudit`, `iterMyAudit`.
+
+`forUser` only works with a fresh ID token: the OP caps the delegated token's
+lifetime at the ID token's `exp`, and ID tokens live 60 s by default
+(`id_token_ttl_seconds`). Use it with the ID token you just received at
+sign-in; for later work on a user's profile, use the machine methods with
+their `user_id` (the ID token's `sub` claim).
+
+List methods take
+`{ cursor?, limit? }` and return `{ items, nextCursor }` (consents:
+`{ current, history, nextCursor }`).
+
+Options (all optional): `baseUrl` (default `{issuer}/profile`; https, http only
+for loopback), `scopes` (machine; default: none sent, so the OP grants all the
+client's allowed scopes; an empty list throws), `audience` (exchange, default
+`hx-profile`), `timeout` (ms, default 10000; bounds token-endpoint calls as
+well as profile requests), `maxRetries` (default 2), `fetch`.
+
+Behaviour: access tokens are cached (expiry counted from when the token
+request was sent) and refreshed before expiry in the background, so callers
+keep the still-valid token meanwhile (one in-flight request shared by
+concurrent callers); a failed early refresh keeps that token and is not
+retried for 30 s (or until expiry); `forUser` tokens are re-exchanged only at
+expiry; a 401 re-mints the token and replays the request once (for `forUser`,
+if the re-exchange fails, e.g. `invalid_grant`, the original 401 is thrown);
+`deleteUser` treats any 2xx as success, whatever the body; GET/PUT/DELETE are retried on network errors, 408, 429, 502-504
+from the profile service (honouring its `Retry-After`, capped at 30 s); a
+token-endpoint network error, 408, 429, 502, 503 or 504 is retried for every
+method, POST/PATCH included, since no profile request was sent, using backoff
+only (the token endpoint's `Retry-After` is ignored); all retries share the
+same `maxRetries` budget; POST/PATCH are otherwise never retried; redirects are
+not followed; a DELETE answered 404 counts as success if any earlier attempt of
+the same call may have run (it got no HTTP response, or got 504), and that
+stays true whatever later attempts answer; a 502 (ambiguous, but a false
+"deleted" is worse than a false 404) or a failure before anything was sent
+does not count: any error with `syscall` `connect`/`getaddrinfo`, or,
+with no `syscall`, refused, DNS, connect timeout or TLS handshake codes
+(unreachable-host/network codes need `syscall: 'connect'`, since they can also
+hit an established keep-alive socket); an error from an injected `fetch` with
+no recognised `code`/`errno` counts as may-have-run;
+iterators stop on a null or empty `next_cursor`, or if the server repeats a
+cursor.
+
+Errors: profile-service failures throw `ProfileApiError` (a `HawcxError`) with
+`status` (`0` = no response: network error/timeout; a 2xx whose body was cut
+off mid-read keeps that status, title `Response body read failed`, detail the
+error name, since the call ran), `title`, `detail`, `type`, `instance`,
+`requestId`, `retryAfter`, `missing` (403 insufficient scope), `fields` (422)
+the parsed JSON `body`, and `rawBody` (the body text, e.g. a gateway's HTML
+error page, capped at 4096 characters, never in `message`; on a malformed 2xx
+only when the body is a markup page starting with `<`, since any other body
+may be a mangled profile, i.e. PII); a body
+with no non-blank `title`/`detail` but a string
+`message` (Kong) uses `message` as `detail`, and `requestId` falls back to the
+body's `request_id`; a 2xx body that is not JSON (`Invalid JSON response`) or
+is not a JSON object / lacks a required field, or a 204 to anything but
+`deleteUser` (`Unexpected response body`), is a `ProfileApiError` with the 2xx
+status. Token failures throw
+`TokenExchangeError` (`statusCode`, `error`, `network`: `true` when no
+complete HTTP response came back, i.e. no response at all, `statusCode`
+undefined, or a 2xx whose body was cut off mid-read, `statusCode` set; for
+`exchangeCode` the latter means the code is already spent). Invalid arguments (empty `userId`/`purpose`/`idToken`)
+throw `HawcxError` before any request, as do `userId`/`purpose` values, and
+`createUser`'s `user_id`, that are `.`/`..` or contain `/`, `\` or control
+characters.
+
+```typescript
+try {
+  await profiles.createUser({ user_id: 'user-123', given_name: 'Ada', family_name: 'Lovelace' });
+} catch (err) {
+  if (err instanceof ProfileApiError && err.status === 409) {
+    /* profile already exists */
+  } else throw err;
+}
+```
+
+---
+
 ## Delegation Module
 
 Server-to-server API for managing users, MFA, and devices. Requires a Hawcx secret key.

package/dist/errors.d.ts

@@ -39,7 +39,17 @@ export declare class HawcxOAuthError extends HawcxError {
 }
 export declare class TokenExchangeError extends HawcxOAuthError {
     readonly statusCode?: number;
-    constructor(message: string, statusCode?: number, fields?: HawcxOAuthErrorFields);
+    /**
+     * `true` when no complete HTTP response came back: no response at all (DNS /
+     * TLS / connection failure, timeout; `statusCode` undefined) or a 2xx whose
+     * body was cut off mid-read (`statusCode` is that 2xx; for `exchangeCode`
+     * the code is then already spent). The underlying error is on `cause`.
+     * `false` otherwise.
+     */
+    readonly network: boolean;
+    constructor(message: string, statusCode?: number, fields?: HawcxOAuthErrorFields & {
+        network?: boolean;
+    });
 }
 export declare class TokenVerificationError extends HawcxOAuthError {
     constructor(message: string, fields?: HawcxOAuthErrorFields);

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAM5D;AAED,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAKjF;AAED,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAI5D;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,qBAAqB;CAOnF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAM5D;AAED,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;gBAGxB,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,qBAAqB,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE;CAOzD;AAED,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAI5D;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,qBAAqB;CAOnF"}

package/dist/errors.js

@@ -40,6 +40,7 @@ class TokenExchangeError extends HawcxOAuthError {
         super(message, fields);
         this.name = 'TokenExchangeError';
         this.statusCode = statusCode;
+        this.network = fields?.network ?? false;
     }
 }
 exports.TokenExchangeError = TokenExchangeError;

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAgBH;;;GAGG;AACH,MAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AALD,gCAKC;AAED;;;;;;;;GAQG;AACH,MAAa,eAAgB,SAAQ,UAAU;IAM7C,YAAY,OAAe,EAAE,MAA8B;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3D,IAAI,MAAM,EAAE,gBAAgB,KAAK,SAAS;YAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC9F,CAAC;CACF;AAZD,0CAYC;AAED,MAAa,kBAAmB,SAAQ,eAAe;IAGrD,YAAY,OAAe,EAAE,UAAmB,EAAE,MAA8B;QAC9E,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AARD,gDAQC;AAED,MAAa,sBAAuB,SAAQ,eAAe;IACzD,YAAY,OAAe,EAAE,MAA8B;QACzD,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED;;;;;;;;;GASG;AACH,MAAa,cAAe,SAAQ,eAAe;IACjD,YAAY,OAAe,EAAE,OAAqD;QAChF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAA4B,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AARD,wCAQC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAgBH;;;GAGG;AACH,MAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AALD,gCAKC;AAED;;;;;;;;GAQG;AACH,MAAa,eAAgB,SAAQ,UAAU;IAM7C,YAAY,OAAe,EAAE,MAA8B;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3D,IAAI,MAAM,EAAE,gBAAgB,KAAK,SAAS;YAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC9F,CAAC;CACF;AAZD,0CAYC;AAED,MAAa,kBAAmB,SAAQ,eAAe;IAWrD,YACE,OAAe,EACf,UAAmB,EACnB,MAAsD;QAEtD,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAC1C,CAAC;CACF;AArBD,gDAqBC;AAED,MAAa,sBAAuB,SAAQ,eAAe;IACzD,YAAY,OAAe,EAAE,MAA8B;QACzD,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED;;;;;;;;;GASG;AACH,MAAa,cAAe,SAAQ,eAAe;IACjD,YAAY,OAAe,EAAE,OAAqD;QAChF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAA4B,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AARD,wCAQC"}

package/dist/index.d.ts

@@ -13,11 +13,15 @@
  * ```
  */
 export { HawcxOAuth } from './oauth';
-export type { HawcxOAuthConfig, HawcxOAuthIssuerConfig, ExchangeResult, JwtClaims, DiscoveryMetadata, VerifyTokenOptions, } from './oauth';
+export type { HawcxOAuthConfig, HawcxOAuthIssuerConfig, ExchangeResult, JwtClaims, DiscoveryMetadata, VerifyTokenOptions, AuthorizeUrlOptions, EndSessionUrlOptions, } from './oauth';
 export { HawcxError, HawcxOAuthError, TokenExchangeError, TokenVerificationError, DiscoveryError, } from './errors';
 export type { HawcxOAuthErrorFields } from './errors';
 export { ClientAssertionSigner, CLIENT_ASSERTION_TYPE } from './client-assertion';
+export { ProfileClient, UserProfileClient } from './profile/client';
+export type { ProfileClientOptions } from './profile/client';
+export { ProfileApiError } from './profile/errors';
+export type { Profile, Consent, AuditEvent, Page, ConsentsPage, MyProfilePatch, ProfilePatch, ReplaceUserInput, CreateUserInput, ConsentInput, PageOptions, ListUsersOptions, } from './profile/types';
 export * from './delegation';
 export * from './stepup';
-export declare const VERSION = "6.0.0";
+export declare const VERSION = "6.2.0";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGlF,cAAc,cAAc,CAAC;AAG7B,cAAc,UAAU,CAAC;AAEzB,eAAO,MAAM,OAAO,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGlF,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EACV,OAAO,EACP,OAAO,EACP,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,cAAc,cAAc,CAAC;AAG7B,cAAc,UAAU,CAAC;AAEzB,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/index.js

@@ -28,7 +28,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VERSION = exports.CLIENT_ASSERTION_TYPE = exports.ClientAssertionSigner = exports.DiscoveryError = exports.TokenVerificationError = exports.TokenExchangeError = exports.HawcxOAuthError = exports.HawcxError = exports.HawcxOAuth = void 0;
+exports.VERSION = exports.ProfileApiError = exports.UserProfileClient = exports.ProfileClient = exports.CLIENT_ASSERTION_TYPE = exports.ClientAssertionSigner = exports.DiscoveryError = exports.TokenVerificationError = exports.TokenExchangeError = exports.HawcxOAuthError = exports.HawcxError = exports.HawcxOAuth = void 0;
 var oauth_1 = require("./oauth");
 Object.defineProperty(exports, "HawcxOAuth", { enumerable: true, get: function () { return oauth_1.HawcxOAuth; } });
 var errors_1 = require("./errors");
@@ -40,9 +40,15 @@ Object.defineProperty(exports, "DiscoveryError", { enumerable: true, get: functi
 var client_assertion_1 = require("./client-assertion");
 Object.defineProperty(exports, "ClientAssertionSigner", { enumerable: true, get: function () { return client_assertion_1.ClientAssertionSigner; } });
 Object.defineProperty(exports, "CLIENT_ASSERTION_TYPE", { enumerable: true, get: function () { return client_assertion_1.CLIENT_ASSERTION_TYPE; } });
+// Profile service module
+var client_1 = require("./profile/client");
+Object.defineProperty(exports, "ProfileClient", { enumerable: true, get: function () { return client_1.ProfileClient; } });
+Object.defineProperty(exports, "UserProfileClient", { enumerable: true, get: function () { return client_1.UserProfileClient; } });
+var errors_2 = require("./profile/errors");
+Object.defineProperty(exports, "ProfileApiError", { enumerable: true, get: function () { return errors_2.ProfileApiError; } });
 // Delegation module
 __exportStar(require("./delegation"), exports);
 // Step-up module
 __exportStar(require("./stepup"), exports);
-exports.VERSION = '6.0.0';
+exports.VERSION = '6.2.0';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;AAEH,iCAAqC;AAA5B,mGAAA,UAAU,OAAA;AASnB,mCAMkB;AALhB,oGAAA,UAAU,OAAA;AACV,yGAAA,eAAe,OAAA;AACf,4GAAA,kBAAkB,OAAA;AAClB,gHAAA,sBAAsB,OAAA;AACtB,wGAAA,cAAc,OAAA;AAIhB,uDAAkF;AAAzE,yHAAA,qBAAqB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAErD,oBAAoB;AACpB,+CAA6B;AAE7B,iBAAiB;AACjB,2CAAyB;AAEZ,QAAA,OAAO,GAAG,OAAO,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;AAEH,iCAAqC;AAA5B,mGAAA,UAAU,OAAA;AAWnB,mCAMkB;AALhB,oGAAA,UAAU,OAAA;AACV,yGAAA,eAAe,OAAA;AACf,4GAAA,kBAAkB,OAAA;AAClB,gHAAA,sBAAsB,OAAA;AACtB,wGAAA,cAAc,OAAA;AAIhB,uDAAkF;AAAzE,yHAAA,qBAAqB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAErD,yBAAyB;AACzB,2CAAoE;AAA3D,uGAAA,aAAa,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAEzC,2CAAmD;AAA1C,yGAAA,eAAe,OAAA;AAgBxB,oBAAoB;AACpB,+CAA6B;AAE7B,iBAAiB;AACjB,2CAAyB;AAEZ,QAAA,OAAO,GAAG,OAAO,CAAC"}

package/dist/internal/url.d.ts

@@ -63,4 +63,11 @@ export declare function parseSecureBaseUrl(label: string, raw: string, makeError
  * base's exact origin and stays under its path prefix.
  */
 export declare function safeJoinUrl(base: SecureBaseUrl, path: string, label: string, makeError: UrlErrorFactory): string;
+/**
+ * Validate a browser-facing custom domain as a raw string (no WHATWG parse,
+ * which would strip whitespace, decode `%2e`, accept `*` or a trailing dot)
+ * and return its canonical origin: `scheme://host[:port]`, lower-cased,
+ * default port dropped.  Same rules as the Python and Java SDKs.
+ */
+export declare function parseCustomDomain(raw: unknown, makeError: UrlErrorFactory): string;
 //# sourceMappingURL=url.d.ts.map

package/dist/internal/url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/internal/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;AAiB1E,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,GAAG,CAsB3F;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,eAAe,GACzB,aAAa,CAYf;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,eAAe,GACzB,MAAM,CAyCR"}
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/internal/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;AAiB1E,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,GAAG,CAsB3F;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,eAAe,GACzB,aAAa,CAYf;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,eAAe,GACzB,MAAM,CAyCR;AAOD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,GAAG,MAAM,CAyClF"}

package/dist/internal/url.js

@@ -31,6 +31,8 @@ exports.isLoopbackHostname = isLoopbackHostname;
 exports.assertSecureUrl = assertSecureUrl;
 exports.parseSecureBaseUrl = parseSecureBaseUrl;
 exports.safeJoinUrl = safeJoinUrl;
+exports.parseCustomDomain = parseCustomDomain;
+const net_1 = require("net");
 /** Exact hostnames (as reported by `URL#hostname`) allowed to use plain http. */
 const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
 /** C0 controls, space and DEL — stripped or rewritten silently by the URL parser. */
@@ -145,6 +147,59 @@ function safeJoinUrl(base, path, label, makeError) {
     }
     return joined.href;
 }
+/** Raw-string shape of a custom domain (cross-SDK contract §1). */
+const CUSTOM_DOMAIN_SHAPE = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/(\[[0-9A-Fa-f:.]+\]|[^/:?#@[\]]+)(?::([^/]*))?\/?$/;
+const DNS_LABEL = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+const IPV4_OCTET = /^(0|[1-9][0-9]{0,2})$/;
+/**
+ * Validate a browser-facing custom domain as a raw string (no WHATWG parse,
+ * which would strip whitespace, decode `%2e`, accept `*` or a trailing dot)
+ * and return its canonical origin: `scheme://host[:port]`, lower-cased,
+ * default port dropped.  Same rules as the Python and Java SDKs.
+ */
+function parseCustomDomain(raw, makeError) {
+    const bad = (why) => makeError(`customDomain ${why}: ${JSON.stringify(raw)}`);
+    if (typeof raw !== 'string' || raw === '')
+        throw bad('must be a non-empty string');
+    // Printable ASCII only, checked before lower-casing (U+212A Kelvin sign lower-cases to 'k').
+    if (/[^\x21-\x7e]|[\\%]/.test(raw)) {
+        throw bad('must be printable ASCII (punycode for IDN) without whitespace, backslash or %');
+    }
+    const m = CUSTOM_DOMAIN_SHAPE.exec(raw);
+    if (m === null)
+        throw bad('must be scheme://host[:port] only (no userinfo, path, query or fragment)');
+    const scheme = m[1].toLowerCase();
+    let host = m[2].toLowerCase();
+    const port = m[3];
+    if (host.startsWith('[')) {
+        if (host.includes('.') || !(0, net_1.isIPv6)(host.slice(1, -1))) {
+            throw bad('has an invalid IPv6 literal (embedded IPv4 not allowed)');
+        }
+        // WHATWG serialises IPv6 in RFC 5952 form: `[0:0::1]` -> `[::1]` (contract R7).
+        host = new URL(`http://${host}`).hostname;
+    }
+    else if (/^[0-9.]+$/.test(host) && host.split('.').length === 4) {
+        if (!host.split('.').every((o) => IPV4_OCTET.test(o) && Number(o) <= 255)) {
+            throw bad('has a non-canonical IPv4 address');
+        }
+    }
+    else {
+        const labels = host.split('.');
+        if (host.length > 253 ||
+            !labels.every((l) => l.length <= 63 && DNS_LABEL.test(l)) ||
+            !/^[a-z]/.test(labels[labels.length - 1])) {
+            throw bad('has an invalid hostname (ASCII/punycode labels only, last label starts with a letter)');
+        }
+    }
+    if (port !== undefined && !(/^[1-9][0-9]{0,4}$/.test(port) && Number(port) <= 65535)) {
+        throw bad('has an invalid port');
+    }
+    if (scheme !== 'https' && !(scheme === 'http' && isLoopbackHostname(host))) {
+        throw bad('must use https (http only for loopback)');
+    }
+    const defaultPort = scheme === 'https' ? '443' : '80';
+    return `${scheme}://${host}${port === undefined || port === defaultPort ? '' : ':' + port}`;
+}
 /** Render a URL for an error message with any credentials removed. */
 function redact(u) {
     const copy = new URL(u.href);

package/dist/internal/url.js.map

@@ -1 +1 @@
-{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/internal/url.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AAqBH,gDAEC;AAYD,0CAsBC;AAgBD,gDAgBC;AAUD,kCA8CC;AA5ID,iFAAiF;AACjF,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7F,qFAAqF;AACrF,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEhD,mEAAmE;AACnE,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,KAAa,EAAE,GAAW,EAAE,SAA0B;IACpF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,CAAC,GAAG,KAAK,wBAAwB,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,CAAC,GAAG,KAAK,6CAA6C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,SAAS,CACb,GAAG,KAAK,yBAAyB,GAAG,yDAAyD,CAC9F,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,KAAa,EACb,GAAW,EACX,SAA0B;IAE1B,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjD,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,MAAM,SAAS,CAAC,GAAG,KAAK,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,oBAAoB;IACpB,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CACzB,IAAmB,EACnB,IAAY,EACZ,KAAa,EACb,SAA0B;IAE1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,CAAC,GAAG,KAAK,oDAAoD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,CAAC,GAAG,KAAK,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,CAAC,GAAG,KAAK,kCAAkC,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,CAAC,GAAG,KAAK,iCAAiC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,GAAG,KAAK,mEAAmE,IAAI,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,CAAC,GAAG,KAAK,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,iEAAiE;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACtF,MAAM,SAAS,CAAC,GAAG,KAAK,2CAA2C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,gEAAgE;IAChE,uEAAuE;IACvE,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,SAAS,CAAC,GAAG,KAAK,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,sEAAsE;AACtE,SAAS,MAAM,CAAC,CAAM;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC"}
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/internal/url.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AAuBH,gDAEC;AAYD,0CAsBC;AAgBD,gDAgBC;AAUD,kCA8CC;AAaD,8CAyCC;AAvMD,6BAA6B;AAK7B,iFAAiF;AACjF,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7F,qFAAqF;AACrF,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEhD,mEAAmE;AACnE,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,KAAa,EAAE,GAAW,EAAE,SAA0B;IACpF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,CAAC,GAAG,KAAK,wBAAwB,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,CAAC,GAAG,KAAK,6CAA6C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,SAAS,CACb,GAAG,KAAK,yBAAyB,GAAG,yDAAyD,CAC9F,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,KAAa,EACb,GAAW,EACX,SAA0B;IAE1B,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjD,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,MAAM,SAAS,CAAC,GAAG,KAAK,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,oBAAoB;IACpB,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CACzB,IAAmB,EACnB,IAAY,EACZ,KAAa,EACb,SAA0B;IAE1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,CAAC,GAAG,KAAK,oDAAoD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,CAAC,GAAG,KAAK,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,CAAC,GAAG,KAAK,kCAAkC,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,CAAC,GAAG,KAAK,iCAAiC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,GAAG,KAAK,mEAAmE,IAAI,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,CAAC,GAAG,KAAK,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,iEAAiE;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACtF,MAAM,SAAS,CAAC,GAAG,KAAK,2CAA2C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,gEAAgE;IAChE,uEAAuE;IACvE,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,SAAS,CAAC,GAAG,KAAK,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,mFAAmF,CAAC;AAChH,MAAM,SAAS,GAAG,iCAAiC,CAAC;AACpD,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,GAAY,EAAE,SAA0B;IACxE,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,SAAS,CAAC,gBAAgB,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACnF,6FAA6F;IAC7F,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,CAAC,+EAA+E,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,GAAG,CAAC,0EAA0E,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAElB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAA,YAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,CAAC;QACD,gFAAgF;QAChF,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC5C,CAAC;SAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IACE,IAAI,CAAC,MAAM,GAAG,GAAG;YACjB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EACzC,CAAC;YACD,MAAM,GAAG,CAAC,uFAAuF,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrF,MAAM,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,OAAO,GAAG,MAAM,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;AAC9F,CAAC;AAED,sEAAsE;AACtE,SAAS,MAAM,CAAC,CAAM;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC"}