@mft/moneyhub-api-client 6.99.0 → 6.101.0

package/CHANGELOG.md

@@ -1,9 +1,71 @@
-6.96.0 / 2026-04-07
+Unreleased
+==========
+
+**Bug Fixes**
+
+* `caasPatchTransaction`: add `past-and-future` to `CaasRecategorisationType`.
+
+6.101.0 / 2026-09-11
+==========
+
+**Features**
+
+* **`getAuthorizeUrl` PKCE hooks**: optional `pkce.generate` + `pkce.storeVerifier` for server-side PKCE generation and persistence (defaults unchanged when omitted).
+* **`exchangeCodeForTokens` PKCE hooks**: optional `pkce.consumeVerifier` to retrieve and apply a stored `code_verifier` at token exchange.
+
+6.100.1 / 2026-08-18
+==========
+
+**Bug Fixes**
+
+* Correct documentation and packaging hygiene ahead of 7.x: publish readme wording, endpoint coverage method names and test scripts, readme API examples, prerequisites URL, missing method docs (`accVerification`, `getPayee`, `getConsentHistory`, `confirmFundsForRecurringPayment`), CHANGELOG 6.99.0 phantom entry, package author typo, and `.npmignore` exclusions for `dist/__tests__` and env files.
+
+6.100.0 / 2026-08-14
+==========
+
+**Features**
+
+* **Standard financial statements**: `getStandardFinancialStatements` / `getStandardFinancialStatement` (scope `standard_financial_statement:read`).
+* **Legacy connections**: `listLegacyConnections` (Identity `.well-known/legacy-connections`).
+* `getAuthorizeUrl` with `accVerification: true` now adds `mh:account_verification` independently of `enableAsync` (previously nested under the async claim block).
+* **ENDPOINT_COVERAGE.md** added to map API definitions to client methods.
+* CHANGELOG backfill for undocumented 5.5.0–6.99.0 releases so history is complete ahead of the 7.x major line.
+
+**Bug Fixes**
+
+* Align `engines.node` with the 6.0.0 support policy: `>= 18.0.0` (Node 12, 14, and 16 were already unsupported from 6.0.0; `package.json` had incorrectly still declared `>= 12.0.0`).
+
+6.99.0 / 2026-06-10
+==========
+
+**Features**
+
+* Add CaaS custom category methods: `caasGetCustomCategories`, `caasCreateCustomCategory`, `caasDeleteCustomCategory`.
+
+6.98.0 / 2026-06-09
+==========
+
+**Features**
+
+* `caasGetTransactions` includes transaction `splits` when the client has the `caas:transaction_splits:read` scope (in addition to `caas:transactions:read`).
+
+6.97.0 / 2026-06-04
+==========
+
+**Features**
+
+* Add CaaS transaction split methods: `caasPutTransactionSplits`, `caasDeleteTransactionSplits`.
+* Update CaaS transaction types.
+
+6.96.0 / 2026-06-04
 ==========
 
 **Features**
 
 * Add `caasGetRegularTransactions` for CaaS `GET /accounts/{accountId}/regular-transactions`.
+* Add `caasGetEnhancedTransaction` for CaaS enhanced transaction retrieval.
+* Update counterparty types; gateway rewrite handling for versioned URL segments.
+* Publishing: GitHub Actions npm publish with provenance and CI guards.
 
 6.95.0 / 2026-02-23
 ==========
@@ -14,6 +76,39 @@
 * `getOpenIdConfig()` uses a TTL cache backed by `@isaacs/ttlcache` (configurable via `options.openIdConfigCacheTtlMs`) and returns discovery with endpoint URLs rewritten to `gatewayIdentityServiceUrl` only when that option is set.
 * Identity URLs are detected for versioning via the effective identity base (no hardcoded path prefix list); when provided, any request URL under that base does not have an API version segment added.
 * See the readme section **Using the client behind a gateway** for configuration, verification, and security notes.
+* Add CaaS methods (categories, counterparties, geotags, transactions, users), including `caasPatchTransaction` and `caasEnrichTransactions`.
+* Add consent history methods.
+* Add confirmation-of-funds support for recurring payments / VRP.
+* Update SCIM user create payload shape; optional amount for VRP confirmation of funds.
+* Add `l1CategoryGroupId` / `l1CategoryGroupName` to CaaS category types.
+
+6.94.0 / 2025-09-10
+==========
+
+**Features**
+
+* Add unenriched transaction methods: `getUnenrichedTransactions`, `getUnenrichedTransaction`.
+
+6.93.1 / 2025-07-18
+==========
+
+**Features**
+
+* Add `providerAccountId` to the Account schema.
+
+6.93.0 / 2025-07-15
+==========
+
+**Features**
+
+* Add `providerParentAccountId` to the Account type (e.g. Monzo pots support).
+
+6.92.0 / 2025-05-19
+==========
+
+**Features**
+
+* Add `categoriseTransactions` method and related types/examples.
 
 6.91.0 / 2025-05-01
 ==================
@@ -23,30 +118,162 @@
 * Add options for proxy agents
 * Add createResellerCheckRequest method
 
+6.9.0 / 2025-03-20
+==========
+
+**Features**
+
+* Add `env` to create auth request params.
+
 6.8.0 / 2025-03-12
 ==================
 
 * Update User Connection Types
 
+6.7.0 / 2025-02-25
+==========
+
+**Breaking Changes**
+
+* Remove `getSCIMUsers` method.
+
+**Bug Fixes**
+
+* Fix `registerSCIMUser` TypeScript definitions.
+
+6.6.0 / 2025-02-04
+==========
+
+**Features**
+
+* Add configurable request retry options.
+* Export connections types from the package index.
 
-6.0.0 / 2024-04-8
+6.5.2 / 2025-01-21
+==========
+
+**Bug Fixes**
+
+* Patch release published to npm (exact commit not retained in the current repository history).
+
+6.5.1 / 2025-01-15
+==========
+
+**Bug Fixes**
+
+* Patch / version bump release.
+
+6.5.0 / 2025-01-14
+==========
+
+**Features**
+
+* Add mTLS options to client configuration.
+* Add `accVerification` / account verification support on auth requests and authorisation URLs.
+* Add `targetDate` support on savings goals; adjust update savings goal behaviour.
+* Add `revokedAt` to VRP response type.
+* Make `sub` and client secret optional where not required by the auth method.
+* Add max retry-after option for requests.
+
+6.4.0 / 2024-08-27
+==========
+
+**Features**
+
+* Add `getSCIMUser` method.
+
+6.3.0 / 2024-08-06
+==========
+
+**Features**
+
+* Add `registerSCIMUser` method.
+
+6.2.0 / 2024-08-05
+==========
+
+**Features**
+
+* Add `accountTypes` and `accountIdentification` to auth requests.
+* Update recurring payment types.
+
+6.1.2 / 2024-06-19
+==========
+
+**Features**
+
+* Update pay-link types with additional parameters.
+
+6.1.1 / 2024-05-21
+==========
+
+**Features**
+
+* Add `payerType: api-payer` and payer to payment claims.
+
+6.1.0 / 2024-04-23
+==========
+
+**Features**
+
+* Add account statements methods.
+* Support API v3 URL handling and related refactoring.
+
+6.0.0 / 2024-04-08
 ==================
 
 **Breaking Changes**
 
-* End-Of-Life versions of Node.js as of October 2023 are no longer supported. Supports Node.js 18, 20, and future releases.
+* End-Of-Life versions of Node.js as of October 2023 are no longer supported. Requires Node.js >= 18.0.0 (supports Node.js 18, 20, and future releases). Node 12, 14, and 16 are unsupported from this release.
 
 **Features**
 
 * Add permissionsAction to authorisation URL generation methods.
 * Add customerIpAddress and customerLastLoggedTime to createAuthRequest
 
+5.91.2 / 2023-12-05
+==========
+
+**Bug Fixes**
+
+* Patch release published to npm (exact commit not retained in the current repository history).
+
+5.91.1 / 2023-11-15
+==========
+
+**Bug Fixes**
+
+* Patch / version bump release.
+
+5.91.0 / 2023-11-15
+==========
+
+**Features**
+
+* Add pay-link methods.
+
+5.9.0 / 2023-11-14
+==========
+
+**Features**
+
+* Maintenance / packaging release.
+
+5.8.0 / 2023-09-11
+==========
+
+**Features**
+
+* Add automatic versioning of API URLs with customisation.
+* Add `enableAsync` option for syncs.
+
 5.7.0 / 2023-09-11
 ==================
 
 **Features**
 
 * Add OSIP methods
+* Add balance notification threshold methods
 
 5.6.1 / 2023-09-06
 ==================
@@ -62,6 +289,13 @@
 
 * Add detectRegularTransactions
 
+5.5.0 / 2023-07-25
+==========
+
+**Features**
+
+* Intermediate release published the same day as 5.6.0 (see 5.6.0 for `detectRegularTransactions`).
+
 5.4.0 / 2023-06-19
 ==================
 

package/dist/exchange-code-for-token.d.ts

@@ -1,5 +1,6 @@
 import { TokenSet } from "openid-client";
 import type { Client } from "openid-client";
+import type { PkceExchangeOptions } from "./pkce";
 declare const ALLOWED_PARAMS: readonly ["access_token", "code", "error", "error_description", "error_uri", "expires_in", "id_token", "state", "token_type", "session_state"];
 export declare type ParamsFromCallback = {
     [K in typeof ALLOWED_PARAMS[number]]?: any;
@@ -12,12 +13,19 @@ export interface LocalParams {
     code_verifier?: any;
     sub?: any;
 }
+export interface ExchangeCodeForTokensOptions {
+    paramsFromCallback: ParamsFromCallback;
+    localParams: LocalParams;
+}
+export interface ExchangeCodeForTokensUsingPKCEOptions extends ExchangeCodeForTokensOptions {
+    pkce?: PkceExchangeOptions;
+}
 declare const _default: ({ client, redirectUri, }: {
     client: Client;
     redirectUri: string;
-}) => ({ paramsFromCallback, localParams, }: {
-    paramsFromCallback: ParamsFromCallback;
-    localParams: LocalParams;
-}) => Promise<TokenSet>;
+}) => {
+    exchangeCodeForTokens: ({ paramsFromCallback, localParams, }: ExchangeCodeForTokensOptions) => Promise<TokenSet>;
+    exchangeCodeForTokensUsingPKCE: ({ paramsFromCallback, localParams, pkce, }: ExchangeCodeForTokensUsingPKCEOptions) => Promise<TokenSet>;
+};
 export default _default;
 //# sourceMappingURL=exchange-code-for-token.d.ts.map

package/dist/exchange-code-for-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exchange-code-for-token.d.ts","sourceRoot":"","sources":["../src/exchange-code-for-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAA;AACtC,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,eAAe,CAAA;AAGzC,QAAA,MAAM,cAAc,gJAWV,CAAA;AAEV,oBAAY,kBAAkB,GAAG;KAC9B,CAAC,IAAI,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG;CAC3C,CAAA;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,GAAG,CAAA;IACb,KAAK,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,GAAG,CAAA;IACnB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,aAAa,CAAC,EAAE,GAAG,CAAA;IACnB,GAAG,CAAC,EAAE,GAAG,CAAA;CACV;;YAiBS,MAAM;iBACD,MAAM;;wBAMG,kBAAkB;iBACzB,WAAW;MACtB,QAAQ,QAAQ,CAAC;AAbvB,wBAqGG"}
+{"version":3,"file":"exchange-code-for-token.d.ts","sourceRoot":"","sources":["../src/exchange-code-for-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAA;AACtC,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,eAAe,CAAA;AAGzC,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,QAAQ,CAAA;AAE/C,QAAA,MAAM,cAAc,gJAWV,CAAA;AAEV,oBAAY,kBAAkB,GAAG;KAC9B,CAAC,IAAI,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG;CAC3C,CAAA;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,GAAG,CAAA;IACb,KAAK,EAAE,GAAG,CAAA;IACV,aAAa,CAAC,EAAE,GAAG,CAAA;IACnB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,aAAa,CAAC,EAAE,GAAG,CAAA;IACnB,GAAG,CAAC,EAAE,GAAG,CAAA;CACV;AAED,MAAM,WAAW,4BAA4B;IAC3C,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,WAAW,EAAE,WAAW,CAAA;CACzB;AAED,MAAM,WAAW,qCAAsC,SAAQ,4BAA4B;IACzF,IAAI,CAAC,EAAE,mBAAmB,CAAA;CAC3B;;YAiBS,MAAM;iBACD,MAAM;;kEAKhB,4BAA4B,KAAG,QAAQ,QAAQ,CAAC;iFA8FhD,qCAAqC,KAAG,QAAQ,QAAQ,CAAC;;AAxG9D,wBA8HC"}

package/dist/exchange-code-for-token.js

@@ -45,70 +45,89 @@ const RESPONSE_TYPE_REQUIRED_PARAMS = {
     id_token: ["id_token"],
     token: ["access_token", "token_type"],
 };
-exports.default = ({ client, redirectUri, }) => ({ paramsFromCallback, localParams, }) => {
-    const params = R.pick(ALLOWED_PARAMS, paramsFromCallback);
-    const checks = localParams;
-    if (client.default_max_age && !checks.max_age)
-        checks.max_age = client.default_max_age;
-    if (!params.state && checks.state) {
-        return Promise.reject(new Error("paramsFromCallback.state is missing"));
-    }
-    if (params.state && !checks.state) {
-        return Promise.reject(new Error("localParams.state argument is missing"));
-    }
-    if (checks.state !== params.state) {
-        return Promise.reject(new Error("state mismatch"));
-    }
-    if (params.error) {
-        return Promise.reject(new Error(params.error));
-    }
-    if (!params.code) {
-        return Promise.reject(new Error("paramsFromCallback.code is missing"));
-    }
-    if (checks.response_type) {
-        for (const type of checks.response_type.split(" ")) {
-            if (type === "none") {
-                if (params.code || params.id_token || params.access_token) {
-                    return Promise.reject(new Error("unexpected params encountered for 'none' response"));
+exports.default = ({ client, redirectUri, }) => {
+    const exchangeCodeForTokens = ({ paramsFromCallback, localParams, }) => {
+        const params = R.pick(ALLOWED_PARAMS, paramsFromCallback);
+        const checks = localParams;
+        if (client.default_max_age && !checks.max_age)
+            checks.max_age = client.default_max_age;
+        if (!params.state && checks.state) {
+            return Promise.reject(new Error("paramsFromCallback.state is missing"));
+        }
+        if (params.state && !checks.state) {
+            return Promise.reject(new Error("localParams.state argument is missing"));
+        }
+        if (checks.state !== params.state) {
+            return Promise.reject(new Error("state mismatch"));
+        }
+        if (params.error) {
+            return Promise.reject(new Error(params.error));
+        }
+        if (!params.code) {
+            return Promise.reject(new Error("paramsFromCallback.code is missing"));
+        }
+        if (checks.response_type) {
+            for (const type of checks.response_type.split(" ")) {
+                if (type === "none") {
+                    if (params.code || params.id_token || params.access_token) {
+                        return Promise.reject(new Error("unexpected params encountered for 'none' response"));
+                    }
                 }
-            }
-            else {
-                for (const param of RESPONSE_TYPE_REQUIRED_PARAMS[type]) {
-                    if (!params[param]) {
-                        return Promise.reject(new Error(`${param} missing from response`));
+                else {
+                    for (const param of RESPONSE_TYPE_REQUIRED_PARAMS[type]) {
+                        if (!params[param]) {
+                            return Promise.reject(new Error(`${param} missing from response`));
+                        }
                     }
                 }
             }
         }
-    }
-    let promise;
-    if (params.id_token) {
-        promise = Promise.resolve(new openid_client_1.TokenSet(params))
-            .then((tokenset) => client.decryptIdToken(tokenset))
-            .then((tokenset) => client.validateIdToken(tokenset, checks.nonce, "authorization", checks.max_age, checks.state));
-    }
-    if (params.code) {
-        const grantCall = () => client.grant({
-            grant_type: "authorization_code",
-            code: params.code,
-            redirect_uri: redirectUri,
-            code_verifier: checks.code_verifier,
-            sub: localParams.sub,
-        })
-            .then((tokenset) => client.decryptIdToken(tokenset))
-            .then((tokenset) => client.validateIdToken(tokenset, checks.nonce, "token", checks.max_age))
-            .then((tokenset) => {
-            if (params.session_state)
-                tokenset.session_state = params.session_state;
-            return tokenset;
-        });
-        if (promise) {
-            promise = promise.then(grantCall);
+        let promise;
+        if (params.id_token) {
+            promise = Promise.resolve(new openid_client_1.TokenSet(params))
+                .then((tokenset) => client.decryptIdToken(tokenset))
+                .then((tokenset) => client.validateIdToken(tokenset, checks.nonce, "authorization", checks.max_age, checks.state));
+        }
+        if (params.code) {
+            const grantCall = () => client.grant({
+                grant_type: "authorization_code",
+                code: params.code,
+                redirect_uri: redirectUri,
+                code_verifier: checks.code_verifier,
+                sub: localParams.sub,
+            })
+                .then((tokenset) => client.decryptIdToken(tokenset))
+                .then((tokenset) => client.validateIdToken(tokenset, checks.nonce, "token", checks.max_age))
+                .then((tokenset) => {
+                if (params.session_state)
+                    tokenset.session_state = params.session_state;
+                return tokenset;
+            });
+            if (promise) {
+                promise = promise.then(grantCall);
+            }
+            else {
+                return grantCall();
+            }
         }
-        else {
-            return grantCall();
+        return promise || Promise.resolve(new openid_client_1.TokenSet(params));
+    };
+    const exchangeCodeForTokensUsingPKCE = async ({ paramsFromCallback, localParams, pkce, }) => {
+        if ((pkce === null || pkce === void 0 ? void 0 : pkce.consumeVerifier) && localParams.code_verifier) {
+            return Promise.reject(new Error("Provide code_verifier via pkce.consumeVerifier or localParams.code_verifier, not both"));
         }
-    }
-    return promise || Promise.resolve(new openid_client_1.TokenSet(params));
+        if (pkce === null || pkce === void 0 ? void 0 : pkce.consumeVerifier) {
+            const code_verifier = await pkce.consumeVerifier({ state: localParams.state });
+            return exchangeCodeForTokens({
+                paramsFromCallback,
+                localParams: { ...localParams, code_verifier },
+            });
+        }
+        return exchangeCodeForTokens({ paramsFromCallback, localParams });
+    };
+    return {
+        exchangeCodeForTokens,
+        exchangeCodeForTokensUsingPKCE,
+    };
 };
 //# sourceMappingURL=exchange-code-for-token.js.map

package/dist/exchange-code-for-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"exchange-code-for-token.js","sourceRoot":"","sources":["../src/exchange-code-for-token.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+BAA+B;AAC/B,mCAAmC;AACnC,iDAAsC;AAEtC,yCAA0B;AAE1B,MAAM,cAAc,GAAG;IACrB,cAAc;IACd,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,UAAU;IACV,OAAO;IACP,YAAY;IACZ,eAAe;CACP,CAAA;AAiBV,MAAM,6BAA6B,GAE/B;IACF,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,KAAK,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;CACtC,CAAA;AAED,kBAAe,CAAC,EACd,MAAM,EACN,WAAW,GAIZ,EAAE,EAAE,CACH,CAAC,EACC,kBAAkB,EAClB,WAAW,GAIZ,EAAqB,EAAE;IACtB,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,WAAW,CAAA;IAE1B,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO;QAC3C,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,eAAe,CAAA;IAEzC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE;QACjC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAA;KACxE;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;QACjC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAA;KAC1E;IAED,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE;QACjC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;KACnD;IAED,IAAI,MAAM,CAAC,KAAK,EAAE;QAChB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;KAC/C;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAChB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;KACvE;IAED,IAAI,MAAM,CAAC,aAAa,EAAE;QACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAmB,EAAE;YACpE,IAAI,IAAI,KAAK,MAAM,EAAE;gBACnB,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE;oBACzD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAC/D,CAAA;iBACF;aACF;iBAAM;gBACL,KAAK,MAAM,KAAK,IAAI,6BAA6B,CAAC,IAAI,CAAC,EAAE;oBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;wBAClB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC,CAAA;qBACnE;iBACF;aACF;SACF;KACF;IAED,IAAI,OAAO,CAAA;IAEX,IAAI,MAAM,CAAC,QAAQ,EAAE;QACnB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,wBAAQ,CAAC,MAAM,CAAC,CAAC;aAC5C,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAE,MAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;aAC5D,IAAI,CAAW,CAAC,QAAQ,EAAE,EAAE,CAC1B,MAAc,CAAC,eAAe,CAC7B,QAAQ,EACR,MAAM,CAAC,KAAK,EACZ,eAAe,EACf,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,KAAK,CACb,CACF,CAAA;KACJ;IAED,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,KAAK,CAAC;YACX,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC;aACC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAE,MAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;aAC5D,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChB,MAAc,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CACjF;aACA,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjB,IAAI,MAAM,CAAC,aAAa;gBACtB,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAA;YAC/C,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC,CAAA;QAEN,IAAI,OAAO,EAAE;YACX,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;SAClC;aAAM;YACL,OAAO,SAAS,EAAE,CAAA;SACnB;KACF;IAED,OAAO,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,wBAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AACzD,CAAC,CAAA"}
+{"version":3,"file":"exchange-code-for-token.js","sourceRoot":"","sources":["../src/exchange-code-for-token.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+BAA+B;AAC/B,mCAAmC;AACnC,iDAAsC;AAEtC,yCAA0B;AAI1B,MAAM,cAAc,GAAG;IACrB,cAAc;IACd,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,UAAU;IACV,OAAO;IACP,YAAY;IACZ,eAAe;CACP,CAAA;AA0BV,MAAM,6BAA6B,GAE/B;IACF,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,KAAK,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;CACtC,CAAA;AAED,kBAAe,CAAC,EACd,MAAM,EACN,WAAW,GAIZ,EAAE,EAAE;IACH,MAAM,qBAAqB,GAAG,CAAC,EAC7B,kBAAkB,EAClB,WAAW,GACkB,EAAqB,EAAE;QACpD,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,WAAW,CAAA;QAE1B,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,OAAO;YAC3C,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,eAAe,CAAA;QAEzC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE;YACjC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAA;SACxE;QAED,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACjC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAA;SAC1E;QAED,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE;YACjC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;SACnD;QAED,IAAI,MAAM,CAAC,KAAK,EAAE;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;SAC/C;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;SACvE;QAED,IAAI,MAAM,CAAC,aAAa,EAAE;YACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAmB,EAAE;gBACpE,IAAI,IAAI,KAAK,MAAM,EAAE;oBACnB,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE;wBACzD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAC/D,CAAA;qBACF;iBACF;qBAAM;oBACL,KAAK,MAAM,KAAK,IAAI,6BAA6B,CAAC,IAAI,CAAC,EAAE;wBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;4BAClB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC,CAAA;yBACnE;qBACF;iBACF;aACF;SACF;QAED,IAAI,OAAO,CAAA;QAEX,IAAI,MAAM,CAAC,QAAQ,EAAE;YACnB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,wBAAQ,CAAC,MAAM,CAAC,CAAC;iBAC5C,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAE,MAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;iBAC5D,IAAI,CAAW,CAAC,QAAQ,EAAE,EAAE,CAC1B,MAAc,CAAC,eAAe,CAC7B,QAAQ,EACR,MAAM,CAAC,KAAK,EACZ,eAAe,EACf,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,KAAK,CACb,CACF,CAAA;SACJ;QAED,IAAI,MAAM,CAAC,IAAI,EAAE;YACf,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,KAAK,CAAC;gBACX,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,GAAG,EAAE,WAAW,CAAC,GAAG;aACrB,CAAC;iBACC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAE,MAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;iBAC5D,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChB,MAAc,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CACjF;iBACA,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACjB,IAAI,MAAM,CAAC,aAAa;oBACtB,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAA;gBAC/C,OAAO,QAAQ,CAAA;YACjB,CAAC,CAAC,CAAA;YAEN,IAAI,OAAO,EAAE;gBACX,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;aAClC;iBAAM;gBACL,OAAO,SAAS,EAAE,CAAA;aACnB;SACF;QAED,OAAO,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,wBAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,CAAC,CAAA;IAED,MAAM,8BAA8B,GAAG,KAAK,EAAE,EAC5C,kBAAkB,EAClB,WAAW,EACX,IAAI,GACkC,EAAqB,EAAE;QAC7D,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,eAAe,KAAI,WAAW,CAAC,aAAa,EAAE;YACtD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,uFAAuF,CAAC,CACnG,CAAA;SACF;QAED,IAAI,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,eAAe,EAAE;YACzB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAC,KAAK,EAAE,WAAW,CAAC,KAAK,EAAC,CAAC,CAAA;YAC5E,OAAO,qBAAqB,CAAC;gBAC3B,kBAAkB;gBAClB,WAAW,EAAE,EAAC,GAAG,WAAW,EAAE,aAAa,EAAC;aAC7C,CAAC,CAAA;SACH;QAED,OAAO,qBAAqB,CAAC,EAAC,kBAAkB,EAAE,WAAW,EAAC,CAAC,CAAA;IACjE,CAAC,CAAA;IAED,OAAO;QACL,qBAAqB;QACrB,8BAA8B;KAC/B,CAAA;AACH,CAAC,CAAA"}

package/dist/get-auth-urls.d.ts

@@ -1,10 +1,27 @@
 /// <reference types="mocha" />
 import type { Client } from "openid-client";
 import type { ApiClientConfig } from "./schema/config";
-import { PayerType, PaymentActorType } from "./schema/payment";
+import type { PkceAuthoriseOptions } from "./pkce";
+import type { PayerType, PaymentActorType } from "./schema/payment";
 import { StandingOrderFrequency } from "./schema/standing-order";
 import { RequestPayee, RequestPayer } from "./schema/payee";
 import { PermissionsAction } from "./requests/types/auth-requests";
+export interface GetAuthorizeUrlOptions {
+    state?: string;
+    scope: string;
+    nonce?: string;
+    claims?: any;
+    permissions?: string[];
+    permissionsAction?: PermissionsAction;
+    enableAsync?: boolean;
+    accVerification?: boolean;
+    expirationDateTime?: string;
+    transactionFromDateTime?: string;
+    codeChallenge?: string;
+}
+export interface GetAuthorizeUrlUsingPKCEOptions extends GetAuthorizeUrlOptions {
+    pkce?: PkceAuthoriseOptions;
+}
 declare type PkceParams = {
     code_challenge: string;
     code_challenge_method: string;
@@ -13,19 +30,8 @@ declare const _default: ({ client, config, }: {
     client: Client;
     config: ApiClientConfig;
 }) => {
-    getAuthorizeUrl: ({ state, scope, nonce, claims, permissions, permissionsAction, enableAsync, accVerification, expirationDateTime, transactionFromDateTime, codeChallenge, }: {
-        state?: string | undefined;
-        scope: string;
-        nonce?: string | undefined;
-        claims?: any;
-        permissions?: string[] | undefined;
-        permissionsAction?: PermissionsAction | undefined;
-        enableAsync?: boolean | undefined;
-        accVerification?: boolean | undefined;
-        expirationDateTime?: string | undefined;
-        transactionFromDateTime?: string | undefined;
-        codeChallenge?: string | undefined;
-    }) => Promise<string>;
+    getAuthorizeUrl: ({ state, scope, nonce, claims, permissions, permissionsAction, enableAsync, accVerification, expirationDateTime, transactionFromDateTime, codeChallenge, }: GetAuthorizeUrlOptions) => Promise<string>;
+    getAuthorizeUrlUsingPKCE: ({ pkce, ...options }: GetAuthorizeUrlUsingPKCEOptions) => Promise<string>;
     getAuthorizeUrlLegacy: ({ state, scope, nonce, claims, permissions, permissionsAction, enableAsync, expirationDateTime, transactionFromDateTime, codeChallenge, }: {
         state?: string | undefined;
         scope: string;

package/dist/get-auth-urls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-auth-urls.d.ts","sourceRoot":"","sources":["../src/get-auth-urls.ts"],"names":[],"mappings":";AACA,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,eAAe,CAAA;AAGzC,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAC,SAAS,EAAE,gBAAgB,EAAC,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAC,sBAAsB,EAAC,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAC,YAAY,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAC,iBAAiB,EAAC,MAAM,gCAAgC,CAAA;AAGhE,aAAK,UAAU,GAAG;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,qBAAqB,EAAE,MAAM,CAAA;CAC9B,CAAA;;YAKS,MAAM;YACN,eAAe;;;;eAiGd,MAAM;;iBAEJ,GAAG;;;;;;;;UAQV,QAAQ,MAAM,CAAC;;;eAkEV,MAAM;;iBAEJ,GAAG;;;;;;;UAOV,QAAQ,MAAM,CAAC;;oBAzJ+C,MAAM;;;eAW/D,MAAM;;gBAEL,MAAM;;;;mCAqM4B,GAAG;;gBA8BnC,MAAM;;;gBAGN,MAAM;iBACL,GAAG;;;;;;;;;gBAmDJ,MAAM;sBACA,MAAM;;;iBAGX,GAAG;;;;uBAIG,MAAM;;;gBAuCb,MAAM;sBACA,MAAM;;;iBAGX,GAAG;;;;;;sBA6CE,MAAM;;;iBAGX,GAAG;;;;;;;gBAoDJ,MAAM;kBACJ,MAAM;;;gBAGR,MAAM;kBACJ,MAAM;;;;;;;;;;iBAUP,GAAG;;;;gBAkEJ,MAAM;mBACH,MAAM;;;gBAGT,MAAM;iBACL,GAAG;;;;;;;gBAsEJ,MAAM;;;;;;;;;;;yBAWG,GAAG;;;;;gBAKZ,MAAM;iBACL,GAAG;;;;gBA+EJ,MAAM;;;;;;mBAMH,MAAM;mBACN,sBAAsB;;4BAEb,MAAM;gCACF,MAAM;4BACV,MAAM;;0BAER,MAAM;8BACF,MAAM;0BACV,MAAM;;;iBAGf,MAAM;iBACN,GAAG;;;;gBAmEJ,MAAM;;;;;iBAKL,GAAG;;;;;;;;;AAvzBlB,wBA+1BC"}
+{"version":3,"file":"get-auth-urls.d.ts","sourceRoot":"","sources":["../src/get-auth-urls.ts"],"names":[],"mappings":";AACA,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,eAAe,CAAA;AAIzC,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAC,oBAAoB,EAAC,MAAM,QAAQ,CAAA;AAChD,OAAO,KAAK,EAAC,SAAS,EAAE,gBAAgB,EAAC,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAC,sBAAsB,EAAC,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAC,YAAY,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAC,iBAAiB,EAAC,MAAM,gCAAgC,CAAA;AAIhE,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,GAAG,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,+BAAgC,SAAQ,sBAAsB;IAC7E,IAAI,CAAC,EAAE,oBAAoB,CAAA;CAC5B;AAED,aAAK,UAAU,GAAG;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,qBAAqB,EAAE,MAAM,CAAA;CAC9B,CAAA;;YAmCS,MAAM;YACN,eAAe;;kLA+FpB,sBAAsB,KAAG,QAAQ,MAAM,CAAC;qDAuDxC,+BAA+B,KAAG,QAAQ,MAAM,CAAC;;;eAuB3C,MAAM;;iBAEJ,GAAG;;;;;;;UAOV,QAAQ,MAAM,CAAC;;oBAzJ+C,MAAM;;;eAW/D,MAAM;;gBAEL,MAAM;;;;mCAqM4B,GAAG;;gBA+BnC,MAAM;;;gBAGN,MAAM;iBACL,GAAG;;;;;;;;;gBAmDJ,MAAM;sBACA,MAAM;;;iBAGX,GAAG;;;;uBAIG,MAAM;;;gBAuCb,MAAM;sBACA,MAAM;;;iBAGX,GAAG;;;;;;sBA6CE,MAAM;;;iBAGX,GAAG;;;;;;;gBAoDJ,MAAM;kBACJ,MAAM;;;gBAGR,MAAM;kBACJ,MAAM;;;;;;;;;;iBAUP,GAAG;;;;gBAkEJ,MAAM;mBACH,MAAM;;;gBAGT,MAAM;iBACL,GAAG;;;;;;;gBAsEJ,MAAM;;;;;;;;;;;yBAWG,GAAG;;;;;gBAKZ,MAAM;iBACL,GAAG;;;;gBA+EJ,MAAM;;;;;;mBAMH,MAAM;mBACN,sBAAsB;;4BAEb,MAAM;gCACF,MAAM;4BACV,MAAM;;0BAER,MAAM;8BACF,MAAM;0BACV,MAAM;;;iBAGf,MAAM;iBACN,GAAG;;;;gBAmEJ,MAAM;;;;;iBAKL,GAAG;;;;;;;;;AAxzBlB,wBAg2BC"}

package/dist/get-auth-urls.js

@@ -27,8 +27,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const got_1 = __importDefault(require("got"));
+const openid_client_1 = require("openid-client");
 const R = __importStar(require("ramda"));
 const filterUndefined = R.reject(R.isNil);
+const resolveAuthoriseCodeChallenge = async ({ state, codeChallenge, pkce, }) => {
+    if (!(pkce === null || pkce === void 0 ? void 0 : pkce.generate)) {
+        return codeChallenge;
+    }
+    if (codeChallenge) {
+        throw new Error("Provide either pkce.generate or codeChallenge, not both");
+    }
+    if (!pkce.storeVerifier) {
+        throw new Error("pkce.storeVerifier is required when pkce.generate is true");
+    }
+    if (!state) {
+        throw new Error("state is required when pkce.generate is true");
+    }
+    const codeVerifier = openid_client_1.generators.codeVerifier();
+    const resolvedCodeChallenge = openid_client_1.generators.codeChallenge(codeVerifier);
+    await pkce.storeVerifier({ state, codeVerifier });
+    return resolvedCodeChallenge;
+};
 exports.default = ({ client, config, }) => {
     const { identityServiceUrl, client: { client_id, redirect_uri, response_type, }, } = config;
     const setPermissionsToClaims = (permissions, permissionsAction) => (claims) => {
@@ -100,11 +119,11 @@ exports.default = ({ client, config, }) => {
                         "essential": true,
                         "value": { "enableAsync": true },
                     },
-                    ...accVerification && {
-                        "mh:account_verification": {
-                            "essential": true,
-                            "value": { "accVerification": true },
-                        },
+                },
+                ...accVerification && {
+                    "mh:account_verification": {
+                        "essential": true,
+                        "value": { "accVerification": true },
                     },
                 },
             },
@@ -118,6 +137,14 @@ exports.default = ({ client, config, }) => {
             pkceParams,
         });
     };
+    const getAuthorizeUrlUsingPKCE = async ({ pkce, ...options }) => {
+        const codeChallenge = await resolveAuthoriseCodeChallenge({
+            state: options.state,
+            codeChallenge: options.codeChallenge,
+            pkce,
+        });
+        return getAuthorizeUrl({ ...options, codeChallenge });
+    };
     const getAuthorizeUrlLegacy = ({ state, scope, nonce, claims = {}, permissions, permissionsAction, enableAsync, expirationDateTime, transactionFromDateTime, codeChallenge, }) => {
         const pkceParams = codeChallenge ? {
             code_challenge: codeChallenge,
@@ -177,6 +204,7 @@ exports.default = ({ client, config, }) => {
     };
     return {
         getAuthorizeUrl,
+        getAuthorizeUrlUsingPKCE,
         getAuthorizeUrlLegacy,
         getAuthorizeUrlFromRequestUri,
         requestObject: getRequestObject,