@openclaw/matrix 2026.8.1-beta.3 → 2026.8.2

package/node_modules/matrix-js-sdk/lib/oauth/authorize.js

@@ -0,0 +1,193 @@
+import _objectSpread from "@babel/runtime/helpers/objectSpread2";
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { secureRandomString } from "../randomstring.js";
+import { OAuth2Error } from "./error.js";
+import { hasOptionalNumberProperty, hasOptionalStringProperty, hasRequiredNumberProperty, hasRequiredStringProperty, isRecord } from "../@types/type-guards.js";
+import { Method } from "../http-api/index.js";
+import { OAuthGrantType } from "./register.js";
+import { sleep } from "../utils.js";
+
+/**
+ * The expected response type from the token endpoint during authorization code flow
+ * Normalized to always use capitalized 'Bearer' for token_type
+ *
+ * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4
+ */
+
+/**
+ * Metadata from OAuth 2.0 token_endpoint as per
+ * https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+ * With validated properties required in type
+ *
+ * This response is expected for the authorization code grant and refresh token grant,
+ * as defined in the Matrix spec.
+ */
+
+/**
+ * Validate the given response matches the format expected for a {@link ValidTokenResponse}
+ * @param response - the response to validate
+ * @throws if the response does not match the expected format
+ */
+export function validateBearerTokenResponse(response) {
+  if (!isRecord(response) || !hasRequiredStringProperty(response, "token_type") ||
+  // token_type is case-insensitive, some OPs return `token_type: "bearer"`
+  response["token_type"].toLowerCase() !== "bearer" || !hasRequiredStringProperty(response, "access_token") || !hasOptionalNumberProperty(response, "expires_in") || !hasOptionalStringProperty(response, "refresh_token") || !hasOptionalStringProperty(response, "scope")) {
+    throw new Error(OAuth2Error.InvalidBearerTokenResponse);
+  }
+}
+
+/**
+ * Generate the scope used in authorization request with OAuth2 IdP
+ * @returns scope
+ */
+export const generateScope = deviceId => {
+  const safeDeviceId = deviceId ?? secureRandomString(10);
+  return `urn:matrix:client:api:* urn:matrix:client:device:${safeDeviceId}`;
+};
+
+/**
+ * Normalize token_type to use capital case to make consuming the token response easier
+ * token_type is case insensitive, and it is spec-compliant for OPs to return token_type: "bearer"
+ * Later, when used in auth headers it is case sensitive and must be Bearer
+ * See: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4
+ *
+ * @param response - validated token response
+ * @returns response with token_type set to 'Bearer'
+ */
+export const normalizeBearerTokenResponseTokenType = response => _objectSpread(_objectSpread({}, response), {}, {
+  token_type: "Bearer"
+});
+
+/**
+ * Response from the OAuth2 token endpoint when exchanging a token for grant_type device_code.
+ */
+
+/**
+ * Validate the given response matches the format expected for a {@link DeviceAccessTokenResponse}
+ * @param response - the response to validate
+ * @throws if the response does not match the expected format
+ */
+export function isValidDeviceAccessTokenResponse(response) {
+  return isRecord(response) && hasRequiredStringProperty(response, "access_token") && hasRequiredStringProperty(response, "token_type") && hasOptionalStringProperty(response, "refresh_token") && hasOptionalStringProperty(response, "scope") && hasOptionalNumberProperty(response, "expires_in");
+}
+
+/**
+ * Error from the OAuth2 token endpoint when exchanging a token for grant_type device_code.
+ */
+
+/**
+ * Response from the OAuth2 device authorization endpoint.
+ * As specified in https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+ */
+
+/**
+ * Validate the given response matches the format expected for a {@link DeviceAuthorizationResponse}
+ * @param response - the response to validate
+ * @throws if the response does not match the expected format
+ */
+export function validateDeviceAuthorizationResponse(response) {
+  if (!isRecord(response) || !hasRequiredStringProperty(response, "device_code") || !hasRequiredStringProperty(response, "user_code") || !hasRequiredStringProperty(response, "verification_uri") || !hasRequiredNumberProperty(response, "expires_in") || !hasOptionalStringProperty(response, "verification_uri_complete") || !hasOptionalNumberProperty(response, "interval")) {
+    throw new Error(OAuth2Error.InvalidDeviceAuthorizationResponse);
+  }
+}
+
+/**
+ * Begin OAuth2 device authorization flow.
+ * @param options - The device authorization parameters.
+ * @param options.clientId - the client ID returned from client registration.
+ * @param options.scope - the scope to request for authorization.
+ * @param options.metadata - the validated OAuth2 metadata for the Identity Provider.
+ * @returns a promise that resolves to a device access token response,
+ *   or an error response if the user denies authorization or the device code expires.
+ */
+export const startDeviceAuthorization = async ({
+  clientId,
+  scope,
+  metadata
+}) => {
+  const body = new URLSearchParams({
+    client_id: clientId,
+    scope: scope
+  }).toString();
+  const url = metadata.device_authorization_endpoint;
+  if (!url) {
+    throw new Error("No device_authorization_endpoint given");
+  }
+  const response = await fetch(url, {
+    method: Method.Post,
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body
+  });
+  const data = await response.json();
+  validateDeviceAuthorizationResponse(data);
+  return data;
+};
+
+/**
+ * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.
+ * @param options - The device authorization parameters.
+ * @param options.session - The session returned from a previous call to {@link startDeviceAuthorization}.
+ * @param options.metadata - The validated OAuth2 metadata for the Identity Provider.
+ * @param options.clientId - The client ID returned from client registration.
+ * @returns a promise that resolves to a device access token response,
+ *   or an error response if the user denies authorization or the device code expires.
+ */
+export const waitForDeviceAuthorization = async ({
+  session,
+  metadata,
+  clientId
+}) => {
+  let interval = (session.interval ?? 5) * 1000; // poll interval
+  const expiration = Date.now() + session.expires_in * 1000;
+  do {
+    const body = new URLSearchParams({
+      device_code: session.device_code,
+      grant_type: OAuthGrantType.DeviceAuthorization,
+      client_id: clientId
+    }).toString();
+    const response = await fetch(metadata.token_endpoint, {
+      method: Method.Post,
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body
+    });
+    const data = await response.json();
+    if (response.ok && isValidDeviceAccessTokenResponse(data)) {
+      return data;
+    }
+    const errorResponse = data;
+    switch (errorResponse.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5000;
+        break;
+      case "access_denied":
+      case "expired_token":
+        return errorResponse;
+    }
+    await sleep(interval);
+  } while (Date.now() < expiration);
+  return {
+    error: "expired"
+  };
+};
+//# sourceMappingURL=authorize.js.map

package/node_modules/matrix-js-sdk/lib/oauth/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","names":[],"sources":["../../src/oauth/authorize.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { secureRandomString } from \"../randomstring.ts\";\nimport { OAuth2Error } from \"./error.ts\";\nimport { type ValidatedAuthMetadata } from \"./discover.ts\";\nimport {\n    hasOptionalNumberProperty,\n    hasOptionalStringProperty,\n    hasRequiredNumberProperty,\n    hasRequiredStringProperty,\n    isRecord,\n} from \"../@types/type-guards.ts\";\nimport { Method } from \"../http-api/index.ts\";\nimport { OAuthGrantType } from \"./register.ts\";\nimport { sleep } from \"../utils.ts\";\n\n/**\n * The expected response type from the token endpoint during authorization code flow\n * Normalized to always use capitalized 'Bearer' for token_type\n *\n * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4\n */\nexport type BearerTokenResponse = Omit<ValidTokenResponse, \"token_type\"> & {\n    token_type: \"Bearer\";\n};\n\n/**\n * Metadata from OAuth 2.0 token_endpoint as per\n * https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\n * With validated properties required in type\n *\n * This response is expected for the authorization code grant and refresh token grant,\n * as defined in the Matrix spec.\n */\ninterface ValidTokenResponse {\n    token_type: \"Bearer\" | \"bearer\";\n    access_token: string;\n    expires_in?: number;\n    refresh_token?: string;\n    scope?: string;\n}\n\n/**\n * Validate the given response matches the format expected for a {@link ValidTokenResponse}\n * @param response - the response to validate\n * @throws if the response does not match the expected format\n */\nexport function validateBearerTokenResponse(response: unknown): asserts response is ValidTokenResponse {\n    if (\n        !isRecord(response) ||\n        !hasRequiredStringProperty(response, \"token_type\") ||\n        // token_type is case-insensitive, some OPs return `token_type: \"bearer\"`\n        response[\"token_type\"].toLowerCase() !== \"bearer\" ||\n        !hasRequiredStringProperty(response, \"access_token\") ||\n        !hasOptionalNumberProperty(response, \"expires_in\") ||\n        !hasOptionalStringProperty(response, \"refresh_token\") ||\n        !hasOptionalStringProperty(response, \"scope\")\n    ) {\n        throw new Error(OAuth2Error.InvalidBearerTokenResponse);\n    }\n}\n\n/**\n * Generate the scope used in authorization request with OAuth2 IdP\n * @returns scope\n */\nexport const generateScope = (deviceId?: string): string => {\n    const safeDeviceId = deviceId ?? secureRandomString(10);\n    return `urn:matrix:client:api:* urn:matrix:client:device:${safeDeviceId}`;\n};\n\n/**\n * Normalize token_type to use capital case to make consuming the token response easier\n * token_type is case insensitive, and it is spec-compliant for OPs to return token_type: \"bearer\"\n * Later, when used in auth headers it is case sensitive and must be Bearer\n * See: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4\n *\n * @param response - validated token response\n * @returns response with token_type set to 'Bearer'\n */\nexport const normalizeBearerTokenResponseTokenType = (response: ValidTokenResponse): BearerTokenResponse => ({\n    ...response,\n    token_type: \"Bearer\",\n});\n\n/**\n * Response from the OAuth2 token endpoint when exchanging a token for grant_type device_code.\n */\nexport interface DeviceAccessTokenResponse {\n    access_token: string;\n    token_type: string;\n    refresh_token?: string;\n    scope?: string;\n    expires_in?: number;\n}\n\n/**\n * Validate the given response matches the format expected for a {@link DeviceAccessTokenResponse}\n * @param response - the response to validate\n * @throws if the response does not match the expected format\n */\nexport function isValidDeviceAccessTokenResponse(response: unknown): response is DeviceAccessTokenResponse {\n    return (\n        isRecord(response) &&\n        hasRequiredStringProperty(response, \"access_token\") &&\n        hasRequiredStringProperty(response, \"token_type\") &&\n        hasOptionalStringProperty(response, \"refresh_token\") &&\n        hasOptionalStringProperty(response, \"scope\") &&\n        hasOptionalNumberProperty(response, \"expires_in\")\n    );\n}\n\n/**\n * Error from the OAuth2 token endpoint when exchanging a token for grant_type device_code.\n */\nexport interface DeviceAccessTokenError {\n    error: string;\n    error_description?: string;\n    error_uri?: string;\n    session_state?: string;\n}\n\n/**\n * Response from the OAuth2 device authorization endpoint.\n * As specified in https://datatracker.ietf.org/doc/html/rfc8628#section-3.2\n */\nexport interface DeviceAuthorizationResponse {\n    /** The device verification code. */\n    device_code: string;\n    /** The end-user verification code. */\n    user_code: string;\n    /**\n     * The end-user verification URI on the authorization server.\n     * The URI should be short and easy to remember as end users will be asked to manually type it into their user agent.\n     */\n    verification_uri: string;\n    /**\n     * The URI which doesn’t require the user to manually type the user_code, designed for non-textual transmission.\n     */\n    verification_uri_complete?: string;\n    /** The lifetime in seconds of the \"device_code\" and \"user_code\". */\n    expires_in: number;\n    /**\n     * The minimum amount of time in seconds that the client SHOULD wait between polling requests to the token endpoint.\n     * If no value is provided, clients MUST use 5 as the default.\n     */\n    interval?: number;\n}\n\n/**\n * Validate the given response matches the format expected for a {@link DeviceAuthorizationResponse}\n * @param response - the response to validate\n * @throws if the response does not match the expected format\n */\nexport function validateDeviceAuthorizationResponse(\n    response: unknown,\n): asserts response is DeviceAuthorizationResponse {\n    if (\n        !isRecord(response) ||\n        !hasRequiredStringProperty(response, \"device_code\") ||\n        !hasRequiredStringProperty(response, \"user_code\") ||\n        !hasRequiredStringProperty(response, \"verification_uri\") ||\n        !hasRequiredNumberProperty(response, \"expires_in\") ||\n        !hasOptionalStringProperty(response, \"verification_uri_complete\") ||\n        !hasOptionalNumberProperty(response, \"interval\")\n    ) {\n        throw new Error(OAuth2Error.InvalidDeviceAuthorizationResponse);\n    }\n}\n\n/**\n * Begin OAuth2 device authorization flow.\n * @param options - The device authorization parameters.\n * @param options.clientId - the client ID returned from client registration.\n * @param options.scope - the scope to request for authorization.\n * @param options.metadata - the validated OAuth2 metadata for the Identity Provider.\n * @returns a promise that resolves to a device access token response,\n *   or an error response if the user denies authorization or the device code expires.\n */\nexport const startDeviceAuthorization = async ({\n    clientId,\n    scope,\n    metadata,\n}: {\n    clientId: string;\n    scope: string;\n    metadata: ValidatedAuthMetadata;\n}): Promise<DeviceAuthorizationResponse> => {\n    const body = new URLSearchParams({ client_id: clientId, scope: scope }).toString();\n\n    const url = metadata.device_authorization_endpoint;\n    if (!url) {\n        throw new Error(\"No device_authorization_endpoint given\");\n    }\n\n    const response = await fetch(url, {\n        method: Method.Post,\n        headers: {\n            \"Content-Type\": \"application/x-www-form-urlencoded\",\n        },\n        body,\n    });\n\n    const data = await response.json();\n    validateDeviceAuthorizationResponse(data);\n    return data;\n};\n\n/**\n * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.\n * @param options - The device authorization parameters.\n * @param options.session - The session returned from a previous call to {@link startDeviceAuthorization}.\n * @param options.metadata - The validated OAuth2 metadata for the Identity Provider.\n * @param options.clientId - The client ID returned from client registration.\n * @returns a promise that resolves to a device access token response,\n *   or an error response if the user denies authorization or the device code expires.\n */\nexport const waitForDeviceAuthorization = async ({\n    session,\n    metadata,\n    clientId,\n}: {\n    session: DeviceAuthorizationResponse;\n    metadata: ValidatedAuthMetadata;\n    clientId: string;\n}): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError> => {\n    let interval = (session.interval ?? 5) * 1000; // poll interval\n    const expiration = Date.now() + session.expires_in * 1000;\n    do {\n        const body = new URLSearchParams({\n            device_code: session.device_code,\n            grant_type: OAuthGrantType.DeviceAuthorization,\n            client_id: clientId,\n        }).toString();\n        const response = await fetch(metadata.token_endpoint, {\n            method: Method.Post,\n            headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n            body,\n        });\n\n        const data = await response.json();\n\n        if (response.ok && isValidDeviceAccessTokenResponse(data)) {\n            return data;\n        }\n        const errorResponse = data as DeviceAccessTokenError;\n        switch (errorResponse.error) {\n            case \"authorization_pending\":\n                break;\n            case \"slow_down\":\n                interval += 5000;\n                break;\n            case \"access_denied\":\n            case \"expired_token\":\n                return errorResponse;\n        }\n        await sleep(interval);\n    } while (Date.now() < expiration);\n    return { error: \"expired\" };\n};\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAAS,kBAAkB,QAAQ,oBAAoB;AACvD,SAAS,WAAW,QAAQ,YAAY;AAExC,SACI,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,QAAQ,QACL,0BAA0B;AACjC,SAAS,MAAM,QAAQ,sBAAsB;AAC7C,SAAS,cAAc,QAAQ,eAAe;AAC9C,SAAS,KAAK,QAAQ,aAAa;;AAEnC;AACA;AACA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA,OAAO,SAAS,2BAA2B,CAAC,QAAiB,EAA0C;EACnG,IACI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IACnB,CAAC,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC;EAClD;EACA,QAAQ,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,QAAQ,IACjD,CAAC,yBAAyB,CAAC,QAAQ,EAAE,cAAc,CAAC,IACpD,CAAC,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAClD,CAAC,yBAAyB,CAAC,QAAQ,EAAE,eAAe,CAAC,IACrD,CAAC,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAC/C;IACE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAAC;EAC3D;AACJ;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAM,aAAa,GAAI,QAAiB,IAAa;EACxD,MAAM,YAAY,GAAG,QAAQ,IAAI,kBAAkB,CAAC,EAAE,CAAC;EACvD,OAAO,oDAAoD,YAAY,EAAE;AAC7E,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM,qCAAqC,GAAI,QAA4B,oCAC3E,QAAQ;EACX,UAAU,EAAE;AAAQ,EACtB;;AAEF;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA,OAAO,SAAS,gCAAgC,CAAC,QAAiB,EAAyC;EACvG,OACI,QAAQ,CAAC,QAAQ,CAAC,IAClB,yBAAyB,CAAC,QAAQ,EAAE,cAAc,CAAC,IACnD,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC,IACjD,yBAAyB,CAAC,QAAQ,EAAE,eAAe,CAAC,IACpD,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAC5C,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC;AAEzD;;AAEA;AACA;AACA;;AAQA;AACA;AACA;AACA;;AAwBA;AACA;AACA;AACA;AACA;AACA,OAAO,SAAS,mCAAmC,CAC/C,QAAiB,EAC8B;EAC/C,IACI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IACnB,CAAC,yBAAyB,CAAC,QAAQ,EAAE,aAAa,CAAC,IACnD,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC,IACjD,CAAC,yBAAyB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,IACxD,CAAC,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAClD,CAAC,yBAAyB,CAAC,QAAQ,EAAE,2BAA2B,CAAC,IACjE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAClD;IACE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,kCAAkC,CAAC;EACnE;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM,wBAAwB,GAAG,OAAO;EAC3C,QAAQ;EACR,KAAK;EACL;AAKJ,CAAC,KAA2C;EACxC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;IAAE,SAAS,EAAE,QAAQ;IAAE,KAAK,EAAE;EAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;EAElF,MAAM,GAAG,GAAG,QAAQ,CAAC,6BAA6B;EAClD,IAAI,CAAC,GAAG,EAAE;IACN,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC;EAC7D;EAEA,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;IAC9B,MAAM,EAAE,MAAM,CAAC,IAAI;IACnB,OAAO,EAAE;MACL,cAAc,EAAE;IACpB,CAAC;IACD;EACJ,CAAC,CAAC;EAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;EAClC,mCAAmC,CAAC,IAAI,CAAC;EACzC,OAAO,IAAI;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM,0BAA0B,GAAG,OAAO;EAC7C,OAAO;EACP,QAAQ;EACR;AAKJ,CAAC,KAAkE;EAC/D,IAAI,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;EAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI;EACzD,GAAG;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;MAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;MAChC,UAAU,EAAE,cAAc,CAAC,mBAAmB;MAC9C,SAAS,EAAE;IACf,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;MAClD,MAAM,EAAE,MAAM,CAAC,IAAI;MACnB,OAAO,EAAE;QAAE,cAAc,EAAE;MAAoC,CAAC;MAChE;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,QAAQ,CAAC,EAAE,IAAI,gCAAgC,CAAC,IAAI,CAAC,EAAE;MACvD,OAAO,IAAI;IACf;IACA,MAAM,aAAa,GAAG,IAA8B;IACpD,QAAQ,aAAa,CAAC,KAAK;MACvB,KAAK,uBAAuB;QACxB;MACJ,KAAK,WAAW;QACZ,QAAQ,IAAI,IAAI;QAChB;MACJ,KAAK,eAAe;MACpB,KAAK,eAAe;QAChB,OAAO,aAAa;IAC5B;IACA,MAAM,KAAK,CAAC,QAAQ,CAAC;EACzB,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU;EAChC,OAAO;IAAE,KAAK,EAAE;EAAU,CAAC;AAC/B,CAAC","ignoreList":[]}

package/node_modules/matrix-js-sdk/lib/oauth/discover.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Metadata from OAuth 2.0 client authentication API as per
+ * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata
+ * With validated properties required in type
+ */
+export interface ValidatedAuthMetadata {
+    /** List of actions that the account management URL supports. */
+    account_management_actions_supported?: string[];
+    /** The URL where the user is able to access the account management capabilities of the homeserver. */
+    account_management_uri?: string;
+    /** URL of the authorization endpoint, necessary to use the authorization code grant. */
+    authorization_endpoint: string;
+    /**
+     * List of OAuth 2.0 Proof Key for Code Exchange (PKCE) code challenge methods that the server supports at the authorization endpoint.
+     *
+     * This array MUST contain at least the S256 value, for improved security in the authorization code grant.
+     */
+    code_challenge_methods_supported: string[];
+    /** URL of the device authorization endpoint, as defined in RFC 8628, necessary to use the device authorization grant. */
+    device_authorization_endpoint?: string;
+    /**
+     * List of OAuth 2.0 grant type strings that the server supports at the token endpoint.
+     *
+     * This array MUST contain at least the authorization_code and refresh_token values,
+     * for clients to be able to use the authorization code grant and refresh token grant, respectively.
+     */
+    grant_types_supported: string[];
+    /** The authorization server’s issuer identifier, which is a URL that uses the https scheme and has no query or fragment components. */
+    issuer: string;
+    /** List of OpenID Connect prompt values that the server supports at the authorization endpoint. */
+    prompt_values_supported?: string[];
+    /** URL of the client registration endpoint, necessary to perform dynamic registration of a client. */
+    registration_endpoint: string;
+    /**
+     * List of OAuth 2.0 response mode strings that the server supports at the authorization endpoint.
+     *
+     * This array MUST contain at least the query and fragment values, for improved security in the authorization code grant.
+     */
+    response_modes_supported: string[];
+    /**
+     * List of OAuth 2.0 response type strings that the server supports at the authorization endpoint.
+     *
+     * This array MUST contain at least the code value, for clients to be able to use the authorization code grant.
+     */
+    response_types_supported: string[];
+    /** URL of the revocation endpoint, necessary to log out a client by invalidating its access and refresh tokens. */
+    revocation_endpoint: string;
+    /** URL of the token endpoint, used by the grants. */
+    token_endpoint: string;
+}
+/**
+ * Validates OAuth 2.0 auth metadata as defined by
+ * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata
+ * @param authMetadata - json object
+ * @returns boolean of whether the input is valid
+ */
+export declare const isValidAuthMetadata: (authMetadata: unknown) => authMetadata is ValidatedAuthMetadata;
+//# sourceMappingURL=discover.d.ts.map

package/node_modules/matrix-js-sdk/lib/oauth/discover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/oauth/discover.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IAClC,gEAAgE;IAChE,oCAAoC,CAAC,EAAE,MAAM,EAAE,CAAC;IAChD,sGAAsG;IACtG,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wFAAwF;IACxF,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,yHAAyH;IACzH,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,uIAAuI;IACvI,MAAM,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,sGAAsG;IACtG,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC;;;;OAIG;IACH,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,mHAAmH;IACnH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,iBAAkB,OAAO,KAAG,YAAY,IAAI,qBAmB3E,CAAC"}

package/node_modules/matrix-js-sdk/lib/oauth/discover.js

@@ -0,0 +1,35 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { hasOptionalStringProperty, hasRequiredStringProperty, isRecord, optionalStringArrayProperty, requiredArrayValue } from "../@types/type-guards.js";
+import { OAuthGrantType } from "./index.js";
+
+/**
+ * Metadata from OAuth 2.0 client authentication API as per
+ * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata
+ * With validated properties required in type
+ */
+
+/**
+ * Validates OAuth 2.0 auth metadata as defined by
+ * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata
+ * @param authMetadata - json object
+ * @returns boolean of whether the input is valid
+ */
+export const isValidAuthMetadata = authMetadata => {
+  return isRecord(authMetadata) && hasRequiredStringProperty(authMetadata, "issuer") && hasRequiredStringProperty(authMetadata, "authorization_endpoint") && hasRequiredStringProperty(authMetadata, "token_endpoint") && hasRequiredStringProperty(authMetadata, "revocation_endpoint") && hasRequiredStringProperty(authMetadata, "registration_endpoint") && hasOptionalStringProperty(authMetadata, "account_management_uri") && hasOptionalStringProperty(authMetadata, "device_authorization_endpoint") && optionalStringArrayProperty(authMetadata, "account_management_actions_supported") && optionalStringArrayProperty(authMetadata, "prompt_values_supported") && requiredArrayValue(authMetadata, "response_modes_supported", "query") && requiredArrayValue(authMetadata, "response_modes_supported", "fragment") && requiredArrayValue(authMetadata, "response_types_supported", "code") && requiredArrayValue(authMetadata, "grant_types_supported", OAuthGrantType.AuthorizationCode) && requiredArrayValue(authMetadata, "grant_types_supported", OAuthGrantType.RefreshToken) && requiredArrayValue(authMetadata, "code_challenge_methods_supported", "S256");
+};
+//# sourceMappingURL=discover.js.map

package/node_modules/matrix-js-sdk/lib/oauth/discover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.js","names":[],"sources":["../../src/oauth/discover.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport {\n    hasOptionalStringProperty,\n    hasRequiredStringProperty,\n    isRecord,\n    optionalStringArrayProperty,\n    requiredArrayValue,\n} from \"../@types/type-guards.ts\";\nimport { OAuthGrantType } from \"./index.ts\";\n\n/**\n * Metadata from OAuth 2.0 client authentication API as per\n * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata\n * With validated properties required in type\n */\nexport interface ValidatedAuthMetadata {\n    /** List of actions that the account management URL supports. */\n    account_management_actions_supported?: string[];\n    /** The URL where the user is able to access the account management capabilities of the homeserver. */\n    account_management_uri?: string;\n    /** URL of the authorization endpoint, necessary to use the authorization code grant. */\n    authorization_endpoint: string;\n    /**\n     * List of OAuth 2.0 Proof Key for Code Exchange (PKCE) code challenge methods that the server supports at the authorization endpoint.\n     *\n     * This array MUST contain at least the S256 value, for improved security in the authorization code grant.\n     */\n    code_challenge_methods_supported: string[];\n    /** URL of the device authorization endpoint, as defined in RFC 8628, necessary to use the device authorization grant. */\n    device_authorization_endpoint?: string;\n    /**\n     * List of OAuth 2.0 grant type strings that the server supports at the token endpoint.\n     *\n     * This array MUST contain at least the authorization_code and refresh_token values,\n     * for clients to be able to use the authorization code grant and refresh token grant, respectively.\n     */\n    grant_types_supported: string[];\n    /** The authorization server’s issuer identifier, which is a URL that uses the https scheme and has no query or fragment components. */\n    issuer: string;\n    /** List of OpenID Connect prompt values that the server supports at the authorization endpoint. */\n    prompt_values_supported?: string[];\n    /** URL of the client registration endpoint, necessary to perform dynamic registration of a client. */\n    registration_endpoint: string;\n    /**\n     * List of OAuth 2.0 response mode strings that the server supports at the authorization endpoint.\n     *\n     * This array MUST contain at least the query and fragment values, for improved security in the authorization code grant.\n     */\n    response_modes_supported: string[];\n    /**\n     * List of OAuth 2.0 response type strings that the server supports at the authorization endpoint.\n     *\n     * This array MUST contain at least the code value, for clients to be able to use the authorization code grant.\n     */\n    response_types_supported: string[];\n    /** URL of the revocation endpoint, necessary to log out a client by invalidating its access and refresh tokens. */\n    revocation_endpoint: string;\n    /** URL of the token endpoint, used by the grants. */\n    token_endpoint: string;\n}\n\n/**\n * Validates OAuth 2.0 auth metadata as defined by\n * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata\n * @param authMetadata - json object\n * @returns boolean of whether the input is valid\n */\nexport const isValidAuthMetadata = (authMetadata: unknown): authMetadata is ValidatedAuthMetadata => {\n    return (\n        isRecord(authMetadata) &&\n        hasRequiredStringProperty(authMetadata, \"issuer\") &&\n        hasRequiredStringProperty(authMetadata, \"authorization_endpoint\") &&\n        hasRequiredStringProperty(authMetadata, \"token_endpoint\") &&\n        hasRequiredStringProperty(authMetadata, \"revocation_endpoint\") &&\n        hasRequiredStringProperty(authMetadata, \"registration_endpoint\") &&\n        hasOptionalStringProperty(authMetadata, \"account_management_uri\") &&\n        hasOptionalStringProperty(authMetadata, \"device_authorization_endpoint\") &&\n        optionalStringArrayProperty(authMetadata, \"account_management_actions_supported\") &&\n        optionalStringArrayProperty(authMetadata, \"prompt_values_supported\") &&\n        requiredArrayValue(authMetadata, \"response_modes_supported\", \"query\") &&\n        requiredArrayValue(authMetadata, \"response_modes_supported\", \"fragment\") &&\n        requiredArrayValue(authMetadata, \"response_types_supported\", \"code\") &&\n        requiredArrayValue(authMetadata, \"grant_types_supported\", OAuthGrantType.AuthorizationCode) &&\n        requiredArrayValue(authMetadata, \"grant_types_supported\", OAuthGrantType.RefreshToken) &&\n        requiredArrayValue(authMetadata, \"code_challenge_methods_supported\", \"S256\")\n    );\n};\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SACI,yBAAyB,EACzB,yBAAyB,EACzB,QAAQ,EACR,2BAA2B,EAC3B,kBAAkB,QACf,0BAA0B;AACjC,SAAS,cAAc,QAAQ,YAAY;;AAE3C;AACA;AACA;AACA;AACA;;AA+CA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM,mBAAmB,GAAI,YAAqB,IAA4C;EACjG,OACI,QAAQ,CAAC,YAAY,CAAC,IACtB,yBAAyB,CAAC,YAAY,EAAE,QAAQ,CAAC,IACjD,yBAAyB,CAAC,YAAY,EAAE,wBAAwB,CAAC,IACjE,yBAAyB,CAAC,YAAY,EAAE,gBAAgB,CAAC,IACzD,yBAAyB,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAC9D,yBAAyB,CAAC,YAAY,EAAE,uBAAuB,CAAC,IAChE,yBAAyB,CAAC,YAAY,EAAE,wBAAwB,CAAC,IACjE,yBAAyB,CAAC,YAAY,EAAE,+BAA+B,CAAC,IACxE,2BAA2B,CAAC,YAAY,EAAE,sCAAsC,CAAC,IACjF,2BAA2B,CAAC,YAAY,EAAE,yBAAyB,CAAC,IACpE,kBAAkB,CAAC,YAAY,EAAE,0BAA0B,EAAE,OAAO,CAAC,IACrE,kBAAkB,CAAC,YAAY,EAAE,0BAA0B,EAAE,UAAU,CAAC,IACxE,kBAAkB,CAAC,YAAY,EAAE,0BAA0B,EAAE,MAAM,CAAC,IACpE,kBAAkB,CAAC,YAAY,EAAE,uBAAuB,EAAE,cAAc,CAAC,iBAAiB,CAAC,IAC3F,kBAAkB,CAAC,YAAY,EAAE,uBAAuB,EAAE,cAAc,CAAC,YAAY,CAAC,IACtF,kBAAkB,CAAC,YAAY,EAAE,kCAAkC,EAAE,MAAM,CAAC;AAEpF,CAAC","ignoreList":[]}

package/node_modules/matrix-js-sdk/lib/oauth/error.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.
+ * Not intended to be displayed directly to the user.
+ */
+export declare enum OAuth2Error {
+    General = "Something went wrong with OAuth2 discovery",
+    OpSupport = "Configured OAuth2 OP does not support required functions",
+    DynamicRegistrationNotSupported = "Dynamic registration not supported",
+    DynamicRegistrationFailed = "Dynamic registration failed",
+    DynamicRegistrationInvalid = "Dynamic registration invalid response",
+    CodeExchangeFailed = "Failed to exchange code for token",
+    InvalidBearerTokenResponse = "Invalid bearer token response",
+    InvalidDeviceAuthorizationResponse = "Invalid device authorization response",
+    MissingOrInvalidStoredState = "State required to finish logging in is not found in storage.",
+    RefreshTokenFailed = "Failed to refresh token",
+    RevokeTokenFailed = "Failed to revoke token",
+    DeviceAuthorizationGrantFailed = "Failed to perform device authorization grant"
+}
+//# sourceMappingURL=error.d.ts.map

package/node_modules/matrix-js-sdk/lib/oauth/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/oauth/error.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AACH,oBAAY,WAAW;IACnB,OAAO,+CAA+C;IACtD,SAAS,6DAA6D;IACtE,+BAA+B,uCAAuC;IACtE,yBAAyB,gCAAgC;IACzD,0BAA0B,0CAA0C;IACpE,kBAAkB,sCAAsC;IACxD,0BAA0B,kCAAkC;IAC5D,kCAAkC,0CAA0C;IAC5E,2BAA2B,iEAAiE;IAC5F,kBAAkB,4BAA4B;IAC9C,iBAAiB,2BAA2B;IAC5C,8BAA8B,iDAAiD;CAClF"}

package/node_modules/matrix-js-sdk/lib/oauth/error.js

@@ -0,0 +1,36 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+/**
+ * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.
+ * Not intended to be displayed directly to the user.
+ */
+export let OAuth2Error = /*#__PURE__*/function (OAuth2Error) {
+  OAuth2Error["General"] = "Something went wrong with OAuth2 discovery";
+  OAuth2Error["OpSupport"] = "Configured OAuth2 OP does not support required functions";
+  OAuth2Error["DynamicRegistrationNotSupported"] = "Dynamic registration not supported";
+  OAuth2Error["DynamicRegistrationFailed"] = "Dynamic registration failed";
+  OAuth2Error["DynamicRegistrationInvalid"] = "Dynamic registration invalid response";
+  OAuth2Error["CodeExchangeFailed"] = "Failed to exchange code for token";
+  OAuth2Error["InvalidBearerTokenResponse"] = "Invalid bearer token response";
+  OAuth2Error["InvalidDeviceAuthorizationResponse"] = "Invalid device authorization response";
+  OAuth2Error["MissingOrInvalidStoredState"] = "State required to finish logging in is not found in storage.";
+  OAuth2Error["RefreshTokenFailed"] = "Failed to refresh token";
+  OAuth2Error["RevokeTokenFailed"] = "Failed to revoke token";
+  OAuth2Error["DeviceAuthorizationGrantFailed"] = "Failed to perform device authorization grant";
+  return OAuth2Error;
+}({});
+//# sourceMappingURL=error.js.map

package/node_modules/matrix-js-sdk/lib/oauth/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","names":[],"sources":["../../src/oauth/error.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/**\n * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.\n * Not intended to be displayed directly to the user.\n */\nexport enum OAuth2Error {\n    General = \"Something went wrong with OAuth2 discovery\",\n    OpSupport = \"Configured OAuth2 OP does not support required functions\",\n    DynamicRegistrationNotSupported = \"Dynamic registration not supported\",\n    DynamicRegistrationFailed = \"Dynamic registration failed\",\n    DynamicRegistrationInvalid = \"Dynamic registration invalid response\",\n    CodeExchangeFailed = \"Failed to exchange code for token\",\n    InvalidBearerTokenResponse = \"Invalid bearer token response\",\n    InvalidDeviceAuthorizationResponse = \"Invalid device authorization response\",\n    MissingOrInvalidStoredState = \"State required to finish logging in is not found in storage.\",\n    RefreshTokenFailed = \"Failed to refresh token\",\n    RevokeTokenFailed = \"Failed to revoke token\",\n    DeviceAuthorizationGrantFailed = \"Failed to perform device authorization grant\",\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA,WAAY,WAAW,0BAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAX,WAAW;EAAA,OAAX,WAAW;AAAA","ignoreList":[]}

package/node_modules/matrix-js-sdk/lib/oauth/index.d.ts

@@ -0,0 +1,87 @@
+import { type BearerTokenResponse, type DeviceAccessTokenError, type DeviceAccessTokenResponse, type DeviceAuthorizationResponse } from "./authorize.ts";
+import type { ValidatedAuthMetadata } from "./discover.ts";
+import { type OAuthRegistrationRequest } from "./register.ts";
+export * from "./authorize.ts";
+export * from "./error.ts";
+export * from "./register.ts";
+export * from "./tokenRefresher.ts";
+export * from "./discover.ts";
+/**
+ * Type representing the persistent context needed for typical OAuth flows
+ */
+type Context = {
+    /** The OAuth client ID */
+    clientId: string;
+    /** The desired device ID */
+    deviceId?: string;
+    /** The seed used to generate the challenge code */
+    codeVerifier?: string;
+    /** The URI to redirect the user to with credentials after auth */
+    redirectUri: string;
+};
+export declare class OAuth2 {
+    readonly metadata: ValidatedAuthMetadata;
+    /**
+     * Attempts dynamic registration against the configured registration endpoint.
+     * Will ignore any URIs that do not use client_uri as a common base as per the spec.
+     * @param authMetadata - Auth config from {@link MatrixClient.getAuthMetadata}
+     * @param clientMetadata - The metadata for the client which to register,
+     *     grant_types & response_types & token_endpoint_auth_method will be sanely calculated if omitted.
+     * @returns Promise<string> resolved with registered clientId
+     * @throws when registration is not supported, on failed request or invalid response
+     */
+    static registerClient(authMetadata: ValidatedAuthMetadata, clientMetadata: OAuthRegistrationRequest): Promise<string>;
+    readonly context: Required<Context>;
+    constructor(metadata: ValidatedAuthMetadata, context: Context);
+    /**
+     * Generate a URL to attempt authorization with the OP
+     * See https://spec.matrix.org/v1.18/client-server-api/#authorization-code-flow
+     * @param state - A unique opaque identifier, like a transaction ID,
+     *     that will allow the client to maintain state between the authorization request and the callback.
+     *     The app should use this to key the storage for where the rest of the auth context is saved.
+     * @param responseMode - The manner in which the IdP should send the secrets back to the app. Defaults to `fragment` for privacy.
+     * @param prompt - Optional prompt parameter to pass to the IdP to signal intent, e.g. `create` for User registration.
+     * @param scope - The OAuth2 scope to request, will be generated based on the device ID if omitted.
+     * @returns a Promise with the url as a string
+     */
+    generateAuthorizationCodeGrantUrl(state: string, responseMode?: "fragment" | "query", prompt?: string, scope?: string): Promise<string>;
+    /**
+     * Attempt to exchange authorization code for bearer token.
+     *
+     * Takes the authorization code returned by the OAuth2 Provider via the authorization URL, and makes a
+     * request to the Token Endpoint, to obtain the access token, refresh token, etc.
+     *
+     * @param code - authorization code as returned by IdP during authorization
+     * @returns a validated bearer token response
+     * @throws An `Error` with `message` set to an entry in {@link OAuth2Error},
+     *      when the request fails, or the returned token response is invalid.
+     */
+    completeAuthorizationCodeGrant(code: string): Promise<BearerTokenResponse>;
+    /**
+     * Refresh the access token using the given refresh token and the refresh token grant
+     * @param refreshToken - the token to use to refresh the access token
+     */
+    performRefreshTokenGrant(refreshToken: string): Promise<BearerTokenResponse>;
+    /**
+     * Revokes the given token
+     * @param token - the token to remove
+     * @param type - the type of token, acts as a hint to the IdP
+     */
+    revokeToken(token: string, type?: "access_token" | "refresh_token"): Promise<void>;
+    /**
+     * Begin OAuth2 device authorization flow.
+     * @param scope - the scope to request for authorization.
+     * @returns a promise that resolves to a device access token response,
+     *   or an error response if the user denies authorization or the device code expires.
+     */
+    startDeviceAuthorizationGrant(scope?: string): Promise<DeviceAuthorizationResponse>;
+    /**
+     * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.
+     * @param session - The session returned from a previous call to {@link OAuth2.startDeviceAuthorizationGrant}.
+     * @returns a promise that resolves to a device access token response,
+     *   or an error response if the user denies authorization or the device code expires.
+     */
+    waitForDeviceAuthorizationGrant(session: DeviceAuthorizationResponse): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError>;
+    private fetch;
+}
+//# sourceMappingURL=index.d.ts.map

package/node_modules/matrix-js-sdk/lib/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACH,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAMnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAEH,KAAK,wBAAwB,EAGhC,MAAM,eAAe,CAAC;AASvB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC;AAE9B;;GAEG;AACH,KAAK,OAAO,GAAG;IACX,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,qBAAa,MAAM;aA0EK,QAAQ,EAAE,qBAAqB;IAzEnD;;;;;;;;OAQG;IACH,OAAoB,cAAc,CAC9B,YAAY,EAAE,qBAAqB,EACnC,cAAc,EAAE,wBAAwB,GACzC,OAAO,CAAC,MAAM,CAAC,CAwDjB;IAED,SAAgB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE3C,YACoB,QAAQ,EAAE,qBAAqB,EAC/C,OAAO,EAAE,OAAO,EAQnB;IAED;;;;;;;;;;OAUG;IACU,iCAAiC,CAC1C,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,UAAU,GAAG,OAAoB,EAC/C,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAkBjB;IAED;;;;;;;;;;OAUG;IACU,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAatF;IAED;;;OAGG;IACU,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAWxF;IAED;;;;OAIG;IACU,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAY9F;IAED;;;;;OAKG;IACU,6BAA6B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAM/F;IAED;;;;;OAKG;IACU,+BAA+B,CACxC,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,yBAAyB,GAAG,sBAAsB,CAAC,CAM7D;YAEa,KAAK;CAqBtB"}