@salesforce/b2c-tooling-sdk 1.21.3 → 1.22.0

package/dist/esm/auth/oauth-pkce.js

@@ -0,0 +1,579 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { URL } from 'node:url';
+import { dispatchFetch } from './dispatch-fetch.js';
+import { getLogger } from '../logging/logger.js';
+import { decodeJWT } from './oauth.js';
+import { DEFAULT_ACCOUNT_MANAGER_HOST } from '../defaults.js';
+import { findAuthSession, saveAuthSession } from './session-store.js';
+const DEFAULT_LOCAL_PORT = 8080;
+const ACCESS_TOKEN_CACHE = new Map();
+const PENDING_AUTH = new Map();
+/**
+ * Thrown when the Authorization Code + PKCE flow fails in a way that indicates
+ * the Account Manager client is not registered for this grant (e.g. an old
+ * implicit-only public client, or a missing/mismatched redirect URI) rather
+ * than a transient or user-driven failure.
+ *
+ * {@link PkceWithImplicitFallbackStrategy} keys its automatic fallback off this
+ * type so it retries with the legacy implicit flow ONLY for grant/registration
+ * failures — never for user-cancel, state mismatch, or a port-in-use error.
+ *
+ * @remarks Part of the implicit→PKCE migration safety net. Remove together with
+ * the fallback strategy once all public clients are PKCE-capable.
+ */
+export class PkceGrantUnsupportedError extends Error {
+    /** The OAuth 2.0 `error` code from the authorize redirect or token response, when available. */
+    oauthError;
+    /** The OAuth stage at which the failure occurred. */
+    stage;
+    constructor(message, stage, oauthError) {
+        super(message);
+        this.name = 'PkceGrantUnsupportedError';
+        this.stage = stage;
+        this.oauthError = oauthError;
+    }
+}
+/**
+ * OAuth 2.0 `error` codes that genuinely indicate the client is not registered
+ * as a PKCE-capable public client — the only failures the implicit fallback can
+ * legitimately rescue. Implicit shares the same authorize endpoint and redirect
+ * URI but returns the token on the redirect with NO token-endpoint call and NO
+ * client authentication, so it rescues clients that support implicit but not
+ * the Authorization Code grant:
+ *
+ * - `invalid_client` — at the token exchange, Account Manager demands client
+ *   authentication (e.g. "Parameter client_assertion_type is missing"), i.e. the
+ *   client is confidential/implicit-only, NOT a public/PKCE client. This is the
+ *   primary real-world migration case for legacy implicit clients.
+ * - `unauthorized_client` — client is not permitted to use this grant type.
+ * - `unsupported_response_type` — authorize endpoint rejects `response_type=code`.
+ * - `unsupported_grant_type` — token endpoint rejects `authorization_code`.
+ *
+ * Every other error is a real failure that would fail identically under
+ * implicit and MUST NOT trigger the fallback, e.g. `invalid_scope` (bad
+ * scopes), `access_denied` (user cancelled consent), `invalid_grant`
+ * (expired/replayed code or PKCE verifier mismatch), `invalid_request`.
+ */
+const PKCE_GRANT_UNSUPPORTED_OAUTH_ERRORS = new Set([
+    'invalid_client',
+    'unauthorized_client',
+    'unsupported_response_type',
+    'unsupported_grant_type',
+]);
+/**
+ * Returns true only when an OAuth `error` code indicates the client cannot use
+ * the Authorization Code (PKCE) grant — the narrow set of failures the implicit
+ * fallback should rescue. Unknown/absent codes return false so ambiguous
+ * failures surface directly instead of silently downgrading to implicit.
+ */
+function isPkceGrantUnsupportedError(oauthError) {
+    return oauthError !== undefined && PKCE_GRANT_UNSUPPORTED_OAUTH_ERRORS.has(oauthError);
+}
+function base64url(buf) {
+    return buf.toString('base64').replace(/=+$/, '').replaceAll('+', '-').replaceAll('/', '_');
+}
+function generatePkcePair() {
+    const verifier = base64url(randomBytes(32));
+    const challenge = base64url(createHash('sha256').update(verifier).digest());
+    return { verifier, challenge };
+}
+function parseOAuthErrorBody(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return {
+            error: typeof parsed.error === 'string' ? parsed.error : undefined,
+            errorDescription: typeof parsed.error_description === 'string' ? parsed.error_description : undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}
+async function openBrowserDefault(url) {
+    try {
+        const open = await import('open');
+        await open.default(url);
+    }
+    catch {
+        getLogger().debug('Could not automatically open browser');
+    }
+}
+/**
+ * OAuth 2.0 Authorization Code Flow with PKCE.
+ *
+ * Used for public clients (no client secret). Replaces the legacy implicit flow,
+ * which is deprecated for public clients per OAuth 2.1.
+ *
+ * Flow:
+ * 1. Generate PKCE verifier + S256 challenge.
+ * 2. Open browser to `/dwsso/oauth2/authorize?response_type=code&code_challenge=...`.
+ * 3. Capture redirect with `?code=...` on a localhost listener.
+ * 4. POST `grant_type=authorization_code` + `code_verifier` to `/dwsso/oauth2/access_token`.
+ *
+ * Tokens may include a refresh_token (depends on client registration in Account Manager).
+ */
+export class PkceOAuthStrategy {
+    config;
+    accountManagerHost;
+    localPort;
+    redirectUri;
+    persistSession;
+    _hasHadSuccess = false;
+    _refreshToken = null;
+    _sub = '';
+    _hydrated = false;
+    constructor(config) {
+        this.config = config;
+        this.accountManagerHost = config.accountManagerHost || DEFAULT_ACCOUNT_MANAGER_HOST;
+        this.localPort = config.localPort || parseInt(process.env.SFCC_OAUTH_LOCAL_PORT || '', 10) || DEFAULT_LOCAL_PORT;
+        this.redirectUri = config.redirectUri || process.env.SFCC_REDIRECT_URI || `http://localhost:${this.localPort}`;
+        this.persistSession = config.persistSession !== false;
+        getLogger().debug({
+            clientId: this.config.clientId,
+            accountManagerHost: this.accountManagerHost,
+            port: this.localPort,
+            redirectUri: this.redirectUri,
+            persistSession: this.persistSession,
+        }, '[Auth] PkceOAuthStrategy initialized');
+    }
+    /**
+     * Load any persisted session for this clientId. Idempotent.
+     */
+    hydrate() {
+        if (!this.persistSession || this._hydrated)
+            return;
+        this._hydrated = true;
+        try {
+            const stored = findAuthSession(this.config.clientId);
+            if (!stored || stored.flow !== 'pkce')
+                return;
+            this._sub = stored.sub ?? '';
+            this._refreshToken = stored.refreshToken ?? null;
+            if (!ACCESS_TOKEN_CACHE.has(this.config.clientId) && stored.accessToken) {
+                const expires = stored.expiresAt ? new Date(stored.expiresAt) : new Date(0);
+                ACCESS_TOKEN_CACHE.set(this.config.clientId, {
+                    accessToken: stored.accessToken,
+                    expires,
+                    scopes: stored.scopes ?? [],
+                });
+            }
+            getLogger().debug({ clientId: this.config.clientId, sub: this._sub, hasRefresh: this._refreshToken !== null }, '[Auth] Hydrated PKCE session from store');
+        }
+        catch (error) {
+            getLogger().debug({ err: error }, '[Auth] PKCE store hydration failed');
+        }
+    }
+    async fetch(url, init = {}) {
+        const logger = getLogger();
+        const method = init.method || 'GET';
+        const token = await this.getAccessToken();
+        const headers = new Headers(init.headers);
+        headers.set('Authorization', `Bearer ${token}`);
+        headers.set('x-dw-client-id', this.config.clientId);
+        let res = await dispatchFetch(url, { ...init, headers });
+        logger.debug({ method, url, status: res.status }, '[Auth] Response');
+        if (res.status !== 401) {
+            this._hasHadSuccess = true;
+        }
+        if (res.status === 401 && this._hasHadSuccess) {
+            logger.debug('[Auth] Received 401, invalidating PKCE token and retrying');
+            this.invalidateToken();
+            const newToken = await this.getAccessToken();
+            headers.set('Authorization', `Bearer ${newToken}`);
+            res = await dispatchFetch(url, { ...init, headers });
+            logger.debug({ method, url, status: res.status }, '[Auth] Retry response');
+        }
+        return res;
+    }
+    async getAuthorizationHeader() {
+        const token = await this.getAccessToken();
+        return `Bearer ${token}`;
+    }
+    async getJWT() {
+        const token = await this.getAccessToken();
+        return decodeJWT(token);
+    }
+    async getTokenResponse() {
+        this.hydrate();
+        const cached = ACCESS_TOKEN_CACHE.get(this.config.clientId);
+        if (cached && this.isCachedTokenUsable(cached)) {
+            return cached;
+        }
+        if (this._refreshToken) {
+            const refreshed = await this.tryRefresh();
+            if (refreshed)
+                return refreshed;
+        }
+        const tokenResponse = await this.runFlow();
+        ACCESS_TOKEN_CACHE.set(this.config.clientId, tokenResponse);
+        return tokenResponse;
+    }
+    invalidateToken() {
+        // Only drop the cached access token. The refresh token is preserved so the
+        // next getAccessToken() can silently mint a new access token via
+        // tryRefresh() instead of re-opening the browser. tryRefresh() forgets the
+        // refresh token on its own when the exchange genuinely fails (revoked /
+        // expired), which is the only case where we fall back to the browser flow.
+        ACCESS_TOKEN_CACHE.delete(this.config.clientId);
+    }
+    isCachedTokenUsable(cached) {
+        const requiredScopes = this.config.scopes || [];
+        const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
+        return hasAllScopes && Date.now() <= cached.expires.getTime();
+    }
+    async getAccessToken() {
+        this.hydrate();
+        const clientId = this.config.clientId;
+        const cached = ACCESS_TOKEN_CACHE.get(clientId);
+        if (cached && this.isCachedTokenUsable(cached)) {
+            return cached.accessToken;
+        }
+        if (cached) {
+            ACCESS_TOKEN_CACHE.delete(clientId);
+        }
+        const pending = PENDING_AUTH.get(clientId);
+        if (pending) {
+            const tokenResponse = await pending;
+            return tokenResponse.accessToken;
+        }
+        const authPromise = (async () => {
+            if (this._refreshToken) {
+                const refreshed = await this.tryRefresh();
+                if (refreshed)
+                    return refreshed;
+            }
+            return this.runFlow();
+        })();
+        PENDING_AUTH.set(clientId, authPromise);
+        try {
+            const tokenResponse = await authPromise;
+            ACCESS_TOKEN_CACHE.set(clientId, tokenResponse);
+            return tokenResponse.accessToken;
+        }
+        finally {
+            PENDING_AUTH.delete(clientId);
+        }
+    }
+    /**
+     * Exchange a stored refresh_token for a new access token. Returns null if no
+     * refresh token is available or the exchange fails (e.g. revoked / expired).
+     * On failure, the refresh token is forgotten so the next request triggers
+     * the browser flow.
+     */
+    async tryRefresh() {
+        const logger = getLogger();
+        if (!this._refreshToken)
+            return null;
+        const tokenUrl = `https://${this.accountManagerHost}/dwsso/oauth2/access_token`;
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: this._refreshToken,
+            client_id: this.config.clientId,
+        });
+        if (this.config.scopes && this.config.scopes.length > 0) {
+            body.set('scope', this.config.scopes.join(' '));
+        }
+        logger.debug({ method: 'POST', url: tokenUrl }, '[Auth REQ] POST /dwsso/oauth2/access_token (refresh_token)');
+        // refresh_token is a secret; trace only the non-sensitive parameters.
+        logger.trace({
+            method: 'POST',
+            url: tokenUrl,
+            body: { grant_type: 'refresh_token', client_id: this.config.clientId, scope: this.config.scopes?.join(' ') },
+        }, '[Auth REQ BODY] POST /dwsso/oauth2/access_token (refresh_token)');
+        let response;
+        try {
+            response = await dispatchFetch(tokenUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: body.toString(),
+            });
+        }
+        catch (error) {
+            logger.debug({ err: error }, '[Auth] PKCE refresh request failed');
+            this._refreshToken = null;
+            return null;
+        }
+        logger.debug({ url: tokenUrl, status: response.status }, `[Auth RESP] POST /dwsso/oauth2/access_token ${response.status}`);
+        if (!response.ok) {
+            const text = await response.text();
+            const oauthError = parseOAuthErrorBody(text);
+            logger.trace({ url: tokenUrl, status: response.status, body: oauthError }, '[Auth RESP BODY] POST /dwsso/oauth2/access_token (refresh_token)');
+            logger.debug({ status: response.status, oauthError: oauthError.error }, '[Auth] PKCE refresh failed; falling back to browser flow');
+            this._refreshToken = null;
+            return null;
+        }
+        let parsed;
+        try {
+            parsed = (await response.json());
+        }
+        catch (error) {
+            logger.debug({ err: error }, '[Auth] PKCE refresh returned non-JSON response');
+            this._refreshToken = null;
+            return null;
+        }
+        if (typeof parsed.access_token !== 'string' || parsed.access_token.length === 0) {
+            logger.debug('[Auth] PKCE refresh response did not contain an access token');
+            this._refreshToken = null;
+            return null;
+        }
+        const expiresIn = typeof parsed.expires_in === 'number' ? parsed.expires_in : 0;
+        const expires = new Date(Date.now() + expiresIn * 1000);
+        const scopes = typeof parsed.scope === 'string' ? parsed.scope.split(' ') : (this.config.scopes ?? []);
+        const tokenResponse = {
+            accessToken: parsed.access_token,
+            expires,
+            scopes,
+        };
+        if (typeof parsed.refresh_token === 'string' && parsed.refresh_token.length > 0) {
+            this._refreshToken = parsed.refresh_token;
+        }
+        try {
+            logger.trace({ jwt: decodeJWT(parsed.access_token).payload }, '[Auth] Refreshed PKCE access token JWT payload');
+        }
+        catch {
+            // access token is not a JWT; nothing to trace
+        }
+        this.persistTokens(tokenResponse);
+        logger.debug({ clientId: this.config.clientId }, '[Auth] PKCE token refreshed silently');
+        return tokenResponse;
+    }
+    /**
+     * Persist the current token + refresh token. No-op when `persistSession`
+     * is disabled. Updates `_sub` from the JWT when available so the persisted
+     * record carries the authenticated user identity for diagnostics.
+     */
+    persistTokens(tokenResponse) {
+        if (!this.persistSession)
+            return;
+        let sub = this._sub;
+        try {
+            const decoded = decodeJWT(tokenResponse.accessToken);
+            if (typeof decoded.payload.sub === 'string' && decoded.payload.sub.length > 0) {
+                sub = decoded.payload.sub;
+            }
+        }
+        catch {
+            // ignore — token may not be a JWT, fall back to existing _sub
+        }
+        this._sub = sub;
+        const record = {
+            clientId: this.config.clientId,
+            flow: 'pkce',
+            accessToken: tokenResponse.accessToken,
+            refreshToken: this._refreshToken,
+            sub,
+            expiresAt: tokenResponse.expires.toISOString(),
+            scopes: tokenResponse.scopes,
+            accountManagerHost: this.accountManagerHost,
+        };
+        try {
+            saveAuthSession(record);
+        }
+        catch (error) {
+            getLogger().debug({ err: error }, '[Auth] Failed to persist PKCE session');
+        }
+    }
+    async runFlow() {
+        const logger = getLogger();
+        logger.trace({ clientId: this.config.clientId, scopes: this.config.scopes, redirectUri: this.redirectUri }, '[Auth] Starting Authorization Code + PKCE flow');
+        const { verifier, challenge } = generatePkcePair();
+        const state = base64url(randomBytes(16));
+        // Verifier is a secret; trace only the derived challenge and state.
+        logger.trace({ codeChallenge: challenge, codeChallengeMethod: 'S256', state }, '[Auth] Generated PKCE challenge');
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.redirectUri,
+            response_type: 'code',
+            code_challenge: challenge,
+            code_challenge_method: 'S256',
+            state,
+        });
+        if (this.config.scopes && this.config.scopes.length > 0) {
+            params.set('scope', this.config.scopes.join(' '));
+        }
+        const authorizeUrl = `https://${this.accountManagerHost}/dwsso/oauth2/authorize?${params.toString()}`;
+        logger.info({ url: authorizeUrl }, `Login URL: ${authorizeUrl}`);
+        logger.info('If the URL does not open automatically, copy/paste it into a browser on this machine.');
+        const code = await this.waitForAuthCode(state, async () => {
+            if (this.config.openBrowser) {
+                await this.config.openBrowser(authorizeUrl);
+            }
+            else {
+                await openBrowserDefault(authorizeUrl);
+            }
+        });
+        logger.debug({ codePrefix: code.slice(0, 8) }, '[Auth] Got authorization code, exchanging for token');
+        const tokenUrl = `https://${this.accountManagerHost}/dwsso/oauth2/access_token`;
+        const tokenBody = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: this.redirectUri,
+            client_id: this.config.clientId,
+            code_verifier: verifier,
+        });
+        logger.debug({ method: 'POST', url: tokenUrl }, '[Auth REQ] POST /dwsso/oauth2/access_token (authorization_code)');
+        // Redact the single-use code and PKCE verifier from the traced body.
+        logger.trace({
+            method: 'POST',
+            url: tokenUrl,
+            body: { grant_type: 'authorization_code', redirect_uri: this.redirectUri, client_id: this.config.clientId },
+        }, '[Auth REQ BODY] POST /dwsso/oauth2/access_token');
+        const tokenRes = await dispatchFetch(tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: tokenBody.toString(),
+        });
+        const rawText = await tokenRes.text();
+        logger.debug({ url: tokenUrl, status: tokenRes.status }, `[Auth RESP] POST /dwsso/oauth2/access_token ${tokenRes.status}`);
+        if (!tokenRes.ok) {
+            // Distinguish "this client can't do the code grant" (which the implicit
+            // fallback can rescue) from real errors that would fail identically under
+            // implicit — e.g. invalid_scope, invalid_grant. Only the former is typed
+            // as PkceGrantUnsupportedError; everything else is a plain Error so the
+            // fallback wrapper propagates it instead of silently downgrading.
+            const errorBody = parseOAuthErrorBody(rawText);
+            const oauthError = errorBody.error;
+            logger.trace({ url: tokenUrl, status: tokenRes.status, body: errorBody }, '[Auth RESP BODY] POST /dwsso/oauth2/access_token');
+            const detail = errorBody.errorDescription ?? errorBody.error;
+            const message = `PKCE token exchange failed (${tokenRes.status})${detail ? `: ${detail}` : ''}`;
+            if (isPkceGrantUnsupportedError(oauthError)) {
+                throw new PkceGrantUnsupportedError(message, 'token', oauthError);
+            }
+            throw new Error(message);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(rawText);
+        }
+        catch {
+            // Do not echo an untrusted response body: a malformed success response
+            // can still contain live token material.
+            throw new Error('PKCE token exchange returned a non-JSON response');
+        }
+        if (typeof parsed.access_token !== 'string' || parsed.access_token.length === 0) {
+            throw new Error('PKCE token exchange response did not contain an access token');
+        }
+        // Never log the raw token response: it contains both the access token and
+        // the long-lived refresh token, and an opaque string bypasses pino's
+        // field-based redaction. JWT claims are traced below after decoding.
+        logger.trace({
+            url: tokenUrl,
+            status: tokenRes.status,
+            body: {
+                expires_in: parsed.expires_in,
+                scope: parsed.scope,
+                hasAccessToken: typeof parsed.access_token === 'string' && parsed.access_token.length > 0,
+                hasRefreshToken: typeof parsed.refresh_token === 'string' && parsed.refresh_token.length > 0,
+            },
+        }, '[Auth RESP BODY] POST /dwsso/oauth2/access_token');
+        const expiresIn = typeof parsed.expires_in === 'number' ? parsed.expires_in : 0;
+        const expires = new Date(Date.now() + expiresIn * 1000);
+        const scopes = typeof parsed.scope === 'string' ? parsed.scope.split(' ') : (this.config.scopes ?? []);
+        const tokenResponse = {
+            accessToken: parsed.access_token,
+            expires,
+            scopes,
+        };
+        if (typeof parsed.refresh_token === 'string' && parsed.refresh_token.length > 0) {
+            this._refreshToken = parsed.refresh_token;
+        }
+        logger.trace({ scopes, expires, hasRefreshToken: !!parsed.refresh_token }, '[Auth] PKCE token exchange succeeded');
+        try {
+            logger.trace({ jwt: decodeJWT(parsed.access_token).payload }, '[Auth] PKCE access token JWT payload');
+        }
+        catch {
+            // access token is not a JWT; nothing to trace
+        }
+        this.persistTokens(tokenResponse);
+        return tokenResponse;
+    }
+    waitForAuthCode(expectedState, openBrowser) {
+        const logger = getLogger();
+        return new Promise((resolve, reject) => {
+            const sockets = new Set();
+            let settled = false;
+            const settleAfterClose = (settle) => {
+                if (settled)
+                    return;
+                settled = true;
+                const forceCloseTimer = setTimeout(() => {
+                    for (const socket of sockets)
+                        socket.destroy();
+                }, 100);
+                server.close(() => {
+                    clearTimeout(forceCloseTimer);
+                    for (const socket of sockets)
+                        socket.destroy();
+                    settle();
+                });
+            };
+            const server = createServer((req, res) => {
+                const requestUrl = new URL(req.url || '/', `http://localhost:${this.localPort}`);
+                const code = requestUrl.searchParams.get('code');
+                const state = requestUrl.searchParams.get('state') ?? '';
+                const error = requestUrl.searchParams.get('error');
+                const errorDescription = requestUrl.searchParams.get('error_description');
+                if (error) {
+                    res.writeHead(500, { 'Content-Type': 'text/plain' });
+                    res.end(`Authentication failed: ${errorDescription ?? error}`);
+                    // Only a grant/registration error (e.g. unsupported_response_type,
+                    // unauthorized_client) means the client can't do the code grant — the
+                    // implicit fallback can rescue that. A user-driven error like
+                    // access_denied (cancelled consent) MUST NOT fall back, so type it
+                    // only for the grant-unsupported set; otherwise reject plainly.
+                    const message = `OAuth error: ${errorDescription ?? error}`;
+                    const authError = isPkceGrantUnsupportedError(error)
+                        ? new PkceGrantUnsupportedError(message, 'authorize', error)
+                        : new Error(message);
+                    settleAfterClose(() => reject(authError));
+                    return;
+                }
+                if (!code) {
+                    res.writeHead(404, { 'Content-Type': 'text/plain' });
+                    res.end('Waiting for authorization code...');
+                    return;
+                }
+                if (state !== expectedState) {
+                    res.writeHead(400, { 'Content-Type': 'text/plain' });
+                    res.end('State mismatch.');
+                    settleAfterClose(() => reject(new Error('OAuth state mismatch — aborting')));
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'text/plain' });
+                res.end('Authentication successful! You may close this browser window and return to your terminal.');
+                settleAfterClose(() => resolve(code));
+            });
+            server.on('connection', (socket) => {
+                sockets.add(socket);
+                socket.on('close', () => sockets.delete(socket));
+            });
+            server.listen(this.localPort, async () => {
+                logger.debug({ port: this.localPort }, `[Auth] PKCE redirect server listening on port ${this.localPort}`);
+                logger.info('Waiting for user to authenticate...');
+                try {
+                    await openBrowser();
+                }
+                catch (error) {
+                    const browserError = error instanceof Error ? error : new Error(String(error));
+                    settleAfterClose(() => reject(browserError));
+                }
+            });
+            server.on('error', (err) => {
+                const hint = 'code' in err && err.code === 'EADDRINUSE'
+                    ? ` Port ${this.localPort} is in use; set SFCC_OAUTH_LOCAL_PORT or pass localPort to use a different port.`
+                    : '';
+                if (!settled) {
+                    settled = true;
+                    reject(new Error(`Failed to start OAuth redirect server: ${err.message}.${hint}`));
+                }
+            });
+        });
+    }
+}
+//# sourceMappingURL=oauth-pkce.js.map

package/dist/esm/auth/oauth-pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-pkce.js","sourceRoot":"","sources":["../../../src/auth/oauth-pkce.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,UAAU,EAAE,WAAW,EAAC,MAAM,aAAa,CAAC;AACpD,OAAO,EAAC,YAAY,EAAyD,MAAM,WAAW,CAAC;AAE/F,OAAO,EAAC,GAAG,EAAC,MAAM,UAAU,CAAC;AAE7B,OAAO,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AACrC,OAAO,EAAC,4BAA4B,EAAC,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAC,eAAe,EAAE,eAAe,EAAmB,MAAM,oBAAoB,CAAC;AAEtF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,MAAM,kBAAkB,GAAqC,IAAI,GAAG,EAAE,CAAC;AACvE,MAAM,YAAY,GAA8C,IAAI,GAAG,EAAE,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,gGAAgG;IACvF,UAAU,CAAU;IAC7B,qDAAqD;IAC5C,KAAK,CAAwB;IAEtC,YAAY,OAAe,EAAE,KAA4B,EAAE,UAAmB;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC;IAClD,gBAAgB;IAChB,qBAAqB;IACrB,2BAA2B;IAC3B,wBAAwB;CACzB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,UAA8B;IACjE,OAAO,UAAU,KAAK,SAAS,IAAI,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACzF,CAAC;AAwBD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAC,QAAQ,EAAE,SAAS,EAAC,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmD,CAAC;QAClF,OAAO;YACL,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAClE,gBAAgB,EAAE,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;SACtG,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IAUR;IATZ,kBAAkB,CAAS;IAC3B,SAAS,CAAS;IAClB,WAAW,CAAS;IACpB,cAAc,CAAU;IACxB,cAAc,GAAG,KAAK,CAAC;IACvB,aAAa,GAAkB,IAAI,CAAC;IACpC,IAAI,GAAG,EAAE,CAAC;IACV,SAAS,GAAG,KAAK,CAAC;IAE1B,YAAoB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;QACzC,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC;QACjH,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/G,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC;QAEtD,SAAS,EAAE,CAAC,KAAK,CACf;YACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,EACD,sCAAsC,CACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO;YAC9C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;YACjD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxE,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5E,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,OAAO;oBACP,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,SAAS,EAAE,CAAC,KAAK,CACf,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI,EAAC,EACzF,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,EAAE,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,KAAK,EAAC,EAAE,oCAAoC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAkB,EAAE;QAC3C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QAEpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAC,EAAE,iBAAiB,CAAC,CAAC;QAEnE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC1E,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YACnD,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAC,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;QAClC,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3C,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,eAAe;QACb,2EAA2E;QAC3E,iEAAiE;QACjE,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAEO,mBAAmB,CAAC,MAA2B;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,OAAO,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC;YACpC,OAAO,aAAa,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,KAAK,IAAkC,EAAE;YAC5D,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1C,IAAI,SAAS;oBAAE,OAAO,SAAS,CAAC;YAClC,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC,CAAC,EAAE,CAAC;QACL,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC;YACxC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAChD,OAAO,aAAa,CAAC,WAAW,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU;QACtB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,kBAAkB,4BAA4B,CAAC;QAChF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAChC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAC,EAAE,4DAA4D,CAAC,CAAC;QAC5G,sEAAsE;QACtE,MAAM,CAAC,KAAK,CACV;YACE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,EAAC,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAC;SAC3G,EACD,iEAAiE,CAClE,CAAC;QAEF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAC,cAAc,EAAE,mCAAmC,EAAC;gBAC9D,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,KAAK,EAAC,EAAE,oCAAoC,CAAC,CAAC;YACjE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,KAAK,CACV,EAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAC,EACxC,+CAA+C,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CACV,EAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAC,EAC1D,kEAAkE,CACnE,CAAC;YACF,MAAM,CAAC,KAAK,CACV,EAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAC,EACvD,0DAA0D,CAC3D,CAAC;YACF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAKH,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,KAAK,EAAC,EAAE,gDAAgD,CAAC,CAAC;YAC7E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC7E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACvG,MAAM,aAAa,GAAwB;YACzC,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,OAAO;YACP,MAAM;SACP,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAC,EAAE,gDAAgD,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC,EAAE,sCAAsC,CAAC,CAAC;QACvF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,aAAkC;QACtD,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QAEjC,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YACrD,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9E,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,MAAM,MAAM,GAAgB;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,GAAG;YACH,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE;YAC9C,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC;QACF,IAAI,CAAC;YACH,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,EAAE,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,KAAK,EAAC,EAAE,uCAAuC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAC,EAC3F,gDAAgD,CACjD,CAAC;QACF,MAAM,EAAC,QAAQ,EAAE,SAAS,EAAC,GAAG,gBAAgB,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,oEAAoE;QACpE,MAAM,CAAC,KAAK,CAAC,EAAC,aAAa,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,EAAC,EAAE,iCAAiC,CAAC,CAAC;QAEhH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,SAAS;YACzB,qBAAqB,EAAE,MAAM;YAC7B,KAAK;SACN,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,IAAI,CAAC,kBAAkB,2BAA2B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEtG,MAAM,CAAC,IAAI,CAAC,EAAC,GAAG,EAAE,YAAY,EAAC,EAAE,cAAc,YAAY,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAErG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACxD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,EAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAC,EAAE,qDAAqD,CAAC,CAAC;QAEpG,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,kBAAkB,4BAA4B,CAAC;QAChF,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC;YACpC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,QAAQ;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAC,EAAE,iEAAiE,CAAC,CAAC;QACjH,qEAAqE;QACrE,MAAM,CAAC,KAAK,CACV;YACE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,EAAC,UAAU,EAAE,oBAAoB,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC;SAC1G,EACD,iDAAiD,CAClD,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAC,cAAc,EAAE,mCAAmC,EAAC;YAC9D,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CACV,EAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAC,EACxC,+CAA+C,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,EAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAC,EACzD,kDAAkD,CACnD,CAAC;YACF,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,IAAI,SAAS,CAAC,KAAK,CAAC;YAC7D,MAAM,OAAO,GAAG,+BAA+B,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAChG,IAAI,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,MAKH,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,yCAAyC;YACzC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,CAAC,KAAK,CACV;YACE,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,cAAc,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;gBACzF,eAAe,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;aAC7F;SACF,EACD,kDAAkD,CACnD,CAAC;QAEF,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACvG,MAAM,aAAa,GAAwB;YACzC,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,OAAO;YACP,MAAM;SACP,CAAC;QAEF,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC5C,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAC,EAAE,sCAAsC,CAAC,CAAC;QACjH,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAC,EAAE,sCAAsC,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAElC,OAAO,aAAa,CAAC;IACvB,CAAC;IAEO,eAAe,CAAC,aAAqB,EAAE,WAAgC;QAC7E,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC;YACvC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,gBAAgB,GAAG,CAAC,MAAkB,EAAE,EAAE;gBAC9C,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,eAAe,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtC,KAAK,MAAM,MAAM,IAAI,OAAO;wBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjD,CAAC,EAAE,GAAG,CAAC,CAAC;gBACR,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;oBAChB,YAAY,CAAC,eAAe,CAAC,CAAC;oBAC9B,KAAK,MAAM,MAAM,IAAI,OAAO;wBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC/C,MAAM,EAAE,CAAC;gBACX,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;gBAChF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACjF,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACzD,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAE1E,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAC;oBACnD,GAAG,CAAC,GAAG,CAAC,0BAA0B,gBAAgB,IAAI,KAAK,EAAE,CAAC,CAAC;oBAC/D,mEAAmE;oBACnE,sEAAsE;oBACtE,8DAA8D;oBAC9D,mEAAmE;oBACnE,gEAAgE;oBAChE,MAAM,OAAO,GAAG,gBAAgB,gBAAgB,IAAI,KAAK,EAAE,CAAC;oBAC5D,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC;wBAClD,CAAC,CAAC,IAAI,yBAAyB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC;wBAC5D,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBACvB,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAC;oBACnD,GAAG,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;oBAC7C,OAAO;gBACT,CAAC;gBAED,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAC;oBACnD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;oBAC3B,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC;oBAC7E,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAC;gBACnD,GAAG,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;gBACrG,gBAAgB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;gBACjC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;gBACvC,MAAM,CAAC,KAAK,CAAC,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAC,EAAE,iDAAiD,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACxG,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;gBACnD,IAAI,CAAC;oBACH,MAAM,WAAW,EAAE,CAAC;gBACtB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC/E,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,IAAI,GACR,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,YAAY;oBACnE,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,kFAAkF;oBAC3G,CAAC,CAAC,EAAE,CAAC;gBACT,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/esm/auth/resolve.d.ts

@@ -29,7 +29,8 @@ export interface ResolveAuthStrategyOptions {
     /**
      * Allowed authentication methods in priority order.
      * The first method with available credentials will be used.
-     * Defaults to: ['client-credentials', 'implicit', 'basic', 'api-key'].
+     * Defaults to {@link ALL_AUTH_METHODS}, where PKCE-based `user` auth is
+     * preferred over the deprecated `implicit` flow.
      *
      * Note: the `'jwt'` method is defined in the {@link AuthMethod} type but is
      * not automatically resolvable here, because JWT auth requires file paths
@@ -67,7 +68,7 @@ export interface AvailableAuthMethods {
  *   clientSecret: 'my-secret',
  * });
  *
- * console.log(result.available); // ['client-credentials', 'implicit']
+ * console.log(result.available); // ['client-credentials', 'user', 'implicit']
  * ```
  */
 export declare function checkAvailableAuthMethods(credentials: AuthCredentials, allowedMethods?: AuthMethod[]): AvailableAuthMethods;
@@ -86,7 +87,7 @@ export declare function checkAvailableAuthMethods(credentials: AuthCredentials,
  * ```typescript
  * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
  *
- * // Will use client-credentials if secret is available, otherwise implicit
+ * // Will use client-credentials if secret is available, otherwise PKCE user auth
  * const strategy = resolveAuthStrategy({
  *   clientId: 'my-client-id',
  *   clientSecret: process.env.CLIENT_SECRET, // may be undefined