@salesforce/b2c-tooling-sdk 1.9.0 → 1.11.0

package/dist/cjs/auth/oauth-implicit.d.ts

@@ -1,89 +0,0 @@
-import type { AuthStrategy, AccessTokenResponse, DecodedJWT, FetchInit } from './types.js';
-/**
- * Configuration for the implicit OAuth flow.
- */
-export interface ImplicitOAuthConfig {
-    /** OAuth client ID registered with Account Manager */
-    clientId: string;
-    /** OAuth scopes to request (e.g., 'sfcc.products', 'sfcc.orders') */
-    scopes?: string[];
-    /** Account Manager host (defaults to 'account.demandware.com') */
-    accountManagerHost?: string;
-    /**
-     * Local port for the OAuth redirect server.
-     * Defaults to 8080 or SFCC_OAUTH_LOCAL_PORT environment variable.
-     */
-    localPort?: number;
-    /**
-     * Full redirect URI for OAuth. Use when running behind a proxy where
-     * localhost cannot be reached directly by the browser.
-     * Defaults to `http://localhost:${localPort}` or SFCC_REDIRECT_URI environment variable.
-     * The local server still listens on localPort regardless of this setting.
-     */
-    redirectUri?: string;
-    /**
-     * Custom browser opener. Receives the authorization URL and should open it
-     * in the user's browser. Useful in environments where the default `open` package
-     * doesn't work (e.g., VS Code remote/Codespaces where `vscode.env.openExternal` is needed).
-     */
-    openBrowser?: (url: string) => Promise<void>;
-}
-/**
- * OAuth 2.0 Implicit Grant Flow authentication strategy.
- *
- * This strategy is used when only a client ID is available (no client secret).
- * It opens a browser for the user to authenticate with Account Manager,
- * then captures the access token from the OAuth redirect.
- *
- * Note: The access token from implicit flow is valid for 30 minutes and cannot be renewed.
- * This flow requires user interaction and a TTY.
- *
- * @example
- * ```typescript
- * import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * const auth = new ImplicitOAuthStrategy({
- *   clientId: 'your-client-id',
- *   scopes: ['sfcc.products', 'sfcc.orders'],
- * });
- *
- * // Will open browser for authentication
- * const response = await auth.fetch('https://example.com/api/resource');
- * ```
- */
-export declare class ImplicitOAuthStrategy implements AuthStrategy {
-    private config;
-    private accountManagerHost;
-    private localPort;
-    private redirectUri;
-    private _hasHadSuccess;
-    constructor(config: ImplicitOAuthConfig);
-    fetch(url: string, init?: FetchInit): Promise<Response>;
-    getAuthorizationHeader(): Promise<string>;
-    /**
-     * Gets the decoded JWT payload
-     */
-    getJWT(): Promise<DecodedJWT>;
-    /**
-     * Gets the full token response including expiration and scopes.
-     * Useful for commands that need to display or return token metadata.
-     */
-    getTokenResponse(): Promise<AccessTokenResponse>;
-    /**
-     * Invalidates the cached token, forcing re-authentication on next request
-     */
-    invalidateToken(): void;
-    /**
-     * Gets an access token, using cache if valid.
-     * Uses a mutex to prevent concurrent auth flows for the same clientId.
-     */
-    private getAccessToken;
-    /**
-     * Performs an implicit OAuth2 login flow.
-     * Opens the user's browser for authentication with Account Manager.
-     *
-     * NOTE: This method requires a TTY and user intervention; it is interactive.
-     * NOTE: Access token is valid for 30 minutes and cannot be renewed.
-     */
-    private implicitFlowLogin;
-}

package/dist/cjs/auth/oauth-implicit.js

@@ -1,350 +0,0 @@
-/*
- * Copyright (c) 2025, Salesforce, Inc.
- * SPDX-License-Identifier: Apache-2
- * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
- */
-import { createServer } from 'node:http';
-import { URL } from 'node:url';
-import { getLogger } from '../logging/logger.js';
-import { decodeJWT } from './oauth.js';
-import { DEFAULT_ACCOUNT_MANAGER_HOST } from '../defaults.js';
-const DEFAULT_LOCAL_PORT = 8080;
-// Module-level token cache to support multiple instances with same clientId
-const ACCESS_TOKEN_CACHE = new Map();
-// Module-level pending auth promises to prevent concurrent auth flows for the same clientId
-const PENDING_AUTH = new Map();
-/**
- * Returns the HTML page served to the browser to extract the access token
- * from the URL fragment and redirect it as query parameters.
- */
-function getOauth2RedirectHTML(redirectUri) {
-    return `
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <title>OAuth Return Flow</title>
-</head>
-<body onload="doReturnFlow()">
-<script>
-    function doReturnFlow() {
-        document.location = "${redirectUri}/?" + window.location.hash.substring(1);
-    }
-</script>
-</body>
-</html>
-`;
-}
-/**
- * Opens the system default browser to the specified URL.
- * Dynamically imports 'open' package to handle the browser opening.
- */
-async function openBrowserDefault(url) {
-    try {
-        // Dynamic import of 'open' package
-        const open = await import('open');
-        await open.default(url);
-    }
-    catch {
-        // If open fails, the URL will still be printed to console
-        getLogger().debug('Could not automatically open browser');
-    }
-}
-/**
- * OAuth 2.0 Implicit Grant Flow authentication strategy.
- *
- * This strategy is used when only a client ID is available (no client secret).
- * It opens a browser for the user to authenticate with Account Manager,
- * then captures the access token from the OAuth redirect.
- *
- * Note: The access token from implicit flow is valid for 30 minutes and cannot be renewed.
- * This flow requires user interaction and a TTY.
- *
- * @example
- * ```typescript
- * import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * const auth = new ImplicitOAuthStrategy({
- *   clientId: 'your-client-id',
- *   scopes: ['sfcc.products', 'sfcc.orders'],
- * });
- *
- * // Will open browser for authentication
- * const response = await auth.fetch('https://example.com/api/resource');
- * ```
- */
-export class ImplicitOAuthStrategy {
-    config;
-    accountManagerHost;
-    localPort;
-    redirectUri;
-    _hasHadSuccess = false;
-    constructor(config) {
-        this.config = config;
-        this.accountManagerHost = config.accountManagerHost || DEFAULT_ACCOUNT_MANAGER_HOST;
-        this.localPort = config.localPort || parseInt(process.env.SFCC_OAUTH_LOCAL_PORT || '', 10) || DEFAULT_LOCAL_PORT;
-        this.redirectUri = config.redirectUri || process.env.SFCC_REDIRECT_URI || `http://localhost:${this.localPort}`;
-        const logger = getLogger();
-        logger.debug({
-            clientId: this.config.clientId,
-            accountManagerHost: this.accountManagerHost,
-            port: this.localPort,
-            redirectUri: this.redirectUri,
-        }, '[Auth] ImplicitOAuthStrategy initialized');
-        logger.trace({ scopes: this.config.scopes }, '[Auth] Configured scopes');
-    }
-    async fetch(url, init = {}) {
-        const logger = getLogger();
-        const method = init.method || 'GET';
-        logger.trace({ method, url }, '[Auth] Fetching with implicit OAuth');
-        const token = await this.getAccessToken();
-        const headers = new Headers(init.headers);
-        headers.set('Authorization', `Bearer ${token}`);
-        headers.set('x-dw-client-id', this.config.clientId);
-        const startTime = Date.now();
-        // Pass through dispatcher for TLS/mTLS support
-        let res = await fetch(url, { ...init, headers });
-        const duration = Date.now() - startTime;
-        logger.debug({ method, url, status: res.status, duration }, '[Auth] Response');
-        if (res.status !== 401) {
-            this._hasHadSuccess = true;
-        }
-        // RESILIENCE: If we previously had a successful response and now get a 401,
-        // the token likely expired. Retry once after invalidating the cached token.
-        // Skip retry on initial 401 to avoid retrying with bad credentials.
-        if (res.status === 401 && this._hasHadSuccess) {
-            logger.debug('[Auth] Received 401, invalidating token and retrying');
-            this.invalidateToken();
-            const newToken = await this.getAccessToken();
-            headers.set('Authorization', `Bearer ${newToken}`);
-            const retryStart = Date.now();
-            res = await fetch(url, { ...init, headers });
-            const retryDuration = Date.now() - retryStart;
-            logger.debug({ method, url, status: res.status, duration: retryDuration }, '[Auth] Retry response');
-        }
-        return res;
-    }
-    async getAuthorizationHeader() {
-        const token = await this.getAccessToken();
-        return `Bearer ${token}`;
-    }
-    /**
-     * Gets the decoded JWT payload
-     */
-    async getJWT() {
-        const token = await this.getAccessToken();
-        return decodeJWT(token);
-    }
-    /**
-     * Gets the full token response including expiration and scopes.
-     * Useful for commands that need to display or return token metadata.
-     */
-    async getTokenResponse() {
-        const logger = getLogger();
-        const cached = ACCESS_TOKEN_CACHE.get(this.config.clientId);
-        if (cached) {
-            const now = new Date();
-            const requiredScopes = this.config.scopes || [];
-            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
-            if (hasAllScopes && now.getTime() <= cached.expires.getTime()) {
-                logger.debug('Reusing cached access token');
-                return cached;
-            }
-        }
-        // Get new token via implicit flow
-        const tokenResponse = await this.implicitFlowLogin();
-        ACCESS_TOKEN_CACHE.set(this.config.clientId, tokenResponse);
-        return tokenResponse;
-    }
-    /**
-     * Invalidates the cached token, forcing re-authentication on next request
-     */
-    invalidateToken() {
-        ACCESS_TOKEN_CACHE.delete(this.config.clientId);
-    }
-    /**
-     * Gets an access token, using cache if valid.
-     * Uses a mutex to prevent concurrent auth flows for the same clientId.
-     */
-    async getAccessToken() {
-        const logger = getLogger();
-        const clientId = this.config.clientId;
-        const cached = ACCESS_TOKEN_CACHE.get(clientId);
-        logger.trace({ clientId, hasCached: !!cached }, '[Auth] Getting access token');
-        if (cached) {
-            const now = new Date();
-            const requiredScopes = this.config.scopes || [];
-            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
-            const timeUntilExpiry = cached.expires.getTime() - now.getTime();
-            logger.trace({
-                cachedScopes: cached.scopes,
-                requiredScopes,
-                hasAllScopes,
-                expiresAt: cached.expires.toISOString(),
-                timeUntilExpiryMs: timeUntilExpiry,
-            }, '[Auth] Checking cached token validity');
-            if (!hasAllScopes) {
-                logger.warn({ cachedScopes: cached.scopes, requiredScopes }, '[Auth] Access token missing scopes; invalidating and re-authenticating');
-                ACCESS_TOKEN_CACHE.delete(clientId);
-            }
-            else if (now.getTime() > cached.expires.getTime()) {
-                logger.warn({ expiresAt: cached.expires.toISOString() }, '[Auth] Access token expired; invalidating and re-authenticating');
-                ACCESS_TOKEN_CACHE.delete(clientId);
-            }
-            else {
-                logger.debug({ timeUntilExpiryMs: timeUntilExpiry }, '[Auth] Reusing cached access token');
-                return cached.accessToken;
-            }
-        }
-        // Check if there's already an auth flow in progress for this clientId
-        const pendingAuth = PENDING_AUTH.get(clientId);
-        if (pendingAuth) {
-            logger.debug('[Auth] Auth flow already in progress, waiting for it to complete');
-            const tokenResponse = await pendingAuth;
-            return tokenResponse.accessToken;
-        }
-        // Start new auth flow and store the promise so concurrent calls can wait
-        logger.debug('[Auth] No valid cached token, starting implicit flow login');
-        const authPromise = this.implicitFlowLogin();
-        PENDING_AUTH.set(clientId, authPromise);
-        try {
-            const tokenResponse = await authPromise;
-            ACCESS_TOKEN_CACHE.set(clientId, tokenResponse);
-            logger.debug({ expiresAt: tokenResponse.expires.toISOString(), scopes: tokenResponse.scopes }, '[Auth] New token cached');
-            return tokenResponse.accessToken;
-        }
-        finally {
-            // Clean up pending auth promise
-            PENDING_AUTH.delete(clientId);
-        }
-    }
-    /**
-     * Performs an implicit OAuth2 login flow.
-     * Opens the user's browser for authentication with Account Manager.
-     *
-     * NOTE: This method requires a TTY and user intervention; it is interactive.
-     * NOTE: Access token is valid for 30 minutes and cannot be renewed.
-     */
-    async implicitFlowLogin() {
-        const logger = getLogger();
-        const params = new URLSearchParams({
-            client_id: this.config.clientId,
-            redirect_uri: this.redirectUri,
-            response_type: 'token',
-        });
-        if (this.config.scopes && this.config.scopes.length > 0) {
-            params.append('scope', this.config.scopes.join(' '));
-        }
-        const authorizeUrl = `https://${this.accountManagerHost}/dwsso/oauth2/authorize?${params.toString()}`;
-        logger.debug({
-            clientId: this.config.clientId,
-            redirectUri: this.redirectUri,
-            scopes: this.config.scopes,
-            accountManagerHost: this.accountManagerHost,
-        }, '[Auth] Starting implicit OAuth flow');
-        logger.trace({ authorizeUrl }, '[Auth] Authorization URL');
-        // Print URL to console (in case machine has no default browser)
-        logger.info({ url: authorizeUrl }, `Login URL: ${authorizeUrl}`);
-        logger.info('If the URL does not open automatically, copy/paste it into a browser on this machine.');
-        // Attempt to open the browser (prefer injected opener, fall back to `open` package)
-        logger.debug('[Auth] Attempting to open browser');
-        if (this.config.openBrowser) {
-            await this.config.openBrowser(authorizeUrl);
-        }
-        else {
-            await openBrowserDefault(authorizeUrl);
-        }
-        return new Promise((resolve, reject) => {
-            const sockets = new Set();
-            const startTime = Date.now();
-            const server = createServer((request, response) => {
-                const requestUrl = new URL(request.url || '/', `http://localhost:${this.localPort}`);
-                const accessToken = requestUrl.searchParams.get('access_token');
-                const error = requestUrl.searchParams.get('error');
-                const errorDescription = requestUrl.searchParams.get('error_description');
-                logger.trace({
-                    path: requestUrl.pathname,
-                    hasAccessToken: !!accessToken,
-                    hasError: !!error,
-                }, '[Auth] Received redirect request');
-                if (!accessToken && !error) {
-                    // Serve HTML page to extract token from URL fragment
-                    logger.debug('[Auth] Serving token extraction HTML page');
-                    response.writeHead(200, { 'Content-Type': 'text/html' });
-                    response.write(getOauth2RedirectHTML(this.redirectUri));
-                    response.end();
-                }
-                else if (accessToken) {
-                    const authDuration = Date.now() - startTime;
-                    // Successfully received access token
-                    logger.debug({ duration: authDuration }, `[Auth] Got access token response (${authDuration}ms)`);
-                    logger.info('Successfully authenticated');
-                    try {
-                        const jwt = decodeJWT(accessToken);
-                        logger.trace({ jwt: jwt.payload }, '[Auth] Decoded JWT payload');
-                    }
-                    catch {
-                        logger.debug('[Auth] Error decoding JWT (token may not be a JWT)');
-                    }
-                    const expiresIn = parseInt(requestUrl.searchParams.get('expires_in') || '0', 10);
-                    const now = new Date();
-                    const expiration = new Date(now.getTime() + expiresIn * 1000);
-                    const scopes = requestUrl.searchParams.get('scope')?.split(' ') ?? [];
-                    logger.debug({ expiresIn, expiresAt: expiration.toISOString(), scopes }, `[Auth] Token expires in ${expiresIn}s, scopes: ${scopes.join(' ')}`);
-                    resolve({
-                        accessToken,
-                        expires: expiration,
-                        scopes,
-                    });
-                    response.writeHead(200, { 'Content-Type': 'text/plain' });
-                    response.write('Authentication successful! You may close this browser window and return to your terminal.');
-                    response.end();
-                    // Shutdown server after a short delay
-                    setTimeout(() => {
-                        logger.debug('[Auth] Shutting down OAuth redirect server');
-                        server.close(() => logger.trace('[Auth] OAuth redirect server closed'));
-                        for (const socket of sockets) {
-                            socket.destroy();
-                        }
-                        logger.trace({ socketCount: sockets.size }, '[Auth] Cleaned up sockets');
-                    }, 100);
-                }
-                else if (error) {
-                    // OAuth error response
-                    const errorMessage = errorDescription || error;
-                    logger.error({ error, errorDescription }, `[Auth] OAuth error: ${error}`);
-                    response.writeHead(500, { 'Content-Type': 'text/plain' });
-                    response.write(`Authentication failed: ${errorMessage}`);
-                    response.end();
-                    reject(new Error(`OAuth error: ${errorMessage}`));
-                    setTimeout(() => {
-                        server.close();
-                        for (const socket of sockets) {
-                            socket.destroy();
-                        }
-                    }, 100);
-                }
-            });
-            server.on('connection', (socket) => {
-                sockets.add(socket);
-                logger.trace({ socketCount: sockets.size }, '[Auth] New socket connection');
-                socket.on('close', () => {
-                    sockets.delete(socket);
-                    logger.trace({ socketCount: sockets.size }, '[Auth] Socket closed');
-                });
-            });
-            server.listen(this.localPort, () => {
-                logger.debug({ port: this.localPort }, `[Auth] OAuth redirect server listening on port ${this.localPort}`);
-                logger.info('Waiting for user to authenticate...');
-            });
-            server.on('error', (err) => {
-                logger.error({ error: err.message, port: this.localPort }, '[Auth] Failed to start OAuth redirect server');
-                const hint = 'code' in err && err.code === 'EADDRINUSE'
-                    ? ` Port ${this.localPort} is in use; set SFCC_OAUTH_LOCAL_PORT or pass localPort to use a different port.`
-                    : '';
-                reject(new Error(`Failed to start OAuth redirect server: ${err.message}.${hint}`));
-            });
-        });
-    }
-}
-//# sourceMappingURL=oauth-implicit.js.map

package/dist/cjs/auth/oauth-implicit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-implicit.js","sourceRoot":"","sources":["../../../src/auth/oauth-implicit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,YAAY,EAAyD,MAAM,WAAW,CAAC;AAE/F,OAAO,EAAC,GAAG,EAAC,MAAM,UAAU,CAAC;AAE7B,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AACrC,OAAO,EAAC,4BAA4B,EAAC,MAAM,gBAAgB,CAAC;AAE5D,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,4EAA4E;AAC5E,MAAM,kBAAkB,GAAqC,IAAI,GAAG,EAAE,CAAC;AAEvE,4FAA4F;AAC5F,MAAM,YAAY,GAA8C,IAAI,GAAG,EAAE,CAAC;AAgC1E;;;GAGG;AACH,SAAS,qBAAqB,CAAC,WAAmB;IAChD,OAAO;;;;;;;;;;+BAUsB,WAAW;;;;;CAKzC,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,mCAAmC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,SAAS,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,qBAAqB;IAMZ;IALZ,kBAAkB,CAAS;IAC3B,SAAS,CAAS;IAClB,WAAW,CAAS;IACpB,cAAc,GAAG,KAAK,CAAC;IAE/B,YAAoB,MAA2B;QAA3B,WAAM,GAAN,MAAM,CAAqB;QAC7C,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC;QACjH,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC;QAE/G,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV;YACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,EACD,0CAA0C,CAC3C,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAC,EAAE,0BAA0B,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAkB,EAAE;QAC3C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QAEpC,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAC,EAAE,qCAAqC,CAAC,CAAC;QAEnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,+CAA+C;QAC/C,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAgB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAC,EAAE,iBAAiB,CAAC,CAAC;QAE7E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,oEAAoE;QACpE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACrE,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YAEnD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAgB,CAAC,CAAC;YAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;YAE9C,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAC,EAAE,uBAAuB,CAAC,CAAC;QACpG,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAChD,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpF,IAAI,YAAY,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC9D,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAC5C,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAC,EAAE,6BAA6B,CAAC,CAAC;QAE7E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAChD,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACpF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;YAEjE,MAAM,CAAC,KAAK,CACV;gBACE,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,cAAc;gBACd,YAAY;gBACZ,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE;gBACvC,iBAAiB,EAAE,eAAe;aACnC,EACD,uCAAuC,CACxC,CAAC;YAEF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CACT,EAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAC,EAC7C,wEAAwE,CACzE,CAAC;gBACF,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;iBAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CACT,EAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAC,EACzC,iEAAiE,CAClE,CAAC;gBACF,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,EAAC,iBAAiB,EAAE,eAAe,EAAC,EAAE,oCAAoC,CAAC,CAAC;gBACzF,OAAO,MAAM,CAAC,WAAW,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACjF,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC;YACxC,OAAO,aAAa,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,yEAAyE;QACzE,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7C,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC;YACxC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CACV,EAAC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAC,EAC9E,yBAAyB,CAC1B,CAAC;YACF,OAAO,aAAa,CAAC,WAAW,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,gCAAgC;YAChC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,IAAI,CAAC,kBAAkB,2BAA2B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEtG,MAAM,CAAC,KAAK,CACV;YACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,EACD,qCAAqC,CACtC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,EAAC,YAAY,EAAC,EAAE,0BAA0B,CAAC,CAAC;QAEzD,gEAAgE;QAChE,MAAM,CAAC,IAAI,CAAC,EAAC,GAAG,EAAE,YAAY,EAAC,EAAE,cAAc,YAAY,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAErG,oFAAoF;QACpF,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1D,MAAM,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAwB,EAAE,QAAwB,EAAE,EAAE;gBACzF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACrF,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAE1E,MAAM,CAAC,KAAK,CACV;oBACE,IAAI,EAAE,UAAU,CAAC,QAAQ;oBACzB,cAAc,EAAE,CAAC,CAAC,WAAW;oBAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK;iBAClB,EACD,kCAAkC,CACnC,CAAC;gBAEF,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC3B,qDAAqD;oBACrD,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;oBAC1D,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,WAAW,EAAC,CAAC,CAAC;oBACvD,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;oBACxD,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACjB,CAAC;qBAAM,IAAI,WAAW,EAAE,CAAC;oBACvB,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;oBAC5C,qCAAqC;oBACrC,MAAM,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAE,YAAY,EAAC,EAAE,qCAAqC,YAAY,KAAK,CAAC,CAAC;oBAC/F,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAE1C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;wBACnC,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAC,EAAE,4BAA4B,CAAC,CAAC;oBACjE,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;oBACrE,CAAC;oBAED,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;oBACjF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;oBAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAEtE,MAAM,CAAC,KAAK,CACV,EAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,EAAC,EACxD,2BAA2B,SAAS,cAAc,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACrE,CAAC;oBAEF,OAAO,CAAC;wBACN,WAAW;wBACX,OAAO,EAAE,UAAU;wBACnB,MAAM;qBACP,CAAC,CAAC;oBAEH,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAC;oBACxD,QAAQ,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC;oBAC5G,QAAQ,CAAC,GAAG,EAAE,CAAC;oBAEf,sCAAsC;oBACtC,UAAU,CAAC,GAAG,EAAE;wBACd,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;wBAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;wBACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;4BAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,CAAC;wBACD,MAAM,CAAC,KAAK,CAAC,EAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAC,EAAE,2BAA2B,CAAC,CAAC;oBACzE,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC;qBAAM,IAAI,KAAK,EAAE,CAAC;oBACjB,uBAAuB;oBACvB,MAAM,YAAY,GAAG,gBAAgB,IAAI,KAAK,CAAC;oBAC/C,MAAM,CAAC,KAAK,CAAC,EAAC,KAAK,EAAE,gBAAgB,EAAC,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;oBACxE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAC;oBACxD,QAAQ,CAAC,KAAK,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAC;oBACzD,QAAQ,CAAC,GAAG,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC,CAAC;oBAElD,UAAU,CAAC,GAAG,EAAE;wBACd,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;4BAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,CAAC;oBACH,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;gBACjC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,EAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAC,EAAE,8BAA8B,CAAC,CAAC;gBAC1E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvB,MAAM,CAAC,KAAK,CAAC,EAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAC,EAAE,sBAAsB,CAAC,CAAC;gBACpE,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBACjC,MAAM,CAAC,KAAK,CAAC,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAC,EAAE,kDAAkD,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACzG,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,CAAC,KAAK,CAAC,EAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAC,EAAE,8CAA8C,CAAC,CAAC;gBACzG,MAAM,IAAI,GACR,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,YAAY;oBACnE,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,kFAAkF;oBAC3G,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACrF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/cjs/auth/oauth-jwt.d.ts

@@ -1,99 +0,0 @@
-import type { AuthStrategy, FetchInit, AccessTokenResponse } from './types.js';
-import { decodeJWT } from './oauth.js';
-/**
- * Configuration for JWT Bearer authentication.
- */
-export interface JwtOAuthConfig {
-    /** OAuth client ID */
-    clientId: string;
-    /** Path to JWT certificate file (cert.pem) */
-    certPath: string;
-    /** Path to JWT private key file (key.pem) */
-    keyPath: string;
-    /** Optional passphrase for encrypted private key */
-    passphrase?: string;
-    /** Account Manager hostname */
-    accountManagerHost: string;
-    /** OAuth scopes to request */
-    scopes?: string[];
-}
-/**
- * OAuth 2.0 JWT Bearer authentication strategy.
- *
- * Implements RFC 7523 (JSON Web Token (JWT) Profile for OAuth 2.0 Client
- * Authentication and Authorization Grants).
- *
- * Key differences from client credentials flow:
- * - Uses public/private key pair instead of client secret
- * - Sends JWT as `client_assertion` in POST body (not Authorization header)
- * - JWT is self-signed and short-lived (60 seconds)
- *
- * @example
- * ```typescript
- * const strategy = new JwtOAuthStrategy({
- *   clientId: 'my-client-id',
- *   certPath: './cert.pem',
- *   keyPath: './key.pem',
- *   accountManagerHost: 'account.demandware.com',
- * });
- *
- * const response = await strategy.fetch('https://api.example.com/data');
- * ```
- */
-export declare class JwtOAuthStrategy implements AuthStrategy {
-    private readonly config;
-    private readonly logger;
-    private readonly cacheKey;
-    private _hasHadSuccess;
-    private readonly privateKey;
-    constructor(config: JwtOAuthConfig);
-    /**
-     * Validates JWT configuration and checks that certificate/key files exist and are readable.
-     */
-    private validateConfig;
-    /**
-     * Performs a fetch request with JWT Bearer authentication.
-     * Automatically injects the Authorization header with a fresh access token.
-     * Includes 401 retry logic and x-dw-client-id header.
-     */
-    fetch(url: string, init?: FetchInit): Promise<Response>;
-    /**
-     * Returns the Authorization header value for legacy clients.
-     */
-    getAuthorizationHeader(): Promise<string>;
-    /**
-     * Gets the decoded JWT payload.
-     */
-    getJWT(): Promise<ReturnType<typeof decodeJWT>>;
-    /**
-     * Creates a new JwtOAuthStrategy with additional scopes merged in.
-     * Used by clients that have specific scope requirements.
-     *
-     * @param additionalScopes - Scopes to add to this strategy's existing scopes
-     * @returns A new JwtOAuthStrategy instance with merged scopes
-     */
-    withAdditionalScopes(additionalScopes: string[]): JwtOAuthStrategy;
-    /**
-     * Gets the full token response including expiration and scopes.
-     * Useful for commands that need to display or return token metadata.
-     */
-    getTokenResponse(): Promise<AccessTokenResponse>;
-    /**
-     * Invalidates the cached access token, forcing re-authentication on next request.
-     */
-    invalidateToken(): void;
-    /**
-     * Gets an access token string, using cached token if still valid.
-     */
-    private getAccessToken;
-    /**
-     * Requests a new access token from Account Manager using JWT Bearer flow.
-     * Returns the full token response and caches it.
-     */
-    private requestNewToken;
-    /**
-     * Creates and signs a JWT token for OAuth authentication.
-     * Uses RS256 algorithm and Base64URL encoding per RFC 7519.
-     */
-    private createSignedJwt;
-}