@wix/auto_sdk_identity_oauth 1.0.60 → 1.0.62

package/build/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../index.ts","../../src/identity-oauth-v1-refresh-token-oauth.universal.ts","../../src/identity-oauth-v1-refresh-token-oauth.http.ts","../../src/identity-oauth-v1-refresh-token-oauth.public.ts","../../src/identity-oauth-v1-refresh-token-oauth.context.ts"],"sourcesContent":["export * from './src/identity-oauth-v1-refresh-token-oauth.context.js';\n","import { transformError as sdkTransformError } from '@wix/sdk-runtime/transform-error';\nimport {\n  renameKeysFromSDKRequestToRESTRequest,\n  renameKeysFromRESTResponseToSDKResponse,\n} from '@wix/sdk-runtime/rename-all-nested-keys';\nimport { HttpClient, NonNullablePaths } from '@wix/sdk-types';\nimport * as ambassadorWixIdentityOauthV1RefreshToken from './identity-oauth-v1-refresh-token-oauth.http.js';\n\nexport interface RefreshToken {\n  token?: string;\n}\n\n/**\n * TokenRequest is sent by the client to the authorization server to request an\n * access token.\n */\nexport interface TokenRequest extends TokenRequestTenantOneOf {\n  /** supported tenant - specific site */\n  siteId?: string | null;\n  /** supported tenant - specific account */\n  accountId?: string | null;\n  /** The application id that want to obtain an access token. */\n  clientId?: string | null;\n  /**\n   * grant_type specifies the grant type being used. supported grant types are:\n   * `authorization_code`, `client_credentials`, `refresh_token`, `urn:ietf:params:oauth:grant-type:device_code`, `anonymous`,\n   * `urn:ietf:params:oauth:grant-type:token-exchange`\n   */\n  grantType?: string;\n  /** Required for `refresh_token` grant type. */\n  refreshToken?: string | null;\n  /** Required for `client_credentials` grant type. */\n  clientSecret?: string | null;\n  /**\n   * Required for `urn:ietf:params:oauth:grant-type:device_code` grant type. The device verification code, \"device_code\" from the\n   * device authorization response\n   */\n  deviceCode?: string | null;\n  /** Required for the `authorization_code` grant type. */\n  redirectUri?: string | null;\n  /** Required for `authorization_code` grant type. */\n  code?: string | null;\n  /** Optional, used if code challenge and code method were used in `authorization_code` grant type. */\n  codeVerifier?: string | null;\n  /** Required for `authorized_client` grant type - create tokens for a specific user. */\n  userId?: string | null;\n  /** Required for `authorized_client` grant type - create tokens for a specific member using api-key. */\n  memberId?: string | null;\n  /**\n   * Required for `client_credentials` grant type with clientId that represents an external app.\n   * An access token will be created based on the app installed version of an instance.\n   */\n  instanceId?: string | null;\n  /** Required for `authorized_client` grant type for externalApp and must be bounded with client id, create access token to an app with a specific version. */\n  appVersion?: string | null;\n  /** Required for `strip_bound_session` grant type - create token without bound session. */\n  accessToken?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - create tokens for a specific user.\n   * @format GUID\n   */\n  userAccountId?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - bind the issued tokens to a specific session (session-bound wixAT/wixRT).\n   * Internal-only: used by the server-to-server switchAccount flow via Oauth2NgInternal.\n   * @internal\n   * @format GUID\n   */\n  sessionId?: string | null;\n  /**\n   * Optional for `authorized_client` grant type (member tokens) - a member session token that is opened server-side to\n   * extract the bound session id, producing session-bound wixAT/wixRT. Public: used by the member flow from public traffic.\n   */\n  sessionToken?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - attach an impersonating user id to the minted token.\n   * Internal-only: used by server-to-server flows where a service mints a token carrying impersonation context.\n   * @internal\n   * @format GUID\n   */\n  impersonatingUserId?: string | null;\n  /**\n   * Required for the `urn:ietf:params:oauth:grant-type:token-exchange` grant - the account-level access token being\n   * exchanged for one scoped to the target named by the `tenant` oneof.\n   */\n  subjectToken?: string | null;\n  /**\n   * Required for the `urn:ietf:params:oauth:grant-type:token-exchange` grant - identifies the type of `subject_token`.\n   * Only `urn:ietf:params:oauth:token-type:access_token` is supported.\n   * @maxLength 100\n   */\n  subjectTokenType?: string | null;\n}\n\n/** @oneof */\nexport interface TokenRequestTenantOneOf {\n  /** supported tenant - specific site */\n  siteId?: string | null;\n  /** supported tenant - specific account */\n  accountId?: string | null;\n}\n\nexport interface InternalTokenResponse\n  extends InternalTokenResponseResultOneOf {\n  success?: TokenResponse;\n  failure?: TokenErrorResponse;\n}\n\n/** @oneof */\nexport interface InternalTokenResponseResultOneOf {\n  success?: TokenResponse;\n  failure?: TokenErrorResponse;\n}\n\nexport interface TokenResponse {\n  /** The access token issued by the authorization server. */\n  accessToken?: string;\n  /** The type of the token issued as described in Section 7.1. of the oauth2 rfc. */\n  tokenType?: string;\n  /**\n   * The lifetime in seconds of the access token.  For example, the value \"3600\" denotes that the access token will\n   * expire in one hour from the time the response was generated.\n   */\n  expiresIn?: number;\n  /** The refresh token, which can be used to obtain new access tokens. */\n  refreshToken?: string | null;\n  /** OPTIONAL, if identical to the scope requested by the client; otherwise, will be sent. */\n  scope?: string | null;\n  idToken?: string | null;\n  /**\n   * Set only for the `urn:ietf:params:oauth:grant-type:token-exchange` grant, where it is always\n   * `urn:ietf:params:oauth:token-type:access_token`. Empty for every other grant.\n   * @maxLength 100\n   */\n  issuedTokenType?: string | null;\n}\n\nexport interface TokenErrorResponse {\n  error?: string;\n  errorDescription?: string | null;\n}\n\nexport interface TokenInfoRequest {\n  /** The access token to introspect. */\n  token?: string;\n}\n\nexport interface TokenInfoResponse {\n  active?: boolean;\n  /** subject type. */\n  subjectType?: SubjectTypeWithLiterals;\n  /** subject id */\n  subjectId?: string;\n  /** Expiration time of the token */\n  exp?: string | null;\n  /** Issued time of the token */\n  iat?: string | null;\n  /** Client id */\n  clientId?: string;\n  /** Account id */\n  accountId?: string | null;\n  /** Site id */\n  siteId?: string | null;\n  /** Instance Id */\n  instanceId?: string | null;\n  /**\n   * Vendor Product Id\n   * @maxLength 100\n   */\n  vendorProductId?: string | null;\n}\n\nexport enum SubjectType {\n  /** unknown subject type */\n  UNKNOWN = 'UNKNOWN',\n  /** user subject type */\n  USER = 'USER',\n  /** visitor subject type */\n  VISITOR = 'VISITOR',\n  /** member subject type */\n  MEMBER = 'MEMBER',\n  /** app subject type */\n  APP = 'APP',\n}\n\n/** @enumType */\nexport type SubjectTypeWithLiterals =\n  | SubjectType\n  | 'UNKNOWN'\n  | 'USER'\n  | 'VISITOR'\n  | 'MEMBER'\n  | 'APP';\n\n/**\n * AuthorizeRequest is sent by the client to the authorization server to initiate\n * the authorization process.\n */\nexport interface AuthorizeRequest {\n  /**\n   * ID of the Wix OAuth app requesting authorization.\n   * @format GUID\n   */\n  clientId?: string;\n  /**\n   * Desired authorization [grant type](https://auth0.com/docs/authenticate/protocols/oauth#grant-types).\n   *\n   * Supported values:\n   * + `code`: The endpoint returns an authorization code that can be used to obtain an access token.\n   * @minLength 1\n   */\n  responseType?: string;\n  /**\n   * URI to redirect the browser to after authentication and authorization. The browser is redirected to this URI whether the authentication and authorization process is successful or not.\n   * @minLength 1\n   */\n  redirectUri?: string | null;\n  /**\n   * Desired scope of access. If this field is left empty, only an access token is granted.\n   * To received a refresh token, pass `offline_access` as the value of this field.\n   */\n  scope?: string | null;\n  /**\n   * A value used to confirm the state of an application before and after it makes an authorization\n   * request. If a value for this field is set in the request, it's added to the `redirectUri` when the browser\n   * is redirected there.\n   * Learn more about [using the state parameter](https://auth0.com/docs/secure/attack-protection/state-parameters).\n   * @minLength 1\n   */\n  state?: string;\n  /**\n   * esired response format.\n   *\n   * Supported values:\n   * + `query`: The response parameters are encoded as query string parameters and added to the `redirectUri` when redirecting.\n   * + `fragment`: The response parameters are encoded as URI fragment parameters and added to the `redirectUri` when redirecting.\n   * + `web_message`: The response parameters are encoded as a JSON object and added to the body of a [web message response](https://datatracker.ietf.org/doc/html/draft-sakimura-oauth-wmrm-00).\n   *\n   * Default value: `query`\n   */\n  responseMode?: string | null;\n  /**\n   * Code challenge to use for PKCE verification.\n   * This field is only used if `responseType` is set to `code`.\n   */\n  codeChallenge?: string | null;\n  /**\n   * Code challenge method to use for PKCE verification.\n   * This field is only used if `responseType` is set to `code`.\n   *\n   * Supported values:\n   * + `S256`: The code challenge is transformed using SHA-256 encyption.\n   * + `S512`: The code challenge is transformed using SHA-512 encyption.\n   */\n  codeChallengeMethod?: string | null;\n  /**\n   * Token returned by a successful [login](https://dev.wix.com/docs/api-reference/business-management/headless/authentication/login-v-2) or [register](https://dev.wix.com/docs/api-reference/business-management/headless/authentication/register-v-2) call that identifies the authenticated member.\n   *\n   * In the default SDK flow, session context is passed through a hidden iframe automatically. When using a [full-page redirect](https://dev.wix.com/docs/go-headless/develop-your-project/self-managed-headless/authentication/members/custom-login-page/custom-login/custom-login-using-the-js-sdk#use-a-full-page-redirect-desktop-and-mobile-browsers) instead, you must pass this field explicitly because there is no iframe to carry the session context.\n   */\n  sessionToken?: string | null;\n  /**\n   * Optional fields for errors\n   * A short error code that describes the type of error that occurred (e.g. \"invalid_request\")\n   * @internal\n   */\n  error?: string | null;\n  /**\n   * A human-readable description of the error that occurred\n   * @internal\n   */\n  errorDescription?: string | null;\n  /**\n   * DEPRECATED: no longer read. The sign-in URL is resolved from the client's OAuthClientConfiguration\n   * component (sign_in_url), falling back to the default Wix sign-in page.\n   * @internal\n   * @format SECURE_WEB_URL\n   * @deprecated\n   */\n  signInUrl?: string | null;\n  /**\n   * Indicates whether the user has consented to the requested scopes\n   * @internal\n   */\n  userConsented?: boolean | null;\n  /**\n   * Indicates whether login is optional. If true, will not redirect to the sign_in_url if user is not logged in.\n   * @internal\n   */\n  optionalLogin?: boolean | null;\n  /**\n   * The site id the authorization is requested for.\n   * @internal\n   * @format GUID\n   */\n  metaSiteId?: string | null;\n  /**\n   * ID of the IAM IdP connection to authenticate with when no member session exists.\n   * When set, the sign-in redirect initiates an OIDC login against this IdP connection\n   * (IAM's `/sso/login` endpoint) instead of the default Wix login page.\n   * @internal\n   * @format GUID\n   */\n  idp?: string | null;\n  /**\n   * OIDC nonce, bound to the authorization request and echoed back in the id_token.\n   * @maxLength 512\n   */\n  nonce?: string | null;\n  /**\n   * RFC 9470 / OIDC acr_values: space-separated required ACRs (OR, in preference order) for step-up.\n   * @internal\n   */\n  acrValues?: string | null;\n  /**\n   * RFC 9470 / OIDC max_age: max seconds since last auth (0 forces re-auth).\n   * @internal\n   */\n  maxAge?: string | null;\n  /** OIDC prompt. Only \"none\" is honored: request silent authorization with no user interaction. */\n  prompt?: string | null;\n  /**\n   * Standard OAuth error code the step-up surface returns on the browser redirect back to authorize\n   * (e.g. access_denied, unmet_authentication_requirements). Browser-supplied like acr_values/prompt, so\n   * untrusted: allowlisted and forwarded to the client as the OAuth error.\n   * @internal\n   */\n  stepUpError?: string | null;\n}\n\nexport interface RawHttpResponse {\n  body?: Uint8Array;\n  statusCode?: number | null;\n  headers?: HeadersEntry[];\n}\n\nexport interface HeadersEntry {\n  key?: string;\n  value?: string;\n}\n\nexport interface RawHttpRequest {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\nexport interface PathParametersEntry {\n  key?: string;\n  value?: string;\n}\n\nexport interface QueryParametersEntry {\n  key?: string;\n  value?: string;\n}\n\n/** Request for the Jwks endpoint. Takes no parameters. */\nexport interface JwksRequest {}\n\nexport interface DeviceCodeRequest {\n  /** The ID of the application that asks for authorization. */\n  clientId?: string;\n  /**\n   * scope is a space-delimited string that specifies the requested scope of the\n   * access request.\n   */\n  scope?: string | null;\n}\n\nexport interface DeviceCodeResponse {\n  /** is the unique code for the device. When the user goes to the verification_uri in their browser-based device, this code will be bound to their session. */\n  deviceCode?: string;\n  /** contains the code that should be input at the verification_uri to authorize the device. */\n  userCode?: string;\n  /** contains the URL the user should visit to authorize the device. */\n  verificationUri?: string;\n  /** indicates the lifetime (in seconds) of the device_code and user_code. */\n  expiresIn?: number;\n  /** indicates the interval (in seconds) at which the app should poll the token URL to request a token. clients MUST use 5 as the default */\n  interval?: number | null;\n}\n\nexport interface DeviceAuthorizeRequest {\n  /** The ID of the application that asks for authorization. */\n  clientId?: string;\n  /** scope is a space-delimited string that specifies the requested scope of the access request. */\n  scope?: string | null;\n  /**\n   * OIDC nonce, bound to the device authorization and echoed back in the id_token at /token.\n   * @maxLength 512\n   */\n  nonce?: string | null;\n}\n\nexport interface DeviceAuthorizeResponse {\n  /** the unique code for the device, used to poll the token endpoint. */\n  deviceCode?: string;\n  /** the code the user enters at the verification_uri to authorize the device. */\n  userCode?: string;\n  /** the URL the user should visit to authorize the device. */\n  verificationUri?: string;\n  /** the verification_uri with the user_code embedded as a query param, ready to encode into a QR code. */\n  verificationUriComplete?: string;\n  /** lifetime (in seconds) of the device_code and user_code. */\n  expiresIn?: number;\n  /** interval (in seconds) at which the client should poll the token endpoint. clients MUST use 5 as the default. */\n  interval?: number | null;\n}\n\nexport interface DeviceVerifyRequest {\n  /** User code representing a currently authorizing device. */\n  userCode?: string;\n}\n\nexport interface DeviceVerifyResponse {}\n\nexport interface DeviceVerifyV2Request {\n  /**\n   * User code representing a currently authorizing device.\n   * @minLength 8\n   * @maxLength 8\n   */\n  userCode?: string;\n}\n\nexport interface DeviceVerifyV2Response {}\n\nexport interface DeviceAuthorizationInfoRequest {\n  /**\n   * User code representing a currently authorizing device.\n   * @minLength 8\n   * @maxLength 8\n   */\n  userCode?: string;\n}\n\nexport interface DeviceAuthorizationInfoResponse {\n  /** The ID of the application the device is authorizing into. */\n  clientId?: string;\n  /** Canonical browser name of the initiating browser (e.g. \"chrome\"). */\n  browser?: string | null;\n  /** Canonical OS of the initiating browser (e.g. \"windows\"). */\n  os?: string | null;\n  /** Canonical device class of the initiating browser (e.g. \"desktop\"). */\n  deviceClass?: string | null;\n  /** IP address of the initiating browser. */\n  browserIp?: string | null;\n  /** Coarse geo-location (country, optional region) derived from the browser IP, e.g. \"IL\" or \"US-NY\". */\n  geo?: string | null;\n}\n\nexport interface InvalidateUserCodeRequest {\n  /** user code to invalidate. Only the authorizing identity is able to invalidate it. */\n  userCode?: string;\n}\n\nexport interface InvalidateUserCodeResponse {}\n\nexport interface RevokeRefreshTokenRequest {\n  /** The refresh token itself. Anyone with the token itself is able to revoke it. */\n  token?: string;\n  /** The client id that issued the refresh token. */\n  clientId?: string | null;\n}\n\nexport interface RevokeRefreshTokenResponse {}\n\nexport interface Empty {}\n\nexport interface DomainEvent extends DomainEventBodyOneOf {\n  createdEvent?: EntityCreatedEvent;\n  updatedEvent?: EntityUpdatedEvent;\n  deletedEvent?: EntityDeletedEvent;\n  actionEvent?: ActionEvent;\n  /** Event ID. With this ID you can easily spot duplicated events and ignore them. */\n  _id?: string;\n  /**\n   * Fully Qualified Domain Name of an entity. This is a unique identifier assigned to the API main business entities.\n   * For example, `wix.stores.catalog.product`, `wix.bookings.session`, `wix.payments.transaction`.\n   */\n  entityFqdn?: string;\n  /**\n   * Event action name, placed at the top level to make it easier for users to dispatch messages.\n   * For example: `created`/`updated`/`deleted`/`started`/`completed`/`email_opened`.\n   */\n  slug?: string;\n  /** ID of the entity associated with the event. */\n  entityId?: string;\n  /** Event timestamp in [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) format and UTC time. For example, `2020-04-26T13:57:50.699Z`. */\n  eventTime?: Date | null;\n  /**\n   * Whether the event was triggered as a result of a privacy regulation application\n   * (for example, GDPR).\n   */\n  triggeredByAnonymizeRequest?: boolean | null;\n  /** If present, indicates the action that triggered the event. */\n  originatedFrom?: string | null;\n  /**\n   * A sequence number that indicates the order of updates to an entity. For example, if an entity was updated at `16:00` and then again at `16:01`, the second update will always have a higher sequence number.\n   * You can use this number to make sure you're handling updates in the right order. Just save the latest sequence number on your end and compare it to the one in each new message. If the new message has an older (lower) number, you can safely ignore it.\n   */\n  entityEventSequence?: string | null;\n}\n\n/** @oneof */\nexport interface DomainEventBodyOneOf {\n  createdEvent?: EntityCreatedEvent;\n  updatedEvent?: EntityUpdatedEvent;\n  deletedEvent?: EntityDeletedEvent;\n  actionEvent?: ActionEvent;\n}\n\nexport interface EntityCreatedEvent {\n  entity?: string;\n}\n\nexport interface RestoreInfo {\n  deletedDate?: Date | null;\n}\n\nexport interface EntityUpdatedEvent {\n  /**\n   * Since platformized APIs only expose PATCH and not PUT we can't assume that the fields sent from the client are the actual diff.\n   * This means that to generate a list of changed fields (as opposed to sent fields) one needs to traverse both objects.\n   * We don't want to impose this on all developers and so we leave this traversal to the notification recipients which need it.\n   */\n  currentEntity?: string;\n}\n\nexport interface EntityDeletedEvent {\n  /** Entity that was deleted. */\n  deletedEntity?: string | null;\n}\n\nexport interface ActionEvent {\n  body?: string;\n}\n\nexport interface UserDeletedEvent {\n  /**\n   * User ID from the deletion event.\n   * @format GUID\n   */\n  userId?: string;\n}\n\nexport interface UserBlockedEvent {\n  /**\n   * User ID from the deletion event.\n   * @format GUID\n   */\n  userId?: string;\n}\n\nexport interface UserInfoRequest {}\n\n/** UserInfo endpoint response for OpenID Connect */\nexport interface UserInfoResponse {\n  /**\n   * Subject identifier — unique identifier for the user (OIDC standard claim).\n   * @format GUID\n   */\n  sub?: string;\n  /**\n   * The user's given name.\n   * @maxLength 20\n   */\n  givenName?: string | null;\n  /**\n   * The user's family name.\n   * @maxLength 20\n   */\n  familyName?: string | null;\n  /**\n   * The user's email address.\n   * @format EMAIL\n   */\n  email?: string | null;\n  /** Indicates whether the user's email address has been verified. */\n  emailVerified?: boolean | null;\n  /**\n   * The URL of the user's profile picture.\n   * @format WEB_URL\n   */\n  picture?: string | null;\n  /**\n   * The user's preferred language, if available.\n   * @format LANGUAGE\n   */\n  language?: string | null;\n  /** The user's full name. */\n  name?: string | null;\n}\n\n/**\n * Creates an access token.\n *\n *\n * The endpoint accepts raw HTTP requests. You must pass the request's body\n * parameters formatted as bytes in the raw HTTP request's `body` field,\n * following this template:\n * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n *\n * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n * token in the `body` field of the raw HTTP response.\n *\n * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n * HTTP response's `statusCode` field and details\n * about the error in `body`. Error details follow the\n * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n * @public\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.Token\n */\nexport async function token(\n  options?: TokenOptions\n): Promise<\n  NonNullablePaths<\n    RawHttpResponse,\n    `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n    2\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[1] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({\n    body: options?.body,\n    pathParams: options?.pathParams,\n    queryParams: options?.queryParams,\n    headers: options?.headers,\n    method: options?.method,\n    rawPath: options?.rawPath,\n    rawQuery: options?.rawQuery,\n  });\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.token(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {\n          body: '$[0].body',\n          pathParams: '$[0].pathParams',\n          queryParams: '$[0].queryParams',\n          headers: '$[0].headers',\n          method: '$[0].method',\n          rawPath: '$[0].rawPath',\n          rawQuery: '$[0].rawQuery',\n        },\n        singleArgumentUnchanged: false,\n      },\n      ['options']\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\nexport interface TokenOptions {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\n/**\n * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n * Serves a non-secret public key.\n * @public\n * @documentationMaturity preview\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.Jwks\n */\nexport async function jwks(): Promise<\n  NonNullablePaths<\n    RawHttpResponse,\n    `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n    2\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[0] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({});\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.jwks(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {},\n        singleArgumentUnchanged: false,\n      },\n      []\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\n/**\n * Token Introspection Endpoint.\n * @public\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.TokenInfo\n */\nexport async function tokenInfo(\n  options?: TokenInfoOptions\n): Promise<\n  NonNullablePaths<\n    TokenInfoResponse,\n    `active` | `subjectType` | `subjectId` | `clientId`,\n    0\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[1] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({\n    body: options?.body,\n    pathParams: options?.pathParams,\n    queryParams: options?.queryParams,\n    headers: options?.headers,\n    method: options?.method,\n    rawPath: options?.rawPath,\n    rawQuery: options?.rawQuery,\n  });\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.tokenInfo(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {\n          body: '$[0].body',\n          pathParams: '$[0].pathParams',\n          queryParams: '$[0].queryParams',\n          headers: '$[0].headers',\n          method: '$[0].method',\n          rawPath: '$[0].rawPath',\n          rawQuery: '$[0].rawQuery',\n        },\n        singleArgumentUnchanged: false,\n      },\n      ['options']\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\nexport interface TokenInfoOptions {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\n/**\n * OpenID Connect UserInfo endpoint\n * Should be called with user access token obtained in OIDC flow as Authorization header\n * @public\n * @documentationMaturity preview\n * @returns UserInfo endpoint response for OpenID Connect\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.UserInfo\n */\nexport async function userInfo(): Promise<\n  NonNullablePaths<UserInfoResponse, `sub`, 0>\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[0] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({});\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.userInfo(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {},\n        singleArgumentUnchanged: false,\n      },\n      []\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n","import { toURLSearchParams } from '@wix/sdk-runtime/rest-modules';\nimport { transformSDKBytesToRESTBytes } from '@wix/sdk-runtime/transformations/bytes';\nimport { transformRESTBytesToSDKBytes } from '@wix/sdk-runtime/transformations/bytes';\nimport { transformPaths } from '@wix/sdk-runtime/transformations/transform-paths';\nimport { resolveUrl } from '@wix/sdk-runtime/rest-modules';\nimport { ResolveUrlOpts } from '@wix/sdk-runtime/rest-modules';\nimport { RequestOptionsFactory } from '@wix/sdk-types';\n\nconst TRANSFORM_PATHS_0 = [{ path: 'body' }];\n\nfunction resolveWixIdentityOauth2V1Oauth2NgUrl(\n  opts: Omit<ResolveUrlOpts, 'domainToMappings'>\n) {\n  const domainToMappings = {\n    'manage._base_domain_': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'www.wixapis.com': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n      {\n        srcPath: '/oauth2/token_info',\n        destPath: '/v1/token_info',\n      },\n    ],\n    'users._base_domain_': [\n      {\n        srcPath: '/v1/oauth/device/verify',\n        destPath: '/v1/oauth/device/verify',\n      },\n      {\n        srcPath: '/v1/oauth/manage/user-code',\n        destPath: '/v1/oauth/manage/user-code',\n      },\n      {\n        srcPath: '/v2/oauth/device/verify',\n        destPath: '/v2/oauth/device/verify',\n      },\n      {\n        srcPath: '/v1/oauth/authorize',\n        destPath: '/v1/oauth/authorize',\n      },\n      {\n        srcPath: '/oauth/device/authorize',\n        destPath: '/v1/oauth/device/authorize',\n      },\n      {\n        srcPath: '/oauth/device/authorization',\n        destPath: '/v1/oauth/device/authorization',\n      },\n      {\n        srcPath: '/oauth/token',\n        destPath: '/v1/oauth/token',\n      },\n      {\n        srcPath: '/oauth/jwks',\n        destPath: '/v1/oauth/jwks',\n      },\n      {\n        srcPath: '/oauth/user-info',\n        destPath: '/v1/oauth/user-info',\n      },\n    ],\n    _: [\n      {\n        srcPath: '/_api/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'platform.rise.ai': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'api._api_base_domain_': [\n      {\n        srcPath: '/oauth2-ng',\n        destPath: '',\n      },\n    ],\n    'apps._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'editor._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'blocks._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'create.editorx': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n  };\n\n  return resolveUrl(Object.assign(opts, { domainToMappings }));\n}\n\nconst PACKAGE_NAME = '@wix/auto_sdk_identity_oauth';\n\n/**\n * Creates an access token.\n *\n *\n * The endpoint accepts raw HTTP requests. You must pass the request's body\n * parameters formatted as bytes in the raw HTTP request's `body` field,\n * following this template:\n * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n *\n * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n * token in the `body` field of the raw HTTP response.\n *\n * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n * HTTP response's `statusCode` field and details\n * about the error in `body`. Error details follow the\n * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n */\nexport function token(payload: object): RequestOptionsFactory<any> {\n  function __token({ host }: any) {\n    const serializedData = transformPaths(payload, [\n      {\n        transformFn: transformSDKBytesToRESTBytes,\n        paths: TRANSFORM_PATHS_0,\n      },\n    ]);\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'POST' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.Token',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/token',\n        data: serializedData,\n        host,\n      }),\n      data: serializedData,\n      transformResponse: (payload: any) =>\n        transformPaths(payload, [\n          {\n            transformFn: transformRESTBytesToSDKBytes,\n            paths: TRANSFORM_PATHS_0,\n          },\n        ]),\n    };\n\n    return metadata;\n  }\n\n  return __token;\n}\n\n/**\n * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n * Serves a non-secret public key.\n */\nexport function jwks(payload: object): RequestOptionsFactory<any> {\n  function __jwks({ host }: any) {\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'GET' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.Jwks',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/jwks',\n        data: payload,\n        host,\n      }),\n      params: toURLSearchParams(payload),\n      transformResponse: (payload: any) =>\n        transformPaths(payload, [\n          {\n            transformFn: transformRESTBytesToSDKBytes,\n            paths: TRANSFORM_PATHS_0,\n          },\n        ]),\n    };\n\n    return metadata;\n  }\n\n  return __jwks;\n}\n\n/** Token Introspection Endpoint. */\nexport function tokenInfo(payload: object): RequestOptionsFactory<any> {\n  function __tokenInfo({ host }: any) {\n    const serializedData = transformPaths(payload, [\n      {\n        transformFn: transformSDKBytesToRESTBytes,\n        paths: TRANSFORM_PATHS_0,\n      },\n    ]);\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'POST' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.TokenInfo',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/token-info',\n        data: serializedData,\n        host,\n      }),\n      data: serializedData,\n    };\n\n    return metadata;\n  }\n\n  return __tokenInfo;\n}\n\n/**\n * OpenID Connect UserInfo endpoint\n * Should be called with user access token obtained in OIDC flow as Authorization header\n */\nexport function userInfo(payload: object): RequestOptionsFactory<any> {\n  function __userInfo({ host }: any) {\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'GET' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.UserInfo',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/user-info',\n        data: payload,\n        host,\n      }),\n      params: toURLSearchParams(payload),\n    };\n\n    return metadata;\n  }\n\n  return __userInfo;\n}\n","import { HttpClient, NonNullablePaths } from '@wix/sdk-types';\nimport {\n  RawHttpResponse,\n  TokenInfoOptions,\n  TokenInfoResponse,\n  TokenOptions,\n  UserInfoResponse,\n  jwks as universalJwks,\n  token as universalToken,\n  tokenInfo as universalTokenInfo,\n  userInfo as universalUserInfo,\n} from './identity-oauth-v1-refresh-token-oauth.universal.js';\n\nexport const __metadata = { PACKAGE_NAME: '@wix/identity' };\n\nexport function token(httpClient: HttpClient): TokenSignature {\n  return (options?: TokenOptions) =>\n    universalToken(\n      options,\n      // @ts-ignore\n      { httpClient }\n    );\n}\n\ninterface TokenSignature {\n  /**\n   * Creates an access token.\n   *\n   *\n   * The endpoint accepts raw HTTP requests. You must pass the request's body\n   * parameters formatted as bytes in the raw HTTP request's `body` field,\n   * following this template:\n   * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n   *\n   * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n   * token in the `body` field of the raw HTTP response.\n   *\n   * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n   * HTTP response's `statusCode` field and details\n   * about the error in `body`. Error details follow the\n   * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n   */\n  (options?: TokenOptions): Promise<\n    NonNullablePaths<\n      RawHttpResponse,\n      `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n      2\n    >\n  >;\n}\n\nexport function jwks(httpClient: HttpClient): JwksSignature {\n  return () =>\n    universalJwks(\n      // @ts-ignore\n      { httpClient }\n    );\n}\n\ninterface JwksSignature {\n  /**\n   * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n   * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n   * Serves a non-secret public key.\n   */\n  (): Promise<\n    NonNullablePaths<\n      RawHttpResponse,\n      `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n      2\n    >\n  >;\n}\n\nexport function tokenInfo(httpClient: HttpClient): TokenInfoSignature {\n  return (options?: TokenInfoOptions) =>\n    universalTokenInfo(\n      options,\n      // @ts-ignore\n      { httpClient }\n    );\n}\n\ninterface TokenInfoSignature {\n  /**\n   * Token Introspection Endpoint.\n   */\n  (options?: TokenInfoOptions): Promise<\n    NonNullablePaths<\n      TokenInfoResponse,\n      `active` | `subjectType` | `subjectId` | `clientId`,\n      0\n    >\n  >;\n}\n\nexport function userInfo(httpClient: HttpClient): UserInfoSignature {\n  return () =>\n    universalUserInfo(\n      // @ts-ignore\n      { httpClient }\n    );\n}\n\ninterface UserInfoSignature {\n  /**\n   * OpenID Connect UserInfo endpoint\n   * Should be called with user access token obtained in OIDC flow as Authorization header\n   * @returns UserInfo endpoint response for OpenID Connect\n   */\n  (): Promise<NonNullablePaths<UserInfoResponse, `sub`, 0>>;\n}\n\nexport {\n  ActionEvent,\n  AuthorizeRequest,\n  DeviceAuthorizationInfoRequest,\n  DeviceAuthorizationInfoResponse,\n  DeviceAuthorizeRequest,\n  DeviceAuthorizeResponse,\n  DeviceCodeRequest,\n  DeviceCodeResponse,\n  DeviceVerifyRequest,\n  DeviceVerifyResponse,\n  DeviceVerifyV2Request,\n  DeviceVerifyV2Response,\n  DomainEvent,\n  DomainEventBodyOneOf,\n  Empty,\n  EntityCreatedEvent,\n  EntityDeletedEvent,\n  EntityUpdatedEvent,\n  HeadersEntry,\n  InternalTokenResponse,\n  InternalTokenResponseResultOneOf,\n  InvalidateUserCodeRequest,\n  InvalidateUserCodeResponse,\n  JwksRequest,\n  PathParametersEntry,\n  QueryParametersEntry,\n  RawHttpRequest,\n  RawHttpResponse,\n  RefreshToken,\n  RestoreInfo,\n  RevokeRefreshTokenRequest,\n  RevokeRefreshTokenResponse,\n  SubjectType,\n  TokenErrorResponse,\n  TokenInfoOptions,\n  TokenInfoRequest,\n  TokenInfoResponse,\n  TokenOptions,\n  TokenRequest,\n  TokenRequestTenantOneOf,\n  TokenResponse,\n  UserBlockedEvent,\n  UserDeletedEvent,\n  UserInfoRequest,\n  UserInfoResponse,\n} from './identity-oauth-v1-refresh-token-oauth.universal.js';\n","import {\n  token as publicToken,\n  jwks as publicJwks,\n  tokenInfo as publicTokenInfo,\n  userInfo as publicUserInfo,\n} from './identity-oauth-v1-refresh-token-oauth.public.js';\nimport { createRESTModule } from '@wix/sdk-runtime/rest-modules';\nimport { BuildRESTFunction, MaybeContext } from '@wix/sdk-types';\n\nexport const token: MaybeContext<\n  BuildRESTFunction<typeof publicToken> & typeof publicToken\n> = /*#__PURE__*/ createRESTModule(publicToken);\nexport const jwks: MaybeContext<\n  BuildRESTFunction<typeof publicJwks> & typeof publicJwks\n> = /*#__PURE__*/ createRESTModule(publicJwks);\nexport const tokenInfo: MaybeContext<\n  BuildRESTFunction<typeof publicTokenInfo> & typeof publicTokenInfo\n> = /*#__PURE__*/ createRESTModule(publicTokenInfo);\nexport const userInfo: MaybeContext<\n  BuildRESTFunction<typeof publicUserInfo> & typeof publicUserInfo\n> = /*#__PURE__*/ createRESTModule(publicUserInfo);\n\nexport { SubjectType } from './identity-oauth-v1-refresh-token-oauth.universal.js';\nexport {\n  RefreshToken,\n  TokenRequest,\n  TokenRequestTenantOneOf,\n  InternalTokenResponse,\n  InternalTokenResponseResultOneOf,\n  TokenResponse,\n  TokenErrorResponse,\n  TokenInfoRequest,\n  TokenInfoResponse,\n  AuthorizeRequest,\n  RawHttpResponse,\n  HeadersEntry,\n  RawHttpRequest,\n  PathParametersEntry,\n  QueryParametersEntry,\n  JwksRequest,\n  DeviceCodeRequest,\n  DeviceCodeResponse,\n  DeviceAuthorizeRequest,\n  DeviceAuthorizeResponse,\n  DeviceVerifyRequest,\n  DeviceVerifyResponse,\n  DeviceVerifyV2Request,\n  DeviceVerifyV2Response,\n  DeviceAuthorizationInfoRequest,\n  DeviceAuthorizationInfoResponse,\n  InvalidateUserCodeRequest,\n  InvalidateUserCodeResponse,\n  RevokeRefreshTokenRequest,\n  RevokeRefreshTokenResponse,\n  Empty,\n  DomainEvent,\n  DomainEventBodyOneOf,\n  EntityCreatedEvent,\n  RestoreInfo,\n  EntityUpdatedEvent,\n  EntityDeletedEvent,\n  ActionEvent,\n  UserDeletedEvent,\n  UserBlockedEvent,\n  UserInfoRequest,\n  UserInfoResponse,\n  TokenOptions,\n  TokenInfoOptions,\n} from './identity-oauth-v1-refresh-token-oauth.universal.js';\nexport { SubjectTypeWithLiterals } from './identity-oauth-v1-refresh-token-oauth.universal.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA,cAAAA;AAAA,EAAA,aAAAC;AAAA,EAAA,iBAAAC;AAAA,EAAA,gBAAAC;AAAA;AAAA;;;ACAA,6BAAoD;AACpD,oCAGO;;;ACJP,0BAAkC;AAClC,mBAA6C;AAC7C,IAAAC,gBAA6C;AAC7C,6BAA+B;AAC/B,IAAAC,uBAA2B;AAI3B,IAAM,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC;AAE3C,SAAS,sCACP,MACA;AACA,QAAM,mBAAmB;AAAA,IACvB,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,mBAAmB;AAAA,MACjB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,uBAAuB;AAAA,MACrB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,GAAG;AAAA,MACD;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,oBAAoB;AAAA,MAClB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,yBAAyB;AAAA,MACvB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,sBAAsB;AAAA,MACpB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,kBAAkB;AAAA,MAChB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAEA,aAAO,iCAAW,OAAO,OAAO,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAC7D;AAEA,IAAM,eAAe;AAmBd,SAAS,MAAM,SAA6C;AACjE,WAAS,QAAQ,EAAE,KAAK,GAAQ;AAC9B,UAAM,qBAAiB,uCAAe,SAAS;AAAA,MAC7C;AAAA,QACE,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,MACN,mBAAmB,CAACC,iBAClB,uCAAeA,UAAS;AAAA,QACtB;AAAA,UACE,aAAa;AAAA,UACb,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAOO,SAAS,KAAK,SAA6C;AAChE,WAAS,OAAO,EAAE,KAAK,GAAQ;AAC7B,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,YAAQ,uCAAkB,OAAO;AAAA,MACjC,mBAAmB,CAACA,iBAClB,uCAAeA,UAAS;AAAA,QACtB;AAAA,UACE,aAAa;AAAA,UACb,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAGO,SAAS,UAAU,SAA6C;AACrE,WAAS,YAAY,EAAE,KAAK,GAAQ;AAClC,UAAM,qBAAiB,uCAAe,SAAS;AAAA,MAC7C;AAAA,QACE,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,IACR;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAMO,SAAS,SAAS,SAA6C;AACpE,WAAS,WAAW,EAAE,KAAK,GAAQ;AACjC,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,YAAQ,uCAAkB,OAAO;AAAA,IACnC;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;;;ADhHO,IAAK,cAAL,kBAAKC,iBAAL;AAEL,EAAAA,aAAA,aAAU;AAEV,EAAAA,aAAA,UAAO;AAEP,EAAAA,aAAA,aAAU;AAEV,EAAAA,aAAA,YAAS;AAET,EAAAA,aAAA,SAAM;AAVI,SAAAA;AAAA,GAAA;AA8bZ,eAAsBC,OACpB,SAOA;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,UAAmD,MAAM,OAAO;AAEtE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAC;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B;AAAA,UACxB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,QACA,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAoBA,eAAsBC,QAMpB;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC,CAAC,CAAC;AAExD,QAAM,UAAmD,KAAK,OAAO;AAErE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAD;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B,CAAC;AAAA,QAC3B,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC;AAAA,IACH;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAOA,eAAsBE,WACpB,SAOA;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,UAAmD,UAAU,OAAO;AAE1E,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAF;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B;AAAA,UACxB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,QACA,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAoBA,eAAsBG,YAEpB;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC,CAAC,CAAC;AAExD,QAAM,UAAmD,SAAS,OAAO;AAEzE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAH;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B,CAAC;AAAA,QAC3B,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC;AAAA,IACH;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;;;AE9zBO,SAASI,OAAM,YAAwC;AAC5D,SAAO,CAAC,YACNA;AAAA,IACE;AAAA;AAAA,IAEA,EAAE,WAAW;AAAA,EACf;AACJ;AA6BO,SAASC,MAAK,YAAuC;AAC1D,SAAO,MACLA;AAAA;AAAA,IAEE,EAAE,WAAW;AAAA,EACf;AACJ;AAiBO,SAASC,WAAU,YAA4C;AACpE,SAAO,CAAC,YACNA;AAAA,IACE;AAAA;AAAA,IAEA,EAAE,WAAW;AAAA,EACf;AACJ;AAeO,SAASC,UAAS,YAA2C;AAClE,SAAO,MACLA;AAAA;AAAA,IAEE,EAAE,WAAW;AAAA,EACf;AACJ;;;AChGA,IAAAC,uBAAiC;AAG1B,IAAMC,SAEK,2DAAiBA,MAAW;AACvC,IAAMC,QAEK,2DAAiBA,KAAU;AACtC,IAAMC,aAEK,2DAAiBA,UAAe;AAC3C,IAAMC,YAEK,2DAAiBA,SAAc;","names":["jwks","token","tokenInfo","userInfo","import_bytes","import_rest_modules","payload","SubjectType","token","sdkTransformError","jwks","tokenInfo","userInfo","token","jwks","tokenInfo","userInfo","import_rest_modules","token","jwks","tokenInfo","userInfo"]}
+{"version":3,"sources":["../../index.ts","../../src/identity-oauth-v1-refresh-token-oauth.universal.ts","../../src/identity-oauth-v1-refresh-token-oauth.http.ts","../../src/identity-oauth-v1-refresh-token-oauth.public.ts","../../src/identity-oauth-v1-refresh-token-oauth.context.ts"],"sourcesContent":["export * from './src/identity-oauth-v1-refresh-token-oauth.context.js';\n","import { transformError as sdkTransformError } from '@wix/sdk-runtime/transform-error';\nimport {\n  renameKeysFromSDKRequestToRESTRequest,\n  renameKeysFromRESTResponseToSDKResponse,\n} from '@wix/sdk-runtime/rename-all-nested-keys';\nimport { HttpClient, NonNullablePaths } from '@wix/sdk-types';\nimport * as ambassadorWixIdentityOauthV1RefreshToken from './identity-oauth-v1-refresh-token-oauth.http.js';\n\nexport interface RefreshToken {\n  token?: string;\n}\n\n/**\n * TokenRequest is sent by the client to the authorization server to request an\n * access token.\n */\nexport interface TokenRequest extends TokenRequestTenantOneOf {\n  /** supported tenant - specific site */\n  siteId?: string | null;\n  /** supported tenant - specific account */\n  accountId?: string | null;\n  /** The application id that want to obtain an access token. */\n  clientId?: string | null;\n  /**\n   * grant_type specifies the grant type being used. supported grant types are:\n   * `authorization_code`, `client_credentials`, `refresh_token`, `urn:ietf:params:oauth:grant-type:device_code`, `anonymous`,\n   * `urn:ietf:params:oauth:grant-type:token-exchange`\n   */\n  grantType?: string;\n  /** Required for `refresh_token` grant type. */\n  refreshToken?: string | null;\n  /** Required for `client_credentials` grant type. */\n  clientSecret?: string | null;\n  /**\n   * Required for `urn:ietf:params:oauth:grant-type:device_code` grant type. The device verification code, \"device_code\" from the\n   * device authorization response\n   */\n  deviceCode?: string | null;\n  /** Required for the `authorization_code` grant type. */\n  redirectUri?: string | null;\n  /** Required for `authorization_code` grant type. */\n  code?: string | null;\n  /** Optional, used if code challenge and code method were used in `authorization_code` grant type. */\n  codeVerifier?: string | null;\n  /** Required for `authorized_client` grant type - create tokens for a specific user. */\n  userId?: string | null;\n  /**\n   * Required for `authorized_client` grant type - create tokens for a specific member.\n   * Optional when `client_id` and `session_token` are sent: the member then comes from the session, and `member_id`, if\n   * sent, must match it.\n   */\n  memberId?: string | null;\n  /**\n   * Required for `client_credentials` grant type with clientId that represents an external app.\n   * An access token will be created based on the app installed version of an instance.\n   */\n  instanceId?: string | null;\n  /** Required for `authorized_client` grant type for externalApp and must be bounded with client id, create access token to an app with a specific version. */\n  appVersion?: string | null;\n  /** Required for `strip_bound_session` grant type - create token without bound session. */\n  accessToken?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - create tokens for a specific user.\n   * @format GUID\n   */\n  userAccountId?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - bind the issued tokens to a specific session (session-bound wixAT/wixRT).\n   * Internal-only: used by the server-to-server switchAccount flow via Oauth2NgInternal.\n   * @internal\n   * @format GUID\n   */\n  sessionId?: string | null;\n  /**\n   * Optional for `authorized_client` grant type (member tokens) - a member session token that is opened server-side to\n   * extract the bound session id, producing session-bound wixAT/wixRT. Public: used by the member flow from public traffic.\n   * When sent with `client_id` (a headless OAuth app's client ID), the tokens are issued to that client for the member\n   * of the session, on the client's site rather than the caller's context.\n   */\n  sessionToken?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - attach an impersonating user id to the minted token.\n   * Internal-only: used by server-to-server flows where a service mints a token carrying impersonation context.\n   * @internal\n   * @format GUID\n   */\n  impersonatingUserId?: string | null;\n  /**\n   * Required for the `urn:ietf:params:oauth:grant-type:token-exchange` grant - the account-level access token being\n   * exchanged for one scoped to the target named by the `tenant` oneof.\n   */\n  subjectToken?: string | null;\n  /**\n   * Required for the `urn:ietf:params:oauth:grant-type:token-exchange` grant - identifies the type of `subject_token`.\n   * Only `urn:ietf:params:oauth:token-type:access_token` is supported.\n   * @maxLength 100\n   */\n  subjectTokenType?: string | null;\n}\n\n/** @oneof */\nexport interface TokenRequestTenantOneOf {\n  /** supported tenant - specific site */\n  siteId?: string | null;\n  /** supported tenant - specific account */\n  accountId?: string | null;\n}\n\nexport interface InternalTokenResponse\n  extends InternalTokenResponseResultOneOf {\n  success?: TokenResponse;\n  failure?: TokenErrorResponse;\n}\n\n/** @oneof */\nexport interface InternalTokenResponseResultOneOf {\n  success?: TokenResponse;\n  failure?: TokenErrorResponse;\n}\n\nexport interface TokenResponse {\n  /** The access token issued by the authorization server. */\n  accessToken?: string;\n  /** The type of the token issued as described in Section 7.1. of the oauth2 rfc. */\n  tokenType?: string;\n  /**\n   * The lifetime in seconds of the access token.  For example, the value \"3600\" denotes that the access token will\n   * expire in one hour from the time the response was generated.\n   */\n  expiresIn?: number;\n  /** The refresh token, which can be used to obtain new access tokens. */\n  refreshToken?: string | null;\n  /** OPTIONAL, if identical to the scope requested by the client; otherwise, will be sent. */\n  scope?: string | null;\n  idToken?: string | null;\n  /**\n   * Set only for the `urn:ietf:params:oauth:grant-type:token-exchange` grant, where it is always\n   * `urn:ietf:params:oauth:token-type:access_token`. Empty for every other grant.\n   * @maxLength 100\n   */\n  issuedTokenType?: string | null;\n}\n\nexport interface TokenErrorResponse {\n  error?: string;\n  errorDescription?: string | null;\n}\n\nexport interface TokenInfoRequest {\n  /** The access token to introspect. */\n  token?: string;\n}\n\nexport interface TokenInfoResponse {\n  active?: boolean;\n  /** subject type. */\n  subjectType?: SubjectTypeWithLiterals;\n  /** subject id */\n  subjectId?: string;\n  /** Expiration time of the token */\n  exp?: string | null;\n  /** Issued time of the token */\n  iat?: string | null;\n  /** Client id */\n  clientId?: string;\n  /** Account id */\n  accountId?: string | null;\n  /** Site id */\n  siteId?: string | null;\n  /** Instance Id */\n  instanceId?: string | null;\n  /**\n   * Vendor Product Id\n   * @maxLength 100\n   */\n  vendorProductId?: string | null;\n}\n\nexport enum SubjectType {\n  /** unknown subject type */\n  UNKNOWN = 'UNKNOWN',\n  /** user subject type */\n  USER = 'USER',\n  /** visitor subject type */\n  VISITOR = 'VISITOR',\n  /** member subject type */\n  MEMBER = 'MEMBER',\n  /** app subject type */\n  APP = 'APP',\n}\n\n/** @enumType */\nexport type SubjectTypeWithLiterals =\n  | SubjectType\n  | 'UNKNOWN'\n  | 'USER'\n  | 'VISITOR'\n  | 'MEMBER'\n  | 'APP';\n\n/**\n * AuthorizeRequest is sent by the client to the authorization server to initiate\n * the authorization process.\n */\nexport interface AuthorizeRequest {\n  /**\n   * ID of the Wix OAuth app requesting authorization.\n   * @format GUID\n   */\n  clientId?: string;\n  /**\n   * Desired authorization [grant type](https://auth0.com/docs/authenticate/protocols/oauth#grant-types).\n   *\n   * Supported values:\n   * + `code`: The endpoint returns an authorization code that can be used to obtain an access token.\n   * @minLength 1\n   */\n  responseType?: string;\n  /**\n   * URI to redirect the browser to after authentication and authorization. The browser is redirected to this URI whether the authentication and authorization process is successful or not.\n   * @minLength 1\n   */\n  redirectUri?: string | null;\n  /**\n   * Desired scope of access. If this field is left empty, only an access token is granted.\n   * To received a refresh token, pass `offline_access` as the value of this field.\n   */\n  scope?: string | null;\n  /**\n   * A value used to confirm the state of an application before and after it makes an authorization\n   * request. If a value for this field is set in the request, it's added to the `redirectUri` when the browser\n   * is redirected there.\n   * Learn more about [using the state parameter](https://auth0.com/docs/secure/attack-protection/state-parameters).\n   * @minLength 1\n   */\n  state?: string;\n  /**\n   * esired response format.\n   *\n   * Supported values:\n   * + `query`: The response parameters are encoded as query string parameters and added to the `redirectUri` when redirecting.\n   * + `fragment`: The response parameters are encoded as URI fragment parameters and added to the `redirectUri` when redirecting.\n   * + `web_message`: The response parameters are encoded as a JSON object and added to the body of a [web message response](https://datatracker.ietf.org/doc/html/draft-sakimura-oauth-wmrm-00).\n   *\n   * Default value: `query`\n   */\n  responseMode?: string | null;\n  /**\n   * Code challenge to use for PKCE verification.\n   * This field is only used if `responseType` is set to `code`.\n   */\n  codeChallenge?: string | null;\n  /**\n   * Code challenge method to use for PKCE verification.\n   * This field is only used if `responseType` is set to `code`.\n   *\n   * Supported values:\n   * + `S256`: The code challenge is transformed using SHA-256 encyption.\n   * + `S512`: The code challenge is transformed using SHA-512 encyption.\n   */\n  codeChallengeMethod?: string | null;\n  /**\n   * Token returned by a successful [login](https://dev.wix.com/docs/api-reference/business-management/headless/authentication/login-v-2) or [register](https://dev.wix.com/docs/api-reference/business-management/headless/authentication/register-v-2) call that identifies the authenticated member.\n   *\n   * In the default SDK flow, session context is passed through a hidden iframe automatically. When using a [full-page redirect](https://dev.wix.com/docs/go-headless/develop-your-project/self-managed-headless/authentication/members/custom-login-page/custom-login/custom-login-using-the-js-sdk#use-a-full-page-redirect-desktop-and-mobile-browsers) instead, you must pass this field explicitly because there is no iframe to carry the session context.\n   */\n  sessionToken?: string | null;\n  /**\n   * Optional fields for errors\n   * A short error code that describes the type of error that occurred (e.g. \"invalid_request\")\n   * @internal\n   */\n  error?: string | null;\n  /**\n   * A human-readable description of the error that occurred\n   * @internal\n   */\n  errorDescription?: string | null;\n  /**\n   * DEPRECATED: no longer read. The sign-in URL is resolved from the client's OAuthClientConfiguration\n   * component (sign_in_url), falling back to the default Wix sign-in page.\n   * @internal\n   * @format SECURE_WEB_URL\n   * @deprecated\n   */\n  signInUrl?: string | null;\n  /**\n   * Indicates whether the user has consented to the requested scopes\n   * @internal\n   */\n  userConsented?: boolean | null;\n  /**\n   * Indicates whether login is optional. If true, will not redirect to the sign_in_url if user is not logged in.\n   * @internal\n   */\n  optionalLogin?: boolean | null;\n  /**\n   * The site id the authorization is requested for.\n   * @internal\n   * @format GUID\n   */\n  metaSiteId?: string | null;\n  /**\n   * ID of the IAM IdP connection to authenticate with when no member session exists.\n   * When set, the sign-in redirect initiates an OIDC login against this IdP connection\n   * (IAM's `/sso/login` endpoint) instead of the default Wix login page.\n   * @internal\n   * @format GUID\n   */\n  idp?: string | null;\n  /**\n   * OIDC nonce, bound to the authorization request and echoed back in the id_token.\n   * @maxLength 512\n   */\n  nonce?: string | null;\n  /**\n   * RFC 9470 / OIDC acr_values: space-separated required ACRs (OR, in preference order) for step-up.\n   * @internal\n   */\n  acrValues?: string | null;\n  /**\n   * RFC 9470 / OIDC max_age: max seconds since last auth (0 forces re-auth).\n   * @internal\n   */\n  maxAge?: string | null;\n  /** OIDC prompt. Only \"none\" is honored: request silent authorization with no user interaction. */\n  prompt?: string | null;\n  /**\n   * Standard OAuth error code the step-up surface returns on the browser redirect back to authorize\n   * (e.g. access_denied, unmet_authentication_requirements). Browser-supplied like acr_values/prompt, so\n   * untrusted: allowlisted and forwarded to the client as the OAuth error.\n   * @internal\n   */\n  stepUpError?: string | null;\n}\n\nexport interface RawHttpResponse {\n  body?: Uint8Array;\n  statusCode?: number | null;\n  headers?: HeadersEntry[];\n}\n\nexport interface HeadersEntry {\n  key?: string;\n  value?: string;\n}\n\nexport interface RawHttpRequest {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\nexport interface PathParametersEntry {\n  key?: string;\n  value?: string;\n}\n\nexport interface QueryParametersEntry {\n  key?: string;\n  value?: string;\n}\n\n/** Request for the Jwks endpoint. Takes no parameters. */\nexport interface JwksRequest {}\n\nexport interface DeviceCodeRequest {\n  /** The ID of the application that asks for authorization. */\n  clientId?: string;\n  /**\n   * scope is a space-delimited string that specifies the requested scope of the\n   * access request.\n   */\n  scope?: string | null;\n}\n\nexport interface DeviceCodeResponse {\n  /** is the unique code for the device. When the user goes to the verification_uri in their browser-based device, this code will be bound to their session. */\n  deviceCode?: string;\n  /** contains the code that should be input at the verification_uri to authorize the device. */\n  userCode?: string;\n  /** contains the URL the user should visit to authorize the device. */\n  verificationUri?: string;\n  /** indicates the lifetime (in seconds) of the device_code and user_code. */\n  expiresIn?: number;\n  /** indicates the interval (in seconds) at which the app should poll the token URL to request a token. clients MUST use 5 as the default */\n  interval?: number | null;\n}\n\nexport interface DeviceAuthorizeRequest {\n  /** The ID of the application that asks for authorization. */\n  clientId?: string;\n  /** scope is a space-delimited string that specifies the requested scope of the access request. */\n  scope?: string | null;\n  /**\n   * OIDC nonce, bound to the device authorization and echoed back in the id_token at /token.\n   * @maxLength 512\n   */\n  nonce?: string | null;\n}\n\nexport interface DeviceAuthorizeResponse {\n  /** the unique code for the device, used to poll the token endpoint. */\n  deviceCode?: string;\n  /** the code the user enters at the verification_uri to authorize the device. */\n  userCode?: string;\n  /** the URL the user should visit to authorize the device. */\n  verificationUri?: string;\n  /** the verification_uri with the user_code embedded as a query param, ready to encode into a QR code. */\n  verificationUriComplete?: string;\n  /** lifetime (in seconds) of the device_code and user_code. */\n  expiresIn?: number;\n  /** interval (in seconds) at which the client should poll the token endpoint. clients MUST use 5 as the default. */\n  interval?: number | null;\n}\n\nexport interface DeviceVerifyRequest {\n  /** User code representing a currently authorizing device. */\n  userCode?: string;\n}\n\nexport interface DeviceVerifyResponse {}\n\nexport interface DeviceVerifyV2Request {\n  /**\n   * User code representing a currently authorizing device.\n   * @minLength 8\n   * @maxLength 8\n   */\n  userCode?: string;\n}\n\nexport interface DeviceVerifyV2Response {}\n\nexport interface DeviceAuthorizationInfoRequest {\n  /**\n   * User code representing a currently authorizing device.\n   * @minLength 8\n   * @maxLength 8\n   */\n  userCode?: string;\n}\n\nexport interface DeviceAuthorizationInfoResponse {\n  /** The ID of the application the device is authorizing into. */\n  clientId?: string;\n  /** Canonical browser name of the initiating browser (e.g. \"chrome\"). */\n  browser?: string | null;\n  /** Canonical OS of the initiating browser (e.g. \"windows\"). */\n  os?: string | null;\n  /** Canonical device class of the initiating browser (e.g. \"desktop\"). */\n  deviceClass?: string | null;\n  /** IP address of the initiating browser. */\n  browserIp?: string | null;\n  /** Coarse geo-location (country, optional region) derived from the browser IP, e.g. \"IL\" or \"US-NY\". */\n  geo?: string | null;\n}\n\nexport interface InvalidateUserCodeRequest {\n  /** user code to invalidate. Only the authorizing identity is able to invalidate it. */\n  userCode?: string;\n}\n\nexport interface InvalidateUserCodeResponse {}\n\nexport interface RevokeRefreshTokenRequest {\n  /** The refresh token itself. Anyone with the token itself is able to revoke it. */\n  token?: string;\n  /** The client id that issued the refresh token. */\n  clientId?: string | null;\n}\n\nexport interface RevokeRefreshTokenResponse {}\n\nexport interface Empty {}\n\nexport interface DomainEvent extends DomainEventBodyOneOf {\n  createdEvent?: EntityCreatedEvent;\n  updatedEvent?: EntityUpdatedEvent;\n  deletedEvent?: EntityDeletedEvent;\n  actionEvent?: ActionEvent;\n  /** Event ID. With this ID you can easily spot duplicated events and ignore them. */\n  _id?: string;\n  /**\n   * Fully Qualified Domain Name of an entity. This is a unique identifier assigned to the API main business entities.\n   * For example, `wix.stores.catalog.product`, `wix.bookings.session`, `wix.payments.transaction`.\n   */\n  entityFqdn?: string;\n  /**\n   * Event action name, placed at the top level to make it easier for users to dispatch messages.\n   * For example: `created`/`updated`/`deleted`/`started`/`completed`/`email_opened`.\n   */\n  slug?: string;\n  /** ID of the entity associated with the event. */\n  entityId?: string;\n  /** Event timestamp in [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) format and UTC time. For example, `2020-04-26T13:57:50.699Z`. */\n  eventTime?: Date | null;\n  /**\n   * Whether the event was triggered as a result of a privacy regulation application\n   * (for example, GDPR).\n   */\n  triggeredByAnonymizeRequest?: boolean | null;\n  /** If present, indicates the action that triggered the event. */\n  originatedFrom?: string | null;\n  /**\n   * A sequence number that indicates the order of updates to an entity. For example, if an entity was updated at `16:00` and then again at `16:01`, the second update will always have a higher sequence number.\n   * You can use this number to make sure you're handling updates in the right order. Just save the latest sequence number on your end and compare it to the one in each new message. If the new message has an older (lower) number, you can safely ignore it.\n   */\n  entityEventSequence?: string | null;\n}\n\n/** @oneof */\nexport interface DomainEventBodyOneOf {\n  createdEvent?: EntityCreatedEvent;\n  updatedEvent?: EntityUpdatedEvent;\n  deletedEvent?: EntityDeletedEvent;\n  actionEvent?: ActionEvent;\n}\n\nexport interface EntityCreatedEvent {\n  entity?: string;\n}\n\nexport interface RestoreInfo {\n  deletedDate?: Date | null;\n}\n\nexport interface EntityUpdatedEvent {\n  /**\n   * Since platformized APIs only expose PATCH and not PUT we can't assume that the fields sent from the client are the actual diff.\n   * This means that to generate a list of changed fields (as opposed to sent fields) one needs to traverse both objects.\n   * We don't want to impose this on all developers and so we leave this traversal to the notification recipients which need it.\n   */\n  currentEntity?: string;\n}\n\nexport interface EntityDeletedEvent {\n  /** Entity that was deleted. */\n  deletedEntity?: string | null;\n}\n\nexport interface ActionEvent {\n  body?: string;\n}\n\nexport interface UserDeletedEvent {\n  /**\n   * User ID from the deletion event.\n   * @format GUID\n   */\n  userId?: string;\n}\n\nexport interface UserBlockedEvent {\n  /**\n   * User ID from the deletion event.\n   * @format GUID\n   */\n  userId?: string;\n}\n\nexport interface UserInfoRequest {}\n\n/** UserInfo endpoint response for OpenID Connect */\nexport interface UserInfoResponse {\n  /**\n   * Subject identifier — unique identifier for the user (OIDC standard claim).\n   * @format GUID\n   */\n  sub?: string;\n  /**\n   * The user's given name.\n   * @maxLength 20\n   */\n  givenName?: string | null;\n  /**\n   * The user's family name.\n   * @maxLength 20\n   */\n  familyName?: string | null;\n  /**\n   * The user's email address.\n   * @format EMAIL\n   */\n  email?: string | null;\n  /** Indicates whether the user's email address has been verified. */\n  emailVerified?: boolean | null;\n  /**\n   * The URL of the user's profile picture.\n   * @format WEB_URL\n   */\n  picture?: string | null;\n  /**\n   * The user's preferred language, if available.\n   * @format LANGUAGE\n   */\n  language?: string | null;\n  /** The user's full name. */\n  name?: string | null;\n}\n\n/**\n * Creates an access token.\n *\n *\n * The endpoint accepts raw HTTP requests. You must pass the request's body\n * parameters formatted as bytes in the raw HTTP request's `body` field,\n * following this template:\n * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n *\n * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n * token in the `body` field of the raw HTTP response.\n *\n * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n * HTTP response's `statusCode` field and details\n * about the error in `body`. Error details follow the\n * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n * @public\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.Token\n */\nexport async function token(\n  options?: TokenOptions\n): Promise<\n  NonNullablePaths<\n    RawHttpResponse,\n    `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n    2\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[1] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({\n    body: options?.body,\n    pathParams: options?.pathParams,\n    queryParams: options?.queryParams,\n    headers: options?.headers,\n    method: options?.method,\n    rawPath: options?.rawPath,\n    rawQuery: options?.rawQuery,\n  });\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.token(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {\n          body: '$[0].body',\n          pathParams: '$[0].pathParams',\n          queryParams: '$[0].queryParams',\n          headers: '$[0].headers',\n          method: '$[0].method',\n          rawPath: '$[0].rawPath',\n          rawQuery: '$[0].rawQuery',\n        },\n        singleArgumentUnchanged: false,\n      },\n      ['options']\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\nexport interface TokenOptions {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\n/**\n * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n * Serves a non-secret public key.\n * @public\n * @documentationMaturity preview\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.Jwks\n */\nexport async function jwks(): Promise<\n  NonNullablePaths<\n    RawHttpResponse,\n    `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n    2\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[0] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({});\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.jwks(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {},\n        singleArgumentUnchanged: false,\n      },\n      []\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\n/**\n * Token Introspection Endpoint.\n * @public\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.TokenInfo\n */\nexport async function tokenInfo(\n  options?: TokenInfoOptions\n): Promise<\n  NonNullablePaths<\n    TokenInfoResponse,\n    `active` | `subjectType` | `subjectId` | `clientId`,\n    0\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[1] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({\n    body: options?.body,\n    pathParams: options?.pathParams,\n    queryParams: options?.queryParams,\n    headers: options?.headers,\n    method: options?.method,\n    rawPath: options?.rawPath,\n    rawQuery: options?.rawQuery,\n  });\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.tokenInfo(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {\n          body: '$[0].body',\n          pathParams: '$[0].pathParams',\n          queryParams: '$[0].queryParams',\n          headers: '$[0].headers',\n          method: '$[0].method',\n          rawPath: '$[0].rawPath',\n          rawQuery: '$[0].rawQuery',\n        },\n        singleArgumentUnchanged: false,\n      },\n      ['options']\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\nexport interface TokenInfoOptions {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\n/**\n * OpenID Connect UserInfo endpoint\n * Should be called with user access token obtained in OIDC flow as Authorization header\n * @public\n * @documentationMaturity preview\n * @returns UserInfo endpoint response for OpenID Connect\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.UserInfo\n */\nexport async function userInfo(): Promise<\n  NonNullablePaths<UserInfoResponse, `sub`, 0>\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[0] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({});\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.userInfo(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {},\n        singleArgumentUnchanged: false,\n      },\n      []\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n","import { toURLSearchParams } from '@wix/sdk-runtime/rest-modules';\nimport { transformSDKBytesToRESTBytes } from '@wix/sdk-runtime/transformations/bytes';\nimport { transformRESTBytesToSDKBytes } from '@wix/sdk-runtime/transformations/bytes';\nimport { transformPaths } from '@wix/sdk-runtime/transformations/transform-paths';\nimport { resolveUrl } from '@wix/sdk-runtime/rest-modules';\nimport { ResolveUrlOpts } from '@wix/sdk-runtime/rest-modules';\nimport { RequestOptionsFactory } from '@wix/sdk-types';\n\nconst TRANSFORM_PATHS_0 = [{ path: 'body' }];\n\nfunction resolveWixIdentityOauth2V1Oauth2NgUrl(\n  opts: Omit<ResolveUrlOpts, 'domainToMappings'>\n) {\n  const domainToMappings = {\n    'manage._base_domain_': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'www.wixapis.com': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n      {\n        srcPath: '/oauth2/token_info',\n        destPath: '/v1/token_info',\n      },\n    ],\n    'users._base_domain_': [\n      {\n        srcPath: '/v1/oauth/device/verify',\n        destPath: '/v1/oauth/device/verify',\n      },\n      {\n        srcPath: '/v1/oauth/manage/user-code',\n        destPath: '/v1/oauth/manage/user-code',\n      },\n      {\n        srcPath: '/v2/oauth/device/verify',\n        destPath: '/v2/oauth/device/verify',\n      },\n      {\n        srcPath: '/v1/oauth/authorize',\n        destPath: '/v1/oauth/authorize',\n      },\n      {\n        srcPath: '/oauth/device/authorize',\n        destPath: '/v1/oauth/device/authorize',\n      },\n      {\n        srcPath: '/oauth/device/authorization',\n        destPath: '/v1/oauth/device/authorization',\n      },\n      {\n        srcPath: '/oauth/token',\n        destPath: '/v1/oauth/token',\n      },\n      {\n        srcPath: '/oauth/jwks',\n        destPath: '/v1/oauth/jwks',\n      },\n      {\n        srcPath: '/oauth/user-info',\n        destPath: '/v1/oauth/user-info',\n      },\n    ],\n    _: [\n      {\n        srcPath: '/_api/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'platform.rise.ai': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'api._api_base_domain_': [\n      {\n        srcPath: '/oauth2-ng',\n        destPath: '',\n      },\n    ],\n    'apps._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'editor._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'blocks._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'create.editorx': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n  };\n\n  return resolveUrl(Object.assign(opts, { domainToMappings }));\n}\n\nconst PACKAGE_NAME = '@wix/auto_sdk_identity_oauth';\n\n/**\n * Creates an access token.\n *\n *\n * The endpoint accepts raw HTTP requests. You must pass the request's body\n * parameters formatted as bytes in the raw HTTP request's `body` field,\n * following this template:\n * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n *\n * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n * token in the `body` field of the raw HTTP response.\n *\n * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n * HTTP response's `statusCode` field and details\n * about the error in `body`. Error details follow the\n * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n */\nexport function token(payload: object): RequestOptionsFactory<any> {\n  function __token({ host }: any) {\n    const serializedData = transformPaths(payload, [\n      {\n        transformFn: transformSDKBytesToRESTBytes,\n        paths: TRANSFORM_PATHS_0,\n      },\n    ]);\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'POST' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.Token',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/token',\n        data: serializedData,\n        host,\n      }),\n      data: serializedData,\n      transformResponse: (payload: any) =>\n        transformPaths(payload, [\n          {\n            transformFn: transformRESTBytesToSDKBytes,\n            paths: TRANSFORM_PATHS_0,\n          },\n        ]),\n    };\n\n    return metadata;\n  }\n\n  return __token;\n}\n\n/**\n * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n * Serves a non-secret public key.\n */\nexport function jwks(payload: object): RequestOptionsFactory<any> {\n  function __jwks({ host }: any) {\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'GET' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.Jwks',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/jwks',\n        data: payload,\n        host,\n      }),\n      params: toURLSearchParams(payload),\n      transformResponse: (payload: any) =>\n        transformPaths(payload, [\n          {\n            transformFn: transformRESTBytesToSDKBytes,\n            paths: TRANSFORM_PATHS_0,\n          },\n        ]),\n    };\n\n    return metadata;\n  }\n\n  return __jwks;\n}\n\n/** Token Introspection Endpoint. */\nexport function tokenInfo(payload: object): RequestOptionsFactory<any> {\n  function __tokenInfo({ host }: any) {\n    const serializedData = transformPaths(payload, [\n      {\n        transformFn: transformSDKBytesToRESTBytes,\n        paths: TRANSFORM_PATHS_0,\n      },\n    ]);\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'POST' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.TokenInfo',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/token-info',\n        data: serializedData,\n        host,\n      }),\n      data: serializedData,\n    };\n\n    return metadata;\n  }\n\n  return __tokenInfo;\n}\n\n/**\n * OpenID Connect UserInfo endpoint\n * Should be called with user access token obtained in OIDC flow as Authorization header\n */\nexport function userInfo(payload: object): RequestOptionsFactory<any> {\n  function __userInfo({ host }: any) {\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'GET' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.UserInfo',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/user-info',\n        data: payload,\n        host,\n      }),\n      params: toURLSearchParams(payload),\n    };\n\n    return metadata;\n  }\n\n  return __userInfo;\n}\n","import { HttpClient, NonNullablePaths } from '@wix/sdk-types';\nimport {\n  RawHttpResponse,\n  TokenInfoOptions,\n  TokenInfoResponse,\n  TokenOptions,\n  UserInfoResponse,\n  jwks as universalJwks,\n  token as universalToken,\n  tokenInfo as universalTokenInfo,\n  userInfo as universalUserInfo,\n} from './identity-oauth-v1-refresh-token-oauth.universal.js';\n\nexport const __metadata = { PACKAGE_NAME: '@wix/identity' };\n\nexport function token(httpClient: HttpClient): TokenSignature {\n  return (options?: TokenOptions) =>\n    universalToken(\n      options,\n      // @ts-ignore\n      { httpClient }\n    );\n}\n\ninterface TokenSignature {\n  /**\n   * Creates an access token.\n   *\n   *\n   * The endpoint accepts raw HTTP requests. You must pass the request's body\n   * parameters formatted as bytes in the raw HTTP request's `body` field,\n   * following this template:\n   * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n   *\n   * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n   * token in the `body` field of the raw HTTP response.\n   *\n   * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n   * HTTP response's `statusCode` field and details\n   * about the error in `body`. Error details follow the\n   * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n   */\n  (options?: TokenOptions): Promise<\n    NonNullablePaths<\n      RawHttpResponse,\n      `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n      2\n    >\n  >;\n}\n\nexport function jwks(httpClient: HttpClient): JwksSignature {\n  return () =>\n    universalJwks(\n      // @ts-ignore\n      { httpClient }\n    );\n}\n\ninterface JwksSignature {\n  /**\n   * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n   * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n   * Serves a non-secret public key.\n   */\n  (): Promise<\n    NonNullablePaths<\n      RawHttpResponse,\n      `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n      2\n    >\n  >;\n}\n\nexport function tokenInfo(httpClient: HttpClient): TokenInfoSignature {\n  return (options?: TokenInfoOptions) =>\n    universalTokenInfo(\n      options,\n      // @ts-ignore\n      { httpClient }\n    );\n}\n\ninterface TokenInfoSignature {\n  /**\n   * Token Introspection Endpoint.\n   */\n  (options?: TokenInfoOptions): Promise<\n    NonNullablePaths<\n      TokenInfoResponse,\n      `active` | `subjectType` | `subjectId` | `clientId`,\n      0\n    >\n  >;\n}\n\nexport function userInfo(httpClient: HttpClient): UserInfoSignature {\n  return () =>\n    universalUserInfo(\n      // @ts-ignore\n      { httpClient }\n    );\n}\n\ninterface UserInfoSignature {\n  /**\n   * OpenID Connect UserInfo endpoint\n   * Should be called with user access token obtained in OIDC flow as Authorization header\n   * @returns UserInfo endpoint response for OpenID Connect\n   */\n  (): Promise<NonNullablePaths<UserInfoResponse, `sub`, 0>>;\n}\n\nexport {\n  ActionEvent,\n  AuthorizeRequest,\n  DeviceAuthorizationInfoRequest,\n  DeviceAuthorizationInfoResponse,\n  DeviceAuthorizeRequest,\n  DeviceAuthorizeResponse,\n  DeviceCodeRequest,\n  DeviceCodeResponse,\n  DeviceVerifyRequest,\n  DeviceVerifyResponse,\n  DeviceVerifyV2Request,\n  DeviceVerifyV2Response,\n  DomainEvent,\n  DomainEventBodyOneOf,\n  Empty,\n  EntityCreatedEvent,\n  EntityDeletedEvent,\n  EntityUpdatedEvent,\n  HeadersEntry,\n  InternalTokenResponse,\n  InternalTokenResponseResultOneOf,\n  InvalidateUserCodeRequest,\n  InvalidateUserCodeResponse,\n  JwksRequest,\n  PathParametersEntry,\n  QueryParametersEntry,\n  RawHttpRequest,\n  RawHttpResponse,\n  RefreshToken,\n  RestoreInfo,\n  RevokeRefreshTokenRequest,\n  RevokeRefreshTokenResponse,\n  SubjectType,\n  TokenErrorResponse,\n  TokenInfoOptions,\n  TokenInfoRequest,\n  TokenInfoResponse,\n  TokenOptions,\n  TokenRequest,\n  TokenRequestTenantOneOf,\n  TokenResponse,\n  UserBlockedEvent,\n  UserDeletedEvent,\n  UserInfoRequest,\n  UserInfoResponse,\n} from './identity-oauth-v1-refresh-token-oauth.universal.js';\n","import {\n  token as publicToken,\n  jwks as publicJwks,\n  tokenInfo as publicTokenInfo,\n  userInfo as publicUserInfo,\n} from './identity-oauth-v1-refresh-token-oauth.public.js';\nimport { createRESTModule } from '@wix/sdk-runtime/rest-modules';\nimport { BuildRESTFunction, MaybeContext } from '@wix/sdk-types';\n\nexport const token: MaybeContext<\n  BuildRESTFunction<typeof publicToken> & typeof publicToken\n> = /*#__PURE__*/ createRESTModule(publicToken);\nexport const jwks: MaybeContext<\n  BuildRESTFunction<typeof publicJwks> & typeof publicJwks\n> = /*#__PURE__*/ createRESTModule(publicJwks);\nexport const tokenInfo: MaybeContext<\n  BuildRESTFunction<typeof publicTokenInfo> & typeof publicTokenInfo\n> = /*#__PURE__*/ createRESTModule(publicTokenInfo);\nexport const userInfo: MaybeContext<\n  BuildRESTFunction<typeof publicUserInfo> & typeof publicUserInfo\n> = /*#__PURE__*/ createRESTModule(publicUserInfo);\n\nexport { SubjectType } from './identity-oauth-v1-refresh-token-oauth.universal.js';\nexport {\n  RefreshToken,\n  TokenRequest,\n  TokenRequestTenantOneOf,\n  InternalTokenResponse,\n  InternalTokenResponseResultOneOf,\n  TokenResponse,\n  TokenErrorResponse,\n  TokenInfoRequest,\n  TokenInfoResponse,\n  AuthorizeRequest,\n  RawHttpResponse,\n  HeadersEntry,\n  RawHttpRequest,\n  PathParametersEntry,\n  QueryParametersEntry,\n  JwksRequest,\n  DeviceCodeRequest,\n  DeviceCodeResponse,\n  DeviceAuthorizeRequest,\n  DeviceAuthorizeResponse,\n  DeviceVerifyRequest,\n  DeviceVerifyResponse,\n  DeviceVerifyV2Request,\n  DeviceVerifyV2Response,\n  DeviceAuthorizationInfoRequest,\n  DeviceAuthorizationInfoResponse,\n  InvalidateUserCodeRequest,\n  InvalidateUserCodeResponse,\n  RevokeRefreshTokenRequest,\n  RevokeRefreshTokenResponse,\n  Empty,\n  DomainEvent,\n  DomainEventBodyOneOf,\n  EntityCreatedEvent,\n  RestoreInfo,\n  EntityUpdatedEvent,\n  EntityDeletedEvent,\n  ActionEvent,\n  UserDeletedEvent,\n  UserBlockedEvent,\n  UserInfoRequest,\n  UserInfoResponse,\n  TokenOptions,\n  TokenInfoOptions,\n} from './identity-oauth-v1-refresh-token-oauth.universal.js';\nexport { SubjectTypeWithLiterals } from './identity-oauth-v1-refresh-token-oauth.universal.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA,cAAAA;AAAA,EAAA,aAAAC;AAAA,EAAA,iBAAAC;AAAA,EAAA,gBAAAC;AAAA;AAAA;;;ACAA,6BAAoD;AACpD,oCAGO;;;ACJP,0BAAkC;AAClC,mBAA6C;AAC7C,IAAAC,gBAA6C;AAC7C,6BAA+B;AAC/B,IAAAC,uBAA2B;AAI3B,IAAM,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC;AAE3C,SAAS,sCACP,MACA;AACA,QAAM,mBAAmB;AAAA,IACvB,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,mBAAmB;AAAA,MACjB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,uBAAuB;AAAA,MACrB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,GAAG;AAAA,MACD;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,oBAAoB;AAAA,MAClB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,yBAAyB;AAAA,MACvB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,sBAAsB;AAAA,MACpB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,kBAAkB;AAAA,MAChB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAEA,aAAO,iCAAW,OAAO,OAAO,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAC7D;AAEA,IAAM,eAAe;AAmBd,SAAS,MAAM,SAA6C;AACjE,WAAS,QAAQ,EAAE,KAAK,GAAQ;AAC9B,UAAM,qBAAiB,uCAAe,SAAS;AAAA,MAC7C;AAAA,QACE,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,MACN,mBAAmB,CAACC,iBAClB,uCAAeA,UAAS;AAAA,QACtB;AAAA,UACE,aAAa;AAAA,UACb,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAOO,SAAS,KAAK,SAA6C;AAChE,WAAS,OAAO,EAAE,KAAK,GAAQ;AAC7B,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,YAAQ,uCAAkB,OAAO;AAAA,MACjC,mBAAmB,CAACA,iBAClB,uCAAeA,UAAS;AAAA,QACtB;AAAA,UACE,aAAa;AAAA,UACb,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAGO,SAAS,UAAU,SAA6C;AACrE,WAAS,YAAY,EAAE,KAAK,GAAQ;AAClC,UAAM,qBAAiB,uCAAe,SAAS;AAAA,MAC7C;AAAA,QACE,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,IACR;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAMO,SAAS,SAAS,SAA6C;AACpE,WAAS,WAAW,EAAE,KAAK,GAAQ;AACjC,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,YAAQ,uCAAkB,OAAO;AAAA,IACnC;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;;;AD1GO,IAAK,cAAL,kBAAKC,iBAAL;AAEL,EAAAA,aAAA,aAAU;AAEV,EAAAA,aAAA,UAAO;AAEP,EAAAA,aAAA,aAAU;AAEV,EAAAA,aAAA,YAAS;AAET,EAAAA,aAAA,SAAM;AAVI,SAAAA;AAAA,GAAA;AA8bZ,eAAsBC,OACpB,SAOA;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,UAAmD,MAAM,OAAO;AAEtE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAC;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B;AAAA,UACxB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,QACA,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAoBA,eAAsBC,QAMpB;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC,CAAC,CAAC;AAExD,QAAM,UAAmD,KAAK,OAAO;AAErE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAD;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B,CAAC;AAAA,QAC3B,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC;AAAA,IACH;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAOA,eAAsBE,WACpB,SAOA;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,UAAmD,UAAU,OAAO;AAE1E,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAF;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B;AAAA,UACxB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,QACA,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAoBA,eAAsBG,YAEpB;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC,CAAC,CAAC;AAExD,QAAM,UAAmD,SAAS,OAAO;AAEzE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAH;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B,CAAC;AAAA,QAC3B,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC;AAAA,IACH;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;;;AEp0BO,SAASI,OAAM,YAAwC;AAC5D,SAAO,CAAC,YACNA;AAAA,IACE;AAAA;AAAA,IAEA,EAAE,WAAW;AAAA,EACf;AACJ;AA6BO,SAASC,MAAK,YAAuC;AAC1D,SAAO,MACLA;AAAA;AAAA,IAEE,EAAE,WAAW;AAAA,EACf;AACJ;AAiBO,SAASC,WAAU,YAA4C;AACpE,SAAO,CAAC,YACNA;AAAA,IACE;AAAA;AAAA,IAEA,EAAE,WAAW;AAAA,EACf;AACJ;AAeO,SAASC,UAAS,YAA2C;AAClE,SAAO,MACLA;AAAA;AAAA,IAEE,EAAE,WAAW;AAAA,EACf;AACJ;;;AChGA,IAAAC,uBAAiC;AAG1B,IAAMC,SAEK,2DAAiBA,MAAW;AACvC,IAAMC,QAEK,2DAAiBA,KAAU;AACtC,IAAMC,aAEK,2DAAiBA,UAAe;AAC3C,IAAMC,YAEK,2DAAiBA,SAAc;","names":["jwks","token","tokenInfo","userInfo","import_bytes","import_rest_modules","payload","SubjectType","token","sdkTransformError","jwks","tokenInfo","userInfo","token","jwks","tokenInfo","userInfo","import_rest_modules","token","jwks","tokenInfo","userInfo"]}

package/build/cjs/index.typings.d.ts

@@ -37,7 +37,11 @@ interface TokenRequest extends TokenRequestTenantOneOf {
     codeVerifier?: string | null;
     /** Required for `authorized_client` grant type - create tokens for a specific user. */
     userId?: string | null;
-    /** Required for `authorized_client` grant type - create tokens for a specific member using api-key. */
+    /**
+     * Required for `authorized_client` grant type - create tokens for a specific member.
+     * Optional when `client_id` and `session_token` are sent: the member then comes from the session, and `member_id`, if
+     * sent, must match it.
+     */
     memberId?: string | null;
     /**
      * Required for `client_credentials` grant type with clientId that represents an external app.
@@ -56,6 +60,8 @@ interface TokenRequest extends TokenRequestTenantOneOf {
     /**
      * Optional for `authorized_client` grant type (member tokens) - a member session token that is opened server-side to
      * extract the bound session id, producing session-bound wixAT/wixRT. Public: used by the member flow from public traffic.
+     * When sent with `client_id` (a headless OAuth app's client ID), the tokens are issued to that client for the member
+     * of the session, on the client's site rather than the caller's context.
      */
     sessionToken?: string | null;
     /**

package/build/cjs/index.typings.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../index.typings.ts","../../src/identity-oauth-v1-refresh-token-oauth.universal.ts","../../src/identity-oauth-v1-refresh-token-oauth.http.ts"],"sourcesContent":["export * from './src/identity-oauth-v1-refresh-token-oauth.universal.js';\n","import { transformError as sdkTransformError } from '@wix/sdk-runtime/transform-error';\nimport {\n  renameKeysFromSDKRequestToRESTRequest,\n  renameKeysFromRESTResponseToSDKResponse,\n} from '@wix/sdk-runtime/rename-all-nested-keys';\nimport { HttpClient, NonNullablePaths } from '@wix/sdk-types';\nimport * as ambassadorWixIdentityOauthV1RefreshToken from './identity-oauth-v1-refresh-token-oauth.http.js';\n\nexport interface RefreshToken {\n  token?: string;\n}\n\n/**\n * TokenRequest is sent by the client to the authorization server to request an\n * access token.\n */\nexport interface TokenRequest extends TokenRequestTenantOneOf {\n  /** supported tenant - specific site */\n  siteId?: string | null;\n  /** supported tenant - specific account */\n  accountId?: string | null;\n  /** The application id that want to obtain an access token. */\n  clientId?: string | null;\n  /**\n   * grant_type specifies the grant type being used. supported grant types are:\n   * `authorization_code`, `client_credentials`, `refresh_token`, `urn:ietf:params:oauth:grant-type:device_code`, `anonymous`,\n   * `urn:ietf:params:oauth:grant-type:token-exchange`\n   */\n  grantType?: string;\n  /** Required for `refresh_token` grant type. */\n  refreshToken?: string | null;\n  /** Required for `client_credentials` grant type. */\n  clientSecret?: string | null;\n  /**\n   * Required for `urn:ietf:params:oauth:grant-type:device_code` grant type. The device verification code, \"device_code\" from the\n   * device authorization response\n   */\n  deviceCode?: string | null;\n  /** Required for the `authorization_code` grant type. */\n  redirectUri?: string | null;\n  /** Required for `authorization_code` grant type. */\n  code?: string | null;\n  /** Optional, used if code challenge and code method were used in `authorization_code` grant type. */\n  codeVerifier?: string | null;\n  /** Required for `authorized_client` grant type - create tokens for a specific user. */\n  userId?: string | null;\n  /** Required for `authorized_client` grant type - create tokens for a specific member using api-key. */\n  memberId?: string | null;\n  /**\n   * Required for `client_credentials` grant type with clientId that represents an external app.\n   * An access token will be created based on the app installed version of an instance.\n   */\n  instanceId?: string | null;\n  /** Required for `authorized_client` grant type for externalApp and must be bounded with client id, create access token to an app with a specific version. */\n  appVersion?: string | null;\n  /** Required for `strip_bound_session` grant type - create token without bound session. */\n  accessToken?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - create tokens for a specific user.\n   * @format GUID\n   */\n  userAccountId?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - bind the issued tokens to a specific session (session-bound wixAT/wixRT).\n   * Internal-only: used by the server-to-server switchAccount flow via Oauth2NgInternal.\n   * @internal\n   * @format GUID\n   */\n  sessionId?: string | null;\n  /**\n   * Optional for `authorized_client` grant type (member tokens) - a member session token that is opened server-side to\n   * extract the bound session id, producing session-bound wixAT/wixRT. Public: used by the member flow from public traffic.\n   */\n  sessionToken?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - attach an impersonating user id to the minted token.\n   * Internal-only: used by server-to-server flows where a service mints a token carrying impersonation context.\n   * @internal\n   * @format GUID\n   */\n  impersonatingUserId?: string | null;\n  /**\n   * Required for the `urn:ietf:params:oauth:grant-type:token-exchange` grant - the account-level access token being\n   * exchanged for one scoped to the target named by the `tenant` oneof.\n   */\n  subjectToken?: string | null;\n  /**\n   * Required for the `urn:ietf:params:oauth:grant-type:token-exchange` grant - identifies the type of `subject_token`.\n   * Only `urn:ietf:params:oauth:token-type:access_token` is supported.\n   * @maxLength 100\n   */\n  subjectTokenType?: string | null;\n}\n\n/** @oneof */\nexport interface TokenRequestTenantOneOf {\n  /** supported tenant - specific site */\n  siteId?: string | null;\n  /** supported tenant - specific account */\n  accountId?: string | null;\n}\n\nexport interface InternalTokenResponse\n  extends InternalTokenResponseResultOneOf {\n  success?: TokenResponse;\n  failure?: TokenErrorResponse;\n}\n\n/** @oneof */\nexport interface InternalTokenResponseResultOneOf {\n  success?: TokenResponse;\n  failure?: TokenErrorResponse;\n}\n\nexport interface TokenResponse {\n  /** The access token issued by the authorization server. */\n  accessToken?: string;\n  /** The type of the token issued as described in Section 7.1. of the oauth2 rfc. */\n  tokenType?: string;\n  /**\n   * The lifetime in seconds of the access token.  For example, the value \"3600\" denotes that the access token will\n   * expire in one hour from the time the response was generated.\n   */\n  expiresIn?: number;\n  /** The refresh token, which can be used to obtain new access tokens. */\n  refreshToken?: string | null;\n  /** OPTIONAL, if identical to the scope requested by the client; otherwise, will be sent. */\n  scope?: string | null;\n  idToken?: string | null;\n  /**\n   * Set only for the `urn:ietf:params:oauth:grant-type:token-exchange` grant, where it is always\n   * `urn:ietf:params:oauth:token-type:access_token`. Empty for every other grant.\n   * @maxLength 100\n   */\n  issuedTokenType?: string | null;\n}\n\nexport interface TokenErrorResponse {\n  error?: string;\n  errorDescription?: string | null;\n}\n\nexport interface TokenInfoRequest {\n  /** The access token to introspect. */\n  token?: string;\n}\n\nexport interface TokenInfoResponse {\n  active?: boolean;\n  /** subject type. */\n  subjectType?: SubjectTypeWithLiterals;\n  /** subject id */\n  subjectId?: string;\n  /** Expiration time of the token */\n  exp?: string | null;\n  /** Issued time of the token */\n  iat?: string | null;\n  /** Client id */\n  clientId?: string;\n  /** Account id */\n  accountId?: string | null;\n  /** Site id */\n  siteId?: string | null;\n  /** Instance Id */\n  instanceId?: string | null;\n  /**\n   * Vendor Product Id\n   * @maxLength 100\n   */\n  vendorProductId?: string | null;\n}\n\nexport enum SubjectType {\n  /** unknown subject type */\n  UNKNOWN = 'UNKNOWN',\n  /** user subject type */\n  USER = 'USER',\n  /** visitor subject type */\n  VISITOR = 'VISITOR',\n  /** member subject type */\n  MEMBER = 'MEMBER',\n  /** app subject type */\n  APP = 'APP',\n}\n\n/** @enumType */\nexport type SubjectTypeWithLiterals =\n  | SubjectType\n  | 'UNKNOWN'\n  | 'USER'\n  | 'VISITOR'\n  | 'MEMBER'\n  | 'APP';\n\n/**\n * AuthorizeRequest is sent by the client to the authorization server to initiate\n * the authorization process.\n */\nexport interface AuthorizeRequest {\n  /**\n   * ID of the Wix OAuth app requesting authorization.\n   * @format GUID\n   */\n  clientId?: string;\n  /**\n   * Desired authorization [grant type](https://auth0.com/docs/authenticate/protocols/oauth#grant-types).\n   *\n   * Supported values:\n   * + `code`: The endpoint returns an authorization code that can be used to obtain an access token.\n   * @minLength 1\n   */\n  responseType?: string;\n  /**\n   * URI to redirect the browser to after authentication and authorization. The browser is redirected to this URI whether the authentication and authorization process is successful or not.\n   * @minLength 1\n   */\n  redirectUri?: string | null;\n  /**\n   * Desired scope of access. If this field is left empty, only an access token is granted.\n   * To received a refresh token, pass `offline_access` as the value of this field.\n   */\n  scope?: string | null;\n  /**\n   * A value used to confirm the state of an application before and after it makes an authorization\n   * request. If a value for this field is set in the request, it's added to the `redirectUri` when the browser\n   * is redirected there.\n   * Learn more about [using the state parameter](https://auth0.com/docs/secure/attack-protection/state-parameters).\n   * @minLength 1\n   */\n  state?: string;\n  /**\n   * esired response format.\n   *\n   * Supported values:\n   * + `query`: The response parameters are encoded as query string parameters and added to the `redirectUri` when redirecting.\n   * + `fragment`: The response parameters are encoded as URI fragment parameters and added to the `redirectUri` when redirecting.\n   * + `web_message`: The response parameters are encoded as a JSON object and added to the body of a [web message response](https://datatracker.ietf.org/doc/html/draft-sakimura-oauth-wmrm-00).\n   *\n   * Default value: `query`\n   */\n  responseMode?: string | null;\n  /**\n   * Code challenge to use for PKCE verification.\n   * This field is only used if `responseType` is set to `code`.\n   */\n  codeChallenge?: string | null;\n  /**\n   * Code challenge method to use for PKCE verification.\n   * This field is only used if `responseType` is set to `code`.\n   *\n   * Supported values:\n   * + `S256`: The code challenge is transformed using SHA-256 encyption.\n   * + `S512`: The code challenge is transformed using SHA-512 encyption.\n   */\n  codeChallengeMethod?: string | null;\n  /**\n   * Token returned by a successful [login](https://dev.wix.com/docs/api-reference/business-management/headless/authentication/login-v-2) or [register](https://dev.wix.com/docs/api-reference/business-management/headless/authentication/register-v-2) call that identifies the authenticated member.\n   *\n   * In the default SDK flow, session context is passed through a hidden iframe automatically. When using a [full-page redirect](https://dev.wix.com/docs/go-headless/develop-your-project/self-managed-headless/authentication/members/custom-login-page/custom-login/custom-login-using-the-js-sdk#use-a-full-page-redirect-desktop-and-mobile-browsers) instead, you must pass this field explicitly because there is no iframe to carry the session context.\n   */\n  sessionToken?: string | null;\n  /**\n   * Optional fields for errors\n   * A short error code that describes the type of error that occurred (e.g. \"invalid_request\")\n   * @internal\n   */\n  error?: string | null;\n  /**\n   * A human-readable description of the error that occurred\n   * @internal\n   */\n  errorDescription?: string | null;\n  /**\n   * DEPRECATED: no longer read. The sign-in URL is resolved from the client's OAuthClientConfiguration\n   * component (sign_in_url), falling back to the default Wix sign-in page.\n   * @internal\n   * @format SECURE_WEB_URL\n   * @deprecated\n   */\n  signInUrl?: string | null;\n  /**\n   * Indicates whether the user has consented to the requested scopes\n   * @internal\n   */\n  userConsented?: boolean | null;\n  /**\n   * Indicates whether login is optional. If true, will not redirect to the sign_in_url if user is not logged in.\n   * @internal\n   */\n  optionalLogin?: boolean | null;\n  /**\n   * The site id the authorization is requested for.\n   * @internal\n   * @format GUID\n   */\n  metaSiteId?: string | null;\n  /**\n   * ID of the IAM IdP connection to authenticate with when no member session exists.\n   * When set, the sign-in redirect initiates an OIDC login against this IdP connection\n   * (IAM's `/sso/login` endpoint) instead of the default Wix login page.\n   * @internal\n   * @format GUID\n   */\n  idp?: string | null;\n  /**\n   * OIDC nonce, bound to the authorization request and echoed back in the id_token.\n   * @maxLength 512\n   */\n  nonce?: string | null;\n  /**\n   * RFC 9470 / OIDC acr_values: space-separated required ACRs (OR, in preference order) for step-up.\n   * @internal\n   */\n  acrValues?: string | null;\n  /**\n   * RFC 9470 / OIDC max_age: max seconds since last auth (0 forces re-auth).\n   * @internal\n   */\n  maxAge?: string | null;\n  /** OIDC prompt. Only \"none\" is honored: request silent authorization with no user interaction. */\n  prompt?: string | null;\n  /**\n   * Standard OAuth error code the step-up surface returns on the browser redirect back to authorize\n   * (e.g. access_denied, unmet_authentication_requirements). Browser-supplied like acr_values/prompt, so\n   * untrusted: allowlisted and forwarded to the client as the OAuth error.\n   * @internal\n   */\n  stepUpError?: string | null;\n}\n\nexport interface RawHttpResponse {\n  body?: Uint8Array;\n  statusCode?: number | null;\n  headers?: HeadersEntry[];\n}\n\nexport interface HeadersEntry {\n  key?: string;\n  value?: string;\n}\n\nexport interface RawHttpRequest {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\nexport interface PathParametersEntry {\n  key?: string;\n  value?: string;\n}\n\nexport interface QueryParametersEntry {\n  key?: string;\n  value?: string;\n}\n\n/** Request for the Jwks endpoint. Takes no parameters. */\nexport interface JwksRequest {}\n\nexport interface DeviceCodeRequest {\n  /** The ID of the application that asks for authorization. */\n  clientId?: string;\n  /**\n   * scope is a space-delimited string that specifies the requested scope of the\n   * access request.\n   */\n  scope?: string | null;\n}\n\nexport interface DeviceCodeResponse {\n  /** is the unique code for the device. When the user goes to the verification_uri in their browser-based device, this code will be bound to their session. */\n  deviceCode?: string;\n  /** contains the code that should be input at the verification_uri to authorize the device. */\n  userCode?: string;\n  /** contains the URL the user should visit to authorize the device. */\n  verificationUri?: string;\n  /** indicates the lifetime (in seconds) of the device_code and user_code. */\n  expiresIn?: number;\n  /** indicates the interval (in seconds) at which the app should poll the token URL to request a token. clients MUST use 5 as the default */\n  interval?: number | null;\n}\n\nexport interface DeviceAuthorizeRequest {\n  /** The ID of the application that asks for authorization. */\n  clientId?: string;\n  /** scope is a space-delimited string that specifies the requested scope of the access request. */\n  scope?: string | null;\n  /**\n   * OIDC nonce, bound to the device authorization and echoed back in the id_token at /token.\n   * @maxLength 512\n   */\n  nonce?: string | null;\n}\n\nexport interface DeviceAuthorizeResponse {\n  /** the unique code for the device, used to poll the token endpoint. */\n  deviceCode?: string;\n  /** the code the user enters at the verification_uri to authorize the device. */\n  userCode?: string;\n  /** the URL the user should visit to authorize the device. */\n  verificationUri?: string;\n  /** the verification_uri with the user_code embedded as a query param, ready to encode into a QR code. */\n  verificationUriComplete?: string;\n  /** lifetime (in seconds) of the device_code and user_code. */\n  expiresIn?: number;\n  /** interval (in seconds) at which the client should poll the token endpoint. clients MUST use 5 as the default. */\n  interval?: number | null;\n}\n\nexport interface DeviceVerifyRequest {\n  /** User code representing a currently authorizing device. */\n  userCode?: string;\n}\n\nexport interface DeviceVerifyResponse {}\n\nexport interface DeviceVerifyV2Request {\n  /**\n   * User code representing a currently authorizing device.\n   * @minLength 8\n   * @maxLength 8\n   */\n  userCode?: string;\n}\n\nexport interface DeviceVerifyV2Response {}\n\nexport interface DeviceAuthorizationInfoRequest {\n  /**\n   * User code representing a currently authorizing device.\n   * @minLength 8\n   * @maxLength 8\n   */\n  userCode?: string;\n}\n\nexport interface DeviceAuthorizationInfoResponse {\n  /** The ID of the application the device is authorizing into. */\n  clientId?: string;\n  /** Canonical browser name of the initiating browser (e.g. \"chrome\"). */\n  browser?: string | null;\n  /** Canonical OS of the initiating browser (e.g. \"windows\"). */\n  os?: string | null;\n  /** Canonical device class of the initiating browser (e.g. \"desktop\"). */\n  deviceClass?: string | null;\n  /** IP address of the initiating browser. */\n  browserIp?: string | null;\n  /** Coarse geo-location (country, optional region) derived from the browser IP, e.g. \"IL\" or \"US-NY\". */\n  geo?: string | null;\n}\n\nexport interface InvalidateUserCodeRequest {\n  /** user code to invalidate. Only the authorizing identity is able to invalidate it. */\n  userCode?: string;\n}\n\nexport interface InvalidateUserCodeResponse {}\n\nexport interface RevokeRefreshTokenRequest {\n  /** The refresh token itself. Anyone with the token itself is able to revoke it. */\n  token?: string;\n  /** The client id that issued the refresh token. */\n  clientId?: string | null;\n}\n\nexport interface RevokeRefreshTokenResponse {}\n\nexport interface Empty {}\n\nexport interface DomainEvent extends DomainEventBodyOneOf {\n  createdEvent?: EntityCreatedEvent;\n  updatedEvent?: EntityUpdatedEvent;\n  deletedEvent?: EntityDeletedEvent;\n  actionEvent?: ActionEvent;\n  /** Event ID. With this ID you can easily spot duplicated events and ignore them. */\n  _id?: string;\n  /**\n   * Fully Qualified Domain Name of an entity. This is a unique identifier assigned to the API main business entities.\n   * For example, `wix.stores.catalog.product`, `wix.bookings.session`, `wix.payments.transaction`.\n   */\n  entityFqdn?: string;\n  /**\n   * Event action name, placed at the top level to make it easier for users to dispatch messages.\n   * For example: `created`/`updated`/`deleted`/`started`/`completed`/`email_opened`.\n   */\n  slug?: string;\n  /** ID of the entity associated with the event. */\n  entityId?: string;\n  /** Event timestamp in [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) format and UTC time. For example, `2020-04-26T13:57:50.699Z`. */\n  eventTime?: Date | null;\n  /**\n   * Whether the event was triggered as a result of a privacy regulation application\n   * (for example, GDPR).\n   */\n  triggeredByAnonymizeRequest?: boolean | null;\n  /** If present, indicates the action that triggered the event. */\n  originatedFrom?: string | null;\n  /**\n   * A sequence number that indicates the order of updates to an entity. For example, if an entity was updated at `16:00` and then again at `16:01`, the second update will always have a higher sequence number.\n   * You can use this number to make sure you're handling updates in the right order. Just save the latest sequence number on your end and compare it to the one in each new message. If the new message has an older (lower) number, you can safely ignore it.\n   */\n  entityEventSequence?: string | null;\n}\n\n/** @oneof */\nexport interface DomainEventBodyOneOf {\n  createdEvent?: EntityCreatedEvent;\n  updatedEvent?: EntityUpdatedEvent;\n  deletedEvent?: EntityDeletedEvent;\n  actionEvent?: ActionEvent;\n}\n\nexport interface EntityCreatedEvent {\n  entity?: string;\n}\n\nexport interface RestoreInfo {\n  deletedDate?: Date | null;\n}\n\nexport interface EntityUpdatedEvent {\n  /**\n   * Since platformized APIs only expose PATCH and not PUT we can't assume that the fields sent from the client are the actual diff.\n   * This means that to generate a list of changed fields (as opposed to sent fields) one needs to traverse both objects.\n   * We don't want to impose this on all developers and so we leave this traversal to the notification recipients which need it.\n   */\n  currentEntity?: string;\n}\n\nexport interface EntityDeletedEvent {\n  /** Entity that was deleted. */\n  deletedEntity?: string | null;\n}\n\nexport interface ActionEvent {\n  body?: string;\n}\n\nexport interface UserDeletedEvent {\n  /**\n   * User ID from the deletion event.\n   * @format GUID\n   */\n  userId?: string;\n}\n\nexport interface UserBlockedEvent {\n  /**\n   * User ID from the deletion event.\n   * @format GUID\n   */\n  userId?: string;\n}\n\nexport interface UserInfoRequest {}\n\n/** UserInfo endpoint response for OpenID Connect */\nexport interface UserInfoResponse {\n  /**\n   * Subject identifier — unique identifier for the user (OIDC standard claim).\n   * @format GUID\n   */\n  sub?: string;\n  /**\n   * The user's given name.\n   * @maxLength 20\n   */\n  givenName?: string | null;\n  /**\n   * The user's family name.\n   * @maxLength 20\n   */\n  familyName?: string | null;\n  /**\n   * The user's email address.\n   * @format EMAIL\n   */\n  email?: string | null;\n  /** Indicates whether the user's email address has been verified. */\n  emailVerified?: boolean | null;\n  /**\n   * The URL of the user's profile picture.\n   * @format WEB_URL\n   */\n  picture?: string | null;\n  /**\n   * The user's preferred language, if available.\n   * @format LANGUAGE\n   */\n  language?: string | null;\n  /** The user's full name. */\n  name?: string | null;\n}\n\n/**\n * Creates an access token.\n *\n *\n * The endpoint accepts raw HTTP requests. You must pass the request's body\n * parameters formatted as bytes in the raw HTTP request's `body` field,\n * following this template:\n * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n *\n * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n * token in the `body` field of the raw HTTP response.\n *\n * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n * HTTP response's `statusCode` field and details\n * about the error in `body`. Error details follow the\n * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n * @public\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.Token\n */\nexport async function token(\n  options?: TokenOptions\n): Promise<\n  NonNullablePaths<\n    RawHttpResponse,\n    `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n    2\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[1] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({\n    body: options?.body,\n    pathParams: options?.pathParams,\n    queryParams: options?.queryParams,\n    headers: options?.headers,\n    method: options?.method,\n    rawPath: options?.rawPath,\n    rawQuery: options?.rawQuery,\n  });\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.token(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {\n          body: '$[0].body',\n          pathParams: '$[0].pathParams',\n          queryParams: '$[0].queryParams',\n          headers: '$[0].headers',\n          method: '$[0].method',\n          rawPath: '$[0].rawPath',\n          rawQuery: '$[0].rawQuery',\n        },\n        singleArgumentUnchanged: false,\n      },\n      ['options']\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\nexport interface TokenOptions {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\n/**\n * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n * Serves a non-secret public key.\n * @public\n * @documentationMaturity preview\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.Jwks\n */\nexport async function jwks(): Promise<\n  NonNullablePaths<\n    RawHttpResponse,\n    `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n    2\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[0] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({});\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.jwks(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {},\n        singleArgumentUnchanged: false,\n      },\n      []\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\n/**\n * Token Introspection Endpoint.\n * @public\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.TokenInfo\n */\nexport async function tokenInfo(\n  options?: TokenInfoOptions\n): Promise<\n  NonNullablePaths<\n    TokenInfoResponse,\n    `active` | `subjectType` | `subjectId` | `clientId`,\n    0\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[1] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({\n    body: options?.body,\n    pathParams: options?.pathParams,\n    queryParams: options?.queryParams,\n    headers: options?.headers,\n    method: options?.method,\n    rawPath: options?.rawPath,\n    rawQuery: options?.rawQuery,\n  });\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.tokenInfo(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {\n          body: '$[0].body',\n          pathParams: '$[0].pathParams',\n          queryParams: '$[0].queryParams',\n          headers: '$[0].headers',\n          method: '$[0].method',\n          rawPath: '$[0].rawPath',\n          rawQuery: '$[0].rawQuery',\n        },\n        singleArgumentUnchanged: false,\n      },\n      ['options']\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\nexport interface TokenInfoOptions {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\n/**\n * OpenID Connect UserInfo endpoint\n * Should be called with user access token obtained in OIDC flow as Authorization header\n * @public\n * @documentationMaturity preview\n * @returns UserInfo endpoint response for OpenID Connect\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.UserInfo\n */\nexport async function userInfo(): Promise<\n  NonNullablePaths<UserInfoResponse, `sub`, 0>\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[0] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({});\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.userInfo(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {},\n        singleArgumentUnchanged: false,\n      },\n      []\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n","import { toURLSearchParams } from '@wix/sdk-runtime/rest-modules';\nimport { transformSDKBytesToRESTBytes } from '@wix/sdk-runtime/transformations/bytes';\nimport { transformRESTBytesToSDKBytes } from '@wix/sdk-runtime/transformations/bytes';\nimport { transformPaths } from '@wix/sdk-runtime/transformations/transform-paths';\nimport { resolveUrl } from '@wix/sdk-runtime/rest-modules';\nimport { ResolveUrlOpts } from '@wix/sdk-runtime/rest-modules';\nimport { RequestOptionsFactory } from '@wix/sdk-types';\n\nconst TRANSFORM_PATHS_0 = [{ path: 'body' }];\n\nfunction resolveWixIdentityOauth2V1Oauth2NgUrl(\n  opts: Omit<ResolveUrlOpts, 'domainToMappings'>\n) {\n  const domainToMappings = {\n    'manage._base_domain_': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'www.wixapis.com': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n      {\n        srcPath: '/oauth2/token_info',\n        destPath: '/v1/token_info',\n      },\n    ],\n    'users._base_domain_': [\n      {\n        srcPath: '/v1/oauth/device/verify',\n        destPath: '/v1/oauth/device/verify',\n      },\n      {\n        srcPath: '/v1/oauth/manage/user-code',\n        destPath: '/v1/oauth/manage/user-code',\n      },\n      {\n        srcPath: '/v2/oauth/device/verify',\n        destPath: '/v2/oauth/device/verify',\n      },\n      {\n        srcPath: '/v1/oauth/authorize',\n        destPath: '/v1/oauth/authorize',\n      },\n      {\n        srcPath: '/oauth/device/authorize',\n        destPath: '/v1/oauth/device/authorize',\n      },\n      {\n        srcPath: '/oauth/device/authorization',\n        destPath: '/v1/oauth/device/authorization',\n      },\n      {\n        srcPath: '/oauth/token',\n        destPath: '/v1/oauth/token',\n      },\n      {\n        srcPath: '/oauth/jwks',\n        destPath: '/v1/oauth/jwks',\n      },\n      {\n        srcPath: '/oauth/user-info',\n        destPath: '/v1/oauth/user-info',\n      },\n    ],\n    _: [\n      {\n        srcPath: '/_api/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'platform.rise.ai': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'api._api_base_domain_': [\n      {\n        srcPath: '/oauth2-ng',\n        destPath: '',\n      },\n    ],\n    'apps._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'editor._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'blocks._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'create.editorx': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n  };\n\n  return resolveUrl(Object.assign(opts, { domainToMappings }));\n}\n\nconst PACKAGE_NAME = '@wix/auto_sdk_identity_oauth';\n\n/**\n * Creates an access token.\n *\n *\n * The endpoint accepts raw HTTP requests. You must pass the request's body\n * parameters formatted as bytes in the raw HTTP request's `body` field,\n * following this template:\n * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n *\n * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n * token in the `body` field of the raw HTTP response.\n *\n * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n * HTTP response's `statusCode` field and details\n * about the error in `body`. Error details follow the\n * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n */\nexport function token(payload: object): RequestOptionsFactory<any> {\n  function __token({ host }: any) {\n    const serializedData = transformPaths(payload, [\n      {\n        transformFn: transformSDKBytesToRESTBytes,\n        paths: TRANSFORM_PATHS_0,\n      },\n    ]);\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'POST' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.Token',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/token',\n        data: serializedData,\n        host,\n      }),\n      data: serializedData,\n      transformResponse: (payload: any) =>\n        transformPaths(payload, [\n          {\n            transformFn: transformRESTBytesToSDKBytes,\n            paths: TRANSFORM_PATHS_0,\n          },\n        ]),\n    };\n\n    return metadata;\n  }\n\n  return __token;\n}\n\n/**\n * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n * Serves a non-secret public key.\n */\nexport function jwks(payload: object): RequestOptionsFactory<any> {\n  function __jwks({ host }: any) {\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'GET' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.Jwks',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/jwks',\n        data: payload,\n        host,\n      }),\n      params: toURLSearchParams(payload),\n      transformResponse: (payload: any) =>\n        transformPaths(payload, [\n          {\n            transformFn: transformRESTBytesToSDKBytes,\n            paths: TRANSFORM_PATHS_0,\n          },\n        ]),\n    };\n\n    return metadata;\n  }\n\n  return __jwks;\n}\n\n/** Token Introspection Endpoint. */\nexport function tokenInfo(payload: object): RequestOptionsFactory<any> {\n  function __tokenInfo({ host }: any) {\n    const serializedData = transformPaths(payload, [\n      {\n        transformFn: transformSDKBytesToRESTBytes,\n        paths: TRANSFORM_PATHS_0,\n      },\n    ]);\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'POST' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.TokenInfo',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/token-info',\n        data: serializedData,\n        host,\n      }),\n      data: serializedData,\n    };\n\n    return metadata;\n  }\n\n  return __tokenInfo;\n}\n\n/**\n * OpenID Connect UserInfo endpoint\n * Should be called with user access token obtained in OIDC flow as Authorization header\n */\nexport function userInfo(payload: object): RequestOptionsFactory<any> {\n  function __userInfo({ host }: any) {\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'GET' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.UserInfo',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/user-info',\n        data: payload,\n        host,\n      }),\n      params: toURLSearchParams(payload),\n    };\n\n    return metadata;\n  }\n\n  return __userInfo;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA,cAAAA;AAAA,EAAA,aAAAC;AAAA,EAAA,iBAAAC;AAAA,EAAA,gBAAAC;AAAA;AAAA;;;ACAA,6BAAoD;AACpD,oCAGO;;;ACJP,0BAAkC;AAClC,mBAA6C;AAC7C,IAAAC,gBAA6C;AAC7C,6BAA+B;AAC/B,IAAAC,uBAA2B;AAI3B,IAAM,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC;AAE3C,SAAS,sCACP,MACA;AACA,QAAM,mBAAmB;AAAA,IACvB,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,mBAAmB;AAAA,MACjB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,uBAAuB;AAAA,MACrB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,GAAG;AAAA,MACD;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,oBAAoB;AAAA,MAClB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,yBAAyB;AAAA,MACvB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,sBAAsB;AAAA,MACpB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,kBAAkB;AAAA,MAChB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAEA,aAAO,iCAAW,OAAO,OAAO,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAC7D;AAEA,IAAM,eAAe;AAmBd,SAAS,MAAM,SAA6C;AACjE,WAAS,QAAQ,EAAE,KAAK,GAAQ;AAC9B,UAAM,qBAAiB,uCAAe,SAAS;AAAA,MAC7C;AAAA,QACE,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,MACN,mBAAmB,CAACC,iBAClB,uCAAeA,UAAS;AAAA,QACtB;AAAA,UACE,aAAa;AAAA,UACb,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAOO,SAAS,KAAK,SAA6C;AAChE,WAAS,OAAO,EAAE,KAAK,GAAQ;AAC7B,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,YAAQ,uCAAkB,OAAO;AAAA,MACjC,mBAAmB,CAACA,iBAClB,uCAAeA,UAAS;AAAA,QACtB;AAAA,UACE,aAAa;AAAA,UACb,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAGO,SAAS,UAAU,SAA6C;AACrE,WAAS,YAAY,EAAE,KAAK,GAAQ;AAClC,UAAM,qBAAiB,uCAAe,SAAS;AAAA,MAC7C;AAAA,QACE,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,IACR;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAMO,SAAS,SAAS,SAA6C;AACpE,WAAS,WAAW,EAAE,KAAK,GAAQ;AACjC,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,YAAQ,uCAAkB,OAAO;AAAA,IACnC;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;;;ADhHO,IAAK,cAAL,kBAAKC,iBAAL;AAEL,EAAAA,aAAA,aAAU;AAEV,EAAAA,aAAA,UAAO;AAEP,EAAAA,aAAA,aAAU;AAEV,EAAAA,aAAA,YAAS;AAET,EAAAA,aAAA,SAAM;AAVI,SAAAA;AAAA,GAAA;AA8bZ,eAAsBC,OACpB,SAOA;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,UAAmD,MAAM,OAAO;AAEtE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAC;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B;AAAA,UACxB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,QACA,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAoBA,eAAsBC,QAMpB;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC,CAAC,CAAC;AAExD,QAAM,UAAmD,KAAK,OAAO;AAErE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAD;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B,CAAC;AAAA,QAC3B,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC;AAAA,IACH;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAOA,eAAsBE,WACpB,SAOA;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,UAAmD,UAAU,OAAO;AAE1E,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAF;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B;AAAA,UACxB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,QACA,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAoBA,eAAsBG,YAEpB;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC,CAAC,CAAC;AAExD,QAAM,UAAmD,SAAS,OAAO;AAEzE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAH;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B,CAAC;AAAA,QAC3B,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC;AAAA,IACH;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;","names":["jwks","token","tokenInfo","userInfo","import_bytes","import_rest_modules","payload","SubjectType","token","sdkTransformError","jwks","tokenInfo","userInfo"]}
+{"version":3,"sources":["../../index.typings.ts","../../src/identity-oauth-v1-refresh-token-oauth.universal.ts","../../src/identity-oauth-v1-refresh-token-oauth.http.ts"],"sourcesContent":["export * from './src/identity-oauth-v1-refresh-token-oauth.universal.js';\n","import { transformError as sdkTransformError } from '@wix/sdk-runtime/transform-error';\nimport {\n  renameKeysFromSDKRequestToRESTRequest,\n  renameKeysFromRESTResponseToSDKResponse,\n} from '@wix/sdk-runtime/rename-all-nested-keys';\nimport { HttpClient, NonNullablePaths } from '@wix/sdk-types';\nimport * as ambassadorWixIdentityOauthV1RefreshToken from './identity-oauth-v1-refresh-token-oauth.http.js';\n\nexport interface RefreshToken {\n  token?: string;\n}\n\n/**\n * TokenRequest is sent by the client to the authorization server to request an\n * access token.\n */\nexport interface TokenRequest extends TokenRequestTenantOneOf {\n  /** supported tenant - specific site */\n  siteId?: string | null;\n  /** supported tenant - specific account */\n  accountId?: string | null;\n  /** The application id that want to obtain an access token. */\n  clientId?: string | null;\n  /**\n   * grant_type specifies the grant type being used. supported grant types are:\n   * `authorization_code`, `client_credentials`, `refresh_token`, `urn:ietf:params:oauth:grant-type:device_code`, `anonymous`,\n   * `urn:ietf:params:oauth:grant-type:token-exchange`\n   */\n  grantType?: string;\n  /** Required for `refresh_token` grant type. */\n  refreshToken?: string | null;\n  /** Required for `client_credentials` grant type. */\n  clientSecret?: string | null;\n  /**\n   * Required for `urn:ietf:params:oauth:grant-type:device_code` grant type. The device verification code, \"device_code\" from the\n   * device authorization response\n   */\n  deviceCode?: string | null;\n  /** Required for the `authorization_code` grant type. */\n  redirectUri?: string | null;\n  /** Required for `authorization_code` grant type. */\n  code?: string | null;\n  /** Optional, used if code challenge and code method were used in `authorization_code` grant type. */\n  codeVerifier?: string | null;\n  /** Required for `authorized_client` grant type - create tokens for a specific user. */\n  userId?: string | null;\n  /**\n   * Required for `authorized_client` grant type - create tokens for a specific member.\n   * Optional when `client_id` and `session_token` are sent: the member then comes from the session, and `member_id`, if\n   * sent, must match it.\n   */\n  memberId?: string | null;\n  /**\n   * Required for `client_credentials` grant type with clientId that represents an external app.\n   * An access token will be created based on the app installed version of an instance.\n   */\n  instanceId?: string | null;\n  /** Required for `authorized_client` grant type for externalApp and must be bounded with client id, create access token to an app with a specific version. */\n  appVersion?: string | null;\n  /** Required for `strip_bound_session` grant type - create token without bound session. */\n  accessToken?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - create tokens for a specific user.\n   * @format GUID\n   */\n  userAccountId?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - bind the issued tokens to a specific session (session-bound wixAT/wixRT).\n   * Internal-only: used by the server-to-server switchAccount flow via Oauth2NgInternal.\n   * @internal\n   * @format GUID\n   */\n  sessionId?: string | null;\n  /**\n   * Optional for `authorized_client` grant type (member tokens) - a member session token that is opened server-side to\n   * extract the bound session id, producing session-bound wixAT/wixRT. Public: used by the member flow from public traffic.\n   * When sent with `client_id` (a headless OAuth app's client ID), the tokens are issued to that client for the member\n   * of the session, on the client's site rather than the caller's context.\n   */\n  sessionToken?: string | null;\n  /**\n   * Optional for `authorized_client` grant type - attach an impersonating user id to the minted token.\n   * Internal-only: used by server-to-server flows where a service mints a token carrying impersonation context.\n   * @internal\n   * @format GUID\n   */\n  impersonatingUserId?: string | null;\n  /**\n   * Required for the `urn:ietf:params:oauth:grant-type:token-exchange` grant - the account-level access token being\n   * exchanged for one scoped to the target named by the `tenant` oneof.\n   */\n  subjectToken?: string | null;\n  /**\n   * Required for the `urn:ietf:params:oauth:grant-type:token-exchange` grant - identifies the type of `subject_token`.\n   * Only `urn:ietf:params:oauth:token-type:access_token` is supported.\n   * @maxLength 100\n   */\n  subjectTokenType?: string | null;\n}\n\n/** @oneof */\nexport interface TokenRequestTenantOneOf {\n  /** supported tenant - specific site */\n  siteId?: string | null;\n  /** supported tenant - specific account */\n  accountId?: string | null;\n}\n\nexport interface InternalTokenResponse\n  extends InternalTokenResponseResultOneOf {\n  success?: TokenResponse;\n  failure?: TokenErrorResponse;\n}\n\n/** @oneof */\nexport interface InternalTokenResponseResultOneOf {\n  success?: TokenResponse;\n  failure?: TokenErrorResponse;\n}\n\nexport interface TokenResponse {\n  /** The access token issued by the authorization server. */\n  accessToken?: string;\n  /** The type of the token issued as described in Section 7.1. of the oauth2 rfc. */\n  tokenType?: string;\n  /**\n   * The lifetime in seconds of the access token.  For example, the value \"3600\" denotes that the access token will\n   * expire in one hour from the time the response was generated.\n   */\n  expiresIn?: number;\n  /** The refresh token, which can be used to obtain new access tokens. */\n  refreshToken?: string | null;\n  /** OPTIONAL, if identical to the scope requested by the client; otherwise, will be sent. */\n  scope?: string | null;\n  idToken?: string | null;\n  /**\n   * Set only for the `urn:ietf:params:oauth:grant-type:token-exchange` grant, where it is always\n   * `urn:ietf:params:oauth:token-type:access_token`. Empty for every other grant.\n   * @maxLength 100\n   */\n  issuedTokenType?: string | null;\n}\n\nexport interface TokenErrorResponse {\n  error?: string;\n  errorDescription?: string | null;\n}\n\nexport interface TokenInfoRequest {\n  /** The access token to introspect. */\n  token?: string;\n}\n\nexport interface TokenInfoResponse {\n  active?: boolean;\n  /** subject type. */\n  subjectType?: SubjectTypeWithLiterals;\n  /** subject id */\n  subjectId?: string;\n  /** Expiration time of the token */\n  exp?: string | null;\n  /** Issued time of the token */\n  iat?: string | null;\n  /** Client id */\n  clientId?: string;\n  /** Account id */\n  accountId?: string | null;\n  /** Site id */\n  siteId?: string | null;\n  /** Instance Id */\n  instanceId?: string | null;\n  /**\n   * Vendor Product Id\n   * @maxLength 100\n   */\n  vendorProductId?: string | null;\n}\n\nexport enum SubjectType {\n  /** unknown subject type */\n  UNKNOWN = 'UNKNOWN',\n  /** user subject type */\n  USER = 'USER',\n  /** visitor subject type */\n  VISITOR = 'VISITOR',\n  /** member subject type */\n  MEMBER = 'MEMBER',\n  /** app subject type */\n  APP = 'APP',\n}\n\n/** @enumType */\nexport type SubjectTypeWithLiterals =\n  | SubjectType\n  | 'UNKNOWN'\n  | 'USER'\n  | 'VISITOR'\n  | 'MEMBER'\n  | 'APP';\n\n/**\n * AuthorizeRequest is sent by the client to the authorization server to initiate\n * the authorization process.\n */\nexport interface AuthorizeRequest {\n  /**\n   * ID of the Wix OAuth app requesting authorization.\n   * @format GUID\n   */\n  clientId?: string;\n  /**\n   * Desired authorization [grant type](https://auth0.com/docs/authenticate/protocols/oauth#grant-types).\n   *\n   * Supported values:\n   * + `code`: The endpoint returns an authorization code that can be used to obtain an access token.\n   * @minLength 1\n   */\n  responseType?: string;\n  /**\n   * URI to redirect the browser to after authentication and authorization. The browser is redirected to this URI whether the authentication and authorization process is successful or not.\n   * @minLength 1\n   */\n  redirectUri?: string | null;\n  /**\n   * Desired scope of access. If this field is left empty, only an access token is granted.\n   * To received a refresh token, pass `offline_access` as the value of this field.\n   */\n  scope?: string | null;\n  /**\n   * A value used to confirm the state of an application before and after it makes an authorization\n   * request. If a value for this field is set in the request, it's added to the `redirectUri` when the browser\n   * is redirected there.\n   * Learn more about [using the state parameter](https://auth0.com/docs/secure/attack-protection/state-parameters).\n   * @minLength 1\n   */\n  state?: string;\n  /**\n   * esired response format.\n   *\n   * Supported values:\n   * + `query`: The response parameters are encoded as query string parameters and added to the `redirectUri` when redirecting.\n   * + `fragment`: The response parameters are encoded as URI fragment parameters and added to the `redirectUri` when redirecting.\n   * + `web_message`: The response parameters are encoded as a JSON object and added to the body of a [web message response](https://datatracker.ietf.org/doc/html/draft-sakimura-oauth-wmrm-00).\n   *\n   * Default value: `query`\n   */\n  responseMode?: string | null;\n  /**\n   * Code challenge to use for PKCE verification.\n   * This field is only used if `responseType` is set to `code`.\n   */\n  codeChallenge?: string | null;\n  /**\n   * Code challenge method to use for PKCE verification.\n   * This field is only used if `responseType` is set to `code`.\n   *\n   * Supported values:\n   * + `S256`: The code challenge is transformed using SHA-256 encyption.\n   * + `S512`: The code challenge is transformed using SHA-512 encyption.\n   */\n  codeChallengeMethod?: string | null;\n  /**\n   * Token returned by a successful [login](https://dev.wix.com/docs/api-reference/business-management/headless/authentication/login-v-2) or [register](https://dev.wix.com/docs/api-reference/business-management/headless/authentication/register-v-2) call that identifies the authenticated member.\n   *\n   * In the default SDK flow, session context is passed through a hidden iframe automatically. When using a [full-page redirect](https://dev.wix.com/docs/go-headless/develop-your-project/self-managed-headless/authentication/members/custom-login-page/custom-login/custom-login-using-the-js-sdk#use-a-full-page-redirect-desktop-and-mobile-browsers) instead, you must pass this field explicitly because there is no iframe to carry the session context.\n   */\n  sessionToken?: string | null;\n  /**\n   * Optional fields for errors\n   * A short error code that describes the type of error that occurred (e.g. \"invalid_request\")\n   * @internal\n   */\n  error?: string | null;\n  /**\n   * A human-readable description of the error that occurred\n   * @internal\n   */\n  errorDescription?: string | null;\n  /**\n   * DEPRECATED: no longer read. The sign-in URL is resolved from the client's OAuthClientConfiguration\n   * component (sign_in_url), falling back to the default Wix sign-in page.\n   * @internal\n   * @format SECURE_WEB_URL\n   * @deprecated\n   */\n  signInUrl?: string | null;\n  /**\n   * Indicates whether the user has consented to the requested scopes\n   * @internal\n   */\n  userConsented?: boolean | null;\n  /**\n   * Indicates whether login is optional. If true, will not redirect to the sign_in_url if user is not logged in.\n   * @internal\n   */\n  optionalLogin?: boolean | null;\n  /**\n   * The site id the authorization is requested for.\n   * @internal\n   * @format GUID\n   */\n  metaSiteId?: string | null;\n  /**\n   * ID of the IAM IdP connection to authenticate with when no member session exists.\n   * When set, the sign-in redirect initiates an OIDC login against this IdP connection\n   * (IAM's `/sso/login` endpoint) instead of the default Wix login page.\n   * @internal\n   * @format GUID\n   */\n  idp?: string | null;\n  /**\n   * OIDC nonce, bound to the authorization request and echoed back in the id_token.\n   * @maxLength 512\n   */\n  nonce?: string | null;\n  /**\n   * RFC 9470 / OIDC acr_values: space-separated required ACRs (OR, in preference order) for step-up.\n   * @internal\n   */\n  acrValues?: string | null;\n  /**\n   * RFC 9470 / OIDC max_age: max seconds since last auth (0 forces re-auth).\n   * @internal\n   */\n  maxAge?: string | null;\n  /** OIDC prompt. Only \"none\" is honored: request silent authorization with no user interaction. */\n  prompt?: string | null;\n  /**\n   * Standard OAuth error code the step-up surface returns on the browser redirect back to authorize\n   * (e.g. access_denied, unmet_authentication_requirements). Browser-supplied like acr_values/prompt, so\n   * untrusted: allowlisted and forwarded to the client as the OAuth error.\n   * @internal\n   */\n  stepUpError?: string | null;\n}\n\nexport interface RawHttpResponse {\n  body?: Uint8Array;\n  statusCode?: number | null;\n  headers?: HeadersEntry[];\n}\n\nexport interface HeadersEntry {\n  key?: string;\n  value?: string;\n}\n\nexport interface RawHttpRequest {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\nexport interface PathParametersEntry {\n  key?: string;\n  value?: string;\n}\n\nexport interface QueryParametersEntry {\n  key?: string;\n  value?: string;\n}\n\n/** Request for the Jwks endpoint. Takes no parameters. */\nexport interface JwksRequest {}\n\nexport interface DeviceCodeRequest {\n  /** The ID of the application that asks for authorization. */\n  clientId?: string;\n  /**\n   * scope is a space-delimited string that specifies the requested scope of the\n   * access request.\n   */\n  scope?: string | null;\n}\n\nexport interface DeviceCodeResponse {\n  /** is the unique code for the device. When the user goes to the verification_uri in their browser-based device, this code will be bound to their session. */\n  deviceCode?: string;\n  /** contains the code that should be input at the verification_uri to authorize the device. */\n  userCode?: string;\n  /** contains the URL the user should visit to authorize the device. */\n  verificationUri?: string;\n  /** indicates the lifetime (in seconds) of the device_code and user_code. */\n  expiresIn?: number;\n  /** indicates the interval (in seconds) at which the app should poll the token URL to request a token. clients MUST use 5 as the default */\n  interval?: number | null;\n}\n\nexport interface DeviceAuthorizeRequest {\n  /** The ID of the application that asks for authorization. */\n  clientId?: string;\n  /** scope is a space-delimited string that specifies the requested scope of the access request. */\n  scope?: string | null;\n  /**\n   * OIDC nonce, bound to the device authorization and echoed back in the id_token at /token.\n   * @maxLength 512\n   */\n  nonce?: string | null;\n}\n\nexport interface DeviceAuthorizeResponse {\n  /** the unique code for the device, used to poll the token endpoint. */\n  deviceCode?: string;\n  /** the code the user enters at the verification_uri to authorize the device. */\n  userCode?: string;\n  /** the URL the user should visit to authorize the device. */\n  verificationUri?: string;\n  /** the verification_uri with the user_code embedded as a query param, ready to encode into a QR code. */\n  verificationUriComplete?: string;\n  /** lifetime (in seconds) of the device_code and user_code. */\n  expiresIn?: number;\n  /** interval (in seconds) at which the client should poll the token endpoint. clients MUST use 5 as the default. */\n  interval?: number | null;\n}\n\nexport interface DeviceVerifyRequest {\n  /** User code representing a currently authorizing device. */\n  userCode?: string;\n}\n\nexport interface DeviceVerifyResponse {}\n\nexport interface DeviceVerifyV2Request {\n  /**\n   * User code representing a currently authorizing device.\n   * @minLength 8\n   * @maxLength 8\n   */\n  userCode?: string;\n}\n\nexport interface DeviceVerifyV2Response {}\n\nexport interface DeviceAuthorizationInfoRequest {\n  /**\n   * User code representing a currently authorizing device.\n   * @minLength 8\n   * @maxLength 8\n   */\n  userCode?: string;\n}\n\nexport interface DeviceAuthorizationInfoResponse {\n  /** The ID of the application the device is authorizing into. */\n  clientId?: string;\n  /** Canonical browser name of the initiating browser (e.g. \"chrome\"). */\n  browser?: string | null;\n  /** Canonical OS of the initiating browser (e.g. \"windows\"). */\n  os?: string | null;\n  /** Canonical device class of the initiating browser (e.g. \"desktop\"). */\n  deviceClass?: string | null;\n  /** IP address of the initiating browser. */\n  browserIp?: string | null;\n  /** Coarse geo-location (country, optional region) derived from the browser IP, e.g. \"IL\" or \"US-NY\". */\n  geo?: string | null;\n}\n\nexport interface InvalidateUserCodeRequest {\n  /** user code to invalidate. Only the authorizing identity is able to invalidate it. */\n  userCode?: string;\n}\n\nexport interface InvalidateUserCodeResponse {}\n\nexport interface RevokeRefreshTokenRequest {\n  /** The refresh token itself. Anyone with the token itself is able to revoke it. */\n  token?: string;\n  /** The client id that issued the refresh token. */\n  clientId?: string | null;\n}\n\nexport interface RevokeRefreshTokenResponse {}\n\nexport interface Empty {}\n\nexport interface DomainEvent extends DomainEventBodyOneOf {\n  createdEvent?: EntityCreatedEvent;\n  updatedEvent?: EntityUpdatedEvent;\n  deletedEvent?: EntityDeletedEvent;\n  actionEvent?: ActionEvent;\n  /** Event ID. With this ID you can easily spot duplicated events and ignore them. */\n  _id?: string;\n  /**\n   * Fully Qualified Domain Name of an entity. This is a unique identifier assigned to the API main business entities.\n   * For example, `wix.stores.catalog.product`, `wix.bookings.session`, `wix.payments.transaction`.\n   */\n  entityFqdn?: string;\n  /**\n   * Event action name, placed at the top level to make it easier for users to dispatch messages.\n   * For example: `created`/`updated`/`deleted`/`started`/`completed`/`email_opened`.\n   */\n  slug?: string;\n  /** ID of the entity associated with the event. */\n  entityId?: string;\n  /** Event timestamp in [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) format and UTC time. For example, `2020-04-26T13:57:50.699Z`. */\n  eventTime?: Date | null;\n  /**\n   * Whether the event was triggered as a result of a privacy regulation application\n   * (for example, GDPR).\n   */\n  triggeredByAnonymizeRequest?: boolean | null;\n  /** If present, indicates the action that triggered the event. */\n  originatedFrom?: string | null;\n  /**\n   * A sequence number that indicates the order of updates to an entity. For example, if an entity was updated at `16:00` and then again at `16:01`, the second update will always have a higher sequence number.\n   * You can use this number to make sure you're handling updates in the right order. Just save the latest sequence number on your end and compare it to the one in each new message. If the new message has an older (lower) number, you can safely ignore it.\n   */\n  entityEventSequence?: string | null;\n}\n\n/** @oneof */\nexport interface DomainEventBodyOneOf {\n  createdEvent?: EntityCreatedEvent;\n  updatedEvent?: EntityUpdatedEvent;\n  deletedEvent?: EntityDeletedEvent;\n  actionEvent?: ActionEvent;\n}\n\nexport interface EntityCreatedEvent {\n  entity?: string;\n}\n\nexport interface RestoreInfo {\n  deletedDate?: Date | null;\n}\n\nexport interface EntityUpdatedEvent {\n  /**\n   * Since platformized APIs only expose PATCH and not PUT we can't assume that the fields sent from the client are the actual diff.\n   * This means that to generate a list of changed fields (as opposed to sent fields) one needs to traverse both objects.\n   * We don't want to impose this on all developers and so we leave this traversal to the notification recipients which need it.\n   */\n  currentEntity?: string;\n}\n\nexport interface EntityDeletedEvent {\n  /** Entity that was deleted. */\n  deletedEntity?: string | null;\n}\n\nexport interface ActionEvent {\n  body?: string;\n}\n\nexport interface UserDeletedEvent {\n  /**\n   * User ID from the deletion event.\n   * @format GUID\n   */\n  userId?: string;\n}\n\nexport interface UserBlockedEvent {\n  /**\n   * User ID from the deletion event.\n   * @format GUID\n   */\n  userId?: string;\n}\n\nexport interface UserInfoRequest {}\n\n/** UserInfo endpoint response for OpenID Connect */\nexport interface UserInfoResponse {\n  /**\n   * Subject identifier — unique identifier for the user (OIDC standard claim).\n   * @format GUID\n   */\n  sub?: string;\n  /**\n   * The user's given name.\n   * @maxLength 20\n   */\n  givenName?: string | null;\n  /**\n   * The user's family name.\n   * @maxLength 20\n   */\n  familyName?: string | null;\n  /**\n   * The user's email address.\n   * @format EMAIL\n   */\n  email?: string | null;\n  /** Indicates whether the user's email address has been verified. */\n  emailVerified?: boolean | null;\n  /**\n   * The URL of the user's profile picture.\n   * @format WEB_URL\n   */\n  picture?: string | null;\n  /**\n   * The user's preferred language, if available.\n   * @format LANGUAGE\n   */\n  language?: string | null;\n  /** The user's full name. */\n  name?: string | null;\n}\n\n/**\n * Creates an access token.\n *\n *\n * The endpoint accepts raw HTTP requests. You must pass the request's body\n * parameters formatted as bytes in the raw HTTP request's `body` field,\n * following this template:\n * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n *\n * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n * token in the `body` field of the raw HTTP response.\n *\n * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n * HTTP response's `statusCode` field and details\n * about the error in `body`. Error details follow the\n * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n * @public\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.Token\n */\nexport async function token(\n  options?: TokenOptions\n): Promise<\n  NonNullablePaths<\n    RawHttpResponse,\n    `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n    2\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[1] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({\n    body: options?.body,\n    pathParams: options?.pathParams,\n    queryParams: options?.queryParams,\n    headers: options?.headers,\n    method: options?.method,\n    rawPath: options?.rawPath,\n    rawQuery: options?.rawQuery,\n  });\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.token(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {\n          body: '$[0].body',\n          pathParams: '$[0].pathParams',\n          queryParams: '$[0].queryParams',\n          headers: '$[0].headers',\n          method: '$[0].method',\n          rawPath: '$[0].rawPath',\n          rawQuery: '$[0].rawQuery',\n        },\n        singleArgumentUnchanged: false,\n      },\n      ['options']\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\nexport interface TokenOptions {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\n/**\n * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n * Serves a non-secret public key.\n * @public\n * @documentationMaturity preview\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.Jwks\n */\nexport async function jwks(): Promise<\n  NonNullablePaths<\n    RawHttpResponse,\n    `body` | `headers` | `headers.${number}.key` | `headers.${number}.value`,\n    2\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[0] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({});\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.jwks(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {},\n        singleArgumentUnchanged: false,\n      },\n      []\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\n/**\n * Token Introspection Endpoint.\n * @public\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.TokenInfo\n */\nexport async function tokenInfo(\n  options?: TokenInfoOptions\n): Promise<\n  NonNullablePaths<\n    TokenInfoResponse,\n    `active` | `subjectType` | `subjectId` | `clientId`,\n    0\n  >\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[1] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({\n    body: options?.body,\n    pathParams: options?.pathParams,\n    queryParams: options?.queryParams,\n    headers: options?.headers,\n    method: options?.method,\n    rawPath: options?.rawPath,\n    rawQuery: options?.rawQuery,\n  });\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.tokenInfo(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {\n          body: '$[0].body',\n          pathParams: '$[0].pathParams',\n          queryParams: '$[0].queryParams',\n          headers: '$[0].headers',\n          method: '$[0].method',\n          rawPath: '$[0].rawPath',\n          rawQuery: '$[0].rawQuery',\n        },\n        singleArgumentUnchanged: false,\n      },\n      ['options']\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n\nexport interface TokenInfoOptions {\n  body?: Uint8Array;\n  pathParams?: PathParametersEntry[];\n  queryParams?: QueryParametersEntry[];\n  headers?: HeadersEntry[];\n  method?: string;\n  rawPath?: string;\n  rawQuery?: string;\n}\n\n/**\n * OpenID Connect UserInfo endpoint\n * Should be called with user access token obtained in OIDC flow as Authorization header\n * @public\n * @documentationMaturity preview\n * @returns UserInfo endpoint response for OpenID Connect\n * @fqn wix.identity.oauth2.v1.Oauth2Ng.UserInfo\n */\nexport async function userInfo(): Promise<\n  NonNullablePaths<UserInfoResponse, `sub`, 0>\n> {\n  // @ts-ignore\n  const { httpClient, sideEffects } = arguments[0] as {\n    httpClient: HttpClient;\n    sideEffects?: any;\n  };\n\n  const payload = renameKeysFromSDKRequestToRESTRequest({});\n\n  const reqOpts = ambassadorWixIdentityOauthV1RefreshToken.userInfo(payload);\n\n  sideEffects?.onSiteCall?.();\n  try {\n    const result = await httpClient.request(reqOpts);\n    sideEffects?.onSuccess?.(result);\n\n    return renameKeysFromRESTResponseToSDKResponse(result.data)!;\n  } catch (err: any) {\n    const transformedError = sdkTransformError(\n      err,\n      {\n        spreadPathsToArguments: {},\n        explicitPathsToArguments: {},\n        singleArgumentUnchanged: false,\n      },\n      []\n    );\n    sideEffects?.onError?.(err);\n\n    throw transformedError;\n  }\n}\n","import { toURLSearchParams } from '@wix/sdk-runtime/rest-modules';\nimport { transformSDKBytesToRESTBytes } from '@wix/sdk-runtime/transformations/bytes';\nimport { transformRESTBytesToSDKBytes } from '@wix/sdk-runtime/transformations/bytes';\nimport { transformPaths } from '@wix/sdk-runtime/transformations/transform-paths';\nimport { resolveUrl } from '@wix/sdk-runtime/rest-modules';\nimport { ResolveUrlOpts } from '@wix/sdk-runtime/rest-modules';\nimport { RequestOptionsFactory } from '@wix/sdk-types';\n\nconst TRANSFORM_PATHS_0 = [{ path: 'body' }];\n\nfunction resolveWixIdentityOauth2V1Oauth2NgUrl(\n  opts: Omit<ResolveUrlOpts, 'domainToMappings'>\n) {\n  const domainToMappings = {\n    'manage._base_domain_': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'www.wixapis.com': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n      {\n        srcPath: '/oauth2/token_info',\n        destPath: '/v1/token_info',\n      },\n    ],\n    'users._base_domain_': [\n      {\n        srcPath: '/v1/oauth/device/verify',\n        destPath: '/v1/oauth/device/verify',\n      },\n      {\n        srcPath: '/v1/oauth/manage/user-code',\n        destPath: '/v1/oauth/manage/user-code',\n      },\n      {\n        srcPath: '/v2/oauth/device/verify',\n        destPath: '/v2/oauth/device/verify',\n      },\n      {\n        srcPath: '/v1/oauth/authorize',\n        destPath: '/v1/oauth/authorize',\n      },\n      {\n        srcPath: '/oauth/device/authorize',\n        destPath: '/v1/oauth/device/authorize',\n      },\n      {\n        srcPath: '/oauth/device/authorization',\n        destPath: '/v1/oauth/device/authorization',\n      },\n      {\n        srcPath: '/oauth/token',\n        destPath: '/v1/oauth/token',\n      },\n      {\n        srcPath: '/oauth/jwks',\n        destPath: '/v1/oauth/jwks',\n      },\n      {\n        srcPath: '/oauth/user-info',\n        destPath: '/v1/oauth/user-info',\n      },\n    ],\n    _: [\n      {\n        srcPath: '/_api/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'platform.rise.ai': [\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n    ],\n    'api._api_base_domain_': [\n      {\n        srcPath: '/oauth2-ng',\n        destPath: '',\n      },\n    ],\n    'apps._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2',\n        destPath: '/v1/oauth',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'editor._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'blocks._base_domain_': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n    'create.editorx': [\n      {\n        srcPath: '/oauth2/callback',\n        destPath: '/oauth2/callback',\n      },\n      {\n        srcPath: '/oauth2/user-authorized',\n        destPath: '/oauth2/user-authorized',\n      },\n    ],\n  };\n\n  return resolveUrl(Object.assign(opts, { domainToMappings }));\n}\n\nconst PACKAGE_NAME = '@wix/auto_sdk_identity_oauth';\n\n/**\n * Creates an access token.\n *\n *\n * The endpoint accepts raw HTTP requests. You must pass the request's body\n * parameters formatted as bytes in the raw HTTP request's `body` field,\n * following this template:\n * `{\"grantType\": \"client_credentials\", \"client_id\": \"<APP_ID>\", \"client_secret\": \"<APP_SECRET_KEY>\", \"instance_id\": \"<INSTANCE_ID>\"}`.\n *\n * When the call succeeds, Wix returns `{\"statusCode\": 200}` and the created access\n * token in the `body` field of the raw HTTP response.\n *\n * In case the call fails, Wix returns the relevant `4XX` error code in the raw\n * HTTP response's `statusCode` field and details\n * about the error in `body`. Error details follow the\n * [conventions of the Internet Engineering Task Force (IETF)](https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.7).\n */\nexport function token(payload: object): RequestOptionsFactory<any> {\n  function __token({ host }: any) {\n    const serializedData = transformPaths(payload, [\n      {\n        transformFn: transformSDKBytesToRESTBytes,\n        paths: TRANSFORM_PATHS_0,\n      },\n    ]);\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'POST' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.Token',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/token',\n        data: serializedData,\n        host,\n      }),\n      data: serializedData,\n      transformResponse: (payload: any) =>\n        transformPaths(payload, [\n          {\n            transformFn: transformRESTBytesToSDKBytes,\n            paths: TRANSFORM_PATHS_0,\n          },\n        ]),\n    };\n\n    return metadata;\n  }\n\n  return __token;\n}\n\n/**\n * Returns the JWKS (JSON Web Key Set) with the RSA public key used to verify asymmetrically-signed\n * tokens (e.g. OIDC id_token). Required by external OIDC relying parties.\n * Serves a non-secret public key.\n */\nexport function jwks(payload: object): RequestOptionsFactory<any> {\n  function __jwks({ host }: any) {\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'GET' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.Jwks',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/jwks',\n        data: payload,\n        host,\n      }),\n      params: toURLSearchParams(payload),\n      transformResponse: (payload: any) =>\n        transformPaths(payload, [\n          {\n            transformFn: transformRESTBytesToSDKBytes,\n            paths: TRANSFORM_PATHS_0,\n          },\n        ]),\n    };\n\n    return metadata;\n  }\n\n  return __jwks;\n}\n\n/** Token Introspection Endpoint. */\nexport function tokenInfo(payload: object): RequestOptionsFactory<any> {\n  function __tokenInfo({ host }: any) {\n    const serializedData = transformPaths(payload, [\n      {\n        transformFn: transformSDKBytesToRESTBytes,\n        paths: TRANSFORM_PATHS_0,\n      },\n    ]);\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'POST' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.TokenInfo',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/token-info',\n        data: serializedData,\n        host,\n      }),\n      data: serializedData,\n    };\n\n    return metadata;\n  }\n\n  return __tokenInfo;\n}\n\n/**\n * OpenID Connect UserInfo endpoint\n * Should be called with user access token obtained in OIDC flow as Authorization header\n */\nexport function userInfo(payload: object): RequestOptionsFactory<any> {\n  function __userInfo({ host }: any) {\n    const metadata = {\n      entityFqdn: 'wix.identity.oauth.v1.refresh_token',\n      method: 'GET' as any,\n      methodFqn: 'wix.identity.oauth2.v1.Oauth2Ng.UserInfo',\n      packageName: PACKAGE_NAME,\n      migrationOptions: {\n        optInTransformResponse: true,\n      },\n      url: resolveWixIdentityOauth2V1Oauth2NgUrl({\n        protoPath: '/v1/oauth/user-info',\n        data: payload,\n        host,\n      }),\n      params: toURLSearchParams(payload),\n    };\n\n    return metadata;\n  }\n\n  return __userInfo;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA,cAAAA;AAAA,EAAA,aAAAC;AAAA,EAAA,iBAAAC;AAAA,EAAA,gBAAAC;AAAA;AAAA;;;ACAA,6BAAoD;AACpD,oCAGO;;;ACJP,0BAAkC;AAClC,mBAA6C;AAC7C,IAAAC,gBAA6C;AAC7C,6BAA+B;AAC/B,IAAAC,uBAA2B;AAI3B,IAAM,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC;AAE3C,SAAS,sCACP,MACA;AACA,QAAM,mBAAmB;AAAA,IACvB,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,mBAAmB;AAAA,MACjB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,uBAAuB;AAAA,MACrB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,GAAG;AAAA,MACD;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,oBAAoB;AAAA,MAClB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,yBAAyB;AAAA,MACvB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,sBAAsB;AAAA,MACpB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IACA,kBAAkB;AAAA,MAChB;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AAEA,aAAO,iCAAW,OAAO,OAAO,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAC7D;AAEA,IAAM,eAAe;AAmBd,SAAS,MAAM,SAA6C;AACjE,WAAS,QAAQ,EAAE,KAAK,GAAQ;AAC9B,UAAM,qBAAiB,uCAAe,SAAS;AAAA,MAC7C;AAAA,QACE,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,MACN,mBAAmB,CAACC,iBAClB,uCAAeA,UAAS;AAAA,QACtB;AAAA,UACE,aAAa;AAAA,UACb,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAOO,SAAS,KAAK,SAA6C;AAChE,WAAS,OAAO,EAAE,KAAK,GAAQ;AAC7B,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,YAAQ,uCAAkB,OAAO;AAAA,MACjC,mBAAmB,CAACA,iBAClB,uCAAeA,UAAS;AAAA,QACtB;AAAA,UACE,aAAa;AAAA,UACb,OAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAGO,SAAS,UAAU,SAA6C;AACrE,WAAS,YAAY,EAAE,KAAK,GAAQ;AAClC,UAAM,qBAAiB,uCAAe,SAAS;AAAA,MAC7C;AAAA,QACE,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AACD,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,IACR;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAMO,SAAS,SAAS,SAA6C;AACpE,WAAS,WAAW,EAAE,KAAK,GAAQ;AACjC,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,aAAa;AAAA,MACb,kBAAkB;AAAA,QAChB,wBAAwB;AAAA,MAC1B;AAAA,MACA,KAAK,sCAAsC;AAAA,QACzC,WAAW;AAAA,QACX,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,YAAQ,uCAAkB,OAAO;AAAA,IACnC;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;;;AD1GO,IAAK,cAAL,kBAAKC,iBAAL;AAEL,EAAAA,aAAA,aAAU;AAEV,EAAAA,aAAA,UAAO;AAEP,EAAAA,aAAA,aAAU;AAEV,EAAAA,aAAA,YAAS;AAET,EAAAA,aAAA,SAAM;AAVI,SAAAA;AAAA,GAAA;AA8bZ,eAAsBC,OACpB,SAOA;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,UAAmD,MAAM,OAAO;AAEtE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAC;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B;AAAA,UACxB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,QACA,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAoBA,eAAsBC,QAMpB;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC,CAAC,CAAC;AAExD,QAAM,UAAmD,KAAK,OAAO;AAErE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAD;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B,CAAC;AAAA,QAC3B,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC;AAAA,IACH;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAOA,eAAsBE,WACpB,SAOA;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC;AAAA,IACpD,MAAM,SAAS;AAAA,IACf,YAAY,SAAS;AAAA,IACrB,aAAa,SAAS;AAAA,IACtB,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,QAAM,UAAmD,UAAU,OAAO;AAE1E,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAF;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B;AAAA,UACxB,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,QACA,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;AAoBA,eAAsBG,YAEpB;AAEA,QAAM,EAAE,YAAY,YAAY,IAAI,UAAU,CAAC;AAK/C,QAAM,cAAU,qEAAsC,CAAC,CAAC;AAExD,QAAM,UAAmD,SAAS,OAAO;AAEzE,eAAa,aAAa;AAC1B,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;AAC/C,iBAAa,YAAY,MAAM;AAE/B,eAAO,uEAAwC,OAAO,IAAI;AAAA,EAC5D,SAAS,KAAU;AACjB,UAAM,uBAAmB,uBAAAH;AAAA,MACvB;AAAA,MACA;AAAA,QACE,wBAAwB,CAAC;AAAA,QACzB,0BAA0B,CAAC;AAAA,QAC3B,yBAAyB;AAAA,MAC3B;AAAA,MACA,CAAC;AAAA,IACH;AACA,iBAAa,UAAU,GAAG;AAE1B,UAAM;AAAA,EACR;AACF;","names":["jwks","token","tokenInfo","userInfo","import_bytes","import_rest_modules","payload","SubjectType","token","sdkTransformError","jwks","tokenInfo","userInfo"]}

package/build/cjs/meta.d.ts

@@ -38,7 +38,11 @@ interface TokenRequest extends TokenRequestTenantOneOf {
     codeVerifier?: string | null;
     /** Required for `authorized_client` grant type - create tokens for a specific user. */
     userId?: string | null;
-    /** Required for `authorized_client` grant type - create tokens for a specific member using api-key. */
+    /**
+     * Required for `authorized_client` grant type - create tokens for a specific member.
+     * Optional when `client_id` and `session_token` are sent: the member then comes from the session, and `member_id`, if
+     * sent, must match it.
+     */
     memberId?: string | null;
     /**
      * Required for `client_credentials` grant type with clientId that represents an external app.
@@ -57,6 +61,8 @@ interface TokenRequest extends TokenRequestTenantOneOf {
     /**
      * Optional for `authorized_client` grant type (member tokens) - a member session token that is opened server-side to
      * extract the bound session id, producing session-bound wixAT/wixRT. Public: used by the member flow from public traffic.
+     * When sent with `client_id` (a headless OAuth app's client ID), the tokens are issued to that client for the member
+     * of the session, on the client's site rather than the caller's context.
      */
     sessionToken?: string | null;
     /**