@workos-inc/node 8.0.0-beta.2 → 8.0.0-beta.4

package/lib/esm/audit-logs/serializers/create-audit-log-schema-options.serializer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/audit-logs/serializers/create-audit-log-schema-options.serializer.ts"],"sourcesContent":["import {\n  AuditLogSchemaMetadata,\n  CreateAuditLogSchemaOptions,\n  SerializedCreateAuditLogSchemaOptions,\n} from '../interfaces';\n\nfunction serializeMetadata(\n  metadata: Record<string, string | number | boolean> | undefined,\n) {\n  if (!metadata) {\n    return {};\n  }\n\n  const serializedMetadata: AuditLogSchemaMetadata = {};\n\n  Object.keys(metadata).forEach((key) => {\n    serializedMetadata[key] = {\n      type: metadata[key] as 'string' | 'number' | 'boolean',\n    };\n  });\n\n  return serializedMetadata;\n}\n\nexport const serializeCreateAuditLogSchemaOptions = (\n  schema: CreateAuditLogSchemaOptions,\n): SerializedCreateAuditLogSchemaOptions => ({\n  actor: {\n    metadata: {\n      type: 'object',\n      properties: serializeMetadata(schema.actor?.metadata),\n    },\n  },\n  targets: schema.targets.map((target) => {\n    return {\n      type: target.type,\n      metadata: target.metadata\n        ? {\n            type: 'object',\n            properties: serializeMetadata(target.metadata),\n          }\n        : undefined,\n    };\n  }),\n  metadata: schema.metadata\n    ? {\n        type: 'object',\n        properties: serializeMetadata(schema.metadata),\n      }\n    : undefined,\n});\n"],"mappings":";;AAMA,SAAS,kBACP,UACA;AACA,MAAI,CAAC,UAAU;AACb,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,qBAA6C,CAAC;AAEpD,SAAO,KAAK,QAAQ,EAAE,QAAQ,CAAC,QAAQ;AACrC,uBAAmB,GAAG,IAAI;AAAA,MACxB,MAAM,SAAS,GAAG;AAAA,IACpB;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAhBS;AAkBF,MAAM,uCAAuC,wBAClD,YAC2C;AAAA,EAC3C,OAAO;AAAA,IACL,UAAU;AAAA,MACR,MAAM;AAAA,MACN,YAAY,kBAAkB,OAAO,OAAO,QAAQ;AAAA,IACtD;AAAA,EACF;AAAA,EACA,SAAS,OAAO,QAAQ,IAAI,CAAC,WAAW;AACtC,WAAO;AAAA,MACL,MAAM,OAAO;AAAA,MACb,UAAU,OAAO,WACb;AAAA,QACE,MAAM;AAAA,QACN,YAAY,kBAAkB,OAAO,QAAQ;AAAA,MAC/C,IACA;AAAA,IACN;AAAA,EACF,CAAC;AAAA,EACD,UAAU,OAAO,WACb;AAAA,IACE,MAAM;AAAA,IACN,YAAY,kBAAkB,OAAO,QAAQ;AAAA,EAC/C,IACA;AACN,IA1BoD;","names":[]}

package/lib/esm/audit-logs/serializers/create-audit-log-schema.serializer.d.ts

@@ -0,0 +1,6 @@
+import { CreateAuditLogSchemaResponse, AuditLogSchema } from '../interfaces/create-audit-log-schema-options.interface.js';
+import '../../common/interfaces/post-options.interface.js';
+
+declare const deserializeAuditLogSchema: (auditLogSchema: CreateAuditLogSchemaResponse) => AuditLogSchema;
+
+export { deserializeAuditLogSchema };

package/lib/esm/audit-logs/serializers/create-audit-log-schema.serializer.js

@@ -0,0 +1,34 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+function deserializeMetadata(metadata) {
+  if (!metadata || !metadata.properties) {
+    return {};
+  }
+  const deserializedMetadata = {};
+  Object.keys(metadata.properties).forEach((key) => {
+    if (metadata.properties) {
+      deserializedMetadata[key] = metadata.properties[key].type;
+    }
+  });
+  return deserializedMetadata;
+}
+__name(deserializeMetadata, "deserializeMetadata");
+const deserializeAuditLogSchema = /* @__PURE__ */ __name((auditLogSchema) => ({
+  object: auditLogSchema.object,
+  version: auditLogSchema.version,
+  targets: auditLogSchema.targets.map((target) => {
+    return {
+      type: target.type,
+      metadata: target.metadata ? deserializeMetadata(target.metadata) : void 0
+    };
+  }),
+  actor: {
+    metadata: deserializeMetadata(auditLogSchema.actor?.metadata)
+  },
+  metadata: auditLogSchema.metadata ? deserializeMetadata(auditLogSchema.metadata) : void 0,
+  createdAt: auditLogSchema.created_at
+}), "deserializeAuditLogSchema");
+export {
+  deserializeAuditLogSchema
+};
+//# sourceMappingURL=create-audit-log-schema.serializer.js.map

package/lib/esm/audit-logs/serializers/create-audit-log-schema.serializer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/audit-logs/serializers/create-audit-log-schema.serializer.ts"],"sourcesContent":["import { AuditLogSchema, CreateAuditLogSchemaResponse } from '../interfaces';\n\nfunction deserializeMetadata(metadata: {\n  properties?: Record<string, { type: string | number | boolean }>;\n}): Record<string, string | number | boolean> {\n  if (!metadata || !metadata.properties) {\n    return {};\n  }\n\n  const deserializedMetadata: Record<string, string | number | boolean> = {};\n\n  Object.keys(metadata.properties).forEach((key) => {\n    if (metadata.properties) {\n      deserializedMetadata[key] = metadata.properties[key].type;\n    }\n  });\n\n  return deserializedMetadata;\n}\n\nexport const deserializeAuditLogSchema = (\n  auditLogSchema: CreateAuditLogSchemaResponse,\n): AuditLogSchema => ({\n  object: auditLogSchema.object,\n  version: auditLogSchema.version,\n  targets: auditLogSchema.targets.map((target) => {\n    return {\n      type: target.type,\n      metadata: target.metadata\n        ? deserializeMetadata(target.metadata)\n        : undefined,\n    };\n  }),\n  actor: {\n    metadata: deserializeMetadata(auditLogSchema.actor?.metadata),\n  },\n  metadata: auditLogSchema.metadata\n    ? deserializeMetadata(auditLogSchema.metadata)\n    : undefined,\n  createdAt: auditLogSchema.created_at,\n});\n"],"mappings":";;AAEA,SAAS,oBAAoB,UAEiB;AAC5C,MAAI,CAAC,YAAY,CAAC,SAAS,YAAY;AACrC,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,uBAAkE,CAAC;AAEzE,SAAO,KAAK,SAAS,UAAU,EAAE,QAAQ,CAAC,QAAQ;AAChD,QAAI,SAAS,YAAY;AACvB,2BAAqB,GAAG,IAAI,SAAS,WAAW,GAAG,EAAE;AAAA,IACvD;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAhBS;AAkBF,MAAM,4BAA4B,wBACvC,oBACoB;AAAA,EACpB,QAAQ,eAAe;AAAA,EACvB,SAAS,eAAe;AAAA,EACxB,SAAS,eAAe,QAAQ,IAAI,CAAC,WAAW;AAC9C,WAAO;AAAA,MACL,MAAM,OAAO;AAAA,MACb,UAAU,OAAO,WACb,oBAAoB,OAAO,QAAQ,IACnC;AAAA,IACN;AAAA,EACF,CAAC;AAAA,EACD,OAAO;AAAA,IACL,UAAU,oBAAoB,eAAe,OAAO,QAAQ;AAAA,EAC9D;AAAA,EACA,UAAU,eAAe,WACrB,oBAAoB,eAAe,QAAQ,IAC3C;AAAA,EACJ,WAAW,eAAe;AAC5B,IApByC;","names":[]}

package/lib/esm/audit-logs/serializers/index.d.ts

@@ -0,0 +1,10 @@
+export { deserializeAuditLogExport } from './audit-log-export.serializer.js';
+export { serializeAuditLogExportOptions } from './audit-log-export-options.serializer.js';
+export { serializeCreateAuditLogEventOptions } from './create-audit-log-event-options.serializer.js';
+export { serializeCreateAuditLogSchemaOptions } from './create-audit-log-schema-options.serializer.js';
+export { deserializeAuditLogSchema } from './create-audit-log-schema.serializer.js';
+import '../interfaces/audit-log-export.interface.js';
+import '../interfaces/audit-log-export-options.interface.js';
+import '../interfaces/create-audit-log-event-options.interface.js';
+import '../../common/interfaces/post-options.interface.js';
+import '../interfaces/create-audit-log-schema-options.interface.js';

package/lib/esm/audit-logs/serializers/index.js

@@ -0,0 +1,6 @@
+export * from "./audit-log-export.serializer.js";
+export * from "./audit-log-export-options.serializer.js";
+export * from "./create-audit-log-event-options.serializer.js";
+export * from "./create-audit-log-schema-options.serializer.js";
+export * from "./create-audit-log-schema.serializer.js";
+//# sourceMappingURL=index.js.map

package/lib/esm/audit-logs/serializers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/audit-logs/serializers/index.ts"],"sourcesContent":["export * from './audit-log-export.serializer';\nexport * from './audit-log-export-options.serializer';\nexport * from './create-audit-log-event-options.serializer';\nexport * from './create-audit-log-schema-options.serializer';\nexport * from './create-audit-log-schema.serializer';\n"],"mappings":"AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}

package/lib/esm/client/index.d.ts

@@ -0,0 +1,3 @@
+export { L as LogoutURLOptions, A as UserManagementAuthorizationURLOptions, u as userManagement } from '../user-management-B38wNrIN.js';
+export { S as SSOAuthorizationURLOptions, s as sso } from '../sso-nFEQz_Js.js';
+import '../sso/interfaces/authorization-url-options.interface.js';

package/lib/esm/client/index.js

@@ -0,0 +1,7 @@
+import * as userManagement from "./user-management.js";
+import * as sso from "./sso.js";
+export {
+  sso,
+  userManagement
+};
+//# sourceMappingURL=index.js.map

package/lib/esm/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/client/index.ts"],"sourcesContent":["/**\n * Client methods that can be used without a WorkOS API key.\n * These are OAuth client operations suitable for PKCE flows.\n */\n\n// User Management client methods and types\nexport * as userManagement from './user-management';\n\n// SSO client methods and types\nexport * as sso from './sso';\n\n// Re-export specific types for convenience\nexport type {\n  AuthorizationURLOptions as UserManagementAuthorizationURLOptions,\n  LogoutURLOptions,\n} from './user-management';\n\nexport type { SSOAuthorizationURLOptions } from './sso';\n"],"mappings":"AAMA,YAAY,oBAAoB;AAGhC,YAAY,SAAS;","names":[]}

package/lib/esm/client/sso.d.ts

@@ -0,0 +1,2 @@
+import '../sso/interfaces/authorization-url-options.interface.js';
+export { S as SSOAuthorizationURLOptions, g as getAuthorizationUrl } from '../sso-nFEQz_Js.js';

package/lib/esm/client/sso.js

@@ -0,0 +1,42 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+import { toQueryString } from "./utils.js";
+function getAuthorizationUrl(options) {
+  const {
+    connection,
+    clientId,
+    domainHint,
+    loginHint,
+    organization,
+    provider,
+    providerQueryParams,
+    providerScopes,
+    redirectUri,
+    state,
+    baseURL = "https://api.workos.com"
+  } = options;
+  if (!provider && !connection && !organization) {
+    throw new Error(
+      `Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`
+    );
+  }
+  const query = toQueryString({
+    connection,
+    organization,
+    domain_hint: domainHint,
+    login_hint: loginHint,
+    provider,
+    provider_query_params: providerQueryParams,
+    provider_scopes: providerScopes,
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    state
+  });
+  return `${baseURL}/sso/authorize?${query}`;
+}
+__name(getAuthorizationUrl, "getAuthorizationUrl");
+export {
+  getAuthorizationUrl
+};
+//# sourceMappingURL=sso.js.map

package/lib/esm/client/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/client/sso.ts"],"sourcesContent":["import { toQueryString } from './utils';\nimport type { SSOAuthorizationURLOptions as BaseSSOAuthorizationURLOptions } from '../sso/interfaces';\n\n// Extend the base options to include baseURL for internal use\nexport type SSOAuthorizationURLOptions = BaseSSOAuthorizationURLOptions & {\n  baseURL?: string;\n};\n\n/**\n * Generates the authorization URL for SSO authentication.\n * Does not require an API key, suitable for OAuth client operations.\n *\n * @param options - SSO authorization URL options\n * @returns The authorization URL as a string\n * @throws Error if required arguments are missing\n */\nexport function getAuthorizationUrl(\n  options: SSOAuthorizationURLOptions,\n): string {\n  const {\n    connection,\n    clientId,\n    domainHint,\n    loginHint,\n    organization,\n    provider,\n    providerQueryParams,\n    providerScopes,\n    redirectUri,\n    state,\n    baseURL = 'https://api.workos.com',\n  } = options;\n\n  if (!provider && !connection && !organization) {\n    throw new Error(\n      `Incomplete arguments. Need to specify either a 'connection', 'organization', or 'provider'.`,\n    );\n  }\n\n  const query = toQueryString({\n    connection,\n    organization,\n    domain_hint: domainHint,\n    login_hint: loginHint,\n    provider,\n    provider_query_params: providerQueryParams,\n    provider_scopes: providerScopes,\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    state,\n  });\n\n  return `${baseURL}/sso/authorize?${query}`;\n}\n"],"mappings":";;AAAA,SAAS,qBAAqB;AAgBvB,SAAS,oBACd,SACQ;AACR,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,EACZ,IAAI;AAEJ,MAAI,CAAC,YAAY,CAAC,cAAc,CAAC,cAAc;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,cAAc;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,YAAY;AAAA,IACZ;AAAA,IACA,uBAAuB;AAAA,IACvB,iBAAiB;AAAA,IACjB,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf;AAAA,EACF,CAAC;AAED,SAAO,GAAG,OAAO,kBAAkB,KAAK;AAC1C;AAtCgB;","names":[]}

package/lib/esm/client/user-management.d.ts

@@ -0,0 +1 @@
+export { A as AuthorizationURLOptions, L as LogoutURLOptions, g as getAuthorizationUrl, b as getJwksUrl, a as getLogoutUrl } from '../user-management-B38wNrIN.js';

package/lib/esm/client/user-management.js

@@ -0,0 +1,85 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+import { toQueryString } from "./utils.js";
+function getAuthorizationUrl(options) {
+  const {
+    connectionId,
+    codeChallenge,
+    codeChallengeMethod,
+    context,
+    clientId,
+    domainHint,
+    loginHint,
+    organizationId,
+    provider,
+    providerQueryParams,
+    providerScopes,
+    prompt,
+    redirectUri,
+    state,
+    screenHint,
+    baseURL = "https://api.workos.com"
+  } = options;
+  if (!provider && !connectionId && !organizationId) {
+    throw new TypeError(
+      `Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`
+    );
+  }
+  if (provider !== "authkit" && screenHint) {
+    throw new TypeError(
+      `'screenHint' is only supported for 'authkit' provider`
+    );
+  }
+  if (context) {
+    console.warn(
+      `WorkOS: \`context\` is deprecated. We previously required initiate login endpoints to return the
+\`context\` query parameter when getting the authorization URL. This is no longer necessary.`
+    );
+  }
+  const query = toQueryString({
+    connection_id: connectionId,
+    code_challenge: codeChallenge,
+    code_challenge_method: codeChallengeMethod,
+    context,
+    organization_id: organizationId,
+    domain_hint: domainHint,
+    login_hint: loginHint,
+    provider,
+    provider_query_params: providerQueryParams,
+    provider_scopes: providerScopes,
+    prompt,
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    state,
+    screen_hint: screenHint
+  });
+  return `${baseURL}/user_management/authorize?${query}`;
+}
+__name(getAuthorizationUrl, "getAuthorizationUrl");
+function getLogoutUrl(options) {
+  const { sessionId, returnTo, baseURL = "https://api.workos.com" } = options;
+  if (!sessionId) {
+    throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);
+  }
+  const url = new URL("/user_management/sessions/logout", baseURL);
+  url.searchParams.set("session_id", sessionId);
+  if (returnTo) {
+    url.searchParams.set("return_to", returnTo);
+  }
+  return url.toString();
+}
+__name(getLogoutUrl, "getLogoutUrl");
+function getJwksUrl(clientId, baseURL = "https://api.workos.com") {
+  if (!clientId) {
+    throw new TypeError("clientId must be a valid clientId");
+  }
+  return `${baseURL}/sso/jwks/${clientId}`;
+}
+__name(getJwksUrl, "getJwksUrl");
+export {
+  getAuthorizationUrl,
+  getJwksUrl,
+  getLogoutUrl
+};
+//# sourceMappingURL=user-management.js.map

package/lib/esm/client/user-management.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/client/user-management.ts"],"sourcesContent":["import { toQueryString } from './utils';\n\n// Re-export necessary interfaces for client use\nexport interface AuthorizationURLOptions {\n  clientId: string;\n  codeChallenge?: string;\n  codeChallengeMethod?: 'S256';\n  connectionId?: string;\n  /**\n   *  @deprecated We previously required initiate login endpoints to return the `context`\n   *  query parameter when getting the authorization URL. This is no longer necessary.\n   */\n  context?: string;\n  organizationId?: string;\n  domainHint?: string;\n  loginHint?: string;\n  provider?: string;\n  providerQueryParams?: Record<string, string | boolean | number>;\n  providerScopes?: string[];\n  prompt?: string;\n  redirectUri: string;\n  state?: string;\n  screenHint?: 'sign-up' | 'sign-in';\n}\n\nexport interface LogoutURLOptions {\n  sessionId: string;\n  returnTo?: string;\n}\n\n/**\n * Generates the authorization URL for OAuth client authentication.\n * Suitable for PKCE flows and other OAuth client operations that don't require an API key.\n *\n * @param options - Authorization URL options\n * @returns The authorization URL as a string\n * @throws TypeError if required arguments are missing\n */\nexport function getAuthorizationUrl(\n  options: AuthorizationURLOptions & { baseURL?: string },\n): string {\n  const {\n    connectionId,\n    codeChallenge,\n    codeChallengeMethod,\n    context,\n    clientId,\n    domainHint,\n    loginHint,\n    organizationId,\n    provider,\n    providerQueryParams,\n    providerScopes,\n    prompt,\n    redirectUri,\n    state,\n    screenHint,\n    baseURL = 'https://api.workos.com',\n  } = options;\n\n  if (!provider && !connectionId && !organizationId) {\n    throw new TypeError(\n      `Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`,\n    );\n  }\n\n  if (provider !== 'authkit' && screenHint) {\n    throw new TypeError(\n      `'screenHint' is only supported for 'authkit' provider`,\n    );\n  }\n\n  if (context) {\n    console.warn(\n      `WorkOS: \\`context\\` is deprecated. We previously required initiate login endpoints to return the\n\\`context\\` query parameter when getting the authorization URL. This is no longer necessary.`,\n    );\n  }\n\n  const query = toQueryString({\n    connection_id: connectionId,\n    code_challenge: codeChallenge,\n    code_challenge_method: codeChallengeMethod,\n    context,\n    organization_id: organizationId,\n    domain_hint: domainHint,\n    login_hint: loginHint,\n    provider,\n    provider_query_params: providerQueryParams,\n    provider_scopes: providerScopes,\n    prompt,\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    response_type: 'code',\n    state,\n    screen_hint: screenHint,\n  });\n\n  return `${baseURL}/user_management/authorize?${query}`;\n}\n\n/**\n * Generates the logout URL for ending a user session.\n * This method is safe to use in browser environments as it doesn't require an API key.\n *\n * @param options - Logout URL options\n * @returns The logout URL as a string\n * @throws TypeError if sessionId is not provided\n */\nexport function getLogoutUrl(\n  options: LogoutURLOptions & { baseURL?: string },\n): string {\n  const { sessionId, returnTo, baseURL = 'https://api.workos.com' } = options;\n\n  if (!sessionId) {\n    throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);\n  }\n\n  const url = new URL('/user_management/sessions/logout', baseURL);\n\n  url.searchParams.set('session_id', sessionId);\n  if (returnTo) {\n    url.searchParams.set('return_to', returnTo);\n  }\n\n  return url.toString();\n}\n\n/**\n * Gets the JWKS (JSON Web Key Set) URL for a given client ID.\n * Does not require an API key, returns the public JWKS endpoint.\n *\n * @param clientId - The WorkOS client ID\n * @param baseURL - Optional base URL for the API (defaults to https://api.workos.com)\n * @returns The JWKS URL as a string\n * @throws TypeError if clientId is not provided\n */\nexport function getJwksUrl(\n  clientId: string,\n  baseURL = 'https://api.workos.com',\n): string {\n  if (!clientId) {\n    throw new TypeError('clientId must be a valid clientId');\n  }\n\n  return `${baseURL}/sso/jwks/${clientId}`;\n}\n"],"mappings":";;AAAA,SAAS,qBAAqB;AAsCvB,SAAS,oBACd,SACQ;AACR,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,EACZ,IAAI;AAEJ,MAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,gBAAgB;AACjD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,aAAa,aAAa,YAAY;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS;AACX,YAAQ;AAAA,MACN;AAAA;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,QAAQ,cAAc;AAAA,IAC1B,eAAe;AAAA,IACf,gBAAgB;AAAA,IAChB,uBAAuB;AAAA,IACvB;AAAA,IACA,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb,YAAY;AAAA,IACZ;AAAA,IACA,uBAAuB;AAAA,IACvB,iBAAiB;AAAA,IACjB;AAAA,IACA,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe;AAAA,IACf;AAAA,IACA,aAAa;AAAA,EACf,CAAC;AAED,SAAO,GAAG,OAAO,8BAA8B,KAAK;AACtD;AA7DgB;AAuET,SAAS,aACd,SACQ;AACR,QAAM,EAAE,WAAW,UAAU,UAAU,yBAAyB,IAAI;AAEpE,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AAEA,QAAM,MAAM,IAAI,IAAI,oCAAoC,OAAO;AAE/D,MAAI,aAAa,IAAI,cAAc,SAAS;AAC5C,MAAI,UAAU;AACZ,QAAI,aAAa,IAAI,aAAa,QAAQ;AAAA,EAC5C;AAEA,SAAO,IAAI,SAAS;AACtB;AAjBgB;AA4BT,SAAS,WACd,UACA,UAAU,0BACF;AACR,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,UAAU,mCAAmC;AAAA,EACzD;AAEA,SAAO,GAAG,OAAO,aAAa,QAAQ;AACxC;AATgB;","names":[]}

package/lib/esm/client/utils.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Converts an options object to a query string using qs library.
+ * Maintains backwards compatibility with existing URL formatting.
+ */
+declare const toQueryString: (options: Record<string, string | string[] | Record<string, string | boolean | number> | undefined>) => string;
+
+export { toQueryString };

package/lib/esm/client/utils.js

@@ -0,0 +1,16 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+import qs from "qs";
+const toQueryString = /* @__PURE__ */ __name((options) => {
+  return qs.stringify(options, {
+    arrayFormat: "repeat",
+    // sorts the keys alphabetically to maintain backwards compatibility
+    sort: /* @__PURE__ */ __name((a, b) => a.localeCompare(b), "sort"),
+    // encodes space as + instead of %20 to maintain backwards compatibility
+    format: "RFC1738"
+  });
+}, "toQueryString");
+export {
+  toQueryString
+};
+//# sourceMappingURL=utils.js.map

package/lib/esm/client/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/client/utils.ts"],"sourcesContent":["import qs from 'qs';\n\n/**\n * Converts an options object to a query string using qs library.\n * Maintains backwards compatibility with existing URL formatting.\n */\nexport const toQueryString = (\n  options: Record<\n    string,\n    string | string[] | Record<string, string | boolean | number> | undefined\n  >,\n): string => {\n  return qs.stringify(options, {\n    arrayFormat: 'repeat',\n    // sorts the keys alphabetically to maintain backwards compatibility\n    sort: (a, b) => a.localeCompare(b),\n    // encodes space as + instead of %20 to maintain backwards compatibility\n    format: 'RFC1738',\n  });\n};\n"],"mappings":";;AAAA,OAAO,QAAQ;AAMR,MAAM,gBAAgB,wBAC3B,YAIW;AACX,SAAO,GAAG,UAAU,SAAS;AAAA,IAC3B,aAAa;AAAA;AAAA,IAEb,MAAM,wBAAC,GAAG,MAAM,EAAE,cAAc,CAAC,GAA3B;AAAA;AAAA,IAEN,QAAQ;AAAA,EACV,CAAC;AACH,GAb6B;","names":[]}

package/lib/esm/common/crypto/crypto-provider.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Interface encapsulating the various crypto computations used by the library,
+ * allowing pluggable underlying crypto implementations.
+ */
+declare abstract class CryptoProvider {
+    encoder: TextEncoder;
+    /**
+     * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
+     * The output HMAC should be encoded in hexadecimal.
+     *
+     * Sample values for implementations:
+     * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
+     * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
+     */
+    abstract computeHMACSignature(payload: string, secret: string): string;
+    /**
+     * Asynchronous version of `computeHMACSignature`. Some implementations may
+     * only allow support async signature computation.
+     *
+     * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
+     * The output HMAC should be encoded in hexadecimal.
+     *
+     * Sample values for implementations:
+     * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
+     * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
+     */
+    abstract computeHMACSignatureAsync(payload: string, secret: string): Promise<string>;
+    /**
+     * Cryptographically determine whether two signatures are equal
+     */
+    abstract secureCompare(stringA: string, stringB: string): Promise<boolean>;
+    /**
+     * Encrypts data using AES-256-GCM algorithm.
+     *
+     * @param plaintext The data to encrypt
+     * @param key The encryption key (should be 32 bytes for AES-256)
+     * @param iv Optional initialization vector (if not provided, a random one will be generated)
+     * @param aad Optional additional authenticated data
+     * @returns Object containing the encrypted ciphertext, the IV used, and the authentication tag
+     */
+    abstract encrypt(plaintext: Uint8Array, key: Uint8Array, iv?: Uint8Array, aad?: Uint8Array): Promise<{
+        ciphertext: Uint8Array;
+        iv: Uint8Array;
+        tag: Uint8Array;
+    }>;
+    /**
+     * Decrypts data that was encrypted using AES-256-GCM algorithm.
+     *
+     * @param ciphertext The encrypted data
+     * @param key The decryption key (must be the same key used for encryption)
+     * @param iv The initialization vector used during encryption
+     * @param tag The authentication tag produced during encryption
+     * @param aad Optional additional authenticated data (must match what was used during encryption)
+     * @returns The decrypted data
+     * @throws Will throw an error if authentication fails or the data has been tampered with
+     */
+    abstract decrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Generates cryptographically secure random bytes.
+     *
+     * @param length The number of random bytes to generate
+     * @returns A Uint8Array containing the random bytes
+     */
+    abstract randomBytes(length: number): Uint8Array;
+}
+
+export { CryptoProvider };

package/lib/esm/common/crypto/crypto-provider.js

@@ -0,0 +1,12 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+class CryptoProvider {
+  static {
+    __name(this, "CryptoProvider");
+  }
+  encoder = new TextEncoder();
+}
+export {
+  CryptoProvider
+};
+//# sourceMappingURL=crypto-provider.js.map

package/lib/esm/common/crypto/crypto-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/common/crypto/crypto-provider.ts"],"sourcesContent":["/**\n * Interface encapsulating the various crypto computations used by the library,\n * allowing pluggable underlying crypto implementations.\n */\nexport abstract class CryptoProvider {\n  encoder = new TextEncoder();\n\n  /**\n   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).\n   * The output HMAC should be encoded in hexadecimal.\n   *\n   * Sample values for implementations:\n   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'\n   * - computeHMACSignature('\\ud83d\\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43\n   */\n  abstract computeHMACSignature(payload: string, secret: string): string;\n\n  /**\n   * Asynchronous version of `computeHMACSignature`. Some implementations may\n   * only allow support async signature computation.\n   *\n   * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).\n   * The output HMAC should be encoded in hexadecimal.\n   *\n   * Sample values for implementations:\n   * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'\n   * - computeHMACSignature('\\ud83d\\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43\n   */\n  abstract computeHMACSignatureAsync(\n    payload: string,\n    secret: string,\n  ): Promise<string>;\n\n  /**\n   * Cryptographically determine whether two signatures are equal\n   */\n  abstract secureCompare(stringA: string, stringB: string): Promise<boolean>;\n\n  /**\n   * Encrypts data using AES-256-GCM algorithm.\n   *\n   * @param plaintext The data to encrypt\n   * @param key The encryption key (should be 32 bytes for AES-256)\n   * @param iv Optional initialization vector (if not provided, a random one will be generated)\n   * @param aad Optional additional authenticated data\n   * @returns Object containing the encrypted ciphertext, the IV used, and the authentication tag\n   */\n  abstract encrypt(\n    plaintext: Uint8Array,\n    key: Uint8Array,\n    iv?: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<{\n    ciphertext: Uint8Array;\n    iv: Uint8Array;\n    tag: Uint8Array;\n  }>;\n\n  /**\n   * Decrypts data that was encrypted using AES-256-GCM algorithm.\n   *\n   * @param ciphertext The encrypted data\n   * @param key The decryption key (must be the same key used for encryption)\n   * @param iv The initialization vector used during encryption\n   * @param tag The authentication tag produced during encryption\n   * @param aad Optional additional authenticated data (must match what was used during encryption)\n   * @returns The decrypted data\n   * @throws Will throw an error if authentication fails or the data has been tampered with\n   */\n  abstract decrypt(\n    ciphertext: Uint8Array,\n    key: Uint8Array,\n    iv: Uint8Array,\n    tag: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<Uint8Array>;\n\n  /**\n   * Generates cryptographically secure random bytes.\n   *\n   * @param length The number of random bytes to generate\n   * @returns A Uint8Array containing the random bytes\n   */\n  abstract randomBytes(length: number): Uint8Array;\n}\n"],"mappings":";;AAIO,MAAe,eAAe;AAAA,EAJrC,OAIqC;AAAA;AAAA;AAAA,EACnC,UAAU,IAAI,YAAY;AA+E5B;","names":[]}

package/lib/esm/common/crypto/signature-provider.d.ts

@@ -0,0 +1,16 @@
+import { CryptoProvider } from './crypto-provider.js';
+
+declare class SignatureProvider {
+    private cryptoProvider;
+    constructor(cryptoProvider: CryptoProvider);
+    verifyHeader({ payload, sigHeader, secret, tolerance, }: {
+        payload: any;
+        sigHeader: string;
+        secret: string;
+        tolerance?: number;
+    }): Promise<boolean>;
+    getTimestampAndSignatureHash(sigHeader: string): [string, string];
+    computeSignature(timestamp: any, payload: any, secret: string): Promise<string>;
+}
+
+export { SignatureProvider };

package/lib/esm/common/crypto/signature-provider.js

@@ -0,0 +1,61 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+import { SignatureVerificationException } from "../exceptions/index.js";
+class SignatureProvider {
+  static {
+    __name(this, "SignatureProvider");
+  }
+  cryptoProvider;
+  constructor(cryptoProvider) {
+    this.cryptoProvider = cryptoProvider;
+  }
+  async verifyHeader({
+    payload,
+    sigHeader,
+    secret,
+    tolerance = 18e4
+  }) {
+    const [timestamp, signatureHash] = this.getTimestampAndSignatureHash(sigHeader);
+    if (!signatureHash || Object.keys(signatureHash).length === 0) {
+      throw new SignatureVerificationException(
+        "No signature hash found with expected scheme v1"
+      );
+    }
+    if (parseInt(timestamp, 10) < Date.now() - tolerance) {
+      throw new SignatureVerificationException(
+        "Timestamp outside the tolerance zone"
+      );
+    }
+    const expectedSig = await this.computeSignature(timestamp, payload, secret);
+    if (await this.cryptoProvider.secureCompare(expectedSig, signatureHash) === false) {
+      throw new SignatureVerificationException(
+        "Signature hash does not match the expected signature hash for payload"
+      );
+    }
+    return true;
+  }
+  getTimestampAndSignatureHash(sigHeader) {
+    const signature = sigHeader;
+    const [t, v1] = signature.split(",");
+    if (typeof t === "undefined" || typeof v1 === "undefined") {
+      throw new SignatureVerificationException(
+        "Signature or timestamp missing"
+      );
+    }
+    const { 1: timestamp } = t.split("=");
+    const { 1: signatureHash } = v1.split("=");
+    return [timestamp, signatureHash];
+  }
+  async computeSignature(timestamp, payload, secret) {
+    payload = JSON.stringify(payload);
+    const signedPayload = `${timestamp}.${payload}`;
+    return await this.cryptoProvider.computeHMACSignatureAsync(
+      signedPayload,
+      secret
+    );
+  }
+}
+export {
+  SignatureProvider
+};
+//# sourceMappingURL=signature-provider.js.map

package/lib/esm/common/crypto/signature-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/common/crypto/signature-provider.ts"],"sourcesContent":["import { SignatureVerificationException } from '../exceptions';\nimport { CryptoProvider } from './crypto-provider';\n\nexport class SignatureProvider {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.cryptoProvider = cryptoProvider;\n  }\n\n  async verifyHeader({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 180000,\n  }: {\n    payload: any;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<boolean> {\n    const [timestamp, signatureHash] =\n      this.getTimestampAndSignatureHash(sigHeader);\n\n    if (!signatureHash || Object.keys(signatureHash).length === 0) {\n      throw new SignatureVerificationException(\n        'No signature hash found with expected scheme v1',\n      );\n    }\n\n    if (parseInt(timestamp, 10) < Date.now() - tolerance) {\n      throw new SignatureVerificationException(\n        'Timestamp outside the tolerance zone',\n      );\n    }\n\n    const expectedSig = await this.computeSignature(timestamp, payload, secret);\n    if (\n      (await this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===\n      false\n    ) {\n      throw new SignatureVerificationException(\n        'Signature hash does not match the expected signature hash for payload',\n      );\n    }\n    return true;\n  }\n\n  getTimestampAndSignatureHash(sigHeader: string): [string, string] {\n    const signature = sigHeader;\n    const [t, v1] = signature.split(',');\n    if (typeof t === 'undefined' || typeof v1 === 'undefined') {\n      throw new SignatureVerificationException(\n        'Signature or timestamp missing',\n      );\n    }\n    const { 1: timestamp } = t.split('=');\n    const { 1: signatureHash } = v1.split('=');\n\n    return [timestamp, signatureHash];\n  }\n\n  async computeSignature(\n    timestamp: any,\n    payload: any,\n    secret: string,\n  ): Promise<string> {\n    payload = JSON.stringify(payload);\n    const signedPayload = `${timestamp}.${payload}`;\n\n    return await this.cryptoProvider.computeHMACSignatureAsync(\n      signedPayload,\n      secret,\n    );\n  }\n}\n"],"mappings":";;AAAA,SAAS,sCAAsC;AAGxC,MAAM,kBAAkB;AAAA,EAH/B,OAG+B;AAAA;AAAA;AAAA,EACrB;AAAA,EAER,YAAY,gBAAgC;AAC1C,SAAK,iBAAiB;AAAA,EACxB;AAAA,EAEA,MAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd,GAKqB;AACnB,UAAM,CAAC,WAAW,aAAa,IAC7B,KAAK,6BAA6B,SAAS;AAE7C,QAAI,CAAC,iBAAiB,OAAO,KAAK,aAAa,EAAE,WAAW,GAAG;AAC7D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,EAAE,IAAI,KAAK,IAAI,IAAI,WAAW;AACpD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,KAAK,iBAAiB,WAAW,SAAS,MAAM;AAC1E,QACG,MAAM,KAAK,eAAe,cAAc,aAAa,aAAa,MACnE,OACA;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,6BAA6B,WAAqC;AAChE,UAAM,YAAY;AAClB,UAAM,CAAC,GAAG,EAAE,IAAI,UAAU,MAAM,GAAG;AACnC,QAAI,OAAO,MAAM,eAAe,OAAO,OAAO,aAAa;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,EAAE,GAAG,UAAU,IAAI,EAAE,MAAM,GAAG;AACpC,UAAM,EAAE,GAAG,cAAc,IAAI,GAAG,MAAM,GAAG;AAEzC,WAAO,CAAC,WAAW,aAAa;AAAA,EAClC;AAAA,EAEA,MAAM,iBACJ,WACA,SACA,QACiB;AACjB,cAAU,KAAK,UAAU,OAAO;AAChC,UAAM,gBAAgB,GAAG,SAAS,IAAI,OAAO;AAE7C,WAAO,MAAM,KAAK,eAAe;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/lib/esm/common/crypto/subtle-crypto-provider.d.ts

@@ -0,0 +1,25 @@
+import { CryptoProvider } from './crypto-provider.js';
+
+/**
+ * `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.
+ *
+ * This only supports asynchronous operations.
+ */
+declare class SubtleCryptoProvider extends CryptoProvider {
+    subtleCrypto: SubtleCrypto;
+    constructor(subtleCrypto?: SubtleCrypto);
+    computeHMACSignature(_payload: string, _secret: string): string;
+    /** @override */
+    computeHMACSignatureAsync(payload: string, secret: string): Promise<string>;
+    /** @override */
+    secureCompare(stringA: string, stringB: string): Promise<boolean>;
+    encrypt(plaintext: Uint8Array, key: Uint8Array, iv?: Uint8Array, aad?: Uint8Array): Promise<{
+        ciphertext: Uint8Array;
+        iv: Uint8Array;
+        tag: Uint8Array;
+    }>;
+    decrypt(ciphertext: Uint8Array, key: Uint8Array, iv: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
+    randomBytes(length: number): Uint8Array;
+}
+
+export { SubtleCryptoProvider };

package/lib/esm/common/crypto/subtle-crypto-provider.js

@@ -0,0 +1,129 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+import { CryptoProvider } from "./crypto-provider.js";
+class SubtleCryptoProvider extends CryptoProvider {
+  static {
+    __name(this, "SubtleCryptoProvider");
+  }
+  subtleCrypto;
+  constructor(subtleCrypto) {
+    super();
+    this.subtleCrypto = subtleCrypto || crypto.subtle;
+  }
+  computeHMACSignature(_payload, _secret) {
+    throw new Error(
+      "SubleCryptoProvider cannot be used in a synchronous context."
+    );
+  }
+  /** @override */
+  async computeHMACSignatureAsync(payload, secret) {
+    const encoder = new TextEncoder();
+    const key = await this.subtleCrypto.importKey(
+      "raw",
+      encoder.encode(secret),
+      {
+        name: "HMAC",
+        hash: { name: "SHA-256" }
+      },
+      false,
+      ["sign"]
+    );
+    const signatureBuffer = await this.subtleCrypto.sign(
+      "hmac",
+      key,
+      encoder.encode(payload)
+    );
+    const signatureBytes = new Uint8Array(signatureBuffer);
+    const signatureHexCodes = new Array(signatureBytes.length);
+    for (let i = 0; i < signatureBytes.length; i++) {
+      signatureHexCodes[i] = byteHexMapping[signatureBytes[i]];
+    }
+    return signatureHexCodes.join("");
+  }
+  /** @override */
+  async secureCompare(stringA, stringB) {
+    const bufferA = this.encoder.encode(stringA);
+    const bufferB = this.encoder.encode(stringB);
+    if (bufferA.length !== bufferB.length) {
+      return false;
+    }
+    const algorithm = { name: "HMAC", hash: "SHA-256" };
+    const key = await crypto.subtle.generateKey(algorithm, false, [
+      "sign",
+      "verify"
+    ]);
+    const hmac = await crypto.subtle.sign(algorithm, key, bufferA);
+    const equal = await crypto.subtle.verify(algorithm, key, hmac, bufferB);
+    return equal;
+  }
+  async encrypt(plaintext, key, iv, aad) {
+    const actualIv = iv || crypto.getRandomValues(new Uint8Array(32));
+    const cryptoKey = await this.subtleCrypto.importKey(
+      "raw",
+      key,
+      { name: "AES-GCM" },
+      false,
+      ["encrypt"]
+    );
+    const encryptParams = {
+      name: "AES-GCM",
+      iv: actualIv
+    };
+    if (aad) {
+      encryptParams.additionalData = aad;
+    }
+    const encryptedData = await this.subtleCrypto.encrypt(
+      encryptParams,
+      cryptoKey,
+      plaintext
+    );
+    const encryptedBytes = new Uint8Array(encryptedData);
+    const tagSize = 16;
+    const tagStart = encryptedBytes.length - tagSize;
+    const tag = encryptedBytes.slice(tagStart);
+    const ciphertext = encryptedBytes.slice(0, tagStart);
+    return {
+      ciphertext,
+      iv: actualIv,
+      tag
+    };
+  }
+  async decrypt(ciphertext, key, iv, tag, aad) {
+    const combinedData = new Uint8Array(ciphertext.length + tag.length);
+    combinedData.set(ciphertext, 0);
+    combinedData.set(tag, ciphertext.length);
+    const cryptoKey = await this.subtleCrypto.importKey(
+      "raw",
+      key,
+      { name: "AES-GCM" },
+      false,
+      ["decrypt"]
+    );
+    const decryptParams = {
+      name: "AES-GCM",
+      iv
+    };
+    if (aad) {
+      decryptParams.additionalData = aad;
+    }
+    const decryptedData = await this.subtleCrypto.decrypt(
+      decryptParams,
+      cryptoKey,
+      combinedData
+    );
+    return new Uint8Array(decryptedData);
+  }
+  randomBytes(length) {
+    const bytes = new Uint8Array(length);
+    crypto.getRandomValues(bytes);
+    return bytes;
+  }
+}
+const byteHexMapping = new Array(256);
+for (let i = 0; i < byteHexMapping.length; i++) {
+  byteHexMapping[i] = i.toString(16).padStart(2, "0");
+}
+export {
+  SubtleCryptoProvider
+};
+//# sourceMappingURL=subtle-crypto-provider.js.map

package/lib/esm/common/crypto/subtle-crypto-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/common/crypto/subtle-crypto-provider.ts"],"sourcesContent":["import { CryptoProvider } from './crypto-provider';\n\n/**\n * `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.\n *\n * This only supports asynchronous operations.\n */\nexport class SubtleCryptoProvider extends CryptoProvider {\n  subtleCrypto: SubtleCrypto;\n\n  constructor(subtleCrypto?: SubtleCrypto) {\n    super();\n\n    // If no subtle crypto is interface, default to the global namespace. This\n    // is to allow custom interfaces (eg. using the Node webcrypto interface in\n    // tests).\n    this.subtleCrypto = subtleCrypto || crypto.subtle;\n  }\n\n  computeHMACSignature(_payload: string, _secret: string): string {\n    throw new Error(\n      'SubleCryptoProvider cannot be used in a synchronous context.',\n    );\n  }\n\n  /** @override */\n  async computeHMACSignatureAsync(\n    payload: string,\n    secret: string,\n  ): Promise<string> {\n    const encoder = new TextEncoder();\n\n    const key = await this.subtleCrypto.importKey(\n      'raw',\n      encoder.encode(secret),\n      {\n        name: 'HMAC',\n        hash: { name: 'SHA-256' },\n      },\n      false,\n      ['sign'],\n    );\n\n    const signatureBuffer = await this.subtleCrypto.sign(\n      'hmac',\n      key,\n      encoder.encode(payload),\n    );\n\n    // crypto.subtle returns the signature in base64 format. This must be\n    // encoded in hex to match the CryptoProvider contract. We map each byte in\n    // the buffer to its corresponding hex octet and then combine into a string.\n    const signatureBytes = new Uint8Array(signatureBuffer);\n    const signatureHexCodes = new Array(signatureBytes.length);\n\n    for (let i = 0; i < signatureBytes.length; i++) {\n      signatureHexCodes[i] = byteHexMapping[signatureBytes[i]];\n    }\n\n    return signatureHexCodes.join('');\n  }\n\n  /** @override */\n  async secureCompare(stringA: string, stringB: string): Promise<boolean> {\n    const bufferA = this.encoder.encode(stringA);\n    const bufferB = this.encoder.encode(stringB);\n\n    if (bufferA.length !== bufferB.length) {\n      return false;\n    }\n\n    const algorithm = { name: 'HMAC', hash: 'SHA-256' };\n    const key = (await crypto.subtle.generateKey(algorithm, false, [\n      'sign',\n      'verify',\n    ])) as CryptoKey;\n    const hmac = await crypto.subtle.sign(algorithm, key, bufferA);\n    const equal = await crypto.subtle.verify(algorithm, key, hmac, bufferB);\n\n    return equal;\n  }\n\n  async encrypt(\n    plaintext: Uint8Array,\n    key: Uint8Array,\n    iv?: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<{\n    ciphertext: Uint8Array;\n    iv: Uint8Array;\n    tag: Uint8Array;\n  }> {\n    const actualIv = iv || crypto.getRandomValues(new Uint8Array(32));\n\n    const cryptoKey = await this.subtleCrypto.importKey(\n      'raw',\n      key as BufferSource,\n      { name: 'AES-GCM' },\n      false,\n      ['encrypt'],\n    );\n\n    const encryptParams: AesGcmParams = {\n      name: 'AES-GCM',\n      iv: actualIv as BufferSource,\n    };\n\n    if (aad) {\n      encryptParams.additionalData = aad as BufferSource;\n    }\n\n    const encryptedData = await this.subtleCrypto.encrypt(\n      encryptParams,\n      cryptoKey,\n      plaintext as BufferSource,\n    );\n\n    const encryptedBytes = new Uint8Array(encryptedData);\n\n    // Extract tag (last 16 bytes)\n    const tagSize = 16;\n    const tagStart = encryptedBytes.length - tagSize;\n    const tag = encryptedBytes.slice(tagStart);\n    const ciphertext = encryptedBytes.slice(0, tagStart);\n\n    return {\n      ciphertext,\n      iv: actualIv,\n      tag,\n    };\n  }\n\n  async decrypt(\n    ciphertext: Uint8Array,\n    key: Uint8Array,\n    iv: Uint8Array,\n    tag: Uint8Array,\n    aad?: Uint8Array,\n  ): Promise<Uint8Array> {\n    // SubtleCrypto expects tag to be appended to ciphertext for AES-GCM\n    const combinedData = new Uint8Array(ciphertext.length + tag.length);\n    combinedData.set(ciphertext, 0);\n    combinedData.set(tag, ciphertext.length);\n\n    const cryptoKey = await this.subtleCrypto.importKey(\n      'raw',\n      key as BufferSource,\n      { name: 'AES-GCM' },\n      false,\n      ['decrypt'],\n    );\n\n    const decryptParams: AesGcmParams = {\n      name: 'AES-GCM',\n      iv: iv as BufferSource,\n    };\n\n    if (aad) {\n      decryptParams.additionalData = aad as BufferSource;\n    }\n\n    const decryptedData = await this.subtleCrypto.decrypt(\n      decryptParams,\n      cryptoKey,\n      combinedData,\n    );\n\n    return new Uint8Array(decryptedData);\n  }\n\n  randomBytes(length: number): Uint8Array {\n    const bytes = new Uint8Array(length);\n    crypto.getRandomValues(bytes);\n    return bytes;\n  }\n}\n\n// Cached mapping of byte to hex representation. We do this once to avoid re-\n// computing every time we need to convert the result of a signature to hex.\nconst byteHexMapping = new Array(256);\nfor (let i = 0; i < byteHexMapping.length; i++) {\n  byteHexMapping[i] = i.toString(16).padStart(2, '0');\n}\n"],"mappings":";;AAAA,SAAS,sBAAsB;AAOxB,MAAM,6BAA6B,eAAe;AAAA,EAPzD,OAOyD;AAAA;AAAA;AAAA,EACvD;AAAA,EAEA,YAAY,cAA6B;AACvC,UAAM;AAKN,SAAK,eAAe,gBAAgB,OAAO;AAAA,EAC7C;AAAA,EAEA,qBAAqB,UAAkB,SAAyB;AAC9D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,0BACJ,SACA,QACiB;AACjB,UAAM,UAAU,IAAI,YAAY;AAEhC,UAAM,MAAM,MAAM,KAAK,aAAa;AAAA,MAClC;AAAA,MACA,QAAQ,OAAO,MAAM;AAAA,MACrB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,EAAE,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAEA,UAAM,kBAAkB,MAAM,KAAK,aAAa;AAAA,MAC9C;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,OAAO;AAAA,IACxB;AAKA,UAAM,iBAAiB,IAAI,WAAW,eAAe;AACrD,UAAM,oBAAoB,IAAI,MAAM,eAAe,MAAM;AAEzD,aAAS,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;AAC9C,wBAAkB,CAAC,IAAI,eAAe,eAAe,CAAC,CAAC;AAAA,IACzD;AAEA,WAAO,kBAAkB,KAAK,EAAE;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,cAAc,SAAiB,SAAmC;AACtE,UAAM,UAAU,KAAK,QAAQ,OAAO,OAAO;AAC3C,UAAM,UAAU,KAAK,QAAQ,OAAO,OAAO;AAE3C,QAAI,QAAQ,WAAW,QAAQ,QAAQ;AACrC,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,EAAE,MAAM,QAAQ,MAAM,UAAU;AAClD,UAAM,MAAO,MAAM,OAAO,OAAO,YAAY,WAAW,OAAO;AAAA,MAC7D;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,MAAM,OAAO,OAAO,KAAK,WAAW,KAAK,OAAO;AAC7D,UAAM,QAAQ,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,MAAM,OAAO;AAEtE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QACJ,WACA,KACA,IACA,KAKC;AACD,UAAM,WAAW,MAAM,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAEhE,UAAM,YAAY,MAAM,KAAK,aAAa;AAAA,MACxC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,gBAA8B;AAAA,MAClC,MAAM;AAAA,MACN,IAAI;AAAA,IACN;AAEA,QAAI,KAAK;AACP,oBAAc,iBAAiB;AAAA,IACjC;AAEA,UAAM,gBAAgB,MAAM,KAAK,aAAa;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,iBAAiB,IAAI,WAAW,aAAa;AAGnD,UAAM,UAAU;AAChB,UAAM,WAAW,eAAe,SAAS;AACzC,UAAM,MAAM,eAAe,MAAM,QAAQ;AACzC,UAAM,aAAa,eAAe,MAAM,GAAG,QAAQ;AAEnD,WAAO;AAAA,MACL;AAAA,MACA,IAAI;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,YACA,KACA,IACA,KACA,KACqB;AAErB,UAAM,eAAe,IAAI,WAAW,WAAW,SAAS,IAAI,MAAM;AAClE,iBAAa,IAAI,YAAY,CAAC;AAC9B,iBAAa,IAAI,KAAK,WAAW,MAAM;AAEvC,UAAM,YAAY,MAAM,KAAK,aAAa;AAAA,MACxC;AAAA,MACA;AAAA,MACA,EAAE,MAAM,UAAU;AAAA,MAClB;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,gBAA8B;AAAA,MAClC,MAAM;AAAA,MACN;AAAA,IACF;AAEA,QAAI,KAAK;AACP,oBAAc,iBAAiB;AAAA,IACjC;AAEA,UAAM,gBAAgB,MAAM,KAAK,aAAa;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO,IAAI,WAAW,aAAa;AAAA,EACrC;AAAA,EAEA,YAAY,QAA4B;AACtC,UAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,WAAO,gBAAgB,KAAK;AAC5B,WAAO;AAAA,EACT;AACF;AAIA,MAAM,iBAAiB,IAAI,MAAM,GAAG;AACpC,SAAS,IAAI,GAAG,IAAI,eAAe,QAAQ,KAAK;AAC9C,iBAAe,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACpD;","names":[]}