cliodot 1.2.3 → 1.2.4

package/dist/OAuthAppClient.js

@@ -1 +1,269 @@
-'use strict';const _0x20773f=_0x2020;(function(_0x42e1a8,_0x7241e0){const _0x5df7dd=_0x2020,_0x3edda7=_0x42e1a8();while(!![]){try{const _0x1e188e=-parseInt(_0x5df7dd(0xe6))/0x1*(parseInt(_0x5df7dd(0x10b))/0x2)+-parseInt(_0x5df7dd(0x12e))/0x3+parseInt(_0x5df7dd(0xec))/0x4*(-parseInt(_0x5df7dd(0xe7))/0x5)+-parseInt(_0x5df7dd(0x130))/0x6+-parseInt(_0x5df7dd(0x129))/0x7+-parseInt(_0x5df7dd(0xf6))/0x8*(-parseInt(_0x5df7dd(0x116))/0x9)+parseInt(_0x5df7dd(0xed))/0xa;if(_0x1e188e===_0x7241e0)break;else _0x3edda7['push'](_0x3edda7['shift']());}catch(_0x4c4a19){_0x3edda7['push'](_0x3edda7['shift']());}}}(_0x3218,0x6aa9f));function _0x3218(){const _0x30ba5e=['C2v0','yxv0Aa','mtaXodmYAwDpALj2','lI90ExbLCY9Vyxv0Ac1HChaUyxbP','zMLSDgvY','DMfSAwrHDgvszxnWB25Zzq','A2v5CW','l3jLDM9Rzq','x19LC01VzhvSzq','C2vHCMnOugfYyw1Z','l3jLzNjLC2G','ywn0B3jFDg9Rzw5FDhLWzq','CMvKAxjLy3rFDxjP','ovjuqMjPBW','y29UBMvJDgLVBL9ZDg9YywDL','zw50CMLLCW','ywn0B3jFDg9Rzw4','l2nVBM5Ly3q','yMfZzvvYBa','t0f1DgHbChbdBgLLBNqGCMvXDwLYzxmGyxbWswq','yNvPBgrtmLnizwfKzxjZ','t0f1DgGGyxbWignYzwrLBNrPywXZihjLCxvPCMvKicHHChbbCgLlzxKGB3iGyxbWu2vJCMv0kq','yxbWqxbPs2v5','yxbWu2vJCMv0','C2nVCgu','l3rVA2vUl2v4y2HHBMDL','zgvMyxvSDa','ue9tva','lI9LCNjVCNm','yxnZAwDU','zxHJAgfUz2u','zxH0zxjUywXFDxnLCL9Pza','ode4nJK5Cgrfyu5l','uMvXDwvZDcbMywLSzwq6ia','t0f1DgHbChbdBgLLBNqGCMvXDwLYzxmGyMfZzvvYBa','yxbWswq','yM9KEq','nZK4nJa2yvHRueLu','Cg9SBcbYzxf1AxjLCYbWB2XSx3n0yxrL','ndeYnZGZohniu053yW','l3rVA2vU','y29UBMvJDcbYzxf1AxjLCYbYzwrPCMvJDf91CMK','yxvKAwvUy2u','C3nVx2jPBMrPBMC','CgfYC2vbCgLfCNjVCK1LC3nHz2u','l29HDxrO','y29Kzq','yxnZzxj0Aw9U','C3vIAMvJDf90B2TLBL90ExbL','l2fWChmV','yxHPB3m','Cg9SBeLUDgvYDMfStxm','qMvHCMvYia','Cg9ZDa','z2v0vg9Rzw4','BgvUz3rO','nfLwAxbmqW','ntu1nxvmrK1Juq','CgfYC2vbCgLfCNjVCKnVzgu','AxnezxzPy2vbDxrOB3jPEMf0Aw9UugvUzgLUz0vYCM9Y','zgvMAw5LuhjVCgvYDhK','rgv2AwnLigf1DgHVCML6yxrPB24GCg9SBcb0Aw1LzcbVDxq','mJm2nezTEKTytW','mJe2mdKXmtbXCMrdtKm','CMvSyxLFC3rHDgu','yxv0Ag9YAxPHDgLVBL91CMW','ChjVDMLKzxi','yxbWBgLJyxrPB24VANnVBG','revmrvrf','DhjPBq','l2nVBM5Ly3rPB25ZlW','C2fTBf9Yzxf1zxn0','mty1ota0ofHRuLfkCq','y3jLyxrL','t0f1DgHbChbdBgLLBNq','CMvXDwvZDgvKx3rVA2vUx3r5Cgu','zgvIDwC','CMvXDwvZDa','y29UBMvJDgLVBKLKigLZihjLCxvPCMvK','l29HDxrOl2fWChmV','AM9PBG','C2nVCgvZ','x19PBxbVCNrezwzHDwX0','C3rHDgu','C3vIAMvJDf90B2TLBG','y29UBMvJDgLVBL9Pza','y29UBMvJDgLVBNm','Cg9SBf9ZDgf0zq','r0vu','CMvZB2X2zufWCeLK','q2XPB2rVDefWAuvYCM9Y'];_0x3218=function(){return _0x30ba5e;};return _0x3218();}var __importDefault=this&&this[_0x20773f(0x100)]||function(_0xd79192){return _0xd79192&&_0xd79192['__esModule']?_0xd79192:{'default':_0xd79192};};Object[_0x20773f(0xea)](exports,_0x20773f(0x111),{'value':!![]}),exports[_0x20773f(0xf8)]=void 0x0;const axios_1=__importDefault(require(_0x20773f(0xe0))),errors_1=require(_0x20773f(0x125)),parse_api_error_1=require('./http/parse-api-error'),oauth_app_api_1=require(_0x20773f(0x10c));function trimBaseUrl(_0x1ed7f0){const _0x326182=_0x20773f;return _0x1ed7f0[_0x326182(0xf3)]()['replace'](/\/+$/,'');}function resolveScope(_0x59d880){const _0x1c00d3=_0x20773f;if(_0x59d880[_0x1c00d3(0x121)]?.[_0x1c00d3(0xf3)]())return _0x59d880[_0x1c00d3(0x121)][_0x1c00d3(0xf3)]();if(_0x59d880['scopes']?.[_0x1c00d3(0xe5)])return _0x59d880[_0x1c00d3(0xff)][_0x1c00d3(0x10d)](Boolean)[_0x1c00d3(0xfe)]('\x20');return undefined;}function buildConnectQuery(_0x2452bb){const _0x439cdd=_0x20773f,_0x213b14={'provider':_0x2452bb['provider']['trim'](),'redirect_uri':_0x2452bb[_0x439cdd(0x115)][_0x439cdd(0xf3)]()},_0x5099f0=resolveScope(_0x2452bb);if(_0x5099f0)_0x213b14['scope']=_0x5099f0;if(_0x2452bb[_0x439cdd(0x101)])_0x213b14[_0x439cdd(0x101)]=_0x2452bb[_0x439cdd(0x101)];if(_0x2452bb[_0x439cdd(0x128)])_0x213b14['external_user_id']=_0x2452bb['external_user_id'];if(_0x2452bb[_0x439cdd(0x117)])_0x213b14[_0x439cdd(0x117)]=_0x2452bb['connection_storage'];return _0x213b14;}function buildConnectBody(_0x35799e){const _0x1b0b91=_0x20773f,_0x50082={'provider':_0x35799e[_0x1b0b91(0xf0)]['trim'](),'redirect_uri':_0x35799e[_0x1b0b91(0x115)]['trim']()},_0x521e28=resolveScope(_0x35799e);if(_0x521e28)_0x50082[_0x1b0b91(0x121)]=_0x521e28;if(_0x35799e[_0x1b0b91(0xff)]?.[_0x1b0b91(0xe5)])_0x50082[_0x1b0b91(0xff)]=_0x35799e[_0x1b0b91(0xff)];if(_0x35799e[_0x1b0b91(0x101)])_0x50082[_0x1b0b91(0x101)]=_0x35799e['state'];if(_0x35799e[_0x1b0b91(0x128)])_0x50082['external_user_id']=_0x35799e[_0x1b0b91(0x128)];if(_0x35799e[_0x1b0b91(0x117)])_0x50082['connection_storage']=_0x35799e[_0x1b0b91(0x117)];if(_0x35799e[_0x1b0b91(0xdd)])_0x50082[_0x1b0b91(0xdd)]=_0x35799e['assertion'];if(_0x35799e[_0x1b0b91(0x102)])_0x50082['subject_token']=_0x35799e[_0x1b0b91(0x102)];if(_0x35799e[_0x1b0b91(0xde)])_0x50082[_0x1b0b91(0xde)]=_0x35799e[_0x1b0b91(0xde)];if(_0x35799e[_0x1b0b91(0xf9)])_0x50082['requested_token_type']=_0x35799e[_0x1b0b91(0xf9)];if(_0x35799e[_0x1b0b91(0x119)])_0x50082['actor_token']=_0x35799e[_0x1b0b91(0x119)];if(_0x35799e[_0x1b0b91(0x114)])_0x50082['actor_token_type']=_0x35799e[_0x1b0b91(0x114)];if(_0x35799e[_0x1b0b91(0x133)])_0x50082[_0x1b0b91(0x133)]=_0x35799e[_0x1b0b91(0x133)];return _0x50082;}function assertConnectInput(_0x483dfc){const _0x4969b6=_0x20773f;if(!_0x483dfc[_0x4969b6(0xf0)]?.['trim']())throw new errors_1[(_0x4969b6(0x108))]('connect\x20requires\x20provider');if(!_0x483dfc[_0x4969b6(0x115)]?.[_0x4969b6(0xf3)]())throw new errors_1[(_0x4969b6(0x108))](_0x4969b6(0x132));}function assertPollInput(_0x5decb7){const _0x56bfba=_0x20773f;if(!_0x5decb7[_0x56bfba(0xf0)]?.[_0x56bfba(0xf3)]())throw new errors_1[(_0x56bfba(0x108))]('poll\x20requires\x20provider');if(!_0x5decb7[_0x56bfba(0x105)]?.[_0x56bfba(0xf3)]())throw new errors_1['CliodotApiError'](_0x56bfba(0x12f));}function _0x2020(_0x592e59,_0x21d2de){_0x592e59=_0x592e59-0xdb;const _0x32184f=_0x3218();let _0x20209a=_0x32184f[_0x592e59];if(_0x2020['SSYcPf']===undefined){var _0x1db1c7=function(_0x3f3ca7){const _0x377fa9='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0xd79192='',_0x1ed7f0='';for(let _0x59d880=0x0,_0x2452bb,_0x213b14,_0x5099f0=0x0;_0x213b14=_0x3f3ca7['charAt'](_0x5099f0++);~_0x213b14&&(_0x2452bb=_0x59d880%0x4?_0x2452bb*0x40+_0x213b14:_0x213b14,_0x59d880++%0x4)?_0xd79192+=String['fromCharCode'](0xff&_0x2452bb>>(-0x2*_0x59d880&0x6)):0x0){_0x213b14=_0x377fa9['indexOf'](_0x213b14);}for(let _0x35799e=0x0,_0x50082=_0xd79192['length'];_0x35799e<_0x50082;_0x35799e++){_0x1ed7f0+='%'+('00'+_0xd79192['charCodeAt'](_0x35799e)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x1ed7f0);};_0x2020['GeaGyV']=_0x1db1c7,_0x2020['bWbhaK']={},_0x2020['SSYcPf']=!![];}const _0x201b40=_0x32184f[0x0],_0x10cf1f=_0x592e59+_0x201b40,_0x19c8d8=_0x2020['bWbhaK'][_0x10cf1f];return!_0x19c8d8?(_0x20209a=_0x2020['GeaGyV'](_0x20209a),_0x2020['bWbhaK'][_0x10cf1f]=_0x20209a):_0x20209a=_0x19c8d8,_0x20209a;}function assertExchangeInput(_0x41afe6){const _0x4a0901=_0x20773f;if(!_0x41afe6[_0x4a0901(0xdc)]?.[_0x4a0901(0xf3)]())throw new errors_1['CliodotApiError']('exchange\x20requires\x20code');if(!_0x41afe6[_0x4a0901(0x103)]?.['trim']())throw new errors_1[(_0x4a0901(0x108))]('exchange\x20requires\x20connection_id');}function assertConnectionId(_0x67b116){const _0x62b4bd=_0x20773f;if(!_0x67b116?.[_0x62b4bd(0xf3)]())throw new errors_1['CliodotApiError'](_0x62b4bd(0xfc));}function sleep(_0x5016f5){return new Promise(_0x537959=>setTimeout(_0x537959,_0x5016f5));}class OAuthAppClient{constructor(_0x532d18){const _0x115d1f=_0x20773f;this['connect']={'start':async _0x2b3f64=>{const _0x2e3874=_0x2020;assertConnectInput(_0x2b3f64);const _0x2c7d13=this[_0x2e3874(0x107)](_0x2b3f64[_0x2e3874(0x12c)]);return this[_0x2e3874(0xfb)](_0x2e3874(0x124),_0x2e3874(0xdf)+encodeURIComponent(_0x2c7d13)+_0x2e3874(0x11a),{'body':buildConnectBody(_0x2b3f64),'auth':![]});},'poll':async _0x68faa6=>{const _0x4c27bd=_0x2020;assertPollInput(_0x68faa6);const _0x5d2722=this[_0x4c27bd(0x107)](_0x68faa6['appId']),_0x5a1dc4=_0x68faa6[_0x4c27bd(0xe1)]??0x1388,_0x3630f8=_0x68faa6['maxAttempts']??0x78;for(let _0x409065=0x0;_0x409065<_0x3630f8;_0x409065+=0x1){try{return await this['request'](_0x4c27bd(0x124),_0x4c27bd(0xdf)+encodeURIComponent(_0x5d2722)+'/connect/poll',{'body':{'provider':_0x68faa6['provider'][_0x4c27bd(0xf3)](),'poll_state':_0x68faa6[_0x4c27bd(0x105)][_0x4c27bd(0xf3)]()},'auth':![]});}catch(_0x292524){if(!(0x0,oauth_app_api_1[_0x4c27bd(0xe9)])(_0x292524)||_0x409065===_0x3630f8-0x1)throw _0x292524;await sleep(_0x5a1dc4);}}throw new errors_1[(_0x4c27bd(0x108))](_0x4c27bd(0xeb));},'buildUrl':_0x29e3c2=>{const _0x1efaf0=_0x2020;assertConnectInput(_0x29e3c2);const _0x6766a0=this['resolveAppId'](_0x29e3c2[_0x1efaf0(0x12c)]),_0x2cf4fa=new URL(this[_0x1efaf0(0x11b)]+_0x1efaf0(0xfd)+encodeURIComponent(_0x6766a0)+_0x1efaf0(0x11a)),_0x2c1c7e=buildConnectQuery(_0x29e3c2);for(const [_0x32f871,value]of Object[_0x1efaf0(0x118)](_0x2c1c7e)){_0x2cf4fa[_0x1efaf0(0x112)][_0x1efaf0(0x109)](_0x32f871,value);}return _0x2cf4fa['toString']();},'isSamlPostBinding':_0x3aa4e7=>{const _0x18e839=_0x2020;return _0x3aa4e7['sso_binding']===_0x18e839(0xe3)&&!!_0x3aa4e7[_0x18e839(0xf5)]&&!!_0x3aa4e7['relay_state'];},'buildSamlPostForm':_0x51f976=>{const _0x58adcb=_0x2020;if(!_0x51f976['saml_request']||!_0x51f976[_0x58adcb(0xee)]||!_0x51f976[_0x58adcb(0xef)])return null;if(_0x51f976[_0x58adcb(0x134)]&&_0x51f976[_0x58adcb(0x134)]!==_0x58adcb(0xe3))return null;return{'action':_0x51f976[_0x58adcb(0xef)],'samlRequest':_0x51f976[_0x58adcb(0xf5)],'relayState':_0x51f976[_0x58adcb(0xee)]};}},this[_0x115d1f(0x104)]={'get':async _0x24f541=>{const _0x16295b=_0x115d1f;return assertConnectionId(_0x24f541),this[_0x16295b(0xfb)]('GET',_0x16295b(0xf4)+encodeURIComponent(_0x24f541[_0x16295b(0xf3)]()));},'getToken':async _0x297fd2=>{const _0x5b6472=_0x115d1f;return assertConnectionId(_0x297fd2),this[_0x5b6472(0xfb)](_0x5b6472(0x106),_0x5b6472(0xf4)+encodeURIComponent(_0x297fd2[_0x5b6472(0xf3)]())+_0x5b6472(0x131));},'sync':async _0x2f7cd9=>{const _0x32b09e=_0x115d1f;return this[_0x32b09e(0x104)][_0x32b09e(0xe4)](_0x2f7cd9);},'refresh':async _0x62859=>{const _0x22cd63=_0x115d1f;return assertConnectionId(_0x62859),this[_0x22cd63(0xfb)](_0x22cd63(0x124),_0x22cd63(0xf4)+encodeURIComponent(_0x62859[_0x22cd63(0xf3)]())+_0x22cd63(0x113));},'revoke':async(_0x4ac101,_0x5f1b18)=>{const _0x1895f0=_0x115d1f;assertConnectionId(_0x4ac101);const _0x2eb8b6={};return _0x5f1b18?.['reason']?.[_0x1895f0(0xf3)]()&&(_0x2eb8b6['reason']=_0x5f1b18['reason']['trim']()),this[_0x1895f0(0xfb)]('POST',_0x1895f0(0xf4)+encodeURIComponent(_0x4ac101[_0x1895f0(0xf3)]())+_0x1895f0(0x110),{'body':Object[_0x1895f0(0x10f)](_0x2eb8b6)[_0x1895f0(0xe5)]?_0x2eb8b6:undefined});},'delete':async _0x415a14=>{const _0x1134c7=_0x115d1f;return assertConnectionId(_0x415a14),this[_0x1134c7(0xfb)](_0x1134c7(0xf2),_0x1134c7(0xf4)+encodeURIComponent(_0x415a14['trim']()));}};if(!_0x532d18[_0x115d1f(0x11b)]?.[_0x115d1f(0xf3)]())throw new errors_1['CliodotApiError'](_0x115d1f(0x12b));if(!_0x532d18[_0x115d1f(0x12c)]?.[_0x115d1f(0xf3)]())throw new errors_1[(_0x115d1f(0x108))](_0x115d1f(0x11c));this['baseUrl']=trimBaseUrl(_0x532d18[_0x115d1f(0x11b)]),this[_0x115d1f(0x12c)]=_0x532d18['appId'][_0x115d1f(0xf3)](),this[_0x115d1f(0x11f)]=_0x532d18[_0x115d1f(0x11f)]?.[_0x115d1f(0xf3)]()||undefined,this[_0x115d1f(0x120)]=_0x532d18[_0x115d1f(0x120)]?.[_0x115d1f(0xf3)]()||undefined,this[_0x115d1f(0xfa)]=_0x532d18[_0x115d1f(0xfa)]??![],this[_0x115d1f(0xe0)]=axios_1[_0x115d1f(0x123)][_0x115d1f(0xf7)]({'baseURL':this['baseUrl']+_0x115d1f(0xdb),'timeout':0x7530,'headers':{'Content-Type':_0x115d1f(0xf1)}});}['resolveAppId'](_0x19224e){const _0x14a756=_0x20773f;return(_0x19224e?.['trim']()||this[_0x14a756(0x12c)])[_0x14a756(0xf3)]();}[_0x20773f(0x11d)](){const _0x368085=_0x20773f;if(this[_0x368085(0x11f)])return{'Authorization':_0x368085(0xe2)+this['appApiKey']};if(this['appSecret'])return{'X-Cliodot-App-Id':this[_0x368085(0x12c)],'X-Cliodot-App-Secret':this['appSecret']};throw new errors_1[(_0x368085(0x108))](_0x368085(0x11e));}async[_0x20773f(0xfb)](_0x3a371d,_0x30b51e,_0x425565){const _0x5de59b=_0x20773f,_0x21d1c2={};_0x425565?.[_0x5de59b(0x10a)]!==![]&&Object[_0x5de59b(0x126)](_0x21d1c2,this[_0x5de59b(0x11d)]());try{const {data:_0x513df9}=await this[_0x5de59b(0xe0)]({'method':_0x3a371d,'url':_0x30b51e,'headers':_0x21d1c2,'data':_0x425565?.[_0x5de59b(0x12d)],'params':_0x425565?.['params'],'validateStatus':_0x425565?.[_0x5de59b(0x10e)]===![]?_0x4bce6f=>_0x4bce6f<0x1f4:undefined});if(_0x513df9?.['ok']===![]){const _0x2a50b5=_0x513df9['statusCode'];throw new errors_1[(_0x5de59b(0x108))]((0x0,parse_api_error_1[_0x5de59b(0x135)])(_0x513df9)||'OAuth\x20request\x20failed',{'data':_0x513df9,'code':(0x0,parse_api_error_1[_0x5de59b(0xe8)])(_0x513df9),'status':_0x2a50b5===0x1ac?0x1ac:undefined});}return _0x513df9;}catch(_0x37859a){if(_0x37859a instanceof errors_1[_0x5de59b(0x108)])throw _0x37859a;const _0x1f3613=(0x0,errors_1['cliodotApiErrorFromAxios'])(_0x37859a,_0x5de59b(0x12a)+_0x3a371d+'\x20'+_0x30b51e);throw _0x1f3613;}}async[_0x20773f(0x127)](_0x1d7b59){const _0x813f0d=_0x20773f;return assertExchangeInput(_0x1d7b59),this[_0x813f0d(0xfb)](_0x813f0d(0x124),_0x813f0d(0x122),{'body':{'code':_0x1d7b59[_0x813f0d(0xdc)]['trim'](),'connection_id':_0x1d7b59[_0x813f0d(0x103)]['trim']()}});}}exports[_0x20773f(0xf8)]=OAuthAppClient;
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthAppClient = void 0;
+const axios_1 = __importDefault(require("axios"));
+const errors_1 = require("./errors");
+const parse_api_error_1 = require("./http/parse-api-error");
+const cliodot_request_1 = require("./http/cliodot-request");
+const oauth_app_api_1 = require("./types/oauth-app.api");
+function trimBaseUrl(url) {
+    return url.trim().replace(/\/+$/, "");
+}
+function resolveScope(input) {
+    if (input.scope?.trim()) {
+        return input.scope.trim();
+    }
+    if (input.scopes?.length) {
+        return input.scopes.filter(Boolean).join(" ");
+    }
+    return undefined;
+}
+function buildConnectQuery(input) {
+    const query = {
+        provider: input.provider.trim(),
+        redirect_uri: input.redirect_uri.trim(),
+    };
+    const scope = resolveScope(input);
+    if (scope)
+        query.scope = scope;
+    if (input.state)
+        query.state = input.state;
+    if (input.external_user_id)
+        query.external_user_id = input.external_user_id;
+    if (input.connection_storage)
+        query.connection_storage = input.connection_storage;
+    return query;
+}
+function buildConnectBody(input) {
+    const body = {
+        provider: input.provider.trim(),
+        redirect_uri: input.redirect_uri.trim(),
+    };
+    const scope = resolveScope(input);
+    if (scope)
+        body.scope = scope;
+    if (input.scopes?.length)
+        body.scopes = input.scopes;
+    if (input.state)
+        body.state = input.state;
+    if (input.external_user_id)
+        body.external_user_id = input.external_user_id;
+    if (input.connection_storage)
+        body.connection_storage = input.connection_storage;
+    if (input.assertion)
+        body.assertion = input.assertion;
+    if (input.subject_token)
+        body.subject_token = input.subject_token;
+    if (input.subject_token_type)
+        body.subject_token_type = input.subject_token_type;
+    if (input.requested_token_type)
+        body.requested_token_type = input.requested_token_type;
+    if (input.actor_token)
+        body.actor_token = input.actor_token;
+    if (input.actor_token_type)
+        body.actor_token_type = input.actor_token_type;
+    if (input.audience)
+        body.audience = input.audience;
+    return body;
+}
+function assertConnectInput(input) {
+    if (!input.provider?.trim()) {
+        throw new errors_1.CliodotApiError("connect requires provider");
+    }
+    if (!input.redirect_uri?.trim()) {
+        throw new errors_1.CliodotApiError("connect requires redirect_uri");
+    }
+}
+function assertPollInput(input) {
+    if (!input.provider?.trim()) {
+        throw new errors_1.CliodotApiError("poll requires provider");
+    }
+    if (!input.poll_state?.trim()) {
+        throw new errors_1.CliodotApiError("poll requires poll_state");
+    }
+}
+function assertExchangeInput(input) {
+    if (!input.code?.trim()) {
+        throw new errors_1.CliodotApiError("exchange requires code");
+    }
+    if (!input.connection_id?.trim()) {
+        throw new errors_1.CliodotApiError("exchange requires connection_id");
+    }
+}
+function assertConnectionId(connectionId) {
+    if (!connectionId?.trim()) {
+        throw new errors_1.CliodotApiError("connectionId is required");
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+class OAuthAppClient {
+    constructor(config) {
+        this.connect = {
+            start: async (input) => {
+                assertConnectInput(input);
+                const appId = this.resolveAppId(input.appId);
+                return this.request("POST", `/apps/${encodeURIComponent(appId)}/connect`, { body: buildConnectBody(input), auth: false });
+            },
+            poll: async (input) => {
+                assertPollInput(input);
+                const appId = this.resolveAppId(input.appId);
+                const intervalMs = input.pollIntervalMs ?? 5000;
+                const maxAttempts = input.maxAttempts ?? 120;
+                for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+                    try {
+                        return await this.request("POST", `/apps/${encodeURIComponent(appId)}/connect/poll`, {
+                            body: {
+                                provider: input.provider.trim(),
+                                poll_state: input.poll_state.trim(),
+                            },
+                            auth: false,
+                        });
+                    }
+                    catch (err) {
+                        if (!(0, oauth_app_api_1.isDeviceAuthorizationPendingError)(err) || attempt === maxAttempts - 1) {
+                            throw err;
+                        }
+                        await sleep(intervalMs);
+                    }
+                }
+                throw new errors_1.CliodotApiError("Device authorization poll timed out");
+            },
+            buildUrl: (input) => {
+                assertConnectInput(input);
+                const appId = this.resolveAppId(input.appId);
+                const url = new URL(`${this.baseUrl}/oauth/apps/${encodeURIComponent(appId)}/connect`);
+                const query = buildConnectQuery(input);
+                for (const [key, value] of Object.entries(query)) {
+                    url.searchParams.set(key, value);
+                }
+                return url.toString();
+            },
+            isSamlPostBinding: (response) => {
+                return response.sso_binding === "post" && !!response.saml_request && !!response.relay_state;
+            },
+            buildSamlPostForm: (response) => {
+                if (!response.saml_request || !response.relay_state || !response.authorization_url) {
+                    return null;
+                }
+                if (response.sso_binding && response.sso_binding !== "post") {
+                    return null;
+                }
+                return {
+                    action: response.authorization_url,
+                    samlRequest: response.saml_request,
+                    relayState: response.relay_state,
+                };
+            },
+        };
+        this.connections = {
+            get: async (connectionId) => {
+                assertConnectionId(connectionId);
+                return this.request("GET", `/connections/${encodeURIComponent(connectionId.trim())}`);
+            },
+            getToken: async (connectionId) => {
+                assertConnectionId(connectionId);
+                return this.request("GET", `/connections/${encodeURIComponent(connectionId.trim())}/token`);
+            },
+            sync: async (connectionId) => {
+                return this.connections.getToken(connectionId);
+            },
+            refresh: async (connectionId) => {
+                assertConnectionId(connectionId);
+                return this.request("POST", `/connections/${encodeURIComponent(connectionId.trim())}/refresh`);
+            },
+            revoke: async (connectionId, input) => {
+                assertConnectionId(connectionId);
+                const body = {};
+                if (input?.reason?.trim()) {
+                    body.reason = input.reason.trim();
+                }
+                return this.request("POST", `/connections/${encodeURIComponent(connectionId.trim())}/revoke`, { body: Object.keys(body).length ? body : undefined });
+            },
+            delete: async (connectionId) => {
+                assertConnectionId(connectionId);
+                return this.request("DELETE", `/connections/${encodeURIComponent(connectionId.trim())}`);
+            },
+        };
+        if (!config.baseUrl?.trim()) {
+            throw new errors_1.CliodotApiError("OAuthAppClient requires baseUrl");
+        }
+        if (!config.appId?.trim()) {
+            throw new errors_1.CliodotApiError("OAuthAppClient requires appId");
+        }
+        this.baseUrl = trimBaseUrl(config.baseUrl);
+        this.appId = config.appId.trim();
+        this.appApiKey = config.appApiKey?.trim() || undefined;
+        this.appSecret = config.appSecret?.trim() || undefined;
+        this.environment = config.environment;
+        this.debug = config.debug ?? false;
+        this.axios = axios_1.default.create({
+            baseURL: `${this.baseUrl}/oauth`,
+            timeout: 30000,
+            headers: { "Content-Type": "application/json" },
+        });
+    }
+    resolveAppId(appId) {
+        return (appId?.trim() || this.appId).trim();
+    }
+    buildS2SHeaders() {
+        if (this.appApiKey) {
+            return (0, cliodot_request_1.applyEnvironmentHeader)({ Authorization: `Bearer ${this.appApiKey}` }, this.environment);
+        }
+        if (this.appSecret) {
+            return (0, cliodot_request_1.applyEnvironmentHeader)({
+                "X-Cliodot-App-Id": this.appId,
+                "X-Cliodot-App-Secret": this.appSecret,
+            }, this.environment);
+        }
+        throw new errors_1.CliodotApiError("OAuth app credentials required (appApiKey or appSecret)");
+    }
+    async request(method, path, options) {
+        const headers = {};
+        if (options?.auth !== false) {
+            Object.assign(headers, this.buildS2SHeaders());
+        }
+        try {
+            const { data } = await this.axios({
+                method,
+                url: path,
+                headers,
+                data: options?.body,
+                params: options?.params,
+                validateStatus: options?.validateResponse === false
+                    ? (status) => status < 500
+                    : undefined,
+            });
+            if (data?.ok === false) {
+                const status = data.statusCode;
+                throw new errors_1.CliodotApiError((0, parse_api_error_1.parseApiErrorMessage)(data) || "OAuth request failed", {
+                    data,
+                    code: (0, parse_api_error_1.parseApiErrorCode)(data),
+                    status: status === 428 ? 428 : undefined,
+                });
+            }
+            return data;
+        }
+        catch (err) {
+            if (err instanceof errors_1.CliodotApiError) {
+                throw err;
+            }
+            const apiErr = (0, errors_1.cliodotApiErrorFromAxios)(err, `Request failed: ${method} ${path}`);
+            throw apiErr;
+        }
+    }
+    async exchange(input) {
+        assertExchangeInput(input);
+        return this.request("POST", "/token/exchange", {
+            body: {
+                code: input.code.trim(),
+                connection_id: input.connection_id.trim(),
+            },
+        });
+    }
+}
+exports.OAuthAppClient = OAuthAppClient;

package/dist/ProviderServicesClient.d.ts

@@ -0,0 +1,24 @@
+import { type CliodotFail, type CliodotMethodResult } from "./http/cliodot-result";
+import type { ProviderCatalogResponse, ProviderExecuteInput, ProviderExecuteResult, ProviderSdkTypesArtifact, ProviderServicesClientConfig } from "./types/provider-services.api";
+export declare class ProviderServicesClient<TCatalog = any> {
+    private readonly baseUrl;
+    private readonly appId;
+    private readonly apiKey?;
+    private readonly appSecret?;
+    private readonly environment?;
+    private readonly axios;
+    private readonly configError;
+    readonly debug: boolean;
+    readonly api: TCatalog;
+    constructor(config: ProviderServicesClientConfig);
+    /**
+     * Execute a catalog operation. Pass `provider` to pin a binding when routing allows it.
+     */
+    execute<TResult = Record<string, unknown>>(input: ProviderExecuteInput): Promise<ProviderExecuteResult<TResult> | CliodotFail>;
+    catalog(): Promise<CliodotMethodResult<ProviderCatalogResponse>>;
+    downloadTypes(): Promise<CliodotMethodResult<ProviderSdkTypesArtifact>>;
+    private asProxy;
+    private buildAuthHeaders;
+    private request;
+}
+//# sourceMappingURL=ProviderServicesClient.d.ts.map

package/dist/ProviderServicesClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProviderServicesClient.d.ts","sourceRoot":"","sources":["../src/ProviderServicesClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAGzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EAEpB,qBAAqB,EACrB,wBAAwB,EAExB,4BAA4B,EAC7B,MAAM,+BAA+B,CAAC;AAsCvC,qBAAa,sBAAsB,CAAC,QAAQ,GAAG,GAAG;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,SAAgB,KAAK,EAAE,OAAO,CAAC;IAC/B,SAAgB,GAAG,EAAE,QAAQ,CAAC;gBAElB,MAAM,EAAE,4BAA4B;IA2BhD;;OAEG;IACH,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC;IAmBxD,OAAO,IAAI,OAAO,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;IAI1D,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;IAW7E,OAAO,CAAC,OAAO;IAoCf,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,OAAO;CAiBhB"}

package/dist/ProviderServicesClient.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderServicesClient = void 0;
+const create_client_1 = require("./http/create-client");
+const cliodot_request_1 = require("./http/cliodot-request");
+const cliodot_result_1 = require("./http/cliodot-result");
+function trimBaseUrl(url) {
+    return url.trim().replace(/\/+$/, "");
+}
+function isExecuteResult(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const obj = value;
+    return (typeof obj.service === "string" &&
+        typeof obj.operation === "string" &&
+        Array.isArray(obj.attempts));
+}
+function normalizeExecuteResult(data, status) {
+    if (!isExecuteResult(data))
+        return null;
+    if (status === 502 || data.ok === false) {
+        const error = data.error;
+        return {
+            ...data,
+            ok: false,
+            error: {
+                code: error?.code || cliodot_result_1.SDK_ERROR.REQUEST_FAILED,
+                message: error?.message || "Provider execute failed",
+            },
+        };
+    }
+    if (data.ok === true) {
+        return data;
+    }
+    return { ...data, ok: true };
+}
+class ProviderServicesClient {
+    constructor(config) {
+        this.configError = (0, cliodot_result_1.resolveConfigError)([
+            {
+                valid: !!config.baseUrl?.trim(),
+                message: "ProviderServicesClient requires baseUrl",
+            },
+            {
+                valid: !!config.appId?.trim(),
+                message: "ProviderServicesClient requires appId",
+            },
+        ]);
+        this.baseUrl = trimBaseUrl(config.baseUrl || "");
+        this.appId = config.appId?.trim() || "";
+        this.apiKey =
+            config.apiKey?.trim() || config.appApiKey?.trim() || undefined;
+        this.appSecret = config.appSecret?.trim() || undefined;
+        this.environment = config.environment;
+        this.debug = config.debug ?? false;
+        this.axios = (0, create_client_1.createCliodotAxios)({
+            baseURL: `${this.baseUrl}/provider`,
+            timeout: config.timeoutMs ?? 60000,
+            headers: { "Content-Type": "application/json" },
+            validateStatus: (status) => status === 200 || status === 502,
+        });
+        this.api = this.asProxy();
+    }
+    /**
+     * Execute a catalog operation. Pass `provider` to pin a binding when routing allows it.
+     */
+    execute(input) {
+        const serviceError = (0, cliodot_result_1.resolveRequiredString)(input?.service, "service");
+        if (serviceError)
+            return Promise.resolve(serviceError);
+        const operationError = (0, cliodot_result_1.resolveRequiredString)(input?.operation, "operation");
+        if (operationError)
+            return Promise.resolve(operationError);
+        const body = {
+            service: input.service.trim(),
+            operation: input.operation.trim(),
+            input: input.input ?? {},
+        };
+        if (input.version?.trim())
+            body.version = input.version.trim();
+        if (input.provider?.trim())
+            body.provider = input.provider.trim();
+        if (input.idempotency_key?.trim()) {
+            body.idempotency_key = input.idempotency_key.trim();
+        }
+        return this.request("POST", "/v1/execute", body);
+    }
+    catalog() {
+        return this.request("GET", "/v1/catalog");
+    }
+    async downloadTypes() {
+        const result = await this.request("GET", "/v1/types");
+        if ((0, cliodot_result_1.isCliodotFail)(result))
+            return result;
+        return {
+            ok: true,
+            typescript: result.typescript,
+            filename: result.filename,
+            export_name: result.export_name,
+        };
+    }
+    asProxy(path = []) {
+        const client = this;
+        const callable = (...args) => {
+            if (path.length !== 2) {
+                return Promise.resolve((0, cliodot_result_1.cliodotValidationFail)("Provider fluent calls are service.operation(input, opts?)"));
+            }
+            const [service, operation] = path;
+            const input = args[0] ?? {};
+            const opts = args[1] || {};
+            return client.execute({
+                service,
+                operation,
+                input,
+                version: opts.version,
+                provider: opts.provider,
+                idempotency_key: opts.idempotency_key,
+            });
+        };
+        return new Proxy(callable, {
+            get(_target, prop) {
+                if (typeof prop === "symbol")
+                    return undefined;
+                if (prop === "then")
+                    return undefined;
+                if (prop === "toString")
+                    return () => "[ProviderServicesClient.api]";
+                return client.asProxy([...path, String(prop)]);
+            },
+            apply(_target, _thisArg, argArray) {
+                return callable(...(argArray || []));
+            },
+        });
+    }
+    buildAuthHeaders() {
+        return (0, cliodot_request_1.resolveBearerAuthHeaders)({
+            appId: this.appId,
+            apiKey: this.apiKey,
+            appSecret: this.appSecret,
+            environment: this.environment,
+            missingMessage: "Provider app credentials required (apiKey/appApiKey or appSecret)",
+        });
+    }
+    request(method, path, body) {
+        return (0, cliodot_request_1.executeCliodotRequest)({
+            configError: this.configError,
+            authHeaders: this.buildAuthHeaders(),
+            axios: this.axios,
+            method,
+            path,
+            body,
+            validateStatus: (status) => status === 200 || status === 502,
+            passThrough: (data, status) => normalizeExecuteResult(data, status),
+            fallbackMessage: `Request failed: ${method} ${path}`,
+        });
+    }
+}
+exports.ProviderServicesClient = ProviderServicesClient;

package/dist/Surface.d.ts

@@ -6,6 +6,8 @@ export interface SurfaceConfig {
     apiKeyHeader?: string;
     fetchSurface?: boolean;
     version?: string;
+    /** Pin project env bag for connector auth templates. Omit to follow the project switch. */
+    environment?: "dev" | "prod" | "development" | "production";
 }
 export interface SurfaceOp {
     id: string;

package/dist/Surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Surface.d.ts","sourceRoot":"","sources":["../src/Surface.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,GAAG,EAAE,SAAS,EAAE,CAAC;CAClB;AAsSD,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,QAAQ,GAAG,GAAG,IAAI,QAAQ,GAAG,cAAc,CAAC;AAEtE,KAAK,kBAAkB,GAAG;IACxB,KAAK,QAAQ,GAAG,GAAG,EAAE,MAAM,EAAE,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;CACtE,CAAC;AAEF,eAAO,MAAM,OAAO,EAMJ,kBAAkB,CAAC"}
+{"version":3,"file":"Surface.d.ts","sourceRoot":"","sources":["../src/Surface.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;CAC7D;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,GAAG,EAAE,SAAS,EAAE,CAAC;CAClB;AAwSD,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,QAAQ,GAAG,GAAG,IAAI,QAAQ,GAAG,cAAc,CAAC;AAEtE,KAAK,kBAAkB,GAAG;IACxB,KAAK,QAAQ,GAAG,GAAG,EAAE,MAAM,EAAE,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;CACtE,CAAC;AAEF,eAAO,MAAM,OAAO,EAMJ,kBAAkB,CAAC"}