vpndetection 5.1.0 → 5.2.1

package/README.md

@@ -62,7 +62,7 @@ Usage counts against the anniversary of your subscription, not the calendar mont
 
 ### Batch lookup
 
-Look up many addresses at once. Bogons and cached answers are handled locally, and everything else goes to the batch endpoint in chunks of up to 1000 addresses, in parallel:
+Look up as many addresses as you like in one call. Bogons and cached answers are handled locally, and the rest go to the batch endpoint in chunks of up to 1000, in parallel:
 
 ```js
 const results = await client.lookupBatch(['45.83.91.1', '8.8.8.8', '1.1.1.1']);
@@ -78,10 +78,10 @@ for (const [ip, result] of results) {
 
 Results are keyed by address, in the order you first listed each one, so duplicates in your list collapse into a single entry and one address failing never loses the rest: it carries its error as its value, with the status the API would have given that address on its own.
 
-How many chunks are in flight at once, and how many times a failed chunk is retried, are configurable per call:
+How many chunks are in flight at once, how many times a failed chunk is retried, and how long each request may take are configurable per call:
 
 ```js
-const results = await client.lookupBatch(manyIps, { concurrency: 4, retries: 4 });
+const results = await client.lookupBatch(manyIps, { concurrency: 4, retries: 4, timeoutMs: 10_000 });
 ```
 
 ### Caching
@@ -150,6 +150,18 @@ try {
 
 Note that `rate_limited` and `quota_exceeded` both arrive as HTTP 429 and are not the same thing. A rate limit is when the API faces extreme traffic bursts and so retrying later works; but a spent quota needs your allowance raised or the window to roll over. The library retries rate limits for you, but not if your quota is exceeded.
 
+### Timeouts
+
+A request that hasn't finished after 30 seconds is abandoned and surfaces as a retryable `network` error. The limit applies to each attempt, so a call that gets retried can take longer in total. Set it for the client, or for a single lookup:
+
+```js
+const client = new VPNDetection({ timeoutMs: 10_000 });
+
+const result = await client.lookup('45.83.91.1', { timeoutMs: 2000 });
+```
+
+A database transfer is exempt, because a large one takes minutes.
+
 ### Database downloads
 
 If your key carries the `db.download` scope, the licensed databases are available through `client.database`. `download` fetches one to a path, streaming it straight to disk so that nothing bigger than a chunk is ever held in memory:
@@ -178,6 +190,27 @@ import { DATABASE_FORMATS } from 'vpndetection';
 DATABASE_FORMATS.includes(fromTheCommandLine);  // ['csvgz', 'mmdb']
 ```
 
+### Sign in with OAuth (device flow)
+
+A program running on the person's own machine can let them sign in with a browser and pick one of their API keys, instead of asking them to paste it:
+
+```js
+const client = new VPNDetection();
+
+const device = await client.oauth.deviceAuthorization('your-client-id', {
+    scope: 'account.read apikeys.read apikeys.reveal',
+});
+console.log(`Open ${device.verification_uri} and enter ${device.user_code}`);
+
+const token = await client.oauth.pollDeviceToken('your-client-id', device);
+if (token.apikey === undefined) {
+    throw new Error("no API key came back: none was picked, or it can't be shown again");
+}
+const keyed = new VPNDetection({ apiKey: token.apikey });
+```
+
+A denied sign-in rejects with `OauthAccessDeniedError` and a code that ran out with `OauthExpiredTokenError`. Client IDs are issued on request from support@vpndetection.io, and `client.oauth.revoke('your-client-id', token.refresh_token)` signs the machine out again.
+
 ### Absent is not false
 
 Only `ip` and `isVpn` come back on every plan. A field your plan does not include is `undefined`, which means "not in your plan" rather than "checked, and no".

package/dist/client.d.ts

@@ -2,6 +2,7 @@ import type { Writable } from 'node:stream';
 import type { Client } from './generated/client/index.js';
 import type { Entitlement, Database, DatabaseFormat, DatabaseMetadata, DbChecksums, Download } from './generated/types.gen.js';
 import { VPNDetectionError } from './errors.js';
+import { OauthApi } from './oauth.js';
 import { type Result } from './types.js';
 /**
  * Where `download` puts the bytes: a path to write, or a stream you opened
@@ -18,6 +19,11 @@ export interface CacheOptions {
 export interface DownloadsOptions {
     /** How many attempts to return, newest first. The API clamps this to 200. */
     limit?: number;
+    /**
+     * How long one attempt may take before it is abandoned, in milliseconds, for
+     * THIS call only. Defaults to the client's `timeoutMs`.
+     */
+    timeoutMs?: number;
 }
 export interface Options {
     /**
@@ -68,6 +74,11 @@ export declare class VPNDetection {
     private readonly timeoutMs;
     /** The licensed dataset downloads, for keys that carry the `db.download` scope. */
     readonly database: DatabaseApi;
+    /**
+     * Sign a person in with the OAuth device flow, so a program on their own
+     * machine can be handed one of their API keys. Needs no API key.
+     */
+    readonly oauth: OauthApi;
     constructor(options?: Options);
     /**
      * Whether an address is private, loopback, link-local, documentation,
@@ -129,7 +140,8 @@ export declare class VPNDetection {
      * error as its value, so one bad entry cannot lose the rest of the answers:
      * the API reports a per-entry failure with the status the single lookup
      * would have answered, and a chunk that fails as a whole marks every
-     * address in it.
+     * address in it. A per-call `concurrency` below 1 is refused as
+     * `bad_request` before anything is sent.
      */
     lookupBatch(ips: Iterable<string>, options?: BatchOptions): Promise<Map<string, Result | VPNDetectionError>>;
     private lookupChunk;

package/dist/client.js

@@ -1,10 +1,11 @@
 import { LRUCache } from 'lru-cache';
 import pLimit from 'p-limit';
-import pRetry from 'p-retry';
 import { createClient, createConfig } from './generated/client/index.js';
 import { myEntitlement, databaseChecksum, databaseMetadata, downloadDatabase as downloadRedirect, listDatabases, listDownloads, lookupBatch, lookupIp, lookupMyIp, } from './generated/sdk.gen.js';
 import { bogonResult, isBogon } from './bogon.js';
 import { errorFromEntry, errorFromResponse, VPNDetectionError } from './errors.js';
+import { OauthApi } from './oauth.js';
+import { asError, deadline, unwrap, withRetry } from './transport.js';
 import { DATABASE_FORMATS, toResult } from './types.js';
 export const DEFAULT_BASE_URL = 'https://api.vpndetection.io';
 // Matches the other SDKs, whose HTTP clients default to 30s. Node's global
@@ -28,6 +29,11 @@ export class VPNDetection {
     timeoutMs;
     /** The licensed dataset downloads, for keys that carry the `db.download` scope. */
     database;
+    /**
+     * Sign a person in with the OAuth device flow, so a program on their own
+     * machine can be handed one of their API keys. Needs no API key.
+     */
+    oauth;
     constructor(options = {}) {
         // Resolved once, because the download path calls object storage
         // directly rather than through the generated client and has to reach
@@ -46,6 +52,7 @@ export class VPNDetection {
         this.retries = options.retries ?? 2;
         this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
         this.database = new DatabaseApi(this.client, this.retries, this.timeoutMs, fetchImpl);
+        this.oauth = new OauthApi(this.client, this.retries, this.timeoutMs);
     }
     /**
      * Whether an address is private, loopback, link-local, documentation,
@@ -143,9 +150,15 @@ export class VPNDetection {
      * error as its value, so one bad entry cannot lose the rest of the answers:
      * the API reports a per-entry failure with the status the single lookup
      * would have answered, and a chunk that fails as a whole marks every
-     * address in it.
+     * address in it. A per-call `concurrency` below 1 is refused as
+     * `bad_request` before anything is sent.
      */
     async lookupBatch(ips, options = {}) {
+        const concurrency = options.concurrency;
+        if (concurrency !== undefined && !(concurrency >= 1 && (Number.isInteger(concurrency)
+            || concurrency === Infinity))) {
+            throw new VPNDetectionError('bad_request', `concurrency must be a whole number of at least 1, got ${concurrency}`);
+        }
         const unique = [...new Set(ips)];
         const out = new Map();
         const pending = [];
@@ -163,9 +176,7 @@ export class VPNDetection {
         }
         // A per-call concurrency gets its own limiter; without one the call
         // would share the instance's budget and silently ignore the override.
-        const limit = options.concurrency === undefined
-            ? this.limit
-            : pLimit(options.concurrency);
+        const limit = concurrency === undefined ? this.limit : pLimit(concurrency);
         const chunks = [];
         for (let i = 0; i < pending.length; i += BATCH_MAX) {
             chunks.push(pending.slice(i, i + BATCH_MAX));
@@ -271,8 +282,9 @@ export class DatabaseApi {
      * and its absence answers nothing.
      */
     async downloads(options = {}) {
+        const timeoutMs = options.timeoutMs ?? this.timeoutMs;
         return withRetry(this.retries, async () => {
-            const res = await deadline(this.timeoutMs, (signal) => listDownloads({
+            const res = await deadline(timeoutMs, (signal) => listDownloads({
                 client: this.client,
                 ...(options.limit === undefined ? {} : { query: { limit: options.limit } }),
                 signal: signal,
@@ -423,70 +435,4 @@ function assertFormat(format) {
     }
     throw new VPNDetectionError('bad_request', `invalid format ${JSON.stringify(format)}; must be one of ${DATABASE_FORMATS.join(', ')}`);
 }
-function unwrap(res) {
-    if (res.response === undefined) {
-        throw new VPNDetectionError('network', 'no response from the API');
-    }
-    if (!res.response.ok) {
-        throw errorFromResponse(res.response.status, res.response.headers, res.error ?? res.data);
-    }
-    return res.data;
-}
-// p-retry owns the backoff schedule; the extra sleep here is what honors a
-// server-supplied Retry-After, which p-retry has no way to know about. A 429
-// carrying that header is the only 429 worth retrying, which is why the wait
-// and the retry decision both key off the same field.
-/**
- * Bound one attempt, and report an expiry as our own error rather than the
- * runtime's `TimeoutError`, whose message says nothing about which call gave up.
- *
- * The signal is built per call, so a retried request gets a fresh budget - the
- * same per-attempt semantics the Go and Python clients have.
- */
-async function deadline(timeoutMs, fn) {
-    const controller = new AbortController();
-    let timer;
-    // Raced, not left to the signal alone: aborting releases the socket, but only
-    // a transport that HONORS the signal then settles, and a substituted `fetch`
-    // need not. Clearing the timer stops the losing side rejecting into nothing.
-    const expiry = new Promise((_, reject) => {
-        timer = setTimeout(() => {
-            controller.abort();
-            reject(new VPNDetectionError('network', `request timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
-    });
-    try {
-        return await Promise.race([fn(controller.signal), expiry]);
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-async function withRetry(retries, fn) {
-    try {
-        return await pRetry(fn, {
-            retries: retries,
-            shouldRetry: ({ error }) => !(error instanceof VPNDetectionError) || error.retryable,
-            onFailedAttempt: async ({ error }) => {
-                const seconds = error instanceof VPNDetectionError ? error.retryAfterSeconds : undefined;
-                if (seconds !== undefined && seconds > 0) {
-                    await new Promise((r) => setTimeout(r, seconds * 1000));
-                }
-            },
-        });
-    }
-    catch (err) {
-        throw asError(err);
-    }
-}
-function asError(err) {
-    if (err instanceof VPNDetectionError) {
-        return err;
-    }
-    const cause = err?.cause;
-    if (cause instanceof VPNDetectionError) {
-        return cause;
-    }
-    return new VPNDetectionError('network', err instanceof Error ? err.message : String(err));
-}
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,MAAM,MAAM,SAAS,CAAC;AAK7B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EACH,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,IAAI,gBAAgB,EACvF,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,GAClE,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAe,MAAM,YAAY,CAAC;AAQrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAE9D,2EAA2E;AAC3E,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,8EAA8E;AAC9E,uBAAuB;AACvB,MAAM,SAAS,GAAG,IAAI,CAAC;AAoDvB;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACJ,MAAM,CAAS;IACf,KAAK,CAAkC;IACvC,KAAK,CAA4B;IACjC,OAAO,CAAS;IAChB,SAAS,CAAS;IAEnC,mFAAmF;IAC1E,QAAQ,CAAc;IAE/B,YAAY,UAAmB,EAAE;QAC7B,gEAAgE;QAChE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;YAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7E,KAAK,EAAE,SAAS;SACnB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAiB;YACvE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,MAAM;YACjC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,QAAQ,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAU;QACd,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,UAAyB,EAAE;QAChD,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACd,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC;gBACvD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM;aACxD,CAAC,CAAC,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,CAAiB,GAAG,CAAC,CAAC;YACzC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,CAAC,UAAyB,EAAE;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC;gBACzD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;aACtC,CAAC,CAAC,CAAC;YACJ,OAAO,QAAQ,CAAC,MAAM,CAAiB,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,aAAa,CAAC,UAAyB,EAAE;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC;gBAC5D,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;aACtC,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAAc,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,WAAW,CACb,GAAqB,EAAE,UAAwB,EAAE;QAEjD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;QAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBACd,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7B,SAAS;YACb,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjB,SAAS;YACb,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,KAAK,SAAS;YAC3C,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YACrD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACxB,CAAC;QACL,CAAC,CAAC,CAAC,CAAC,CAAC;QACL,sEAAsE;QACtE,2DAA2D;QAC3D,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,2CAA2C;IACnC,KAAK,CAAC,WAAW,CACrB,KAAe,EAAE,OAAsB;QAEvC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;QAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,IAAI,IAAyB,CAAC;QAC9B,IAAI,CAAC;YACD,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC/D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC;oBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM;iBAC5D,CAAC,CAAC,CAAC;gBACJ,OAAO,MAAM,CAAsB,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACpB,SAAS;YACb,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpC,SAAS;YACb,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,iBAAiB,CAC7B,cAAc,EAAE,oCAAoC,EAAE,EAAE,EAAE,GAAG,CAChE,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;CACJ;AAED,qFAAqF;AACrF,MAAM,OAAO,WAAW;IAEC;IACA;IACA;IACA;IAJrB,YACqB,MAAc,EACd,OAAe,EACf,SAAiB,EACjB,SAAkC;QAHlC,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAyB;IACpD,CAAC;IAEJ,KAAK,CAAC,IAAI;QACN,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC;gBACjE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;aACtC,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAA8B,GAAG,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACrB,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC;gBACpE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM;aACzD,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAAmB,GAAG,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAsB;QAC9C,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC;gBACpE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM;aACzE,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAA6B,GAAG,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,UAA4B,EAAE;QAC1C,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC;gBACjE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC3E,MAAM,EAAE,MAAM;aACjB,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAA8B,GAAG,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,MAAsB;QAChD,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC;gBACpE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBACjC,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;aACR,CAAC,CAAC,CAAC;YACb,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACnD,OAAO,QAAQ,CAAC;YACpB,CAAC;YACD,MAAM,CAAU,GAAG,CAAC,CAAC;YACrB,MAAM,IAAI,iBAAiB,CACvB,cAAc,EAAE,uCAAuC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAC/E,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,QAAQ,CACV,EAAU,EAAE,MAAsB,EAAE,WAAgC;QAEpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CACvB,cAAc,EAAE,sCAAsC,EAAE,GAAG,CAAC,MAAM,CACrE,CAAC;QACN,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC1D,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAgD,CAAC,CAAC;QAEtF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,SAAS,CAAC,CAAC,OAAO;YACnB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC/B,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBACtB,MAAM,KAAK,CAAC;YAChB,CAAC;QACL,CAAC;QAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,WAAW,OAAO,CAAC;QACtC,IAAI,CAAC;YACD,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,CAAC;QACd,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,MAAsB;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,wDAAwD;IAChD,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,MAAsB;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,+DAA+D;gBAC/D,0DAA0D;gBAC1D,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE;oBAC7C,KAAK,EAAE,wDAAwD,GAAG,CAAC,MAAM,EAAE;iBAC9E,CAAC,CAAC;YACP,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,UAAU,CAAC,MAAc;IAC9B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrE,CAAC;AAMD;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,MAAsB;IACxC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO;IACX,CAAC;IACD,MAAM,IAAI,iBAAiB,CACvB,aAAa,EACb,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,oBAAoB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;AACN,CAAC;AAED,SAAS,MAAM,CAAI,GAAQ;IACvB,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,GAAG,CAAC,IAAS,CAAC;AACzB,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,sDAAsD;AACtD;;;;;;GAMG;AACH,KAAK,UAAU,QAAQ,CAAI,SAAiB,EAAE,EAAuC;IACjF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAoC,CAAC;IACzC,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC5C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACpB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,SAAS,IAAI,CAAC,CAAC,CAAC;QACvF,CAAC,EAAE,SAAS,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,KAAM,CAAC,CAAC;IACzB,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAI,OAAe,EAAE,EAAoB;IAC7D,IAAI,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,EAAE,EAAE;YACpB,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC,IAAI,KAAK,CAAC,SAAS;YACpF,eAAe,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;gBAC5D,CAAC;YACL,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IACzB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAI,GAA2B,EAAE,KAAK,CAAC;IAClD,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,MAAM,MAAM,SAAS,CAAC;AAK7B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EACH,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,IAAI,gBAAgB,EACvF,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,GAClE,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAe,MAAM,YAAY,CAAC;AAQrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAE9D,2EAA2E;AAC3E,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,8EAA8E;AAC9E,uBAAuB;AACvB,MAAM,SAAS,GAAG,IAAI,CAAC;AAyDvB;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACJ,MAAM,CAAS;IACf,KAAK,CAAkC;IACvC,KAAK,CAA4B;IACjC,OAAO,CAAS;IAChB,SAAS,CAAS;IAEnC,mFAAmF;IAC1E,QAAQ,CAAc;IAE/B;;;OAGG;IACM,KAAK,CAAW;IAEzB,YAAY,UAAmB,EAAE;QAC7B,gEAAgE;QAChE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;YAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7E,KAAK,EAAE,SAAS;SACnB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAiB;YACvE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,MAAM;YACjC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,QAAQ,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAU;QACd,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,UAAyB,EAAE;QAChD,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACd,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC;gBACvD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM;aACxD,CAAC,CAAC,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,CAAiB,GAAG,CAAC,CAAC;YACzC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,CAAC,UAAyB,EAAE;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC;gBACzD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;aACtC,CAAC,CAAC,CAAC;YACJ,OAAO,QAAQ,CAAC,MAAM,CAAiB,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,aAAa,CAAC,UAAyB,EAAE;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC;gBAC5D,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;aACtC,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAAc,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,WAAW,CACb,GAAqB,EAAE,UAAwB,EAAE;QAEjD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;eAC9E,WAAW,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,iBAAiB,CACvB,aAAa,EAAE,yDAAyD,WAAW,EAAE,CACxF,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;QAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBACd,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7B,SAAS;YACb,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjB,SAAS;YACb,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,KAAK,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YACrD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACxB,CAAC;QACL,CAAC,CAAC,CAAC,CAAC,CAAC;QACL,sEAAsE;QACtE,2DAA2D;QAC3D,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,2CAA2C;IACnC,KAAK,CAAC,WAAW,CACrB,KAAe,EAAE,OAAsB;QAEvC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;QAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,IAAI,IAAyB,CAAC;QAC9B,IAAI,CAAC;YACD,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC/D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC;oBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM;iBAC5D,CAAC,CAAC,CAAC;gBACJ,OAAO,MAAM,CAAsB,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACpB,SAAS;YACb,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpC,SAAS;YACb,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,iBAAiB,CAC7B,cAAc,EAAE,oCAAoC,EAAE,EAAE,EAAE,GAAG,CAChE,CAAC,CAAC;QACP,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;CACJ;AAED,qFAAqF;AACrF,MAAM,OAAO,WAAW;IAEC;IACA;IACA;IACA;IAJrB,YACqB,MAAc,EACd,OAAe,EACf,SAAiB,EACjB,SAAkC;QAHlC,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAyB;IACpD,CAAC;IAEJ,KAAK,CAAC,IAAI;QACN,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC;gBACjE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;aACtC,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAA8B,GAAG,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACrB,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC;gBACpE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM;aACzD,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAAmB,GAAG,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAsB;QAC9C,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC;gBACpE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM;aACzE,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAA6B,GAAG,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,UAA4B,EAAE;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC;gBAC5D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC3E,MAAM,EAAE,MAAM;aACjB,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAA8B,GAAG,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,MAAsB;QAChD,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC;gBACpE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBACjC,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;aACR,CAAC,CAAC,CAAC;YACb,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACnD,OAAO,QAAQ,CAAC;YACpB,CAAC;YACD,MAAM,CAAU,GAAG,CAAC,CAAC;YACrB,MAAM,IAAI,iBAAiB,CACvB,cAAc,EAAE,uCAAuC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAC/E,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,QAAQ,CACV,EAAU,EAAE,MAAsB,EAAE,WAAgC;QAEpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CACvB,cAAc,EAAE,sCAAsC,EAAE,GAAG,CAAC,MAAM,CACrE,CAAC;QACN,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC1D,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAgD,CAAC,CAAC;QAEtF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,SAAS,CAAC,CAAC,OAAO;YACnB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC/B,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBACtB,MAAM,KAAK,CAAC;YAChB,CAAC;QACL,CAAC;QAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,WAAW,OAAO,CAAC;QACtC,IAAI,CAAC;YACD,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,CAAC;QACd,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,MAAsB;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,wDAAwD;IAChD,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,MAAsB;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,+DAA+D;gBAC/D,0DAA0D;gBAC1D,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE;oBAC7C,KAAK,EAAE,wDAAwD,GAAG,CAAC,MAAM,EAAE;iBAC9E,CAAC,CAAC;YACP,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,UAAU,CAAC,MAAc;IAC9B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,MAAsB;IACxC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO;IACX,CAAC;IACD,MAAM,IAAI,iBAAiB,CACvB,aAAa,EACb,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,oBAAoB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;AACN,CAAC"}

package/dist/errors.d.ts

@@ -16,6 +16,34 @@ export declare class VPNDetectionError extends Error {
     /** Whether retrying this exact request could succeed. */
     get retryable(): boolean;
 }
+/**
+ * The authorization server refusing an OAuth request: a 4xx whose body names an
+ * OAuth error code. Never retryable as it stands.
+ *
+ * `kind` follows the status like any other failure's. A 401 here means the
+ * client ID is not registered, never the API key, which OAuth requests do not
+ * carry. The two codes a sign-in ends on have their own subclasses.
+ */
+export declare class OauthError extends VPNDetectionError {
+    /** The server's code, such as `authorization_pending` or `invalid_grant`, kept as sent. */
+    readonly errorCode: string;
+    /** The server's explanation, when it sent one. */
+    readonly errorDescription?: string;
+    constructor(errorCode: string, errorDescription?: string, status?: number);
+    get retryable(): boolean;
+}
+/** The person refused the sign-in. Its device code is spent, so a new attempt starts over. */
+export declare class OauthAccessDeniedError extends OauthError {
+    constructor(errorDescription?: string, status?: number);
+}
+/**
+ * The device code is no longer valid: it expired, or was already used or
+ * refused. A poll that outlives the code raises this itself, with no `status`.
+ */
+export declare class OauthExpiredTokenError extends OauthError {
+    constructor(errorDescription?: string, status?: number);
+}
+export declare function oauthErrorFrom(errorCode: string, errorDescription: string | undefined, status: number): OauthError;
 export declare function errorFromResponse(status: number, headers: {
     get(name: string): string | null;
 }, body: unknown): VPNDetectionError;

package/dist/errors.js

@@ -14,6 +14,56 @@ export class VPNDetectionError extends Error {
         return this.kind === 'rate_limited' || this.kind === 'server_error' || this.kind === 'network';
     }
 }
+/**
+ * The authorization server refusing an OAuth request: a 4xx whose body names an
+ * OAuth error code. Never retryable as it stands.
+ *
+ * `kind` follows the status like any other failure's. A 401 here means the
+ * client ID is not registered, never the API key, which OAuth requests do not
+ * carry. The two codes a sign-in ends on have their own subclasses.
+ */
+export class OauthError extends VPNDetectionError {
+    /** The server's code, such as `authorization_pending` or `invalid_grant`, kept as sent. */
+    errorCode;
+    /** The server's explanation, when it sent one. */
+    errorDescription;
+    constructor(errorCode, errorDescription, status) {
+        super(status === undefined ? 'bad_request' : errorFromResponse(status, NO_HEADERS, undefined).kind, errorDescription === undefined ? errorCode : `${errorCode}: ${errorDescription}`, status);
+        this.name = 'OauthError';
+        this.errorCode = errorCode;
+        this.errorDescription = errorDescription;
+    }
+    get retryable() {
+        return false;
+    }
+}
+/** The person refused the sign-in. Its device code is spent, so a new attempt starts over. */
+export class OauthAccessDeniedError extends OauthError {
+    constructor(errorDescription, status) {
+        super('access_denied', errorDescription, status);
+        this.name = 'OauthAccessDeniedError';
+    }
+}
+/**
+ * The device code is no longer valid: it expired, or was already used or
+ * refused. A poll that outlives the code raises this itself, with no `status`.
+ */
+export class OauthExpiredTokenError extends OauthError {
+    constructor(errorDescription, status) {
+        super('expired_token', errorDescription, status);
+        this.name = 'OauthExpiredTokenError';
+    }
+}
+export function oauthErrorFrom(errorCode, errorDescription, status) {
+    if (errorCode === 'access_denied') {
+        return new OauthAccessDeniedError(errorDescription, status);
+    }
+    if (errorCode === 'expired_token') {
+        return new OauthExpiredTokenError(errorDescription, status);
+    }
+    return new OauthError(errorCode, errorDescription, status);
+}
+const NO_HEADERS = { get: () => null };
 export function errorFromResponse(status, headers, body) {
     const message = messageOf(body) ?? `request failed with status ${status}`;
     const retryAfter = parseRetryAfter(headers.get('retry-after'));
@@ -47,7 +97,7 @@ export function errorFromResponse(status, headers, body) {
  * is a spent allowance, which is the only kind the API puts in an entry.
  */
 export function errorFromEntry(entry) {
-    return errorFromResponse(entry.status, { get: () => null }, { error: entry.error });
+    return errorFromResponse(entry.status, NO_HEADERS, { error: entry.error });
 }
 // The two APIs behind this host answer with different envelopes: the lookup
 // endpoint uses `error`, the database endpoints use `rc`. Both are read here so

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC/B,IAAI,CAAY;IAChB,MAAM,CAAU;IAChB,iBAAiB,CAAU;IAEpC,YAAY,IAAe,EAAE,OAAe,EAAE,MAAe,EAAE,iBAA0B;QACrF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC/C,CAAC;IAED,yDAAyD;IACzD,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IACnG,CAAC;CACJ;AAED,MAAM,UAAU,iBAAiB,CAC7B,MAAc,EAAE,OAA6C,EAAE,IAAa;IAE5E,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,8BAA8B,MAAM,EAAE,CAAC;IAC1E,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAE/D,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,uEAAuE;QACvE,0CAA0C;QAC1C,OAAO,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC;YAC1D,CAAC,CAAC,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,IAAI,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,IAAI,iBAAiB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QACf,OAAO,IAAI,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAwC;IACnE,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,gFAAgF;AAChF,iDAAiD;AACjD,SAAS,SAAS,CAAC,IAAa;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,CAAC,CAAC,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,KAAoB;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,wCAAwC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC/B,IAAI,CAAY;IAChB,MAAM,CAAU;IAChB,iBAAiB,CAAU;IAEpC,YAAY,IAAe,EAAE,OAAe,EAAE,MAAe,EAAE,iBAA0B;QACrF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC/C,CAAC;IAED,yDAAyD;IACzD,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IACnG,CAAC;CACJ;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,UAAW,SAAQ,iBAAiB;IAC7C,2FAA2F;IAClF,SAAS,CAAS;IAC3B,kDAAkD;IACzC,gBAAgB,CAAU;IAEnC,YAAY,SAAiB,EAAE,gBAAyB,EAAE,MAAe;QACrE,KAAK,CACD,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,EAC5F,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,gBAAgB,EAAE,EAChF,MAAM,CACT,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC7C,CAAC;IAED,IAAa,SAAS;QAClB,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ;AAED,8FAA8F;AAC9F,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IAClD,YAAY,gBAAyB,EAAE,MAAe;QAClD,KAAK,CAAC,eAAe,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACzC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IAClD,YAAY,gBAAyB,EAAE,MAAe;QAClD,KAAK,CAAC,eAAe,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACzC,CAAC;CACJ;AAED,MAAM,UAAU,cAAc,CAC1B,SAAiB,EAAE,gBAAoC,EAAE,MAAc;IAEvE,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAEvC,MAAM,UAAU,iBAAiB,CAC7B,MAAc,EAAE,OAA6C,EAAE,IAAa;IAE5E,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,8BAA8B,MAAM,EAAE,CAAC;IAC1E,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAE/D,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,uEAAuE;QACvE,0CAA0C;QAC1C,OAAO,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC;YAC1D,CAAC,CAAC,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,IAAI,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,IAAI,iBAAiB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QACf,OAAO,IAAI,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAwC;IACnE,OAAO,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,4EAA4E;AAC5E,gFAAgF;AAChF,iDAAiD;AACjD,SAAS,SAAS,CAAC,IAAa;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,CAAC,CAAC,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,KAAoB;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,wCAAwC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/generated/sdk.gen.d.ts

@@ -62,7 +62,7 @@ export declare const lookupBatch: <ThrowOnError extends boolean = false>(options
 /**
  * List
  *
- * Every database this organization may SEE, with where its licence stands.
+ * Every database this organization may SEE, with where its license stands.
  * Not just the ones you hold: a customer with one grant should be able to
  * tell what else is published without asking. `standing` is the
  * difference - `licensed`, `expired`, or `unlicensed` for one never

package/dist/generated/sdk.gen.js

@@ -90,7 +90,7 @@ export const lookupBatch = (options) => (options.client ?? client).post({
 /**
  * List
  *
- * Every database this organization may SEE, with where its licence stands.
+ * Every database this organization may SEE, with where its license stands.
  * Not just the ones you hold: a customer with one grant should be able to
  * tell what else is published without asking. `standing` is the
  * difference - `licensed`, `expired`, or `unlicensed` for one never

package/dist/generated/types.gen.d.ts

@@ -252,7 +252,7 @@ export type DatabaseFormatSize = {
     bytes: number | null;
 };
 /**
- * One database FAMILY your organization is licensed for. A license covers
+ * One database FAMILY, with your organization's license beside it. A license covers
  * the family, while a download names a specific version, so the ids you
  * pass to the download and checksum endpoints come from `versions`.
  *
@@ -567,9 +567,14 @@ export type OauthMetadata = {
     grant_types_supported?: Array<string>;
     code_challenge_methods_supported?: Array<string>;
     /**
-     * A client_id may be an https URL serving your client metadata.
+     * Always `none`. Every client is public and has no secret.
      */
-    client_id_metadata_document_supported?: boolean;
+    token_endpoint_auth_methods_supported?: Array<string>;
+    /**
+     * RFC 9207. A redirect back from the authorization endpoint carries `iss`.
+     */
+    authorization_response_iss_parameter_supported?: boolean;
+    service_documentation?: string;
 };
 export type DeviceAuthorizationRequest = {
     client_id: string;
@@ -596,6 +601,9 @@ export type DeviceAuthorization = {
      * The same page with the code already filled in.
      */
     verification_uri_complete?: string;
+    /**
+     * Seconds until both codes expire.
+     */
     expires_in: number;
     /**
      * Seconds between polls.
@@ -603,26 +611,77 @@ export type DeviceAuthorization = {
     interval: number;
 };
 export type TokenRequest = {
+    /**
+     * `urn:ietf:params:oauth:grant-type:device_code`, `authorization_code` or `refresh_token`.
+     */
     grant_type: string;
     client_id: string;
+    /**
+     * Required by the device code grant.
+     */
     device_code?: string;
+    /**
+     * Required by the authorization code grant.
+     */
     code?: string;
+    /**
+     * Required by the authorization code grant.
+     */
     code_verifier?: string;
+    /**
+     * Authorization code grant: the `redirect_uri` the code was issued against, exactly.
+     */
     redirect_uri?: string;
+    /**
+     * Required by the refresh token grant.
+     */
     refresh_token?: string;
 };
 export type TokenResponse = {
     access_token: string;
+    /**
+     * Always `Bearer`.
+     */
     token_type: string;
+    /**
+     * Seconds until the access token expires.
+     */
     expires_in: number;
+    /**
+     * Always returned. A refresh consumes the token it presents, so keep this one.
+     */
     refresh_token?: string;
     /**
      * What was actually granted, which may be narrower than what was asked for.
      */
     scope?: string;
+    /**
+     * Not part of OAuth. The ID of the API key the person picked when they
+     * approved, returned by every grant while this authorization may still
+     * read that key back. Absent when no key was picked, or when the
+     * person's role no longer allows reading keys back.
+     *
+     */
+    'mslm:apikey_id'?: string;
+    /**
+     * Not part of OAuth. The API key itself, so a device ends up holding an
+     * ordinary key. Returned by the device code and authorization code
+     * grants only, never by a refresh, and only alongside
+     * `mslm:apikey_id`. Absent when that key's secret cannot be read back,
+     * which is the case for a key created before keys could be shown again
+     * in the console; a rotated key can be.
+     *
+     */
+    'mslm:apikey'?: string;
 };
 export type RevokeRequest = {
+    /**
+     * An access token or a refresh token.
+     */
     token: string;
+    /**
+     * Accepted and not checked.
+     */
     client_id?: string;
 };
 export type OauthError = {
@@ -907,6 +966,9 @@ export type ListDownloadsData = {
     body?: never;
     path?: never;
     query?: {
+        /**
+         * How many attempts to return. Clamped to 1 through 200.
+         */
         limit?: number;
     };
     url: '/api/v1/database/downloads';
@@ -1222,11 +1284,16 @@ export type OauthDeviceAuthorizationData = {
 };
 export type OauthDeviceAuthorizationErrors = {
     /**
-     * `invalid_request`, `invalid_client`, `unauthorized_client`, or
-     * `slow_down` when this address has started too many authorizations.
+     * `invalid_request`, `unauthorized_client` when the client may not use
+     * the device flow, or `slow_down` when this address has started too
+     * many authorizations.
      *
      */
     400: OauthError;
+    /**
+     * `invalid_client`: the `client_id` is not registered.
+     */
+    401: OauthError;
 };
 export type OauthDeviceAuthorizationError = OauthDeviceAuthorizationErrors[keyof OauthDeviceAuthorizationErrors];
 export type OauthDeviceAuthorizationResponses = {
@@ -1276,9 +1343,18 @@ export type OauthTokenErrors = {
     /**
      * An RFC 6749 error. `authorization_pending` and `slow_down` are
      * normal answers while polling a device authorization, not failures.
+     * `access_denied` means the person refused, and `expired_token` that
+     * the device code is no longer valid: it expired, or it was already
+     * exchanged or refused. `invalid_grant` means the code, device code or
+     * refresh token is not valid for this `client_id`. `slow_down` also
+     * answers any grant when this address sends too many requests.
      *
      */
     400: OauthError;
+    /**
+     * `invalid_client`: the `client_id` is not registered.
+     */
+    401: OauthError;
 };
 export type OauthTokenError = OauthTokenErrors[keyof OauthTokenErrors];
 export type OauthTokenResponses = {

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 export { VPNDetection, DatabaseApi, DEFAULT_BASE_URL } from './client.js';
 export type { Options, CacheOptions, LookupOptions, BatchOptions, DownloadsOptions, DownloadDestination, } from './client.js';
+export { OauthApi } from './oauth.js';
+export type { OauthOptions, DeviceAuthorizationOptions, PollDeviceTokenOptions, OauthMetadata, DeviceAuthorization, TokenResponse, } from './oauth.js';
 export { isBogon } from './bogon.js';
-export { VPNDetectionError } from './errors.js';
+export { VPNDetectionError, OauthError, OauthAccessDeniedError, OauthExpiredTokenError, } from './errors.js';
 export type { ErrorKind } from './errors.js';
 export type { Result, VpnDetail, ClassDetail, ProxyDetail, LookupResponse, } from './types.js';
 export { DATABASE_FORMATS, STANDINGS, LICENSE_TYPES } from './types.js';

package/dist/index.js

@@ -1,5 +1,6 @@
 export { VPNDetection, DatabaseApi, DEFAULT_BASE_URL } from './client.js';
+export { OauthApi } from './oauth.js';
 export { isBogon } from './bogon.js';
-export { VPNDetectionError } from './errors.js';
+export { VPNDetectionError, OauthError, OauthAccessDeniedError, OauthExpiredTokenError, } from './errors.js';
 export { DATABASE_FORMATS, STANDINGS, LICENSE_TYPES } from './types.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAK1E,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKhD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAK1E,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAKtC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EACH,iBAAiB,EAAE,UAAU,EAAE,sBAAsB,EAAE,sBAAsB,GAChF,MAAM,aAAa,CAAC;AAKrB,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,118 @@
+import type { Client } from './generated/client/index.js';
+/** Per-call overrides for one OAuth request. Anything omitted falls back to the client's setting. */
+export interface OauthOptions {
+    /** How long one attempt may take before it is abandoned, in milliseconds. */
+    timeoutMs?: number;
+}
+/** What a device sign-in asks for. A member left out is left out of the request, never sent empty. */
+export interface DeviceAuthorizationOptions extends OauthOptions {
+    /** Space-delimited scopes, sent as given. The server narrows them to what the client may ask for. */
+    scope?: string;
+    /** The API the tokens are meant for. */
+    resource?: string;
+}
+export interface PollDeviceTokenOptions {
+    /** How long EACH request of the poll may take, in milliseconds. Never bounds the poll as a whole. */
+    timeoutMs?: number;
+    /** Aborting it stops the wait and any request in flight, and the poll rejects with its reason. */
+    signal?: AbortSignal;
+}
+/** The authorization server's discovery document. No call here needs it: each builds on the base URL. */
+export interface OauthMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    device_authorization_endpoint?: string;
+    revocation_endpoint?: string;
+    scopes_supported?: string[];
+    response_types_supported?: string[];
+    grant_types_supported?: string[];
+    code_challenge_methods_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    authorization_response_iss_parameter_supported?: boolean;
+    service_documentation?: string;
+}
+/** A started device sign-in. `expires_in` and `interval` are seconds. */
+export interface DeviceAuthorization {
+    device_code: string;
+    /** What the person types in at `verification_uri`. */
+    user_code: string;
+    verification_uri: string;
+    /** `verification_uri` with the code already in it, for a program that can open a browser. */
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval: number;
+}
+/**
+ * What a completed sign-in or a refresh hands back.
+ *
+ * `apikey_id` is set when the person picked one of their API keys and may still
+ * read it back. `apikey`, the key itself, also needs a sign-in rather than a
+ * refresh and a key whose secret can be shown again, so `apikey_id` without
+ * `apikey` is normal. An empty `scope` is present.
+ */
+export interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    /** Spent by the refresh that presents it, so keep the one each refresh returns. */
+    refresh_token?: string;
+    scope?: string;
+    apikey_id?: string;
+    apikey?: string;
+}
+/**
+ * Signs a person in on their own machine with the OAuth device flow, so a
+ * program can be handed one of their API keys instead of asking them to paste
+ * it. Reached through `client.oauth`.
+ *
+ * Every call takes a client ID, issued on request from support@vpndetection.io.
+ * None of these requests carries the client's API key, and none needs one.
+ */
+export declare class OauthApi {
+    private readonly client;
+    private readonly retries;
+    private readonly timeoutMs;
+    private clock;
+    constructor(client: Client, retries: number, timeoutMs: number);
+    metadata(options?: OauthOptions): Promise<OauthMetadata>;
+    /**
+     * Start a device sign-in: show the person `user_code` and `verification_uri`,
+     * then hand the answer to `pollDeviceToken`. It consumes nothing, so it is
+     * retried like a lookup; a refusal such as `slow_down` is an `OauthError`.
+     */
+    deviceAuthorization(clientId: string, options?: DeviceAuthorizationOptions): Promise<DeviceAuthorization>;
+    /**
+     * Ask once whether the person has approved a device sign-in. Until they do,
+     * it rejects with an `OauthError` coded `authorization_pending`;
+     * `pollDeviceToken` is the loop around it.
+     *
+     * Never retried: an approved code is spent by the answer carrying the tokens,
+     * so a retry after a lost response could only lose them.
+     */
+    exchangeDeviceCode(clientId: string, deviceCode: string, options?: OauthOptions): Promise<TokenResponse>;
+    /**
+     * Trade a refresh token for a new pair. The old one is spent whatever happens
+     * next, so this is never retried. A refresh names the key the person picked
+     * (`apikey_id`) but never reveals it again (`apikey`).
+     */
+    exchangeRefreshToken(clientId: string, refreshToken: string, options?: OauthOptions): Promise<TokenResponse>;
+    /**
+     * End a token. A refresh token ends the whole sign-in and every token it
+     * issued, which is how a program signs the machine out; an access token ends
+     * only itself. The server answers the same for any token, known or not.
+     */
+    revoke(clientId: string, token: string, options?: OauthOptions): Promise<void>;
+    /**
+     * Wait for the person to approve a device sign-in, and return its tokens.
+     *
+     * Waits `device.interval` seconds (5 when that is below 1) before EVERY
+     * request, the first included, and 5 more for the rest of the call each time
+     * the server answers `slow_down`. Ends at the first answer that is neither:
+     * a denial rejects with `OauthAccessDeniedError`, a code that ran out with
+     * `OauthExpiredTokenError` - as does outliving `device.expires_in`, counted
+     * from this call, with no `status` - and any other failure as it came.
+     */
+    pollDeviceToken(clientId: string, device: DeviceAuthorization, options?: PollDeviceTokenOptions): Promise<TokenResponse>;
+    private exchange;
+}

package/dist/oauth.js

@@ -0,0 +1,240 @@
+import { oauthDeviceAuthorization, oauthMetadata, oauthRevoke, oauthToken, } from './generated/sdk.gen.js';
+import { errorFromResponse, OauthError, oauthErrorFrom, OauthExpiredTokenError, VPNDetectionError, } from './errors.js';
+import { asError, deadline, withRetry } from './transport.js';
+/**
+ * Signs a person in on their own machine with the OAuth device flow, so a
+ * program can be handed one of their API keys instead of asking them to paste
+ * it. Reached through `client.oauth`.
+ *
+ * Every call takes a client ID, issued on request from support@vpndetection.io.
+ * None of these requests carries the client's API key, and none needs one.
+ */
+export class OauthApi {
+    client;
+    retries;
+    timeoutMs;
+    // The poll's wait and its deadline, which tests replace together.
+    clock = { now: () => performance.now(), sleep: sleep };
+    constructor(client, retries, timeoutMs) {
+        this.client = client;
+        this.retries = retries;
+        this.timeoutMs = timeoutMs;
+    }
+    async metadata(options = {}) {
+        return withRetry(this.retries, async () => {
+            const res = await deadline(options.timeoutMs ?? this.timeoutMs, (signal) => oauthMetadata({
+                client: this.client, signal: signal,
+            }));
+            return decode(res, METADATA);
+        });
+    }
+    /**
+     * Start a device sign-in: show the person `user_code` and `verification_uri`,
+     * then hand the answer to `pollDeviceToken`. It consumes nothing, so it is
+     * retried like a lookup; a refusal such as `slow_down` is an `OauthError`.
+     */
+    async deviceAuthorization(clientId, options = {}) {
+        const body = {
+            client_id: clientId,
+            scope: options.scope || undefined,
+            resource: options.resource || undefined,
+        };
+        const timeoutMs = options.timeoutMs ?? this.timeoutMs;
+        return withRetry(this.retries, async () => {
+            const res = await deadline(timeoutMs, (signal) => oauthDeviceAuthorization({
+                client: this.client, body: body, signal: signal,
+            }));
+            return decode(res, DEVICE_AUTHORIZATION);
+        });
+    }
+    /**
+     * Ask once whether the person has approved a device sign-in. Until they do,
+     * it rejects with an `OauthError` coded `authorization_pending`;
+     * `pollDeviceToken` is the loop around it.
+     *
+     * Never retried: an approved code is spent by the answer carrying the tokens,
+     * so a retry after a lost response could only lose them.
+     */
+    async exchangeDeviceCode(clientId, deviceCode, options = {}) {
+        return this.exchange({
+            grant_type: DEVICE_CODE_GRANT, device_code: deviceCode, client_id: clientId,
+        }, options.timeoutMs);
+    }
+    /**
+     * Trade a refresh token for a new pair. The old one is spent whatever happens
+     * next, so this is never retried. A refresh names the key the person picked
+     * (`apikey_id`) but never reveals it again (`apikey`).
+     */
+    async exchangeRefreshToken(clientId, refreshToken, options = {}) {
+        return this.exchange({
+            grant_type: 'refresh_token', refresh_token: refreshToken, client_id: clientId,
+        }, options.timeoutMs);
+    }
+    /**
+     * End a token. A refresh token ends the whole sign-in and every token it
+     * issued, which is how a program signs the machine out; an access token ends
+     * only itself. The server answers the same for any token, known or not.
+     */
+    async revoke(clientId, token, options = {}) {
+        await withRetry(this.retries, async () => {
+            const res = await deadline(options.timeoutMs ?? this.timeoutMs, (signal) => oauthRevoke({
+                client: this.client,
+                body: { token: token, client_id: clientId },
+                // The answer says nothing, so it is read as text and dropped rather than parsed.
+                parseAs: 'text',
+                signal: signal,
+            }));
+            throwIfFailed(res);
+        });
+    }
+    /**
+     * Wait for the person to approve a device sign-in, and return its tokens.
+     *
+     * Waits `device.interval` seconds (5 when that is below 1) before EVERY
+     * request, the first included, and 5 more for the rest of the call each time
+     * the server answers `slow_down`. Ends at the first answer that is neither:
+     * a denial rejects with `OauthAccessDeniedError`, a code that ran out with
+     * `OauthExpiredTokenError` - as does outliving `device.expires_in`, counted
+     * from this call, with no `status` - and any other failure as it came.
+     */
+    async pollDeviceToken(clientId, device, options = {}) {
+        let interval = device.interval >= 1 ? device.interval : 5;
+        const expires = this.clock.now() + device.expires_in * 1000;
+        for (;;) {
+            await this.clock.sleep(interval * 1000, options.signal);
+            if (this.clock.now() >= expires) {
+                throw new OauthExpiredTokenError();
+            }
+            try {
+                return await this.exchange({
+                    grant_type: DEVICE_CODE_GRANT, device_code: device.device_code, client_id: clientId,
+                }, options.timeoutMs, options.signal);
+            }
+            catch (err) {
+                if (!(err instanceof OauthError)) {
+                    throw err;
+                }
+                // RFC 8628: slow_down widens the interval for every later request, not just the next.
+                if (err.errorCode === 'slow_down') {
+                    interval += 5;
+                }
+                else if (err.errorCode !== 'authorization_pending') {
+                    throw err;
+                }
+            }
+        }
+    }
+    async exchange(form, timeoutMs, cancel) {
+        const res = await deadline(timeoutMs ?? this.timeoutMs, (signal) => oauthToken({
+            client: this.client, body: form, signal: signal,
+        }), cancel);
+        return decode(res, TOKEN_RESPONSE);
+    }
+}
+const DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const METADATA = {
+    issuer: { type: 'string', required: true },
+    authorization_endpoint: { type: 'string', required: true },
+    token_endpoint: { type: 'string', required: true },
+    device_authorization_endpoint: { type: 'string' },
+    revocation_endpoint: { type: 'string' },
+    scopes_supported: { type: 'string[]' },
+    response_types_supported: { type: 'string[]' },
+    grant_types_supported: { type: 'string[]' },
+    code_challenge_methods_supported: { type: 'string[]' },
+    token_endpoint_auth_methods_supported: { type: 'string[]' },
+    authorization_response_iss_parameter_supported: { type: 'boolean' },
+    service_documentation: { type: 'string' },
+};
+const DEVICE_AUTHORIZATION = {
+    device_code: { type: 'string', required: true },
+    user_code: { type: 'string', required: true },
+    verification_uri: { type: 'string', required: true },
+    verification_uri_complete: { type: 'string' },
+    expires_in: { type: 'number', required: true },
+    interval: { type: 'number', required: true },
+};
+const TOKEN_RESPONSE = {
+    access_token: { type: 'string', required: true },
+    token_type: { type: 'string', required: true },
+    expires_in: { type: 'number', required: true },
+    refresh_token: { type: 'string' },
+    scope: { type: 'string' },
+    apikey_id: { type: 'string', wire: 'mslm:apikey_id' },
+    apikey: { type: 'string', wire: 'mslm:apikey' },
+};
+// Only the declared members are copied, on PRESENCE, so an absent one stays
+// absent and an empty `scope` stays present. Anything else the server sends is
+// dropped rather than surfaced untyped.
+function decode(res, members) {
+    const status = throwIfFailed(res).status;
+    if (res.error !== undefined) {
+        // A 2xx the generated client could not parse, which reports it here.
+        throw asError(res.error);
+    }
+    const body = res.data;
+    if (!isObject(body)) {
+        throw new VPNDetectionError('server_error', 'the answer was not a JSON object', status);
+    }
+    const out = {};
+    for (const [name, member] of Object.entries(members)) {
+        const wire = member.wire ?? name;
+        const value = body[wire];
+        if (value === undefined || value === null) {
+            if (member.required) {
+                throw new VPNDetectionError('server_error', `the answer carried no ${wire}`, status);
+            }
+            continue;
+        }
+        if (!hasType(value, member.type)) {
+            throw new VPNDetectionError('server_error', `the answer's ${wire} is not a ${member.type}`, status);
+        }
+        out[name] = value;
+    }
+    return out;
+}
+// Only a 4xx whose body is a JSON object with a STRING `error` is an OAuth
+// refusal. Every 5xx, whatever it says, is the server failing, and is retried
+// wherever the operation retries.
+function throwIfFailed(res) {
+    if (res.response === undefined) {
+        throw new VPNDetectionError('network', 'no response from the API');
+    }
+    const { status, ok, headers } = res.response;
+    if (ok) {
+        return res.response;
+    }
+    const body = res.error;
+    if (status >= 400 && status < 500 && isObject(body) && typeof body.error === 'string') {
+        const description = typeof body.error_description === 'string' ? body.error_description : undefined;
+        throw oauthErrorFrom(body.error, description, status);
+    }
+    throw errorFromResponse(status, headers, body);
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasType(value, type) {
+    if (type === 'string[]') {
+        return Array.isArray(value) && value.every((item) => typeof item === 'string');
+    }
+    return typeof value === type;
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal?.reason);
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AACA,OAAO,EACH,wBAAwB,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,GACnE,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACH,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,sBAAsB,EAAE,iBAAiB,GAC3F,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAY,MAAM,gBAAgB,CAAC;AAsExE;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IAKI;IACA;IACA;IANrB,kEAAkE;IAC1D,KAAK,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEtE,YACqB,MAAc,EACd,OAAe,EACf,SAAiB;QAFjB,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAQ;IACnC,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,UAAwB,EAAE;QACrC,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC;gBACtF,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;aACtC,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CACrB,QAAgB,EAAE,UAAsC,EAAE;QAE1D,MAAM,IAAI,GAAG;YACT,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;SAC1C,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QACtD,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC;gBACvE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM;aAClD,CAAC,CAAC,CAAC;YACJ,OAAO,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACpB,QAAgB,EAAE,UAAkB,EAAE,UAAwB,EAAE;QAEhE,OAAO,IAAI,CAAC,QAAQ,CAAC;YACjB,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ;SAC9E,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CACtB,QAAgB,EAAE,YAAoB,EAAE,UAAwB,EAAE;QAElE,OAAO,IAAI,CAAC,QAAQ,CAAC;YACjB,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ;SAChF,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,KAAa,EAAE,UAAwB,EAAE;QACpE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACrC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC;gBACpF,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;gBAC3C,iFAAiF;gBACjF,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,MAAM;aACjB,CAAC,CAAC,CAAC;YACJ,aAAa,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CACjB,QAAgB,EAAE,MAA2B,EAAE,UAAkC,EAAE;QAEnF,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QAC5D,SAAS,CAAC;YACN,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,sBAAsB,EAAE,CAAC;YACvC,CAAC;YACD,IAAI,CAAC;gBACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC;oBACvB,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ;iBACtF,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;oBAC/B,MAAM,GAAG,CAAC;gBACd,CAAC;gBACD,sFAAsF;gBACtF,IAAI,GAAG,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;oBAChC,QAAQ,IAAI,CAAC,CAAC;gBAClB,CAAC;qBAAM,IAAI,GAAG,CAAC,SAAS,KAAK,uBAAuB,EAAE,CAAC;oBACnD,MAAM,GAAG,CAAC;gBACd,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,QAAQ,CAClB,IAAkB,EAAE,SAAkB,EAAE,MAAoB;QAE5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC;YAC3E,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM;SAClD,CAAC,EAAE,MAAM,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvC,CAAC;CACJ;AAED,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAczE,MAAM,QAAQ,GAAwC;IAClD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC1C,sBAAsB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC1D,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClD,6BAA6B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjD,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvC,gBAAgB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;IACtC,wBAAwB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;IAC9C,qBAAqB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;IAC3C,gCAAgC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;IACtD,qCAAqC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;IAC3D,8CAA8C,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACnE,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAC5C,CAAC;AAEF,MAAM,oBAAoB,GAA8C;IACpE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7C,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpD,yBAAyB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;CAC/C,CAAC;AAEF,MAAM,cAAc,GAAwC;IACxD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAChD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC9C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC9C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACrD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE;CAClD,CAAC;AAEF,4EAA4E;AAC5E,+EAA+E;AAC/E,wCAAwC;AACxC,SAAS,MAAM,CAAI,GAAQ,EAAE,OAAgC;IACzD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,qEAAqE;QACrE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAS,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,yBAAyB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACzF,CAAC;YACD,SAAS;QACb,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,iBAAiB,CACvB,cAAc,EAAE,gBAAgB,IAAI,aAAa,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CACzE,CAAC;QACN,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,GAAQ,CAAC;AACpB,CAAC;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,kCAAkC;AAClC,SAAS,aAAa,CAAC,GAAQ;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC7C,IAAI,EAAE,EAAE,CAAC;QACL,OAAO,GAAG,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;IACvB,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpF,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAoB;IACjD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,OAAO;QACX,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,EAAE;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACd,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/transport.d.ts

@@ -0,0 +1,18 @@
+import { VPNDetectionError } from './errors.js';
+export interface Res {
+    data?: unknown;
+    error?: unknown;
+    response?: Response;
+}
+export declare function unwrap<T>(res: Res): T;
+/**
+ * Bound one attempt, and report an expiry as our own error rather than the
+ * runtime's `TimeoutError`, whose message says nothing about which call gave up.
+ *
+ * The signal is built per call, so a retried request gets a fresh budget - the
+ * same per-attempt semantics the Go and Python clients have. Aborting `cancel`
+ * ends the attempt at once, rejecting with its reason.
+ */
+export declare function deadline<T>(timeoutMs: number, fn: (signal: AbortSignal) => Promise<T>, cancel?: AbortSignal): Promise<T>;
+export declare function withRetry<T>(retries: number, fn: () => Promise<T>): Promise<T>;
+export declare function asError(err: unknown): VPNDetectionError;

package/dist/transport.js

@@ -0,0 +1,82 @@
+import pRetry from 'p-retry';
+import { errorFromResponse, VPNDetectionError } from './errors.js';
+export function unwrap(res) {
+    if (res.response === undefined) {
+        throw new VPNDetectionError('network', 'no response from the API');
+    }
+    if (!res.response.ok) {
+        throw errorFromResponse(res.response.status, res.response.headers, res.error ?? res.data);
+    }
+    return res.data;
+}
+/**
+ * Bound one attempt, and report an expiry as our own error rather than the
+ * runtime's `TimeoutError`, whose message says nothing about which call gave up.
+ *
+ * The signal is built per call, so a retried request gets a fresh budget - the
+ * same per-attempt semantics the Go and Python clients have. Aborting `cancel`
+ * ends the attempt at once, rejecting with its reason.
+ */
+export async function deadline(timeoutMs, fn, cancel) {
+    cancel?.throwIfAborted();
+    const controller = new AbortController();
+    let timer;
+    let stop;
+    // Raced, not left to the signal alone: aborting releases the socket, but only
+    // a transport that HONORS the signal then settles, and a substituted `fetch`
+    // need not. Clearing the timer stops the losing side rejecting into nothing.
+    const expiry = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new VPNDetectionError('network', `request timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        if (cancel !== undefined) {
+            stop = () => {
+                controller.abort(cancel.reason);
+                reject(cancel.reason);
+            };
+            cancel.addEventListener('abort', stop, { once: true });
+        }
+    });
+    try {
+        return await Promise.race([fn(controller.signal), expiry]);
+    }
+    finally {
+        clearTimeout(timer);
+        if (stop !== undefined) {
+            cancel?.removeEventListener('abort', stop);
+        }
+    }
+}
+// p-retry owns the backoff schedule; the extra sleep here is what honors a
+// server-supplied Retry-After, which p-retry has no way to know about. A 429
+// carrying that header is the only 429 worth retrying, which is why the wait
+// and the retry decision both key off the same field.
+export async function withRetry(retries, fn) {
+    try {
+        return await pRetry(fn, {
+            retries: retries,
+            shouldRetry: ({ error }) => !(error instanceof VPNDetectionError) || error.retryable,
+            onFailedAttempt: async ({ error }) => {
+                const seconds = error instanceof VPNDetectionError ? error.retryAfterSeconds : undefined;
+                if (seconds !== undefined && seconds > 0) {
+                    await new Promise((r) => setTimeout(r, seconds * 1000));
+                }
+            },
+        });
+    }
+    catch (err) {
+        throw asError(err);
+    }
+}
+export function asError(err) {
+    if (err instanceof VPNDetectionError) {
+        return err;
+    }
+    const cause = err?.cause;
+    if (cause instanceof VPNDetectionError) {
+        return cause;
+    }
+    return new VPNDetectionError('network', err instanceof Error ? err.message : String(err));
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMnE,MAAM,UAAU,MAAM,CAAI,GAAQ;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,GAAG,CAAC,IAAS,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC1B,SAAiB,EAAE,EAAuC,EAAE,MAAoB;IAEhF,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAoC,CAAC;IACzC,IAAI,IAA8B,CAAC;IACnC,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC5C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACpB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,SAAS,IAAI,CAAC,CAAC,CAAC;QACvF,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,EAAE;gBACR,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,KAAM,CAAC,CAAC;QACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,OAAe,EAAE,EAAoB;IACpE,IAAI,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,EAAE,EAAE;YACpB,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC,IAAI,KAAK,CAAC,SAAS;YACpF,eAAe,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;gBAC5D,CAAC;YACL,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAI,GAA2B,EAAE,KAAK,CAAC;IAClD,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9F,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vpndetection",
-  "version": "5.1.0",
+  "version": "5.2.1",
   "description": "Official Node.js client library for the VPNDetection API. Detect VPNs, proxies, Tor, hosting and CDN IPs.",
   "type": "module",
   "license": "MIT",
@@ -55,10 +55,10 @@
   },
   "devDependencies": {
     "@hey-api/openapi-ts": "^0.99.0",
-    "@mslmio/eslint-config": "^1.0.1",
+    "@mslmio/eslint-config": "^1.1.0",
     "@types/node": "^26.2.0",
-    "eslint": "^9.39.0",
-    "typescript": "^5.9.3"
+    "eslint": "^10.10.0",
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "build": "rm -rf dist && openapi-ts && tsc",