@hearth-auth/node 1.0.19 → 1.1.0

package/dist/client.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.test.js","sourceRoot":"","sources":["../src/client.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,MAAM,GAAG;IACb,UAAU,EAAE,0BAA0B;IACtC,SAAS,EAAE,SAAS;IACpB,aAAa,EAAE,SAAS;CACzB,CAAC;AAEF,SAAS,SAAS;IAChB,MAAM,OAAO,GAAe;QAC1B,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,0BAA0B;QAC/B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;QACzC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACnC,CAAC;IACF,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEtC,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,gBAAgB,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAClH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"client.test.js","sourceRoot":"","sources":["../src/client.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,MAAM,GAAG;IACb,UAAU,EAAE,0BAA0B;IACtC,SAAS,EAAE,SAAS;IACpB,aAAa,EAAE,SAAS;CACzB,CAAC;AAEF,SAAS,SAAS;IAChB,MAAM,OAAO,GAAe;QAC1B,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,0BAA0B;QAC/B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;QACzC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACnC,CAAC;IACF,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEtC,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,gBAAgB,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAClH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iFAAiF;AAEjF,MAAM,cAAc,GAAG;IACrB,YAAY,EAAE,QAAQ;IACtB,UAAU,EAAE,QAAQ;IACpB,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,WAAW,EAAE,UAAU;IACvB,SAAS,EAAE,WAAW;IACtB,gBAAgB,EAAE,mCAAmC;IACrD,UAAU,EAAE,GAAG;IACf,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEtC,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACtG,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/discovery.d.ts

@@ -5,6 +5,7 @@ export interface OidcDiscovery {
     introspection_endpoint?: string;
     authorization_endpoint?: string;
     token_endpoint?: string;
+    device_authorization_endpoint?: string;
     userinfo_endpoint?: string;
     [key: string]: unknown;
 }

package/dist/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAIlF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qBAAa,eAAe;IAKxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAL9B,OAAO,CAAC,KAAK,CAA8B;IAC3C,OAAO,CAAC,YAAY,CAAuC;gBAGxC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM;IAGhC,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC;YAgB1B,cAAc;IA0B5B,gFAAgF;IAChF,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAIlF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qBAAa,eAAe;IAKxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAL9B,OAAO,CAAC,KAAK,CAA8B;IAC3C,OAAO,CAAC,YAAY,CAAuC;gBAGxC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM;IAGhC,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC;YAgB1B,cAAc;IA0B5B,gFAAgF;IAChF,KAAK,IAAI,IAAI;CAGd"}

package/dist/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAY7C,MAAM,OAAO,eAAe;IAKP;IACA;IALX,KAAK,GAAyB,IAAI,CAAC;IACnC,YAAY,GAAkC,IAAI,CAAC;IAE3D,YACmB,SAAiB,EACjB,WAAmB;QADnB,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IACnC,CAAC;IAEJ,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACrD,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;gBACjB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACrE,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACtD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAmB,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CAAC,0DAA0D,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gFAAgF;IAChF,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAa7C,MAAM,OAAO,eAAe;IAKP;IACA;IALX,KAAK,GAAyB,IAAI,CAAC;IACnC,YAAY,GAAkC,IAAI,CAAC;IAE3D,YACmB,SAAiB,EACjB,WAAmB;QADnB,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IACnC,CAAC;IAEJ,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACrD,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;gBACjB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACrE,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACtD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,gCAAgC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAmB,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CAAC,0DAA0D,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gFAAgF;IAChF,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;CACF"}

package/dist/errors.d.ts

@@ -117,4 +117,17 @@ export declare class AdminHttpError extends HearthError {
         cause?: unknown;
     });
 }
+/**
+ * Typed HTTP error for OAuth flow operations (token exchange, device flow, magic-link, etc.)
+ * that return non-2xx responses not covered by the standard error taxonomy.
+ *
+ * HTTP 429 from `requestMagicLink` is surfaced as this error (spec §4.5.3).
+ */
+export declare class OAuthFlowError extends HearthError {
+    /** HTTP status code from the server response; 0 for network-level failures. */
+    readonly statusCode: number;
+    constructor(statusCode: number, message: string, options?: {
+        cause?: unknown;
+    });
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2CAA2C;AA8C3C,oGAAoG;AACpG,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAK3D;AAED,6FAA6F;AAC7F,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,4EAA4E;AAC5E,qBAAa,cAAe,SAAQ,WAAW;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,+DAA+D;AAC/D,qBAAa,cAAe,SAAQ,WAAW;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,2FAA2F;AAC3F,qBAAa,sBAAuB,SAAQ,WAAW;gBACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,kFAAkF;AAClF,qBAAa,iBAAkB,SAAQ,sBAAsB;gBAC/C,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,oFAAoF;AACpF,qBAAa,qBAAsB,SAAQ,sBAAsB;gBACnD,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,qGAAqG;AACrG,qBAAa,iBAAkB,SAAQ,sBAAsB;gBAC/C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,4EAA4E;AAC5E,qBAAa,gBAAiB,SAAQ,sBAAsB;gBAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAGhE;AAED,0EAA0E;AAC1E,qBAAa,kBAAmB,SAAQ,sBAAsB;gBAChD,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAGpE;AAED,gGAAgG;AAChG,qBAAa,gBAAiB,SAAQ,sBAAsB;gBAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,qFAAqF;AACrF,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,yFAAyF;AACzF,qBAAa,eAAgB,SAAQ,WAAW;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,WAAW;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAK5E;AAED,yFAAyF;AACzF,qBAAa,cAAe,SAAQ,WAAW;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;IAClD,sEAAsE;IACtE,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;gBAE7B,eAAe,EAAE,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ3F;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,WAAW;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3E"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2CAA2C;AA8C3C,oGAAoG;AACpG,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAK3D;AAED,6FAA6F;AAC7F,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,4EAA4E;AAC5E,qBAAa,cAAe,SAAQ,WAAW;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,+DAA+D;AAC/D,qBAAa,cAAe,SAAQ,WAAW;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,2FAA2F;AAC3F,qBAAa,sBAAuB,SAAQ,WAAW;gBACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,kFAAkF;AAClF,qBAAa,iBAAkB,SAAQ,sBAAsB;gBAC/C,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,oFAAoF;AACpF,qBAAa,qBAAsB,SAAQ,sBAAsB;gBACnD,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,qGAAqG;AACrG,qBAAa,iBAAkB,SAAQ,sBAAsB;gBAC/C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,4EAA4E;AAC5E,qBAAa,gBAAiB,SAAQ,sBAAsB;gBAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAGhE;AAED,0EAA0E;AAC1E,qBAAa,kBAAmB,SAAQ,sBAAsB;gBAChD,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAGpE;AAED,gGAAgG;AAChG,qBAAa,gBAAiB,SAAQ,sBAAsB;gBAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,qFAAqF;AACrF,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED,yFAAyF;AACzF,qBAAa,eAAgB,SAAQ,WAAW;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,WAAW;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAK5E;AAED,yFAAyF;AACzF,qBAAa,cAAe,SAAQ,WAAW;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAG3D;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;IAClD,sEAAsE;IACtE,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;gBAE7B,eAAe,EAAE,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ3F;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,WAAW;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3E;AAED;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,WAAW;IAC7C,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI/E"}

package/dist/errors.js

@@ -169,4 +169,18 @@ export class AdminHttpError extends HearthError {
         this.status = status;
     }
 }
+/**
+ * Typed HTTP error for OAuth flow operations (token exchange, device flow, magic-link, etc.)
+ * that return non-2xx responses not covered by the standard error taxonomy.
+ *
+ * HTTP 429 from `requestMagicLink` is surfaced as this error (spec §4.5.3).
+ */
+export class OAuthFlowError extends HearthError {
+    /** HTTP status code from the server response; 0 for network-level failures. */
+    statusCode;
+    constructor(statusCode, message, options) {
+        super(message, options);
+        this.statusCode = statusCode;
+    }
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,6FAA6F;AAC7F,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAG,MAAM;WACrC,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,CAAC,CAAI,MAAM;WACrC,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAK,MAAM;WACrC,IAAI,KAAK,EAAE,CAAoB,IAAI;WACnC,IAAI,KAAK,EAAE,CAAC,CAAmB,IAAI;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,gFAAgF;IAChF,sFAAsF;IACtF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrE,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,CAAC,CAAC;gBACpB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC1D,CAAC,EAAE,CAAC;oBACJ,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;wBAAE,CAAC,EAAE,CAAC;oBAClE,GAAG,IAAI,QAAQ,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,uFAAuF;gBACvF,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;gBACpC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YACD,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,GAAG,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,KAAK,CAAC,iBAAiB;YAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,OAAO,sBAAuB,SAAQ,WAAW;IACrD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,iBAAkB,SAAQ,sBAAsB;IAC3D,YAAY,SAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,oBAAoB,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,OAAO,qBAAsB,SAAQ,sBAAsB;IAC/D,YAAY,SAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,yBAAyB,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,OAAO,iBAAkB,SAAQ,sBAAsB;IAC3D,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,gBAAiB,SAAQ,sBAAsB;IAC1D,YAAY,YAAoB,EAAE,OAA6B;QAC7D,KAAK,CAAC,iBAAiB,YAAY,oCAAoC,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,kBAAmB,SAAQ,sBAAsB;IAC5D,YAAY,gBAAwB,EAAE,OAA6B;QACjE,KAAK,CAAC,mDAAmD,gBAAgB,GAAG,EAAE,OAAO,CAAC,CAAC;IACzF,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,OAAO,gBAAiB,SAAQ,sBAAsB;IAC1D,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,OAAO,eAAgB,SAAQ,WAAW;IAC9C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,WAAW;IAC5C,QAAQ,CAAS;IACjB,MAAM,CAAS;IAExB,YAAY,QAAgB,EAAE,MAAc,EAAE,OAA6B;QACzE,KAAK,CAAC,gCAAgC,QAAQ,wBAAwB,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IAClD,sEAAsE;IAC7D,eAAe,CAAW;IACnC,oFAAoF;IAC3E,WAAW,CAAqB;IAEzC,YAAY,eAAyB,EAAE,WAAoB,EAAE,OAA6B;QACxF,KAAK,CACH,kDAAkD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,EAC1F,OAAO,CACR,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,WAAW;IACpC,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe,EAAE,OAA6B;QACxE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,6FAA6F;AAC7F,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAG,MAAM;WACrC,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,GAAG,CAAC,CAAI,MAAM;WACrC,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAK,MAAM;WACrC,IAAI,KAAK,EAAE,CAAoB,IAAI;WACnC,IAAI,KAAK,EAAE,CAAC,CAAmB,IAAI;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,gFAAgF;IAChF,sFAAsF;IACtF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrE,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,CAAC,CAAC;gBACpB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC1D,CAAC,EAAE,CAAC;oBACJ,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;wBAAE,CAAC,EAAE,CAAC;oBAClE,GAAG,IAAI,QAAQ,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,uFAAuF;gBACvF,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;gBACpC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YACD,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,GAAG,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,KAAK,CAAC,iBAAiB;YAAE,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,OAAO,sBAAuB,SAAQ,WAAW;IACrD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,iBAAkB,SAAQ,sBAAsB;IAC3D,YAAY,SAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,oBAAoB,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,OAAO,qBAAsB,SAAQ,sBAAsB;IAC/D,YAAY,SAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,yBAAyB,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,OAAO,iBAAkB,SAAQ,sBAAsB;IAC3D,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,gBAAiB,SAAQ,sBAAsB;IAC1D,YAAY,YAAoB,EAAE,OAA6B;QAC7D,KAAK,CAAC,iBAAiB,YAAY,oCAAoC,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,kBAAmB,SAAQ,sBAAsB;IAC5D,YAAY,gBAAwB,EAAE,OAA6B;QACjE,KAAK,CAAC,mDAAmD,gBAAgB,GAAG,EAAE,OAAO,CAAC,CAAC;IACzF,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,OAAO,gBAAiB,SAAQ,sBAAsB;IAC1D,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,OAAO,eAAgB,SAAQ,WAAW;IAC9C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,WAAW;IAC5C,QAAQ,CAAS;IACjB,MAAM,CAAS;IAExB,YAAY,QAAgB,EAAE,MAAc,EAAE,OAA6B;QACzE,KAAK,CAAC,gCAAgC,QAAQ,wBAAwB,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IAClD,sEAAsE;IAC7D,eAAe,CAAW;IACnC,oFAAoF;IAC3E,WAAW,CAAqB;IAEzC,YAAY,eAAyB,EAAE,WAAoB,EAAE,OAA6B;QACxF,KAAK,CACH,kDAAkD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,EAC1F,OAAO,CACR,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,WAAW;IACpC,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe,EAAE,OAA6B;QACxE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,+EAA+E;IACtE,UAAU,CAAS;IAE5B,YAAY,UAAkB,EAAE,OAAe,EAAE,OAA6B;QAC5E,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF"}

package/dist/flows.d.ts

@@ -0,0 +1,181 @@
+/**
+ * §4.5 — OAuth flow helpers: exchangeCode, clientCredentials, device flow,
+ * magic-link, userinfo, /me/permissions, and session-version feed.
+ */
+import type { ResolvedConfig } from "./config.js";
+import type { OidcDiscovery } from "./discovery.js";
+/** Standard OAuth 2.0 token endpoint response. */
+export interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+    id_token?: string;
+}
+/** RFC 8628 device authorization response. */
+export interface DeviceAuthorizationResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    /** Pre-filled URI (when provided by server). */
+    verification_uri_complete?: string;
+    expires_in: number;
+    /** Minimum polling interval in seconds. */
+    interval: number;
+}
+/** OIDC userinfo endpoint response. */
+export interface UserInfoResponse {
+    sub: string;
+    name?: string;
+    email?: string;
+    email_verified?: boolean;
+    preferred_username?: string;
+    [key: string]: unknown;
+}
+/**
+ * Live RBAC state from `GET /v1/me/permissions`.
+ * Unlike JWT claims (which are cached), this reflects the server's current assignments.
+ */
+export interface MePermissionsResponse {
+    roles: string[];
+    groups: string[];
+    permissions: string[];
+    scope?: string;
+}
+/** A single session-version bump event (HEA-930). */
+export interface SvDeltaEntry {
+    seq: number;
+    session_id: string;
+    min_sv: number;
+    bumped_at?: number;
+}
+/** Response from `GET /oauth/session-versions?since=<seq>` (HEA-930). */
+export interface SvDeltaResponse {
+    realm: string;
+    next_seq: number;
+    deltas: SvDeltaEntry[];
+}
+/** Response from `GET /oauth/session-versions/snapshot` (HEA-930). */
+export interface SvSnapshotResponse {
+    realm: string;
+    current_seq: number;
+    versions: Record<string, number>;
+}
+/** Options for the `exchangeCode` method. */
+export interface ExchangeCodeOptions {
+    /** PKCE verifier from `generatePkce()`. Required when the auth request included a code_challenge. */
+    codeVerifier?: string;
+}
+/**
+ * Handles OAuth 2.0 flows, userinfo, /me/permissions, and the session-version feed.
+ * Discovers all endpoint URLs from OIDC discovery — no hard-coded paths.
+ */
+export declare class OAuthFlowsClient {
+    private readonly config;
+    private readonly getDiscovery;
+    private readonly timeout;
+    constructor(config: ResolvedConfig, getDiscovery: () => Promise<OidcDiscovery>);
+    private getTokenEndpoint;
+    private getDeviceAuthEndpoint;
+    private getUserInfoEndpoint;
+    /** POST application/x-www-form-urlencoded; decode JSON response. */
+    private postForm;
+    /** GET with Bearer token; returns null on 204 No Content. */
+    private getWithBearer;
+    /**
+     * Exchange an authorization code for tokens (RFC 6749 §4.1.3).
+     *
+     * Discovers the token endpoint from OIDC discovery. Sends credentials as
+     * `application/x-www-form-urlencoded` — never as query parameters.
+     *
+     * @param code - Authorization code from the callback URL.
+     * @param redirectUri - The same redirect_uri used in the authorization request.
+     * @param opts - Optional PKCE verifier (`codeVerifier`) for PKCE-protected flows.
+     */
+    exchangeCode(code: string, redirectUri: string, opts?: ExchangeCodeOptions): Promise<TokenResponse>;
+    /**
+     * Obtain a token using the Client Credentials grant (RFC 6749 §4.4).
+     *
+     * Required for M2M authentication (services, daemons, admin tooling acting as
+     * their own principal). Credentials are sent in the POST body, never in the URL.
+     *
+     * @param scope - Optional space-delimited scope string.
+     */
+    clientCredentials(scope?: string): Promise<TokenResponse>;
+    /**
+     * Begin a Device Authorization Flow (RFC 8628).
+     *
+     * Returns the `device_code`, `user_code`, `verification_uri`, and `interval`.
+     * Present the `user_code` and `verification_uri` to the user, then call
+     * `pollDeviceToken(device_code, interval)` to await approval.
+     *
+     * @param scope - Optional space-delimited scope string.
+     */
+    startDeviceFlow(scope?: string): Promise<DeviceAuthorizationResponse>;
+    /**
+     * Poll the token endpoint until the device flow completes (RFC 8628 §3.5).
+     *
+     * Blocks until:
+     * - User approves → resolves with `TokenResponse`.
+     * - Device code expires → rejects with `TokenExpiredError`.
+     * - Fatal error → rejects with `OAuthFlowError`.
+     *
+     * Handles `authorization_pending` by continuing to poll without surfacing
+     * an error to the caller. Handles `slow_down` by increasing the interval
+     * by 5 s per occurrence as required by RFC 8628 §3.5.
+     *
+     * @param deviceCode - The `device_code` from `startDeviceFlow()`.
+     * @param intervalSeconds - Initial polling interval from `startDeviceFlow().interval`.
+     */
+    pollDeviceToken(deviceCode: string, intervalSeconds: number): Promise<TokenResponse>;
+    /**
+     * Send a magic-link email for passwordless sign-in (spec §4.5.3).
+     *
+     * Per enumeration-resistance requirements, the server always returns 202
+     * regardless of whether the email is registered. This method always
+     * succeeds on 202 — it does NOT surface "user not found" errors.
+     * HTTP 429 (Too Many Requests) is surfaced as `OAuthFlowError`.
+     *
+     * Requires `realm_id` in the HearthConfig.
+     *
+     * @param email - Email address to send the magic link to.
+     */
+    requestMagicLink(email: string): Promise<void>;
+    /**
+     * Fetch the OIDC userinfo claims for the bearer token (discovered endpoint).
+     *
+     * @param token - Access token whose claims to retrieve.
+     */
+    userinfo(token: string): Promise<UserInfoResponse>;
+    /**
+     * Fetch the current user's live RBAC state from `GET /v1/me/permissions`.
+     *
+     * Unlike JWT embedded claims (cached at issuance), this reflects the server's
+     * current role and group assignments.
+     *
+     * @param token - Access token of the user whose permissions to retrieve.
+     */
+    mePermissions(token: string): Promise<MePermissionsResponse>;
+    /**
+     * Fetch the full session-version snapshot (HEA-930).
+     *
+     * Returns all current `{sessionId → minSV}` pairs. Used to seed a local
+     * session-version cache on startup. Requires a token with `hearth.sv_feed` scope.
+     *
+     * @param token - Service token with `hearth.sv_feed` scope.
+     */
+    svSnapshot(token: string): Promise<SvSnapshotResponse>;
+    /**
+     * Fetch session-version deltas since sequence number `since` (HEA-930).
+     *
+     * Returns `null` when there are no new deltas (HTTP 204 No Content).
+     * Requires a token with `hearth.sv_feed` scope.
+     *
+     * @param token - Service token with `hearth.sv_feed` scope.
+     * @param since - Return only events with `seq > since`.
+     * @param limit - Maximum number of deltas to return (server default applies when omitted).
+     */
+    svDelta(token: string, since: number, limit?: number): Promise<SvDeltaResponse | null>;
+}
+//# sourceMappingURL=flows.d.ts.map

package/dist/flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../src/flows.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8CAA8C;AAC9C,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IAClC,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC;YAQhE,gBAAgB;YAQhB,qBAAqB;YAUrB,mBAAmB;IAUjC,oEAAoE;YACtD,QAAQ;IAuCtB,6DAA6D;YAC/C,aAAa;IAyC3B;;;;;;;;;OASG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,mBAAmB,GACzB,OAAO,CAAC,aAAa,CAAC;IAazB;;;;;;;OAOG;IACG,iBAAiB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAW/D;;;;;;;;OAQG;IACG,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAO3E;;;;;;;;;;;;;;OAcG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA8D1F;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCpD;;;;OAIG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAOxD;;;;;;;OAOG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAOlE;;;;;;;OAOG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAO5D;;;;;;;;;OASG;IACG,OAAO,CACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAMnC"}

package/dist/flows.js

@@ -0,0 +1,332 @@
+/**
+ * §4.5 — OAuth flow helpers: exchangeCode, clientCredentials, device flow,
+ * magic-link, userinfo, /me/permissions, and session-version feed.
+ */
+import { ConfigurationError, OAuthFlowError, TokenExpiredError } from "./errors.js";
+// ── OAuthFlowsClient ──────────────────────────────────────────────────────────
+/**
+ * Handles OAuth 2.0 flows, userinfo, /me/permissions, and the session-version feed.
+ * Discovers all endpoint URLs from OIDC discovery — no hard-coded paths.
+ */
+export class OAuthFlowsClient {
+    config;
+    getDiscovery;
+    timeout;
+    constructor(config, getDiscovery) {
+        this.config = config;
+        this.getDiscovery = getDiscovery;
+        this.timeout = config.http_timeout;
+    }
+    // ── Discovery helpers ──────────────────────────────────────────────────────
+    async getTokenEndpoint() {
+        const doc = await this.getDiscovery();
+        if (!doc.token_endpoint) {
+            throw new ConfigurationError("token_endpoint not found in OIDC discovery document");
+        }
+        return doc.token_endpoint;
+    }
+    async getDeviceAuthEndpoint() {
+        const doc = await this.getDiscovery();
+        if (!doc.device_authorization_endpoint) {
+            throw new ConfigurationError("device_authorization_endpoint not found in OIDC discovery document");
+        }
+        return doc.device_authorization_endpoint;
+    }
+    async getUserInfoEndpoint() {
+        const doc = await this.getDiscovery();
+        if (!doc.userinfo_endpoint) {
+            throw new ConfigurationError("userinfo_endpoint not found in OIDC discovery document");
+        }
+        return doc.userinfo_endpoint;
+    }
+    // ── HTTP primitives ────────────────────────────────────────────────────────
+    /** POST application/x-www-form-urlencoded; decode JSON response. */
+    async postForm(endpoint, params) {
+        const body = new URLSearchParams(params);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeout);
+        let res;
+        try {
+            res = await fetch(endpoint, {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body,
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            throw new OAuthFlowError(0, `Request failed: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!res.ok) {
+            let message = `HTTP ${res.status}`;
+            try {
+                const json = (await res.json());
+                if (typeof json.error === "string") {
+                    message = json.error;
+                    if (typeof json.error_description === "string") {
+                        message += `: ${json.error_description}`;
+                    }
+                }
+            }
+            catch { /* ignore parse failure */ }
+            throw new OAuthFlowError(res.status, message);
+        }
+        return res.json();
+    }
+    /** GET with Bearer token; returns null on 204 No Content. */
+    async getWithBearer(endpoint, token, params) {
+        let url = endpoint;
+        if (params) {
+            const u = new URL(endpoint);
+            for (const [k, v] of Object.entries(params))
+                u.searchParams.set(k, v);
+            url = u.toString();
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeout);
+        let res;
+        try {
+            res = await fetch(url, {
+                headers: { Authorization: `Bearer ${token}` },
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            throw new OAuthFlowError(0, `Request failed: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (res.status === 204)
+            return null;
+        if (!res.ok) {
+            throw new OAuthFlowError(res.status, `HTTP ${res.status}`);
+        }
+        return res.json();
+    }
+    // ── Public API ─────────────────────────────────────────────────────────────
+    /**
+     * Exchange an authorization code for tokens (RFC 6749 §4.1.3).
+     *
+     * Discovers the token endpoint from OIDC discovery. Sends credentials as
+     * `application/x-www-form-urlencoded` — never as query parameters.
+     *
+     * @param code - Authorization code from the callback URL.
+     * @param redirectUri - The same redirect_uri used in the authorization request.
+     * @param opts - Optional PKCE verifier (`codeVerifier`) for PKCE-protected flows.
+     */
+    async exchangeCode(code, redirectUri, opts) {
+        const endpoint = await this.getTokenEndpoint();
+        const params = {
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: redirectUri,
+            client_id: this.config.client_id,
+            client_secret: this.config.client_secret,
+        };
+        if (opts?.codeVerifier)
+            params.code_verifier = opts.codeVerifier;
+        return this.postForm(endpoint, params);
+    }
+    /**
+     * Obtain a token using the Client Credentials grant (RFC 6749 §4.4).
+     *
+     * Required for M2M authentication (services, daemons, admin tooling acting as
+     * their own principal). Credentials are sent in the POST body, never in the URL.
+     *
+     * @param scope - Optional space-delimited scope string.
+     */
+    async clientCredentials(scope) {
+        const endpoint = await this.getTokenEndpoint();
+        const params = {
+            grant_type: "client_credentials",
+            client_id: this.config.client_id,
+            client_secret: this.config.client_secret,
+        };
+        if (scope)
+            params.scope = scope;
+        return this.postForm(endpoint, params);
+    }
+    /**
+     * Begin a Device Authorization Flow (RFC 8628).
+     *
+     * Returns the `device_code`, `user_code`, `verification_uri`, and `interval`.
+     * Present the `user_code` and `verification_uri` to the user, then call
+     * `pollDeviceToken(device_code, interval)` to await approval.
+     *
+     * @param scope - Optional space-delimited scope string.
+     */
+    async startDeviceFlow(scope) {
+        const endpoint = await this.getDeviceAuthEndpoint();
+        const params = { client_id: this.config.client_id };
+        if (scope)
+            params.scope = scope;
+        return this.postForm(endpoint, params);
+    }
+    /**
+     * Poll the token endpoint until the device flow completes (RFC 8628 §3.5).
+     *
+     * Blocks until:
+     * - User approves → resolves with `TokenResponse`.
+     * - Device code expires → rejects with `TokenExpiredError`.
+     * - Fatal error → rejects with `OAuthFlowError`.
+     *
+     * Handles `authorization_pending` by continuing to poll without surfacing
+     * an error to the caller. Handles `slow_down` by increasing the interval
+     * by 5 s per occurrence as required by RFC 8628 §3.5.
+     *
+     * @param deviceCode - The `device_code` from `startDeviceFlow()`.
+     * @param intervalSeconds - Initial polling interval from `startDeviceFlow().interval`.
+     */
+    async pollDeviceToken(deviceCode, intervalSeconds) {
+        const endpoint = await this.getTokenEndpoint();
+        let intervalMs = intervalSeconds * 1000;
+        // eslint-disable-next-line no-constant-condition
+        while (true) {
+            await new Promise((resolve) => setTimeout(resolve, intervalMs));
+            const body = new URLSearchParams({
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                device_code: deviceCode,
+                client_id: this.config.client_id,
+            });
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), this.timeout);
+            let res;
+            try {
+                res = await fetch(endpoint, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                    body,
+                    signal: controller.signal,
+                });
+            }
+            catch (err) {
+                throw new OAuthFlowError(0, `Device token poll failed: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            if (res.ok) {
+                return res.json();
+            }
+            let errorCode = "";
+            try {
+                const json = (await res.json());
+                errorCode = typeof json.error === "string" ? json.error : "";
+            }
+            catch { /* ignore */ }
+            if (errorCode === "authorization_pending") {
+                continue;
+            }
+            if (errorCode === "slow_down") {
+                intervalMs += 5000;
+                continue;
+            }
+            if (errorCode === "expired_token") {
+                throw new TokenExpiredError(new Date(), { cause: new Error("device code expired") });
+            }
+            throw new OAuthFlowError(res.status, `Device token poll failed: ${errorCode || `HTTP ${res.status}`}`);
+        }
+    }
+    /**
+     * Send a magic-link email for passwordless sign-in (spec §4.5.3).
+     *
+     * Per enumeration-resistance requirements, the server always returns 202
+     * regardless of whether the email is registered. This method always
+     * succeeds on 202 — it does NOT surface "user not found" errors.
+     * HTTP 429 (Too Many Requests) is surfaced as `OAuthFlowError`.
+     *
+     * Requires `realm_id` in the HearthConfig.
+     *
+     * @param email - Email address to send the magic link to.
+     */
+    async requestMagicLink(email) {
+        if (!this.config.realm_id) {
+            throw new ConfigurationError("realm_id is required for requestMagicLink — set it in HearthConfig");
+        }
+        const url = `${this.config.issuer_url}/v1/${this.config.realm_id}/auth/magic-link`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeout);
+        let res;
+        try {
+            res = await fetch(url, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ email }),
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            throw new OAuthFlowError(0, `Magic-link request failed: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (res.status === 202)
+            return;
+        throw new OAuthFlowError(res.status, `Magic-link request returned HTTP ${res.status}`);
+    }
+    /**
+     * Fetch the OIDC userinfo claims for the bearer token (discovered endpoint).
+     *
+     * @param token - Access token whose claims to retrieve.
+     */
+    async userinfo(token) {
+        const endpoint = await this.getUserInfoEndpoint();
+        const result = await this.getWithBearer(endpoint, token);
+        if (!result)
+            throw new OAuthFlowError(204, "userinfo returned 204 No Content");
+        return result;
+    }
+    /**
+     * Fetch the current user's live RBAC state from `GET /v1/me/permissions`.
+     *
+     * Unlike JWT embedded claims (cached at issuance), this reflects the server's
+     * current role and group assignments.
+     *
+     * @param token - Access token of the user whose permissions to retrieve.
+     */
+    async mePermissions(token) {
+        const url = `${this.config.issuer_url}/v1/me/permissions`;
+        const result = await this.getWithBearer(url, token);
+        if (!result)
+            throw new OAuthFlowError(204, "mePermissions returned 204 No Content");
+        return result;
+    }
+    /**
+     * Fetch the full session-version snapshot (HEA-930).
+     *
+     * Returns all current `{sessionId → minSV}` pairs. Used to seed a local
+     * session-version cache on startup. Requires a token with `hearth.sv_feed` scope.
+     *
+     * @param token - Service token with `hearth.sv_feed` scope.
+     */
+    async svSnapshot(token) {
+        const url = `${this.config.issuer_url}/oauth/session-versions/snapshot`;
+        const result = await this.getWithBearer(url, token);
+        if (!result)
+            throw new OAuthFlowError(204, "svSnapshot returned 204 No Content");
+        return result;
+    }
+    /**
+     * Fetch session-version deltas since sequence number `since` (HEA-930).
+     *
+     * Returns `null` when there are no new deltas (HTTP 204 No Content).
+     * Requires a token with `hearth.sv_feed` scope.
+     *
+     * @param token - Service token with `hearth.sv_feed` scope.
+     * @param since - Return only events with `seq > since`.
+     * @param limit - Maximum number of deltas to return (server default applies when omitted).
+     */
+    async svDelta(token, since, limit) {
+        const url = `${this.config.issuer_url}/oauth/session-versions`;
+        const params = { since: String(since) };
+        if (limit !== undefined)
+            params.limit = String(limit);
+        return this.getWithBearer(url, token, params);
+    }
+}
+//# sourceMappingURL=flows.js.map