@hearth-auth/sdk 1.0.20 → 1.1.0

package/dist/admin.d.ts

@@ -36,6 +36,66 @@ export declare class AdminClient {
     updateRealm(realmId: string, params: UpdateRealmParams): Promise<Realm>;
     /** DELETE /admin/realms/:id — delete a realm. */
     deleteRealm(realmId: string): Promise<void>;
+    /** POST /admin/clients — register an OAuth 2.0 client. */
+    createClient(params: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** GET /admin/clients/:id — get a client by ID. */
+    getClient(clientId: string): Promise<Record<string, unknown>>;
+    /** PATCH /admin/clients/:id — update a client. */
+    updateClient(clientId: string, params: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** DELETE /admin/clients/:id — delete a client. */
+    deleteClient(clientId: string): Promise<void>;
+    /** GET /admin/clients — list clients with optional pagination. */
+    listClients(options?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        items: Record<string, unknown>[];
+        next_cursor: string | null;
+    }>;
+    /** POST /admin/roles — create a role. */
+    createRole(params: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** GET /admin/roles/:id — get a role by ID. */
+    getRole(roleId: string): Promise<Record<string, unknown>>;
+    /** PATCH /admin/roles/:id — update a role. */
+    updateRole(roleId: string, params: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** DELETE /admin/roles/:id — delete a role. */
+    deleteRole(roleId: string): Promise<void>;
+    /** GET /admin/roles — list roles with optional pagination. */
+    listRoles(options?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        items: Record<string, unknown>[];
+        next_cursor: string | null;
+    }>;
+    /** POST /admin/groups — create a group. */
+    createGroup(params: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** GET /admin/groups/:id — get a group by ID. */
+    getGroup(groupId: string): Promise<Record<string, unknown>>;
+    /** PATCH /admin/groups/:id — update a group. */
+    updateGroup(groupId: string, params: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** DELETE /admin/groups/:id — delete a group. */
+    deleteGroup(groupId: string): Promise<void>;
+    /** GET /admin/groups — list groups with optional pagination. */
+    listGroups(options?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        items: Record<string, unknown>[];
+        next_cursor: string | null;
+    }>;
+    /** POST /admin/orgs/:orgId/members — add a member to an organization. */
+    addOrgMember(orgId: string, params: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** GET /admin/orgs/:orgId/members — list members of an organization. */
+    listOrgMembers(orgId: string, options?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        items: Record<string, unknown>[];
+        next_cursor: string | null;
+    }>;
+    /** DELETE /admin/orgs/:orgId/members/:userId — remove a member from an organization. */
+    removeOrgMember(orgId: string, userId: string): Promise<void>;
     private headers;
     private get;
     private post;

package/dist/admin.js

@@ -92,6 +92,130 @@ export class AdminClient {
             throw new HearthError(resp.status, await resp.json());
         }
     }
+    // === OAuth Clients ===
+    /** POST /admin/clients — register an OAuth 2.0 client. */
+    async createClient(params) {
+        return this.post("/admin/clients", params);
+    }
+    /** GET /admin/clients/:id — get a client by ID. */
+    async getClient(clientId) {
+        return this.get(`/admin/clients/${clientId}`);
+    }
+    /** PATCH /admin/clients/:id — update a client. */
+    async updateClient(clientId, params) {
+        return this.request("PATCH", `/admin/clients/${clientId}`, params);
+    }
+    /** DELETE /admin/clients/:id — delete a client. */
+    async deleteClient(clientId) {
+        const resp = await fetch(`${this.baseUrl}/admin/clients/${clientId}`, {
+            method: "DELETE",
+            headers: this.headers(),
+        });
+        if (!resp.ok) {
+            throw new HearthError(resp.status, await resp.json());
+        }
+    }
+    /** GET /admin/clients — list clients with optional pagination. */
+    async listClients(options) {
+        const q = new URLSearchParams();
+        if (options?.limit)
+            q.set("limit", String(options.limit));
+        if (options?.cursor)
+            q.set("cursor", options.cursor);
+        const qs = q.toString();
+        return this.get(`/admin/clients${qs ? `?${qs}` : ""}`);
+    }
+    // === Roles ===
+    /** POST /admin/roles — create a role. */
+    async createRole(params) {
+        return this.post("/admin/roles", params);
+    }
+    /** GET /admin/roles/:id — get a role by ID. */
+    async getRole(roleId) {
+        return this.get(`/admin/roles/${roleId}`);
+    }
+    /** PATCH /admin/roles/:id — update a role. */
+    async updateRole(roleId, params) {
+        return this.request("PATCH", `/admin/roles/${roleId}`, params);
+    }
+    /** DELETE /admin/roles/:id — delete a role. */
+    async deleteRole(roleId) {
+        const resp = await fetch(`${this.baseUrl}/admin/roles/${roleId}`, {
+            method: "DELETE",
+            headers: this.headers(),
+        });
+        if (!resp.ok) {
+            throw new HearthError(resp.status, await resp.json());
+        }
+    }
+    /** GET /admin/roles — list roles with optional pagination. */
+    async listRoles(options) {
+        const q = new URLSearchParams();
+        if (options?.limit)
+            q.set("limit", String(options.limit));
+        if (options?.cursor)
+            q.set("cursor", options.cursor);
+        const qs = q.toString();
+        return this.get(`/admin/roles${qs ? `?${qs}` : ""}`);
+    }
+    // === Groups ===
+    /** POST /admin/groups — create a group. */
+    async createGroup(params) {
+        return this.post("/admin/groups", params);
+    }
+    /** GET /admin/groups/:id — get a group by ID. */
+    async getGroup(groupId) {
+        return this.get(`/admin/groups/${groupId}`);
+    }
+    /** PATCH /admin/groups/:id — update a group. */
+    async updateGroup(groupId, params) {
+        return this.request("PATCH", `/admin/groups/${groupId}`, params);
+    }
+    /** DELETE /admin/groups/:id — delete a group. */
+    async deleteGroup(groupId) {
+        const resp = await fetch(`${this.baseUrl}/admin/groups/${groupId}`, {
+            method: "DELETE",
+            headers: this.headers(),
+        });
+        if (!resp.ok) {
+            throw new HearthError(resp.status, await resp.json());
+        }
+    }
+    /** GET /admin/groups — list groups with optional pagination. */
+    async listGroups(options) {
+        const q = new URLSearchParams();
+        if (options?.limit)
+            q.set("limit", String(options.limit));
+        if (options?.cursor)
+            q.set("cursor", options.cursor);
+        const qs = q.toString();
+        return this.get(`/admin/groups${qs ? `?${qs}` : ""}`);
+    }
+    // === Org Members ===
+    /** POST /admin/orgs/:orgId/members — add a member to an organization. */
+    async addOrgMember(orgId, params) {
+        return this.post(`/admin/orgs/${orgId}/members`, params);
+    }
+    /** GET /admin/orgs/:orgId/members — list members of an organization. */
+    async listOrgMembers(orgId, options) {
+        const q = new URLSearchParams();
+        if (options?.limit)
+            q.set("limit", String(options.limit));
+        if (options?.cursor)
+            q.set("cursor", options.cursor);
+        const qs = q.toString();
+        return this.get(`/admin/orgs/${orgId}/members${qs ? `?${qs}` : ""}`);
+    }
+    /** DELETE /admin/orgs/:orgId/members/:userId — remove a member from an organization. */
+    async removeOrgMember(orgId, userId) {
+        const resp = await fetch(`${this.baseUrl}/admin/orgs/${orgId}/members/${userId}`, {
+            method: "DELETE",
+            headers: this.headers(),
+        });
+        if (!resp.ok) {
+            throw new HearthError(resp.status, await resp.json());
+        }
+    }
     headers() {
         return {
             "X-Realm-ID": this.realmId,

package/dist/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAW1C;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAEH;IACA;IACA;IAHnB,YACmB,OAAe,EACf,OAAe,EACf,WAAmB;QAFnB,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAQ;QACf,gBAAW,GAAX,WAAW,CAAQ;IACnC,CAAC;IAEJ,gBAAgB;IAEhB,yCAAyC;IACzC,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,SAAS,CAAC,OAGf;QACC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAAwB;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE;YACrD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,MAAM,EAAE,EAAE;YAChE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,iBAAiB;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,WAAW,CAAC,MAAyB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,UAAU,CAAC,OAGhB;QACC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,WAAW,CACf,OAAe,EACf,MAAyB;QAEzB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,OAAO,EAAE,EAAE;YACvD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,iBAAiB,OAAO,EAAE,EAAE;YAClE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEO,OAAO;QACb,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,OAAO;YAC1B,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;YAC3C,cAAc,EAAE,kBAAkB;SACnC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,GAAG,CAAI,IAAY;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAa;QAEb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACjD,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAW1C;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAEH;IACA;IACA;IAHnB,YACmB,OAAe,EACf,OAAe,EACf,WAAmB;QAFnB,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAQ;QACf,gBAAW,GAAX,WAAW,CAAQ;IACnC,CAAC;IAEJ,gBAAgB;IAEhB,yCAAyC;IACzC,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,SAAS,CAAC,OAGf;QACC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAAwB;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE;YACrD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,MAAM,EAAE,EAAE;YAChE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,iBAAiB;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,WAAW,CAAC,MAAyB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,UAAU,CAAC,OAGhB;QACC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,WAAW,CACf,OAAe,EACf,MAAyB;QAEzB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,OAAO,EAAE,EAAE;YACvD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,iBAAiB,OAAO,EAAE,EAAE;YAClE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,wBAAwB;IAExB,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,MAA+B;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAA+B;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,kBAAkB,QAAQ,EAAE,EAAE;YACpE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,WAAW,CAAC,OAA6C;QAC7D,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,gBAAgB;IAEhB,yCAAyC;IACzC,KAAK,CAAC,UAAU,CAAC,MAA+B;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAA+B;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,MAAM,EAAE,EAAE;YAChE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,SAAS,CAAC,OAA6C;QAC3D,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,iBAAiB;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,WAAW,CAAC,MAA+B;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,MAA+B;QAChE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,iBAAiB,OAAO,EAAE,EAAE;YAClE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,UAAU,CAAC,OAA6C;QAC5D,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,sBAAsB;IAEtB,yEAAyE;IACzE,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,MAA+B;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,KAAK,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,OAA6C;QAC/E,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QACjD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,eAAe,KAAK,YAAY,MAAM,EAAE,EAAE;YAChF,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEO,OAAO;QACb,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,OAAO;YAC1B,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;YAC3C,cAAc,EAAE,kBAAkB;SACnC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,GAAG,CAAI,IAAY;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAa;QAEb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACjD,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF"}

package/dist/errors.d.ts

@@ -70,6 +70,21 @@ export declare class IntrospectionError extends HearthSdkError {
     readonly cause?: unknown | undefined;
     constructor(message: string, cause?: unknown | undefined);
 }
+/**
+ * Thrown when an OAuth 2.0 token-endpoint request (code exchange, client credentials,
+ * device flow, magic-link, etc.) returns a non-2xx HTTP response.
+ */
+export declare class OAuthFlowError extends HearthSdkError {
+    /** HTTP status code returned by the server; 0 for network-level failures. */
+    readonly statusCode: number;
+    /** OAuth error code from the response body, or a summary message. */
+    readonly errorCode: string;
+    constructor(
+    /** HTTP status code returned by the server; 0 for network-level failures. */
+    statusCode: number, 
+    /** OAuth error code from the response body, or a summary message. */
+    errorCode: string, message?: string);
+}
 /**
  * Thrown when the `mode` field echoed in an introspection response does not
  * match the SDK's configured `expectedMode`.

package/dist/errors.js

@@ -102,6 +102,23 @@ export class IntrospectionError extends HearthSdkError {
         this.cause = cause;
     }
 }
+/**
+ * Thrown when an OAuth 2.0 token-endpoint request (code exchange, client credentials,
+ * device flow, magic-link, etc.) returns a non-2xx HTTP response.
+ */
+export class OAuthFlowError extends HearthSdkError {
+    statusCode;
+    errorCode;
+    constructor(
+    /** HTTP status code returned by the server; 0 for network-level failures. */
+    statusCode, 
+    /** OAuth error code from the response body, or a summary message. */
+    errorCode, message = `OAuth flow error ${statusCode}: ${errorCode}`) {
+        super(message);
+        this.statusCode = statusCode;
+        this.errorCode = errorCode;
+    }
+}
 /**
  * Thrown when the `mode` field echoed in an introspection response does not
  * match the SDK's configured `expectedMode`.

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4CAA4C;AAC5C,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,cAAe,SAAQ,cAAc;IAG9B;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;IAGjC,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,OAAO,cAAe,SAAQ,cAAc;IAG9B;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;IAGjC,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IAEjC;IADlB,YACkB,SAAe,EAC/B,OAAO,GAAG,oBAAoB,SAAS,CAAC,WAAW,EAAE,EAAE;QAEvD,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,cAAS,GAAT,SAAS,CAAM;IAIjC,CAAC;CACF;AAED,0DAA0D;AAC1D,MAAM,OAAO,qBAAsB,SAAQ,cAAc;IAErC;IADlB,YACkB,SAAe,EAC/B,OAAO,GAAG,6BAA6B,SAAS,CAAC,WAAW,EAAE,EAAE;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,cAAS,GAAT,SAAS,CAAM;IAIjC,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,gBAAiB,SAAQ,cAAc;IAEhC;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAc,EAC9B,OAAO,GAAG,oCAAoC,QAAQ,WAAW,MAAM,GAAG;QAE1E,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;IAIhC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IAElC;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAgB,EAChC,OAAO,GAAG,sCAAsC,QAAQ,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAEvF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAU;IAIlC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IAGnC;IAEA;IAJlB;IACE,sEAAsE;IACtD,eAAyB;IACzC,+EAA+E;IAC/D,WAAoB,EACpC,OAAO,GAAG,6BAA6B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAEnE,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,oBAAe,GAAf,eAAe,CAAU;QAEzB,gBAAW,GAAX,WAAW,CAAS;IAItC,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IAGlC;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;IAGjC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IAE9C;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAc,EAC9B,OAAO,GAAG,0CAA0C,QAAQ,WAAW,MAAM,GAAG;QAEhF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;IAIhC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,0BAA2B,SAAQ,cAAc;IAE1C;IACA;IACA;IAHlB,YACkB,SAAiB,EACjB,OAAe,EACf,KAAa,EAC7B,OAAO,GAAG,gCAAgC,SAAS,QAAQ,OAAO,UAAU,KAAK,EAAE;QAEnF,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,cAAS,GAAT,SAAS,CAAQ;QACjB,YAAO,GAAP,OAAO,CAAQ;QACf,UAAK,GAAL,KAAK,CAAQ;IAI/B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA8B,SAAQ,cAAc;IAG7C;IACA;IAHlB;IACE,2EAA2E;IAC3D,KAAa,EACb,UAAmC,QAAQ,EAC3D,OAAO,GAAG,oCAAoC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE;QAEzF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,UAAK,GAAL,KAAK,CAAQ;QACb,YAAO,GAAP,OAAO,CAAoC;IAI7D,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4CAA4C;AAC5C,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,cAAe,SAAQ,cAAc;IAG9B;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;IAGjC,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,OAAO,cAAe,SAAQ,cAAc;IAG9B;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;IAGjC,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IAEjC;IADlB,YACkB,SAAe,EAC/B,OAAO,GAAG,oBAAoB,SAAS,CAAC,WAAW,EAAE,EAAE;QAEvD,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,cAAS,GAAT,SAAS,CAAM;IAIjC,CAAC;CACF;AAED,0DAA0D;AAC1D,MAAM,OAAO,qBAAsB,SAAQ,cAAc;IAErC;IADlB,YACkB,SAAe,EAC/B,OAAO,GAAG,6BAA6B,SAAS,CAAC,WAAW,EAAE,EAAE;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,cAAS,GAAT,SAAS,CAAM;IAIjC,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,gBAAiB,SAAQ,cAAc;IAEhC;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAc,EAC9B,OAAO,GAAG,oCAAoC,QAAQ,WAAW,MAAM,GAAG;QAE1E,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;IAIhC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IAElC;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAgB,EAChC,OAAO,GAAG,sCAAsC,QAAQ,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAEvF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAU;IAIlC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IAGnC;IAEA;IAJlB;IACE,sEAAsE;IACtD,eAAyB;IACzC,+EAA+E;IAC/D,WAAoB,EACpC,OAAO,GAAG,6BAA6B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAEnE,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,oBAAe,GAAf,eAAe,CAAU;QAEzB,gBAAW,GAAX,WAAW,CAAS;IAItC,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IAGlC;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;IAGjC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,cAAc;IAG9B;IAEA;IAJlB;IACE,6EAA6E;IAC7D,UAAkB;IAClC,qEAAqE;IACrD,SAAiB,EACjC,OAAO,GAAG,oBAAoB,UAAU,KAAK,SAAS,EAAE;QAExD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,eAAU,GAAV,UAAU,CAAQ;QAElB,cAAS,GAAT,SAAS,CAAQ;IAInC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IAE9C;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAc,EAC9B,OAAO,GAAG,0CAA0C,QAAQ,WAAW,MAAM,GAAG;QAEhF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;IAIhC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,0BAA2B,SAAQ,cAAc;IAE1C;IACA;IACA;IAHlB,YACkB,SAAiB,EACjB,OAAe,EACf,KAAa,EAC7B,OAAO,GAAG,gCAAgC,SAAS,QAAQ,OAAO,UAAU,KAAK,EAAE;QAEnF,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,cAAS,GAAT,SAAS,CAAQ;QACjB,YAAO,GAAP,OAAO,CAAQ;QACf,UAAK,GAAL,KAAK,CAAQ;IAI/B,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA8B,SAAQ,cAAc;IAG7C;IACA;IAHlB;IACE,2EAA2E;IAC3D,KAAa,EACb,UAAmC,QAAQ,EAC3D,OAAO,GAAG,oCAAoC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE;QAEzF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,UAAK,GAAL,KAAK,CAAQ;QACb,YAAO,GAAP,OAAO,CAAoC;IAI7D,CAAC;CACF"}

package/dist/hearth-client.d.ts

@@ -1,6 +1,7 @@
 import { JwksClient } from "./jwks-client.js";
 import { IntrospectionClient, type IntrospectionResult } from "./introspection-client.js";
-import type { AccessTokenAuthorizationMode, AuthorizePermissionOptions } from "./types.js";
+import type { AccessTokenAuthorizationMode, AuthorizePermissionOptions, DeviceAuthorizationResponse, TokenResponse } from "./types.js";
+import { Claims } from "./claims.js";
 /** Configuration for {@link HearthClient}. */
 export interface HearthClientConfig {
     /**
@@ -129,5 +130,69 @@ export declare class HearthClient {
      * @throws {@link AuthorizationModeMismatchError} on mode echo mismatch.
      */
     introspect(token: string): Promise<IntrospectionResult>;
+    /**
+     * Verify a JWT using JWKS-backed EdDSA/Ed25519 local signature verification (spec §2).
+     *
+     * Performs all five mandatory validation steps in order:
+     * 1. Signature against the JWKS endpoint (EdDSA/OKP/Ed25519 required; RS256/ES256 accepted).
+     * 2. `exp` claim (rejects expired tokens).
+     * 3. `iss` claim (must match configured `issuerUrl`).
+     * 4. `aud` claim (validated when `clientId` is set in config).
+     * 5. `iat` claim (within 60-second clock skew tolerance).
+     *
+     * @throws {@link TokenExpiredError} — token is expired.
+     * @throws {@link TokenInvalidError} — signature invalid or JWT malformed.
+     * @throws {@link TokenIssuerError} — issuer does not match `issuerUrl`.
+     * @throws {@link TokenAudienceError} — audience does not include `clientId`.
+     * @throws {@link JWKSFetchError} — JWKS endpoint unreachable.
+     */
+    verifyToken(token: string): Promise<Claims>;
+    /**
+     * Obtain a token via the Client Credentials grant (RFC 6749 §4.4).
+     *
+     * Sends `client_id` and `client_secret` as `application/x-www-form-urlencoded`
+     * body fields — NEVER as URL query parameters. The token endpoint is discovered
+     * from the OIDC discovery document.
+     *
+     * @throws {@link OAuthFlowError} on any non-2xx response.
+     */
+    clientCredentials(scope?: string): Promise<TokenResponse>;
+    /**
+     * Begin a Device Authorization Flow (RFC 8628 §3.1).
+     *
+     * Returns the `device_code`, `user_code`, `verification_uri`, and polling `interval`.
+     * Pass the returned `device_code` and `interval` to `pollDeviceToken()` to await approval.
+     *
+     * @throws {@link ConfigurationError} when `device_authorization_endpoint` is absent.
+     * @throws {@link OAuthFlowError} on any non-2xx response.
+     */
+    startDeviceFlow(scope?: string): Promise<DeviceAuthorizationResponse>;
+    /**
+     * Poll the token endpoint until the device flow completes (RFC 8628 §3.5).
+     *
+     * Handles `authorization_pending` by continuing to poll transparently.
+     * Handles `slow_down` by increasing the interval by 5 s per occurrence.
+     * Throws `TokenExpiredError` when the device code expires (`expired_token`).
+     *
+     * @param deviceCode - The `device_code` from `startDeviceFlow()`.
+     * @param intervalSeconds - Initial polling interval (from `startDeviceFlow().interval`).
+     * @throws {@link TokenExpiredError} — device code has expired.
+     * @throws {@link OAuthFlowError} — non-recoverable error from the server.
+     */
+    pollDeviceToken(deviceCode: string, intervalSeconds: number): Promise<TokenResponse>;
+    /**
+     * Request a magic-link / passwordless authentication email (spec §4.5.3).
+     *
+     * Always resolves silently on HTTP 202 — per enumeration-resistance requirements,
+     * the server always returns 202 whether or not the email is registered.
+     * HTTP 429 (rate limit) and other non-2xx responses throw `OAuthFlowError`.
+     *
+     * Requires `realmId` in `HearthClientConfig`.
+     *
+     * @throws {@link ConfigurationError} when `realmId` is absent.
+     * @throws {@link OAuthFlowError} on non-2xx response.
+     */
+    requestMagicLink(email: string): Promise<void>;
+    private postForm;
 }
 export {};

package/dist/hearth-client.js

@@ -1,4 +1,4 @@
-import { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, } from "./errors.js";
+import { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, OAuthFlowError, TokenExpiredError, } from "./errors.js";
 import { JwksClient } from "./jwks-client.js";
 import { IntrospectionClient, } from "./introspection-client.js";
 /**
@@ -188,5 +188,180 @@ export class HearthClient {
         }
         return result;
     }
+    // ── §2 — Token Verification (EdDSA/Ed25519) ─────────────────────────────
+    /**
+     * Verify a JWT using JWKS-backed EdDSA/Ed25519 local signature verification (spec §2).
+     *
+     * Performs all five mandatory validation steps in order:
+     * 1. Signature against the JWKS endpoint (EdDSA/OKP/Ed25519 required; RS256/ES256 accepted).
+     * 2. `exp` claim (rejects expired tokens).
+     * 3. `iss` claim (must match configured `issuerUrl`).
+     * 4. `aud` claim (validated when `clientId` is set in config).
+     * 5. `iat` claim (within 60-second clock skew tolerance).
+     *
+     * @throws {@link TokenExpiredError} — token is expired.
+     * @throws {@link TokenInvalidError} — signature invalid or JWT malformed.
+     * @throws {@link TokenIssuerError} — issuer does not match `issuerUrl`.
+     * @throws {@link TokenAudienceError} — audience does not include `clientId`.
+     * @throws {@link JWKSFetchError} — JWKS endpoint unreachable.
+     */
+    async verifyToken(token) {
+        const jc = await this.jwksClient();
+        return jc.verify(token, {
+            issuer: this.issuerUrl,
+            audience: this.clientId,
+        });
+    }
+    // ── §4.5 — OAuth Flows ───────────────────────────────────────────────────
+    /**
+     * Obtain a token via the Client Credentials grant (RFC 6749 §4.4).
+     *
+     * Sends `client_id` and `client_secret` as `application/x-www-form-urlencoded`
+     * body fields — NEVER as URL query parameters. The token endpoint is discovered
+     * from the OIDC discovery document.
+     *
+     * @throws {@link OAuthFlowError} on any non-2xx response.
+     */
+    async clientCredentials(scope) {
+        const doc = await this.discover();
+        const tokenEndpoint = doc["token_endpoint"];
+        if (!tokenEndpoint) {
+            throw new ConfigurationError("token_endpoint not found in OIDC discovery document");
+        }
+        const params = {
+            grant_type: "client_credentials",
+            client_id: this.clientId ?? "",
+            client_secret: this.clientSecret ?? "",
+        };
+        if (scope !== undefined)
+            params.scope = scope;
+        return this.postForm(tokenEndpoint, params);
+    }
+    /**
+     * Begin a Device Authorization Flow (RFC 8628 §3.1).
+     *
+     * Returns the `device_code`, `user_code`, `verification_uri`, and polling `interval`.
+     * Pass the returned `device_code` and `interval` to `pollDeviceToken()` to await approval.
+     *
+     * @throws {@link ConfigurationError} when `device_authorization_endpoint` is absent.
+     * @throws {@link OAuthFlowError} on any non-2xx response.
+     */
+    async startDeviceFlow(scope) {
+        const doc = await this.discover();
+        const deviceEndpoint = doc["device_authorization_endpoint"];
+        if (!deviceEndpoint) {
+            throw new ConfigurationError("device_authorization_endpoint not found in OIDC discovery document");
+        }
+        const params = { client_id: this.clientId ?? "" };
+        if (scope !== undefined)
+            params.scope = scope;
+        return this.postForm(deviceEndpoint, params);
+    }
+    /**
+     * Poll the token endpoint until the device flow completes (RFC 8628 §3.5).
+     *
+     * Handles `authorization_pending` by continuing to poll transparently.
+     * Handles `slow_down` by increasing the interval by 5 s per occurrence.
+     * Throws `TokenExpiredError` when the device code expires (`expired_token`).
+     *
+     * @param deviceCode - The `device_code` from `startDeviceFlow()`.
+     * @param intervalSeconds - Initial polling interval (from `startDeviceFlow().interval`).
+     * @throws {@link TokenExpiredError} — device code has expired.
+     * @throws {@link OAuthFlowError} — non-recoverable error from the server.
+     */
+    async pollDeviceToken(deviceCode, intervalSeconds) {
+        const doc = await this.discover();
+        const tokenEndpoint = doc["token_endpoint"];
+        if (!tokenEndpoint) {
+            throw new ConfigurationError("token_endpoint not found in OIDC discovery document");
+        }
+        let currentIntervalMs = intervalSeconds * 1000;
+        // Use while(true) + await-setTimeout so Vitest fake timers can control polling in tests.
+        // eslint-disable-next-line no-constant-condition
+        while (true) {
+            await new Promise((res) => setTimeout(res, currentIntervalMs));
+            const body = new URLSearchParams({
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                device_code: deviceCode,
+                client_id: this.clientId ?? "",
+            }).toString();
+            const resp = await fetch(tokenEndpoint, {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body,
+            });
+            if (resp.ok) {
+                return resp.json();
+            }
+            let errorCode = "unknown";
+            try {
+                const parsed = (await resp.json());
+                errorCode = typeof parsed["error"] === "string" ? parsed["error"] : "unknown";
+            }
+            catch { /* ignore parse failures */ }
+            if (errorCode === "authorization_pending") {
+                continue;
+            }
+            else if (errorCode === "slow_down") {
+                currentIntervalMs += 5000;
+                continue;
+            }
+            else if (errorCode === "expired_token") {
+                throw new TokenExpiredError(new Date());
+            }
+            else {
+                throw new OAuthFlowError(resp.status, errorCode);
+            }
+        }
+    }
+    /**
+     * Request a magic-link / passwordless authentication email (spec §4.5.3).
+     *
+     * Always resolves silently on HTTP 202 — per enumeration-resistance requirements,
+     * the server always returns 202 whether or not the email is registered.
+     * HTTP 429 (rate limit) and other non-2xx responses throw `OAuthFlowError`.
+     *
+     * Requires `realmId` in `HearthClientConfig`.
+     *
+     * @throws {@link ConfigurationError} when `realmId` is absent.
+     * @throws {@link OAuthFlowError} on non-2xx response.
+     */
+    async requestMagicLink(email) {
+        if (!this.realmId) {
+            throw new ConfigurationError("realmId is required for requestMagicLink");
+        }
+        const url = `${this.issuerUrl}/v1/${this.realmId}/auth/magic-link`;
+        const resp = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ email }),
+            signal: AbortSignal.timeout(this.httpTimeout),
+        });
+        if (resp.status === 202)
+            return;
+        if (!resp.ok) {
+            throw new OAuthFlowError(resp.status, `HTTP ${resp.status}`);
+        }
+    }
+    // ── Private helpers ──────────────────────────────────────────────────────
+    async postForm(endpoint, params) {
+        const resp = await fetch(endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(params).toString(),
+            signal: AbortSignal.timeout(this.httpTimeout),
+        });
+        if (!resp.ok) {
+            let errorCode = `HTTP ${resp.status}`;
+            try {
+                const parsed = (await resp.json());
+                if (typeof parsed["error"] === "string")
+                    errorCode = parsed["error"];
+            }
+            catch { /* ignore */ }
+            throw new OAuthFlowError(resp.status, errorCode);
+        }
+        return resp.json();
+    }
 }
 //# sourceMappingURL=hearth-client.js.map

package/dist/hearth-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"hearth-client.js","sourceRoot":"","sources":["../src/hearth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,mBAAmB,GAEpB,MAAM,2BAA2B,CAAC;AA4DnC;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IACvB,0CAA0C;IACjC,SAAS,CAAS;IAClB,QAAQ,CAAqB;IAC7B,YAAY,CAAqB;IACjC,OAAO,CAAqB;IAC5B,6BAA6B,CAAqB;IAC3D,wEAAwE;IAC/D,WAAW,CAAS;IAC7B,qEAAqE;IAC5D,OAAO,CAAqB;IACrC,6EAA6E;IACpE,YAAY,CAA2C;IAExD,UAAU,GAA6B,IAAI,CAAC;IAC5C,WAAW,GAAsB,IAAI,CAAC;IACtC,oBAAoB,GAA+B,IAAI,CAAC;IAEhE,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAC1B,cAAc,MAAM,CAAC,SAAS,sBAAsB,CACrD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,6BAA6B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAE5C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,wCAAwC,GAAG,EAAE,EAC7C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE;gBAC/D,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CACtB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,6BAA6B;YAClC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB,CAAC;QAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,uEAAuE;gBACrE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,CAAC;YAClD,qBAAqB,EAAE,QAAQ;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,UAAkB,EAClB,IAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,IAAI,EAAE,cAAc;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,IAAI,EAAE,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,IAAI,CAAC,OAAO;oBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wCAAwC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EACjC,CAAC;YACD,MAAM,IAAI,8BAA8B,CACtC,IAAI,CAAC,YAAY,EACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CACpB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"hearth-client.js","sourceRoot":"","sources":["../src/hearth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,mBAAmB,GAEpB,MAAM,2BAA2B,CAAC;AAkEnC;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IACvB,0CAA0C;IACjC,SAAS,CAAS;IAClB,QAAQ,CAAqB;IAC7B,YAAY,CAAqB;IACjC,OAAO,CAAqB;IAC5B,6BAA6B,CAAqB;IAC3D,wEAAwE;IAC/D,WAAW,CAAS;IAC7B,qEAAqE;IAC5D,OAAO,CAAqB;IACrC,6EAA6E;IACpE,YAAY,CAA2C;IAExD,UAAU,GAA6B,IAAI,CAAC;IAC5C,WAAW,GAAsB,IAAI,CAAC;IACtC,oBAAoB,GAA+B,IAAI,CAAC;IAEhE,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAC1B,cAAc,MAAM,CAAC,SAAS,sBAAsB,CACrD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,6BAA6B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAE5C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,wCAAwC,GAAG,EAAE,EAC7C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE;gBAC/D,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CACtB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,6BAA6B;YAClC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB,CAAC;QAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,uEAAuE;gBACrE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,CAAC;YAClD,qBAAqB,EAAE,QAAQ;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,UAAkB,EAClB,IAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,IAAI,EAAE,cAAc;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,IAAI,EAAE,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,IAAI,CAAC,OAAO;oBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wCAAwC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EACjC,CAAC;YACD,MAAM,IAAI,8BAA8B,CACtC,IAAI,CAAC,YAAY,EACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CACpB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAc;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAI,GAA+B,CAAC,gBAAgB,CAAuB,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;SACvC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAgB,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,KAAc;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,cAAc,GAAI,GAA+B,CAAC,+BAA+B,CAAuB,CAAC;QAC/G,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,kBAAkB,CAC1B,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAA8B,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,eAAuB;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAI,GAA+B,CAAC,gBAAgB,CAAuB,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,iBAAiB,GAAG,eAAe,GAAG,IAAI,CAAC;QAE/C,yFAAyF;QACzF,iDAAiD;QACjD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAErE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;aAC/B,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEd,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;aACL,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,IAAI,EAA4B,CAAC;YAC/C,CAAC;YAED,IAAI,SAAS,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAC9D,SAAS,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;YAEvC,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;iBAAM,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;gBACrC,iBAAiB,IAAI,IAAI,CAAC;gBAC1B,SAAS;YACX,CAAC;iBAAM,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,OAAO,kBAAkB,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QAChC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAEpE,KAAK,CAAC,QAAQ,CAAI,QAAgB,EAAE,MAA8B;QACxE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;YAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,SAAS,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;oBAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACxB,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF"}

package/dist/index.d.ts

@@ -3,10 +3,10 @@ export { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl, sta
 export type { BuildAuthorizationUrlOptions, AuthorizationUrlResult, StartLoginOptions, StartLoginResult, } from "./pkce.js";
 export type { HearthClientConfig } from "./hearth-client.js";
 export { JwksClient } from "./jwks-client.js";
-export type { JwksClientConfig } from "./jwks-client.js";
+export type { JwksClientConfig, VerifyOptions } from "./jwks-client.js";
 export { IntrospectionClient } from "./introspection-client.js";
 export type { IntrospectionClientConfig, IntrospectionResult, } from "./introspection-client.js";
-export { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, HearthSdkError, IntrospectionError, JWKSFetchError, RequiredActionError, SessionVersionCacheStaleError, SessionVersionRevokedError, TokenAudienceError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenNotYetValidError, } from "./errors.js";
+export { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, HearthSdkError, IntrospectionError, JWKSFetchError, OAuthFlowError, RequiredActionError, SessionVersionCacheStaleError, SessionVersionRevokedError, TokenAudienceError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenNotYetValidError, } from "./errors.js";
 export { requirePermission } from "./middleware.js";
 export type { PermissionChecker, RequirePermissionOptions } from "./middleware.js";
 export { Claims } from "./claims.js";
@@ -17,7 +17,7 @@ export { createHearth } from "./hearth.js";
 export type { HearthFacade, HearthHttpClient, HearthOptions, } from "./hearth.js";
 export { HearthContext, HearthProvider, useHasPermission, useHasRole, useInGroup, useInOrg, } from "./react.js";
 export type { HearthProviderProps } from "./react.js";
-export type { AccessTokenAuthorizationMode, AuthorizeParams, AuthorizePermissionOptions, AuthorizeResponse, BootstrapResponse, CreateRealmParams, CreateUserParams, JwksDocument, JsonWebKey, MePermissionsResponse, OAuthClient, PageResponse, RegisterClientParams, Realm, SessionVersionConfig, TokenExchangeParams, TokenResponse, UpdateRealmParams, UpdateUserParams, User, UserInfoResponse, } from "./types.js";
+export type { AccessTokenAuthorizationMode, AuthorizeParams, AuthorizePermissionOptions, AuthorizeResponse, BootstrapResponse, CreateRealmParams, CreateUserParams, JwksDocument, JsonWebKey, MePermissionsResponse, OAuthClient, PageResponse, RegisterClientParams, Realm, SessionVersionConfig, TokenExchangeParams, DeviceAuthorizationResponse, TokenResponse, UpdateRealmParams, UpdateUserParams, User, UserInfoResponse, } from "./types.js";
 export { SessionVersionCache } from "./session-version-cache.js";
 export { getAccessToken, getRefreshToken, getIdToken, isAuthenticated, clearTokens, createHearthAuth, } from "./browser-auth.js";
 export type { AuthConfig, HearthBrowserAuth } from "./browser-auth.js";

package/dist/index.js

@@ -6,7 +6,7 @@ export { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl, sta
 export { JwksClient } from "./jwks-client.js";
 export { IntrospectionClient } from "./introspection-client.js";
 // Error types (spec §5).
-export { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, HearthSdkError, IntrospectionError, JWKSFetchError, RequiredActionError, SessionVersionCacheStaleError, SessionVersionRevokedError, TokenAudienceError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenNotYetValidError, } from "./errors.js";
+export { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, HearthSdkError, IntrospectionError, JWKSFetchError, OAuthFlowError, RequiredActionError, SessionVersionCacheStaleError, SessionVersionRevokedError, TokenAudienceError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenNotYetValidError, } from "./errors.js";
 // Mode-aware middleware (HEA-923).
 export { requirePermission } from "./middleware.js";
 // Claims API (spec §4).

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qCAAqC;AACrC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,GACX,MAAM,WAAW,CAAC;AASnB,mDAAmD;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAMhE,yBAAyB;AACzB,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,mCAAmC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,wBAAwB;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,6DAA6D;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;AAyBpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,OAAO,EACL,cAAc,EACd,eAAe,EACf,UAAU,EACV,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qCAAqC;AACrC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,GACX,MAAM,WAAW,CAAC;AASnB,mDAAmD;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAMhE,yBAAyB;AACzB,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,mCAAmC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,wBAAwB;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,6DAA6D;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;AA0BpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,OAAO,EACL,cAAc,EACd,eAAe,EACf,UAAU,EACV,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}

package/dist/jwks-client.d.ts

@@ -1,4 +1,14 @@
 import type { JsonWebKey } from "./types.js";
+import { Claims } from "./claims.js";
+/** Options for {@link JwksClient.verify}. */
+export interface VerifyOptions {
+    /** Expected `iss` claim. When provided, verification fails if the token's issuer differs. */
+    issuer?: string;
+    /** Expected `aud` claim(s). Skipped when absent. */
+    audience?: string | string[];
+    /** Clock skew tolerance in seconds. Default: 60. */
+    clockSkewSeconds?: number;
+}
 /** Configuration for {@link JwksClient}. */
 export interface JwksClientConfig {
     /** URL of the JWKS endpoint (e.g. from OIDC discovery `jwks_uri`). */
@@ -6,23 +16,46 @@ export interface JwksClientConfig {
     /**
      * Override cache TTL in milliseconds.
      * When absent, the client respects `Cache-Control: max-age` from the JWKS
-     * response and falls back to 5 minutes.
+     * response and falls back to 5 minutes (300 000 ms).
      */
     ttl?: number;
     /** Timeout for outbound HTTP calls in milliseconds. Default: 10 000. */
     httpTimeout?: number;
 }
 /**
- * Low-level JWKS fetcher.
+ * JWKS-backed JWT verifier with key caching, automatic key rotation,
+ * and full EdDSA / Ed25519 signature verification (spec §2).
  *
- * Fetches the JSON Web Key Set from the configured endpoint.
- * Full caching and rotation logic will be added in §2.
+ * Uses `fetchKeys()` (global `fetch`) to retrieve JWKS, then builds a local
+ * key set via `createLocalJWKSet`. This makes the JWKS fetch mockable in tests.
+ * Keys are cached for `ttl` milliseconds; on a key miss the JWKS is re-fetched once.
  */
 export declare class JwksClient {
     private readonly jwksUri;
     readonly ttl: number | undefined;
     readonly httpTimeout: number;
+    /** Cached local key set and when it was fetched. */
+    private _cache;
     constructor(config: JwksClientConfig);
+    private getKeySet;
+    /**
+     * Verify a JWT using Ed25519/EdDSA JWKS-based local signature verification (spec §2).
+     *
+     * Executes all five spec §2 validation steps in order:
+     * 1. Signature against cached JWKS (EdDSA / RS256 / ES256).
+     * 2. `exp` — rejects expired tokens.
+     * 3. `iss` — when `options.issuer` is provided.
+     * 4. `aud` — when `options.audience` is provided.
+     * 5. `iat` — within clock skew tolerance.
+     *
+     * @throws {@link TokenExpiredError} when the token is expired.
+     * @throws {@link TokenInvalidError} when the signature or structure is invalid.
+     * @throws {@link TokenIssuerError} when the issuer does not match.
+     * @throws {@link TokenAudienceError} when the audience does not match.
+     * @throws {@link JWKSFetchError} when the JWKS endpoint cannot be reached.
+     */
+    verify(token: string, options?: VerifyOptions): Promise<Claims>;
+    private mapJoseError;
     /** Fetch the current JWKS keys from the endpoint. */
     fetchKeys(): Promise<JsonWebKey[]>;
 }

package/dist/jwks-client.js

@@ -1,25 +1,120 @@
+import { createLocalJWKSet, jwtVerify, errors as joseErrors, } from "jose";
+import { Claims } from "./claims.js";
+import { JWKSFetchError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenAudienceError, } from "./errors.js";
 /**
- * Low-level JWKS fetcher.
+ * JWKS-backed JWT verifier with key caching, automatic key rotation,
+ * and full EdDSA / Ed25519 signature verification (spec §2).
  *
- * Fetches the JSON Web Key Set from the configured endpoint.
- * Full caching and rotation logic will be added in §2.
+ * Uses `fetchKeys()` (global `fetch`) to retrieve JWKS, then builds a local
+ * key set via `createLocalJWKSet`. This makes the JWKS fetch mockable in tests.
+ * Keys are cached for `ttl` milliseconds; on a key miss the JWKS is re-fetched once.
  */
 export class JwksClient {
     jwksUri;
     ttl;
     httpTimeout;
+    /** Cached local key set and when it was fetched. */
+    _cache = null;
     constructor(config) {
         this.jwksUri = config.jwksUri;
         this.ttl = config.ttl;
         this.httpTimeout = config.httpTimeout ?? 10_000;
     }
+    async getKeySet(forceRefresh = false) {
+        const now = Date.now();
+        const maxAge = this.ttl ?? 5 * 60 * 1000;
+        if (!forceRefresh && this._cache && (now - this._cache.fetchedAt) < maxAge) {
+            return this._cache.keySet;
+        }
+        const keys = await this.fetchKeys();
+        const keySet = createLocalJWKSet({ keys: keys });
+        this._cache = { keySet: keySet, fetchedAt: now };
+        return keySet;
+    }
+    /**
+     * Verify a JWT using Ed25519/EdDSA JWKS-based local signature verification (spec §2).
+     *
+     * Executes all five spec §2 validation steps in order:
+     * 1. Signature against cached JWKS (EdDSA / RS256 / ES256).
+     * 2. `exp` — rejects expired tokens.
+     * 3. `iss` — when `options.issuer` is provided.
+     * 4. `aud` — when `options.audience` is provided.
+     * 5. `iat` — within clock skew tolerance.
+     *
+     * @throws {@link TokenExpiredError} when the token is expired.
+     * @throws {@link TokenInvalidError} when the signature or structure is invalid.
+     * @throws {@link TokenIssuerError} when the issuer does not match.
+     * @throws {@link TokenAudienceError} when the audience does not match.
+     * @throws {@link JWKSFetchError} when the JWKS endpoint cannot be reached.
+     */
+    async verify(token, options) {
+        const clockTolerance = options?.clockSkewSeconds ?? 60;
+        let keySet = await this.getKeySet();
+        const doVerify = async (ks) => {
+            const { payload } = await jwtVerify(token, ks, {
+                issuer: options?.issuer,
+                audience: options?.audience,
+                algorithms: ["EdDSA", "RS256", "ES256", "RS384", "ES384"],
+                clockTolerance,
+            });
+            return new Claims(payload);
+        };
+        try {
+            return await doVerify(keySet);
+        }
+        catch (firstErr) {
+            if (firstErr instanceof joseErrors.JWKSNoMatchingKey) {
+                // Key miss — re-fetch once to handle key rotation, then retry.
+                keySet = await this.getKeySet(true);
+                try {
+                    return await doVerify(keySet);
+                }
+                catch (retryErr) {
+                    return this.mapJoseError(retryErr, options);
+                }
+            }
+            return this.mapJoseError(firstErr, options);
+        }
+    }
+    mapJoseError(err, options) {
+        if (err instanceof joseErrors.JWTExpired) {
+            const exp = err.payload?.exp;
+            throw new TokenExpiredError(exp ? new Date(exp * 1000) : new Date(0));
+        }
+        if (err instanceof joseErrors.JWTClaimValidationFailed) {
+            const claim = err.claim;
+            if (claim === "iss") {
+                const actual = err.payload?.["iss"] ?? "";
+                throw new TokenIssuerError(options?.issuer ?? "", actual);
+            }
+            if (claim === "aud") {
+                const raw = err.payload?.["aud"];
+                const actual = Array.isArray(raw) ? raw : [String(raw ?? "")];
+                const expected = Array.isArray(options?.audience)
+                    ? options.audience[0]
+                    : (options?.audience ?? "");
+                throw new TokenAudienceError(expected, actual);
+            }
+            throw new TokenInvalidError(`JWT claim validation failed (${claim}): ${err.message}`);
+        }
+        if (err instanceof joseErrors.JWTInvalid ||
+            err instanceof joseErrors.JWSInvalid ||
+            err instanceof joseErrors.JWSSignatureVerificationFailed ||
+            err instanceof joseErrors.JWKSNoMatchingKey) {
+            throw new TokenInvalidError(err instanceof Error ? err.message : "JWT signature verification failed");
+        }
+        if (err instanceof Error) {
+            throw new TokenInvalidError(err.message);
+        }
+        throw new TokenInvalidError("Unknown token verification error");
+    }
     /** Fetch the current JWKS keys from the endpoint. */
     async fetchKeys() {
         const resp = await fetch(this.jwksUri, {
             signal: AbortSignal.timeout(this.httpTimeout),
         });
         if (!resp.ok) {
-            throw new Error(`JWKS fetch failed with HTTP ${resp.status}`);
+            throw new JWKSFetchError(`JWKS fetch failed with HTTP ${resp.status}`);
         }
         const doc = (await resp.json());
         return doc.keys;

package/dist/jwks-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwks-client.js","sourceRoot":"","sources":["../src/jwks-client.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IACJ,OAAO,CAAS;IACxB,GAAG,CAAqB;IACxB,WAAW,CAAS;IAE7B,YAAY,MAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;IAClD,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"jwks-client.js","sourceRoot":"","sources":["../src/jwks-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,MAAM,IAAI,UAAU,GACrB,MAAM,MAAM,CAAC;AAOd,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AA4BrB;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACJ,OAAO,CAAS;IACxB,GAAG,CAAqB;IACxB,WAAW,CAAS;IAC7B,oDAAoD;IAC5C,MAAM,GAAyD,IAAI,CAAC;IAE5E,YAAY,MAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,YAAY,GAAG,KAAK;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAuD,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,MAAwB,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACnE,OAAO,MAAwB,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAuB;QACjD,MAAM,cAAc,GAAG,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;QACvD,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAEpC,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAkB,EAAE,EAAE;YAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE;gBAC7C,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;gBACzD,cAAc;aACf,CAAC,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,OAAkC,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,IAAI,QAAQ,YAAY,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBACrD,+DAA+D;gBAC/D,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBAClB,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAY,EAAE,OAAuB;QACxD,IAAI,GAAG,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;YAC7B,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,GAAG,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAI,GAAG,CAAC,OAAmC,EAAE,CAAC,KAAK,CAAW,IAAI,EAAE,CAAC;gBACjF,MAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAI,GAAG,CAAC,OAAmC,EAAE,CAAC,KAAK,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC;oBAC/C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACrB,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,KAAK,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IACE,GAAG,YAAY,UAAU,CAAC,UAAU;YACpC,GAAG,YAAY,UAAU,CAAC,UAAU;YACpC,GAAG,YAAY,UAAU,CAAC,8BAA8B;YACxD,GAAG,YAAY,UAAU,CAAC,iBAAiB,EAC3C,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IAClE,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,+BAA+B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;CACF"}

package/dist/types.d.ts

@@ -29,6 +29,17 @@ export interface TokenExchangeParams {
     redirectUri: string;
     codeVerifier?: string;
 }
+/** RFC 8628 device authorization response. */
+export interface DeviceAuthorizationResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    /** Pre-filled URI with user_code (when provided by server). */
+    verification_uri_complete?: string;
+    expires_in: number;
+    /** Minimum polling interval in seconds. */
+    interval: number;
+}
 /** Response from the token exchange endpoint. */
 export interface TokenResponse {
     access_token: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hearth-auth/sdk",
-  "version": "1.0.20",
+  "version": "1.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/hearth-auth/hearth.git",