@hearth-auth/sdk 2.0.4 → 3.0.1

package/dist/hearth-client.js

@@ -1,8 +1,9 @@
 import { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, OAuthFlowError, TokenExpiredError, } from "./errors.js";
 import { JwksClient } from "./jwks-client.js";
 import { IntrospectionClient } from "./introspection-client.js";
+import { buildAuthorizationUrl, generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 /**
- * Primary entry point for the Hearth Node.js SDK.
+ * Primary entry point for the Hearth SDK.
  *
  * Accepts a single configuration object, auto-discovers all endpoint URLs
  * from `{issuerUrl}/.well-known/openid-configuration` on first use, and
@@ -25,6 +26,7 @@ export class HearthClient {
     /** Expected authorization mode; validated on `introspect()` when present. */
     expectedMode;
     _discovery = null;
+    _discoveryInFlight = null;
     _jwksClient = null;
     _introspectionClient = null;
     constructor(config) {
@@ -50,12 +52,34 @@ export class HearthClient {
      * Fetches and caches the OIDC discovery document from
      * `{issuerUrl}/.well-known/openid-configuration`.
      *
+     * Concurrent callers share one request. A failed fetch is not cached.
+     *
      * Throws {@link DiscoveryError} when the endpoint is unreachable,
      * returns a non-2xx status, or returns invalid JSON.
      */
     async discover() {
         if (this._discovery)
             return this._discovery;
+        if (!this._discoveryInFlight) {
+            this._discoveryInFlight = this.fetchDiscovery().finally(() => {
+                this._discoveryInFlight = null;
+            });
+        }
+        return this._discoveryInFlight;
+    }
+    /**
+     * Drop the cached discovery document, JWKS key set and introspection client.
+     * The next call fetches them again. Call it after the issuer rotates keys or
+     * changes endpoints, or after a resource server answers 401 for a token you
+     * believe is valid.
+     */
+    invalidateCache() {
+        this._discovery = null;
+        this._discoveryInFlight = null;
+        this._jwksClient = null;
+        this._introspectionClient = null;
+    }
+    async fetchDiscovery() {
         const url = `${this.issuerUrl}/.well-known/openid-configuration`;
         let resp;
         try {
@@ -178,12 +202,14 @@ export class HearthClient {
      * deployments where the resource server and the issuing client disagree on
      * the permission delivery strategy.
      *
+     * @param tokenTypeHint - Optional RFC 7662 `token_type_hint`.
      * @throws {@link ConfigurationError} when `clientId`/`clientSecret` are absent.
+     * @throws {@link IntrospectionError} when the introspection request fails.
      * @throws {@link AuthorizationModeMismatchError} on mode echo mismatch.
      */
-    async introspect(token) {
+    async introspect(token, tokenTypeHint) {
         const ic = await this.introspectionClient();
-        const result = await ic.introspect(token);
+        const result = await ic.introspect(token, tokenTypeHint);
         if (this.expectedMode !== undefined &&
             result.mode !== undefined &&
             result.mode !== this.expectedMode) {
@@ -205,7 +231,8 @@ export class HearthClient {
      * 3. `nbf` claim (rejects post-dated tokens).
      * 4. `iss` claim (must match configured `issuerUrl`).
      * 5. `aud` claim (validated when `clientId` is set in config).
-     * 6. `iat` claim (within 60-second clock skew tolerance).
+     *
+     * `exp` and `nbf` allow a 5-second clock skew.
      *
      * @throws {@link TokenExpiredError} — token is expired.
      * @throws {@link TokenInvalidError} — signature invalid or JWT malformed.
@@ -221,6 +248,89 @@ export class HearthClient {
         });
     }
     // ── §4.5 — OAuth Flows ───────────────────────────────────────────────────
+    /**
+     * Begin an authorization-code login with PKCE.
+     *
+     * Generates a code verifier and a `state` value and builds the URL of the
+     * discovered `authorization_endpoint`. Store `state` and `codeVerifier` in the
+     * server-side session, redirect the browser to `authorizationUrl`, then call
+     * {@link completeLogin} on the callback route.
+     *
+     * @param redirectUri - Callback URL registered for this client.
+     * @param scope - Space-delimited scopes. Default: `"openid"`.
+     * @throws {@link ConfigurationError} when `clientId` is absent or discovery has
+     *   no `authorization_endpoint`.
+     */
+    async beginLogin(redirectUri, scope = "openid") {
+        const clientId = this.requireClientId("beginLogin");
+        const authorizationEndpoint = await this.endpoint("authorization_endpoint");
+        const codeVerifier = generateCodeVerifier();
+        const { url, state } = buildAuthorizationUrl({
+            authorizationEndpoint,
+            clientId,
+            redirectUri,
+            codeChallenge: await generateCodeChallenge(codeVerifier),
+            scope,
+        });
+        return { authorizationUrl: url, state, codeVerifier };
+    }
+    /**
+     * Complete an authorization-code login: exchange the callback `code` for
+     * tokens. Check the callback's `state` against the stored one first.
+     *
+     * @param code - The `code` query parameter from the callback URL.
+     * @param codeVerifier - The verifier returned by {@link beginLogin}.
+     * @param redirectUri - The same redirect URI passed to {@link beginLogin}.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
+     */
+    async completeLogin(code, codeVerifier, redirectUri) {
+        return this.exchangeCode(code, redirectUri, { codeVerifier });
+    }
+    /**
+     * Exchange an authorization code for tokens (RFC 6749 §4.1.3).
+     *
+     * Posts to the discovered `token_endpoint` as
+     * `application/x-www-form-urlencoded`. `client_secret` is sent only when
+     * configured, so public clients use PKCE alone.
+     *
+     * @param code - Authorization code from the callback URL.
+     * @param redirectUri - The redirect URI used in the authorization request.
+     * @param opts - `codeVerifier` for PKCE-protected flows.
+     * @throws {@link ConfigurationError} when `clientId` is absent.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
+     */
+    async exchangeCode(code, redirectUri, opts) {
+        const params = {
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: redirectUri,
+            ...this.clientAuthParams("exchangeCode"),
+        };
+        if (opts?.codeVerifier)
+            params.code_verifier = opts.codeVerifier;
+        return this.postForm(await this.endpoint("token_endpoint"), params);
+    }
+    /**
+     * Exchange a refresh token for new tokens (RFC 6749 §6).
+     *
+     * The response may carry a rotated `refresh_token`; store it in place of the
+     * old one when present.
+     *
+     * @param refreshToken - Refresh token previously issued to this client.
+     * @param scope - Optional space-delimited scopes (must not widen the grant).
+     * @throws {@link ConfigurationError} when `clientId` is absent.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
+     */
+    async refreshTokens(refreshToken, scope) {
+        const params = {
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            ...this.clientAuthParams("refreshTokens"),
+        };
+        if (scope !== undefined)
+            params.scope = scope;
+        return this.postForm(await this.endpoint("token_endpoint"), params);
+    }
     /**
      * Obtain a token via the Client Credentials grant (RFC 6749 §4.4).
      *
@@ -228,14 +338,9 @@ export class HearthClient {
      * body fields — NEVER as URL query parameters. The token endpoint is discovered
      * from the OIDC discovery document.
      *
-     * @throws {@link OAuthFlowError} on any non-2xx response.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
      */
     async clientCredentials(scope) {
-        const doc = await this.discover();
-        const tokenEndpoint = doc["token_endpoint"];
-        if (!tokenEndpoint) {
-            throw new ConfigurationError("token_endpoint not found in OIDC discovery document");
-        }
         const params = {
             grant_type: "client_credentials",
             client_id: this.clientId ?? "",
@@ -243,7 +348,7 @@ export class HearthClient {
         };
         if (scope !== undefined)
             params.scope = scope;
-        return this.postForm(tokenEndpoint, params);
+        return this.postForm(await this.endpoint("token_endpoint"), params);
     }
     /**
      * Begin a Device Authorization Flow (RFC 8628 §3.1).
@@ -252,18 +357,13 @@ export class HearthClient {
      * Pass the returned `device_code` and `interval` to `pollDeviceToken()` to await approval.
      *
      * @throws {@link ConfigurationError} when `device_authorization_endpoint` is absent.
-     * @throws {@link OAuthFlowError} on any non-2xx response.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
      */
     async startDeviceFlow(scope) {
-        const doc = await this.discover();
-        const deviceEndpoint = doc["device_authorization_endpoint"];
-        if (!deviceEndpoint) {
-            throw new ConfigurationError("device_authorization_endpoint not found in OIDC discovery document");
-        }
         const params = { client_id: this.clientId ?? "" };
         if (scope !== undefined)
             params.scope = scope;
-        return this.postForm(deviceEndpoint, params);
+        return this.postForm(await this.endpoint("device_authorization_endpoint"), params);
     }
     /**
      * Poll the token endpoint until the device flow completes (RFC 8628 §3.5).
@@ -275,51 +375,33 @@ export class HearthClient {
      * @param deviceCode - The `device_code` from `startDeviceFlow()`.
      * @param intervalSeconds - Initial polling interval (from `startDeviceFlow().interval`).
      * @throws {@link TokenExpiredError} — device code has expired.
-     * @throws {@link OAuthFlowError} — non-recoverable error from the server.
+     * @throws {@link OAuthFlowError} — non-recoverable error from the server, or a network failure.
      */
     async pollDeviceToken(deviceCode, intervalSeconds) {
-        const doc = await this.discover();
-        const tokenEndpoint = doc["token_endpoint"];
-        if (!tokenEndpoint) {
-            throw new ConfigurationError("token_endpoint not found in OIDC discovery document");
-        }
+        const tokenEndpoint = await this.endpoint("token_endpoint");
         let currentIntervalMs = intervalSeconds * 1000;
         // Use while(true) + await-setTimeout so Vitest fake timers can control polling in tests.
         while (true) {
             await new Promise((res) => setTimeout(res, currentIntervalMs));
-            const body = new URLSearchParams({
-                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-                device_code: deviceCode,
-                client_id: this.clientId ?? "",
-            }).toString();
-            const resp = await fetch(tokenEndpoint, {
-                method: "POST",
-                headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                body,
-            });
-            if (resp.ok) {
-                return resp.json();
-            }
-            let errorCode = "unknown";
             try {
-                const parsed = (await resp.json());
-                errorCode = typeof parsed["error"] === "string" ? parsed["error"] : "unknown";
-            }
-            catch {
-                /* ignore parse failures */
-            }
-            if (errorCode === "authorization_pending") {
-                continue;
-            }
-            else if (errorCode === "slow_down") {
-                currentIntervalMs += 5000;
-                continue;
-            }
-            else if (errorCode === "expired_token") {
-                throw new TokenExpiredError(new Date());
+                return await this.postForm(tokenEndpoint, {
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    device_code: deviceCode,
+                    client_id: this.clientId ?? "",
+                });
             }
-            else {
-                throw new OAuthFlowError(resp.status, errorCode);
+            catch (err) {
+                if (!(err instanceof OAuthFlowError))
+                    throw err;
+                if (err.errorCode === "authorization_pending")
+                    continue;
+                if (err.errorCode === "slow_down") {
+                    currentIntervalMs += 5000;
+                    continue;
+                }
+                if (err.errorCode === "expired_token")
+                    throw new TokenExpiredError(new Date());
+                throw err;
             }
         }
     }
@@ -333,24 +415,19 @@ export class HearthClient {
      * Requires `realmId` in `HearthClientConfig`.
      *
      * @throws {@link ConfigurationError} when `realmId` is absent.
-     * @throws {@link OAuthFlowError} on non-2xx response.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
      */
     async requestMagicLink(email) {
         if (!this.realmId) {
             throw new ConfigurationError("realmId is required for requestMagicLink");
         }
-        const url = `${this.issuerUrl}/v1/${this.realmId}/auth/magic-link`;
-        const resp = await fetch(url, {
+        const resp = await this.send(`${this.issuerUrl}/v1/${this.realmId}/auth/magic-link`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ email }),
-            signal: AbortSignal.timeout(this.httpTimeout),
         });
-        if (resp.status === 202)
-            return;
-        if (!resp.ok) {
-            throw new OAuthFlowError(resp.status, `HTTP ${resp.status}`);
-        }
+        if (!resp.ok)
+            throw await oauthFlowError(resp);
     }
     /**
      * Exchange a magic-link token for tokens (spec §4.5.3 / §7.2 C-12).
@@ -364,40 +441,158 @@ export class HearthClient {
      * @throws {@link OAuthFlowError} on any non-2xx response (e.g. expired/used token).
      */
     async exchangeMagicLink(token) {
-        const doc = await this.discover();
-        const tokenEndpoint = doc["token_endpoint"];
-        if (!tokenEndpoint) {
-            throw new ConfigurationError("token_endpoint not found in OIDC discovery document");
-        }
         const params = {
             grant_type: "urn:hearth:grant-type:magic-link",
             token,
         };
         if (this.clientId)
             params.client_id = this.clientId;
-        return this.postForm(tokenEndpoint, params);
+        return this.postForm(await this.endpoint("token_endpoint"), params);
+    }
+    // ── UserInfo, live permissions and the session-version feed ─────────────
+    /**
+     * Fetch the OIDC userinfo claims for an access token from the discovered
+     * `userinfo_endpoint`. Sends `X-Realm-ID` when `realmId` is configured.
+     *
+     * @throws {@link ConfigurationError} when discovery has no `userinfo_endpoint`.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
+     */
+    async userinfo(accessToken) {
+        const endpoint = await this.endpoint("userinfo_endpoint");
+        return this.getRequired(endpoint, accessToken);
+    }
+    /**
+     * Fetch the user's current roles, groups and permissions from
+     * `GET /v1/me/permissions`. Unlike the claims in the JWT, which are fixed
+     * when the token is issued, this reflects assignments made since.
+     *
+     * @throws {@link ConfigurationError} when `realmId` is absent.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
+     */
+    async mePermissions(accessToken) {
+        this.requireRealmId("mePermissions");
+        const url = `${this.issuerUrl}/v1/me/permissions`;
+        return this.getRequired(url, accessToken);
+    }
+    /**
+     * Fetch the full session-version snapshot (RFC HEA-930): every
+     * `{sessionId → minSv}` pair in the realm. Use it to seed a cache, then
+     * follow {@link svDelta} from `current_seq`. {@link SessionVersionCache} does
+     * both for you.
+     *
+     * @param serviceToken - Token with the `hearth.sv_feed` scope.
+     * @throws {@link ConfigurationError} when `realmId` is absent.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
+     */
+    async svSnapshot(serviceToken) {
+        this.requireRealmId("svSnapshot");
+        const url = `${this.issuerUrl}/oauth/session-versions/snapshot`;
+        return this.getRequired(url, serviceToken);
+    }
+    /**
+     * Fetch session-version changes with `seq > since` (RFC HEA-930).
+     *
+     * @param serviceToken - Token with the `hearth.sv_feed` scope.
+     * @param since - Return only events after this sequence number.
+     * @param limit - Maximum number of entries (server default when omitted).
+     * @returns The deltas, or `null` when there are none (HTTP 204).
+     * @throws {@link ConfigurationError} when `realmId` is absent.
+     * @throws {@link OAuthFlowError} on a non-2xx response or a network failure.
+     */
+    async svDelta(serviceToken, since, limit) {
+        this.requireRealmId("svDelta");
+        const url = new URL(`${this.issuerUrl}/oauth/session-versions`);
+        url.searchParams.set("since", String(since));
+        if (limit !== undefined)
+            url.searchParams.set("limit", String(limit));
+        return this.getWithBearer(url.toString(), serviceToken);
     }
     // ── Private helpers ──────────────────────────────────────────────────────
+    requireClientId(method) {
+        if (!this.clientId)
+            throw new ConfigurationError(`clientId is required for ${method}()`);
+        return this.clientId;
+    }
+    requireRealmId(method) {
+        if (!this.realmId)
+            throw new ConfigurationError(`realmId is required for ${method}()`);
+        return this.realmId;
+    }
+    /** `client_id`, plus `client_secret` when this is a confidential client. */
+    clientAuthParams(method) {
+        const params = { client_id: this.requireClientId(method) };
+        if (this.clientSecret)
+            params.client_secret = this.clientSecret;
+        return params;
+    }
+    /** Read an endpoint URL from the discovery document. */
+    async endpoint(field) {
+        const value = (await this.discover())[field];
+        if (typeof value !== "string" || value === "") {
+            throw new ConfigurationError(`${field} not found in OIDC discovery document`);
+        }
+        return value;
+    }
+    /** `fetch` with the configured timeout; a network failure becomes `OAuthFlowError(0)`. */
+    async send(url, init) {
+        try {
+            return await fetch(url, { ...init, signal: AbortSignal.timeout(this.httpTimeout) });
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            throw new OAuthFlowError(0, "request_failed", `Request to ${url} failed: ${detail}`);
+        }
+    }
     async postForm(endpoint, params) {
-        const resp = await fetch(endpoint, {
+        const resp = await this.send(endpoint, {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: new URLSearchParams(params).toString(),
-            signal: AbortSignal.timeout(this.httpTimeout),
         });
-        if (!resp.ok) {
-            let errorCode = `HTTP ${resp.status}`;
-            try {
-                const parsed = (await resp.json());
-                if (typeof parsed["error"] === "string")
-                    errorCode = parsed["error"];
-            }
-            catch {
-                /* ignore */
-            }
-            throw new OAuthFlowError(resp.status, errorCode);
+        if (!resp.ok)
+            throw await oauthFlowError(resp);
+        return resp.json();
+    }
+    /** GET with a bearer token, for endpoints that must return a body. */
+    async getRequired(url, token) {
+        const result = await this.getWithBearer(url, token);
+        if (result === null) {
+            throw new OAuthFlowError(204, "no_content", `${url} answered 204 No Content`);
         }
+        return result;
+    }
+    /** GET with a bearer token; `null` on 204 No Content. */
+    async getWithBearer(url, token) {
+        const headers = { Authorization: `Bearer ${token}` };
+        if (this.realmId)
+            headers["X-Realm-ID"] = this.realmId;
+        const resp = await this.send(url, { headers });
+        if (resp.status === 204)
+            return null;
+        if (!resp.ok)
+            throw await oauthFlowError(resp);
         return resp.json();
     }
 }
+/**
+ * Build an {@link OAuthFlowError} from a non-2xx response, taking `error` and
+ * `error_description` from an RFC 6749 §5.2 JSON body when there is one.
+ */
+async function oauthFlowError(resp) {
+    let errorCode = `HTTP ${resp.status}`;
+    let description;
+    try {
+        const parsed = (await resp.json());
+        if (typeof parsed["error"] === "string")
+            errorCode = parsed["error"];
+        if (typeof parsed["error_description"] === "string") {
+            description = parsed["error_description"];
+        }
+    }
+    catch {
+        /* body is not JSON */
+    }
+    const message = `OAuth flow error ${resp.status}: ${errorCode}${description ? ` (${description})` : ""}`;
+    return new OAuthFlowError(resp.status, errorCode, message);
+}
 //# sourceMappingURL=hearth-client.js.map

package/dist/hearth-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"hearth-client.js","sourceRoot":"","sources":["../src/hearth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAA4B,MAAM,2BAA2B,CAAC;AAkE1F;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IACvB,0CAA0C;IACjC,SAAS,CAAS;IAClB,QAAQ,CAAqB;IAC7B,YAAY,CAAqB;IACjC,OAAO,CAAqB;IAC5B,6BAA6B,CAAqB;IAC3D,wEAAwE;IAC/D,WAAW,CAAS;IAC7B,qEAAqE;IAC5D,OAAO,CAAqB;IACrC,6EAA6E;IACpE,YAAY,CAA2C;IAExD,UAAU,GAA6B,IAAI,CAAC;IAC5C,WAAW,GAAsB,IAAI,CAAC;IACtC,oBAAoB,GAA+B,IAAI,CAAC;IAEhE,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,cAAc,MAAM,CAAC,SAAS,sBAAsB,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,6BAA6B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAE5C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,wCAAwC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE;gBAC/D,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CAAC,6DAA6D,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,oEAAoE;YACpE,+CAA+C;YAC/C,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB,CAAC;QAEvF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,uEAAuE;gBACrE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,CAAC;YAClD,qBAAqB,EAAE,QAAQ;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,UAAkB,EAClB,IAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,IAAI,EAAE,cAAc;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,IAAI,EAAE,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,IAAI,CAAC,OAAO;oBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wCAAwC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EACjC,CAAC;YACD,MAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAc;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAI,GAA+B,CAAC,gBAAgB,CAAuB,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;SACvC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAgB,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,KAAc;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,cAAc,GAAI,GAA+B,CAAC,+BAA+B,CACnE,CAAC;QACrB,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,kBAAkB,CAC1B,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAA8B,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,eAAuB;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAI,GAA+B,CAAC,gBAAgB,CAAuB,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,iBAAiB,GAAG,eAAe,GAAG,IAAI,CAAC;QAE/C,yFAAyF;QACzF,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAErE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;aAC/B,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEd,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;aACL,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,IAAI,EAA4B,CAAC;YAC/C,CAAC;YAED,IAAI,SAAS,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAC9D,SAAS,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,2BAA2B;YAC7B,CAAC;YAED,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;iBAAM,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;gBACrC,iBAAiB,IAAI,IAAI,CAAC;gBAC1B,SAAS;YACX,CAAC;iBAAM,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,OAAO,kBAAkB,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QAChC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAI,GAA+B,CAAC,gBAAgB,CAAuB,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,kCAAkC;YAC9C,KAAK;SACN,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAgB,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAEpE,KAAK,CAAC,QAAQ,CAAI,QAAgB,EAAE,MAA8B;QACxE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;YAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,SAAS,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;oBAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"hearth-client.js","sourceRoot":"","sources":["../src/hearth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAA4B,MAAM,2BAA2B,CAAC;AAc1F,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAuE/F;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IACvB,0CAA0C;IACjC,SAAS,CAAS;IAClB,QAAQ,CAAqB;IAC7B,YAAY,CAAqB;IACjC,OAAO,CAAqB;IAC5B,6BAA6B,CAAqB;IAC3D,wEAAwE;IAC/D,WAAW,CAAS;IAC7B,qEAAqE;IAC5D,OAAO,CAAqB;IACrC,6EAA6E;IACpE,YAAY,CAA2C;IAExD,UAAU,GAA6B,IAAI,CAAC;IAC5C,kBAAkB,GAAsC,IAAI,CAAC;IAC7D,WAAW,GAAsB,IAAI,CAAC;IACtC,oBAAoB,GAA+B,IAAI,CAAC;IAEhE,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,cAAc,MAAM,CAAC,SAAS,sBAAsB,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,6BAA6B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC3D,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,wCAAwC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE;gBAC/D,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CAAC,6DAA6D,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,oEAAoE;YACpE,+CAA+C;YAC/C,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB,CAAC;QAEvF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,uEAAuE;gBACrE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,CAAC;YAClD,qBAAqB,EAAE,QAAQ;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,UAAkB,EAClB,IAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,IAAI,EAAE,cAAc;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,IAAI,EAAE,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,IAAI,CAAC,OAAO;oBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wCAAwC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,UAAU,CACd,KAAa,EACb,aAAgD;QAEhD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACzD,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EACjC,CAAC;YACD,MAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,KAAK,GAAG,QAAQ;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC;YAC3C,qBAAqB;YACrB,QAAQ;YACR,WAAW;YACX,aAAa,EAAE,MAAM,qBAAqB,CAAC,YAAY,CAAC;YACxD,KAAK;SACN,CAAC,CAAC;QACH,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACxD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,YAAoB,EACpB,WAAmB;QAEnB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,WAAmB,EACnB,IAA0B;QAE1B,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC;SACzC,CAAC;QACF,IAAI,IAAI,EAAE,YAAY;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QACjE,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,KAAc;QACtD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,GAAG,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;SAC1C,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAc;QACpC,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;SACvC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,KAAc;QAClC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EACpD,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,eAAuB;QAC/D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC5D,IAAI,iBAAiB,GAAG,eAAe,GAAG,IAAI,CAAC;QAE/C,yFAAyF;QACzF,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAErE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAgB,aAAa,EAAE;oBACvD,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU;oBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;iBAC/B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,cAAc,CAAC;oBAAE,MAAM,GAAG,CAAC;gBAChD,IAAI,GAAG,CAAC,SAAS,KAAK,uBAAuB;oBAAE,SAAS;gBACxD,IAAI,GAAG,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;oBAClC,iBAAiB,IAAI,IAAI,CAAC;oBAC1B,SAAS;gBACX,CAAC;gBACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe;oBAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC/E,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,OAAO,kBAAkB,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,kCAAkC;YAC9C,KAAK;SACN,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,2EAA2E;IAE3E;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAmB,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,oBAAoB,CAAC;QAClD,OAAO,IAAI,CAAC,WAAW,CAAwB,GAAG,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,YAAoB;QACnC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,kCAAkC,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAqB,GAAG,EAAE,YAAY,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,KAAa,EACb,KAAc;QAEd,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,yBAAyB,CAAC,CAAC;QAChE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,aAAa,CAAkB,GAAG,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;IAC3E,CAAC;IAED,4EAA4E;IAEpE,eAAe,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,MAAM,IAAI,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,MAAM,IAAI,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4EAA4E;IACpE,gBAAgB,CAAC,MAAc;QACrC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACnF,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACzC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,kBAAkB,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAAiB;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,cAAc,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,GAAG,YAAY,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAI,QAAgB,EAAE,MAA8B;QACxE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,WAAW,CAAI,GAAW,EAAE,KAAa;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,GAAG,0BAA0B,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yDAAyD;IACjD,KAAK,CAAC,aAAa,CAAI,GAAW,EAAE,KAAa;QACvD,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7E,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,IAAc;IAC1C,IAAI,SAAS,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;IACtC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,OAAO,MAAM,CAAC,mBAAmB,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpD,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,IAAI,CAAC,MAAM,KAAK,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzG,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}

package/dist/index.d.ts

@@ -1,23 +1,24 @@
 export { HearthClient } from "./hearth-client.js";
 export { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl, startLogin, } from "./pkce.js";
 export type { BuildAuthorizationUrlOptions, AuthorizationUrlResult, StartLoginOptions, StartLoginResult, } from "./pkce.js";
-export type { HearthClientConfig } from "./hearth-client.js";
+export type { HearthClientConfig, OidcConfiguration } from "./hearth-client.js";
 export { JwksClient } from "./jwks-client.js";
 export type { JwksClientConfig, VerifyOptions } from "./jwks-client.js";
 export { IntrospectionClient } from "./introspection-client.js";
 export type { IntrospectionClientConfig, IntrospectionResult } from "./introspection-client.js";
-export { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, HearthSdkError, IntrospectionError, JWKSFetchError, OAuthFlowError, RequiredActionError, SessionVersionCacheStaleError, SessionVersionRevokedError, TokenAudienceError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenNotYetValidError, } from "./errors.js";
-export { requirePermission } from "./middleware.js";
-export type { PermissionChecker, RequirePermissionOptions } from "./middleware.js";
+export { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, HearthSdkError, IntrospectionError, JWKSFetchError, OAuthFlowError, RequiredActionError, SessionVersionCacheStaleError, SessionVersionRevokedError, TokenAudienceError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenNotYetValidError, TokenVerificationError, } from "./errors.js";
+export { assertMiddlewareOptions, authenticateRequest, hearthFastifyHook, hearthMiddleware, requirePermission, } from "./middleware.js";
+export type { FastifyReplyLike, FastifyRequestLike, HearthAuthErrorBody, HearthAuthResult, HearthMiddlewareOptions, MiddlewareRequest, MiddlewareResponse, PermissionChecker, RequirePermissionOptions, } from "./middleware.js";
 export { Claims } from "./claims.js";
 export { HearthApiClient, HearthError } from "./client.js";
 export type { HearthApiClientConfig, HandleCallbackParams } from "./client.js";
 export { AdminClient } from "./admin.js";
+export type { AdminApplication, AdminGroup, AdminRole, CreateApplicationParams, CreateGroupParams, CreateOrganizationParams, CreateRoleParams, Organization, UpdateApplicationParams, UpdateGroupParams, UpdateOrganizationParams, UpdateRoleParams, } from "./admin.js";
 export { createHearth } from "./hearth.js";
 export type { HearthFacade, HearthHttpClient, HearthOptions } from "./hearth.js";
 export { HearthContext, HearthProvider, useHasPermission, useHasRole, useInGroup, useInOrg, } from "./react.js";
 export type { HearthProviderProps } from "./react.js";
-export type { AccessTokenAuthorizationMode, AuthorizeParams, AuthorizePermissionOptions, AuthorizeResponse, BootstrapResponse, CreateUserParams, JwksDocument, JsonWebKey, MePermissionsResponse, OAuthClient, PageResponse, RegisterClientParams, Realm, SessionVersionConfig, StepUpAssertion, StepUpProof, TokenExchangeParams, DeviceAuthorizationResponse, TokenResponse, UpdateRealmParams, UpdateUserParams, User, UserInfoResponse, WebAuthnAllowCredential, WebAuthnRegistrationBeginResponse, WebAuthnRegistrationCompleteRequest, WebAuthnRegistrationCompleteResponse, WebAuthnAuthenticationBeginResponse, WebAuthnAuthenticationCompleteRequest, } from "./types.js";
+export type { AccessTokenAuthorizationMode, AuthorizeParams, AuthorizePermissionOptions, AuthorizeResponse, BootstrapResponse, CreateUserParams, ExchangeCodeOptions, JwksDocument, JsonWebKey, LoginBeginResult, MePermissionsResponse, OAuthClient, PageOptions, PageResponse, RegisterClientParams, Realm, SessionVersionConfig, StepUpAssertion, StepUpProof, SvDeltaEntry, SvDeltaResponse, SvSnapshotResponse, TokenExchangeParams, DeviceAuthorizationResponse, TokenResponse, UpdateRealmParams, UpdateUserParams, UserStatus, User, UserInfoResponse, WebAuthnAllowCredential, WebAuthnRegistrationBeginResponse, WebAuthnRegistrationCompleteRequest, WebAuthnRegistrationCompleteResponse, WebAuthnAuthenticationBeginResponse, WebAuthnAuthenticationCompleteRequest, } from "./types.js";
 export { SessionVersionCache } from "./session-version-cache.js";
 export { getAccessToken, getRefreshToken, getIdToken, isAuthenticated, clearTokens, createHearthAuth, } from "./browser-auth.js";
 export type { AuthConfig, HearthBrowserAuth } from "./browser-auth.js";

package/dist/index.js

@@ -6,9 +6,10 @@ export { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl, sta
 export { JwksClient } from "./jwks-client.js";
 export { IntrospectionClient } from "./introspection-client.js";
 // Error types (spec §5).
-export { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, HearthSdkError, IntrospectionError, JWKSFetchError, OAuthFlowError, RequiredActionError, SessionVersionCacheStaleError, SessionVersionRevokedError, TokenAudienceError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenNotYetValidError, } from "./errors.js";
-// Mode-aware middleware (HEA-923).
-export { requirePermission } from "./middleware.js";
+export { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, HearthSdkError, IntrospectionError, JWKSFetchError, OAuthFlowError, RequiredActionError, SessionVersionCacheStaleError, SessionVersionRevokedError, TokenAudienceError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenNotYetValidError, TokenVerificationError, } from "./errors.js";
+// Mode-aware permission checks and request middleware (HEA-923).
+// Next.js helpers live at `@hearth-auth/sdk/nextjs` and `@hearth-auth/sdk/nextjs/edge`.
+export { assertMiddlewareOptions, authenticateRequest, hearthFastifyHook, hearthMiddleware, requirePermission, } from "./middleware.js";
 // Claims API (spec §4).
 export { Claims } from "./claims.js";
 // Lower-level API client (kept for backwards-compatibility).

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qCAAqC;AACrC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,GACX,MAAM,WAAW,CAAC;AASnB,mDAAmD;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,yBAAyB;AACzB,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,mCAAmC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,wBAAwB;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,6DAA6D;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;AAiCpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,OAAO,EACL,cAAc,EACd,eAAe,EACf,UAAU,EACV,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qCAAqC;AACrC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,GACX,MAAM,WAAW,CAAC;AASnB,mDAAmD;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,yBAAyB;AACzB,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,iEAAiE;AACjE,wFAAwF;AACxF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAazB,wBAAwB;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,6DAA6D;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAezC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;AAwCpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,OAAO,EACL,cAAc,EACd,eAAe,EACf,UAAU,EACV,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}

package/dist/introspection-client.d.ts

@@ -46,7 +46,7 @@ export interface IntrospectionClientConfig {
  * Low-level RFC 7662 token introspection client.
  *
  * Results are never cached — per RFC 7662 §2.1, token state can change
- * at any time. Full error taxonomy will be added in §3.
+ * at any time.
  */
 export declare class IntrospectionClient {
     private readonly endpoint;
@@ -54,6 +54,12 @@ export declare class IntrospectionClient {
     private readonly clientSecret;
     readonly httpTimeout: number;
     constructor(config: IntrospectionClientConfig);
-    /** Introspect a token. Never cached per RFC 7662 §2.1. */
-    introspect(token: string): Promise<IntrospectionResult>;
+    /**
+     * Introspect a token. Never cached per RFC 7662 §2.1.
+     *
+     * @param tokenTypeHint - Optional RFC 7662 `token_type_hint`.
+     * @throws {@link IntrospectionError} when the request fails, the endpoint
+     *   answers non-2xx, or the response is not JSON.
+     */
+    introspect(token: string, tokenTypeHint?: "access_token" | "refresh_token"): Promise<IntrospectionResult>;
 }