@hearth-auth/sdk 2.0.4 → 3.0.1

package/dist/nextjs/index.js

@@ -0,0 +1,55 @@
+/**
+ * `@hearth-auth/sdk/nextjs` — Next.js helpers for the Node.js runtime
+ * (Pages Router API routes and App Router Route Handlers).
+ *
+ * For `middleware.ts`, which runs on the Edge Runtime, import
+ * `hearthEdgeMiddleware` from `@hearth-auth/sdk/nextjs/edge`.
+ */
+import { hearthMiddleware } from "../middleware.js";
+/**
+ * Wrap a Pages Router API route with Hearth authentication.
+ *
+ * Verifies the `Authorization: Bearer` token, applies the guards in `options`,
+ * sets `req.hearthClaims` and calls `handler`. When the request fails it
+ * answers 401 or 403 and `handler` is not called.
+ *
+ * @throws {@link ConfigurationError} when the client cannot serve the mode.
+ */
+export function withHearthAuth(handler, options) {
+    const middleware = hearthMiddleware(options);
+    return async (req, res) => {
+        let proceed = false;
+        let failure;
+        await middleware(req, res, (err) => {
+            if (err === undefined)
+                proceed = true;
+            else
+                failure = err;
+        });
+        if (failure !== undefined)
+            throw failure;
+        if (proceed)
+            await handler(req, res);
+    };
+}
+/**
+ * Verify the bearer token on an App Router Route Handler request.
+ *
+ * Returns the verified {@link Claims}, or `null` when the `Authorization`
+ * header is missing or not a bearer token, the token does not verify, or the
+ * token is a `required_action` token. Create the {@link HearthClient} once at
+ * module scope so its JWKS cache is shared across requests.
+ */
+export async function getHearthClaims(req, client) {
+    const match = /^Bearer[ ]+(\S+)\s*$/i.exec(req.headers.get("authorization") ?? "");
+    if (!match)
+        return null;
+    try {
+        const claims = await client.verifyToken(match[1]);
+        return claims.tokenType() === "required_action" ? null : claims;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/nextjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nextjs/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA4BpD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA6B,EAC7B,OAAgC;IAEhC,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAiB,EAAE;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAgB,CAAC;QACrB,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAa,EAAE,EAAE;YAC3C,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,IAAI,CAAC;;gBACjC,OAAO,GAAG,GAAG,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC;QACzC,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgB,EAChB,MAAoB;IAEpB,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,SAAS,EAAE,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/session-version-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-version-cache.js","sourceRoot":"","sources":["../src/session-version-cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAqBxF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,mBAAmB;IACb,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,GAAG,CAAuB;IAC1B,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,aAAa,GAAG,CAAC,CAAC;IAClB,GAAG,GAAG,CAAC,CAAC;IACR,SAAS,GAAyC,IAAI,CAAC;IAE/D,YAAY,OAAe,EAAE,OAAe,EAAE,GAAyB;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CACV,qEAAqE;gBACnE,UAAU,IAAI,CAAC,GAAG,CAAC,gBAAgB,YAAY,IAAI,CAAC,GAAG,CAAC,cAAc,OAAO;gBAC7E,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,IAAI;QACF,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,GAAG;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;IACzC,CAAC;IAED;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAsB,EAAE,SAA6B;QAC9D,IAAI,EAAE,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO;QAExD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,6BAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,0BAA0B,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,+EAA+E;IAEvE,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,0CAA0C,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAqB,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,KAAK,IAAI,CAAC,IAAI,EAAE;iBACb,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;iBACtB,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACxC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,GAAG,GACP,GAAG,IAAI,CAAC,OAAO,iCAAiC,IAAI,CAAC,GAAG,EAAE;YAC1D,UAAU,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,mEAAmE;YACnE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"session-version-cache.js","sourceRoot":"","sources":["../src/session-version-cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAExF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,mBAAmB;IACb,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,GAAG,CAAuB;IAC1B,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,aAAa,GAAG,CAAC,CAAC;IAClB,GAAG,GAAG,CAAC,CAAC;IACR,SAAS,GAAyC,IAAI,CAAC;IAE/D,YAAY,OAAe,EAAE,OAAe,EAAE,GAAyB;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CACV,qEAAqE;gBACnE,UAAU,IAAI,CAAC,GAAG,CAAC,gBAAgB,YAAY,IAAI,CAAC,GAAG,CAAC,cAAc,OAAO;gBAC7E,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,IAAI;QACF,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,GAAG;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;IACzC,CAAC;IAED;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAsB,EAAE,SAA6B;QAC9D,IAAI,EAAE,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO;QAExD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,6BAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,0BAA0B,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,+EAA+E;IAEvE,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,0CAA0C,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAuB,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,KAAK,IAAI,CAAC,IAAI,EAAE;iBACb,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;iBACtB,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACxC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,GAAG,GACP,GAAG,IAAI,CAAC,OAAO,iCAAiC,IAAI,CAAC,GAAG,EAAE;YAC1D,UAAU,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,mEAAmE;YACnE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoB,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;CACF"}

package/dist/types.d.ts

@@ -40,13 +40,17 @@ export interface DeviceAuthorizationResponse {
     /** Minimum polling interval in seconds. */
     interval: number;
 }
-/** Response from the token exchange endpoint. */
+/**
+ * Response from the token endpoint. `refresh_token` and `id_token` are present
+ * only for grants that issue them (a client-credentials grant issues neither).
+ */
 export interface TokenResponse {
     access_token: string;
-    id_token: string;
     token_type: string;
     expires_in: number;
-    refresh_token: string;
+    refresh_token?: string;
+    id_token?: string;
+    scope?: string;
 }
 /** UserInfo response from the OIDC UserInfo endpoint. */
 export interface UserInfoResponse {
@@ -54,6 +58,48 @@ export interface UserInfoResponse {
     name?: string;
     email?: string;
     email_verified?: boolean;
+    preferred_username?: string;
+    /** Any other claim the server releases for the granted scopes. */
+    [claim: string]: unknown;
+}
+/** Options for `HearthClient.exchangeCode()`. */
+export interface ExchangeCodeOptions {
+    /** PKCE code verifier. Required when the authorization request sent a `code_challenge`. */
+    codeVerifier?: string;
+}
+/**
+ * Result of `HearthClient.beginLogin()`. Store `state` and `codeVerifier` in
+ * the server-side session, then redirect the browser to `authorizationUrl`.
+ */
+export interface LoginBeginResult {
+    /** Full authorization URL to redirect the browser to. */
+    authorizationUrl: string;
+    /** CSRF value. Check it equals the `state` query parameter on the callback. */
+    state: string;
+    /** PKCE code verifier. Pass it to `completeLogin()` on the callback. */
+    codeVerifier: string;
+}
+/** Response from `GET /oauth/session-versions/snapshot` (RFC HEA-930). */
+export interface SvSnapshotResponse {
+    realm: string;
+    /** Sequence number to pass as `since` to the first delta call. */
+    current_seq: number;
+    /** Minimum accepted `sv` per session ID. */
+    versions: Record<string, number>;
+}
+/** One session-version bump in the delta feed (RFC HEA-930). */
+export interface SvDeltaEntry {
+    seq: number;
+    session_id: string;
+    min_sv: number;
+    bumped_at?: number;
+}
+/** Response from `GET /oauth/session-versions?since=<seq>` (RFC HEA-930). */
+export interface SvDeltaResponse {
+    realm: string;
+    /** Sequence number to pass as `since` to the next call. */
+    next_seq: number;
+    deltas: SvDeltaEntry[];
 }
 /** An entry in the `allow_credentials` list during a WebAuthn authentication ceremony. */
 export interface WebAuthnAllowCredential {
@@ -141,11 +187,16 @@ export interface User {
     created_at?: number;
     updated_at?: number;
 }
+/**
+ * A user's lifecycle status, as `PATCH /admin/users/{id}` accepts it: the
+ * proto enum name. The server refuses the short form (`"active"`).
+ */
+export type UserStatus = "USER_STATUS_ACTIVE" | "USER_STATUS_DISABLED" | "USER_STATUS_PENDING_VERIFICATION";
 /** Parameters for updating a user. */
 export interface UpdateUserParams {
     email?: string;
     displayName?: string;
-    status?: string;
+    status?: UserStatus;
 }
 /** Realm record from the API. */
 export interface Realm {
@@ -167,6 +218,13 @@ export interface UpdateRealmParams {
     status?: string;
     config?: Record<string, unknown>;
 }
+/** Pagination options for admin list calls. */
+export interface PageOptions {
+    /** Maximum number of items to return. */
+    limit?: number;
+    /** `next_cursor` from the previous page. */
+    cursor?: string;
+}
 /** Paginated list response. */
 export interface PageResponse<T> {
     items: T[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hearth-auth/sdk",
-  "version": "2.0.4",
+  "version": "3.0.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/hearth-auth/hearth.git",
@@ -13,6 +13,16 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
+    },
+    "./nextjs": {
+      "types": "./dist/nextjs/index.d.ts",
+      "import": "./dist/nextjs/index.js",
+      "default": "./dist/nextjs/index.js"
+    },
+    "./nextjs/edge": {
+      "types": "./dist/nextjs/edge.d.ts",
+      "import": "./dist/nextjs/edge.js",
+      "default": "./dist/nextjs/edge.js"
     }
   },
   "files": [
@@ -27,26 +37,33 @@
     "format:check": "prettier --check ."
   },
   "dependencies": {
-    "jose": "^5.0.0"
+    "jose": "^6.2.12",
+    "openapi-fetch": "^0.17.0"
   },
   "peerDependencies": {
+    "next": ">=14.0.0",
     "react": ">=17.0.0 <20.0.0"
   },
   "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    },
     "react": {
       "optional": true
     }
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@testing-library/react": "^16.0.0",
+    "@testing-library/react": "^16.3.3",
     "@types/react": "^18.3.0",
     "@types/react-dom": "^18.3.0",
     "eslint": "^10.11.0",
     "jsdom": "^25.0.0",
+    "openapi-typescript": "7.13.0",
     "prettier": "3.9.9",
     "react": "^18.3.0",
     "react-dom": "^18.3.0",
+    "tsx": "4.23.15",
     "typescript": "^5.0.0",
     "typescript-eslint": "^8.71.0",
     "vitest": "^4.1.6"