@hearth-auth/sdk 3.0.0 → 3.1.0

package/dist/hearth-client.js

@@ -1,5 +1,5 @@
 import { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, OAuthFlowError, TokenExpiredError, } from "./errors.js";
-import { JwksClient } from "./jwks-client.js";
+import { DEFAULT_AUDIENCE, JwksClient } from "./jwks-client.js";
 import { IntrospectionClient } from "./introspection-client.js";
 import { buildAuthorizationUrl, generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 /**
@@ -17,6 +17,8 @@ export class HearthClient {
     issuerUrl;
     clientId;
     clientSecret;
+    /** Expected `aud` of verified access tokens. Default `"hearth"`. */
+    audience;
     jwksTtl;
     introspectionEndpointOverride;
     /** HTTP timeout in milliseconds applied to all outbound fetch calls. */
@@ -42,6 +44,10 @@ export class HearthClient {
         this.issuerUrl = config.issuerUrl.replace(/\/$/, "");
         this.clientId = config.clientId;
         this.clientSecret = config.clientSecret;
+        if (config.audience === "") {
+            throw new ConfigurationError('audience must not be empty — leave it unset for the default "hearth"');
+        }
+        this.audience = config.audience ?? DEFAULT_AUDIENCE;
         this.jwksTtl = config.jwksTtl;
         this.introspectionEndpointOverride = config.introspectionEndpoint;
         this.httpTimeout = config.httpTimeout ?? 10_000;
@@ -121,7 +127,7 @@ export class HearthClient {
             // Pin iss/aud on the client itself, so a caller who reaches for the
             // exported JwksClient still gets them checked.
             issuer: this.issuerUrl,
-            audience: this.clientId,
+            audience: this.audience,
             ttl: this.jwksTtl,
             httpTimeout: this.httpTimeout,
         });
@@ -230,21 +236,23 @@ export class HearthClient {
      * 2. `exp` claim (rejects expired tokens).
      * 3. `nbf` claim (rejects post-dated tokens).
      * 4. `iss` claim (must match configured `issuerUrl`).
-     * 5. `aud` claim (validated when `clientId` is set in config).
+     * 5. `aud` claim (must contain the configured `audience`, default `"hearth"`).
+     * 6. `iat` claim (rejects a token issued in the future).
      *
-     * `exp` and `nbf` allow a 5-second clock skew.
+     * `exp`, `nbf` and `iat` allow a 5-second clock skew.
      *
      * @throws {@link TokenExpiredError} — token is expired.
+     * @throws {@link TokenNotYetValidError} — `nbf` or `iat` is in the future.
      * @throws {@link TokenInvalidError} — signature invalid or JWT malformed.
      * @throws {@link TokenIssuerError} — issuer does not match `issuerUrl`.
-     * @throws {@link TokenAudienceError} — audience does not include `clientId`.
+     * @throws {@link TokenAudienceError} — audience does not include `audience`.
      * @throws {@link JWKSFetchError} — JWKS endpoint unreachable.
      */
     async verifyToken(token) {
         const jc = await this.jwksClient();
         return jc.verify(token, {
             issuer: this.issuerUrl,
-            audience: this.clientId,
+            audience: this.audience,
         });
     }
     // ── §4.5 — OAuth Flows ───────────────────────────────────────────────────

package/dist/hearth-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"hearth-client.js","sourceRoot":"","sources":["../src/hearth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAA4B,MAAM,2BAA2B,CAAC;AAc1F,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAuE/F;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IACvB,0CAA0C;IACjC,SAAS,CAAS;IAClB,QAAQ,CAAqB;IAC7B,YAAY,CAAqB;IACjC,OAAO,CAAqB;IAC5B,6BAA6B,CAAqB;IAC3D,wEAAwE;IAC/D,WAAW,CAAS;IAC7B,qEAAqE;IAC5D,OAAO,CAAqB;IACrC,6EAA6E;IACpE,YAAY,CAA2C;IAExD,UAAU,GAA6B,IAAI,CAAC;IAC5C,kBAAkB,GAAsC,IAAI,CAAC;IAC7D,WAAW,GAAsB,IAAI,CAAC;IACtC,oBAAoB,GAA+B,IAAI,CAAC;IAEhE,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,cAAc,MAAM,CAAC,SAAS,sBAAsB,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,6BAA6B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC3D,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,wCAAwC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE;gBAC/D,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CAAC,6DAA6D,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,oEAAoE;YACpE,+CAA+C;YAC/C,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB,CAAC;QAEvF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,uEAAuE;gBACrE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,CAAC;YAClD,qBAAqB,EAAE,QAAQ;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,UAAkB,EAClB,IAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,IAAI,EAAE,cAAc;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,IAAI,EAAE,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,IAAI,CAAC,OAAO;oBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wCAAwC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,UAAU,CACd,KAAa,EACb,aAAgD;QAEhD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACzD,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EACjC,CAAC;YACD,MAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,KAAK,GAAG,QAAQ;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC;YAC3C,qBAAqB;YACrB,QAAQ;YACR,WAAW;YACX,aAAa,EAAE,MAAM,qBAAqB,CAAC,YAAY,CAAC;YACxD,KAAK;SACN,CAAC,CAAC;QACH,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACxD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,YAAoB,EACpB,WAAmB;QAEnB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,WAAmB,EACnB,IAA0B;QAE1B,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC;SACzC,CAAC;QACF,IAAI,IAAI,EAAE,YAAY;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QACjE,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,KAAc;QACtD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,GAAG,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;SAC1C,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAc;QACpC,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;SACvC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,KAAc;QAClC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EACpD,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,eAAuB;QAC/D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC5D,IAAI,iBAAiB,GAAG,eAAe,GAAG,IAAI,CAAC;QAE/C,yFAAyF;QACzF,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAErE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAgB,aAAa,EAAE;oBACvD,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU;oBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;iBAC/B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,cAAc,CAAC;oBAAE,MAAM,GAAG,CAAC;gBAChD,IAAI,GAAG,CAAC,SAAS,KAAK,uBAAuB;oBAAE,SAAS;gBACxD,IAAI,GAAG,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;oBAClC,iBAAiB,IAAI,IAAI,CAAC;oBAC1B,SAAS;gBACX,CAAC;gBACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe;oBAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC/E,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,OAAO,kBAAkB,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,kCAAkC;YAC9C,KAAK;SACN,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,2EAA2E;IAE3E;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAmB,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,oBAAoB,CAAC;QAClD,OAAO,IAAI,CAAC,WAAW,CAAwB,GAAG,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,YAAoB;QACnC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,kCAAkC,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAqB,GAAG,EAAE,YAAY,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,KAAa,EACb,KAAc;QAEd,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,yBAAyB,CAAC,CAAC;QAChE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,aAAa,CAAkB,GAAG,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;IAC3E,CAAC;IAED,4EAA4E;IAEpE,eAAe,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,MAAM,IAAI,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,MAAM,IAAI,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4EAA4E;IACpE,gBAAgB,CAAC,MAAc;QACrC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACnF,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACzC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,kBAAkB,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAAiB;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,cAAc,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,GAAG,YAAY,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAI,QAAgB,EAAE,MAA8B;QACxE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,WAAW,CAAI,GAAW,EAAE,KAAa;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,GAAG,0BAA0B,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yDAAyD;IACjD,KAAK,CAAC,aAAa,CAAI,GAAW,EAAE,KAAa;QACvD,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7E,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,IAAc;IAC1C,IAAI,SAAS,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;IACtC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,OAAO,MAAM,CAAC,mBAAmB,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpD,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,IAAI,CAAC,MAAM,KAAK,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzG,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"hearth-client.js","sourceRoot":"","sources":["../src/hearth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAA4B,MAAM,2BAA2B,CAAC;AAc1F,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AA+E/F;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IACvB,0CAA0C;IACjC,SAAS,CAAS;IAClB,QAAQ,CAAqB;IAC7B,YAAY,CAAqB;IAC1C,oEAAoE;IAC3D,QAAQ,CAAS;IACjB,OAAO,CAAqB;IAC5B,6BAA6B,CAAqB;IAC3D,wEAAwE;IAC/D,WAAW,CAAS;IAC7B,qEAAqE;IAC5D,OAAO,CAAqB;IACrC,6EAA6E;IACpE,YAAY,CAA2C;IAExD,UAAU,GAA6B,IAAI,CAAC;IAC5C,kBAAkB,GAAsC,IAAI,CAAC;IAC7D,WAAW,GAAsB,IAAI,CAAC;IACtC,oBAAoB,GAA+B,IAAI,CAAC;IAEhE,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAAC,cAAc,MAAM,CAAC,SAAS,sBAAsB,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,kBAAkB,CAC1B,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,gBAAgB,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,6BAA6B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC3D,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,wCAAwC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE;gBAC/D,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CAAC,6DAA6D,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,oEAAoE;YACpE,+CAA+C;YAC/C,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB,CAAC;QAEvF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,uEAAuE;gBACrE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,CAAC;YAClD,qBAAqB,EAAE,QAAQ;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,UAAkB,EAClB,IAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,IAAI,EAAE,cAAc;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,IAAI,EAAE,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,IAAI,CAAC,OAAO;oBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wCAAwC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,UAAU,CACd,KAAa,EACb,aAAgD;QAEhD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACzD,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EACjC,CAAC;YACD,MAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,KAAK,GAAG,QAAQ;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC;YAC3C,qBAAqB;YACrB,QAAQ;YACR,WAAW;YACX,aAAa,EAAE,MAAM,qBAAqB,CAAC,YAAY,CAAC;YACxD,KAAK;SACN,CAAC,CAAC;QACH,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACxD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,YAAoB,EACpB,WAAmB;QAEnB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,WAAmB,EACnB,IAA0B;QAE1B,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC;SACzC,CAAC;QACF,IAAI,IAAI,EAAE,YAAY;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QACjE,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,KAAc;QACtD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,GAAG,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;SAC1C,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAc;QACpC,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;SACvC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,KAAc;QAClC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EACpD,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,eAAuB;QAC/D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC5D,IAAI,iBAAiB,GAAG,eAAe,GAAG,IAAI,CAAC;QAE/C,yFAAyF;QACzF,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAErE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAgB,aAAa,EAAE;oBACvD,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU;oBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;iBAC/B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,cAAc,CAAC;oBAAE,MAAM,GAAG,CAAC;gBAChD,IAAI,GAAG,CAAC,SAAS,KAAK,uBAAuB;oBAAE,SAAS;gBACxD,IAAI,GAAG,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;oBAClC,iBAAiB,IAAI,IAAI,CAAC;oBAC1B,SAAS;gBACX,CAAC;gBACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe;oBAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC/E,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,OAAO,kBAAkB,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,kCAAkC;YAC9C,KAAK;SACN,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAgB,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,2EAA2E;IAE3E;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAmB,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,oBAAoB,CAAC;QAClD,OAAO,IAAI,CAAC,WAAW,CAAwB,GAAG,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,YAAoB;QACnC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,kCAAkC,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAqB,GAAG,EAAE,YAAY,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,KAAa,EACb,KAAc;QAEd,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,yBAAyB,CAAC,CAAC;QAChE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,aAAa,CAAkB,GAAG,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;IAC3E,CAAC;IAED,4EAA4E;IAEpE,eAAe,CAAC,MAAc;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,MAAM,IAAI,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,MAAM,IAAI,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4EAA4E;IACpE,gBAAgB,CAAC,MAAc;QACrC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACnF,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACzC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,kBAAkB,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAAiB;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,cAAc,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,GAAG,YAAY,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAI,QAAgB,EAAE,MAA8B;QACxE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,WAAW,CAAI,GAAW,EAAE,KAAa;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,GAAG,0BAA0B,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yDAAyD;IACjD,KAAK,CAAC,aAAa,CAAI,GAAW,EAAE,KAAa;QACvD,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7E,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,IAAc;IAC1C,IAAI,SAAS,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;IACtC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,OAAO,MAAM,CAAC,mBAAmB,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpD,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,IAAI,CAAC,MAAM,KAAK,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzG,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}

package/dist/hearth.d.ts

@@ -6,11 +6,22 @@ export interface HearthOptions {
     /** Realm ID to scope all requests to. */
     realmId: string;
     /**
-     * Called synchronously on every `hasPermission` / `hasRole` /
-     * `inGroup` / `inOrg` check. Return `null`/`undefined` when the
-     * caller is unauthenticated.
+     * The realm's issuer URL, e.g. `https://hearth.example.com/realms/acme`.
+     * Tokens are verified against the JWKS this issuer publishes, and their
+     * `iss` must equal it.
      */
-    getToken: () => string | null | undefined;
+    issuerUrl: string;
+    /**
+     * Expected `aud` of the token: the name of the API that checks it
+     * (RFC 9068 §4). Default `"hearth"`, the audience Hearth mints when a
+     * client names no resource. The check is always on.
+     */
+    audience?: string;
+    /**
+     * Called on every `hasPermission` / `hasRole` / `inGroup` / `inOrg`
+     * check. Return `null`/`undefined` when the caller is unauthenticated.
+     */
+    getToken: () => string | null | undefined | Promise<string | null | undefined>;
     /**
      * Optional session-version cache configuration (RFC HEA-930 § 13).
      *
@@ -40,42 +51,45 @@ export interface HearthHttpClient {
 /**
  * RBAC claim-oriented facade over the Hearth SDK.
  *
- * When `sessionVersions` is not configured all boolean predicates are
- * synchronous, lock-free, and decode the JWT returned by `getToken()` on
- * every call. No network traffic, no cache. When the token is absent or
- * malformed every predicate returns `false`.
+ * Every predicate verifies the token returned by `getToken()` before it
+ * reads a claim: the EdDSA signature against the realm JWKS (fetched once,
+ * then cached), plus `exp`, `nbf`, `iat`, `iss` and `aud`. A token that is
+ * absent or does not verify holds nothing, and the predicate resolves to
+ * `false`.
  *
  * When `sessionVersions.enabled` is `true`, the predicates additionally
- * validate the `sv` claim and may throw {@link SessionVersionRevokedError}
- * or {@link SessionVersionCacheStaleError} (see RFC HEA-930 § 8).
+ * validate the `sv` claim and may reject with
+ * {@link SessionVersionRevokedError} or {@link SessionVersionCacheStaleError}
+ * (see RFC HEA-930 § 8).
  */
 export interface HearthFacade {
     /**
-     * Returns `true` iff the JWT `permissions` claim contains `permission`.
+     * Resolves `true` iff the token verifies and its `permissions` claim
+     * contains `permission`.
      *
-     * May throw {@link SessionVersionRevokedError} or
+     * May reject with {@link SessionVersionRevokedError} or
      * {@link SessionVersionCacheStaleError} when session-version tracking
      * is enabled and the token's `sv` claim fails validation.
      */
-    hasPermission(permission: string): boolean;
+    hasPermission(permission: string): Promise<boolean>;
     /**
-     * Returns `true` iff the JWT `roles` claim contains `role`.
+     * Resolves `true` iff the token verifies and its `roles` claim contains `role`.
      *
-     * Same session-version throw semantics as {@link hasPermission}.
+     * Same session-version semantics as {@link hasPermission}.
      */
-    hasRole(role: string): boolean;
+    hasRole(role: string): Promise<boolean>;
     /**
-     * Returns `true` iff the JWT `groups` claim contains `group`.
+     * Resolves `true` iff the token verifies and its `groups` claim contains `group`.
      *
-     * Same session-version throw semantics as {@link hasPermission}.
+     * Same session-version semantics as {@link hasPermission}.
      */
-    inGroup(group: string): boolean;
+    inGroup(group: string): Promise<boolean>;
     /**
-     * Returns `true` iff the JWT `oid` claim equals `org`.
+     * Resolves `true` iff the token verifies and its `oid` claim equals `org`.
      *
-     * Same session-version throw semantics as {@link hasPermission}.
+     * Same session-version semantics as {@link hasPermission}.
      */
-    inOrg(org: string): boolean;
+    inOrg(org: string): Promise<boolean>;
     /**
      * Returns the age of the session-version cache in milliseconds.
      *
@@ -95,8 +109,8 @@ export interface HearthFacade {
     client: HearthHttpClient;
 }
 /**
- * Create a {@link HearthFacade} over the RBAC claim set embedded in the
- * JWT returned by `opts.getToken()`.
+ * Create a {@link HearthFacade} over the RBAC claims of the token returned
+ * by `opts.getToken()`. Each check verifies that token first.
  *
  * When `opts.sessionVersions.enabled` is `true` the facade additionally
  * starts a background session-version poll loop. Call `facade.stop()` to

package/dist/hearth.js

@@ -1,41 +1,26 @@
-import { decodeJwt } from "jose";
 import { HearthApiClient } from "./client.js";
+import { HearthClient } from "./hearth-client.js";
 import { SessionVersionCache } from "./session-version-cache.js";
-/**
- * Decode the middle JWT segment using `jose.decodeJwt`. Returns `null`
- * when the token is missing, malformed, or cannot be parsed as JSON.
- * Signature is NOT verified — the app trusts its own token.
- */
-function safeDecode(token) {
-    if (!token || typeof token !== "string")
-        return null;
-    try {
-        return decodeJwt(token);
-    }
-    catch {
-        return null;
-    }
-}
 function arrayContains(claim, value) {
     return Array.isArray(claim) && claim.includes(value);
 }
 /** Extract the `sv` claim as `bigint`, or `undefined` if absent/non-numeric. */
 function extractSv(c) {
-    if (c.sv === undefined || c.sv === null)
-        return undefined;
-    if (typeof c.sv === "number")
-        return BigInt(Math.trunc(c.sv));
-    if (typeof c.sv === "bigint")
-        return c.sv;
+    const sv = c.get("sv");
+    if (typeof sv === "number")
+        return BigInt(Math.trunc(sv));
+    if (typeof sv === "bigint")
+        return sv;
     return undefined;
 }
 /** Extract the `sid` claim as `string`, or `undefined` if absent. */
 function extractSid(c) {
-    return typeof c.sid === "string" ? c.sid : undefined;
+    const sid = c.get("sid");
+    return typeof sid === "string" ? sid : undefined;
 }
 /**
- * Create a {@link HearthFacade} over the RBAC claim set embedded in the
- * JWT returned by `opts.getToken()`.
+ * Create a {@link HearthFacade} over the RBAC claims of the token returned
+ * by `opts.getToken()`. Each check verifies that token first.
  *
  * When `opts.sessionVersions.enabled` is `true` the facade additionally
  * starts a background session-version poll loop. Call `facade.stop()` to
@@ -46,48 +31,49 @@ export function createHearth(opts) {
         baseUrl: opts.baseUrl,
         realmId: opts.realmId,
     });
+    // Discovery and the JWKS are fetched on the first check and cached.
+    const verifier = new HearthClient({ issuerUrl: opts.issuerUrl, audience: opts.audience });
     let svCache = null;
     if (opts.sessionVersions?.enabled) {
         svCache = new SessionVersionCache(opts.baseUrl, opts.realmId, opts.sessionVersions);
         svCache.start();
     }
-    function claims() {
-        return safeDecode(opts.getToken());
-    }
-    /** Runs the sv check; throws on revoked or stale. No-op when sv absent. */
-    function assertSv(c) {
-        if (svCache !== null) {
-            svCache.validateSv(extractSv(c), extractSid(c));
+    /**
+     * The verified claims of the current token, or `null` when there is no
+     * token or it does not verify. Runs the `sv` check on verified claims; that
+     * check throws on a revoked or stale session.
+     */
+    async function verifiedClaims() {
+        const token = await opts.getToken();
+        if (!token || typeof token !== "string")
+            return null;
+        let claims;
+        try {
+            claims = await verifier.verifyToken(token);
+        }
+        catch {
+            return null;
         }
+        svCache?.validateSv(extractSv(claims), extractSid(claims));
+        return claims;
     }
     return {
-        hasPermission(permission) {
-            const c = claims();
-            if (c === null)
-                return false;
-            assertSv(c);
-            return arrayContains(c.permissions, permission);
+        async hasPermission(permission) {
+            const c = await verifiedClaims();
+            return c !== null && arrayContains(c.get("permissions"), permission);
         },
-        hasRole(role) {
-            const c = claims();
-            if (c === null)
-                return false;
-            assertSv(c);
-            return arrayContains(c.roles, role);
+        async hasRole(role) {
+            const c = await verifiedClaims();
+            return c !== null && arrayContains(c.get("roles"), role);
         },
-        inGroup(group) {
-            const c = claims();
-            if (c === null)
-                return false;
-            assertSv(c);
-            return arrayContains(c.groups, group);
+        async inGroup(group) {
+            const c = await verifiedClaims();
+            return c !== null && arrayContains(c.get("groups"), group);
         },
-        inOrg(org) {
-            const c = claims();
-            if (c === null)
-                return false;
-            assertSv(c);
-            return typeof c.oid === "string" && c.oid === org;
+        async inOrg(org) {
+            const c = await verifiedClaims();
+            const oid = c?.get("oid");
+            return typeof oid === "string" && oid === org;
         },
         sessionVersionCacheAge() {
             return svCache?.age() ?? Number.POSITIVE_INFINITY;
@@ -96,10 +82,10 @@ export function createHearth(opts) {
             svCache?.stop();
         },
         client: {
-            permissions() {
-                const token = opts.getToken();
+            async permissions() {
+                const token = await opts.getToken();
                 if (!token) {
-                    return Promise.reject(new Error("getToken() returned no token; cannot call permissions()"));
+                    throw new Error("getToken() returned no token; cannot call permissions()");
                 }
                 return http.permissions(token);
             },

package/dist/hearth.js.map

@@ -1 +1 @@
-{"version":3,"file":"hearth.js","sourceRoot":"","sources":["../src/hearth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAgHjE;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAgC;IAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAAkB,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,CAAgB;IACjC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC1C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,CAAgB;IAClC,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;IAEH,IAAI,OAAO,GAA+B,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC;QAClC,OAAO,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;IAED,SAAS,MAAM;QACb,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,2EAA2E;IAC3E,SAAS,QAAQ,CAAC,CAAgB;QAChC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,CAAC,UAAkB;YAC9B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC7B,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,IAAY;YAClB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC7B,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,KAAa;YACnB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC7B,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,GAAW;YACf,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC7B,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;QACpD,CAAC;QACD,sBAAsB;YACpB,OAAO,OAAO,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC;QACpD,CAAC;QACD,IAAI;YACF,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;QACD,MAAM,EAAE;YACN,WAAW;gBACT,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,yDAAyD,CAAC,CACrE,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hearth.js","sourceRoot":"","sources":["../src/hearth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAmHjE,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;IACH,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE1F,IAAI,OAAO,GAA+B,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC;QAClC,OAAO,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,cAAc;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,UAAkB;YACpC,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAY;YACxB,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAa;YACzB,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAW;YACrB,MAAM,CAAC,GAAG,MAAM,cAAc,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,GAAG,CAAC;QAChD,CAAC;QACD,sBAAsB;YACpB,OAAO,OAAO,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC;QACpD,CAAC;QACD,IAAI;YACF,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;QACD,MAAM,EAAE;YACN,KAAK,CAAC,WAAW;gBACf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBAC7E,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { HearthClient } from "./hearth-client.js";
 export { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl, startLogin, } from "./pkce.js";
 export type { BuildAuthorizationUrlOptions, AuthorizationUrlResult, StartLoginOptions, StartLoginResult, } from "./pkce.js";
 export type { HearthClientConfig, OidcConfiguration } from "./hearth-client.js";
-export { JwksClient } from "./jwks-client.js";
+export { DEFAULT_AUDIENCE, JwksClient } from "./jwks-client.js";
 export type { JwksClientConfig, VerifyOptions } from "./jwks-client.js";
 export { IntrospectionClient } from "./introspection-client.js";
 export type { IntrospectionClientConfig, IntrospectionResult } from "./introspection-client.js";
@@ -20,5 +20,5 @@ export { HearthContext, HearthProvider, useHasPermission, useHasRole, useInGroup
 export type { HearthProviderProps } from "./react.js";
 export type { AccessTokenAuthorizationMode, AuthorizeParams, AuthorizePermissionOptions, AuthorizeResponse, BootstrapResponse, CreateUserParams, ExchangeCodeOptions, JwksDocument, JsonWebKey, LoginBeginResult, MePermissionsResponse, OAuthClient, PageOptions, PageResponse, RegisterClientParams, Realm, SessionVersionConfig, StepUpAssertion, StepUpProof, SvDeltaEntry, SvDeltaResponse, SvSnapshotResponse, TokenExchangeParams, DeviceAuthorizationResponse, TokenResponse, UpdateRealmParams, UpdateUserParams, UserStatus, User, UserInfoResponse, WebAuthnAllowCredential, WebAuthnRegistrationBeginResponse, WebAuthnRegistrationCompleteRequest, WebAuthnRegistrationCompleteResponse, WebAuthnAuthenticationBeginResponse, WebAuthnAuthenticationCompleteRequest, } from "./types.js";
 export { SessionVersionCache } from "./session-version-cache.js";
-export { getAccessToken, getRefreshToken, getIdToken, isAuthenticated, clearTokens, createHearthAuth, } from "./browser-auth.js";
-export type { AuthConfig, HearthBrowserAuth } from "./browser-auth.js";
+export { createHearthAuth } from "./browser-auth.js";
+export type { AuthConfig, AuthStorage, HearthBrowserAuth, TokenStorage } from "./browser-auth.js";

package/dist/index.js

@@ -3,7 +3,7 @@ export { HearthClient } from "./hearth-client.js";
 // PKCE browser utilities (RFC 7636).
 export { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl, startLogin, } from "./pkce.js";
 // Lower-level primitives (JWKS and introspection).
-export { JwksClient } from "./jwks-client.js";
+export { DEFAULT_AUDIENCE, JwksClient } from "./jwks-client.js";
 export { IntrospectionClient } from "./introspection-client.js";
 // Error types (spec §5).
 export { AuthorizationModeMismatchError, ConfigurationError, DiscoveryError, HearthSdkError, IntrospectionError, JWKSFetchError, OAuthFlowError, RequiredActionError, SessionVersionCacheStaleError, SessionVersionRevokedError, TokenAudienceError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenNotYetValidError, TokenVerificationError, } from "./errors.js";
@@ -18,6 +18,6 @@ export { AdminClient } from "./admin.js";
 export { createHearth } from "./hearth.js";
 export { HearthContext, HearthProvider, useHasPermission, useHasRole, useInGroup, useInOrg, } from "./react.js";
 export { SessionVersionCache } from "./session-version-cache.js";
-// Browser auth: token store + PKCE login facade for SPAs.
-export { getAccessToken, getRefreshToken, getIdToken, isAuthenticated, clearTokens, createHearthAuth, } from "./browser-auth.js";
+// Browser auth: PKCE login facade for SPAs; token getters live on the returned object.
+export { createHearthAuth } from "./browser-auth.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qCAAqC;AACrC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,GACX,MAAM,WAAW,CAAC;AASnB,mDAAmD;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,yBAAyB;AACzB,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,iEAAiE;AACjE,wFAAwF;AACxF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAazB,wBAAwB;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,6DAA6D;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAezC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;AAwCpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,OAAO,EACL,cAAc,EACd,eAAe,EACf,UAAU,EACV,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qCAAqC;AACrC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,GACX,MAAM,WAAW,CAAC;AASnB,mDAAmD;AACnD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,yBAAyB;AACzB,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAErB,iEAAiE;AACjE,wFAAwF;AACxF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAazB,wBAAwB;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,6DAA6D;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAezC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;AAwCpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,uFAAuF;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/jwks-client.d.ts

@@ -4,9 +4,12 @@ import { Claims } from "./claims.js";
 export interface VerifyOptions {
     /** Expected `iss` claim. When provided, verification fails if the token's issuer differs. */
     issuer?: string;
-    /** Expected `aud` claim(s). Skipped when absent. */
+    /**
+     * Expected `aud` claim(s) for this call. Overrides the client's configured
+     * `audience`; the check itself always runs.
+     */
     audience?: string | string[];
-    /** Clock skew tolerance in seconds, applied to `exp` and `nbf`. Default: 5. */
+    /** Clock skew tolerance in seconds, applied to `exp`, `nbf` and `iat`. Default: 5. */
     clockSkewSeconds?: number;
 }
 /** Configuration for {@link JwksClient}. */
@@ -23,8 +26,11 @@ export interface JwksClientConfig {
      */
     issuer?: string;
     /**
-     * Expected `aud` claim(s), pinned for every {@link JwksClient.verify} call
-     * that does not override it. When neither is set the audience is not checked.
+     * Expected `aud` claim(s): the name of the API that verifies the token
+     * (RFC 9068 §4). Pinned for every {@link JwksClient.verify} call that does not
+     * override it. Default: {@link DEFAULT_AUDIENCE} (`"hearth"`), the audience
+     * Hearth mints when a client names no resource. An API registered as a
+     * protected resource sets its resource URI. The check is always on.
      */
     audience?: string | string[];
     /**
@@ -36,6 +42,11 @@ export interface JwksClientConfig {
     /** Timeout for outbound HTTP calls in milliseconds. Default: 10 000. */
     httpTimeout?: number;
 }
+/**
+ * The audience Hearth puts in an access token when the client names no
+ * resource. Every verifier checks `aud` against it unless configured otherwise.
+ */
+export declare const DEFAULT_AUDIENCE = "hearth";
 /**
  * JWKS-backed JWT verifier with key caching, automatic key rotation,
  * and full EdDSA / Ed25519 signature verification (spec §2).
@@ -47,7 +58,7 @@ export interface JwksClientConfig {
 export declare class JwksClient {
     private readonly jwksUri;
     readonly issuer: string | undefined;
-    readonly audience: string | string[] | undefined;
+    readonly audience: string | string[];
     readonly ttl: number | undefined;
     readonly httpTimeout: number;
     /** Cached local key set and when it was fetched. */
@@ -57,17 +68,21 @@ export declare class JwksClient {
     /**
      * Verify a JWT using Ed25519/EdDSA JWKS-based local signature verification (spec §2).
      *
-     * Executes all five spec §2 validation steps in order:
+     * Executes every validation step of the sdk-support-contract spec:
      * 1. Signature against cached JWKS — EdDSA only; RS256 and ES256 are refused.
      * 2. `exp` — rejects expired tokens.
      * 3. `iss` — always, against `options.issuer` or the client's configured
      *    `issuer`. Throws {@link ConfigurationError} when neither is set.
-     * 4. `aud` — when `options.audience` or the client's configured `audience` is set.
-     * 5. `nbf` — when present, within clock skew tolerance.
+     * 4. `aud` — always, against `options.audience` or the client's configured
+     *    `audience` (default `"hearth"`).
+     * 5. `iat` — not in the future, within clock skew tolerance.
+     * 6. `nbf` — when present, within clock skew tolerance.
      *
-     * `jose` performs every check above; this method only maps its errors.
+     * `jose` performs every check above except the `iat` one; this method
+     * maps its errors.
      *
      * @throws {@link TokenExpiredError} when the token is expired.
+     * @throws {@link TokenNotYetValidError} when `nbf` or `iat` is in the future.
      * @throws {@link TokenInvalidError} when the signature or structure is invalid.
      * @throws {@link TokenIssuerError} when the issuer does not match.
      * @throws {@link TokenAudienceError} when the audience does not match.

package/dist/jwks-client.js

@@ -1,6 +1,11 @@
 import { createLocalJWKSet, jwtVerify, errors as joseErrors } from "jose";
 import { Claims } from "./claims.js";
-import { ConfigurationError, JWKSFetchError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenAudienceError, TokenNotYetValidError, } from "./errors.js";
+import { ConfigurationError, JWKSFetchError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenAudienceError, TokenNotYetValidError, TokenVerificationError, } from "./errors.js";
+/**
+ * The audience Hearth puts in an access token when the client names no
+ * resource. Every verifier checks `aud` against it unless configured otherwise.
+ */
+export const DEFAULT_AUDIENCE = "hearth";
 /**
  * JWKS-backed JWT verifier with key caching, automatic key rotation,
  * and full EdDSA / Ed25519 signature verification (spec §2).
@@ -20,7 +25,7 @@ export class JwksClient {
     constructor(config) {
         this.jwksUri = config.jwksUri;
         this.issuer = config.issuer;
-        this.audience = config.audience;
+        this.audience = config.audience ?? DEFAULT_AUDIENCE;
         this.ttl = config.ttl;
         this.httpTimeout = config.httpTimeout ?? 10_000;
     }
@@ -40,17 +45,21 @@ export class JwksClient {
     /**
      * Verify a JWT using Ed25519/EdDSA JWKS-based local signature verification (spec §2).
      *
-     * Executes all five spec §2 validation steps in order:
+     * Executes every validation step of the sdk-support-contract spec:
      * 1. Signature against cached JWKS — EdDSA only; RS256 and ES256 are refused.
      * 2. `exp` — rejects expired tokens.
      * 3. `iss` — always, against `options.issuer` or the client's configured
      *    `issuer`. Throws {@link ConfigurationError} when neither is set.
-     * 4. `aud` — when `options.audience` or the client's configured `audience` is set.
-     * 5. `nbf` — when present, within clock skew tolerance.
+     * 4. `aud` — always, against `options.audience` or the client's configured
+     *    `audience` (default `"hearth"`).
+     * 5. `iat` — not in the future, within clock skew tolerance.
+     * 6. `nbf` — when present, within clock skew tolerance.
      *
-     * `jose` performs every check above; this method only maps its errors.
+     * `jose` performs every check above except the `iat` one; this method
+     * maps its errors.
      *
      * @throws {@link TokenExpiredError} when the token is expired.
+     * @throws {@link TokenNotYetValidError} when `nbf` or `iat` is in the future.
      * @throws {@link TokenInvalidError} when the signature or structure is invalid.
      * @throws {@link TokenIssuerError} when the issuer does not match.
      * @throws {@link TokenAudienceError} when the audience does not match.
@@ -70,6 +79,10 @@ export class JwksClient {
                 "`iss` would accept a token minted by any issuer sharing this JWKS.");
         }
         const audience = options?.audience ?? this.audience;
+        if (audience === "" || (Array.isArray(audience) && audience.length === 0)) {
+            throw new ConfigurationError("JwksClient.verify requires an expected audience — leave `audience` unset " +
+                'for the default "hearth", or set the API\'s resource URI.');
+        }
         let keySet = await this.getKeySet();
         const doVerify = async (ks) => {
             const { payload } = await jwtVerify(token, ks, {
@@ -83,6 +96,12 @@ export class JwksClient {
                 requiredClaims: ["exp"],
                 clockTolerance,
             });
+            // jose checks that `iat` is a number but not that it lies in the past.
+            // A token issued "later than now" (beyond the skew) is not yet valid.
+            if (typeof payload.iat === "number" &&
+                payload.iat > Math.floor(Date.now() / 1000) + clockTolerance) {
+                throw new TokenNotYetValidError(new Date(payload.iat * 1000));
+            }
             return new Claims(payload);
         };
         try {
@@ -107,6 +126,8 @@ export class JwksClient {
      * `issuer` and `audience` are the values the check actually used.
      */
     mapJoseError(err, issuer, audience) {
+        if (err instanceof TokenVerificationError)
+            throw err;
         if (err instanceof joseErrors.JWTExpired) {
             const exp = err.payload?.exp;
             throw new TokenExpiredError(exp ? new Date(exp * 1000) : new Date(0));
@@ -124,7 +145,7 @@ export class JwksClient {
             if (claim === "aud") {
                 const raw = err.payload?.["aud"];
                 const actual = Array.isArray(raw) ? raw : [String(raw ?? "")];
-                const expected = Array.isArray(audience) ? (audience[0] ?? "") : (audience ?? "");
+                const expected = Array.isArray(audience) ? (audience[0] ?? "") : audience;
                 throw new TokenAudienceError(expected, actual);
             }
             throw new TokenInvalidError(`JWT claim validation failed (${claim}): ${err.message}`);