fhirstarterjs 1.0.8 → 1.0.9

package/LICENSE.md

@@ -1,44 +1,44 @@
-# Kopimi License
-
-This software is released under the Kopimi License.
-
-## Permission
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to copy,
-modify, merge, publish, distribute, sublicense, sell, use, study,
-reverse-engineer, decompile, and otherwise deal in the Software without
-restriction, including without limitation for commercial or non-commercial
-purposes.
-
-Commercial use, sale, resale, or distribution for profit must include clear
-attribution to the original author(s) in the distributed copy and in any
-customary public-facing product notices, documentation, credits, or legal
-notices associated with that use.
-
-## Kopimi Propagation
-
-The Software is Kopimi. Copies, substantial portions, and derivative works must
-preserve the freedom to copy, share, modify, remix, and redistribute the
-Software. No copy, substantial portion, or derivative work may be distributed
-under terms that prohibit those freedoms.
-
-License notices, author notices, and Kopimi notices included with the Software
-may not be removed from redistributed copies, substantial portions, or
-derivative works.
-
-Attribution to the original author(s) is appreciated for non-commercial use and
-required for commercial use as described above.
-
-## Disclaimer
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
-CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-This license is itself Kopimi. Copy it, use it, and remix it.
-
-For more information, please refer to <https://kopimi.com>
+# Kopimi License
+
+This software is released under the Kopimi License.
+
+## Permission
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to copy,
+modify, merge, publish, distribute, sublicense, sell, use, study,
+reverse-engineer, decompile, and otherwise deal in the Software without
+restriction, including without limitation for commercial or non-commercial
+purposes.
+
+Commercial use, sale, resale, or distribution for profit must include clear
+attribution to the original author(s) in the distributed copy and in any
+customary public-facing product notices, documentation, credits, or legal
+notices associated with that use.
+
+## Kopimi Propagation
+
+The Software is Kopimi. Copies, substantial portions, and derivative works must
+preserve the freedom to copy, share, modify, remix, and redistribute the
+Software. No copy, substantial portion, or derivative work may be distributed
+under terms that prohibit those freedoms.
+
+License notices, author notices, and Kopimi notices included with the Software
+may not be removed from redistributed copies, substantial portions, or
+derivative works.
+
+Attribution to the original author(s) is appreciated for non-commercial use and
+required for commercial use as described above.
+
+## Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+This license is itself Kopimi. Copy it, use it, and remix it.
+
+For more information, please refer to <https://kopimi.com>

package/README.md

@@ -1,142 +1,142 @@
-# 🔥 fhirStarter
-
-SMART on FHIR Backend Services auth lifecycle for any FHIR client.
-
-## Install
-
-```sh
-npm install fhirstarterjs
-```
-
-## Usage
-
-This example uses the official `fhirclient` package as the FHIR client; `fhirStarter` only manages auth.
-
-```ts
-import FHIR from "fhirclient"
-import fhirStarter from "fhirstarterjs"
-
-const auth = new fhirStarter({
-   clientId: "your-client-id",
-   privateKey: "./privatekey.pem",
-   tokenEndpointUrl: "https://fhir.epic.com/interconnect-fhir-oauth/oauth2/token",
-   scopes: ["system/Patient.rs", "system/Observation.rs"],
-})
-
-await auth.start()
-
-const client = FHIR.client({
-   serverUrl: "https://fhir.epic.com/interconnect-fhir-oauth/api/FHIR/R4",
-   tokenResponse: auth.tokenResponse(),
-})
-
-const bundle = await client.request("Patient?family=Smith")
-```
-
-`auth.start()` fetches the first token and starts the proactive refresh loop. `auth.tokenResponse()` returns a live getter-backed object — `fhirclient` reads `access_token` dynamically per request, so it always picks up the latest token.
-
-`fhirStarter` does not fetch FHIR resources and does not bundle a FHIR client. It manages the auth lifecycle; the FHIR client does the rest.
-
-`privateKey` can be PEM text, a `Buffer` from `readFileSync`, or a path to a PKCS#8 PEM file.
-
-## TypeScript types
-
-If needed, you can import the public types directly:
-
-```ts
-import type { AuthConfig, JwkSet, LiveTokenResponse, Provider } from "fhirstarterjs"
-```
-
-## Other FHIR clients
-
-For clients with a bearer token setter (e.g. `fhir-kit-client`):
-
-```ts
-const unsubscribe = auth.onRefresh((token) => {
-   client.bearerToken = token
-})
-```
-
-For raw `fetch` or any other HTTP client:
-
-```ts
-const token = await auth.getAccessToken()
-const res = await fetch(url, {
-   headers: { Authorization: `Bearer ${token}` },
-})
-```
-
-## API
-
-`new fhirStarter(config)`
-
-| Member | Returns | Description |
-|---|---|---|
-| `start()` | `Promise<void>` | Fetch first token and begin proactive refresh loop |
-| `stop()` | `void` | Clear the refresh timer |
-| `token` | `string \| null` | Current valid token, or null if expired |
-| `expiresIn` | `number \| null` | Seconds until actual expiry, or null |
-| `authorizationHeader` | `string \| null` | `Bearer <token>` or null |
-| `getAccessToken()` | `Promise<string>` | Async valid token with lazy refresh |
-| `tokenResponse()` | `LiveTokenResponse` | Getter-backed token response for `fhirclient` |
-| `onRefresh(callback)` | `() => void` | Subscribe to token updates — returns unsubscribe |
-| `getJwks()` | `Promise<JwkSet>` | Public JWKS derived from the private key |
-| `fhirStarter.thumbprint(privateKey)` | `string` | RFC 7638 JWK Thumbprint (base64url SHA-256) |
-
-`getJwks()` strips private key material — host the output JSON at your registered JWKS URL and pass that URL as `jwksUrl` so the JWT `jku` header is set automatically.
-
-## Thumbprint
-
-Derive a deterministic `kid` from a private key without instantiating the class:
-
-```ts
-import fhirStarter from "fhirstarterjs"
-
-const kid = fhirStarter.thumbprint("./privatekey.pem")
-console.log(kid) // base64url SHA-256 of the canonical RSA public JWK
-```
-
-This implements RFC 7638 — the SHA-256 of the sorted canonical JWK members `{e, kty, n}`, base64url-encoded. Use it as the `keyId` when registering your JWKS.
-
-## JWKS
-
-Some SMART Backend Services registrations require a public JWKS URL when using `jku`. Generate it from the same private key you use for auth:
-
-```ts
-import { writeFileSync } from "node:fs"
-import fhirStarter from "fhirstarterjs"
-
-const auth = new fhirStarter({
-   clientId: "your-client-id",
-   privateKey: "./privatekey.pem",
-   tokenEndpointUrl: "https://fhir.epic.com/interconnect-fhir-oauth/oauth2/token",
-   scopes: ["system/Patient.rs"],
-   keyId: "my-key-id",
-   jwksUrl: "https://example.com/.well-known/jwks.json",
-})
-
-// No need to call auth.start() — getJwks() only needs the private key.
-const jwks = await auth.getJwks()
-writeFileSync("./jwks.json", JSON.stringify(jwks, null, 3))
-```
-
-Host `jwks.json` at the exact URL you register with your authorization server, then pass that URL as `jwksUrl`. If you set `keyId`, the generated key includes `kid`, and signed JWTs use the same `kid` header.
-
-## Compatibility
-
-`tokenResponse()` is designed for `fhirclient.request()`. If a client copies the token at construction time rather than reading it per-request, use `onRefresh()` to update or recreate that client instead. If `fhirclient` clears its internal state after a 401, recreate the client instance with `auth.tokenResponse()`.
-
-## Scripts
-
-| Command | What |
-|---|---|
-| `npm run check` | `tsc --noEmit` |
-| `npm run build` | Compile to `dist/` |
-
-## Notes
-
-- Call `auth.start()` to fetch the first token and begin the proactive refresh loop — call `auth.stop()` during shutdown in long-running processes
-- Tokens are cached with separate refresh and expiry timestamps — if a refresh fails but the token is not yet expired, the old token remains usable
-- Concurrent callers share a single in-flight token refresh
-- JWT assertions are signed RS384, expire after 5 minutes
-- Requires Node 20+, a PKCS#8 RSA key, and SMART Backend Services scopes
+# 🔥 fhirStarter
+
+SMART on FHIR Backend Services auth lifecycle for any FHIR client.
+
+## Install
+
+```sh
+npm install fhirstarterjs
+```
+
+## Usage
+
+This example uses the official `fhirclient` package as the FHIR client; `fhirStarter` only manages auth.
+
+```ts
+import FHIR from "fhirclient"
+import fhirStarter from "fhirstarterjs"
+
+const auth = new fhirStarter({
+   clientId: "your-client-id",
+   privateKey: "./privatekey.pem",
+   tokenEndpointUrl: "https://fhir.epic.com/interconnect-fhir-oauth/oauth2/token",
+   scopes: ["system/Patient.rs", "system/Observation.rs"],
+})
+
+await auth.start()
+
+const client = FHIR.client({
+   serverUrl: "https://fhir.epic.com/interconnect-fhir-oauth/api/FHIR/R4",
+   tokenResponse: auth.tokenResponse(),
+})
+
+const bundle = await client.request("Patient?family=Smith")
+```
+
+`auth.start()` fetches the first token and starts the proactive refresh loop. `auth.tokenResponse()` returns a live getter-backed object — `fhirclient` reads `access_token` dynamically per request, so it always picks up the latest token.
+
+`fhirStarter` does not fetch FHIR resources and does not bundle a FHIR client. It manages the auth lifecycle; the FHIR client does the rest.
+
+`privateKey` can be PEM text, a `Buffer` from `readFileSync`, or a path to a PKCS#8 PEM file.
+
+## TypeScript types
+
+If needed, you can import the public types directly:
+
+```ts
+import type { AuthConfig, JwkSet, LiveTokenResponse, Provider } from "fhirstarterjs"
+```
+
+## Other FHIR clients
+
+For clients with a bearer token setter (e.g. `fhir-kit-client`):
+
+```ts
+const unsubscribe = auth.onRefresh((token) => {
+   client.bearerToken = token
+})
+```
+
+For raw `fetch` or any other HTTP client:
+
+```ts
+const token = await auth.getAccessToken()
+const res = await fetch(url, {
+   headers: { Authorization: `Bearer ${token}` },
+})
+```
+
+## API
+
+`new fhirStarter(config)`
+
+| Member | Returns | Description |
+|---|---|---|
+| `start()` | `Promise<void>` | Fetch first token and begin proactive refresh loop |
+| `stop()` | `void` | Clear the refresh timer |
+| `token` | `string \| null` | Current valid token, or null if expired |
+| `expiresIn` | `number \| null` | Seconds until actual expiry, or null |
+| `authorizationHeader` | `string \| null` | `Bearer <token>` or null |
+| `getAccessToken()` | `Promise<string>` | Async valid token with lazy refresh |
+| `tokenResponse()` | `LiveTokenResponse` | Getter-backed token response for `fhirclient` |
+| `onRefresh(callback)` | `() => void` | Subscribe to token updates — returns unsubscribe |
+| `getJwks()` | `Promise<JwkSet>` | Public JWKS derived from the private key |
+| `fhirStarter.thumbprint(privateKey)` | `string` | RFC 7638 JWK Thumbprint (base64url SHA-256) |
+
+`getJwks()` strips private key material — host the output JSON at your registered JWKS URL and pass that URL as `jwksUrl` so the JWT `jku` header is set automatically.
+
+## Thumbprint
+
+Derive a deterministic `kid` from a private key without instantiating the class:
+
+```ts
+import fhirStarter from "fhirstarterjs"
+
+const kid = fhirStarter.thumbprint("./privatekey.pem")
+console.log(kid) // base64url SHA-256 of the canonical RSA public JWK
+```
+
+This implements RFC 7638 — the SHA-256 of the sorted canonical JWK members `{e, kty, n}`, base64url-encoded. Use it as the `keyId` when registering your JWKS.
+
+## JWKS
+
+Some SMART Backend Services registrations require a public JWKS URL when using `jku`. Generate it from the same private key you use for auth:
+
+```ts
+import { writeFileSync } from "node:fs"
+import fhirStarter from "fhirstarterjs"
+
+const auth = new fhirStarter({
+   clientId: "your-client-id",
+   privateKey: "./privatekey.pem",
+   tokenEndpointUrl: "https://fhir.epic.com/interconnect-fhir-oauth/oauth2/token",
+   scopes: ["system/Patient.rs"],
+   keyId: "my-key-id",
+   jwksUrl: "https://example.com/.well-known/jwks.json",
+})
+
+// No need to call auth.start() — getJwks() only needs the private key.
+const jwks = await auth.getJwks()
+writeFileSync("./jwks.json", JSON.stringify(jwks, null, 3))
+```
+
+Host `jwks.json` at the exact URL you register with your authorization server, then pass that URL as `jwksUrl`. If you set `keyId`, the generated key includes `kid`, and signed JWTs use the same `kid` header.
+
+## Compatibility
+
+`tokenResponse()` is designed for `fhirclient.request()`. If a client copies the token at construction time rather than reading it per-request, use `onRefresh()` to update or recreate that client instead. If `fhirclient` clears its internal state after a 401, recreate the client instance with `auth.tokenResponse()`.
+
+## Scripts
+
+| Command | What |
+|---|---|
+| `npm run check` | `tsc --noEmit` |
+| `npm run build` | Compile to `dist/` |
+
+## Notes
+
+- Call `auth.start()` to fetch the first token and begin the proactive refresh loop — call `auth.stop()` during shutdown in long-running processes
+- Tokens are cached with separate refresh and expiry timestamps — if a refresh fails but the token is not yet expired, the old token remains usable
+- Concurrent callers share a single in-flight token refresh
+- JWT assertions are signed RS384, expire after 5 minutes
+- Requires Node 20+, a PKCS#8 RSA key, and SMART Backend Services scopes

package/dist/fhirstarter.d.ts

@@ -0,0 +1,81 @@
+/**
+ * SMART Backend Services auth provider.
+ *
+ * Manages client-credentials token acquisition and proactive refresh
+ * using a private RSA key and the JWT Bearer client-assertion flow (RFC 7523).
+ */
+export default class fhirStarter implements Provider {
+    private readonly config;
+    private readonly privateKeyText;
+    private readonly refreshCallbacks;
+    private cache;
+    private refreshPromise;
+    private refreshTimer;
+    private privateKeyObj;
+    private started;
+    private refreshFailed;
+    private refreshRetryMs;
+    /**
+     * @param config - Auth configuration including client ID, private key, token endpoint, and scopes.
+     * @throws If any required field is missing, blank, or invalid.
+     */
+    constructor(config: AuthConfig);
+    /** The current access token, or `null` if no valid token is cached. */
+    get token(): string | null;
+    /** Seconds until the cached token expires, or `null` if no valid token is cached. */
+    get expiresIn(): number | null;
+    /** Ready-to-use `Authorization` header value (e.g. `"Bearer <token>"`), or `null` if no valid token is cached. */
+    get authorizationHeader(): string | null;
+    /**
+     * Acquires an initial token and starts the proactive background refresh timer.
+     * Safe to call multiple times — subsequent calls are no-ops.
+     * @throws If the initial token acquisition fails.
+     */
+    start: () => Promise<void>;
+    /**
+     * Stops the background refresh timer.
+     * Any in-flight refresh will still complete, but no new timers will be scheduled.
+     */
+    stop: () => void;
+    /**
+     * Returns a live `LiveTokenResponse` object whose `access_token` and `expires_in`
+     * properties are always read from the current cache.
+     * Useful for libraries that hold a reference to a token response object.
+     */
+    tokenResponse: () => LiveTokenResponse;
+    /**
+     * Registers a callback that is invoked whenever a new access token is obtained.
+     * The callback is called immediately with the current token if one is already cached.
+     * @param callback - Receives the new access token string.
+     * @returns An unsubscribe function call it to stop receiving updates.
+     */
+    onRefresh: (callback: RefreshCallback) => (() => void);
+    /**
+     * Returns the public JWKS derived from the configured private key.
+     * Private key material (`d`, `p`, `q`, etc.) is stripped before returning.
+     */
+    getJwks: () => Promise<JwkSet>;
+    /**
+     * Returns a valid access token, refreshing if the cached token is at or past its refresh threshold.
+     * Falls back to a not-yet-expired stale token if the refresh request fails.
+     * @throws If no cached token is available and the refresh request fails.
+     */
+    getAccessToken: () => Promise<string>;
+    private doRefresh;
+    private scheduleRefresh;
+    private notifyRefresh;
+    private refreshAccessToken;
+    private getPrivateKey;
+    private buildJwt;
+    private static normalizeScopes;
+    private static resolvePrivateKey;
+    /**
+     * Derives a deterministic key identifier from a private key using an
+     * RFC 7638 JWK Thumbprint (SHA-256 of canonical RSA public JWK members, base64url).
+     *
+     * @param privateKey - RSA PKCS#8 PEM text, a Buffer, or a readable file path.
+     * @returns A base64url-encoded SHA-256 thumbprint string.
+     * @throws If the key is not RSA or cannot be parsed.
+     */
+    static thumbprint(privateKey: string | Buffer): string;
+}

package/dist/fhirstarter.js

@@ -314,3 +314,4 @@ export default class fhirStarter {
         return createHash("sha256").update(canonical).digest("base64url");
     }
 }
+//# sourceMappingURL=fhirstarter.js.map

package/dist/fhirstarter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fhirstarter.js","sourceRoot":"","sources":["../ts/fhirstarter.ts"],"names":[],"mappings":"AAAA,OAAO,EACJ,WAAW,EACX,SAAS,EACT,OAAO,GAET,MAAM,MAAM,CAAA;AACb,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGtC;;;;;GAKG;AACH,MAAM,CAAC,OAAO,OAAO,WAAW;IACZ,MAAM,CAAY;IAClB,cAAc,CAAQ;IACtB,gBAAgB,GAAyB,IAAI,GAAG,EAAE,CAAA;IAC3D,KAAK,GAAsB,IAAI,CAAA;IAC/B,cAAc,GAA2B,IAAI,CAAA;IAC7C,YAAY,GAAyC,IAAI,CAAA;IACzD,aAAa,GAAmD,IAAI,CAAA;IACpE,OAAO,GAAG,KAAK,CAAA;IACf,aAAa,GAAG,KAAK,CAAA;IACrB,cAAc,GAAG,KAAK,CAAA;IAE9B;;;OAGG;IACH,YAAY,MAAkB;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACzE,IACG,CAAC,MAAM,CAAC,UAAU;YAClB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;YAEtE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,CAAC,gBAAgB;YACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAE9D,MAAM,MAAM,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAEhE,IAAI,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACZ,oDAAoD,MAAM,CAAC,gBAAgB,EAAE,CAC/E,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACzE,CAAC;IAED,uBAAuB;IAEvB,uEAAuE;IACvE,IAAI,KAAK;QACN,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,WAAW;YACzB,CAAC,CAAE,IAAI,CAAA;IACb,CAAC;IAED,qFAAqF;IACrF,IAAI,SAAS;QACV,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;YACxD,CAAC,CAAE,IAAI,CAAA;IACb,CAAC;IAED,kHAAkH;IAClH,IAAI,mBAAmB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED,oBAAoB;IAEpB;;;;OAIG;IACH,KAAK,GAAG,KAAK,IAAmB,EAAE;QAC/B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAA;QAC3B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAA;QAC1B,IAAI,CAAC;YACF,MAAM,IAAI,CAAC,cAAc,EAAE,CAAA;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;YACpB,MAAM,GAAG,CAAA;QACZ,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAA;IACzB,CAAC,CAAA;IAED;;;OAGG;IACH,IAAI,GAAG,GAAS,EAAE;QACf,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACpB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC3B,CAAC;IACJ,CAAC,CAAA;IAED,yBAAyB;IAEzB;;;;OAIG;IACH,aAAa,GAAG,GAAsB,EAAE;QACrC,MAAM,IAAI,GAAG,IAAI,CAAA;QACjB,OAAO;YACJ,UAAU,EAAE,QAAQ;YACpB,IAAI,YAAY;gBACb,OAAO,IAAI,CAAC,KAAK,IAAI,SAAS,CAAA;YACjC,CAAC;YACD,IAAI,UAAU;gBACX,OAAO,IAAI,CAAC,SAAS,IAAI,SAAS,CAAA;YACrC,CAAC;YACD,IAAI,KAAK;gBACN,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,CAAA;YAC3B,CAAC;SACH,CAAA;IACJ,CAAC,CAAA;IAED;;;;;OAKG;IACH,SAAS,GAAG,CAAC,QAAyB,EAAgB,EAAE;QACrD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAA;QAC1B,IAAI,OAAO;YACR,IAAI,CAAC;gBACF,QAAQ,CAAC,OAAO,CAAC,CAAA;YACpB,CAAC;YAAC,MAAM,CAAC;gBACN,YAAY;YACf,CAAC;QACJ,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACtD,CAAC,CAAA;IAED,uBAAuB;IAEvB;;;OAGG;IACH,OAAO,GAAG,KAAK,IAAqB,EAAE;QACnC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,MAAM,EAC1B,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,EACvC,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAA;QAEpC,OAAO,GAAG,CAAC,CAAC,CAAA;QACZ,OAAO,GAAG,CAAC,CAAC,CAAA;QACZ,OAAO,GAAG,CAAC,CAAC,CAAA;QACZ,OAAO,GAAG,CAAC,EAAE,CAAA;QACb,OAAO,GAAG,CAAC,EAAE,CAAA;QACb,OAAO,GAAG,CAAC,EAAE,CAAA;QACb,GAAG,CAAC,GAAG,GAAG,OAAO,CAAA;QACjB,GAAG,CAAC,GAAG,GAAG,KAAK,CAAA;QACf,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,GAAG,KAAK,CAAA;QAE1B,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IACzB,CAAC,CAAA;IAED;;;;OAIG;IACH,cAAc,GAAG,KAAK,IAAqB,EAAE;QAC1C,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS;YAChD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAA;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAA;QAC7B,IAAI,CAAC;YACF,OAAO,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACZ,4EAA4E;YAC5E,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,SAAS;gBAChD,OAAO,UAAU,CAAC,WAAW,CAAA;YAChC,MAAM,GAAG,CAAA;QACZ,CAAC;IACJ,CAAC,CAAA;IAED,kBAAkB;IAElB,2EAA2E;IACnE,SAAS,GAAG,GAAoB,EAAE;QACvC,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAA;QACnD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,kBAAkB,EAAE;aAC3C,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;YAC1B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAA;YAC1B,IAAI,CAAC,cAAc,GAAG,KAAK,CAAA;YAC3B,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,eAAe,EAAE,CAAA;YACxC,OAAO,KAAK,CAAC,WAAW,CAAA;QAC3B,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;YAC1B,MAAM,GAAG,CAAA;QACZ,CAAC,CAAC,CAAA;QACL,OAAO,IAAI,CAAC,cAAc,CAAA;IAC7B,CAAC,CAAA;IAEO,eAAe,GAAG,GAAS,EAAE;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAM;QACzB,IAAI,IAAI,CAAC,YAAY;YAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAEtD,MAAM,KAAK,GACR,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;YAChC,IAAI,CAAC,cAAc;YACtB,CAAC,CAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAExD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACvC,IAAI,CAAC;gBACF,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;YACzB,CAAC;YAAC,MAAM,CAAC;gBACN,IAAI,CAAC,aAAa,GAAG,IAAI,CAAA;gBACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;gBAC/D,IAAI,CAAC,eAAe,EAAE,CAAA;YACzB,CAAC;QACJ,CAAC,EAAE,KAAK,CAAC,CAAA;QAET,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAA;IAC9B,CAAC,CAAA;IAEO,aAAa,GAAG,CAAC,KAAa,EAAQ,EAAE;QAC7C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,gBAAgB;YACzC,IAAI,CAAC;gBACF,QAAQ,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;YAAC,MAAM,CAAC;gBACN,yDAAyD;YAC5D,CAAC;IACP,CAAC,CAAA;IAEO,kBAAkB,GAAG,KAAK,IAAyB,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,EAC9B,MAAM,GAAG,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EACxD,IAAI,GAAG,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,qBAAqB,EAClB,wDAAwD;YAC3D,gBAAgB,EAAE,GAAG;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACzB,CAAC,EACF,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACrC,CAAC,CAAA;QAEL,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAA;YACtD,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,IAAI,IAAmB,CAAA;QACvB,IAAI,CAAC;YACF,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACtD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAC5D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACzD,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAE3D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EACjC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,EACtC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,SAAS,GAAG,GAAG,GAAG,KAAK,EACvB,SAAS,GAAG,SAAS,GAAG,QAAQ,EAChC,KAAK,GAAe;YACjB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS;YACT,SAAS;YACT,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAC9D,CAAA;QAEJ,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACrC,OAAO,KAAK,CAAA;IACf,CAAC,CAAA;IAEO,aAAa,GAAG,KAAK,IAE3B,EAAE;QACD,IAAI,CAAC,IAAI,CAAC,aAAa;YACpB,IAAI,CAAC,aAAa,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE;gBAClE,WAAW,EAAE,IAAI;aACnB,CAAC,CAAA;QACL,OAAO,IAAI,CAAC,aAAa,CAAA;IAC5B,CAAC,CAAA;IAEO,QAAQ,GAAG,KAAK,IAAqB,EAAE;QAC5C,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAC/D,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,EACvC,MAAM,GAAwB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;QAC7D,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,GAAG,KAAK,CAAA;QAC7B,IAAI,OAAO;YAAE,MAAM,CAAC,GAAG,GAAG,OAAO,CAAA;QAEjC,OAAO,IAAI,OAAO,CAAC;YAChB,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,gBAAgB;YACrB,GAAG,EAAE,UAAU,EAAE,EAAE,yBAAyB;SAC9C,CAAC;aACE,kBAAkB,CAAC,MAAM,CAAC;aAC1B,WAAW,EAAE;aACb,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,UAAU,CAAC,CAAA;IACvB,CAAC,CAAA;IAED,yBAAyB;IAEjB,MAAM,CAAC,eAAe,CAAC,MAAyB;QACrD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YACzB,CAAC,CAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAC,UAA2B;QACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QAE7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,OAAO,CAAA;QAElD,IAAI,CAAC;YACF,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACZ,+EAA+E,OAAO,EAAE,CAC1F,CAAA;QACJ,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,UAAU,CAAC,UAA2B;QAC1C,MACG,GAAG,GAAG,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAC/C,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK;YAChC,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAA;QAChF,MACG,GAAG,GAAG,eAAe,CAAC,GAAgC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA6C,EAC7H,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;QACjE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACpE,CAAC;CACH"}

package/package.json

@@ -1,62 +1,76 @@
-{
-   "name": "fhirstarterjs",
-   "version": "1.0.8",
-   "description": "SMART Backend Services auth lifecycle for any FHIR client",
-   "author": "Joshua Faulkenberry <j@joshuafaulkenberry.com> (https://joshuafaulkenberry.com/)",
-   "license": "Kopimi",
-   "homepage": "https://github.com/FaulkJ/fhirstarter#readme",
-   "repository": {
-      "type": "git",
-      "url": "git+https://github.com/FaulkJ/fhirstarter.git"
-   },
-   "bugs": {
-      "url": "https://github.com/FaulkJ/fhirstarter/issues"
-   },
-   "keywords": [
-      "fhir",
-      "smart",
-      "smart-on-fhir",
-      "backend-services",
-      "oauth",
-      "jwt",
-      "hl7",
-      "healthcare",
-      "ehr",
-      "epic",
-      "fhirclient",
-      "token",
-      "jwks"
-   ],
-   "type": "module",
-   "main": "./dist/fhirstarter.js",
-   "types": "./types/index.d.ts",
-   "exports": {
-      ".": {
-         "types": "./types/index.d.ts",
-         "import": "./dist/fhirstarter.js"
-      }
-   },
-   "sideEffects": false,
-   "files": [
-      "dist",
-      "ts",
-      "types",
-      "README.md",
-      "LICENSE.md"
-   ],
-   "engines": {
-      "node": ">=20"
-   },
-   "scripts": {
-      "check": "tsc --noEmit",
-      "build": "tsc -p tsconfig.build.json",
-      "prepack": "npm run build"
-   },
-   "dependencies": {
-      "jose": "^6.2.3"
-   },
-   "devDependencies": {
-      "@types/node": "^26.0.1",
-      "typescript": "^6.0.3"
-   }
-}
+{
+   "name": "fhirstarterjs",
+   "version": "1.0.9",
+   "description": "SMART on FHIR Backend Services (client credentials) auth lifecycle for any FHIR client — JWT assertion, JWKS, and automatic token refresh.",
+   "keywords": [
+      "fhir",
+      "smart-on-fhir",
+      "smart",
+      "backend-services",
+      "smart-backend-services",
+      "fhir-auth",
+      "fhir-client",
+      "fhirclient",
+      "oauth",
+      "oauth2",
+      "client-credentials",
+      "jwt",
+      "jwt-assertion",
+      "jwks",
+      "token",
+      "token-refresh",
+      "access-token",
+      "healthcare",
+      "hl7",
+      "ehr",
+      "r4",
+      "interoperability"
+   ],
+   "author": "Joshua Faulkenberry <j@joshuafaulkenberry.com> (https://joshuafaulkenberry.com/)",
+   "license": "Kopimi",
+   "homepage": "https://github.com/faulkj/fhirStarter#readme",
+   "repository": {
+      "type": "git",
+      "url": "git+https://github.com/faulkj/fhirStarter.git"
+   },
+   "bugs": {
+      "url": "https://github.com/faulkj/fhirStarter/issues"
+   },
+   "type": "module",
+   "main": "./dist/fhirstarter.js",
+   "types": "./types/index.d.ts",
+   "exports": {
+      ".": {
+         "types": "./types/index.d.ts",
+         "import": "./dist/fhirstarter.js"
+      }
+   },
+   "sideEffects": false,
+   "files": [
+      "dist",
+      "ts",
+      "types",
+      "README.md",
+      "LICENSE.md"
+   ],
+   "publishConfig": {
+      "provenance": true,
+      "access": "public"
+   },
+   "engines": {
+      "node": ">=20"
+   },
+   "scripts": {
+      "check": "tsc --noEmit",
+      "clean": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\"",
+      "build": "npm run clean && tsc -p tsconfig.build.json",
+      "prepack": "npm run build"
+   },
+   "dependencies": {
+      "jose": "^6.2.3"
+   },
+   "devDependencies": {
+      "@types/node": "^26.1.1",
+      "typescript": "^7.0.2"
+   }
+}