huia-auth-core 1.0.0-alpha.5

package/dist/cookie.d.ts

@@ -0,0 +1,15 @@
+export declare function splitIntoChunks(value: string, limit: number): string[];
+export declare function sealValue(password: string, value: unknown, ttlSeconds?: number): Promise<string>;
+export declare function unsealValue<T>(password: string, sealed: string | undefined, ttlSeconds?: number): Promise<T | null>;
+/**
+ * Normalizes the cookie name:
+ * If secure=true, preserves `__Host-` or `__Secure-` prefixes.
+ * If secure=false (e.g. dev over plain http), strips `__Host-` and `__Secure-` prefixes
+ * because browsers strictly reject prefixed cookies over insecure HTTP.
+ */
+export declare function resolveCookieName(name: string, secure: boolean): string;
+/**
+ * Reassembles a chunked cookie if present, or reads single cookie.
+ */
+export declare function assembleChunks(getCookie: (name: string) => string | undefined, name: string, maxChunks?: number): string | null;
+//# sourceMappingURL=cookie.d.ts.map

package/dist/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAMA,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAOtE;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAKhG;AAED,wBAAsB,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,SAAS,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWzH;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAGvE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC/C,IAAI,EAAE,MAAM,EACZ,SAAS,SAAI,GACZ,MAAM,GAAG,IAAI,CAYf"}

package/dist/cookie.js

@@ -0,0 +1,60 @@
+import uncrypto from 'uncrypto';
+import { seal, unseal, defaults as ironDefaults } from 'iron-webcrypto';
+// iron-webcrypto's internal _Crypto shape; uncrypto satisfies it at runtime in node/browser/edge.
+const ironCrypto = uncrypto;
+export function splitIntoChunks(value, limit) {
+    if (limit <= 0)
+        return [value];
+    const parts = [];
+    for (let i = 0; i < value.length; i += limit) {
+        parts.push(value.slice(i, i + limit));
+    }
+    return parts;
+}
+export function sealValue(password, value, ttlSeconds = 604800) {
+    return seal(ironCrypto, value, password, {
+        ...ironDefaults,
+        ttl: ttlSeconds * 1000,
+    });
+}
+export async function unsealValue(password, sealed, ttlSeconds = 604800) {
+    if (!sealed)
+        return null;
+    try {
+        return (await unseal(ironCrypto, sealed, password, {
+            ...ironDefaults,
+            ttl: ttlSeconds * 1000,
+        }));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Normalizes the cookie name:
+ * If secure=true, preserves `__Host-` or `__Secure-` prefixes.
+ * If secure=false (e.g. dev over plain http), strips `__Host-` and `__Secure-` prefixes
+ * because browsers strictly reject prefixed cookies over insecure HTTP.
+ */
+export function resolveCookieName(name, secure) {
+    if (secure)
+        return name;
+    return name.replace(/^__Host-/, '').replace(/^__Secure-/, '');
+}
+/**
+ * Reassembles a chunked cookie if present, or reads single cookie.
+ */
+export function assembleChunks(getCookie, name, maxChunks = 4) {
+    const direct = getCookie(name);
+    if (direct !== undefined && direct !== '')
+        return direct;
+    const parts = [];
+    for (let i = 0; i < maxChunks; i++) {
+        const part = getCookie(`${name}.${i}`);
+        if (part === undefined || part === '')
+            break;
+        parts.push(part);
+    }
+    return parts.length > 0 ? parts.join('') : null;
+}
+//# sourceMappingURL=cookie.js.map

package/dist/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEvE,kGAAkG;AAClG,MAAM,UAAU,GAAG,QAAiD,CAAA;AAEpE,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,KAAc,EAAE,UAAU,GAAG,MAAM;IAC7E,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;QACvC,GAAG,YAAY;QACf,GAAG,EAAE,UAAU,GAAG,IAAI;KACvB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,QAAgB,EAAE,MAA0B,EAAE,UAAU,GAAG,MAAM;IACpG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;YACjD,GAAG,YAAY;YACf,GAAG,EAAE,UAAU,GAAG,IAAI;SACvB,CAAC,CAAM,CAAA;IACV,CAAC;IACD,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAe;IAC7D,IAAI,MAAM;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA+C,EAC/C,IAAY,EACZ,SAAS,GAAG,CAAC;IAEb,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,MAAM,CAAA;IAExD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;YAAE,MAAK;QAC5C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC"}

package/dist/headless-client.d.ts

@@ -0,0 +1,81 @@
+import type { BackendTokenResponse, BackendMeResponse, BackendPhoneStartResponse, BackendPhoneVerifyResponse, BackendExternalExchangeResponse, HeadlessAdminUser, HeadlessAdminRole, HeadlessAdminUsersPage, CreateHeadlessAdminUserRequest, UpdateHeadlessAdminUserRequest } from './types.js';
+export declare class BackendError extends Error {
+    status: number;
+    problem: unknown;
+    constructor(status: number, problem: unknown);
+}
+export interface HuiaHeadlessClientOptions {
+    baseUrl: string;
+    allowInsecureTls?: boolean;
+}
+export declare class HuiaHeadlessClient {
+    readonly baseUrl: string;
+    readonly allowInsecureTls: boolean;
+    constructor(options: HuiaHeadlessClientOptions);
+    private call;
+    register(body: {
+        email: string;
+        password: string;
+        firstName?: string;
+        lastName?: string;
+    }): Promise<void>;
+    login(body: {
+        email: string;
+        password: string;
+        twoFactorCode?: string;
+        twoFactorRecoveryCode?: string;
+    }): Promise<BackendTokenResponse>;
+    refresh(refreshToken: string): Promise<BackendTokenResponse>;
+    me(accessToken: string): Promise<BackendMeResponse>;
+    confirmEmail(userId: string, code: string, changedEmail?: string): Promise<void>;
+    resendConfirmationEmail(email: string): Promise<void>;
+    forgotPassword(email: string): Promise<void>;
+    resetPassword(body: {
+        email: string;
+        resetCode: string;
+        newPassword: string;
+    }): Promise<void>;
+    phoneStart(body: {
+        phoneNumber: string;
+        country?: string;
+        captchaResponse?: string;
+    }): Promise<BackendPhoneStartResponse>;
+    phoneVerify(body: {
+        flowId: string;
+        code: string;
+    }): Promise<BackendPhoneVerifyResponse>;
+    phoneCompleteProfile(body: {
+        flowId: string;
+        firstName: string;
+        lastName: string;
+    }): Promise<BackendTokenResponse>;
+    externalLoginUrl(provider: string, returnUrl: string): string;
+    externalExchange(code: string): Promise<BackendExternalExchangeResponse>;
+    externalCompleteProfile(body: {
+        code: string;
+        firstName: string;
+        lastName: string;
+    }): Promise<BackendTokenResponse>;
+    adminListUsers(accessToken: string, params?: {
+        page?: number;
+        pageSize?: number;
+        search?: string;
+    }): Promise<HeadlessAdminUsersPage>;
+    adminGetUser(accessToken: string, id: string): Promise<HeadlessAdminUser>;
+    adminCreateUser(accessToken: string, body: CreateHeadlessAdminUserRequest): Promise<HeadlessAdminUser>;
+    adminUpdateUser(accessToken: string, id: string, body: UpdateHeadlessAdminUserRequest): Promise<HeadlessAdminUser>;
+    adminDeleteUser(accessToken: string, id: string): Promise<void>;
+    adminGetUserRoles(accessToken: string, id: string): Promise<string[]>;
+    adminAddUserRole(accessToken: string, id: string, role: string): Promise<void>;
+    adminRemoveUserRole(accessToken: string, id: string, role: string): Promise<void>;
+    adminLockUser(accessToken: string, id: string): Promise<void>;
+    adminUnlockUser(accessToken: string, id: string): Promise<void>;
+    adminListRoles(accessToken: string): Promise<{
+        data: HeadlessAdminRole[];
+    }>;
+    adminGetRole(accessToken: string, id: string): Promise<HeadlessAdminRole>;
+    adminCreateRole(accessToken: string, name: string): Promise<HeadlessAdminRole>;
+    adminUpdateRole(accessToken: string, id: string, name: string): Promise<HeadlessAdminRole>;
+    adminDeleteRole(accessToken: string, id: string): Promise<void>;
+}
+//# sourceMappingURL=headless-client.d.ts.map

package/dist/headless-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-client.d.ts","sourceRoot":"","sources":["../src/headless-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,+BAA+B,EAC/B,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,YAAY,CAAA;AAEnB,qBAAa,YAAa,SAAQ,KAAK;IAClB,MAAM,EAAE,MAAM;IAAS,OAAO,EAAE,OAAO;gBAAvC,MAAM,EAAE,MAAM,EAAS,OAAO,EAAE,OAAO;CAI3D;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;gBAEtB,OAAO,EAAE,yBAAyB;YAShC,IAAI;IA+BlB,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzG,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAOvI,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAO5D,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOnD,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5C,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7F,UAAU,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAOzH,WAAW,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAOxF,oBAAoB,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAOlH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAK7D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAOxE,uBAAuB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAOnH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYpI,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOzE,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQtG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQlH,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOrE,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9E,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOjF,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7D,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC;IAO3E,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOzE,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQ9E,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQ1F,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMhE"}

package/dist/headless-client.js

@@ -0,0 +1,231 @@
+export class BackendError extends Error {
+    status;
+    problem;
+    constructor(status, problem) {
+        super(`huia_headless_error: ${status}`);
+        this.status = status;
+        this.problem = problem;
+        this.name = 'BackendError';
+    }
+}
+export class HuiaHeadlessClient {
+    baseUrl;
+    allowInsecureTls;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/+$/, '');
+        this.allowInsecureTls = options.allowInsecureTls ?? false;
+        if (this.allowInsecureTls && typeof process !== 'undefined' && process.env.NODE_ENV !== 'production') {
+            process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+        }
+    }
+    async call(path, init) {
+        const res = await fetch(`${this.baseUrl}${path}`, {
+            ...init,
+            headers: {
+                'content-type': 'application/json',
+                ...init.headers,
+            },
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            let problem = null;
+            if (text) {
+                try {
+                    problem = JSON.parse(text);
+                }
+                catch {
+                    problem = text;
+                }
+            }
+            throw new BackendError(res.status, problem);
+        }
+        if (!text) {
+            return undefined;
+        }
+        return JSON.parse(text);
+    }
+    register(body) {
+        return this.call('/identity/register', {
+            method: 'POST',
+            body: JSON.stringify(body),
+        });
+    }
+    login(body) {
+        return this.call('/identity/login', {
+            method: 'POST',
+            body: JSON.stringify(body),
+        });
+    }
+    refresh(refreshToken) {
+        return this.call('/identity/refresh', {
+            method: 'POST',
+            body: JSON.stringify({ refreshToken }),
+        });
+    }
+    me(accessToken) {
+        return this.call('/identity/me', {
+            method: 'GET',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    confirmEmail(userId, code, changedEmail) {
+        const query = new URLSearchParams({ userId, code, ...(changedEmail ? { changedEmail } : {}) });
+        return this.call(`/identity/confirmEmail?${query}`, { method: 'GET' });
+    }
+    resendConfirmationEmail(email) {
+        return this.call('/identity/resendConfirmationEmail', {
+            method: 'POST',
+            body: JSON.stringify({ email }),
+        });
+    }
+    forgotPassword(email) {
+        return this.call('/identity/forgotPassword', {
+            method: 'POST',
+            body: JSON.stringify({ email }),
+        });
+    }
+    resetPassword(body) {
+        return this.call('/identity/resetPassword', {
+            method: 'POST',
+            body: JSON.stringify(body),
+        });
+    }
+    phoneStart(body) {
+        return this.call('/identity/phone/start', {
+            method: 'POST',
+            body: JSON.stringify(body),
+        });
+    }
+    phoneVerify(body) {
+        return this.call('/identity/phone/verify', {
+            method: 'POST',
+            body: JSON.stringify(body),
+        });
+    }
+    phoneCompleteProfile(body) {
+        return this.call('/identity/phone/complete-profile', {
+            method: 'POST',
+            body: JSON.stringify(body),
+        });
+    }
+    externalLoginUrl(provider, returnUrl) {
+        const q = new URLSearchParams({ returnUrl });
+        return `${this.baseUrl}/identity/account/external/${encodeURIComponent(provider)}?${q}`;
+    }
+    externalExchange(code) {
+        return this.call('/identity/account/external/exchange', {
+            method: 'POST',
+            body: JSON.stringify({ code }),
+        });
+    }
+    externalCompleteProfile(body) {
+        return this.call('/identity/account/external/complete-profile', {
+            method: 'POST',
+            body: JSON.stringify(body),
+        });
+    }
+    adminListUsers(accessToken, params) {
+        const q = new URLSearchParams();
+        if (params?.page)
+            q.set('page', String(params.page));
+        if (params?.pageSize)
+            q.set('pageSize', String(params.pageSize));
+        if (params?.search)
+            q.set('search', params.search);
+        const qs = q.toString() ? `?${q}` : '';
+        return this.call(`/admin/users${qs}`, {
+            method: 'GET',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    adminGetUser(accessToken, id) {
+        return this.call(`/admin/users/${encodeURIComponent(id)}`, {
+            method: 'GET',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    adminCreateUser(accessToken, body) {
+        return this.call('/admin/users', {
+            method: 'POST',
+            headers: { authorization: `Bearer ${accessToken}` },
+            body: JSON.stringify(body),
+        });
+    }
+    adminUpdateUser(accessToken, id, body) {
+        return this.call(`/admin/users/${encodeURIComponent(id)}`, {
+            method: 'PUT',
+            headers: { authorization: `Bearer ${accessToken}` },
+            body: JSON.stringify(body),
+        });
+    }
+    adminDeleteUser(accessToken, id) {
+        return this.call(`/admin/users/${encodeURIComponent(id)}`, {
+            method: 'DELETE',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    adminGetUserRoles(accessToken, id) {
+        return this.call(`/admin/users/${encodeURIComponent(id)}/roles`, {
+            method: 'GET',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    adminAddUserRole(accessToken, id, role) {
+        return this.call(`/admin/users/${encodeURIComponent(id)}/roles`, {
+            method: 'POST',
+            headers: { authorization: `Bearer ${accessToken}` },
+            body: JSON.stringify({ role }),
+        });
+    }
+    adminRemoveUserRole(accessToken, id, role) {
+        return this.call(`/admin/users/${encodeURIComponent(id)}/roles/${encodeURIComponent(role)}`, {
+            method: 'DELETE',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    adminLockUser(accessToken, id) {
+        return this.call(`/admin/users/${encodeURIComponent(id)}/lock`, {
+            method: 'POST',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    adminUnlockUser(accessToken, id) {
+        return this.call(`/admin/users/${encodeURIComponent(id)}/unlock`, {
+            method: 'POST',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    adminListRoles(accessToken) {
+        return this.call('/admin/roles', {
+            method: 'GET',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    adminGetRole(accessToken, id) {
+        return this.call(`/admin/roles/${encodeURIComponent(id)}`, {
+            method: 'GET',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+    adminCreateRole(accessToken, name) {
+        return this.call('/admin/roles', {
+            method: 'POST',
+            headers: { authorization: `Bearer ${accessToken}` },
+            body: JSON.stringify({ name }),
+        });
+    }
+    adminUpdateRole(accessToken, id, name) {
+        return this.call(`/admin/roles/${encodeURIComponent(id)}`, {
+            method: 'PUT',
+            headers: { authorization: `Bearer ${accessToken}` },
+            body: JSON.stringify({ name }),
+        });
+    }
+    adminDeleteRole(accessToken, id) {
+        return this.call(`/admin/roles/${encodeURIComponent(id)}`, {
+            method: 'DELETE',
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+    }
+}
+//# sourceMappingURL=headless-client.js.map

package/dist/headless-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-client.js","sourceRoot":"","sources":["../src/headless-client.ts"],"names":[],"mappings":"AAaA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAClB;IAAuB;IAA1C,YAAmB,MAAc,EAAS,OAAgB;QACxD,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAA;QADtB,WAAM,GAAN,MAAM,CAAQ;QAAS,YAAO,GAAP,OAAO,CAAS;QAExD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC5B,CAAC;CACF;AAOD,MAAM,OAAO,kBAAkB;IACpB,OAAO,CAAQ;IACf,gBAAgB,CAAS;IAElC,YAAY,OAAkC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAA;QAEzD,IAAI,IAAI,CAAC,gBAAgB,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACrG,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,GAAG,CAAA;QAChD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAiB;QACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,IAAI,CAAC,OAAO;aAChB;SACF,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAE7B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,OAAO,GAAY,IAAI,CAAA;YAC3B,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC5B,CAAC;gBACD,MAAM,CAAC;oBACL,OAAO,GAAG,IAAI,CAAA;gBAChB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7C,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAc,CAAA;QACvB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;IAC9B,CAAC;IAED,QAAQ,CAAC,IAAgF;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,IAAiG;QACrG,OAAO,IAAI,CAAC,IAAI,CAAuB,iBAAiB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,CAAC,YAAoB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAuB,mBAAmB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;SACvC,CAAC,CAAA;IACJ,CAAC;IAED,EAAE,CAAC,WAAmB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAoB,cAAc,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,YAAqB;QAC9D,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC9F,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,uBAAuB,CAAC,KAAa;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,mCAAmC,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,aAAa,CAAC,IAA+D;QAC3E,OAAO,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,UAAU,CAAC,IAAyE;QAClF,OAAO,IAAI,CAAC,IAAI,CAA4B,uBAAuB,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,WAAW,CAAC,IAAsC;QAChD,OAAO,IAAI,CAAC,IAAI,CAA6B,wBAAwB,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,oBAAoB,CAAC,IAA6D;QAChF,OAAO,IAAI,CAAC,IAAI,CAAuB,kCAAkC,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;QAClD,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC5C,OAAO,GAAG,IAAI,CAAC,OAAO,8BAA8B,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAA;IACzF,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAkC,qCAAqC,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED,uBAAuB,CAAC,IAA2D;QACjF,OAAO,IAAI,CAAC,IAAI,CAAuB,6CAA6C,EAAE;YACpF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,cAAc,CAAC,WAAmB,EAAE,MAA8D;QAChG,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAA;QAC/B,IAAI,MAAM,EAAE,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QACpD,IAAI,MAAM,EAAE,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChE,IAAI,MAAM,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACtC,OAAO,IAAI,CAAC,IAAI,CAAyB,eAAe,EAAE,EAAE,EAAE;YAC5D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,YAAY,CAAC,WAAmB,EAAE,EAAU;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAoB,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YAC5E,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,eAAe,CAAC,WAAmB,EAAE,IAAoC;QACvE,OAAO,IAAI,CAAC,IAAI,CAAoB,cAAc,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,eAAe,CAAC,WAAmB,EAAE,EAAU,EAAE,IAAoC;QACnF,OAAO,IAAI,CAAC,IAAI,CAAoB,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YAC5E,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,eAAe,CAAC,WAAmB,EAAE,EAAU;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YACzD,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB,CAAC,WAAmB,EAAE,EAAU;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAW,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE;YACzE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,gBAAgB,CAAC,WAAmB,EAAE,EAAU,EAAE,IAAY;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED,mBAAmB,CAAC,WAAmB,EAAE,EAAU,EAAE,IAAY;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE;YAC3F,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,aAAa,CAAC,WAAmB,EAAE,EAAU;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,eAAe,CAAC,WAAmB,EAAE,EAAU;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,cAAc,CAAC,WAAmB;QAChC,OAAO,IAAI,CAAC,IAAI,CAAgC,cAAc,EAAE;YAC9D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,YAAY,CAAC,WAAmB,EAAE,EAAU;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAoB,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YAC5E,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;IAED,eAAe,CAAC,WAAmB,EAAE,IAAY;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAoB,cAAc,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED,eAAe,CAAC,WAAmB,EAAE,EAAU,EAAE,IAAY;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAoB,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YAC5E,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED,eAAe,CAAC,WAAmB,EAAE,EAAU;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YACzD,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export * from './types.js';
+export * from './cookie.js';
+export * from './tokens.js';
+export * from './storage.js';
+export * from './refresh.js';
+export * from './headless-client.js';
+export * from './oidc-client.js';
+export { randomUUID } from 'uncrypto';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export * from './types.js';
+export * from './cookie.js';
+export * from './tokens.js';
+export * from './storage.js';
+export * from './refresh.js';
+export * from './headless-client.js';
+export * from './oidc-client.js';
+export { randomUUID } from 'uncrypto';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA"}

package/dist/oidc-client.d.ts

@@ -0,0 +1,46 @@
+import * as oidc from 'openid-client';
+import type { AuthStateRecord } from './types.js';
+export interface HuiaOidcClientOptions {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    scopes?: string[];
+    par?: {
+        enabled?: boolean;
+        required?: boolean;
+    };
+    allowInsecureTls?: boolean;
+}
+export interface AuthorizationResult {
+    redirectTo: string;
+    stateRecord: AuthStateRecord;
+}
+export interface CompletedAuthResult {
+    tokens: oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers;
+    claims: Record<string, unknown>;
+    returnTo?: string;
+}
+export declare class HuiaOidcHelper {
+    private configCache;
+    private inflightDiscovery;
+    getConfiguration(options: HuiaOidcClientOptions): Promise<oidc.Configuration>;
+    private discover;
+    beginAuthorization(config: oidc.Configuration, options: {
+        clientId: string;
+        redirectUri: string;
+        scopes?: string[];
+        returnTo?: string;
+        extraParams?: Record<string, string>;
+        parEnabled?: boolean;
+        parRequired?: boolean;
+    }): Promise<AuthorizationResult>;
+    completeAuthorization(config: oidc.Configuration, currentUrl: URL, stateRecord: AuthStateRecord, expectedIssuer: string): Promise<CompletedAuthResult>;
+    refreshTokens(config: oidc.Configuration, refreshToken: string, scope?: string): Promise<oidc.TokenEndpointResponse & oidc.TokenEndpointResponseHelpers>;
+    buildLogoutUrl(config: oidc.Configuration, issuer: string, params: {
+        clientId: string;
+        postLogoutRedirectUri: string;
+        idTokenHint?: string;
+    }): string;
+}
+export declare const defaultOidcHelper: HuiaOidcHelper;
+//# sourceMappingURL=oidc-client.d.ts.map

package/dist/oidc-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client.d.ts","sourceRoot":"","sources":["../src/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAA;AAErC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;IACD,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,eAAe,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,4BAA4B,CAAA;IACtE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,WAAW,CAAwC;IAC3D,OAAO,CAAC,iBAAiB,CAAiD;IAEpE,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAoBrE,QAAQ;IAoBhB,kBAAkB,CACtB,MAAM,EAAE,IAAI,CAAC,aAAa,EAC1B,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACpC,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GACA,OAAO,CAAC,mBAAmB,CAAC;IAqDzB,qBAAqB,CACzB,MAAM,EAAE,IAAI,CAAC,aAAa,EAC1B,UAAU,EAAE,GAAG,EACf,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,mBAAmB,CAAC;IAmBzB,aAAa,CACjB,MAAM,EAAE,IAAI,CAAC,aAAa,EAC1B,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,4BAA4B,CAAC;IAI1E,cAAc,CACZ,MAAM,EAAE,IAAI,CAAC,aAAa,EAC1B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAChF,MAAM;CAkBV;AAED,eAAO,MAAM,iBAAiB,gBAAuB,CAAA"}

package/dist/oidc-client.js

@@ -0,0 +1,122 @@
+import * as oidc from 'openid-client';
+import { assertHuiaIssuer } from './tokens.js';
+export class HuiaOidcHelper {
+    configCache = new Map();
+    inflightDiscovery = new Map();
+    async getConfiguration(options) {
+        const key = `${options.issuer}:${options.clientId}`;
+        const cached = this.configCache.get(key);
+        if (cached)
+            return cached;
+        const pending = this.inflightDiscovery.get(key);
+        if (pending)
+            return pending;
+        const p = this.discover(options);
+        this.inflightDiscovery.set(key, p);
+        try {
+            const cfg = await p;
+            this.configCache.set(key, cfg);
+            return cfg;
+        }
+        finally {
+            this.inflightDiscovery.delete(key);
+        }
+    }
+    async discover(options) {
+        const server = new URL(`${options.issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`);
+        const insecure = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0' || (options.allowInsecureTls && process.env.NODE_ENV !== 'production');
+        const clientAuth = options.clientSecret
+            ? oidc.ClientSecretPost(options.clientSecret)
+            : undefined;
+        return oidc.discovery(server, options.clientId, undefined, clientAuth, {
+            timeout: 10,
+            ...(insecure ? { execute: [oidc.allowInsecureRequests] } : {}),
+        });
+    }
+    async beginAuthorization(config, options) {
+        const codeVerifier = oidc.randomPKCECodeVerifier();
+        const codeChallenge = await oidc.calculatePKCECodeChallenge(codeVerifier);
+        const state = oidc.randomState();
+        const nonce = oidc.randomNonce();
+        const params = {
+            client_id: options.clientId,
+            redirect_uri: options.redirectUri,
+            response_type: 'code',
+            scope: (options.scopes && options.scopes.length > 0)
+                ? options.scopes.join(' ')
+                : 'openid profile email offline_access',
+            state,
+            nonce,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+            ...options.extraParams,
+        };
+        const meta = config.serverMetadata();
+        const parSupported = !!meta.pushed_authorization_request_endpoint;
+        let redirectTo;
+        if (options.parEnabled && parSupported) {
+            try {
+                redirectTo = (await oidc.buildAuthorizationUrlWithPAR(config, params)).href;
+            }
+            catch (err) {
+                if (options.parRequired) {
+                    throw new Error('par_required: PAR push failed', { cause: err });
+                }
+                redirectTo = oidc.buildAuthorizationUrl(config, params).href;
+            }
+        }
+        else if (options.parRequired) {
+            throw new Error('par_required: server does not advertise pushed_authorization_request_endpoint');
+        }
+        else {
+            redirectTo = oidc.buildAuthorizationUrl(config, params).href;
+        }
+        const stateRecord = {
+            state,
+            codeVerifier,
+            nonce,
+            returnTo: options.returnTo,
+            createdAt: Date.now(),
+        };
+        return { redirectTo, stateRecord };
+    }
+    async completeAuthorization(config, currentUrl, stateRecord, expectedIssuer) {
+        const tokens = await oidc.authorizationCodeGrant(config, currentUrl, {
+            pkceCodeVerifier: stateRecord.codeVerifier,
+            expectedState: stateRecord.state,
+            expectedNonce: stateRecord.nonce,
+            idTokenExpected: true,
+        });
+        const claims = tokens.claims();
+        if (!claims)
+            throw new Error('missing_id_token');
+        assertHuiaIssuer(claims.iss, expectedIssuer);
+        return {
+            tokens,
+            claims,
+            returnTo: stateRecord.returnTo,
+        };
+    }
+    async refreshTokens(config, refreshToken, scope) {
+        return oidc.refreshTokenGrant(config, refreshToken, scope ? { scope } : undefined);
+    }
+    buildLogoutUrl(config, issuer, params) {
+        const meta = config.serverMetadata();
+        const queryParams = {
+            client_id: params.clientId,
+            post_logout_redirect_uri: params.postLogoutRedirectUri,
+        };
+        if (params.idTokenHint)
+            queryParams.id_token_hint = params.idTokenHint;
+        if (meta.end_session_endpoint) {
+            return oidc.buildEndSessionUrl(config, queryParams).href;
+        }
+        const url = new URL(`${issuer.replace(/\/+$/, '')}/connect/logout`);
+        for (const [k, v] of Object.entries(queryParams)) {
+            url.searchParams.set(k, v);
+        }
+        return url.href;
+    }
+}
+export const defaultOidcHelper = new HuiaOidcHelper();
+//# sourceMappingURL=oidc-client.js.map

package/dist/oidc-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../src/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AA0B9C,MAAM,OAAO,cAAc;IACjB,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAA;IACnD,iBAAiB,GAAG,IAAI,GAAG,EAAuC,CAAA;IAE1E,KAAK,CAAC,gBAAgB,CAAC,OAA8B;QACnD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAA;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAE3B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAChC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAA;YACnB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9B,OAAO,GAAG,CAAA;QACZ,CAAC;gBACO,CAAC;YACP,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAA8B;QACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAA;QAChG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAA;QAExI,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY;YACrC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAA;QAEb,OAAO,IAAI,CAAC,SAAS,CACnB,MAAM,EACN,OAAO,CAAC,QAAQ,EAChB,SAAS,EACT,UAAU,EACV;YACE,OAAO,EAAE,EAAE;YACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,MAA0B,EAC1B,OAQC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAA;QAClD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAA;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAEhC,MAAM,MAAM,GAA2B;YACrC,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC1B,CAAC,CAAC,qCAAqC;YACzC,KAAK;YACL,KAAK;YACL,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,GAAG,OAAO,CAAC,WAAW;SACvB,CAAA;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,CAAA;QACpC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAA;QACjE,IAAI,UAAkB,CAAA;QAEtB,IAAI,OAAO,CAAC,UAAU,IAAI,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;YAC7E,CAAC;YACD,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;gBAClE,CAAC;gBACD,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAA;YAC9D,CAAC;QACH,CAAC;aACI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAA;QAClG,CAAC;aACI,CAAC;YACJ,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAA;QAC9D,CAAC;QAED,MAAM,WAAW,GAAoB;YACnC,KAAK;YACL,YAAY;YACZ,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAA;QAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,MAA0B,EAC1B,UAAe,EACf,WAA4B,EAC5B,cAAsB;QAEtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE;YACnE,gBAAgB,EAAE,WAAW,CAAC,YAAY;YAC1C,aAAa,EAAE,WAAW,CAAC,KAAK;YAChC,aAAa,EAAE,WAAW,CAAC,KAAK;YAChC,eAAe,EAAE,IAAI;SACtB,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;QAC9B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAChD,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAE5C,OAAO;YACL,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAA;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAA0B,EAC1B,YAAoB,EACpB,KAAc;QAEd,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACpF,CAAC;IAED,cAAc,CACZ,MAA0B,EAC1B,MAAc,EACd,MAAiF;QAEjF,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,CAAA;QACpC,MAAM,WAAW,GAA2B;YAC1C,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,wBAAwB,EAAE,MAAM,CAAC,qBAAqB;SACvD,CAAA;QACD,IAAI,MAAM,CAAC,WAAW;YAAE,WAAW,CAAC,aAAa,GAAG,MAAM,CAAC,WAAW,CAAA;QAEtE,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAA;QAC1D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAA;QACnE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,cAAc,EAAE,CAAA"}

package/dist/refresh.d.ts

@@ -0,0 +1,15 @@
+import type { HuiaStorageAdapter, TokenRecord } from './types.js';
+export declare class RefreshTokenExpiredError extends Error {
+    constructor(message?: string);
+}
+export interface RefreshLockOptions {
+    ttlMs?: number;
+    earlyRefreshSeconds?: number;
+    retryIntervalMs?: number;
+    maxWaitMs?: number;
+}
+/**
+ * Ensures token record is fresh, using deduplicated in-memory promises and storage locking.
+ */
+export declare function ensureFreshTokenRecord(storage: HuiaStorageAdapter, record: TokenRecord, refreshFn: (record: TokenRecord) => Promise<TokenRecord>, options?: RefreshLockOptions): Promise<TokenRecord>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAGjE,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,SAA0B;CAI9C;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAKD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,EACxD,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,CAkBtB"}