@health-samurai/aidbox-client 0.0.0-alpha.3 → 0.0.0-alpha.4

package/README.md

@@ -253,12 +253,74 @@ Both methods can throw the `RequestError` class if the error happened before the
 
 ## Authentication Providers
 
-Authentication is managed via the `AuthProvider` interface.
+Authentication is managed via the `AuthProvider` interface. The client ships with three built-in providers:
 
-Currently, the client only provides a `BrowserAuthProvider` class.
-It is suitable for usage in browsers, but other environments may require a different method.
+| Provider | Environment | Auth Method |
+|----------|-------------|-------------|
+| `BrowserAuthProvider` | Browser | Cookie-based sessions |
+| `BasicAuthProvider` | Any | HTTP Basic Auth |
+| `SmartBackendServicesAuthProvider` | Server-side | OAuth 2.0 client_credentials with JWT bearer |
 
-Thus, an application can describe its own Auth Provider by implementing a class that implements `AuthProvider`:
+### BrowserAuthProvider
+
+For browser applications. Uses cookie-based sessions and redirects to the login page on 401.
+
+```typescript
+import { AidboxClient, BrowserAuthProvider } from "@health-samurai/aidbox-client";
+
+const baseUrl = "https://fhir-server.address";
+const client = new AidboxClient(baseUrl, new BrowserAuthProvider(baseUrl));
+```
+
+### BasicAuthProvider
+
+For server-side applications using HTTP Basic Auth.
+
+```typescript
+import { AidboxClient, BasicAuthProvider } from "@health-samurai/aidbox-client";
+
+const baseUrl = "https://fhir-server.address";
+const client = new AidboxClient(
+  baseUrl,
+  new BasicAuthProvider(baseUrl, "username", "password"),
+);
+```
+
+### SmartBackendServicesAuthProvider
+
+For server-to-server authentication using [SMART Backend Services](https://www.hl7.org/fhir/smart-app-launch/backend-services.html) (OAuth 2.0 client_credentials grant with JWT bearer assertion).
+
+Features:
+- Token caching with proactive refresh before expiry
+- Thundering herd prevention — concurrent requests share a single token fetch
+- Automatic retry on 401 with fresh token
+- OAuth2 discovery from `.well-known/smart-configuration`
+
+```typescript
+import { AidboxClient, SmartBackendServicesAuthProvider } from "@health-samurai/aidbox-client";
+
+// Generate or import your private key using Web Crypto API
+const privateKey = await crypto.subtle.generateKey(
+  { name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-384" },
+  true,
+  ["sign", "verify"]
+).then(kp => kp.privateKey);
+
+const auth = new SmartBackendServicesAuthProvider({
+  baseUrl: "https://fhir-server.address",
+  clientId: "my-service",
+  privateKey: privateKey,                     // CryptoKey from Web Crypto API
+  keyId: "key-001",                           // Must match kid in JWKS
+  scope: "system/*.read",
+  // tokenExpirationBuffer: 30,              // Optional: seconds before expiry to refresh (default: 30)
+});
+
+const client = new AidboxClient("https://fhir-server.address", auth);
+```
+
+### Custom Auth Provider
+
+For other authentication methods, implement the `AuthProvider` interface:
 
 ```typescript
 import type { AuthProvider } from "@health-samurai/aidbox-client";
@@ -267,30 +329,31 @@ export class CustomAuthProvider implements AuthProvider {
   public baseUrl: string;
 
   constructor(baseUrl: string) {
-	this.baseUrl = baseUrl;
+    this.baseUrl = baseUrl;
   }
 
   public async establishSession() {
-	/* code to establish a session */
+    /* code to establish a session */
   }
 
   public async revokeSession() {
-	/* code to revoke the session */
+    /* code to revoke the session */
   }
 
+  /**
+   * A wrapper around the `fetch` function, that does all the
+   * necessary preparations and argument patching required for the
+   * request to go through.
+   *
+   * Optionally, security checks can be implemented, like verifying
+   * that the request indeed goes to the `baseUrl`, and not
+   * somewhere else.
+   */
   public async fetch(
-	input: RequestInfo | URL,
-	init?: RequestInit,
+    input: RequestInfo | URL,
+    init?: RequestInit,
   ): Promise<Response> {
-	/**
-     * A wrapper around the `fetch` function, that does all the
-     * necessary preparations and argument patching required for the
-     * request to go through.
-     *
-     * Optionally, security checks can be implemented, like verifying
-     * that the request indeed goes to the `baseUrl`, and not
-     * somewhere else.
-     */
+    /* ... */
   }
 }
 ```

package/dist/src/auth-providers.d.ts

@@ -20,4 +20,13 @@ export declare class BrowserAuthProvider implements AuthProvider {
      */
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
 }
+export declare class BasicAuthProvider implements AuthProvider {
+    #private;
+    /** @ignore */
+    baseUrl: string;
+    constructor(baseUrl: string, username: string, password: string);
+    establishSession(): Promise<void>;
+    revokeSession(): Promise<void>;
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
 //# sourceMappingURL=auth-providers.d.ts.map

package/dist/src/auth-providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.d.ts","sourceRoot":"","sources":["../../src/auth-providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,qBAAa,mBAAoB,YAAW,YAAY;;IACvD,cAAc;IACP,OAAO,EAAE,MAAM,CAAC;gBAEX,OAAO,EAAE,MAAM;IAgB3B;;OAEG;IACU,gBAAgB;IAQ7B;;OAEG;IACU,aAAa;IAW1B;;;;;OAKG;IACU,KAAK,CACjB,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,QAAQ,CAAC;CAsBpB"}
+{"version":3,"file":"auth-providers.d.ts","sourceRoot":"","sources":["../../src/auth-providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG5C,qBAAa,mBAAoB,YAAW,YAAY;;IACvD,cAAc;IACP,OAAO,EAAE,MAAM,CAAC;gBAEX,OAAO,EAAE,MAAM;IAgB3B;;OAEG;IACU,gBAAgB;IAQ7B;;OAEG;IACU,aAAa;IAW1B;;;;;OAKG;IACU,KAAK,CACjB,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,QAAQ,CAAC;CAepB;AAED,qBAAa,iBAAkB,YAAW,YAAY;;IACrD,cAAc;IACP,OAAO,EAAE,MAAM,CAAC;gBAGX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IASlD,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B,KAAK,CACjB,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,QAAQ,CAAC;CAcpB"}

package/dist/src/auth-providers.js

@@ -1,3 +1,11 @@
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array(arr);
+}
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -32,11 +40,46 @@ function _check_private_redeclaration(obj, privateCollection) {
         throw new TypeError("Cannot initialize the same private elements twice on an object");
     }
 }
+function _class_apply_descriptor_get(receiver, descriptor) {
+    if (descriptor.get) {
+        return descriptor.get.call(receiver);
+    }
+    return descriptor.value;
+}
+function _class_apply_descriptor_set(receiver, descriptor, value) {
+    if (descriptor.set) {
+        descriptor.set.call(receiver, value);
+    } else {
+        if (!descriptor.writable) {
+            throw new TypeError("attempted to set read only private field");
+        }
+        descriptor.value = value;
+    }
+}
 function _class_call_check(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
 }
+function _class_extract_field_descriptor(receiver, privateMap, action) {
+    if (!privateMap.has(receiver)) {
+        throw new TypeError("attempted to " + action + " private field on non-instance");
+    }
+    return privateMap.get(receiver);
+}
+function _class_private_field_get(receiver, privateMap) {
+    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "get");
+    return _class_apply_descriptor_get(receiver, descriptor);
+}
+function _class_private_field_init(obj, privateMap, value) {
+    _check_private_redeclaration(obj, privateMap);
+    privateMap.set(obj, value);
+}
+function _class_private_field_set(receiver, privateMap, value) {
+    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "set");
+    _class_apply_descriptor_set(receiver, descriptor, value);
+    return value;
+}
 function _class_private_method_get(receiver, privateSet, fn) {
     if (!privateSet.has(receiver)) {
         throw new TypeError("attempted to get private field on non-instance");
@@ -81,6 +124,23 @@ function _instanceof(left, right) {
         return left instanceof right;
     }
 }
+function _iterable_to_array(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array(arr) {
+    return _array_without_holes(arr) || _iterable_to_array(arr) || _unsupported_iterable_to_array(arr) || _non_iterable_spread();
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -172,6 +232,7 @@ function _ts_generator(thisArg, body) {
         };
     }
 }
+import { mergeHeaders, validateBaseUrl } from "./utils";
 var _checkSession = /*#__PURE__*/ new WeakSet();
 export var BrowserAuthProvider = /*#__PURE__*/ function() {
     "use strict";
@@ -249,18 +310,16 @@ export var BrowserAuthProvider = /*#__PURE__*/ function() {
 	 * Accepts the same arguments as `fetch`.
 	 */ function fetch1(input, init) {
                 return _async_to_generator(function() {
-                    var url, i, response;
+                    var requestInit, response;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
-                                if (_instanceof(input, Request)) url = input.url;
-                                else url = input.toString();
-                                if (!url.startsWith(this.baseUrl)) throw Error("url of the request must start with baseUrl");
-                                i = init !== null && init !== void 0 ? init : {};
-                                i.credentials = "include";
+                                validateBaseUrl(input, this.baseUrl);
+                                requestInit = init !== null && init !== void 0 ? init : {};
+                                requestInit.credentials = "include";
                                 return [
                                     4,
-                                    fetch(input, i)
+                                    fetch(input, requestInit)
                                 ];
                             case 1:
                                 response = _state.sent();
@@ -291,8 +350,7 @@ export var BrowserAuthProvider = /*#__PURE__*/ function() {
         }
     ]);
     return BrowserAuthProvider;
-} // TODO: backend auth provider
-();
+}();
 function checkSession() {
     return _async_to_generator(function() {
         var response;
@@ -320,3 +378,72 @@ function checkSession() {
         });
     }).call(this);
 }
+var _authHeader = /*#__PURE__*/ new WeakMap();
+export var BasicAuthProvider = /*#__PURE__*/ function() {
+    "use strict";
+    function BasicAuthProvider(baseUrl, username, password) {
+        var _String;
+        _class_call_check(this, BasicAuthProvider);
+        /** @ignore */ _define_property(this, "baseUrl", void 0);
+        _class_private_field_init(this, _authHeader, {
+            writable: true,
+            value: void 0
+        });
+        this.baseUrl = baseUrl;
+        // Create Base64-encoded credentials for Basic Auth header (RFC 7617: UTF-8 encoded)
+        var credentials = "".concat(username, ":").concat(password);
+        var utf8Bytes = new TextEncoder().encode(credentials);
+        var base64 = btoa((_String = String).fromCharCode.apply(_String, _to_consumable_array(utf8Bytes)));
+        _class_private_field_set(this, _authHeader, "Basic ".concat(base64));
+    }
+    _create_class(BasicAuthProvider, [
+        {
+            key: "establishSession",
+            value: function establishSession() {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        return [
+                            2
+                        ];
+                    });
+                // No-op for basic auth - credentials are sent with each request
+                })();
+            }
+        },
+        {
+            key: "revokeSession",
+            value: function revokeSession() {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        return [
+                            2
+                        ];
+                    });
+                // No-op for basic auth - stateless authentication
+                })();
+            }
+        },
+        {
+            key: "fetch",
+            value: function fetch1(input, init) {
+                return _async_to_generator(function() {
+                    var requestInit, baseHeaders, initHeaders, headers;
+                    return _ts_generator(this, function(_state) {
+                        validateBaseUrl(input, this.baseUrl);
+                        requestInit = init !== null && init !== void 0 ? init : {};
+                        baseHeaders = _instanceof(input, Request) ? input.headers : undefined;
+                        initHeaders = requestInit.headers ? new Headers(requestInit.headers) : undefined;
+                        headers = mergeHeaders(baseHeaders, initHeaders);
+                        headers.set("Authorization", _class_private_field_get(this, _authHeader));
+                        requestInit.headers = headers;
+                        return [
+                            2,
+                            fetch(input, requestInit)
+                        ];
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return BasicAuthProvider;
+}();

package/dist/src/index.d.ts

@@ -4,6 +4,7 @@ export type * from "./fhir-types/hl7-fhir-r4-core";
 export * from "./fhir-types/hl7-fhir-r4-core";
 export type * from "./result";
 export * from "./result";
+export * from "./smart-backend-services";
 export type * from "./types";
 export * from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,mBAAmB,+BAA+B,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,mBAAmB,UAAU,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,mBAAmB,SAAS,CAAC;AAC7B,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,mBAAmB,+BAA+B,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,mBAAmB,UAAU,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,0BAA0B,CAAC;AACzC,mBAAmB,SAAS,CAAC;AAC7B,cAAc,SAAS,CAAC"}

package/dist/src/index.js

@@ -2,4 +2,5 @@ export * from "./auth-providers";
 export * from "./client";
 export * from "./fhir-types/hl7-fhir-r4-core";
 export * from "./result";
+export * from "./smart-backend-services";
 export * from "./types";

package/dist/src/smart-backend-services.d.ts

@@ -0,0 +1,44 @@
+import type { AuthProvider } from "./types";
+export type SmartBackendServicesConfig = {
+    /** FHIR server base URL */
+    baseUrl: string;
+    /** OAuth 2.0 client ID */
+    clientId: string;
+    /** Private key for signing JWTs (CryptoKey from Web Crypto API) */
+    privateKey: CryptoKey;
+    /** Key ID (kid) - must match the kid in JWKS registered on the server */
+    keyId: string;
+    /** OAuth 2.0 scopes (e.g., "system/*.read") */
+    scope: string;
+    /** Token expiration buffer in seconds (refresh token this many seconds before expiry, default: 30) */
+    tokenExpirationBuffer?: number;
+    /** Allow insecure HTTP requests (for testing only, default: false) */
+    allowInsecureRequests?: boolean;
+};
+/**
+ * SMART Backend Services authentication provider.
+ *
+ * Implements OAuth 2.0 client_credentials grant with JWT bearer assertion
+ * for server-to-server authentication per SMART Backend Services spec.
+ *
+ * @see https://hl7.org/fhir/smart-app-launch/backend-services.html
+ */
+export declare class SmartBackendServicesAuthProvider implements AuthProvider {
+    #private;
+    baseUrl: string;
+    constructor(config: SmartBackendServicesConfig);
+    /**
+     * Establish session - for Backend Services this means getting a token.
+     */
+    establishSession(): Promise<void>;
+    /**
+     * Revoke session - clear cached token.
+     */
+    revokeSession(): Promise<void>;
+    /**
+     * Fetch wrapper that adds Bearer token authorization.
+     * Automatically obtains token on first request and retries once on 401.
+     */
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
+//# sourceMappingURL=smart-backend-services.d.ts.map

package/dist/src/smart-backend-services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smart-backend-services.d.ts","sourceRoot":"","sources":["../../src/smart-backend-services.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG5C,MAAM,MAAM,0BAA0B,GAAG;IACxC,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,UAAU,EAAE,SAAS,CAAC;IACtB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAiBF;;;;;;;GAOG;AACH,qBAAa,gCAAiC,YAAW,YAAY;;IAC7D,OAAO,EAAE,MAAM,CAAC;gBAMX,MAAM,EAAE,0BAA0B;IAsJ9C;;OAEG;IACU,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9C;;OAEG;IACU,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3C;;;OAGG;IACU,KAAK,CACjB,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,QAAQ,CAAC;CAwCpB"}

package/dist/src/smart-backend-services.js

@@ -0,0 +1,685 @@
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _check_private_redeclaration(obj, privateCollection) {
+    if (privateCollection.has(obj)) {
+        throw new TypeError("Cannot initialize the same private elements twice on an object");
+    }
+}
+function _class_apply_descriptor_get(receiver, descriptor) {
+    if (descriptor.get) {
+        return descriptor.get.call(receiver);
+    }
+    return descriptor.value;
+}
+function _class_apply_descriptor_set(receiver, descriptor, value) {
+    if (descriptor.set) {
+        descriptor.set.call(receiver, value);
+    } else {
+        if (!descriptor.writable) {
+            throw new TypeError("attempted to set read only private field");
+        }
+        descriptor.value = value;
+    }
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _class_extract_field_descriptor(receiver, privateMap, action) {
+    if (!privateMap.has(receiver)) {
+        throw new TypeError("attempted to " + action + " private field on non-instance");
+    }
+    return privateMap.get(receiver);
+}
+function _class_private_field_get(receiver, privateMap) {
+    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "get");
+    return _class_apply_descriptor_get(receiver, descriptor);
+}
+function _class_private_field_init(obj, privateMap, value) {
+    _check_private_redeclaration(obj, privateMap);
+    privateMap.set(obj, value);
+}
+function _class_private_field_set(receiver, privateMap, value) {
+    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "set");
+    _class_apply_descriptor_set(receiver, descriptor, value);
+    return value;
+}
+function _class_private_method_get(receiver, privateSet, fn) {
+    if (!privateSet.has(receiver)) {
+        throw new TypeError("attempted to get private field on non-instance");
+    }
+    return fn;
+}
+function _class_private_method_init(obj, privateSet) {
+    _check_private_redeclaration(obj, privateSet);
+    privateSet.add(obj);
+}
+function _defineProperties(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    if (staticProps) _defineProperties(Constructor, staticProps);
+    return Constructor;
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _iterable_to_array_limit(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_without_properties(source, excluded) {
+    if (source == null) return {};
+    var target = _object_without_properties_loose(source, excluded);
+    var key, i;
+    if (Object.getOwnPropertySymbols) {
+        var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
+        for(i = 0; i < sourceSymbolKeys.length; i++){
+            key = sourceSymbolKeys[i];
+            if (excluded.indexOf(key) >= 0) continue;
+            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+            target[key] = source[key];
+        }
+    }
+    return target;
+}
+function _object_without_properties_loose(source, excluded) {
+    if (source == null) return {};
+    var target = {};
+    var sourceKeys = Object.keys(source);
+    var key, i;
+    for(i = 0; i < sourceKeys.length; i++){
+        key = sourceKeys[i];
+        if (excluded.indexOf(key) >= 0) continue;
+        target[key] = source[key];
+    }
+    return target;
+}
+function _sliced_to_array(arr, i) {
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import * as oauth from "oauth4webapi";
+import { mergeHeaders, validateBaseUrl } from "./utils";
+var _config = /*#__PURE__*/ new WeakMap(), _cachedToken = /*#__PURE__*/ new WeakMap(), _pendingTokenRequest = /*#__PURE__*/ new WeakMap(), _discoverAuthServer = /*#__PURE__*/ new WeakSet(), _requestToken = /*#__PURE__*/ new WeakSet(), _sanitizeTokenResponse = /*#__PURE__*/ new WeakSet(), /**
+	 * Get valid cached token if not expired, or null if needs refresh.
+	 */ _getValidCachedToken = /*#__PURE__*/ new WeakSet(), _getAccessToken = /*#__PURE__*/ new WeakSet(), _fetchAndCacheToken = /*#__PURE__*/ new WeakSet();
+/**
+ * SMART Backend Services authentication provider.
+ *
+ * Implements OAuth 2.0 client_credentials grant with JWT bearer assertion
+ * for server-to-server authentication per SMART Backend Services spec.
+ *
+ * @see https://hl7.org/fhir/smart-app-launch/backend-services.html
+ */ export var SmartBackendServicesAuthProvider = /*#__PURE__*/ function() {
+    "use strict";
+    function SmartBackendServicesAuthProvider(config) {
+        _class_call_check(this, SmartBackendServicesAuthProvider);
+        _class_private_method_init(this, _discoverAuthServer);
+        /**
+	 * Request access token from token endpoint using client_credentials grant.
+	 */ _class_private_method_init(this, _requestToken);
+        /**
+	 * Fixes "refresh_token" = null which does not work with oauth4webapi
+	 * Fixed in Aidbox 2601, but kept for backwards compatibility.
+	 */ _class_private_method_init(this, _sanitizeTokenResponse);
+        _class_private_method_init(this, _getValidCachedToken);
+        /**
+	 * Get a valid access token, refreshing if necessary.
+	 * Deduplicates concurrent requests to prevent thundering herd.
+	 */ _class_private_method_init(this, _getAccessToken);
+        /**
+	 * Fetch token from server and cache it.
+	 */ _class_private_method_init(this, _fetchAndCacheToken);
+        _define_property(this, "baseUrl", void 0);
+        _class_private_field_init(this, _config, {
+            writable: true,
+            value: void 0
+        });
+        _class_private_field_init(this, _cachedToken, {
+            writable: true,
+            value: null
+        });
+        _class_private_field_init(this, _pendingTokenRequest, {
+            writable: true,
+            value: null
+        });
+        this.baseUrl = config.baseUrl;
+        var _config_tokenExpirationBuffer, _config_allowInsecureRequests;
+        _class_private_field_set(this, _config, {
+            baseUrl: config.baseUrl,
+            clientId: config.clientId,
+            privateKey: config.privateKey,
+            keyId: config.keyId,
+            scope: config.scope,
+            tokenExpirationBuffer: (_config_tokenExpirationBuffer = config.tokenExpirationBuffer) !== null && _config_tokenExpirationBuffer !== void 0 ? _config_tokenExpirationBuffer : 30,
+            allowInsecureRequests: (_config_allowInsecureRequests = config.allowInsecureRequests) !== null && _config_allowInsecureRequests !== void 0 ? _config_allowInsecureRequests : false
+        });
+    }
+    _create_class(SmartBackendServicesAuthProvider, [
+        {
+            key: "establishSession",
+            value: /**
+	 * Establish session - for Backend Services this means getting a token.
+	 */ function establishSession() {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    _class_private_method_get(this, _getAccessToken, getAccessToken).call(this)
+                                ];
+                            case 1:
+                                _state.sent();
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "revokeSession",
+            value: /**
+	 * Revoke session - clear cached token.
+	 */ function revokeSession() {
+                return _async_to_generator(function() {
+                    var pending, e;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                // Wait for any pending token request to settle before clearing
+                                pending = _class_private_field_get(this, _pendingTokenRequest);
+                                if (!pending) return [
+                                    3,
+                                    4
+                                ];
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
+                                return [
+                                    4,
+                                    pending
+                                ];
+                            case 2:
+                                _state.sent();
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 3:
+                                e = _state.sent();
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 4:
+                                _class_private_field_set(this, _cachedToken, null);
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "fetch",
+            value: /**
+	 * Fetch wrapper that adds Bearer token authorization.
+	 * Automatically obtains token on first request and retries once on 401.
+	 */ function fetch1(input, init) {
+                return _async_to_generator(function() {
+                    var accessToken, requestInit, baseHeaders, initHeaders, mergedHeaders, clonedInput, retryBody, _requestInit_body_tee, stream1, stream2, response, newToken;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                validateBaseUrl(input, this.baseUrl);
+                                return [
+                                    4,
+                                    _class_private_method_get(this, _getAccessToken, getAccessToken).call(this)
+                                ];
+                            case 1:
+                                accessToken = _state.sent();
+                                requestInit = init !== null && init !== void 0 ? init : {};
+                                baseHeaders = _instanceof(input, Request) ? input.headers : undefined;
+                                initHeaders = requestInit.headers ? new Headers(requestInit.headers) : undefined;
+                                mergedHeaders = mergeHeaders(baseHeaders, initHeaders);
+                                mergedHeaders.set("Authorization", "Bearer ".concat(accessToken));
+                                requestInit.headers = mergedHeaders;
+                                // Clone input/body to preserve for potential retry
+                                clonedInput = _instanceof(input, Request) ? input.clone() : input;
+                                retryBody = requestInit.body;
+                                // If body is a ReadableStream, tee it for potential retry
+                                if (_instanceof(requestInit.body, ReadableStream)) {
+                                    _requestInit_body_tee = _sliced_to_array(requestInit.body.tee(), 2), stream1 = _requestInit_body_tee[0], stream2 = _requestInit_body_tee[1];
+                                    requestInit.body = stream1;
+                                    retryBody = stream2;
+                                }
+                                return [
+                                    4,
+                                    fetch(clonedInput, requestInit)
+                                ];
+                            case 2:
+                                response = _state.sent();
+                                if (!(response.status === 401)) return [
+                                    3,
+                                    5
+                                ];
+                                _class_private_field_set(this, _cachedToken, null);
+                                return [
+                                    4,
+                                    _class_private_method_get(this, _getAccessToken, getAccessToken).call(this)
+                                ];
+                            case 3:
+                                newToken = _state.sent();
+                                mergedHeaders.set("Authorization", "Bearer ".concat(newToken));
+                                if (retryBody !== undefined) {
+                                    requestInit.body = retryBody;
+                                }
+                                return [
+                                    4,
+                                    fetch(input, requestInit)
+                                ];
+                            case 4:
+                                response = _state.sent();
+                                _state.label = 5;
+                            case 5:
+                                return [
+                                    2,
+                                    response
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return SmartBackendServicesAuthProvider;
+}();
+function discoverAuthServer() {
+    return _async_to_generator(function() {
+        var url, response, metadata;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    url = new URL(_class_private_field_get(this, _config).baseUrl);
+                    return [
+                        4,
+                        oauth.discoveryRequest(url, _define_property({
+                            algorithm: "oauth2"
+                        }, oauth.allowInsecureRequests, _class_private_field_get(this, _config).allowInsecureRequests))
+                    ];
+                case 1:
+                    response = _state.sent();
+                    return [
+                        4,
+                        oauth.processDiscoveryResponse(url, response)
+                    ];
+                case 2:
+                    metadata = _state.sent();
+                    if (!metadata.token_endpoint) {
+                        throw new Error("Discovery response missing token_endpoint");
+                    }
+                    return [
+                        2,
+                        metadata
+                    ];
+            }
+        });
+    }).call(this);
+}
+function requestToken() {
+    return _async_to_generator(function() {
+        var as, client, privateKey, clientAuth, params, response, sanitizedResponse;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        _class_private_method_get(this, _discoverAuthServer, discoverAuthServer).call(this)
+                    ];
+                case 1:
+                    as = _state.sent();
+                    client = {
+                        client_id: _class_private_field_get(this, _config).clientId
+                    };
+                    privateKey = {
+                        key: _class_private_field_get(this, _config).privateKey,
+                        kid: _class_private_field_get(this, _config).keyId
+                    };
+                    // Aidbox requires typ: "JWT" in the client assertion JWT header.
+                    // oauth.modifyAssertion is a Symbol that allows customizing the JWT before signing.
+                    clientAuth = oauth.PrivateKeyJwt(privateKey, _define_property({}, oauth.modifyAssertion, function(header) {
+                        header.typ = "JWT";
+                    }));
+                    // Request parameters
+                    params = new URLSearchParams();
+                    params.set("scope", _class_private_field_get(this, _config).scope);
+                    return [
+                        4,
+                        oauth.clientCredentialsGrantRequest(as, client, clientAuth, params, _define_property({}, oauth.allowInsecureRequests, _class_private_field_get(this, _config).allowInsecureRequests))
+                    ];
+                case 2:
+                    response = _state.sent();
+                    return [
+                        4,
+                        _class_private_method_get(this, _sanitizeTokenResponse, sanitizeTokenResponse).call(this, response)
+                    ];
+                case 3:
+                    sanitizedResponse = _state.sent();
+                    return [
+                        2,
+                        oauth.processClientCredentialsResponse(as, client, sanitizedResponse)
+                    ];
+            }
+        });
+    }).call(this);
+}
+function sanitizeTokenResponse(response) {
+    return _async_to_generator(function() {
+        var cloned, body, _, sanitized;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    cloned = response.clone();
+                    return [
+                        4,
+                        cloned.json()
+                    ];
+                case 1:
+                    body = _state.sent();
+                    if (!("refresh_token" in body) || body.refresh_token !== null) {
+                        return [
+                            2,
+                            response
+                        ];
+                    }
+                    _ = body.refresh_token, sanitized = _object_without_properties(body, [
+                        "refresh_token"
+                    ]);
+                    return [
+                        2,
+                        new Response(JSON.stringify(sanitized), {
+                            status: response.status,
+                            statusText: response.statusText,
+                            headers: response.headers
+                        })
+                    ];
+            }
+        });
+    })();
+}
+function getValidCachedToken() {
+    if (!_class_private_field_get(this, _cachedToken)) return null;
+    var bufferMs = _class_private_field_get(this, _config).tokenExpirationBuffer * 1000;
+    if (_class_private_field_get(this, _cachedToken).expiresAt > Date.now() + bufferMs) {
+        return _class_private_field_get(this, _cachedToken).accessToken;
+    }
+    return null;
+}
+function getAccessToken() {
+    return _async_to_generator(function() {
+        var validToken;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    validToken = _class_private_method_get(this, _getValidCachedToken, getValidCachedToken).call(this);
+                    if (validToken) {
+                        return [
+                            2,
+                            validToken
+                        ];
+                    }
+                    // If a token request is already in progress, wait for it
+                    if (_class_private_field_get(this, _pendingTokenRequest)) {
+                        return [
+                            2,
+                            _class_private_field_get(this, _pendingTokenRequest)
+                        ];
+                    }
+                    // Request new token, storing the promise to deduplicate concurrent calls
+                    _class_private_field_set(this, _pendingTokenRequest, _class_private_method_get(this, _fetchAndCacheToken, fetchAndCacheToken).call(this));
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        ,
+                        3,
+                        4
+                    ]);
+                    return [
+                        4,
+                        _class_private_field_get(this, _pendingTokenRequest)
+                    ];
+                case 2:
+                    return [
+                        2,
+                        _state.sent()
+                    ];
+                case 3:
+                    _class_private_field_set(this, _pendingTokenRequest, null);
+                    return [
+                        7
+                    ];
+                case 4:
+                    return [
+                        2
+                    ];
+            }
+        });
+    }).call(this);
+}
+function fetchAndCacheToken() {
+    return _async_to_generator(function() {
+        var tokenResponse, now, _tokenResponse_expires_in;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        _class_private_method_get(this, _requestToken, requestToken).call(this)
+                    ];
+                case 1:
+                    tokenResponse = _state.sent();
+                    now = Date.now();
+                    _class_private_field_set(this, _cachedToken, {
+                        accessToken: tokenResponse.access_token,
+                        expiresAt: now + ((_tokenResponse_expires_in = tokenResponse.expires_in) !== null && _tokenResponse_expires_in !== void 0 ? _tokenResponse_expires_in : 300) * 1000
+                    });
+                    return [
+                        2,
+                        _class_private_field_get(this, _cachedToken).accessToken
+                    ];
+            }
+        });
+    }).call(this);
+}

package/dist/src/utils.d.ts

@@ -1,3 +1,13 @@
 import type { ResponseWithMeta } from "./types";
+/**
+ * Validate that fetch input URL starts with baseUrl.
+ * Throws if the URL doesn't match baseUrl.
+ */
+export declare function validateBaseUrl(input: RequestInfo | URL, baseUrl: string): void;
+/**
+ * Merge two Headers objects.
+ * Headers from `override` take precedence over `base`.
+ */
+export declare function mergeHeaders(base?: Headers, override?: Headers): Headers;
 export declare const coerceBody: <T>(meta: ResponseWithMeta) => Promise<T>;
 //# sourceMappingURL=utils.d.ts.map

package/dist/src/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAYhD,eAAO,MAAM,UAAU,GAAU,CAAC,EAAE,MAAM,gBAAgB,KAAG,OAAO,CAAC,CAAC,CA2BrE,CAAC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAGhD;;;GAGG;AACH,wBAAgB,eAAe,CAC9B,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,OAAO,EAAE,MAAM,GACb,IAAI,CAMN;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAYxE;AAWD,eAAO,MAAM,UAAU,GAAU,CAAC,EAAE,MAAM,gBAAgB,KAAG,OAAO,CAAC,CAAC,CA2BrE,CAAC"}

package/dist/src/utils.js

@@ -127,6 +127,28 @@ function _ts_generator(thisArg, body) {
 }
 import YAML from "yaml";
 import { ErrorResponse } from "./types";
+/**
+ * Validate that fetch input URL starts with baseUrl.
+ * Throws if the URL doesn't match baseUrl.
+ */ export function validateBaseUrl(input, baseUrl) {
+    var url = _instanceof(input, Request) ? input.url : input.toString();
+    if (!url.startsWith(baseUrl)) {
+        throw new Error("URL of the request must start with baseUrl");
+    }
+}
+/**
+ * Merge two Headers objects.
+ * Headers from `override` take precedence over `base`.
+ */ export function mergeHeaders(base, override) {
+    var merged = new Headers();
+    base === null || base === void 0 ? void 0 : base.forEach(function(value, key) {
+        merged.set(key, value);
+    });
+    override === null || override === void 0 ? void 0 : override.forEach(function(value, key) {
+        merged.set(key, value);
+    });
+    return merged;
+}
 var normalizeContentType = function(contentType) {
     var semicolon = contentType.indexOf(";");
     if (semicolon !== -1) {

package/dist/test/auth-providers.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-providers.test.d.ts.map

package/dist/test/auth-providers.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.test.d.ts","sourceRoot":"","sources":["../../test/auth-providers.test.ts"],"names":[],"mappings":""}

package/dist/test/basic-auth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=basic-auth.test.d.ts.map

package/dist/test/basic-auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic-auth.test.d.ts","sourceRoot":"","sources":["../../test/basic-auth.test.ts"],"names":[],"mappings":""}

package/dist/test/smart-backend-services.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=smart-backend-services.test.d.ts.map

package/dist/test/smart-backend-services.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smart-backend-services.test.d.ts","sourceRoot":"","sources":["../../test/smart-backend-services.test.ts"],"names":[],"mappings":""}

package/dist/test/utils.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=utils.test.d.ts.map

package/dist/test/utils.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.test.d.ts","sourceRoot":"","sources":["../../test/utils.test.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@health-samurai/aidbox-client",
-  "version": "0.0.0-alpha.3",
+  "version": "0.0.0-alpha.4",
   "description": "A client library for communicating with Aidbox",
   "author": "Health Samurai",
   "type": "module",
@@ -14,6 +14,7 @@
   },
   "dependencies": {
     "@types/json-patch": "^0.0.33",
+    "oauth4webapi": "^3.8.3",
     "yaml": "^2.8.1"
   },
   "publishConfig": {