@medplum/core 2.0.14 → 2.0.16

package/dist/esm/client.mjs

@@ -1,4 +1,3 @@
-import { __classPrivateFieldSet, __classPrivateFieldGet } from './node_modules/tslib/tslib.es6.mjs';
 import { LRUCache } from './cache.mjs';
 import { getRandomString, encryptSHA256 } from './crypto.mjs';
 import { EventTarget } from './eventtarget.mjs';
@@ -8,11 +7,10 @@ import { ReadablePromise } from './readablepromise.mjs';
 import { ClientStorage } from './storage.mjs';
 import { globalSchema, indexStructureDefinition, indexSearchParameter } from './types.mjs';
 import { createReference, arrayBufferToBase64 } from './utils.mjs';
+import { encodeBase64 } from './base64.mjs';
 
 // PKCE auth based on:
-// https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/
-var _MedplumClient_instances, _MedplumClient_fetch, _MedplumClient_createPdf, _MedplumClient_storage, _MedplumClient_requestCache, _MedplumClient_cacheTime, _MedplumClient_baseUrl, _MedplumClient_fhirBaseUrl, _MedplumClient_authorizeUrl, _MedplumClient_tokenUrl, _MedplumClient_logoutUrl, _MedplumClient_exchangeUrl, _MedplumClient_onUnauthenticated, _MedplumClient_autoBatchTime, _MedplumClient_autoBatchQueue, _MedplumClient_clientId, _MedplumClient_clientSecret, _MedplumClient_autoBatchTimerId, _MedplumClient_accessToken, _MedplumClient_refreshToken, _MedplumClient_refreshPromise, _MedplumClient_profilePromise, _MedplumClient_profile, _MedplumClient_config, _MedplumClient_addLogin, _MedplumClient_refreshProfile, _MedplumClient_getCacheEntry, _MedplumClient_setCacheEntry, _MedplumClient_cacheResource, _MedplumClient_deleteCacheEntry, _MedplumClient_request, _MedplumClient_fetchWithRetry, _MedplumClient_executeAutoBatch, _MedplumClient_addFetchOptionsDefaults, _MedplumClient_setRequestContentType, _MedplumClient_setRequestBody, _MedplumClient_handleUnauthenticated, _MedplumClient_requestAuthorization, _MedplumClient_refresh, _MedplumClient_fetchTokens, _MedplumClient_verifyTokens, _MedplumClient_setupStorageListener;
-const MEDPLUM_VERSION = "2.0.14-8c7457fd";
+const MEDPLUM_VERSION = "2.0.16-816ad9bf";
 const DEFAULT_BASE_URL = 'https://api.medplum.com/';
 const DEFAULT_RESOURCE_CACHE_SIZE = 1000;
 const DEFAULT_CACHE_TIME = 60000; // 60 seconds
@@ -20,6 +18,35 @@ const JSON_CONTENT_TYPE = 'application/json';
 const FHIR_CONTENT_TYPE = 'application/fhir+json';
 const PATCH_CONTENT_TYPE = 'application/json-patch+json';
 const system = { resourceType: 'Device', id: 'system', deviceName: [{ name: 'System' }] };
+/**
+ * OAuth 2.0 Grant Type Identifiers
+ * Standard identifiers defined here: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#name-grant-types
+ * Token exchange extension defined here: https://datatracker.ietf.org/doc/html/rfc8693
+ */
+var OAuthGrantType;
+(function (OAuthGrantType) {
+    OAuthGrantType["ClientCredentials"] = "client_credentials";
+    OAuthGrantType["AuthorizationCode"] = "authorization_code";
+    OAuthGrantType["RefreshToken"] = "refresh_token";
+    OAuthGrantType["TokenExchange"] = "urn:ietf:params:oauth:grant-type:token-exchange";
+})(OAuthGrantType || (OAuthGrantType = {}));
+/**
+ * OAuth 2.0 Token Type Identifiers
+ * See: https://datatracker.ietf.org/doc/html/rfc8693#name-token-type-identifiers
+ */
+var OAuthTokenType;
+(function (OAuthTokenType) {
+    /** Indicates that the token is an OAuth 2.0 access token issued by the given authorization server. */
+    OAuthTokenType["AccessToken"] = "urn:ietf:params:oauth:token-type:access_token";
+    /** Indicates that the token is an OAuth 2.0 refresh token issued by the given authorization server. */
+    OAuthTokenType["RefreshToken"] = "urn:ietf:params:oauth:token-type:refresh_token";
+    /** Indicates that the token is an ID Token as defined in Section 2 of [OpenID.Core]. */
+    OAuthTokenType["IdToken"] = "urn:ietf:params:oauth:token-type:id_token";
+    /** Indicates that the token is a base64url-encoded SAML 1.1 [OASIS.saml-core-1.1] assertion. */
+    OAuthTokenType["Saml1Token"] = "urn:ietf:params:oauth:token-type:saml1";
+    /** Indicates that the token is a base64url-encoded SAML 2.0 [OASIS.saml-core-2.0-os] assertion. */
+    OAuthTokenType["Saml2Token"] = "urn:ietf:params:oauth:token-type:saml2";
+})(OAuthTokenType || (OAuthTokenType = {}));
 /**
  * The MedplumClient class provides a client for the Medplum FHIR server.
  *
@@ -75,57 +102,43 @@ const system = { resourceType: 'Device', id: 'system', deviceName: [{ name: 'Sys
 class MedplumClient extends EventTarget {
     constructor(options) {
         super();
-        _MedplumClient_instances.add(this);
-        _MedplumClient_fetch.set(this, void 0);
-        _MedplumClient_createPdf.set(this, void 0);
-        _MedplumClient_storage.set(this, void 0);
-        _MedplumClient_requestCache.set(this, void 0);
-        _MedplumClient_cacheTime.set(this, void 0);
-        _MedplumClient_baseUrl.set(this, void 0);
-        _MedplumClient_fhirBaseUrl.set(this, void 0);
-        _MedplumClient_authorizeUrl.set(this, void 0);
-        _MedplumClient_tokenUrl.set(this, void 0);
-        _MedplumClient_logoutUrl.set(this, void 0);
-        _MedplumClient_exchangeUrl.set(this, void 0);
-        _MedplumClient_onUnauthenticated.set(this, void 0);
-        _MedplumClient_autoBatchTime.set(this, void 0);
-        _MedplumClient_autoBatchQueue.set(this, void 0);
-        _MedplumClient_clientId.set(this, void 0);
-        _MedplumClient_clientSecret.set(this, void 0);
-        _MedplumClient_autoBatchTimerId.set(this, void 0);
-        _MedplumClient_accessToken.set(this, void 0);
-        _MedplumClient_refreshToken.set(this, void 0);
-        _MedplumClient_refreshPromise.set(this, void 0);
-        _MedplumClient_profilePromise.set(this, void 0);
-        _MedplumClient_profile.set(this, void 0);
-        _MedplumClient_config.set(this, void 0);
         if (options?.baseUrl) {
             if (!options.baseUrl.startsWith('http')) {
                 throw new Error('Base URL must start with http or https');
             }
         }
-        __classPrivateFieldSet(this, _MedplumClient_fetch, options?.fetch || getDefaultFetch(), "f");
-        __classPrivateFieldSet(this, _MedplumClient_storage, options?.storage || new ClientStorage(), "f");
-        __classPrivateFieldSet(this, _MedplumClient_createPdf, options?.createPdf, "f");
-        __classPrivateFieldSet(this, _MedplumClient_requestCache, new LRUCache(options?.resourceCacheSize ?? DEFAULT_RESOURCE_CACHE_SIZE), "f");
-        __classPrivateFieldSet(this, _MedplumClient_cacheTime, options?.cacheTime ?? DEFAULT_CACHE_TIME, "f");
-        __classPrivateFieldSet(this, _MedplumClient_baseUrl, ensureTrailingSlash(options?.baseUrl) || DEFAULT_BASE_URL, "f");
-        __classPrivateFieldSet(this, _MedplumClient_fhirBaseUrl, __classPrivateFieldGet(this, _MedplumClient_baseUrl, "f") + (ensureTrailingSlash(options?.fhirUrlPath) || 'fhir/R4/'), "f");
-        __classPrivateFieldSet(this, _MedplumClient_clientId, options?.clientId || '', "f");
-        __classPrivateFieldSet(this, _MedplumClient_authorizeUrl, options?.authorizeUrl || __classPrivateFieldGet(this, _MedplumClient_baseUrl, "f") + 'oauth2/authorize', "f");
-        __classPrivateFieldSet(this, _MedplumClient_tokenUrl, options?.tokenUrl || __classPrivateFieldGet(this, _MedplumClient_baseUrl, "f") + 'oauth2/token', "f");
-        __classPrivateFieldSet(this, _MedplumClient_logoutUrl, options?.logoutUrl || __classPrivateFieldGet(this, _MedplumClient_baseUrl, "f") + 'oauth2/logout', "f");
-        __classPrivateFieldSet(this, _MedplumClient_exchangeUrl, __classPrivateFieldGet(this, _MedplumClient_baseUrl, "f") + 'auth/exchange', "f");
-        __classPrivateFieldSet(this, _MedplumClient_onUnauthenticated, options?.onUnauthenticated, "f");
-        __classPrivateFieldSet(this, _MedplumClient_autoBatchTime, options?.autoBatchTime ?? 0, "f");
-        __classPrivateFieldSet(this, _MedplumClient_autoBatchQueue, [], "f");
+        this.fetch = options?.fetch || getDefaultFetch();
+        this.storage = options?.storage || new ClientStorage();
+        this.createPdfImpl = options?.createPdf;
+        this.baseUrl = ensureTrailingSlash(options?.baseUrl) || DEFAULT_BASE_URL;
+        this.fhirBaseUrl = this.baseUrl + (ensureTrailingSlash(options?.fhirUrlPath) || 'fhir/R4/');
+        this.clientId = options?.clientId || '';
+        this.authorizeUrl = options?.authorizeUrl || this.baseUrl + 'oauth2/authorize';
+        this.tokenUrl = options?.tokenUrl || this.baseUrl + 'oauth2/token';
+        this.logoutUrl = options?.logoutUrl || this.baseUrl + 'oauth2/logout';
+        this.onUnauthenticated = options?.onUnauthenticated;
+        this.cacheTime = options?.cacheTime ?? DEFAULT_CACHE_TIME;
+        if (this.cacheTime > 0) {
+            this.requestCache = new LRUCache(options?.resourceCacheSize ?? DEFAULT_RESOURCE_CACHE_SIZE);
+        }
+        else {
+            this.requestCache = undefined;
+        }
+        if (options?.autoBatchTime) {
+            this.autoBatchTime = options?.autoBatchTime ?? 0;
+            this.autoBatchQueue = [];
+        }
+        else {
+            this.autoBatchTime = 0;
+            this.autoBatchQueue = undefined;
+        }
         const activeLogin = this.getActiveLogin();
         if (activeLogin) {
-            __classPrivateFieldSet(this, _MedplumClient_accessToken, activeLogin.accessToken, "f");
-            __classPrivateFieldSet(this, _MedplumClient_refreshToken, activeLogin.refreshToken, "f");
-            __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_refreshProfile).call(this).catch(console.log);
+            this.accessToken = activeLogin.accessToken;
+            this.refreshToken = activeLogin.refreshToken;
+            this.refreshProfile().catch(console.log);
         }
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setupStorageListener).call(this);
+        this.setupStorageListener();
     }
     /**
      * Returns the current base URL for all API requests.
@@ -135,14 +148,14 @@ class MedplumClient extends EventTarget {
      * @returns The current base URL for all API requests.
      */
     getBaseUrl() {
-        return __classPrivateFieldGet(this, _MedplumClient_baseUrl, "f");
+        return this.baseUrl;
     }
     /**
      * Clears all auth state including local storage and session storage.
      * @category Authentication
      */
     clear() {
-        __classPrivateFieldGet(this, _MedplumClient_storage, "f").clear();
+        this.storage.clear();
         this.clearActiveLogin();
     }
     /**
@@ -151,12 +164,12 @@ class MedplumClient extends EventTarget {
      * @category Authentication
      */
     clearActiveLogin() {
-        __classPrivateFieldGet(this, _MedplumClient_storage, "f").setString('activeLogin', undefined);
-        __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").clear();
-        __classPrivateFieldSet(this, _MedplumClient_accessToken, undefined, "f");
-        __classPrivateFieldSet(this, _MedplumClient_refreshToken, undefined, "f");
-        __classPrivateFieldSet(this, _MedplumClient_profile, undefined, "f");
-        __classPrivateFieldSet(this, _MedplumClient_config, undefined, "f");
+        this.storage.setString('activeLogin', undefined);
+        this.requestCache?.clear();
+        this.accessToken = undefined;
+        this.refreshToken = undefined;
+        this.profile = undefined;
+        this.config = undefined;
         this.dispatchEvent({ type: 'change' });
     }
     /**
@@ -166,7 +179,7 @@ class MedplumClient extends EventTarget {
      */
     invalidateUrl(url) {
         url = url.toString();
-        __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").delete(url);
+        this.requestCache?.delete(url);
     }
     /**
      * Invalidates all cached search results or cached requests for the given resourceType.
@@ -174,10 +187,12 @@ class MedplumClient extends EventTarget {
      * @param resourceType The resource type to invalidate.
      */
     invalidateSearches(resourceType) {
-        const url = 'fhir/R4/' + resourceType;
-        for (const key of __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").keys()) {
-            if (key.endsWith(url) || key.includes(url + '?')) {
-                __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").delete(key);
+        const url = this.fhirBaseUrl + resourceType;
+        if (this.requestCache) {
+            for (const key of this.requestCache.keys()) {
+                if (key.endsWith(url) || key.includes(url + '?')) {
+                    this.requestCache.delete(key);
+                }
             }
         }
     }
@@ -195,30 +210,30 @@ class MedplumClient extends EventTarget {
      */
     get(url, options = {}) {
         url = url.toString();
-        const cached = __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_getCacheEntry).call(this, url, options);
+        const cached = this.getCacheEntry(url, options);
         if (cached) {
             return cached.value;
         }
         let promise;
-        if (url.startsWith(__classPrivateFieldGet(this, _MedplumClient_fhirBaseUrl, "f")) && __classPrivateFieldGet(this, _MedplumClient_autoBatchTime, "f") > 0) {
+        if (url.startsWith(this.fhirBaseUrl) && this.autoBatchQueue) {
             promise = new Promise((resolve, reject) => {
-                __classPrivateFieldGet(this, _MedplumClient_autoBatchQueue, "f").push({
+                this.autoBatchQueue.push({
                     method: 'GET',
-                    url: url.replace(__classPrivateFieldGet(this, _MedplumClient_fhirBaseUrl, "f"), ''),
+                    url: url.replace(this.fhirBaseUrl, ''),
                     options,
                     resolve,
                     reject,
                 });
-                if (!__classPrivateFieldGet(this, _MedplumClient_autoBatchTimerId, "f")) {
-                    __classPrivateFieldSet(this, _MedplumClient_autoBatchTimerId, setTimeout(() => __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_executeAutoBatch).call(this), __classPrivateFieldGet(this, _MedplumClient_autoBatchTime, "f")), "f");
+                if (!this.autoBatchTimerId) {
+                    this.autoBatchTimerId = setTimeout(() => this.executeAutoBatch(), this.autoBatchTime);
                 }
             });
         }
         else {
-            promise = __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_request).call(this, 'GET', url, options);
+            promise = this.request('GET', url, options);
         }
         const readablePromise = new ReadablePromise(promise);
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setCacheEntry).call(this, url, readablePromise);
+        this.setCacheEntry(url, readablePromise);
         return readablePromise;
     }
     /**
@@ -238,13 +253,13 @@ class MedplumClient extends EventTarget {
     post(url, body, contentType, options = {}) {
         url = url.toString();
         if (body) {
-            __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setRequestBody).call(this, options, body);
+            this.setRequestBody(options, body);
         }
         if (contentType) {
-            __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setRequestContentType).call(this, options, contentType);
+            this.setRequestContentType(options, contentType);
         }
         this.invalidateUrl(url);
-        return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_request).call(this, 'POST', url, options);
+        return this.request('POST', url, options);
     }
     /**
      * Makes an HTTP PUT request to the specified URL.
@@ -263,13 +278,13 @@ class MedplumClient extends EventTarget {
     put(url, body, contentType, options = {}) {
         url = url.toString();
         if (body) {
-            __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setRequestBody).call(this, options, body);
+            this.setRequestBody(options, body);
         }
         if (contentType) {
-            __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setRequestContentType).call(this, options, contentType);
+            this.setRequestContentType(options, contentType);
         }
         this.invalidateUrl(url);
-        return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_request).call(this, 'PUT', url, options);
+        return this.request('PUT', url, options);
     }
     /**
      * Makes an HTTP PATCH request to the specified URL.
@@ -286,10 +301,10 @@ class MedplumClient extends EventTarget {
      */
     patch(url, operations, options = {}) {
         url = url.toString();
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setRequestBody).call(this, options, operations);
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setRequestContentType).call(this, options, PATCH_CONTENT_TYPE);
+        this.setRequestBody(options, operations);
+        this.setRequestContentType(options, PATCH_CONTENT_TYPE);
         this.invalidateUrl(url);
-        return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_request).call(this, 'PATCH', url, options);
+        return this.request('PATCH', url, options);
     }
     /**
      * Makes an HTTP DELETE request to the specified URL.
@@ -307,7 +322,7 @@ class MedplumClient extends EventTarget {
     delete(url, options = {}) {
         url = url.toString();
         this.invalidateUrl(url);
-        return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_request).call(this, 'DELETE', url, options);
+        return this.request('DELETE', url, options);
     }
     /**
      * Initiates a new user flow.
@@ -359,7 +374,7 @@ class MedplumClient extends EventTarget {
     async startLogin(loginRequest) {
         return this.post('auth/login', {
             ...(await this.ensureCodeChallenge(loginRequest)),
-            clientId: loginRequest.clientId ?? __classPrivateFieldGet(this, _MedplumClient_clientId, "f"),
+            clientId: loginRequest.clientId ?? this.clientId,
             scope: loginRequest.scope,
         });
     }
@@ -374,7 +389,7 @@ class MedplumClient extends EventTarget {
     async startGoogleLogin(loginRequest) {
         return this.post('auth/google', {
             ...(await this.ensureCodeChallenge(loginRequest)),
-            clientId: loginRequest.clientId ?? __classPrivateFieldGet(this, _MedplumClient_clientId, "f"),
+            clientId: loginRequest.clientId ?? this.clientId,
             scope: loginRequest.scope,
         });
     }
@@ -398,7 +413,7 @@ class MedplumClient extends EventTarget {
      * @category Authentication
      */
     async signOut() {
-        await this.post(__classPrivateFieldGet(this, _MedplumClient_logoutUrl, "f"), {});
+        await this.post(this.logoutUrl, {});
         this.clear();
     }
     /**
@@ -412,7 +427,7 @@ class MedplumClient extends EventTarget {
         const urlParams = new URLSearchParams(window.location.search);
         const code = urlParams.get('code');
         if (!code) {
-            await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_requestAuthorization).call(this, loginParams);
+            await this.requestAuthorization(loginParams);
             return undefined;
         }
         else {
@@ -425,7 +440,7 @@ class MedplumClient extends EventTarget {
      * @category Authentication
      */
     signOutWithRedirect() {
-        window.location.assign(__classPrivateFieldGet(this, _MedplumClient_logoutUrl, "f"));
+        window.location.assign(this.logoutUrl);
     }
     /**
      * Initiates sign in with an external identity provider.
@@ -446,26 +461,16 @@ class MedplumClient extends EventTarget {
      * @category Authentication
      */
     async exchangeExternalAccessToken(token, clientId) {
-        clientId = clientId || __classPrivateFieldGet(this, _MedplumClient_clientId, "f");
+        clientId = clientId || this.clientId;
         if (!clientId) {
             throw new Error('MedplumClient is missing clientId');
         }
-        const response = await __classPrivateFieldGet(this, _MedplumClient_fetch, "f").call(this, __classPrivateFieldGet(this, _MedplumClient_exchangeUrl, "f"), {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                clientId: __classPrivateFieldGet(this, _MedplumClient_clientId, "f"),
-                externalAccessToken: token,
-            }),
-            credentials: 'include',
-        });
-        if (!response.ok) {
-            this.clearActiveLogin();
-            throw new Error('Failed to fetch tokens');
-        }
-        const tokens = await response.json();
-        await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_verifyTokens).call(this, tokens);
-        return this.getProfile();
+        const formBody = new URLSearchParams();
+        formBody.set('grant_type', OAuthGrantType.TokenExchange);
+        formBody.set('subject_token_type', OAuthTokenType.AccessToken);
+        formBody.set('client_id', clientId);
+        formBody.set('subject_token', token);
+        return this.fetchTokens(formBody);
     }
     /**
      * Builds the external identity provider redirect URI.
@@ -493,7 +498,7 @@ class MedplumClient extends EventTarget {
      * @returns The well-formed FHIR URL.
      */
     fhirUrl(...path) {
-        return new URL(__classPrivateFieldGet(this, _MedplumClient_fhirBaseUrl, "f") + path.join('/'));
+        return new URL(this.fhirBaseUrl + path.join('/'));
     }
     /**
      * Builds a FHIR search URL from a search query or structured query object.
@@ -561,7 +566,7 @@ class MedplumClient extends EventTarget {
     search(resourceType, query, options = {}) {
         const url = this.fhirSearchUrl(resourceType, query);
         const cacheKey = url.toString() + '-search';
-        const cached = __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_getCacheEntry).call(this, cacheKey, options);
+        const cached = this.getCacheEntry(cacheKey, options);
         if (cached) {
             return cached.value;
         }
@@ -569,12 +574,12 @@ class MedplumClient extends EventTarget {
             const bundle = await this.get(url, options);
             if (bundle.entry) {
                 for (const entry of bundle.entry) {
-                    __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_cacheResource).call(this, entry.resource);
+                    this.cacheResource(entry.resource);
                 }
             }
             return bundle;
         })());
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setCacheEntry).call(this, cacheKey, promise);
+        this.setCacheEntry(cacheKey, promise);
         return promise;
     }
     /**
@@ -604,12 +609,12 @@ class MedplumClient extends EventTarget {
         url.searchParams.set('_count', '1');
         url.searchParams.sort();
         const cacheKey = url.toString() + '-searchOne';
-        const cached = __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_getCacheEntry).call(this, cacheKey, options);
+        const cached = this.getCacheEntry(cacheKey, options);
         if (cached) {
             return cached.value;
         }
         const promise = new ReadablePromise(this.search(resourceType, url.searchParams, options).then((b) => b.entry?.[0]?.resource));
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setCacheEntry).call(this, cacheKey, promise);
+        this.setCacheEntry(cacheKey, promise);
         return promise;
     }
     /**
@@ -637,12 +642,12 @@ class MedplumClient extends EventTarget {
     searchResources(resourceType, query, options = {}) {
         const url = this.fhirSearchUrl(resourceType, query);
         const cacheKey = url.toString() + '-searchResources';
-        const cached = __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_getCacheEntry).call(this, cacheKey, options);
+        const cached = this.getCacheEntry(cacheKey, options);
         if (cached) {
             return cached.value;
         }
         const promise = new ReadablePromise(this.search(resourceType, query, options).then((b) => b.entry?.map((e) => e.resource) ?? []));
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setCacheEntry).call(this, cacheKey, promise);
+        this.setCacheEntry(cacheKey, promise);
         return promise;
     }
     /**
@@ -703,7 +708,7 @@ class MedplumClient extends EventTarget {
      * @returns The resource if it is available in the cache; undefined otherwise.
      */
     getCached(resourceType, id) {
-        const cached = __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").get(this.fhirUrl(resourceType, id).toString())?.value;
+        const cached = this.requestCache?.get(this.fhirUrl(resourceType, id).toString())?.value;
         return cached && cached.isOk() ? cached.read() : undefined;
     }
     /**
@@ -805,7 +810,7 @@ class MedplumClient extends EventTarget {
             return Promise.resolve(globalSchema);
         }
         const cacheKey = resourceType + '-requestSchema';
-        const cached = __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_getCacheEntry).call(this, cacheKey, undefined);
+        const cached = this.getCacheEntry(cacheKey, undefined);
         if (cached) {
             return cached.value;
         }
@@ -848,7 +853,7 @@ class MedplumClient extends EventTarget {
             }
             return globalSchema;
         })());
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setCacheEntry).call(this, cacheKey, promise);
+        this.setCacheEntry(cacheKey, promise);
         return promise;
     }
     /**
@@ -1046,7 +1051,7 @@ class MedplumClient extends EventTarget {
             };
             xhr.open('POST', url);
             xhr.withCredentials = true;
-            xhr.setRequestHeader('Authorization', 'Bearer ' + __classPrivateFieldGet(this, _MedplumClient_accessToken, "f"));
+            xhr.setRequestHeader('Authorization', 'Bearer ' + this.accessToken);
             xhr.setRequestHeader('Cache-Control', 'no-cache, no-store, max-age=0');
             xhr.setRequestHeader('Content-Type', contentType);
             xhr.setRequestHeader('X-Medplum', 'extended');
@@ -1076,10 +1081,10 @@ class MedplumClient extends EventTarget {
      * @returns The result of the create operation.
      */
     async createPdf(docDefinition, filename, tableLayouts, fonts) {
-        if (!__classPrivateFieldGet(this, _MedplumClient_createPdf, "f")) {
+        if (!this.createPdfImpl) {
             throw new Error('PDF creation not enabled');
         }
-        const blob = await __classPrivateFieldGet(this, _MedplumClient_createPdf, "f").call(this, docDefinition, tableLayouts, fonts);
+        const blob = await this.createPdfImpl(docDefinition, tableLayouts, fonts);
         return this.createBinary(blob, filename, 'application/pdf');
     }
     /**
@@ -1157,7 +1162,7 @@ class MedplumClient extends EventTarget {
             // return result ?? resource;
             result = resource;
         }
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_cacheResource).call(this, result);
+        this.cacheResource(result);
         return result;
     }
     /**
@@ -1205,7 +1210,7 @@ class MedplumClient extends EventTarget {
      * @returns The result of the delete operation.
      */
     deleteResource(resourceType, id) {
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_deleteCacheEntry).call(this, this.fhirUrl(resourceType, id).toString());
+        this.deleteCacheEntry(this.fhirUrl(resourceType, id).toString());
         this.invalidateSearches(resourceType);
         return this.delete(this.fhirUrl(resourceType, id));
     }
@@ -1297,7 +1302,7 @@ class MedplumClient extends EventTarget {
      * @returns The FHIR batch/transaction response bundle.
      */
     executeBatch(bundle) {
-        return this.post('fhir/R4', bundle);
+        return this.post(this.fhirBaseUrl.slice(0, -1), bundle);
     }
     /**
      * Sends an email using the Medplum Email API.
@@ -1409,61 +1414,80 @@ class MedplumClient extends EventTarget {
      * @returns The Login State
      */
     getActiveLogin() {
-        return __classPrivateFieldGet(this, _MedplumClient_storage, "f").getObject('activeLogin');
+        return this.storage.getObject('activeLogin');
     }
     /**
      * @category Authentication
      */
     async setActiveLogin(login) {
         this.clearActiveLogin();
-        __classPrivateFieldSet(this, _MedplumClient_accessToken, login.accessToken, "f");
-        __classPrivateFieldSet(this, _MedplumClient_refreshToken, login.refreshToken, "f");
-        __classPrivateFieldGet(this, _MedplumClient_storage, "f").setObject('activeLogin', login);
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_addLogin).call(this, login);
-        __classPrivateFieldSet(this, _MedplumClient_refreshPromise, undefined, "f");
-        await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_refreshProfile).call(this);
+        this.accessToken = login.accessToken;
+        this.refreshToken = login.refreshToken;
+        this.storage.setObject('activeLogin', login);
+        this.addLogin(login);
+        this.refreshPromise = undefined;
+        await this.refreshProfile();
     }
     /**
      * Returns the current access token.
      * @category Authentication
      */
     getAccessToken() {
-        return __classPrivateFieldGet(this, _MedplumClient_accessToken, "f");
+        return this.accessToken;
     }
     /**
      * Sets the current access token.
      * @category Authentication
      */
     setAccessToken(accessToken) {
-        __classPrivateFieldSet(this, _MedplumClient_accessToken, accessToken, "f");
-        __classPrivateFieldSet(this, _MedplumClient_refreshToken, undefined, "f");
-        __classPrivateFieldSet(this, _MedplumClient_profile, undefined, "f");
-        __classPrivateFieldSet(this, _MedplumClient_config, undefined, "f");
+        this.accessToken = accessToken;
+        this.refreshToken = undefined;
+        this.profile = undefined;
+        this.config = undefined;
     }
     /**
      * @category Authentication
      */
     getLogins() {
-        return __classPrivateFieldGet(this, _MedplumClient_storage, "f").getObject('logins') ?? [];
+        return this.storage.getObject('logins') ?? [];
+    }
+    addLogin(newLogin) {
+        const logins = this.getLogins().filter((login) => login.profile?.reference !== newLogin.profile?.reference);
+        logins.push(newLogin);
+        this.storage.setObject('logins', logins);
+    }
+    async refreshProfile() {
+        this.profilePromise = new Promise((resolve, reject) => {
+            this.get('auth/me')
+                .then((result) => {
+                this.profilePromise = undefined;
+                this.profile = result.profile;
+                this.config = result.config;
+                this.dispatchEvent({ type: 'change' });
+                resolve(this.profile);
+            })
+                .catch(reject);
+        });
+        return this.profilePromise;
     }
     /**
      * @category Authentication
      */
     isLoading() {
-        return !!__classPrivateFieldGet(this, _MedplumClient_profilePromise, "f");
+        return !!this.profilePromise;
     }
     /**
      * @category User Profile
      */
     getProfile() {
-        return __classPrivateFieldGet(this, _MedplumClient_profile, "f");
+        return this.profile;
     }
     /**
      * @category User Profile
      */
     async getProfileAsync() {
-        if (__classPrivateFieldGet(this, _MedplumClient_profilePromise, "f")) {
-            await __classPrivateFieldGet(this, _MedplumClient_profilePromise, "f");
+        if (this.profilePromise) {
+            await this.profilePromise;
         }
         return this.getProfile();
     }
@@ -1471,7 +1495,7 @@ class MedplumClient extends EventTarget {
      * @category User Profile
      */
     getUserConfiguration() {
-        return __classPrivateFieldGet(this, _MedplumClient_config, "f");
+        return this.config;
     }
     /**
      * Downloads the URL as a blob.
@@ -1481,13 +1505,234 @@ class MedplumClient extends EventTarget {
      * @returns Promise to the response body as a blob.
      */
     async download(url, options = {}) {
-        if (__classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f")) {
-            await __classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f");
+        if (this.refreshPromise) {
+            await this.refreshPromise;
         }
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_addFetchOptionsDefaults).call(this, options);
-        const response = await __classPrivateFieldGet(this, _MedplumClient_fetch, "f").call(this, url.toString(), options);
+        this.addFetchOptionsDefaults(options);
+        const response = await this.fetch(url.toString(), options);
         return response.blob();
     }
+    //
+    // Private helpers
+    //
+    /**
+     * Returns the cache entry if available and not expired.
+     * @param key The cache key to retrieve.
+     * @param options Optional fetch options for cache settings.
+     * @returns The cached entry if found.
+     */
+    getCacheEntry(key, options) {
+        if (!this.requestCache || options?.cache === 'no-cache' || options?.cache === 'reload') {
+            return undefined;
+        }
+        const entry = this.requestCache.get(key);
+        if (!entry || entry.requestTime + this.cacheTime < Date.now()) {
+            return undefined;
+        }
+        return entry;
+    }
+    /**
+     * Adds a readable promise to the cache.
+     * @param key The cache key to store.
+     * @param value The readable promise to store.
+     */
+    setCacheEntry(key, value) {
+        if (this.requestCache) {
+            this.requestCache.set(key, { requestTime: Date.now(), value });
+        }
+    }
+    /**
+     * Adds a concrete value as the cache entry for the given resource.
+     * This is used in cases where the resource is loaded indirectly.
+     * For example, when a resource is loaded as part of a Bundle.
+     * @param resource The resource to cache.
+     */
+    cacheResource(resource) {
+        if (resource?.id) {
+            this.setCacheEntry(this.fhirUrl(resource.resourceType, resource.id).toString(), new ReadablePromise(Promise.resolve(resource)));
+        }
+    }
+    /**
+     * Deletes a cache entry.
+     * @param key The cache key to delete.
+     */
+    deleteCacheEntry(key) {
+        if (this.requestCache) {
+            this.requestCache.delete(key);
+        }
+    }
+    /**
+     * Makes an HTTP request.
+     * @param {string} method
+     * @param {string} url
+     * @param {string=} contentType
+     * @param {Object=} body
+     */
+    async request(method, url, options = {}) {
+        if (this.refreshPromise) {
+            await this.refreshPromise;
+        }
+        if (!url.startsWith('http')) {
+            url = this.baseUrl + url;
+        }
+        options.method = method;
+        this.addFetchOptionsDefaults(options);
+        const response = await this.fetchWithRetry(url, options);
+        if (response.status === 401) {
+            // Refresh and try again
+            return this.handleUnauthenticated(method, url, options);
+        }
+        if (response.status === 204 || response.status === 304) {
+            // No content or change
+            return undefined;
+        }
+        let obj = undefined;
+        try {
+            obj = await response.json();
+        }
+        catch (err) {
+            console.error('Error parsing response', response.status, err);
+            throw err;
+        }
+        if (response.status >= 400) {
+            throw new OperationOutcomeError(normalizeOperationOutcome(obj));
+        }
+        return obj;
+    }
+    async fetchWithRetry(url, options) {
+        const maxRetries = 3;
+        const retryDelay = 200;
+        let response = undefined;
+        for (let retry = 0; retry < maxRetries; retry++) {
+            response = (await this.fetch(url, options));
+            if (response.status < 500) {
+                return response;
+            }
+            await new Promise((resolve) => setTimeout(resolve, retryDelay));
+        }
+        return response;
+    }
+    /**
+     * Executes a batch of requests that were automatically batched together.
+     */
+    async executeAutoBatch() {
+        // Get the current queue
+        const entries = [...this.autoBatchQueue];
+        // Clear the queue
+        this.autoBatchQueue.length = 0;
+        // Clear the timer
+        this.autoBatchTimerId = undefined;
+        // If there is only one request in the batch, just execute it
+        if (entries.length === 1) {
+            const entry = entries[0];
+            try {
+                entry.resolve(await this.request(entry.method, this.fhirBaseUrl + entry.url, entry.options));
+            }
+            catch (err) {
+                entry.reject(new OperationOutcomeError(normalizeOperationOutcome(err)));
+            }
+            return;
+        }
+        // Build the batch request
+        const batch = {
+            resourceType: 'Bundle',
+            type: 'batch',
+            entry: entries.map((e) => ({
+                request: {
+                    method: e.method,
+                    url: e.url,
+                },
+                resource: e.options.body ? JSON.parse(e.options.body) : undefined,
+            })),
+        };
+        // Execute the batch request
+        const response = (await this.post(this.fhirBaseUrl.slice(0, -1), batch));
+        // Process the response
+        for (let i = 0; i < entries.length; i++) {
+            const entry = entries[i];
+            const responseEntry = response.entry?.[i];
+            if (responseEntry?.response?.outcome && !isOk(responseEntry.response.outcome)) {
+                entry.reject(new OperationOutcomeError(responseEntry.response.outcome));
+            }
+            else {
+                entry.resolve(responseEntry?.resource);
+            }
+        }
+    }
+    /**
+     * Adds default options to the fetch options.
+     * @param options The options to add defaults to.
+     */
+    addFetchOptionsDefaults(options) {
+        let headers = options.headers;
+        if (!headers) {
+            headers = {};
+            options.headers = headers;
+        }
+        headers['X-Medplum'] = 'extended';
+        if (options.body && !headers['Content-Type']) {
+            headers['Content-Type'] = FHIR_CONTENT_TYPE;
+        }
+        if (this.accessToken) {
+            headers['Authorization'] = 'Bearer ' + this.accessToken;
+        }
+        if (this.basicAuth) {
+            headers['Authorization'] = 'Basic ' + this.basicAuth;
+        }
+        if (!options.cache) {
+            options.cache = 'no-cache';
+        }
+        if (!options.credentials) {
+            options.credentials = 'include';
+        }
+    }
+    /**
+     * Sets the "Content-Type" header on fetch options.
+     * @param options The fetch options.
+     * @param contentType The new content type to set.
+     */
+    setRequestContentType(options, contentType) {
+        if (!options.headers) {
+            options.headers = {};
+        }
+        const headers = options.headers;
+        headers['Content-Type'] = contentType;
+    }
+    /**
+     * Sets the body on fetch options.
+     * @param options The fetch options.
+     * @param data The new content body.
+     */
+    setRequestBody(options, data) {
+        if (typeof data === 'string' ||
+            (typeof Blob !== 'undefined' && data instanceof Blob) ||
+            (typeof File !== 'undefined' && data instanceof File) ||
+            (typeof Uint8Array !== 'undefined' && data instanceof Uint8Array)) {
+            options.body = data;
+        }
+        else if (data) {
+            options.body = JSON.stringify(data);
+        }
+    }
+    /**
+     * Handles an unauthenticated response from the server.
+     * First, tries to refresh the access token and retry the request.
+     * Otherwise, calls unauthenticated callbacks and rejects.
+     * @param method The HTTP method of the original request.
+     * @param url The URL of the original request.
+     * @param contentType The content type of the original request.
+     * @param body The body of the original request.
+     */
+    handleUnauthenticated(method, url, options) {
+        if (this.refresh()) {
+            return this.request(method, url, options);
+        }
+        this.clearActiveLogin();
+        if (this.onUnauthenticated) {
+            this.onUnauthenticated();
+        }
+        return Promise.reject(new Error('Unauthenticated'));
+    }
     /**
      * Starts a new PKCE flow.
      * These PKCE values are stateful, and must survive redirects and page refreshes.
@@ -1503,6 +1748,23 @@ class MedplumClient extends EventTarget {
         sessionStorage.setItem('codeChallenge', codeChallenge);
         return { codeChallengeMethod: 'S256', codeChallenge };
     }
+    /**
+     * Redirects the user to the login screen for authorization.
+     * Clears all auth state including local storage and session storage.
+     * See: https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint
+     */
+    async requestAuthorization(loginParams) {
+        const loginRequest = await this.ensureCodeChallenge(loginParams || {});
+        const url = new URL(this.authorizeUrl);
+        url.searchParams.set('response_type', 'code');
+        url.searchParams.set('state', sessionStorage.getItem('pkceState'));
+        url.searchParams.set('client_id', loginRequest.clientId || this.clientId);
+        url.searchParams.set('redirect_uri', loginRequest.redirectUri || getWindowOrigin());
+        url.searchParams.set('code_challenge_method', loginRequest.codeChallengeMethod);
+        url.searchParams.set('code_challenge', loginRequest.codeChallenge);
+        url.searchParams.set('scope', loginRequest.scope || 'openid profile');
+        window.location.assign(url.toString());
+    }
     /**
      * Processes an OAuth authorization code.
      * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest
@@ -1512,9 +1774,9 @@ class MedplumClient extends EventTarget {
      */
     processCode(code, loginParams) {
         const formBody = new URLSearchParams();
-        formBody.set('grant_type', 'authorization_code');
+        formBody.set('grant_type', OAuthGrantType.AuthorizationCode);
         formBody.set('code', code);
-        formBody.set('client_id', loginParams?.clientId || __classPrivateFieldGet(this, _MedplumClient_clientId, "f"));
+        formBody.set('client_id', loginParams?.clientId || this.clientId);
         formBody.set('redirect_uri', loginParams?.redirectUri || getWindowOrigin());
         if (typeof sessionStorage !== 'undefined') {
             const codeVerifier = sessionStorage.getItem('codeVerifier');
@@ -1522,7 +1784,29 @@ class MedplumClient extends EventTarget {
                 formBody.set('code_verifier', codeVerifier);
             }
         }
-        return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_fetchTokens).call(this, formBody);
+        return this.fetchTokens(formBody);
+    }
+    /**
+     * Tries to refresh the auth tokens.
+     * See: https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens
+     */
+    refresh() {
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        if (this.refreshToken) {
+            const formBody = new URLSearchParams();
+            formBody.set('grant_type', OAuthGrantType.RefreshToken);
+            formBody.set('client_id', this.clientId);
+            formBody.set('refresh_token', this.refreshToken);
+            this.refreshPromise = this.fetchTokens(formBody);
+            return this.refreshPromise;
+        }
+        if (this.clientId && this.clientSecret) {
+            this.refreshPromise = this.startClientLogin(this.clientId, this.clientSecret);
+            return this.refreshPromise;
+        }
+        return undefined;
     }
     /**
      * Starts a new OAuth2 client credentials flow.
@@ -1533,13 +1817,24 @@ class MedplumClient extends EventTarget {
      * @returns Promise that resolves to the client profile.
      */
     async startClientLogin(clientId, clientSecret) {
-        __classPrivateFieldSet(this, _MedplumClient_clientId, clientId, "f");
-        __classPrivateFieldSet(this, _MedplumClient_clientSecret, clientSecret, "f");
+        this.clientId = clientId;
+        this.clientSecret = clientSecret;
         const formBody = new URLSearchParams();
-        formBody.set('grant_type', 'client_credentials');
+        formBody.set('grant_type', OAuthGrantType.ClientCredentials);
         formBody.set('client_id', clientId);
         formBody.set('client_secret', clientSecret);
-        return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_fetchTokens).call(this, formBody);
+        return this.fetchTokens(formBody);
+    }
+    /**
+     * Sets the client ID and secret for basic auth.
+     * @category Authentication
+     * @param clientId The client ID.
+     * @param clientSecret The client secret.
+     */
+    setBasicAuth(clientId, clientSecret) {
+        this.clientId = clientId;
+        this.clientSecret = clientSecret;
+        this.basicAuth = encodeBase64(clientId + ':' + clientSecret);
     }
     /**
      * Invite a user to a project.
@@ -1550,280 +1845,72 @@ class MedplumClient extends EventTarget {
     async invite(projectId, body) {
         return this.post('admin/projects/' + projectId + '/invite', body);
     }
-}
-_MedplumClient_fetch = new WeakMap(), _MedplumClient_createPdf = new WeakMap(), _MedplumClient_storage = new WeakMap(), _MedplumClient_requestCache = new WeakMap(), _MedplumClient_cacheTime = new WeakMap(), _MedplumClient_baseUrl = new WeakMap(), _MedplumClient_fhirBaseUrl = new WeakMap(), _MedplumClient_authorizeUrl = new WeakMap(), _MedplumClient_tokenUrl = new WeakMap(), _MedplumClient_logoutUrl = new WeakMap(), _MedplumClient_exchangeUrl = new WeakMap(), _MedplumClient_onUnauthenticated = new WeakMap(), _MedplumClient_autoBatchTime = new WeakMap(), _MedplumClient_autoBatchQueue = new WeakMap(), _MedplumClient_clientId = new WeakMap(), _MedplumClient_clientSecret = new WeakMap(), _MedplumClient_autoBatchTimerId = new WeakMap(), _MedplumClient_accessToken = new WeakMap(), _MedplumClient_refreshToken = new WeakMap(), _MedplumClient_refreshPromise = new WeakMap(), _MedplumClient_profilePromise = new WeakMap(), _MedplumClient_profile = new WeakMap(), _MedplumClient_config = new WeakMap(), _MedplumClient_instances = new WeakSet(), _MedplumClient_addLogin = function _MedplumClient_addLogin(newLogin) {
-    const logins = this.getLogins().filter((login) => login.profile?.reference !== newLogin.profile?.reference);
-    logins.push(newLogin);
-    __classPrivateFieldGet(this, _MedplumClient_storage, "f").setObject('logins', logins);
-}, _MedplumClient_refreshProfile = async function _MedplumClient_refreshProfile() {
-    __classPrivateFieldSet(this, _MedplumClient_profilePromise, new Promise((resolve, reject) => {
-        this.get('auth/me')
-            .then((result) => {
-            __classPrivateFieldSet(this, _MedplumClient_profilePromise, undefined, "f");
-            __classPrivateFieldSet(this, _MedplumClient_profile, result.profile, "f");
-            __classPrivateFieldSet(this, _MedplumClient_config, result.config, "f");
-            this.dispatchEvent({ type: 'change' });
-            resolve(__classPrivateFieldGet(this, _MedplumClient_profile, "f"));
-        })
-            .catch(reject);
-    }), "f");
-    return __classPrivateFieldGet(this, _MedplumClient_profilePromise, "f");
-}, _MedplumClient_getCacheEntry = function _MedplumClient_getCacheEntry(key, options) {
-    if (__classPrivateFieldGet(this, _MedplumClient_cacheTime, "f") <= 0 || options?.cache === 'no-cache' || options?.cache === 'reload') {
-        return undefined;
-    }
-    const entry = __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").get(key);
-    if (!entry || entry.requestTime + __classPrivateFieldGet(this, _MedplumClient_cacheTime, "f") < Date.now()) {
-        return undefined;
-    }
-    return entry;
-}, _MedplumClient_setCacheEntry = function _MedplumClient_setCacheEntry(key, value) {
-    if (__classPrivateFieldGet(this, _MedplumClient_cacheTime, "f") > 0) {
-        __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").set(key, { requestTime: Date.now(), value });
-    }
-}, _MedplumClient_cacheResource = function _MedplumClient_cacheResource(resource) {
-    if (resource?.id) {
-        __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_setCacheEntry).call(this, this.fhirUrl(resource.resourceType, resource.id).toString(), new ReadablePromise(Promise.resolve(resource)));
-    }
-}, _MedplumClient_deleteCacheEntry = function _MedplumClient_deleteCacheEntry(key) {
-    if (__classPrivateFieldGet(this, _MedplumClient_cacheTime, "f") > 0) {
-        __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").delete(key);
-    }
-}, _MedplumClient_request = 
-/**
- * Makes an HTTP request.
- * @param {string} method
- * @param {string} url
- * @param {string=} contentType
- * @param {Object=} body
- */
-async function _MedplumClient_request(method, url, options = {}) {
-    if (__classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f")) {
-        await __classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f");
-    }
-    if (!url.startsWith('http')) {
-        url = __classPrivateFieldGet(this, _MedplumClient_baseUrl, "f") + url;
-    }
-    options.method = method;
-    __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_addFetchOptionsDefaults).call(this, options);
-    const response = await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_fetchWithRetry).call(this, url, options);
-    if (response.status === 401) {
-        // Refresh and try again
-        return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_handleUnauthenticated).call(this, method, url, options);
-    }
-    if (response.status === 204 || response.status === 304) {
-        // No content or change
-        return undefined;
-    }
-    let obj = undefined;
-    try {
-        obj = await response.json();
-    }
-    catch (err) {
-        console.error('Error parsing response', response.status, err);
-        throw err;
-    }
-    if (response.status >= 400) {
-        throw new OperationOutcomeError(normalizeOperationOutcome(obj));
+    /**
+     * Makes a POST request to the tokens endpoint.
+     * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
+     * @param formBody Token parameters in URL encoded format.
+     */
+    async fetchTokens(formBody) {
+        const response = await this.fetch(this.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: formBody,
+            credentials: 'include',
+        });
+        if (!response.ok) {
+            this.clearActiveLogin();
+            throw new Error('Failed to fetch tokens');
+        }
+        const tokens = await response.json();
+        await this.verifyTokens(tokens);
+        return this.getProfile();
     }
-    return obj;
-}, _MedplumClient_fetchWithRetry = async function _MedplumClient_fetchWithRetry(url, options) {
-    const maxRetries = 3;
-    const retryDelay = 200;
-    let response = undefined;
-    for (let retry = 0; retry < maxRetries; retry++) {
-        response = (await __classPrivateFieldGet(this, _MedplumClient_fetch, "f").call(this, url, options));
-        if (response.status < 500) {
-            return response;
+    /**
+     * Verifies the tokens received from the auth server.
+     * Validates the JWT against the JWKS.
+     * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
+     * @param tokens
+     */
+    async verifyTokens(tokens) {
+        const token = tokens.access_token;
+        // Verify token has not expired
+        const tokenPayload = parseJWTPayload(token);
+        if (Date.now() >= tokenPayload.exp * 1000) {
+            this.clearActiveLogin();
+            throw new Error('Token expired');
+        }
+        // Verify app_client_id
+        if (this.clientId && tokenPayload.client_id !== this.clientId) {
+            this.clearActiveLogin();
+            throw new Error('Token was not issued for this audience');
         }
-        await new Promise((resolve) => setTimeout(resolve, retryDelay));
+        return this.setActiveLogin({
+            accessToken: token,
+            refreshToken: tokens.refresh_token,
+            project: tokens.project,
+            profile: tokens.profile,
+        });
     }
-    return response;
-}, _MedplumClient_executeAutoBatch = 
-/**
- * Executes a batch of requests that were automatically batched together.
- */
-async function _MedplumClient_executeAutoBatch() {
-    // Get the current queue
-    const entries = [...__classPrivateFieldGet(this, _MedplumClient_autoBatchQueue, "f")];
-    // Clear the queue
-    __classPrivateFieldGet(this, _MedplumClient_autoBatchQueue, "f").length = 0;
-    // Clear the timer
-    __classPrivateFieldSet(this, _MedplumClient_autoBatchTimerId, undefined, "f");
-    // If there is only one request in the batch, just execute it
-    if (entries.length === 1) {
-        const entry = entries[0];
+    /**
+     * Sets up a listener for window storage events.
+     * This synchronizes state across browser windows and browser tabs.
+     */
+    setupStorageListener() {
         try {
-            entry.resolve(await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_request).call(this, entry.method, __classPrivateFieldGet(this, _MedplumClient_fhirBaseUrl, "f") + entry.url, entry.options));
+            window.addEventListener('storage', (e) => {
+                if (e.key === null || e.key === 'activeLogin') {
+                    // Storage events fire when different tabs make changes.
+                    // On storage clear (key === null) or activeLogin change (key === 'activeLogin')
+                    // Refresh the page to ensure the active login is up to date.
+                    window.location.reload();
+                }
+            });
         }
         catch (err) {
-            entry.reject(new OperationOutcomeError(normalizeOperationOutcome(err)));
-        }
-        return;
-    }
-    // Build the batch request
-    const batch = {
-        resourceType: 'Bundle',
-        type: 'batch',
-        entry: entries.map((e) => ({
-            request: {
-                method: e.method,
-                url: e.url,
-            },
-            resource: e.options.body ? JSON.parse(e.options.body) : undefined,
-        })),
-    };
-    // Execute the batch request
-    const response = (await this.post('fhir/R4', batch));
-    // Process the response
-    for (let i = 0; i < entries.length; i++) {
-        const entry = entries[i];
-        const responseEntry = response.entry?.[i];
-        if (responseEntry?.response?.outcome && !isOk(responseEntry.response.outcome)) {
-            entry.reject(new OperationOutcomeError(responseEntry.response.outcome));
+            // Silently ignore if this environment does not support storage events
         }
-        else {
-            entry.resolve(responseEntry?.resource);
-        }
-    }
-}, _MedplumClient_addFetchOptionsDefaults = function _MedplumClient_addFetchOptionsDefaults(options) {
-    if (!options.headers) {
-        options.headers = {};
-    }
-    const headers = options.headers;
-    headers['X-Medplum'] = 'extended';
-    if (!headers['Content-Type']) {
-        headers['Content-Type'] = FHIR_CONTENT_TYPE;
-    }
-    if (__classPrivateFieldGet(this, _MedplumClient_accessToken, "f")) {
-        headers['Authorization'] = 'Bearer ' + __classPrivateFieldGet(this, _MedplumClient_accessToken, "f");
-    }
-    if (!options.cache) {
-        options.cache = 'no-cache';
-    }
-    if (!options.credentials) {
-        options.credentials = 'include';
-    }
-}, _MedplumClient_setRequestContentType = function _MedplumClient_setRequestContentType(options, contentType) {
-    if (!options.headers) {
-        options.headers = {};
     }
-    const headers = options.headers;
-    headers['Content-Type'] = contentType;
-}, _MedplumClient_setRequestBody = function _MedplumClient_setRequestBody(options, data) {
-    if (typeof data === 'string' ||
-        (typeof Blob !== 'undefined' && data instanceof Blob) ||
-        (typeof File !== 'undefined' && data instanceof File) ||
-        (typeof Uint8Array !== 'undefined' && data instanceof Uint8Array)) {
-        options.body = data;
-    }
-    else if (data) {
-        options.body = JSON.stringify(data);
-    }
-}, _MedplumClient_handleUnauthenticated = function _MedplumClient_handleUnauthenticated(method, url, options) {
-    if (__classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_refresh).call(this)) {
-        return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_request).call(this, method, url, options);
-    }
-    this.clearActiveLogin();
-    if (__classPrivateFieldGet(this, _MedplumClient_onUnauthenticated, "f")) {
-        __classPrivateFieldGet(this, _MedplumClient_onUnauthenticated, "f").call(this);
-    }
-    return Promise.reject(new Error('Unauthenticated'));
-}, _MedplumClient_requestAuthorization = 
-/**
- * Redirects the user to the login screen for authorization.
- * Clears all auth state including local storage and session storage.
- * See: https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint
- */
-async function _MedplumClient_requestAuthorization(loginParams) {
-    const loginRequest = await this.ensureCodeChallenge(loginParams || {});
-    const url = new URL(__classPrivateFieldGet(this, _MedplumClient_authorizeUrl, "f"));
-    url.searchParams.set('response_type', 'code');
-    url.searchParams.set('state', sessionStorage.getItem('pkceState'));
-    url.searchParams.set('client_id', loginRequest.clientId || __classPrivateFieldGet(this, _MedplumClient_clientId, "f"));
-    url.searchParams.set('redirect_uri', loginRequest.redirectUri || getWindowOrigin());
-    url.searchParams.set('code_challenge_method', loginRequest.codeChallengeMethod);
-    url.searchParams.set('code_challenge', loginRequest.codeChallenge);
-    url.searchParams.set('scope', loginRequest.scope || 'openid profile');
-    window.location.assign(url.toString());
-}, _MedplumClient_refresh = function _MedplumClient_refresh() {
-    if (__classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f")) {
-        return __classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f");
-    }
-    if (__classPrivateFieldGet(this, _MedplumClient_refreshToken, "f")) {
-        const formBody = new URLSearchParams();
-        formBody.set('grant_type', 'refresh_token');
-        formBody.set('client_id', __classPrivateFieldGet(this, _MedplumClient_clientId, "f"));
-        formBody.set('refresh_token', __classPrivateFieldGet(this, _MedplumClient_refreshToken, "f"));
-        __classPrivateFieldSet(this, _MedplumClient_refreshPromise, __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_fetchTokens).call(this, formBody), "f");
-        return __classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f");
-    }
-    if (__classPrivateFieldGet(this, _MedplumClient_clientId, "f") && __classPrivateFieldGet(this, _MedplumClient_clientSecret, "f")) {
-        __classPrivateFieldSet(this, _MedplumClient_refreshPromise, this.startClientLogin(__classPrivateFieldGet(this, _MedplumClient_clientId, "f"), __classPrivateFieldGet(this, _MedplumClient_clientSecret, "f")), "f");
-        return __classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f");
-    }
-    return undefined;
-}, _MedplumClient_fetchTokens = 
-/**
- * Makes a POST request to the tokens endpoint.
- * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
- * @param formBody Token parameters in URL encoded format.
- */
-async function _MedplumClient_fetchTokens(formBody) {
-    const response = await __classPrivateFieldGet(this, _MedplumClient_fetch, "f").call(this, __classPrivateFieldGet(this, _MedplumClient_tokenUrl, "f"), {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: formBody,
-        credentials: 'include',
-    });
-    if (!response.ok) {
-        this.clearActiveLogin();
-        throw new Error('Failed to fetch tokens');
-    }
-    const tokens = await response.json();
-    await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_verifyTokens).call(this, tokens);
-    return this.getProfile();
-}, _MedplumClient_verifyTokens = 
-/**
- * Verifies the tokens received from the auth server.
- * Validates the JWT against the JWKS.
- * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
- * @param tokens
- */
-async function _MedplumClient_verifyTokens(tokens) {
-    const token = tokens.access_token;
-    // Verify token has not expired
-    const tokenPayload = parseJWTPayload(token);
-    if (Date.now() >= tokenPayload.exp * 1000) {
-        this.clearActiveLogin();
-        throw new Error('Token expired');
-    }
-    // Verify app_client_id
-    if (__classPrivateFieldGet(this, _MedplumClient_clientId, "f") && tokenPayload.client_id !== __classPrivateFieldGet(this, _MedplumClient_clientId, "f")) {
-        this.clearActiveLogin();
-        throw new Error('Token was not issued for this audience');
-    }
-    return this.setActiveLogin({
-        accessToken: token,
-        refreshToken: tokens.refresh_token,
-        project: tokens.project,
-        profile: tokens.profile,
-    });
-}, _MedplumClient_setupStorageListener = function _MedplumClient_setupStorageListener() {
-    try {
-        window.addEventListener('storage', (e) => {
-            if (e.key === null || e.key === 'activeLogin') {
-                // Storage events fire when different tabs make changes.
-                // On storage clear (key === null) or activeLogin change (key === 'activeLogin')
-                // Refresh the page to ensure the active login is up to date.
-                window.location.reload();
-            }
-        });
-    }
-    catch (err) {
-        // Silently ignore if this environment does not support storage events
-    }
-};
+}
 /**
  * Returns the default fetch method.
  * The default fetch is currently only available in browser environments.
@@ -1853,5 +1940,5 @@ function ensureTrailingSlash(url) {
     return url.endsWith('/') ? url : url + '/';
 }
 
-export { MEDPLUM_VERSION, MedplumClient };
+export { MEDPLUM_VERSION, MedplumClient, OAuthGrantType, OAuthTokenType };
 //# sourceMappingURL=client.mjs.map