@oneidentity/safeguard 8.0.0 → 8.0.1-pre38225

package/README.md

@@ -76,7 +76,7 @@ const client = new SafeguardClient('safeguard.sample.corp', {
 
 await client.connect();
 
-const me = await client.get(Service.CORE, 'v4/Me');
+const me = await client.get(Service.CORE, 'Me');
 console.log(me);
 
 await client.disconnect();
@@ -97,7 +97,7 @@ const client = new SafeguardClient('safeguard.sample.corp', {
 
 await client.connect(); // Redirects to Safeguard login if no stored tokens
 
-const me = await client.get(Service.CORE, 'v4/Me');
+const me = await client.get(Service.CORE, 'Me');
 console.log(me);
 ```
 
@@ -117,7 +117,7 @@ const client = new SafeguardClient('safeguard.sample.corp', {
 });
 
 await client.connect();
-const me = await client.get(Service.CORE, 'v4/Me');
+const me = await client.get(Service.CORE, 'Me');
 await client.disconnect();
 ```
 
@@ -135,7 +135,7 @@ const client = new SafeguardClient('safeguard.sample.corp', {
 });
 
 await client.connect();
-const me = await client.get(Service.CORE, 'v4/Me');
+const me = await client.get(Service.CORE, 'Me');
 await client.disconnect();
 ```
 
@@ -149,7 +149,7 @@ const client = new SafeguardClient('safeguard.sample.corp', {
 });
 
 await client.connect();
-const status = await client.get(Service.NOTIFICATION, 'v4/Status');
+const status = await client.get(Service.NOTIFICATION, 'Status');
 console.log(status);
 ```
 
@@ -163,34 +163,34 @@ const client = new SafeguardClient('safeguard.sample.corp', {
 });
 
 await client.connect();
-const me = await client.get(Service.CORE, 'v4/Me');
+const me = await client.get(Service.CORE, 'Me');
 ```
 
 ## Calling the API
 
-The client provides typed HTTP methods:
+The client provides typed HTTP methods. Pass relative paths only — the SDK prepends the configured API version automatically (`v4` by default):
 
 ```typescript
 // GET
-const users = await client.get(Service.CORE, 'v4/Users');
+const users = await client.get(Service.CORE, 'Users');
 
 // GET with query parameters
-const filtered = await client.get(Service.CORE, 'v4/Users', {
+const filtered = await client.get(Service.CORE, 'Users', {
   query: { filter: "Name eq 'Admin'", fields: 'Id,Name' },
 });
 
 // POST (create)
-const newUser = await client.post(Service.CORE, 'v4/Users', {
+const newUser = await client.post(Service.CORE, 'Users', {
   json: { Name: 'newuser', PrimaryAuthenticationProvider: { Id: -1 } },
 });
 
 // PUT (update)
-await client.put(Service.CORE, `v4/Users/${newUser.Id}/Password`, {
+await client.put(Service.CORE, `Users/${newUser.Id}/Password`, {
   json: 'NewPassword123',
 });
 
 // DELETE
-await client.delete(Service.CORE, `v4/Users/${newUser.Id}`);
+await client.delete(Service.CORE, `Users/${newUser.Id}`);
 ```
 
 ### Services

package/dist/{browser-C_ziogDF.d.ts → browser-Df-ljVNJ.d.ts}

@@ -219,17 +219,17 @@ declare class ConfigurationError extends SafeguardError {
  *
  * @example
  * buildServiceUrl('appliance.example.com', Service.CORE)
- * // => 'https://appliance.example.com/service/core'
+ * // => 'https://appliance.example.com/service/core/v4'
  */
-declare function buildServiceUrl(host: string, service: Service): string;
+declare function buildServiceUrl(host: string, service: Service, apiVersion?: string): string;
 /**
  * Builds a full API URL including path and optional query parameters.
  *
  * @example
- * buildRequestUrl('appliance.example.com', Service.CORE, 'v4/Users', { filter: 'Name eq "admin"' })
+ * buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq "admin"' })
  * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'
  */
-declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>): string;
+declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>, apiVersion?: string): string;
 /**
  * Encodes bytes to a URL-safe base64 string (no padding).
  */
@@ -444,4 +444,4 @@ declare class SafeguardClient {
 
 //#endregion
 export { AnonymousAuth, ApiError, type ApiErrorBody, type Auth, AuthenticationError, AuthorizationError, BrowserHttpClient, BrowserSessionStorage, ConfigurationError, type HttpClient, HttpMethod, type HttpRequestOptions, type HttpResponse, MemoryStorage, NotFoundError, PasswordAuth, type PasswordAuthOptions, PkceAuth, type PkceAuthOptions, type PkceCallbackResult, type RequestOptions, SafeguardClient, type SafeguardClientOptions, SafeguardError, type SafeguardResponse, SecretValue, Service, StorageKeys, type StorageProvider, TokenAuth, type TokenAuthOptions, type TokenSet, TransportError, base64UrlEncode, buildRequestUrl, buildServiceUrl, generateCodeChallenge, generateCodeVerifier, generateState, handlePkceCallback };
-//# sourceMappingURL=browser-C_ziogDF.d.ts.map
+//# sourceMappingURL=browser-Df-ljVNJ.d.ts.map

package/dist/{browser-C_ziogDF.d.ts.map → browser-Df-ljVNJ.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"browser-C_ziogDF.d.ts","names":[],"sources":["../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/types.ts","../src/errors.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/pkce.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts"],"mappings":";;AAIA;;AAGY,UAHK,kBAAA,CAGL;KACM,EAAA,MAAA;QACP,EAAA,MAAA;EAAW,OAAA,CAAA,EAFV,MAEU,CAAA,MAAA,EAAA,MAAA,CAAA;EAIL,IAAA,CAAA,EAAA,MAAA,GALC,MAKW,GAAA,IAElB;EAqBM,MAAA,CAAA,EA3BN,WA2BgB;EAAA,OAAA,CAAA,EAAA,MAAA;;AACqB,UAxB/B,YAAA,CAwB+B;QAAR,EAAA,MAAA;EAAO,OAAA,EAtBpC,MAsBoC,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;;;AGXiC,UHU/D,UAAA,CGV+D;SAKtC,CAAA,OAAA,EHMvB,kBGNuB,CAAA,EHMF,OGNE,CHMM,YGNN,CAAA;SAAqB,GAAA,EAAA,IAAA;;;;;;AH3B/D;;AAGY,UCJK,eAAA,CDIL;KACM,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;KACP,CAAA,GAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAW,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAIL,KAAA,EAAA,EAAA,IAAA;AAuBjB;;AACmB,cC1BN,WD0BM,EAAA;WAA6B,KAAA,EAAA,iBAAA;WAAR,aAAA,EAAA,yBAAA;AAAO,CAAA;;;;;AAjC/C;;;;;AAKsB;AAItB;AAuBiB,cE1BJ,WAAA,CF0Bc;EAAA,CAAA,OAAA;aACR,CAAA,KAAA,EAAA,MAAA;;QAAqB,CAAA,CAAA,EAAA,MAAA;EAAO,QAAA,CAAA,CAAA,EAAA,MAAA;;OEFxC,MAAA,CAAO,WAAW;;ADhCzB;;;;;;ADMsB,UGFL,QAAA,CHEK;EAIL;EAuBA,WAAA,EG3BF,WH2BY;EAAA;WACR,CAAA,EAAA,MAAA;;YAAqB,EAAA,MAAA;AAAO;;;;AClC9B,UEgBA,IAAA,CFhBe;EAQnB;;;;ACDb;;yCCgByC,qBAAqB,kBAAkB,QAAQ;;AAnBxF;AAYA;EAAqB,YAAA,EAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EAYqB,UAZrB,EAAA,OAAA,EAY0C,eAZ1C,CAAA,EAY4D,OAZ5D,CAYoE,QAZpE,GAAA,IAAA,CAAA;;WAOyC,WAAA,EAAA,MAAA;;;;;;AHtB9D;;AAGY,aIJA,OAAA;MJKM,GAAA,MAAA;WACP,GAAA,WAAA;EAAW,YAAA,GAAA,cAAA;EAIL,GAAA,GAAA,KAAA;EAuBA,KAAA,GAAA,OAAU;EAAA,IAAA,GAAA,MAAA;;;;AACoB;aItBnC,UAAA;;;EHZK,GAAA,GAAA,KAAA;EAQJ,MAAA,GAAA,QAGH;;;;ACJV;;UEgBiB;QACT;EDpBS,MAAA,EAAA,MAAQ;EAYR,OAAI,ECUV,MDVU,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;AAO2D,UCS/D,cAAA,CDT+D;;MAKjB,CAAA,EAAA,OAAA;;MAAkB,CAAA,ECQxE,QDRwE,GAAA,IAAA;EAAO;YCU5E;;UAEF;EAxCE;EAYA,MAAA,CAAA,EA8BD,WA9BW;EAWL;EAAiB,OAAA,CAAA,EAAA,MAAA;;cAGvB,CAAA,EAAA,OAAA;AAAM;AAMjB;;;AAMY,UAcK,sBAAA,CAdL;;MAID,EAU4B,IAV5B;EAAW;EAUL,EAAA,CAAA,EAAA,MAAA,GAID,MAJC;EAAsB;QAAA,CAAA,EAAA,OAAA;;EAIjB,UAAA,CAAA,EAAA,MAAA;;;;EC/CT,WAAA,CAAA,EAAA,OAAe;;;;;;ALR5B;;;;;AAKsB;AAItB;AAuBA;;;AACgD,cKzBnC,cAAA,SAAuB,KAAA,CLyBY;aAAR,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EKxBC,YLwBD;AAAO;UKlB9B,YAAA;;;EJhBA,UAAA,CAAA,EAAA;IAQJ,OAAA,CAAA,EAGH,MAAA;;;;ACJG,cGgBA,QAAA,SAAiB,cAAA,CHSL;;iBGPR;sDAEoC,+BAAsC;EFvB1E;AAYjB;;SAOyC,YAAA,CAAA,MAAA,EAAA,MAAA,EAAA,IAAA,EAAA,MAAA,GEcY,YFdZ,GAAA,IAAA,CAAA,EEckC,QFdlC;iBAAqB,SAAA;iBAA0B,YAAA;;AAK9C,cE4C7B,mBAAA,SAA4B,QAAA,CF5CC;aAAqB,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EE6C1B,YF7C0B,GAAA,IAAA,EAAA,OAAA,CAAA,EE6CY,YF7CZ;;AAAkB,cEmDpE,kBAAA,SAA2B,QAAA,CFnDyC;EAAO,WAAA,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EEoDnD,YFpDmD,GAAA,IAAA,EAAA,OAAA,CAAA,EEoDb,YFpDa;;cE0D3E,aAAA,SAAsB,QAAA;sCACE,+BAAsC;ADvF3E;AAYY,cCiFC,cAAA,SAAuB,cAAA,CDjFd;EAWL,WAAA,CAAA,OAAA,EAAiB,MAAA,EAAA,OAAA,CAAA,ECuEO,YDvEP;;AAC1B,cC4EK,kBAAA,SAA2B,cAAA,CD5EhC;aAEG,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EC2E8B,YD3E9B;AAAM;AAMjB;;;AJCA;;;;;AAC+C;;iBMW/B,eAAA,wBAAuC;;AL7CvD;AAQA;;;;ACDA;iBIoDgB,eAAA,wBAEL,sCAED;;;AH3DV;AAYiB,iBGiED,eAAA,CHjEK,KAAA,EGiEkB,UHjElB,CAAA,EAAA,MAAA;;;;;AAO2D,iBGmEhE,oBAAA,CAAA,CHnEgE,EAAA,MAAA;;;;;AAKQ,iBGwElE,qBAAA,CHxEkE,QAAA,EAAA,MAAA,CAAA,EGwEzB,OHxEyB,CAAA,MAAA,CAAA;;;;AC5B5E,iBE8GI,aAAA,CAAA,CF9GG,EAAA,MAAA;AAYnB;AAWA;;;;;AJtBA;;;;AAKW,cOHE,aAAA,YAAyB,ePG3B,CAAA;EAAW,CAAA,OAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,CAAA,EAAA,MAAA,GAElB,IAAA;EAqBM,GAAA,CAAA,GAAA,EAAA,MAAU,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAA,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OACR,CAAA,CAAA,EAAA,IAAA;;;;;AAjCnB;;;;AAKW,cQHE,qBAAA,YAAiC,eRGnC,CAAA;EAAW,GAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,EAAA,KAAA,EAAA,MAElB,CAAA,EAAM,IAAA;EAqBA,MAAA,CAAA,GAAA,EAAA,MAAU,CAAA,EAAA,IAAA;EAAA,KAAA,CAAA,CAAA,EAAA,IAAA;;;;;AAhC3B;;;;AAKW,cSHE,iBAAA,YAA6B,UTG/B,CAAA;EAAW,CAAA,OAAA;EAIL,WAAA,CAAA,OAuBU,CAvBE,EAAA;IAuBZ,WAAU,CAAA,ES3Ba,kBT2Bb;EAAA,CAAA;SACR,CAAA,OAAA,ESxBM,kBTwBN,CAAA,ESxB2B,OTwB3B,CSxBmC,YTwBnC,CAAA;;;;;AA9BP,UUAK,mBAAA,CVAL;UACM,EAAA,MAAA;UACP,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAuB7B;;;;AACwC,cUpB3B,YAAA,YAAwB,IVoBG,CAAA;EAAO,CAAA,OAAA;uBUfxB;;yCAawB,sBAAsB,kBAAkB,QAAQ;EThC9E,YAAA,CAAA,IAAA,EAAe,MAAA,EAAA,UAAA,ES0Ce,UT1Cf,EAAA,OAAA,ES0CoC,eT1CpC,CAAA,ES0CsD,OT1CtD,CS0C8D,QT1C9D,GAAA,IAAA,CAAA;AAQhC;;;;ADJY,UWCK,eAAA,CXDL;;aAED,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAuB7B;;;;;AAC+C,cWlBlC,QAAA,YAAoB,IXkBc,CAAA;;uBWdxB;;EVpBN;AAQjB;;;yCU2B+C,qBAAqB,kBAAkB,QAAQ;AT5B9F;;;;AFNiB,UYAA,kBAAA,CZAkB;EAAA,IAAA,EAAA,MAAA;OAGvB,EAAA,MAAA;;;AAEU;AAItB;AAuBA;;;;;AAC+C;;;iBYjB/B,kBAAA,UACL,gCAER;AXpBH;;;ADIY,UaDK,gBAAA,CbCL;;aAED,EAAA,MAAA;AAAW;AAItB;AAuBA;;;AACgD,catBnC,SAAA,YAAqB,IbsBc,CAAA;UAAR;EAAO,WAAA,CAAA,OAAA,EanBxB,gBbmBwB;;2CaVE,sBAAsB,kBAAkB,QAAQ;;AZxBjG;;;;;;ADMsB;AAIL,ccJJ,aAAA,YAAyB,IdMrB,CAAA;EAqBA,IAAA,WAAU,CAAA,CAAA,EAAA,MAAA;EAAA,YAAA,CAAA,KAAA,EAAA,MAAA,EAAA,WAAA,EctBsB,UdsBtB,EAAA,QAAA,EctB4C,edsB5C,CAAA,EctB8D,OdsB9D,CctBsE,QdsBtE,CAAA;;;;;;;AA3BL;AAItB;AAuBiB,cenBJ,eAAA,CfmBc;EAAA,CAAA,OAAA;aACR,CAAA,IAAA,EAAA,MAAA,EAAA,OAAA,EeNkB,sBfMlB;;MAAqB,IAAA,CAAA,CAAA,EAAA,MAAA;EAAO;;;qBekB1B;EdpDJ;EAQJ,IAAA,MAAA,CAAA,CAAA,EAGH,OAAA;;;;ACJV;;;sBa+DsB;EZlEL;AAYjB;;;;;eAOgF,CAAA,UAAA,EY0DpD,UZ1DoD,CAAA,EAAA,IAAA;;;;;AAKQ;aY+DrE;;;AX3FnB;EAYY,UAAA,CAAA,CAAA,EWgGU,OXhGA,CAAA,IAAA,CAAA;EAWL;;;iCAGN,CAAA,CAAA,EAAA,MAAA;EAAM,GAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWmGiB,OXnGjB,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWmGyD,cXnGzD,CAAA,EWmG0E,OXnG1E,CWmGkF,CXnGlF,CAAA;EAMA,IAAA,CAAA,IAAA,OAAA,CAAc,CAAA,OAAA,EWiGI,OXjGJ,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWiG4C,cXjG5C,CAAA,EWiG6D,OXjG7D,CWiGqE,CXjGrE,CAAA;EAAA,GAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWqGG,OXrGH,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWqG2C,cXrG3C,CAAA,EWqG4D,OXrG5D,CWqGoE,CXrGpE,CAAA;QAItB,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWqG4B,OXrG5B,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWqGoE,cXrGpE,CAAA,EWqGqF,OXrGrF,CWqG6F,CXrG7F,CAAA;OAEG,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWuGwB,OXvGxB,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWuGgE,cXvGhE,CAAA,EWuGiF,OXvGjF,CWuGyF,CXvGzF,CAAA;;;AAIU;AAUtB;;;QAIgB,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWkGH,OXlGG,EAAA,MAAA,EWmGJ,UXnGI,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWqGF,cXrGE,CAAA,EWsGX,OXtGW,CWsGH,CXtGG,CAAA;AAAM"}
+{"version":3,"file":"browser-Df-ljVNJ.d.ts","names":[],"sources":["../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/types.ts","../src/errors.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/pkce.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts"],"mappings":";;AAIA;;AAGY,UAHK,kBAAA,CAGL;KACM,EAAA,MAAA;QACP,EAAA,MAAA;EAAW,OAAA,CAAA,EAFV,MAEU,CAAA,MAAA,EAAA,MAAA,CAAA;EAIL,IAAA,CAAA,EAAA,MAAA,GALC,MAKW,GAAA,IAElB;EAqBM,MAAA,CAAA,EA3BN,WA2BgB;EAAA,OAAA,CAAA,EAAA,MAAA;;AACqB,UAxB/B,YAAA,CAwB+B;QAAR,EAAA,MAAA;EAAO,OAAA,EAtBpC,MAsBoC,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;;;AGXiC,UHU/D,UAAA,CGV+D;SAKtC,CAAA,OAAA,EHMvB,kBGNuB,CAAA,EHMF,OGNE,CHMM,YGNN,CAAA;SAAqB,GAAA,EAAA,IAAA;;;;;;AH3B/D;;AAGY,UCJK,eAAA,CDIL;KACM,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;KACP,CAAA,GAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAW,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAIL,KAAA,EAAA,EAAA,IAAA;AAuBjB;;AACmB,cC1BN,WD0BM,EAAA;WAA6B,KAAA,EAAA,iBAAA;WAAR,aAAA,EAAA,yBAAA;AAAO,CAAA;;;;;AAjC/C;;;;;AAKsB;AAItB;AAuBiB,cE1BJ,WAAA,CF0Bc;EAAA,CAAA,OAAA;aACR,CAAA,KAAA,EAAA,MAAA;;QAAqB,CAAA,CAAA,EAAA,MAAA;EAAO,QAAA,CAAA,CAAA,EAAA,MAAA;;OEFxC,MAAA,CAAO,WAAW;;ADhCzB;;;;;;ADMsB,UGFL,QAAA,CHEK;EAIL;EAuBA,WAAA,EG3BF,WH2BY;EAAA;WACR,CAAA,EAAA,MAAA;;YAAqB,EAAA,MAAA;AAAO;;;;AClC9B,UEgBA,IAAA,CFhBe;EAQnB;;;;ACDb;;yCCgByC,qBAAqB,kBAAkB,QAAQ;;AAnBxF;AAYA;EAAqB,YAAA,EAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EAYqB,UAZrB,EAAA,OAAA,EAY0C,eAZ1C,CAAA,EAY4D,OAZ5D,CAYoE,QAZpE,GAAA,IAAA,CAAA;;WAOyC,WAAA,EAAA,MAAA;;;;;;AHtB9D;;AAGY,aIJA,OAAA;MJKM,GAAA,MAAA;WACP,GAAA,WAAA;EAAW,YAAA,GAAA,cAAA;EAIL,GAAA,GAAA,KAAA;EAuBA,KAAA,GAAA,OAAU;EAAA,IAAA,GAAA,MAAA;;;;AACoB;aItBnC,UAAA;;;EHZK,GAAA,GAAA,KAAA;EAQJ,MAAA,GAAA,QAGH;;;;ACJV;;UEgBiB;QACT;EDpBS,MAAA,EAAA,MAAQ;EAYR,OAAI,ECUV,MDVU,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;AAO2D,UCS/D,cAAA,CDT+D;;MAKjB,CAAA,EAAA,OAAA;;MAAkB,CAAA,ECQxE,QDRwE,GAAA,IAAA;EAAO;YCU5E;;UAEF;EAxCE;EAYA,MAAA,CAAA,EA8BD,WA9BW;EAWL;EAAiB,OAAA,CAAA,EAAA,MAAA;;cAGvB,CAAA,EAAA,OAAA;AAAM;AAMjB;;;AAMY,UAcK,sBAAA,CAdL;;MAID,EAU4B,IAV5B;EAAW;EAUL,EAAA,CAAA,EAAA,MAAA,GAID,MAJC;EAAsB;QAAA,CAAA,EAAA,OAAA;;EAIjB,UAAA,CAAA,EAAA,MAAA;;;;EC/CT,WAAA,CAAA,EAAA,OAAe;;;;;;ALR5B;;;;;AAKsB;AAItB;AAuBA;;;AACgD,cKzBnC,cAAA,SAAuB,KAAA,CLyBY;aAAR,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EKxBC,YLwBD;AAAO;UKlB9B,YAAA;;;EJhBA,UAAA,CAAA,EAAA;IAQJ,OAAA,CAAA,EAGH,MAAA;;;;ACJG,cGgBA,QAAA,SAAiB,cAAA,CHSL;;iBGPR;sDAEoC,+BAAsC;EFvB1E;AAYjB;;SAOyC,YAAA,CAAA,MAAA,EAAA,MAAA,EAAA,IAAA,EAAA,MAAA,GEcY,YFdZ,GAAA,IAAA,CAAA,EEckC,QFdlC;iBAAqB,SAAA;iBAA0B,YAAA;;AAK9C,cE4C7B,mBAAA,SAA4B,QAAA,CF5CC;aAAqB,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EE6C1B,YF7C0B,GAAA,IAAA,EAAA,OAAA,CAAA,EE6CY,YF7CZ;;AAAkB,cEmDpE,kBAAA,SAA2B,QAAA,CFnDyC;EAAO,WAAA,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EEoDnD,YFpDmD,GAAA,IAAA,EAAA,OAAA,CAAA,EEoDb,YFpDa;;cE0D3E,aAAA,SAAsB,QAAA;sCACE,+BAAsC;ADvF3E;AAYY,cCiFC,cAAA,SAAuB,cAAA,CDjFd;EAWL,WAAA,CAAA,OAAA,EAAiB,MAAA,EAAA,OAAA,CAAA,ECuEO,YDvEP;;AAC1B,cC4EK,kBAAA,SAA2B,cAAA,CD5EhC;aAEG,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EC2E8B,YD3E9B;AAAM;AAMjB;;;AJCA;;;;;AAC+C;;iBMW/B,eAAA,wBAAuC;;AL7CvD;AAQA;;;;ACDA;iBIoDgB,eAAA,wBAEL,sCAED;;;AH3DV;AAYiB,iBGkED,eAAA,CHlEK,KAAA,EGkEkB,UHlElB,CAAA,EAAA,MAAA;;;;;AAO2D,iBGoEhE,oBAAA,CAAA,CHpEgE,EAAA,MAAA;;;;;AAKQ,iBGyElE,qBAAA,CHzEkE,QAAA,EAAA,MAAA,CAAA,EGyEzB,OHzEyB,CAAA,MAAA,CAAA;;;;AC5B5E,iBE+GI,aAAA,CAAA,CF/GG,EAAA,MAAA;AAYnB;AAWA;;;;;AJtBA;;;;AAKW,cOHE,aAAA,YAAyB,ePG3B,CAAA;EAAW,CAAA,OAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,CAAA,EAAA,MAAA,GAElB,IAAA;EAqBM,GAAA,CAAA,GAAA,EAAA,MAAU,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAA,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OACR,CAAA,CAAA,EAAA,IAAA;;;;;AAjCnB;;;;AAKW,cQHE,qBAAA,YAAiC,eRGnC,CAAA;EAAW,GAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,EAAA,KAAA,EAAA,MAElB,CAAA,EAAM,IAAA;EAqBA,MAAA,CAAA,GAAA,EAAA,MAAU,CAAA,EAAA,IAAA;EAAA,KAAA,CAAA,CAAA,EAAA,IAAA;;;;;AAhC3B;;;;AAKW,cSHE,iBAAA,YAA6B,UTG/B,CAAA;EAAW,CAAA,OAAA;EAIL,WAAA,CAAA,OAuBU,CAvBE,EAAA;IAuBZ,WAAU,CAAA,ES3Ba,kBT2Bb;EAAA,CAAA;SACR,CAAA,OAAA,ESxBM,kBTwBN,CAAA,ESxB2B,OTwB3B,CSxBmC,YTwBnC,CAAA;;;;;AA9BP,UUAK,mBAAA,CVAL;UACM,EAAA,MAAA;UACP,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAuB7B;;;;AACwC,cUpB3B,YAAA,YAAwB,IVoBG,CAAA;EAAO,CAAA,OAAA;uBUfxB;;yCAawB,sBAAsB,kBAAkB,QAAQ;EThC9E,YAAA,CAAA,IAAA,EAAe,MAAA,EAAA,UAAA,ES0Ce,UT1Cf,EAAA,OAAA,ES0CoC,eT1CpC,CAAA,ES0CsD,OT1CtD,CS0C8D,QT1C9D,GAAA,IAAA,CAAA;AAQhC;;;;ADJY,UWCK,eAAA,CXDL;;aAED,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAuB7B;;;;;AAC+C,cWlBlC,QAAA,YAAoB,IXkBc,CAAA;;uBWdxB;;EVpBN;AAQjB;;;yCU2B+C,qBAAqB,kBAAkB,QAAQ;AT5B9F;;;;AFNiB,UYAA,kBAAA,CZAkB;EAAA,IAAA,EAAA,MAAA;OAGvB,EAAA,MAAA;;;AAEU;AAItB;AAuBA;;;;;AAC+C;;;iBYjB/B,kBAAA,UACL,gCAER;AXpBH;;;ADIY,UaDK,gBAAA,CbCL;;aAED,EAAA,MAAA;AAAW;AAItB;AAuBA;;;AACgD,catBnC,SAAA,YAAqB,IbsBc,CAAA;UAAR;EAAO,WAAA,CAAA,OAAA,EanBxB,gBbmBwB;;2CaVE,sBAAsB,kBAAkB,QAAQ;;AZxBjG;;;;;;ADMsB;AAIL,ccJJ,aAAA,YAAyB,IdMrB,CAAA;EAqBA,IAAA,WAAU,CAAA,CAAA,EAAA,MAAA;EAAA,YAAA,CAAA,KAAA,EAAA,MAAA,EAAA,WAAA,EctBsB,UdsBtB,EAAA,QAAA,EctB4C,edsB5C,CAAA,EctB8D,OdsB9D,CctBsE,QdsBtE,CAAA;;;;;;;AA3BL;AAItB;AAuBiB,cenBJ,eAAA,CfmBc;EAAA,CAAA,OAAA;aACR,CAAA,IAAA,EAAA,MAAA,EAAA,OAAA,EeNkB,sBfMlB;;MAAqB,IAAA,CAAA,CAAA,EAAA,MAAA;EAAO;;;qBekB1B;EdpDJ;EAQJ,IAAA,MAAA,CAAA,CAAA,EAGH,OAAA;;;;ACJV;;;sBa+DsB;EZlEL;AAYjB;;;;;eAOgF,CAAA,UAAA,EY0DpD,UZ1DoD,CAAA,EAAA,IAAA;;;;;AAKQ;aY+DrE;;;AX3FnB;EAYY,UAAA,CAAA,CAAA,EWgGU,OXhGA,CAAA,IAAA,CAAA;EAWL;;;iCAGN,CAAA,CAAA,EAAA,MAAA;EAAM,GAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWmGiB,OXnGjB,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWmGyD,cXnGzD,CAAA,EWmG0E,OXnG1E,CWmGkF,CXnGlF,CAAA;EAMA,IAAA,CAAA,IAAA,OAAA,CAAc,CAAA,OAAA,EWiGI,OXjGJ,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWiG4C,cXjG5C,CAAA,EWiG6D,OXjG7D,CWiGqE,CXjGrE,CAAA;EAAA,GAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWqGG,OXrGH,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWqG2C,cXrG3C,CAAA,EWqG4D,OXrG5D,CWqGoE,CXrGpE,CAAA;QAItB,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWqG4B,OXrG5B,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWqGoE,cXrGpE,CAAA,EWqGqF,OXrGrF,CWqG6F,CXrG7F,CAAA;OAEG,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWuGwB,OXvGxB,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWuGgE,cXvGhE,CAAA,EWuGiF,OXvGjF,CWuGyF,CXvGzF,CAAA;;;AAIU;AAUtB;;;QAIgB,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWkGH,OXlGG,EAAA,MAAA,EWmGJ,UXnGI,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWqGF,cXrGE,CAAA,EWsGX,OXtGW,CWsGH,CXtGG,CAAA;AAAM"}

package/dist/browser.d.ts

@@ -219,17 +219,17 @@ declare class ConfigurationError extends SafeguardError {
  *
  * @example
  * buildServiceUrl('appliance.example.com', Service.CORE)
- * // => 'https://appliance.example.com/service/core'
+ * // => 'https://appliance.example.com/service/core/v4'
  */
-declare function buildServiceUrl(host: string, service: Service): string;
+declare function buildServiceUrl(host: string, service: Service, apiVersion?: string): string;
 /**
  * Builds a full API URL including path and optional query parameters.
  *
  * @example
- * buildRequestUrl('appliance.example.com', Service.CORE, 'v4/Users', { filter: 'Name eq "admin"' })
+ * buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq "admin"' })
  * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'
  */
-declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>): string;
+declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>, apiVersion?: string): string;
 /**
  * Encodes bytes to a URL-safe base64 string (no padding).
  */
@@ -444,4 +444,4 @@ declare class SafeguardClient {
 
 //#endregion
 export { AnonymousAuth, ApiError, type ApiErrorBody, type Auth, AuthenticationError, AuthorizationError, BrowserHttpClient, BrowserSessionStorage, ConfigurationError, type HttpClient, HttpMethod, type HttpRequestOptions, type HttpResponse, MemoryStorage, NotFoundError, PasswordAuth, type PasswordAuthOptions, PkceAuth, type PkceAuthOptions, type PkceCallbackResult, type RequestOptions, SafeguardClient, type SafeguardClientOptions, SafeguardError, type SafeguardResponse, SecretValue, Service, StorageKeys, type StorageProvider, TokenAuth, type TokenAuthOptions, type TokenSet, TransportError, base64UrlEncode, buildRequestUrl, buildServiceUrl, generateCodeChallenge, generateCodeVerifier, generateState, handlePkceCallback };
-//# sourceMappingURL=browser-C_ziogDF.d.ts.map
+//# sourceMappingURL=browser-Df-ljVNJ.d.ts.map

package/dist/browser.js

@@ -184,21 +184,21 @@ function validateHost(host) {
 *
 * @example
 * buildServiceUrl('appliance.example.com', Service.CORE)
-* // => 'https://appliance.example.com/service/core'
+* // => 'https://appliance.example.com/service/core/v4'
 */
-function buildServiceUrl(host, service) {
+function buildServiceUrl(host, service, apiVersion = "v4") {
 	if (service === "RSTS") return `https://${host}/RSTS`;
-	return `https://${host}/service/${service}`;
+	return `https://${host}/service/${service}/${apiVersion}`;
 }
 /**
 * Builds a full API URL including path and optional query parameters.
 *
 * @example
-* buildRequestUrl('appliance.example.com', Service.CORE, 'v4/Users', { filter: 'Name eq "admin"' })
+* buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq "admin"' })
 * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'
 */
-function buildRequestUrl(host, service, relativeUrl, query) {
-	const base = buildServiceUrl(host, service);
+function buildRequestUrl(host, service, relativeUrl, query, apiVersion = "v4") {
+	const base = buildServiceUrl(host, service, apiVersion);
 	const path = relativeUrl.startsWith("/") ? relativeUrl.slice(1) : relativeUrl;
 	const url = new URL(`${base}/${path}`);
 	if (query) for (const [key, value] of Object.entries(query)) url.searchParams.set(key, String(value));
@@ -704,7 +704,7 @@ var SafeguardClient = class {
 	async invoke(service, method, relativeUrl, options) {
 		if (!this.#connected || !this.#httpClient) throw new ConfigurationError("Client not connected. Call connect() first.");
 		if (this.#autoRefresh) await this.#ensureValidToken();
-		const url = buildRequestUrl(this.#host, service, relativeUrl, options?.query);
+		const url = buildRequestUrl(this.#host, service, relativeUrl, options?.query, this.#apiVersion);
 		const headers = {
 			Authorization: `Bearer ${this.#tokenSet.accessToken.expose()}`,
 			Accept: "application/json",

package/dist/browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser.js","names":["#value","#store","#credentials","#doFetch","#username","#password","#provider","#getRstsToken","#exchangeForUserToken","#redirectUri","#provider","#exchangeCode","#initiateRedirect","#accessToken","#host","#auth","#apiVersion","#timeout","#autoRefresh","#ca","#verify","#storage","#connected","#httpClient","#tokenSet","#ensureValidToken"],"sources":["../src/types.ts","../src/errors.ts","../src/secret.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/storage/types.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/pkce.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts"],"sourcesContent":["/**\n * Safeguard appliance service endpoints.\n */\nexport enum Service {\n  CORE = 'core',\n  APPLIANCE = 'appliance',\n  NOTIFICATION = 'notification',\n  A2A = 'a2a',\n  EVENT = 'event',\n  RSTS = 'RSTS',\n}\n\n/**\n * HTTP methods supported by the Safeguard API.\n */\nexport enum HttpMethod {\n  GET = 'GET',\n  POST = 'POST',\n  PUT = 'PUT',\n  DELETE = 'DELETE',\n  PATCH = 'PATCH',\n}\n\n/**\n * Full response from a Safeguard API call (returned when fullResponse: true).\n */\nexport interface SafeguardResponse<T = unknown> {\n  data: T;\n  status: number;\n  headers: Record<string, string>;\n}\n\n/**\n * Options for individual API requests.\n */\nexport interface RequestOptions {\n  /** Request body as JSON-serializable object. */\n  json?: unknown;\n  /** Raw request body. */\n  body?: BodyInit | null;\n  /** Additional HTTP headers. */\n  headers?: Record<string, string>;\n  /** URL query parameters. */\n  query?: Record<string, string | number | boolean>;\n  /** AbortSignal for request cancellation. */\n  signal?: AbortSignal;\n  /** Request timeout in milliseconds (overrides client default). */\n  timeout?: number;\n  /** If true, returns full response with status and headers. */\n  fullResponse?: boolean;\n}\n\n/**\n * Options for constructing a SafeguardClient.\n */\nexport interface SafeguardClientOptions {\n  /** Authentication strategy. */\n  auth: import('./auth/types.js').Auth;\n  /** Custom CA certificate (PEM string or Buffer). Node.js only. */\n  ca?: string | Buffer;\n  /** Whether to verify TLS certificates. Default: true. */\n  verify?: boolean;\n  /** Safeguard API version prefix. Default: 'v4'. */\n  apiVersion?: string;\n  /** Request timeout in milliseconds. Default: 300_000 (5 min). */\n  timeout?: number;\n  /** Auto-refresh tokens before expiry. Default: true. */\n  autoRefresh?: boolean;\n}\n","/**\n * Error hierarchy for the Safeguard SDK.\n *\n * SafeguardError\n * ├── ApiError              (HTTP errors from Safeguard API)\n * │   ├── AuthenticationError  (401)\n * │   ├── AuthorizationError   (403)\n * │   └── NotFoundError        (404)\n * ├── TransportError        (Network/connection failures)\n * └── ConfigurationError    (Invalid client options)\n */\n\nexport class SafeguardError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'SafeguardError';\n  }\n}\n\nexport interface ApiErrorBody {\n  Code?: string;\n  Message?: string;\n  InnerError?: { Message?: string };\n  [key: string]: unknown;\n}\n\nexport class ApiError extends SafeguardError {\n  readonly status: number;\n  readonly body: ApiErrorBody | null;\n\n  constructor(message: string, status: number, body: ApiErrorBody | null = null, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'ApiError';\n    this.status = status;\n    this.body = body;\n  }\n\n  /**\n   * Creates an appropriate ApiError subclass based on HTTP status code.\n   */\n  static fromResponse(status: number, body: string | ApiErrorBody | null): ApiError {\n    const parsed = ApiError.parseBody(body);\n    const message = ApiError.buildMessage(status, parsed);\n\n    switch (status) {\n      case 401:\n        return new AuthenticationError(message, parsed);\n      case 403:\n        return new AuthorizationError(message, parsed);\n      case 404:\n        return new NotFoundError(message, parsed);\n      default:\n        return new ApiError(message, status, parsed);\n    }\n  }\n\n  private static parseBody(body: string | ApiErrorBody | null): ApiErrorBody | null {\n    if (body === null || body === undefined) return null;\n    if (typeof body === 'object') return body;\n    try {\n      return JSON.parse(body) as ApiErrorBody;\n    } catch {\n      return { Message: body };\n    }\n  }\n\n  private static buildMessage(status: number, body: ApiErrorBody | null): string {\n    const apiMessage = body?.Message ?? body?.InnerError?.Message;\n    if (apiMessage) {\n      return `HTTP ${String(status)}: ${apiMessage}`;\n    }\n    return `HTTP ${String(status)}`;\n  }\n}\n\nexport class AuthenticationError extends ApiError {\n  constructor(message: string, body: ApiErrorBody | null = null, options?: ErrorOptions) {\n    super(message, 401, body, options);\n    this.name = 'AuthenticationError';\n  }\n}\n\nexport class AuthorizationError extends ApiError {\n  constructor(message: string, body: ApiErrorBody | null = null, options?: ErrorOptions) {\n    super(message, 403, body, options);\n    this.name = 'AuthorizationError';\n  }\n}\n\nexport class NotFoundError extends ApiError {\n  constructor(message: string, body: ApiErrorBody | null = null, options?: ErrorOptions) {\n    super(message, 404, body, options);\n    this.name = 'NotFoundError';\n  }\n}\n\nexport class TransportError extends SafeguardError {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'TransportError';\n  }\n}\n\nexport class ConfigurationError extends SafeguardError {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'ConfigurationError';\n  }\n}\n","const REDACTED = '[REDACTED]';\n\n/**\n * A wrapper that prevents accidental logging of sensitive values.\n *\n * - `toString()` returns \"[REDACTED]\"\n * - `toJSON()` returns \"[REDACTED]\"\n * - `console.log(secretValue)` prints \"[REDACTED]\"\n * - `.expose()` returns the raw value when intentionally needed\n */\nexport class SecretValue {\n  readonly #value: string;\n\n  constructor(value: string) {\n    this.#value = value;\n  }\n\n  /** Returns the raw secret. Use only when you intentionally need the plaintext. */\n  expose(): string {\n    return this.#value;\n  }\n\n  toString(): string {\n    return REDACTED;\n  }\n\n  toJSON(): string {\n    return REDACTED;\n  }\n\n  /** Node.js custom inspect (prevents leaking in console.log / util.inspect). */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return REDACTED;\n  }\n\n  get [Symbol.toStringTag](): string {\n    return 'SecretValue';\n  }\n}\n","import { Service } from './types.js';\nimport { ConfigurationError } from './errors.js';\n\n/**\n * Validates that a host string is a bare hostname or IP address.\n * Rejects URLs, paths, query strings, userinfo, and embedded ports.\n *\n * @throws {ConfigurationError} if the host contains disallowed characters\n */\nexport function validateHost(host: string): string {\n  if (!host) throw new ConfigurationError('Host must not be empty');\n\n  const trimmed = host.trim();\n  if (trimmed !== host) {\n    throw new ConfigurationError('Host must not contain leading or trailing whitespace');\n  }\n\n  // Reject protocol prefixes\n  if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(host)) {\n    throw new ConfigurationError(\n      `Host must be a bare hostname or IP, not a URL. Remove the protocol prefix (e.g., use \"${host.replace(/^[a-z][a-z0-9+.-]*:\\/\\//i, '')}\")`,\n    );\n  }\n\n  // Reject path, query, fragment, userinfo characters\n  if (/[/?#@]/.test(host)) {\n    throw new ConfigurationError(\n      'Host must be a bare hostname or IP address — must not contain /, ?, #, or @',\n    );\n  }\n\n  // Reject port suffix (e.g. \"host:8443\") — SDK always uses HTTPS/443\n  if (/:\\d+$/.test(host) && !host.startsWith('[')) {\n    throw new ConfigurationError(\n      'Host must not include a port number. The SDK always connects over HTTPS (port 443).',\n    );\n  }\n\n  return host;\n}\n\n/**\n * Builds the base URL for a Safeguard service endpoint.\n *\n * @example\n * buildServiceUrl('appliance.example.com', Service.CORE)\n * // => 'https://appliance.example.com/service/core'\n */\nexport function buildServiceUrl(host: string, service: Service): string {\n  if (service === Service.RSTS) {\n    return `https://${host}/RSTS`;\n  }\n  return `https://${host}/service/${service}`;\n}\n\n/**\n * Builds a full API URL including path and optional query parameters.\n *\n * @example\n * buildRequestUrl('appliance.example.com', Service.CORE, 'v4/Users', { filter: 'Name eq \"admin\"' })\n * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'\n */\nexport function buildRequestUrl(\n  host: string,\n  service: Service,\n  relativeUrl: string,\n  query?: Record<string, string | number | boolean>,\n): string {\n  const base = buildServiceUrl(host, service);\n  const path = relativeUrl.startsWith('/') ? relativeUrl.slice(1) : relativeUrl;\n  const url = new URL(`${base}/${path}`);\n\n  if (query) {\n    for (const [key, value] of Object.entries(query)) {\n      url.searchParams.set(key, String(value));\n    }\n  }\n\n  return url.toString();\n}\n\n/**\n * Encodes bytes to a URL-safe base64 string (no padding).\n */\nexport function base64UrlEncode(bytes: Uint8Array): string {\n  const binary = String.fromCharCode(...bytes);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/**\n * Generates a cryptographically random code verifier for PKCE.\n * Returns a 43-character base64url string (32 random bytes).\n */\nexport function generateCodeVerifier(): string {\n  const bytes = new Uint8Array(32);\n  crypto.getRandomValues(bytes);\n  return base64UrlEncode(bytes);\n}\n\n/**\n * Computes the S256 code challenge from a code verifier.\n * Uses Web Crypto API (available in Node 20+ and all modern browsers).\n */\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\n/**\n * Generates a random state parameter for OAuth flows.\n */\nexport function generateState(): string {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return base64UrlEncode(bytes);\n}\n\n/**\n * Extracts the `exp` claim from a JWT and returns expiresIn (seconds from now).\n * Returns undefined if the token is not a valid JWT or has no `exp` claim.\n */\nexport function getTokenExpiresIn(jwt: string): number | undefined {\n  try {\n    const parts = jwt.split('.');\n    if (parts.length !== 3) return undefined;\n    // Base64url decode the payload\n    const payload = parts[1]!.replace(/-/g, '+').replace(/_/g, '/');\n    const json = atob(payload);\n    const claims = JSON.parse(json) as { exp?: number };\n    if (typeof claims.exp !== 'number') return undefined;\n    const now = Math.floor(Date.now() / 1000);\n    return Math.max(0, claims.exp - now);\n  } catch {\n    return undefined;\n  }\n}\n","import type { StorageProvider } from './types.js';\n\n/**\n * In-memory storage provider. Default for Node.js environments.\n * Data does not persist across process restarts.\n */\nexport class MemoryStorage implements StorageProvider {\n  readonly #store = new Map<string, string>();\n\n  get(key: string): string | null {\n    return this.#store.get(key) ?? null;\n  }\n\n  set(key: string, value: string): void {\n    this.#store.set(key, value);\n  }\n\n  remove(key: string): void {\n    this.#store.delete(key);\n  }\n\n  clear(): void {\n    this.#store.clear();\n  }\n}\n","import type { StorageProvider } from './types.js';\n\n/**\n * Browser sessionStorage adapter. Data persists for the browser tab lifetime.\n * Requires a DOM environment (browser or jsdom).\n */\nexport class BrowserSessionStorage implements StorageProvider {\n  get(key: string): string | null {\n    return sessionStorage.getItem(key);\n  }\n\n  set(key: string, value: string): void {\n    sessionStorage.setItem(key, value);\n  }\n\n  remove(key: string): void {\n    sessionStorage.removeItem(key);\n  }\n\n  clear(): void {\n    sessionStorage.clear();\n  }\n}\n","/**\n * Interface for token/state storage backends.\n */\nexport interface StorageProvider {\n  get(key: string): string | null;\n  set(key: string, value: string): void;\n  remove(key: string): void;\n  clear(): void;\n}\n\n/** Well-known storage keys used by the SDK. */\nexport const StorageKeys = {\n  STATE: 'safeguard_state',\n  CODE_VERIFIER: 'safeguard_code_verifier',\n} as const;\n","import type { HttpClient, HttpRequestOptions, HttpResponse } from './types.js';\n\n/**\n * Browser HTTP client using native fetch API.\n * No TLS configuration needed — browser handles certificates.\n */\nexport class BrowserHttpClient implements HttpClient {\n  readonly #credentials: RequestCredentials;\n\n  constructor(options?: { credentials?: RequestCredentials }) {\n    this.#credentials = options?.credentials ?? 'include';\n  }\n\n  async request(options: HttpRequestOptions): Promise<HttpResponse> {\n    const { url, method, headers, body, signal, timeout } = options;\n\n    const requestInit: RequestInit = {\n      method,\n      credentials: this.#credentials,\n    };\n\n    if (headers) requestInit.headers = headers;\n    if (body != null) requestInit.body = body as BodyInit;\n    if (signal || timeout) {\n      const controller = new AbortController();\n      let timeoutId: ReturnType<typeof setTimeout> | undefined;\n\n      if (timeout) {\n        timeoutId = setTimeout(() => controller.abort(new Error('Request timed out')), timeout);\n      }\n\n      requestInit.signal = signal\n        ? AbortSignal.any([signal, controller.signal])\n        : controller.signal;\n\n      try {\n        return await this.#doFetch(url, requestInit);\n      } finally {\n        if (timeoutId !== undefined) clearTimeout(timeoutId);\n      }\n    }\n\n    return this.#doFetch(url, requestInit);\n  }\n\n  async #doFetch(url: string, init: RequestInit): Promise<HttpResponse> {\n    const response = await fetch(url, init);\n\n    const responseHeaders: Record<string, string> = {};\n    response.headers.forEach((value, key) => {\n      responseHeaders[key] = value;\n    });\n\n    const responseBody = await response.text();\n\n    return {\n      status: response.status,\n      headers: responseHeaders,\n      body: responseBody,\n    };\n  }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { getTokenExpiresIn } from '../utils.js';\n\nexport interface PasswordAuthOptions {\n  username: string;\n  password: string;\n  /** Identity provider name. Default: 'local'. */\n  provider?: string;\n}\n\n/**\n * Authenticates using username/password via RSTS Resource Owner grant.\n */\nexport class PasswordAuth implements Auth {\n  readonly #username: string;\n  readonly #password: SecretValue;\n  readonly #provider: string;\n\n  constructor(options: PasswordAuthOptions) {\n    if (!options.username) throw new ConfigurationError('PasswordAuth requires username');\n    if (!options.password) throw new ConfigurationError('PasswordAuth requires password');\n    if (!options.provider) throw new ConfigurationError('PasswordAuth requires provider');\n    this.#username = options.username;\n    this.#password = new SecretValue(options.password);\n    this.#provider = options.provider;\n  }\n\n  get description(): string {\n    return `PasswordAuth(${this.#username}@${this.#provider})`;\n  }\n\n  async authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n    // Step 1: Get RSTS token\n    const rstsToken = await this.#getRstsToken(host, httpClient);\n\n    // Step 2: Exchange RSTS token for Safeguard user token\n    const userToken = await this.#exchangeForUserToken(host, httpClient, rstsToken);\n\n    return userToken;\n  }\n\n  async refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null> {\n    // Password auth can always re-authenticate\n    return this.authenticate(host, httpClient, storage);\n  }\n\n  async #getRstsToken(host: string, httpClient: HttpClient): Promise<string> {\n    const body = JSON.stringify({\n      grant_type: 'password',\n      username: this.#username,\n      password: this.#password.expose(),\n      scope: 'rsts:sts:primaryproviderid:' + this.#provider.toLowerCase(),\n    });\n\n    const response = await httpClient.request({\n      url: `https://${host}/RSTS/oauth2/token`,\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body,\n    });\n\n    if (response.status !== 200) {\n      const { ApiError } = await import('../errors.js');\n      throw ApiError.fromResponse(response.status, response.body);\n    }\n\n    const data = JSON.parse(response.body) as { access_token: string };\n    return data.access_token;\n  }\n\n  async #exchangeForUserToken(host: string, httpClient: HttpClient, rstsToken: string): Promise<TokenSet> {\n    const response = await httpClient.request({\n      url: `https://${host}/service/core/v4/Token/LoginResponse`,\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${rstsToken}`,\n      },\n      body: JSON.stringify({ StsAccessToken: rstsToken }),\n    });\n\n    if (response.status !== 200) {\n      const { ApiError } = await import('../errors.js');\n      throw ApiError.fromResponse(response.status, response.body);\n    }\n\n    const data = JSON.parse(response.body) as { UserToken: string; ExpiresIn?: number };\n    const tokenSet: TokenSet = {\n      accessToken: new SecretValue(data.UserToken),\n      acquiredAt: Date.now(),\n    };\n    if (data.ExpiresIn != null) {\n      tokenSet.expiresIn = data.ExpiresIn;\n    } else {\n      const expiresIn = getTokenExpiresIn(data.UserToken);\n      if (expiresIn != null) tokenSet.expiresIn = expiresIn;\n    }\n    return tokenSet;\n  }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { StorageKeys } from '../storage/types.js';\nimport { generateCodeVerifier, generateCodeChallenge, generateState } from '../utils.js';\n\nexport interface PkceAuthOptions {\n  /** OAuth redirect URI (must match RSTS configuration). */\n  redirectUri: string;\n  /** Identity provider name. Default: 'local'. */\n  provider?: string;\n}\n\n/**\n * Authenticates using PKCE (Proof Key for Code Exchange) with browser redirect.\n * For browser environments where the user is redirected to RSTS login.\n */\nexport class PkceAuth implements Auth {\n  readonly #redirectUri: string;\n  readonly #provider: string;\n\n  constructor(options: PkceAuthOptions) {\n    if (!options.redirectUri) throw new ConfigurationError('PkceAuth requires redirectUri');\n    if (!options.provider) throw new ConfigurationError('PkceAuth requires provider');\n    this.#redirectUri = options.redirectUri;\n    this.#provider = options.provider;\n  }\n\n  get description(): string {\n    return `PKCE(redirect=${this.#redirectUri})`;\n  }\n\n  /**\n   * Initiates the PKCE flow. If a stored authorization code exists (from callback),\n   * exchanges it for a token. Otherwise, redirects to RSTS login.\n   */\n  async authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet> {\n    // Check for authorization code (set by handlePkceCallback)\n    const code = storage.get('safeguard_auth_code');\n    if (code) {\n      const verifier = storage.get(StorageKeys.CODE_VERIFIER);\n      if (!verifier) {\n        throw new ConfigurationError('PKCE code verifier not found in storage');\n      }\n      storage.remove('safeguard_auth_code');\n      storage.remove(StorageKeys.CODE_VERIFIER);\n      storage.remove(StorageKeys.STATE);\n      return this.#exchangeCode(host, httpClient, code, verifier);\n    }\n\n    // No code — initiate redirect\n    await this.#initiateRedirect(host, storage);\n\n    // This point is never reached in a browser (redirect happens).\n    // For testability, throw rather than hang.\n    throw new ConfigurationError(\n      'PKCE redirect initiated. Call handlePkceCallback() on the callback page.',\n    );\n  }\n\n  async #initiateRedirect(host: string, storage: StorageProvider): Promise<void> {\n    const verifier = generateCodeVerifier();\n    const challenge = await generateCodeChallenge(verifier);\n    const state = generateState();\n\n    storage.set(StorageKeys.CODE_VERIFIER, verifier);\n    storage.set(StorageKeys.STATE, state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: 'safeguard.js',\n      redirect_uri: this.#redirectUri,\n      scope: 'rsts:sts:primaryproviderid:' + this.#provider,\n      code_challenge: challenge,\n      code_challenge_method: 'S256',\n      state,\n    });\n\n    const authUrl = `https://${host}/RSTS/Login?${params.toString()}`;\n\n    // In browser environment, redirect\n    if (typeof window !== 'undefined' && window.location) {\n      window.location.href = authUrl;\n    }\n  }\n\n  async #exchangeCode(\n    host: string,\n    httpClient: HttpClient,\n    code: string,\n    verifier: string,\n  ): Promise<TokenSet> {\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: this.#redirectUri,\n      client_id: 'safeguard.js',\n      code_verifier: verifier,\n    });\n\n    const response = await httpClient.request({\n      url: `https://${host}/RSTS/oauth2/token`,\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    if (response.status !== 200) {\n      const { ApiError } = await import('../errors.js');\n      throw ApiError.fromResponse(response.status, response.body);\n    }\n\n    const data = JSON.parse(response.body) as { access_token: string; expires_in?: number };\n\n    // Exchange RSTS token for Safeguard user token\n    const userTokenResponse = await httpClient.request({\n      url: `https://${host}/service/core/v4/Token/LoginResponse`,\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${data.access_token}`,\n      },\n      body: JSON.stringify({ StsAccessToken: data.access_token }),\n    });\n\n    if (userTokenResponse.status !== 200) {\n      const { ApiError } = await import('../errors.js');\n      throw ApiError.fromResponse(userTokenResponse.status, userTokenResponse.body);\n    }\n\n    const userData = JSON.parse(userTokenResponse.body) as { UserToken: string; ExpiresIn?: number };\n    const tokenSet: TokenSet = {\n      accessToken: new SecretValue(userData.UserToken),\n      acquiredAt: Date.now(),\n    };\n    if (userData.ExpiresIn != null) tokenSet.expiresIn = userData.ExpiresIn;\n\n    // Token stays in-memory only (SafeguardClient.#tokenSet). Not persisted to\n    // sessionStorage to avoid XSS exfiltration of high-privilege PAM tokens.\n    return tokenSet;\n  }\n}\n","import { StorageKeys } from '../storage/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport { ConfigurationError } from '../errors.js';\n\nexport interface PkceCallbackResult {\n  code: string;\n  state: string;\n}\n\n/**\n * Parses the PKCE callback URL and stores the authorization code.\n * Call this on the callback/redirect page to complete the PKCE flow.\n *\n * This is the explicit replacement for the legacy `safeguardJsAccessTokenChecker.js`\n * script that ran as a side-effect on import.\n *\n * @param storage - StorageProvider to persist the code\n * @param url - The callback URL to parse (defaults to window.location.href)\n * @returns The parsed code and state, or null if not a valid callback\n */\nexport function handlePkceCallback(\n  storage: StorageProvider,\n  url?: string,\n): PkceCallbackResult | null {\n  const callbackUrl = url ?? (typeof window !== 'undefined' ? window.location.href : '');\n  if (!callbackUrl) return null;\n\n  const parsed = new URL(callbackUrl);\n  const code = parsed.searchParams.get('code');\n  const state = parsed.searchParams.get('state');\n\n  if (!code || !state) return null;\n\n  // Validate state matches what we stored\n  const storedState = storage.get(StorageKeys.STATE);\n  if (storedState && storedState !== state) {\n    throw new ConfigurationError('PKCE state mismatch — possible CSRF attack');\n  }\n\n  // Store the code for the PkceAuth strategy to pick up\n  storage.set('safeguard_auth_code', code);\n\n  return { code, state };\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\n\nexport interface TokenAuthOptions {\n  /** Pre-existing Safeguard access token. */\n  accessToken: string;\n}\n\n/**\n * Uses a pre-existing access token. No authentication flow — the token is assumed valid.\n * Useful when tokens are obtained externally or for service-to-service scenarios.\n */\nexport class TokenAuth implements Auth {\n  readonly #accessToken: SecretValue;\n\n  constructor(options: TokenAuthOptions) {\n    if (!options.accessToken) throw new ConfigurationError('TokenAuth requires accessToken');\n    this.#accessToken = new SecretValue(options.accessToken);\n  }\n\n  get description(): string {\n    return 'TokenAuth(pre-existing)';\n  }\n\n  async authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n    return {\n      accessToken: this.#accessToken,\n      acquiredAt: Date.now(),\n    };\n  }\n\n  // No refresh possible with a pre-existing token\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { SecretValue } from '../secret.js';\n\n/**\n * Anonymous authentication — no credentials.\n * Used for accessing public Safeguard endpoints (e.g., appliance status).\n */\nexport class AnonymousAuth implements Auth {\n  get description(): string {\n    return 'AnonymousAuth';\n  }\n\n  async authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n    return {\n      accessToken: new SecretValue(''),\n      acquiredAt: Date.now(),\n    };\n  }\n}\n","import { Service, HttpMethod } from './types.js';\nimport type { RequestOptions, SafeguardClientOptions } from './types.js';\nimport type { Auth, TokenSet } from './auth/types.js';\nimport type { HttpClient } from './http/types.js';\nimport type { StorageProvider } from './storage/types.js';\nimport { MemoryStorage } from './storage/memory.js';\nimport { buildRequestUrl, validateHost } from './utils.js';\nimport { AuthenticationError, ConfigurationError, ApiError } from './errors.js';\n\nconst DEFAULT_TIMEOUT = 300_000;\nconst DEFAULT_API_VERSION = 'v4';\nconst TOKEN_REFRESH_MARGIN_MS = 60_000; // refresh 60s before expiry\n\n/**\n * Main entry point for the Safeguard SDK.\n * Instance-based — no global state. Multiple clients to different appliances are supported.\n */\nexport class SafeguardClient {\n  readonly #host: string;\n  readonly #auth: Auth;\n  readonly #apiVersion: string;\n  readonly #timeout: number;\n  readonly #autoRefresh: boolean;\n  readonly #ca: string | Buffer | undefined;\n  readonly #verify: boolean;\n\n  #httpClient: HttpClient | undefined;\n  #storage: StorageProvider;\n  #tokenSet: TokenSet | undefined;\n  #connected = false;\n\n  constructor(host: string, options: SafeguardClientOptions) {\n    if (!host) throw new ConfigurationError('SafeguardClient requires a host');\n    if (!options.auth) throw new ConfigurationError('SafeguardClient requires an auth strategy');\n    this.#host = validateHost(host);\n    this.#auth = options.auth;\n    this.#apiVersion = options.apiVersion ?? DEFAULT_API_VERSION;\n    this.#timeout = options.timeout ?? DEFAULT_TIMEOUT;\n    this.#autoRefresh = options.autoRefresh !== false;\n    this.#ca = options.ca;\n    this.#verify = options.verify !== false;\n    this.#storage = new MemoryStorage();\n  }\n\n  /** The appliance hostname this client connects to. */\n  get host(): string {\n    return this.#host;\n  }\n\n  /** The API version prefix (e.g. 'v4'). */\n  get apiVersion(): string {\n    return this.#apiVersion;\n  }\n\n  /** Custom CA certificate, if provided. */\n  get ca(): string | Buffer | undefined {\n    return this.#ca;\n  }\n\n  /** Whether TLS verification is enabled. */\n  get verify(): boolean {\n    return this.#verify;\n  }\n\n  /** Whether the client has an active authenticated session. */\n  get isConnected(): boolean {\n    return this.#connected;\n  }\n\n  /**\n   * Sets a custom StorageProvider (e.g., BrowserSessionStorage).\n   * Must be called before connect().\n   */\n  setStorage(storage: StorageProvider): this {\n    this.#storage = storage;\n    return this;\n  }\n\n  /**\n   * Sets the HttpClient implementation. If not called, must be set before connect().\n   * The factory pattern allows platform-specific client injection:\n   *   - Node: `new NodeHttpClient({ ca, rejectUnauthorized })`\n   *   - Browser: `new BrowserHttpClient()`\n   */\n  setHttpClient(httpClient: HttpClient): this {\n    this.#httpClient = httpClient;\n    return this;\n  }\n\n  /**\n   * Authenticate and establish a session.\n   * @throws {AuthenticationError} if authentication fails\n   * @throws {ConfigurationError} if httpClient not set\n   */\n  async connect(): Promise<void> {\n    if (!this.#httpClient) {\n      throw new ConfigurationError(\n        'HttpClient not set. Call setHttpClient() before connect(), or use SafeguardClient.createNode() / SafeguardClient.createBrowser().',\n      );\n    }\n\n    this.#tokenSet = await this.#auth.authenticate(this.#host, this.#httpClient, this.#storage);\n    if (!this.#tokenSet.accessToken.expose()) {\n      throw new AuthenticationError('Authentication returned empty access token');\n    }\n    this.#connected = true;\n  }\n\n  /**\n   * Disconnect — dispose HTTP client and clear token.\n   */\n  async disconnect(): Promise<void> {\n    this.#tokenSet = undefined;\n    this.#connected = false;\n    this.#httpClient?.dispose?.();\n  }\n\n  /**\n   * Returns seconds until the current access token expires, or -1 if unknown.\n   */\n  getAccessTokenLifetimeRemaining(): number {\n    if (!this.#tokenSet?.expiresIn) return -1;\n    const elapsed = (Date.now() - this.#tokenSet.acquiredAt) / 1000;\n    return Math.max(0, this.#tokenSet.expiresIn - elapsed);\n  }\n\n  // ─── Convenience HTTP verbs ─────────────────────────────────────────\n\n  async get<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.GET, relativeUrl, options);\n  }\n\n  async post<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.POST, relativeUrl, options);\n  }\n\n  async put<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.PUT, relativeUrl, options);\n  }\n\n  async delete<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.DELETE, relativeUrl, options);\n  }\n\n  async patch<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.PATCH, relativeUrl, options);\n  }\n\n  // ─── Core invoke ────────────────────────────────────────────────────\n\n  /**\n   * Low-level request method. Convenience verbs delegate here.\n   *\n   * When `options.fullResponse` is true, returns SafeguardResponse<T> with status + headers.\n   * Otherwise returns just the parsed response body as T.\n   */\n  async invoke<T = unknown>(\n    service: Service,\n    method: HttpMethod,\n    relativeUrl: string,\n    options?: RequestOptions,\n  ): Promise<T> {\n    if (!this.#connected || !this.#httpClient) {\n      throw new ConfigurationError('Client not connected. Call connect() first.');\n    }\n\n    // Auto-refresh token if needed\n    if (this.#autoRefresh) {\n      await this.#ensureValidToken();\n    }\n\n    const url = buildRequestUrl(this.#host, service, relativeUrl, options?.query);\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${this.#tokenSet!.accessToken.expose()}`,\n      Accept: 'application/json',\n      ...options?.headers,\n    };\n\n    let body: string | null = null;\n    if (options?.json != null) {\n      body = JSON.stringify(options.json);\n      headers['Content-Type'] = 'application/json';\n    } else if (options?.body != null) {\n      body = options.body as string;\n    }\n\n    const requestOpts: import('./http/types.js').HttpRequestOptions = {\n      url,\n      method,\n      headers,\n      body,\n      timeout: options?.timeout ?? this.#timeout,\n    };\n    if (options?.signal) requestOpts.signal = options.signal;\n\n    const response = await this.#httpClient.request(requestOpts);\n\n    if (response.status >= 400) {\n      throw ApiError.fromResponse(response.status, response.body);\n    }\n\n    const data = response.body ? (JSON.parse(response.body) as T) : (undefined as T);\n\n    if (options?.fullResponse) {\n      return { data, status: response.status, headers: response.headers } as unknown as T;\n    }\n\n    return data;\n  }\n\n  // ─── Private helpers ────────────────────────────────────────────────\n\n  async #ensureValidToken(): Promise<void> {\n    if (!this.#tokenSet) return;\n    if (!this.#tokenSet.expiresIn) return; // can't determine expiry\n\n    const elapsed = Date.now() - this.#tokenSet.acquiredAt;\n    const expiresInMs = this.#tokenSet.expiresIn * 1000;\n\n    if (elapsed + TOKEN_REFRESH_MARGIN_MS >= expiresInMs) {\n      // Token is expired or about to expire — refresh\n      if (this.#auth.refreshToken) {\n        const refreshed = await this.#auth.refreshToken(this.#host, this.#httpClient!, this.#storage);\n        if (refreshed) {\n          this.#tokenSet = refreshed;\n          return;\n        }\n      }\n      // No refresh support or refresh failed — re-authenticate\n      this.#tokenSet = await this.#auth.authenticate(this.#host, this.#httpClient!, this.#storage);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAGA,IAAY,UAAL,yBAAA,SAAA;CACL,QAAA,UAAA;CACA,QAAA,eAAA;CACA,QAAA,kBAAA;CACA,QAAA,SAAA;CACA,QAAA,WAAA;CACA,QAAA,UAAA;;AACF,EAAA,CAAA,CAAA;;;;AAKA,IAAY,aAAL,yBAAA,YAAA;CACL,WAAA,SAAA;CACA,WAAA,UAAA;CACA,WAAA,SAAA;CACA,WAAA,YAAA;CACA,WAAA,WAAA;;AACF,EAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;ACTA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AASA,IAAa,WAAb,MAAa,iBAAiB,eAAe;CAC3C;CACA;CAEA,YAAY,SAAiB,QAAgB,OAA4B,MAAM,SAAwB;EACrG,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;;;;CAKA,OAAO,aAAa,QAAgB,MAA8C;EAChF,MAAM,SAAS,SAAS,UAAU,IAAI;EACtC,MAAM,UAAU,SAAS,aAAa,QAAQ,MAAM;EAEpD,QAAQ,QAAR;GACE,KAAK,KACH,OAAO,IAAI,oBAAoB,SAAS,MAAM;GAChD,KAAK,KACH,OAAO,IAAI,mBAAmB,SAAS,MAAM;GAC/C,KAAK,KACH,OAAO,IAAI,cAAc,SAAS,MAAM;GAC1C,SACE,OAAO,IAAI,SAAS,SAAS,QAAQ,MAAM;EAC/C;CACF;CAEA,OAAe,UAAU,MAAyD;EAChF,IAAI,SAAS,QAAQ,SAAS,KAAA,GAAW,OAAO;EAChD,IAAI,OAAO,SAAS,UAAU,OAAO;EACrC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,EAAE,SAAS,KAAK;EACzB;CACF;CAEA,OAAe,aAAa,QAAgB,MAAmC;EAC7E,MAAM,aAAa,MAAM,WAAW,MAAM,YAAY;EACtD,IAAI,YACF,OAAO,QAAQ,OAAO,MAAM,EAAE,IAAI;EAEpC,OAAO,QAAQ,OAAO,MAAM;CAC9B;AACF;AAEA,IAAa,sBAAb,cAAyC,SAAS;CAChD,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,SAAS;CAC/C,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,SAAS;CAC1C,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,eAAe;CACjD,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,eAAe;CACrD,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;AC5GA,MAAM,WAAW;;;;;;;;;AAUjB,IAAa,cAAb,MAAyB;CACvB;CAEA,YAAY,OAAe;EACzB,KAAKA,SAAS;CAChB;;CAGA,SAAiB;EACf,OAAO,KAAKA;CACd;CAEA,WAAmB;EACjB,OAAO;CACT;CAEA,SAAiB;EACf,OAAO;CACT;;CAGA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO;CACT;CAEA,KAAK,OAAO,eAAuB;EACjC,OAAO;CACT;AACF;;;;;;;;;AC7BA,SAAgB,aAAa,MAAsB;CACjD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,wBAAwB;CAGhE,IADgB,KAAK,KACX,MAAM,MACd,MAAM,IAAI,mBAAmB,sDAAsD;CAIrF,IAAI,2BAA2B,KAAK,IAAI,GACtC,MAAM,IAAI,mBACR,yFAAyF,KAAK,QAAQ,4BAA4B,EAAE,EAAE,GACxI;CAIF,IAAI,SAAS,KAAK,IAAI,GACpB,MAAM,IAAI,mBACR,6EACF;CAIF,IAAI,QAAQ,KAAK,IAAI,KAAK,CAAC,KAAK,WAAW,GAAG,GAC5C,MAAM,IAAI,mBACR,qFACF;CAGF,OAAO;AACT;;;;;;;;AASA,SAAgB,gBAAgB,MAAc,SAA0B;CACtE,IAAI,YAAA,QACF,OAAO,WAAW,KAAK;CAEzB,OAAO,WAAW,KAAK,WAAW;AACpC;;;;;;;;AASA,SAAgB,gBACd,MACA,SACA,aACA,OACQ;CACR,MAAM,OAAO,gBAAgB,MAAM,OAAO;CAC1C,MAAM,OAAO,YAAY,WAAW,GAAG,IAAI,YAAY,MAAM,CAAC,IAAI;CAClE,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM;CAErC,IAAI,OACF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC7C,IAAI,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;CAI3C,OAAO,IAAI,SAAS;AACtB;;;;AAKA,SAAgB,gBAAgB,OAA2B;CACzD,MAAM,SAAS,OAAO,aAAa,GAAG,KAAK;CAC3C,OAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;;;;;AAMA,SAAgB,uBAA+B;CAC7C,MAAM,QAAQ,IAAI,WAAW,EAAE;CAC/B,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,KAAK;AAC9B;;;;;AAMA,eAAsB,sBAAsB,UAAmC;CAE7E,MAAM,OAAO,IADO,YACD,EAAE,OAAO,QAAQ;CACpC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CACzD,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;;;;AAKA,SAAgB,gBAAwB;CACtC,MAAM,QAAQ,IAAI,WAAW,EAAE;CAC/B,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,KAAK;AAC9B;;;;;AAMA,SAAgB,kBAAkB,KAAiC;CACjE,IAAI;EACF,MAAM,QAAQ,IAAI,MAAM,GAAG;EAC3B,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;EAE/B,MAAM,UAAU,MAAM,GAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;EAC9D,MAAM,OAAO,KAAK,OAAO;EACzB,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAI,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;EAC3C,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,GAAG;CACrC,QAAQ;EACN;CACF;AACF;;;;;;;ACnIA,IAAa,gBAAb,MAAsD;CACpD,yBAAkB,IAAI,IAAoB;CAE1C,IAAI,KAA4B;EAC9B,OAAO,KAAKC,OAAO,IAAI,GAAG,KAAK;CACjC;CAEA,IAAI,KAAa,OAAqB;EACpC,KAAKA,OAAO,IAAI,KAAK,KAAK;CAC5B;CAEA,OAAO,KAAmB;EACxB,KAAKA,OAAO,OAAO,GAAG;CACxB;CAEA,QAAc;EACZ,KAAKA,OAAO,MAAM;CACpB;AACF;;;;;;;AClBA,IAAa,wBAAb,MAA8D;CAC5D,IAAI,KAA4B;EAC9B,OAAO,eAAe,QAAQ,GAAG;CACnC;CAEA,IAAI,KAAa,OAAqB;EACpC,eAAe,QAAQ,KAAK,KAAK;CACnC;CAEA,OAAO,KAAmB;EACxB,eAAe,WAAW,GAAG;CAC/B;CAEA,QAAc;EACZ,eAAe,MAAM;CACvB;AACF;;;;ACXA,MAAa,cAAc;CACzB,OAAO;CACP,eAAe;AACjB;;;;;;;ACRA,IAAa,oBAAb,MAAqD;CACnD;CAEA,YAAY,SAAgD;EAC1D,KAAKC,eAAe,SAAS,eAAe;CAC9C;CAEA,MAAM,QAAQ,SAAoD;EAChE,MAAM,EAAE,KAAK,QAAQ,SAAS,MAAM,QAAQ,YAAY;EAExD,MAAM,cAA2B;GAC/B;GACA,aAAa,KAAKA;EACpB;EAEA,IAAI,SAAS,YAAY,UAAU;EACnC,IAAI,QAAQ,MAAM,YAAY,OAAO;EACrC,IAAI,UAAU,SAAS;GACrB,MAAM,aAAa,IAAI,gBAAgB;GACvC,IAAI;GAEJ,IAAI,SACF,YAAY,iBAAiB,WAAW,sBAAM,IAAI,MAAM,mBAAmB,CAAC,GAAG,OAAO;GAGxF,YAAY,SAAS,SACjB,YAAY,IAAI,CAAC,QAAQ,WAAW,MAAM,CAAC,IAC3C,WAAW;GAEf,IAAI;IACF,OAAO,MAAM,KAAKC,SAAS,KAAK,WAAW;GAC7C,UAAU;IACR,IAAI,cAAc,KAAA,GAAW,aAAa,SAAS;GACrD;EACF;EAEA,OAAO,KAAKA,SAAS,KAAK,WAAW;CACvC;CAEA,MAAMA,SAAS,KAAa,MAA0C;EACpE,MAAM,WAAW,MAAM,MAAM,KAAK,IAAI;EAEtC,MAAM,kBAA0C,CAAC;EACjD,SAAS,QAAQ,SAAS,OAAO,QAAQ;GACvC,gBAAgB,OAAO;EACzB,CAAC;EAED,MAAM,eAAe,MAAM,SAAS,KAAK;EAEzC,OAAO;GACL,QAAQ,SAAS;GACjB,SAAS;GACT,MAAM;EACR;CACF;AACF;;;;;;AC5CA,IAAa,eAAb,MAA0C;CACxC;CACA;CACA;CAEA,YAAY,SAA8B;EACxC,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,KAAKC,YAAY,QAAQ;EACzB,KAAKC,YAAY,IAAI,YAAY,QAAQ,QAAQ;EACjD,KAAKC,YAAY,QAAQ;CAC3B;CAEA,IAAI,cAAsB;EACxB,OAAO,gBAAgB,KAAKF,UAAU,GAAG,KAAKE,UAAU;CAC1D;CAEA,MAAM,aAAa,MAAc,YAAwB,UAA8C;EAErG,MAAM,YAAY,MAAM,KAAKC,cAAc,MAAM,UAAU;EAK3D,OAAO,MAFiB,KAAKC,sBAAsB,MAAM,YAAY,SAAS;CAGhF;CAEA,MAAM,aAAa,MAAc,YAAwB,SAAoD;EAE3G,OAAO,KAAK,aAAa,MAAM,YAAY,OAAO;CACpD;CAEA,MAAMD,cAAc,MAAc,YAAyC;EACzE,MAAM,OAAO,KAAK,UAAU;GAC1B,YAAY;GACZ,UAAU,KAAKH;GACf,UAAU,KAAKC,UAAU,OAAO;GAChC,OAAO,gCAAgC,KAAKC,UAAU,YAAY;EACpE,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C;EACF,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,EAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAGA,OADa,KAAK,MAAM,SAAS,IACvB,EAAE;CACd;CAEA,MAAME,sBAAsB,MAAc,YAAwB,WAAsC;EACtG,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,UAAU,CAAC;EACpD,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,EAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,KAAK,SAAS;GAC3C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,KAAK,aAAa,MACpB,SAAS,YAAY,KAAK;OACrB;GACL,MAAM,YAAY,kBAAkB,KAAK,SAAS;GAClD,IAAI,aAAa,MAAM,SAAS,YAAY;EAC9C;EACA,OAAO;CACT;AACF;;;;;;;ACpFA,IAAa,WAAb,MAAsC;CACpC;CACA;CAEA,YAAY,SAA0B;EACpC,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,mBAAmB,+BAA+B;EACtF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,4BAA4B;EAChF,KAAKC,eAAe,QAAQ;EAC5B,KAAKC,YAAY,QAAQ;CAC3B;CAEA,IAAI,cAAsB;EACxB,OAAO,iBAAiB,KAAKD,aAAa;CAC5C;;;;;CAMA,MAAM,aAAa,MAAc,YAAwB,SAA6C;EAEpG,MAAM,OAAO,QAAQ,IAAI,qBAAqB;EAC9C,IAAI,MAAM;GACR,MAAM,WAAW,QAAQ,IAAI,YAAY,aAAa;GACtD,IAAI,CAAC,UACH,MAAM,IAAI,mBAAmB,yCAAyC;GAExE,QAAQ,OAAO,qBAAqB;GACpC,QAAQ,OAAO,YAAY,aAAa;GACxC,QAAQ,OAAO,YAAY,KAAK;GAChC,OAAO,KAAKE,cAAc,MAAM,YAAY,MAAM,QAAQ;EAC5D;EAGA,MAAM,KAAKC,kBAAkB,MAAM,OAAO;EAI1C,MAAM,IAAI,mBACR,0EACF;CACF;CAEA,MAAMA,kBAAkB,MAAc,SAAyC;EAC7E,MAAM,WAAW,qBAAqB;EACtC,MAAM,YAAY,MAAM,sBAAsB,QAAQ;EACtD,MAAM,QAAQ,cAAc;EAE5B,QAAQ,IAAI,YAAY,eAAe,QAAQ;EAC/C,QAAQ,IAAI,YAAY,OAAO,KAAK;EAYpC,MAAM,UAAU,WAAW,KAAK,cAAc,IAV3B,gBAAgB;GACjC,eAAe;GACf,WAAW;GACX,cAAc,KAAKH;GACnB,OAAO,gCAAgC,KAAKC;GAC5C,gBAAgB;GAChB,uBAAuB;GACvB;EACF,CAEmD,EAAE,SAAS;EAG9D,IAAI,OAAO,WAAW,eAAe,OAAO,UAC1C,OAAO,SAAS,OAAO;CAE3B;CAEA,MAAMC,cACJ,MACA,YACA,MACA,UACmB;EACnB,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ;GACA,cAAc,KAAKF;GACnB,WAAW;GACX,eAAe;EACjB,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,EAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EAGrC,MAAM,oBAAoB,MAAM,WAAW,QAAQ;GACjD,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,KAAK;GAChC;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,KAAK,aAAa,CAAC;EAC5D,CAAC;EAED,IAAI,kBAAkB,WAAW,KAAK;GACpC,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,EAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,kBAAkB,QAAQ,kBAAkB,IAAI;EAC9E;EAEA,MAAM,WAAW,KAAK,MAAM,kBAAkB,IAAI;EAClD,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,SAAS,SAAS;GAC/C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,SAAS,aAAa,MAAM,SAAS,YAAY,SAAS;EAI9D,OAAO;CACT;AACF;;;;;;;;;;;;;;AC3HA,SAAgB,mBACd,SACA,KAC2B;CAC3B,MAAM,cAAc,QAAQ,OAAO,WAAW,cAAc,OAAO,SAAS,OAAO;CACnF,IAAI,CAAC,aAAa,OAAO;CAEzB,MAAM,SAAS,IAAI,IAAI,WAAW;CAClC,MAAM,OAAO,OAAO,aAAa,IAAI,MAAM;CAC3C,MAAM,QAAQ,OAAO,aAAa,IAAI,OAAO;CAE7C,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO;CAG5B,MAAM,cAAc,QAAQ,IAAI,YAAY,KAAK;CACjD,IAAI,eAAe,gBAAgB,OACjC,MAAM,IAAI,mBAAmB,4CAA4C;CAI3E,QAAQ,IAAI,uBAAuB,IAAI;CAEvC,OAAO;EAAE;EAAM;CAAM;AACvB;;;;;;;AC5BA,IAAa,YAAb,MAAuC;CACrC;CAEA,YAAY,SAA2B;EACrC,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,mBAAmB,gCAAgC;EACvF,KAAKI,eAAe,IAAI,YAAY,QAAQ,WAAW;CACzD;CAEA,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aAAa,OAAe,aAAyB,UAA8C;EACvG,OAAO;GACL,aAAa,KAAKA;GAClB,YAAY,KAAK,IAAI;EACvB;CACF;AAGF;;;;;;;AC1BA,IAAa,gBAAb,MAA2C;CACzC,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aAAa,OAAe,aAAyB,UAA8C;EACvG,OAAO;GACL,aAAa,IAAI,YAAY,EAAE;GAC/B,YAAY,KAAK,IAAI;EACvB;CACF;AACF;;;ACXA,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;;;;;AAMhC,IAAa,kBAAb,MAA6B;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA,aAAa;CAEb,YAAY,MAAc,SAAiC;EACzD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,iCAAiC;EACzE,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI,mBAAmB,2CAA2C;EAC3F,KAAKC,QAAQ,aAAa,IAAI;EAC9B,KAAKC,QAAQ,QAAQ;EACrB,KAAKC,cAAc,QAAQ,cAAc;EACzC,KAAKC,WAAW,QAAQ,WAAW;EACnC,KAAKC,eAAe,QAAQ,gBAAgB;EAC5C,KAAKC,MAAM,QAAQ;EACnB,KAAKC,UAAU,QAAQ,WAAW;EAClC,KAAKC,WAAW,IAAI,cAAc;CACpC;;CAGA,IAAI,OAAe;EACjB,OAAO,KAAKP;CACd;;CAGA,IAAI,aAAqB;EACvB,OAAO,KAAKE;CACd;;CAGA,IAAI,KAAkC;EACpC,OAAO,KAAKG;CACd;;CAGA,IAAI,SAAkB;EACpB,OAAO,KAAKC;CACd;;CAGA,IAAI,cAAuB;EACzB,OAAO,KAAKE;CACd;;;;;CAMA,WAAW,SAAgC;EACzC,KAAKD,WAAW;EAChB,OAAO;CACT;;;;;;;CAQA,cAAc,YAA8B;EAC1C,KAAKE,cAAc;EACnB,OAAO;CACT;;;;;;CAOA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAKA,aACR,MAAM,IAAI,mBACR,mIACF;EAGF,KAAKC,YAAY,MAAM,KAAKT,MAAM,aAAa,KAAKD,OAAO,KAAKS,aAAa,KAAKF,QAAQ;EAC1F,IAAI,CAAC,KAAKG,UAAU,YAAY,OAAO,GACrC,MAAM,IAAI,oBAAoB,4CAA4C;EAE5E,KAAKF,aAAa;CACpB;;;;CAKA,MAAM,aAA4B;EAChC,KAAKE,YAAY,KAAA;EACjB,KAAKF,aAAa;EAClB,KAAKC,aAAa,UAAU;CAC9B;;;;CAKA,kCAA0C;EACxC,IAAI,CAAC,KAAKC,WAAW,WAAW,OAAO;EACvC,MAAM,WAAW,KAAK,IAAI,IAAI,KAAKA,UAAU,cAAc;EAC3D,OAAO,KAAK,IAAI,GAAG,KAAKA,UAAU,YAAY,OAAO;CACvD;CAIA,MAAM,IAAiB,SAAkB,aAAqB,SAAsC;EAClG,OAAO,KAAK,OAAU,SAAA,OAAyB,aAAa,OAAO;CACrE;CAEA,MAAM,KAAkB,SAAkB,aAAqB,SAAsC;EACnG,OAAO,KAAK,OAAU,SAAA,QAA0B,aAAa,OAAO;CACtE;CAEA,MAAM,IAAiB,SAAkB,aAAqB,SAAsC;EAClG,OAAO,KAAK,OAAU,SAAA,OAAyB,aAAa,OAAO;CACrE;CAEA,MAAM,OAAoB,SAAkB,aAAqB,SAAsC;EACrG,OAAO,KAAK,OAAU,SAAA,UAA4B,aAAa,OAAO;CACxE;CAEA,MAAM,MAAmB,SAAkB,aAAqB,SAAsC;EACpG,OAAO,KAAK,OAAU,SAAA,SAA2B,aAAa,OAAO;CACvE;;;;;;;CAUA,MAAM,OACJ,SACA,QACA,aACA,SACY;EACZ,IAAI,CAAC,KAAKF,cAAc,CAAC,KAAKC,aAC5B,MAAM,IAAI,mBAAmB,6CAA6C;EAI5E,IAAI,KAAKL,cACP,MAAM,KAAKO,kBAAkB;EAG/B,MAAM,MAAM,gBAAgB,KAAKX,OAAO,SAAS,aAAa,SAAS,KAAK;EAC5E,MAAM,UAAkC;GACtC,eAAe,UAAU,KAAKU,UAAW,YAAY,OAAO;GAC5D,QAAQ;GACR,GAAG,SAAS;EACd;EAEA,IAAI,OAAsB;EAC1B,IAAI,SAAS,QAAQ,MAAM;GACzB,OAAO,KAAK,UAAU,QAAQ,IAAI;GAClC,QAAQ,kBAAkB;EAC5B,OAAO,IAAI,SAAS,QAAQ,MAC1B,OAAO,QAAQ;EAGjB,MAAM,cAA4D;GAChE;GACA;GACA;GACA;GACA,SAAS,SAAS,WAAW,KAAKP;EACpC;EACA,IAAI,SAAS,QAAQ,YAAY,SAAS,QAAQ;EAElD,MAAM,WAAW,MAAM,KAAKM,YAAY,QAAQ,WAAW;EAE3D,IAAI,SAAS,UAAU,KACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,MAAM,OAAO,SAAS,OAAQ,KAAK,MAAM,SAAS,IAAI,IAAW,KAAA;EAEjE,IAAI,SAAS,cACX,OAAO;GAAE;GAAM,QAAQ,SAAS;GAAQ,SAAS,SAAS;EAAQ;EAGpE,OAAO;CACT;CAIA,MAAME,oBAAmC;EACvC,IAAI,CAAC,KAAKD,WAAW;EACrB,IAAI,CAAC,KAAKA,UAAU,WAAW;EAE/B,MAAM,UAAU,KAAK,IAAI,IAAI,KAAKA,UAAU;EAC5C,MAAM,cAAc,KAAKA,UAAU,YAAY;EAE/C,IAAI,UAAU,2BAA2B,aAAa;GAEpD,IAAI,KAAKT,MAAM,cAAc;IAC3B,MAAM,YAAY,MAAM,KAAKA,MAAM,aAAa,KAAKD,OAAO,KAAKS,aAAc,KAAKF,QAAQ;IAC5F,IAAI,WAAW;KACb,KAAKG,YAAY;KACjB;IACF;GACF;GAEA,KAAKA,YAAY,MAAM,KAAKT,MAAM,aAAa,KAAKD,OAAO,KAAKS,aAAc,KAAKF,QAAQ;EAC7F;CACF;AACF"}
+{"version":3,"file":"browser.js","names":["#value","#store","#credentials","#doFetch","#username","#password","#provider","#getRstsToken","#exchangeForUserToken","#redirectUri","#provider","#exchangeCode","#initiateRedirect","#accessToken","#host","#auth","#apiVersion","#timeout","#autoRefresh","#ca","#verify","#storage","#connected","#httpClient","#tokenSet","#ensureValidToken"],"sources":["../src/types.ts","../src/errors.ts","../src/secret.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/storage/types.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/pkce.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts"],"sourcesContent":["/**\n * Safeguard appliance service endpoints.\n */\nexport enum Service {\n  CORE = 'core',\n  APPLIANCE = 'appliance',\n  NOTIFICATION = 'notification',\n  A2A = 'a2a',\n  EVENT = 'event',\n  RSTS = 'RSTS',\n}\n\n/**\n * HTTP methods supported by the Safeguard API.\n */\nexport enum HttpMethod {\n  GET = 'GET',\n  POST = 'POST',\n  PUT = 'PUT',\n  DELETE = 'DELETE',\n  PATCH = 'PATCH',\n}\n\n/**\n * Full response from a Safeguard API call (returned when fullResponse: true).\n */\nexport interface SafeguardResponse<T = unknown> {\n  data: T;\n  status: number;\n  headers: Record<string, string>;\n}\n\n/**\n * Options for individual API requests.\n */\nexport interface RequestOptions {\n  /** Request body as JSON-serializable object. */\n  json?: unknown;\n  /** Raw request body. */\n  body?: BodyInit | null;\n  /** Additional HTTP headers. */\n  headers?: Record<string, string>;\n  /** URL query parameters. */\n  query?: Record<string, string | number | boolean>;\n  /** AbortSignal for request cancellation. */\n  signal?: AbortSignal;\n  /** Request timeout in milliseconds (overrides client default). */\n  timeout?: number;\n  /** If true, returns full response with status and headers. */\n  fullResponse?: boolean;\n}\n\n/**\n * Options for constructing a SafeguardClient.\n */\nexport interface SafeguardClientOptions {\n  /** Authentication strategy. */\n  auth: import('./auth/types.js').Auth;\n  /** Custom CA certificate (PEM string or Buffer). Node.js only. */\n  ca?: string | Buffer;\n  /** Whether to verify TLS certificates. Default: true. */\n  verify?: boolean;\n  /** Safeguard API version prefix. Default: 'v4'. */\n  apiVersion?: string;\n  /** Request timeout in milliseconds. Default: 300_000 (5 min). */\n  timeout?: number;\n  /** Auto-refresh tokens before expiry. Default: true. */\n  autoRefresh?: boolean;\n}\n","/**\n * Error hierarchy for the Safeguard SDK.\n *\n * SafeguardError\n * ├── ApiError              (HTTP errors from Safeguard API)\n * │   ├── AuthenticationError  (401)\n * │   ├── AuthorizationError   (403)\n * │   └── NotFoundError        (404)\n * ├── TransportError        (Network/connection failures)\n * └── ConfigurationError    (Invalid client options)\n */\n\nexport class SafeguardError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'SafeguardError';\n  }\n}\n\nexport interface ApiErrorBody {\n  Code?: string;\n  Message?: string;\n  InnerError?: { Message?: string };\n  [key: string]: unknown;\n}\n\nexport class ApiError extends SafeguardError {\n  readonly status: number;\n  readonly body: ApiErrorBody | null;\n\n  constructor(message: string, status: number, body: ApiErrorBody | null = null, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'ApiError';\n    this.status = status;\n    this.body = body;\n  }\n\n  /**\n   * Creates an appropriate ApiError subclass based on HTTP status code.\n   */\n  static fromResponse(status: number, body: string | ApiErrorBody | null): ApiError {\n    const parsed = ApiError.parseBody(body);\n    const message = ApiError.buildMessage(status, parsed);\n\n    switch (status) {\n      case 401:\n        return new AuthenticationError(message, parsed);\n      case 403:\n        return new AuthorizationError(message, parsed);\n      case 404:\n        return new NotFoundError(message, parsed);\n      default:\n        return new ApiError(message, status, parsed);\n    }\n  }\n\n  private static parseBody(body: string | ApiErrorBody | null): ApiErrorBody | null {\n    if (body === null || body === undefined) return null;\n    if (typeof body === 'object') return body;\n    try {\n      return JSON.parse(body) as ApiErrorBody;\n    } catch {\n      return { Message: body };\n    }\n  }\n\n  private static buildMessage(status: number, body: ApiErrorBody | null): string {\n    const apiMessage = body?.Message ?? body?.InnerError?.Message;\n    if (apiMessage) {\n      return `HTTP ${String(status)}: ${apiMessage}`;\n    }\n    return `HTTP ${String(status)}`;\n  }\n}\n\nexport class AuthenticationError extends ApiError {\n  constructor(message: string, body: ApiErrorBody | null = null, options?: ErrorOptions) {\n    super(message, 401, body, options);\n    this.name = 'AuthenticationError';\n  }\n}\n\nexport class AuthorizationError extends ApiError {\n  constructor(message: string, body: ApiErrorBody | null = null, options?: ErrorOptions) {\n    super(message, 403, body, options);\n    this.name = 'AuthorizationError';\n  }\n}\n\nexport class NotFoundError extends ApiError {\n  constructor(message: string, body: ApiErrorBody | null = null, options?: ErrorOptions) {\n    super(message, 404, body, options);\n    this.name = 'NotFoundError';\n  }\n}\n\nexport class TransportError extends SafeguardError {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'TransportError';\n  }\n}\n\nexport class ConfigurationError extends SafeguardError {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'ConfigurationError';\n  }\n}\n","const REDACTED = '[REDACTED]';\n\n/**\n * A wrapper that prevents accidental logging of sensitive values.\n *\n * - `toString()` returns \"[REDACTED]\"\n * - `toJSON()` returns \"[REDACTED]\"\n * - `console.log(secretValue)` prints \"[REDACTED]\"\n * - `.expose()` returns the raw value when intentionally needed\n */\nexport class SecretValue {\n  readonly #value: string;\n\n  constructor(value: string) {\n    this.#value = value;\n  }\n\n  /** Returns the raw secret. Use only when you intentionally need the plaintext. */\n  expose(): string {\n    return this.#value;\n  }\n\n  toString(): string {\n    return REDACTED;\n  }\n\n  toJSON(): string {\n    return REDACTED;\n  }\n\n  /** Node.js custom inspect (prevents leaking in console.log / util.inspect). */\n  [Symbol.for('nodejs.util.inspect.custom')](): string {\n    return REDACTED;\n  }\n\n  get [Symbol.toStringTag](): string {\n    return 'SecretValue';\n  }\n}\n","import { Service } from './types.js';\nimport { ConfigurationError } from './errors.js';\n\n/**\n * Validates that a host string is a bare hostname or IP address.\n * Rejects URLs, paths, query strings, userinfo, and embedded ports.\n *\n * @throws {ConfigurationError} if the host contains disallowed characters\n */\nexport function validateHost(host: string): string {\n  if (!host) throw new ConfigurationError('Host must not be empty');\n\n  const trimmed = host.trim();\n  if (trimmed !== host) {\n    throw new ConfigurationError('Host must not contain leading or trailing whitespace');\n  }\n\n  // Reject protocol prefixes\n  if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(host)) {\n    throw new ConfigurationError(\n      `Host must be a bare hostname or IP, not a URL. Remove the protocol prefix (e.g., use \"${host.replace(/^[a-z][a-z0-9+.-]*:\\/\\//i, '')}\")`,\n    );\n  }\n\n  // Reject path, query, fragment, userinfo characters\n  if (/[/?#@]/.test(host)) {\n    throw new ConfigurationError(\n      'Host must be a bare hostname or IP address — must not contain /, ?, #, or @',\n    );\n  }\n\n  // Reject port suffix (e.g. \"host:8443\") — SDK always uses HTTPS/443\n  if (/:\\d+$/.test(host) && !host.startsWith('[')) {\n    throw new ConfigurationError(\n      'Host must not include a port number. The SDK always connects over HTTPS (port 443).',\n    );\n  }\n\n  return host;\n}\n\n/**\n * Builds the base URL for a Safeguard service endpoint.\n *\n * @example\n * buildServiceUrl('appliance.example.com', Service.CORE)\n * // => 'https://appliance.example.com/service/core/v4'\n */\nexport function buildServiceUrl(host: string, service: Service, apiVersion: string = 'v4'): string {\n  if (service === Service.RSTS) {\n    return `https://${host}/RSTS`;\n  }\n  return `https://${host}/service/${service}/${apiVersion}`;\n}\n\n/**\n * Builds a full API URL including path and optional query parameters.\n *\n * @example\n * buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq \"admin\"' })\n * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'\n */\nexport function buildRequestUrl(\n  host: string,\n  service: Service,\n  relativeUrl: string,\n  query?: Record<string, string | number | boolean>,\n  apiVersion: string = 'v4',\n): string {\n  const base = buildServiceUrl(host, service, apiVersion);\n  const path = relativeUrl.startsWith('/') ? relativeUrl.slice(1) : relativeUrl;\n  const url = new URL(`${base}/${path}`);\n\n  if (query) {\n    for (const [key, value] of Object.entries(query)) {\n      url.searchParams.set(key, String(value));\n    }\n  }\n\n  return url.toString();\n}\n\n/**\n * Encodes bytes to a URL-safe base64 string (no padding).\n */\nexport function base64UrlEncode(bytes: Uint8Array): string {\n  const binary = String.fromCharCode(...bytes);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/**\n * Generates a cryptographically random code verifier for PKCE.\n * Returns a 43-character base64url string (32 random bytes).\n */\nexport function generateCodeVerifier(): string {\n  const bytes = new Uint8Array(32);\n  crypto.getRandomValues(bytes);\n  return base64UrlEncode(bytes);\n}\n\n/**\n * Computes the S256 code challenge from a code verifier.\n * Uses Web Crypto API (available in Node 20+ and all modern browsers).\n */\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\n/**\n * Generates a random state parameter for OAuth flows.\n */\nexport function generateState(): string {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return base64UrlEncode(bytes);\n}\n\n/**\n * Extracts the `exp` claim from a JWT and returns expiresIn (seconds from now).\n * Returns undefined if the token is not a valid JWT or has no `exp` claim.\n */\nexport function getTokenExpiresIn(jwt: string): number | undefined {\n  try {\n    const parts = jwt.split('.');\n    if (parts.length !== 3) return undefined;\n    // Base64url decode the payload\n    const payload = parts[1]!.replace(/-/g, '+').replace(/_/g, '/');\n    const json = atob(payload);\n    const claims = JSON.parse(json) as { exp?: number };\n    if (typeof claims.exp !== 'number') return undefined;\n    const now = Math.floor(Date.now() / 1000);\n    return Math.max(0, claims.exp - now);\n  } catch {\n    return undefined;\n  }\n}\n","import type { StorageProvider } from './types.js';\n\n/**\n * In-memory storage provider. Default for Node.js environments.\n * Data does not persist across process restarts.\n */\nexport class MemoryStorage implements StorageProvider {\n  readonly #store = new Map<string, string>();\n\n  get(key: string): string | null {\n    return this.#store.get(key) ?? null;\n  }\n\n  set(key: string, value: string): void {\n    this.#store.set(key, value);\n  }\n\n  remove(key: string): void {\n    this.#store.delete(key);\n  }\n\n  clear(): void {\n    this.#store.clear();\n  }\n}\n","import type { StorageProvider } from './types.js';\n\n/**\n * Browser sessionStorage adapter. Data persists for the browser tab lifetime.\n * Requires a DOM environment (browser or jsdom).\n */\nexport class BrowserSessionStorage implements StorageProvider {\n  get(key: string): string | null {\n    return sessionStorage.getItem(key);\n  }\n\n  set(key: string, value: string): void {\n    sessionStorage.setItem(key, value);\n  }\n\n  remove(key: string): void {\n    sessionStorage.removeItem(key);\n  }\n\n  clear(): void {\n    sessionStorage.clear();\n  }\n}\n","/**\n * Interface for token/state storage backends.\n */\nexport interface StorageProvider {\n  get(key: string): string | null;\n  set(key: string, value: string): void;\n  remove(key: string): void;\n  clear(): void;\n}\n\n/** Well-known storage keys used by the SDK. */\nexport const StorageKeys = {\n  STATE: 'safeguard_state',\n  CODE_VERIFIER: 'safeguard_code_verifier',\n} as const;\n","import type { HttpClient, HttpRequestOptions, HttpResponse } from './types.js';\n\n/**\n * Browser HTTP client using native fetch API.\n * No TLS configuration needed — browser handles certificates.\n */\nexport class BrowserHttpClient implements HttpClient {\n  readonly #credentials: RequestCredentials;\n\n  constructor(options?: { credentials?: RequestCredentials }) {\n    this.#credentials = options?.credentials ?? 'include';\n  }\n\n  async request(options: HttpRequestOptions): Promise<HttpResponse> {\n    const { url, method, headers, body, signal, timeout } = options;\n\n    const requestInit: RequestInit = {\n      method,\n      credentials: this.#credentials,\n    };\n\n    if (headers) requestInit.headers = headers;\n    if (body != null) requestInit.body = body as BodyInit;\n    if (signal || timeout) {\n      const controller = new AbortController();\n      let timeoutId: ReturnType<typeof setTimeout> | undefined;\n\n      if (timeout) {\n        timeoutId = setTimeout(() => controller.abort(new Error('Request timed out')), timeout);\n      }\n\n      requestInit.signal = signal\n        ? AbortSignal.any([signal, controller.signal])\n        : controller.signal;\n\n      try {\n        return await this.#doFetch(url, requestInit);\n      } finally {\n        if (timeoutId !== undefined) clearTimeout(timeoutId);\n      }\n    }\n\n    return this.#doFetch(url, requestInit);\n  }\n\n  async #doFetch(url: string, init: RequestInit): Promise<HttpResponse> {\n    const response = await fetch(url, init);\n\n    const responseHeaders: Record<string, string> = {};\n    response.headers.forEach((value, key) => {\n      responseHeaders[key] = value;\n    });\n\n    const responseBody = await response.text();\n\n    return {\n      status: response.status,\n      headers: responseHeaders,\n      body: responseBody,\n    };\n  }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { getTokenExpiresIn } from '../utils.js';\n\nexport interface PasswordAuthOptions {\n  username: string;\n  password: string;\n  /** Identity provider name. Default: 'local'. */\n  provider?: string;\n}\n\n/**\n * Authenticates using username/password via RSTS Resource Owner grant.\n */\nexport class PasswordAuth implements Auth {\n  readonly #username: string;\n  readonly #password: SecretValue;\n  readonly #provider: string;\n\n  constructor(options: PasswordAuthOptions) {\n    if (!options.username) throw new ConfigurationError('PasswordAuth requires username');\n    if (!options.password) throw new ConfigurationError('PasswordAuth requires password');\n    if (!options.provider) throw new ConfigurationError('PasswordAuth requires provider');\n    this.#username = options.username;\n    this.#password = new SecretValue(options.password);\n    this.#provider = options.provider;\n  }\n\n  get description(): string {\n    return `PasswordAuth(${this.#username}@${this.#provider})`;\n  }\n\n  async authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n    // Step 1: Get RSTS token\n    const rstsToken = await this.#getRstsToken(host, httpClient);\n\n    // Step 2: Exchange RSTS token for Safeguard user token\n    const userToken = await this.#exchangeForUserToken(host, httpClient, rstsToken);\n\n    return userToken;\n  }\n\n  async refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null> {\n    // Password auth can always re-authenticate\n    return this.authenticate(host, httpClient, storage);\n  }\n\n  async #getRstsToken(host: string, httpClient: HttpClient): Promise<string> {\n    const body = JSON.stringify({\n      grant_type: 'password',\n      username: this.#username,\n      password: this.#password.expose(),\n      scope: 'rsts:sts:primaryproviderid:' + this.#provider.toLowerCase(),\n    });\n\n    const response = await httpClient.request({\n      url: `https://${host}/RSTS/oauth2/token`,\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body,\n    });\n\n    if (response.status !== 200) {\n      const { ApiError } = await import('../errors.js');\n      throw ApiError.fromResponse(response.status, response.body);\n    }\n\n    const data = JSON.parse(response.body) as { access_token: string };\n    return data.access_token;\n  }\n\n  async #exchangeForUserToken(host: string, httpClient: HttpClient, rstsToken: string): Promise<TokenSet> {\n    const response = await httpClient.request({\n      url: `https://${host}/service/core/v4/Token/LoginResponse`,\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${rstsToken}`,\n      },\n      body: JSON.stringify({ StsAccessToken: rstsToken }),\n    });\n\n    if (response.status !== 200) {\n      const { ApiError } = await import('../errors.js');\n      throw ApiError.fromResponse(response.status, response.body);\n    }\n\n    const data = JSON.parse(response.body) as { UserToken: string; ExpiresIn?: number };\n    const tokenSet: TokenSet = {\n      accessToken: new SecretValue(data.UserToken),\n      acquiredAt: Date.now(),\n    };\n    if (data.ExpiresIn != null) {\n      tokenSet.expiresIn = data.ExpiresIn;\n    } else {\n      const expiresIn = getTokenExpiresIn(data.UserToken);\n      if (expiresIn != null) tokenSet.expiresIn = expiresIn;\n    }\n    return tokenSet;\n  }\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\nimport { StorageKeys } from '../storage/types.js';\nimport { generateCodeVerifier, generateCodeChallenge, generateState } from '../utils.js';\n\nexport interface PkceAuthOptions {\n  /** OAuth redirect URI (must match RSTS configuration). */\n  redirectUri: string;\n  /** Identity provider name. Default: 'local'. */\n  provider?: string;\n}\n\n/**\n * Authenticates using PKCE (Proof Key for Code Exchange) with browser redirect.\n * For browser environments where the user is redirected to RSTS login.\n */\nexport class PkceAuth implements Auth {\n  readonly #redirectUri: string;\n  readonly #provider: string;\n\n  constructor(options: PkceAuthOptions) {\n    if (!options.redirectUri) throw new ConfigurationError('PkceAuth requires redirectUri');\n    if (!options.provider) throw new ConfigurationError('PkceAuth requires provider');\n    this.#redirectUri = options.redirectUri;\n    this.#provider = options.provider;\n  }\n\n  get description(): string {\n    return `PKCE(redirect=${this.#redirectUri})`;\n  }\n\n  /**\n   * Initiates the PKCE flow. If a stored authorization code exists (from callback),\n   * exchanges it for a token. Otherwise, redirects to RSTS login.\n   */\n  async authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet> {\n    // Check for authorization code (set by handlePkceCallback)\n    const code = storage.get('safeguard_auth_code');\n    if (code) {\n      const verifier = storage.get(StorageKeys.CODE_VERIFIER);\n      if (!verifier) {\n        throw new ConfigurationError('PKCE code verifier not found in storage');\n      }\n      storage.remove('safeguard_auth_code');\n      storage.remove(StorageKeys.CODE_VERIFIER);\n      storage.remove(StorageKeys.STATE);\n      return this.#exchangeCode(host, httpClient, code, verifier);\n    }\n\n    // No code — initiate redirect\n    await this.#initiateRedirect(host, storage);\n\n    // This point is never reached in a browser (redirect happens).\n    // For testability, throw rather than hang.\n    throw new ConfigurationError(\n      'PKCE redirect initiated. Call handlePkceCallback() on the callback page.',\n    );\n  }\n\n  async #initiateRedirect(host: string, storage: StorageProvider): Promise<void> {\n    const verifier = generateCodeVerifier();\n    const challenge = await generateCodeChallenge(verifier);\n    const state = generateState();\n\n    storage.set(StorageKeys.CODE_VERIFIER, verifier);\n    storage.set(StorageKeys.STATE, state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: 'safeguard.js',\n      redirect_uri: this.#redirectUri,\n      scope: 'rsts:sts:primaryproviderid:' + this.#provider,\n      code_challenge: challenge,\n      code_challenge_method: 'S256',\n      state,\n    });\n\n    const authUrl = `https://${host}/RSTS/Login?${params.toString()}`;\n\n    // In browser environment, redirect\n    if (typeof window !== 'undefined' && window.location) {\n      window.location.href = authUrl;\n    }\n  }\n\n  async #exchangeCode(\n    host: string,\n    httpClient: HttpClient,\n    code: string,\n    verifier: string,\n  ): Promise<TokenSet> {\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: this.#redirectUri,\n      client_id: 'safeguard.js',\n      code_verifier: verifier,\n    });\n\n    const response = await httpClient.request({\n      url: `https://${host}/RSTS/oauth2/token`,\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    });\n\n    if (response.status !== 200) {\n      const { ApiError } = await import('../errors.js');\n      throw ApiError.fromResponse(response.status, response.body);\n    }\n\n    const data = JSON.parse(response.body) as { access_token: string; expires_in?: number };\n\n    // Exchange RSTS token for Safeguard user token\n    const userTokenResponse = await httpClient.request({\n      url: `https://${host}/service/core/v4/Token/LoginResponse`,\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${data.access_token}`,\n      },\n      body: JSON.stringify({ StsAccessToken: data.access_token }),\n    });\n\n    if (userTokenResponse.status !== 200) {\n      const { ApiError } = await import('../errors.js');\n      throw ApiError.fromResponse(userTokenResponse.status, userTokenResponse.body);\n    }\n\n    const userData = JSON.parse(userTokenResponse.body) as { UserToken: string; ExpiresIn?: number };\n    const tokenSet: TokenSet = {\n      accessToken: new SecretValue(userData.UserToken),\n      acquiredAt: Date.now(),\n    };\n    if (userData.ExpiresIn != null) tokenSet.expiresIn = userData.ExpiresIn;\n\n    // Token stays in-memory only (SafeguardClient.#tokenSet). Not persisted to\n    // sessionStorage to avoid XSS exfiltration of high-privilege PAM tokens.\n    return tokenSet;\n  }\n}\n","import { StorageKeys } from '../storage/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport { ConfigurationError } from '../errors.js';\n\nexport interface PkceCallbackResult {\n  code: string;\n  state: string;\n}\n\n/**\n * Parses the PKCE callback URL and stores the authorization code.\n * Call this on the callback/redirect page to complete the PKCE flow.\n *\n * This is the explicit replacement for the legacy `safeguardJsAccessTokenChecker.js`\n * script that ran as a side-effect on import.\n *\n * @param storage - StorageProvider to persist the code\n * @param url - The callback URL to parse (defaults to window.location.href)\n * @returns The parsed code and state, or null if not a valid callback\n */\nexport function handlePkceCallback(\n  storage: StorageProvider,\n  url?: string,\n): PkceCallbackResult | null {\n  const callbackUrl = url ?? (typeof window !== 'undefined' ? window.location.href : '');\n  if (!callbackUrl) return null;\n\n  const parsed = new URL(callbackUrl);\n  const code = parsed.searchParams.get('code');\n  const state = parsed.searchParams.get('state');\n\n  if (!code || !state) return null;\n\n  // Validate state matches what we stored\n  const storedState = storage.get(StorageKeys.STATE);\n  if (storedState && storedState !== state) {\n    throw new ConfigurationError('PKCE state mismatch — possible CSRF attack');\n  }\n\n  // Store the code for the PkceAuth strategy to pick up\n  storage.set('safeguard_auth_code', code);\n\n  return { code, state };\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { ConfigurationError } from '../errors.js';\nimport { SecretValue } from '../secret.js';\n\nexport interface TokenAuthOptions {\n  /** Pre-existing Safeguard access token. */\n  accessToken: string;\n}\n\n/**\n * Uses a pre-existing access token. No authentication flow — the token is assumed valid.\n * Useful when tokens are obtained externally or for service-to-service scenarios.\n */\nexport class TokenAuth implements Auth {\n  readonly #accessToken: SecretValue;\n\n  constructor(options: TokenAuthOptions) {\n    if (!options.accessToken) throw new ConfigurationError('TokenAuth requires accessToken');\n    this.#accessToken = new SecretValue(options.accessToken);\n  }\n\n  get description(): string {\n    return 'TokenAuth(pre-existing)';\n  }\n\n  async authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n    return {\n      accessToken: this.#accessToken,\n      acquiredAt: Date.now(),\n    };\n  }\n\n  // No refresh possible with a pre-existing token\n}\n","import type { HttpClient } from '../http/types.js';\nimport type { StorageProvider } from '../storage/types.js';\nimport type { Auth, TokenSet } from './types.js';\nimport { SecretValue } from '../secret.js';\n\n/**\n * Anonymous authentication — no credentials.\n * Used for accessing public Safeguard endpoints (e.g., appliance status).\n */\nexport class AnonymousAuth implements Auth {\n  get description(): string {\n    return 'AnonymousAuth';\n  }\n\n  async authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet> {\n    return {\n      accessToken: new SecretValue(''),\n      acquiredAt: Date.now(),\n    };\n  }\n}\n","import { Service, HttpMethod } from './types.js';\nimport type { RequestOptions, SafeguardClientOptions } from './types.js';\nimport type { Auth, TokenSet } from './auth/types.js';\nimport type { HttpClient } from './http/types.js';\nimport type { StorageProvider } from './storage/types.js';\nimport { MemoryStorage } from './storage/memory.js';\nimport { buildRequestUrl, validateHost } from './utils.js';\nimport { AuthenticationError, ConfigurationError, ApiError } from './errors.js';\n\nconst DEFAULT_TIMEOUT = 300_000;\nconst DEFAULT_API_VERSION = 'v4';\nconst TOKEN_REFRESH_MARGIN_MS = 60_000; // refresh 60s before expiry\n\n/**\n * Main entry point for the Safeguard SDK.\n * Instance-based — no global state. Multiple clients to different appliances are supported.\n */\nexport class SafeguardClient {\n  readonly #host: string;\n  readonly #auth: Auth;\n  readonly #apiVersion: string;\n  readonly #timeout: number;\n  readonly #autoRefresh: boolean;\n  readonly #ca: string | Buffer | undefined;\n  readonly #verify: boolean;\n\n  #httpClient: HttpClient | undefined;\n  #storage: StorageProvider;\n  #tokenSet: TokenSet | undefined;\n  #connected = false;\n\n  constructor(host: string, options: SafeguardClientOptions) {\n    if (!host) throw new ConfigurationError('SafeguardClient requires a host');\n    if (!options.auth) throw new ConfigurationError('SafeguardClient requires an auth strategy');\n    this.#host = validateHost(host);\n    this.#auth = options.auth;\n    this.#apiVersion = options.apiVersion ?? DEFAULT_API_VERSION;\n    this.#timeout = options.timeout ?? DEFAULT_TIMEOUT;\n    this.#autoRefresh = options.autoRefresh !== false;\n    this.#ca = options.ca;\n    this.#verify = options.verify !== false;\n    this.#storage = new MemoryStorage();\n  }\n\n  /** The appliance hostname this client connects to. */\n  get host(): string {\n    return this.#host;\n  }\n\n  /** The API version prefix (e.g. 'v4'). */\n  get apiVersion(): string {\n    return this.#apiVersion;\n  }\n\n  /** Custom CA certificate, if provided. */\n  get ca(): string | Buffer | undefined {\n    return this.#ca;\n  }\n\n  /** Whether TLS verification is enabled. */\n  get verify(): boolean {\n    return this.#verify;\n  }\n\n  /** Whether the client has an active authenticated session. */\n  get isConnected(): boolean {\n    return this.#connected;\n  }\n\n  /**\n   * Sets a custom StorageProvider (e.g., BrowserSessionStorage).\n   * Must be called before connect().\n   */\n  setStorage(storage: StorageProvider): this {\n    this.#storage = storage;\n    return this;\n  }\n\n  /**\n   * Sets the HttpClient implementation. If not called, must be set before connect().\n   * The factory pattern allows platform-specific client injection:\n   *   - Node: `new NodeHttpClient({ ca, rejectUnauthorized })`\n   *   - Browser: `new BrowserHttpClient()`\n   */\n  setHttpClient(httpClient: HttpClient): this {\n    this.#httpClient = httpClient;\n    return this;\n  }\n\n  /**\n   * Authenticate and establish a session.\n   * @throws {AuthenticationError} if authentication fails\n   * @throws {ConfigurationError} if httpClient not set\n   */\n  async connect(): Promise<void> {\n    if (!this.#httpClient) {\n      throw new ConfigurationError(\n        'HttpClient not set. Call setHttpClient() before connect(), or use SafeguardClient.createNode() / SafeguardClient.createBrowser().',\n      );\n    }\n\n    this.#tokenSet = await this.#auth.authenticate(this.#host, this.#httpClient, this.#storage);\n    if (!this.#tokenSet.accessToken.expose()) {\n      throw new AuthenticationError('Authentication returned empty access token');\n    }\n    this.#connected = true;\n  }\n\n  /**\n   * Disconnect — dispose HTTP client and clear token.\n   */\n  async disconnect(): Promise<void> {\n    this.#tokenSet = undefined;\n    this.#connected = false;\n    this.#httpClient?.dispose?.();\n  }\n\n  /**\n   * Returns seconds until the current access token expires, or -1 if unknown.\n   */\n  getAccessTokenLifetimeRemaining(): number {\n    if (!this.#tokenSet?.expiresIn) return -1;\n    const elapsed = (Date.now() - this.#tokenSet.acquiredAt) / 1000;\n    return Math.max(0, this.#tokenSet.expiresIn - elapsed);\n  }\n\n  // ─── Convenience HTTP verbs ─────────────────────────────────────────\n\n  async get<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.GET, relativeUrl, options);\n  }\n\n  async post<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.POST, relativeUrl, options);\n  }\n\n  async put<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.PUT, relativeUrl, options);\n  }\n\n  async delete<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.DELETE, relativeUrl, options);\n  }\n\n  async patch<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T> {\n    return this.invoke<T>(service, HttpMethod.PATCH, relativeUrl, options);\n  }\n\n  // ─── Core invoke ────────────────────────────────────────────────────\n\n  /**\n   * Low-level request method. Convenience verbs delegate here.\n   *\n   * When `options.fullResponse` is true, returns SafeguardResponse<T> with status + headers.\n   * Otherwise returns just the parsed response body as T.\n   */\n  async invoke<T = unknown>(\n    service: Service,\n    method: HttpMethod,\n    relativeUrl: string,\n    options?: RequestOptions,\n  ): Promise<T> {\n    if (!this.#connected || !this.#httpClient) {\n      throw new ConfigurationError('Client not connected. Call connect() first.');\n    }\n\n    // Auto-refresh token if needed\n    if (this.#autoRefresh) {\n      await this.#ensureValidToken();\n    }\n\n    const url = buildRequestUrl(this.#host, service, relativeUrl, options?.query, this.#apiVersion);\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${this.#tokenSet!.accessToken.expose()}`,\n      Accept: 'application/json',\n      ...options?.headers,\n    };\n\n    let body: string | null = null;\n    if (options?.json != null) {\n      body = JSON.stringify(options.json);\n      headers['Content-Type'] = 'application/json';\n    } else if (options?.body != null) {\n      body = options.body as string;\n    }\n\n    const requestOpts: import('./http/types.js').HttpRequestOptions = {\n      url,\n      method,\n      headers,\n      body,\n      timeout: options?.timeout ?? this.#timeout,\n    };\n    if (options?.signal) requestOpts.signal = options.signal;\n\n    const response = await this.#httpClient.request(requestOpts);\n\n    if (response.status >= 400) {\n      throw ApiError.fromResponse(response.status, response.body);\n    }\n\n    const data = response.body ? (JSON.parse(response.body) as T) : (undefined as T);\n\n    if (options?.fullResponse) {\n      return { data, status: response.status, headers: response.headers } as unknown as T;\n    }\n\n    return data;\n  }\n\n  // ─── Private helpers ────────────────────────────────────────────────\n\n  async #ensureValidToken(): Promise<void> {\n    if (!this.#tokenSet) return;\n    if (!this.#tokenSet.expiresIn) return; // can't determine expiry\n\n    const elapsed = Date.now() - this.#tokenSet.acquiredAt;\n    const expiresInMs = this.#tokenSet.expiresIn * 1000;\n\n    if (elapsed + TOKEN_REFRESH_MARGIN_MS >= expiresInMs) {\n      // Token is expired or about to expire — refresh\n      if (this.#auth.refreshToken) {\n        const refreshed = await this.#auth.refreshToken(this.#host, this.#httpClient!, this.#storage);\n        if (refreshed) {\n          this.#tokenSet = refreshed;\n          return;\n        }\n      }\n      // No refresh support or refresh failed — re-authenticate\n      this.#tokenSet = await this.#auth.authenticate(this.#host, this.#httpClient!, this.#storage);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAGA,IAAY,UAAL,yBAAA,SAAA;CACL,QAAA,UAAA;CACA,QAAA,eAAA;CACA,QAAA,kBAAA;CACA,QAAA,SAAA;CACA,QAAA,WAAA;CACA,QAAA,UAAA;;AACF,EAAA,CAAA,CAAA;;;;AAKA,IAAY,aAAL,yBAAA,YAAA;CACL,WAAA,SAAA;CACA,WAAA,UAAA;CACA,WAAA,SAAA;CACA,WAAA,YAAA;CACA,WAAA,WAAA;;AACF,EAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;ACTA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AASA,IAAa,WAAb,MAAa,iBAAiB,eAAe;CAC3C;CACA;CAEA,YAAY,SAAiB,QAAgB,OAA4B,MAAM,SAAwB;EACrG,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,OAAO;CACd;;;;CAKA,OAAO,aAAa,QAAgB,MAA8C;EAChF,MAAM,SAAS,SAAS,UAAU,IAAI;EACtC,MAAM,UAAU,SAAS,aAAa,QAAQ,MAAM;EAEpD,QAAQ,QAAR;GACE,KAAK,KACH,OAAO,IAAI,oBAAoB,SAAS,MAAM;GAChD,KAAK,KACH,OAAO,IAAI,mBAAmB,SAAS,MAAM;GAC/C,KAAK,KACH,OAAO,IAAI,cAAc,SAAS,MAAM;GAC1C,SACE,OAAO,IAAI,SAAS,SAAS,QAAQ,MAAM;EAC/C;CACF;CAEA,OAAe,UAAU,MAAyD;EAChF,IAAI,SAAS,QAAQ,SAAS,KAAA,GAAW,OAAO;EAChD,IAAI,OAAO,SAAS,UAAU,OAAO;EACrC,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,OAAO,EAAE,SAAS,KAAK;EACzB;CACF;CAEA,OAAe,aAAa,QAAgB,MAAmC;EAC7E,MAAM,aAAa,MAAM,WAAW,MAAM,YAAY;EACtD,IAAI,YACF,OAAO,QAAQ,OAAO,MAAM,EAAE,IAAI;EAEpC,OAAO,QAAQ,OAAO,MAAM;CAC9B;AACF;AAEA,IAAa,sBAAb,cAAyC,SAAS;CAChD,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,SAAS;CAC/C,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,gBAAb,cAAmC,SAAS;CAC1C,YAAY,SAAiB,OAA4B,MAAM,SAAwB;EACrF,MAAM,SAAS,KAAK,MAAM,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,eAAe;CACjD,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,eAAe;CACrD,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;;AC5GA,MAAM,WAAW;;;;;;;;;AAUjB,IAAa,cAAb,MAAyB;CACvB;CAEA,YAAY,OAAe;EACzB,KAAKA,SAAS;CAChB;;CAGA,SAAiB;EACf,OAAO,KAAKA;CACd;CAEA,WAAmB;EACjB,OAAO;CACT;CAEA,SAAiB;EACf,OAAO;CACT;;CAGA,CAAC,OAAO,IAAI,4BAA4B,KAAa;EACnD,OAAO;CACT;CAEA,KAAK,OAAO,eAAuB;EACjC,OAAO;CACT;AACF;;;;;;;;;AC7BA,SAAgB,aAAa,MAAsB;CACjD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,wBAAwB;CAGhE,IADgB,KAAK,KACX,MAAM,MACd,MAAM,IAAI,mBAAmB,sDAAsD;CAIrF,IAAI,2BAA2B,KAAK,IAAI,GACtC,MAAM,IAAI,mBACR,yFAAyF,KAAK,QAAQ,4BAA4B,EAAE,EAAE,GACxI;CAIF,IAAI,SAAS,KAAK,IAAI,GACpB,MAAM,IAAI,mBACR,6EACF;CAIF,IAAI,QAAQ,KAAK,IAAI,KAAK,CAAC,KAAK,WAAW,GAAG,GAC5C,MAAM,IAAI,mBACR,qFACF;CAGF,OAAO;AACT;;;;;;;;AASA,SAAgB,gBAAgB,MAAc,SAAkB,aAAqB,MAAc;CACjG,IAAI,YAAA,QACF,OAAO,WAAW,KAAK;CAEzB,OAAO,WAAW,KAAK,WAAW,QAAQ,GAAG;AAC/C;;;;;;;;AASA,SAAgB,gBACd,MACA,SACA,aACA,OACA,aAAqB,MACb;CACR,MAAM,OAAO,gBAAgB,MAAM,SAAS,UAAU;CACtD,MAAM,OAAO,YAAY,WAAW,GAAG,IAAI,YAAY,MAAM,CAAC,IAAI;CAClE,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM;CAErC,IAAI,OACF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC7C,IAAI,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;CAI3C,OAAO,IAAI,SAAS;AACtB;;;;AAKA,SAAgB,gBAAgB,OAA2B;CACzD,MAAM,SAAS,OAAO,aAAa,GAAG,KAAK;CAC3C,OAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;;;;;AAMA,SAAgB,uBAA+B;CAC7C,MAAM,QAAQ,IAAI,WAAW,EAAE;CAC/B,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,KAAK;AAC9B;;;;;AAMA,eAAsB,sBAAsB,UAAmC;CAE7E,MAAM,OAAO,IADO,YACD,EAAE,OAAO,QAAQ;CACpC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CACzD,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;;;;AAKA,SAAgB,gBAAwB;CACtC,MAAM,QAAQ,IAAI,WAAW,EAAE;CAC/B,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,KAAK;AAC9B;;;;;AAMA,SAAgB,kBAAkB,KAAiC;CACjE,IAAI;EACF,MAAM,QAAQ,IAAI,MAAM,GAAG;EAC3B,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;EAE/B,MAAM,UAAU,MAAM,GAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;EAC9D,MAAM,OAAO,KAAK,OAAO;EACzB,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAI,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;EAC3C,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,GAAG;CACrC,QAAQ;EACN;CACF;AACF;;;;;;;ACpIA,IAAa,gBAAb,MAAsD;CACpD,yBAAkB,IAAI,IAAoB;CAE1C,IAAI,KAA4B;EAC9B,OAAO,KAAKC,OAAO,IAAI,GAAG,KAAK;CACjC;CAEA,IAAI,KAAa,OAAqB;EACpC,KAAKA,OAAO,IAAI,KAAK,KAAK;CAC5B;CAEA,OAAO,KAAmB;EACxB,KAAKA,OAAO,OAAO,GAAG;CACxB;CAEA,QAAc;EACZ,KAAKA,OAAO,MAAM;CACpB;AACF;;;;;;;AClBA,IAAa,wBAAb,MAA8D;CAC5D,IAAI,KAA4B;EAC9B,OAAO,eAAe,QAAQ,GAAG;CACnC;CAEA,IAAI,KAAa,OAAqB;EACpC,eAAe,QAAQ,KAAK,KAAK;CACnC;CAEA,OAAO,KAAmB;EACxB,eAAe,WAAW,GAAG;CAC/B;CAEA,QAAc;EACZ,eAAe,MAAM;CACvB;AACF;;;;ACXA,MAAa,cAAc;CACzB,OAAO;CACP,eAAe;AACjB;;;;;;;ACRA,IAAa,oBAAb,MAAqD;CACnD;CAEA,YAAY,SAAgD;EAC1D,KAAKC,eAAe,SAAS,eAAe;CAC9C;CAEA,MAAM,QAAQ,SAAoD;EAChE,MAAM,EAAE,KAAK,QAAQ,SAAS,MAAM,QAAQ,YAAY;EAExD,MAAM,cAA2B;GAC/B;GACA,aAAa,KAAKA;EACpB;EAEA,IAAI,SAAS,YAAY,UAAU;EACnC,IAAI,QAAQ,MAAM,YAAY,OAAO;EACrC,IAAI,UAAU,SAAS;GACrB,MAAM,aAAa,IAAI,gBAAgB;GACvC,IAAI;GAEJ,IAAI,SACF,YAAY,iBAAiB,WAAW,sBAAM,IAAI,MAAM,mBAAmB,CAAC,GAAG,OAAO;GAGxF,YAAY,SAAS,SACjB,YAAY,IAAI,CAAC,QAAQ,WAAW,MAAM,CAAC,IAC3C,WAAW;GAEf,IAAI;IACF,OAAO,MAAM,KAAKC,SAAS,KAAK,WAAW;GAC7C,UAAU;IACR,IAAI,cAAc,KAAA,GAAW,aAAa,SAAS;GACrD;EACF;EAEA,OAAO,KAAKA,SAAS,KAAK,WAAW;CACvC;CAEA,MAAMA,SAAS,KAAa,MAA0C;EACpE,MAAM,WAAW,MAAM,MAAM,KAAK,IAAI;EAEtC,MAAM,kBAA0C,CAAC;EACjD,SAAS,QAAQ,SAAS,OAAO,QAAQ;GACvC,gBAAgB,OAAO;EACzB,CAAC;EAED,MAAM,eAAe,MAAM,SAAS,KAAK;EAEzC,OAAO;GACL,QAAQ,SAAS;GACjB,SAAS;GACT,MAAM;EACR;CACF;AACF;;;;;;AC5CA,IAAa,eAAb,MAA0C;CACxC;CACA;CACA;CAEA,YAAY,SAA8B;EACxC,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,gCAAgC;EACpF,KAAKC,YAAY,QAAQ;EACzB,KAAKC,YAAY,IAAI,YAAY,QAAQ,QAAQ;EACjD,KAAKC,YAAY,QAAQ;CAC3B;CAEA,IAAI,cAAsB;EACxB,OAAO,gBAAgB,KAAKF,UAAU,GAAG,KAAKE,UAAU;CAC1D;CAEA,MAAM,aAAa,MAAc,YAAwB,UAA8C;EAErG,MAAM,YAAY,MAAM,KAAKC,cAAc,MAAM,UAAU;EAK3D,OAAO,MAFiB,KAAKC,sBAAsB,MAAM,YAAY,SAAS;CAGhF;CAEA,MAAM,aAAa,MAAc,YAAwB,SAAoD;EAE3G,OAAO,KAAK,aAAa,MAAM,YAAY,OAAO;CACpD;CAEA,MAAMD,cAAc,MAAc,YAAyC;EACzE,MAAM,OAAO,KAAK,UAAU;GAC1B,YAAY;GACZ,UAAU,KAAKH;GACf,UAAU,KAAKC,UAAU,OAAO;GAChC,OAAO,gCAAgC,KAAKC,UAAU,YAAY;EACpE,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C;EACF,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,EAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAGA,OADa,KAAK,MAAM,SAAS,IACvB,EAAE;CACd;CAEA,MAAME,sBAAsB,MAAc,YAAwB,WAAsC;EACtG,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU;GAC3B;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,UAAU,CAAC;EACpD,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,EAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EACrC,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,KAAK,SAAS;GAC3C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,KAAK,aAAa,MACpB,SAAS,YAAY,KAAK;OACrB;GACL,MAAM,YAAY,kBAAkB,KAAK,SAAS;GAClD,IAAI,aAAa,MAAM,SAAS,YAAY;EAC9C;EACA,OAAO;CACT;AACF;;;;;;;ACpFA,IAAa,WAAb,MAAsC;CACpC;CACA;CAEA,YAAY,SAA0B;EACpC,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,mBAAmB,+BAA+B;EACtF,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,mBAAmB,4BAA4B;EAChF,KAAKC,eAAe,QAAQ;EAC5B,KAAKC,YAAY,QAAQ;CAC3B;CAEA,IAAI,cAAsB;EACxB,OAAO,iBAAiB,KAAKD,aAAa;CAC5C;;;;;CAMA,MAAM,aAAa,MAAc,YAAwB,SAA6C;EAEpG,MAAM,OAAO,QAAQ,IAAI,qBAAqB;EAC9C,IAAI,MAAM;GACR,MAAM,WAAW,QAAQ,IAAI,YAAY,aAAa;GACtD,IAAI,CAAC,UACH,MAAM,IAAI,mBAAmB,yCAAyC;GAExE,QAAQ,OAAO,qBAAqB;GACpC,QAAQ,OAAO,YAAY,aAAa;GACxC,QAAQ,OAAO,YAAY,KAAK;GAChC,OAAO,KAAKE,cAAc,MAAM,YAAY,MAAM,QAAQ;EAC5D;EAGA,MAAM,KAAKC,kBAAkB,MAAM,OAAO;EAI1C,MAAM,IAAI,mBACR,0EACF;CACF;CAEA,MAAMA,kBAAkB,MAAc,SAAyC;EAC7E,MAAM,WAAW,qBAAqB;EACtC,MAAM,YAAY,MAAM,sBAAsB,QAAQ;EACtD,MAAM,QAAQ,cAAc;EAE5B,QAAQ,IAAI,YAAY,eAAe,QAAQ;EAC/C,QAAQ,IAAI,YAAY,OAAO,KAAK;EAYpC,MAAM,UAAU,WAAW,KAAK,cAAc,IAV3B,gBAAgB;GACjC,eAAe;GACf,WAAW;GACX,cAAc,KAAKH;GACnB,OAAO,gCAAgC,KAAKC;GAC5C,gBAAgB;GAChB,uBAAuB;GACvB;EACF,CAEmD,EAAE,SAAS;EAG9D,IAAI,OAAO,WAAW,eAAe,OAAO,UAC1C,OAAO,SAAS,OAAO;CAE3B;CAEA,MAAMC,cACJ,MACA,YACA,MACA,UACmB;EACnB,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ;GACA,cAAc,KAAKF;GACnB,WAAW;GACX,eAAe;EACjB,CAAC;EAED,MAAM,WAAW,MAAM,WAAW,QAAQ;GACxC,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,KAAK,SAAS;EACtB,CAAC;EAED,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,EAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAC5D;EAEA,MAAM,OAAO,KAAK,MAAM,SAAS,IAAI;EAGrC,MAAM,oBAAoB,MAAM,WAAW,QAAQ;GACjD,KAAK,WAAW,KAAK;GACrB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,eAAe,UAAU,KAAK;GAChC;GACA,MAAM,KAAK,UAAU,EAAE,gBAAgB,KAAK,aAAa,CAAC;EAC5D,CAAC;EAED,IAAI,kBAAkB,WAAW,KAAK;GACpC,MAAM,EAAE,aAAa,MAAA,QAAA,QAAA,EAAA,WAAA,cAAA;GACrB,MAAM,SAAS,aAAa,kBAAkB,QAAQ,kBAAkB,IAAI;EAC9E;EAEA,MAAM,WAAW,KAAK,MAAM,kBAAkB,IAAI;EAClD,MAAM,WAAqB;GACzB,aAAa,IAAI,YAAY,SAAS,SAAS;GAC/C,YAAY,KAAK,IAAI;EACvB;EACA,IAAI,SAAS,aAAa,MAAM,SAAS,YAAY,SAAS;EAI9D,OAAO;CACT;AACF;;;;;;;;;;;;;;AC3HA,SAAgB,mBACd,SACA,KAC2B;CAC3B,MAAM,cAAc,QAAQ,OAAO,WAAW,cAAc,OAAO,SAAS,OAAO;CACnF,IAAI,CAAC,aAAa,OAAO;CAEzB,MAAM,SAAS,IAAI,IAAI,WAAW;CAClC,MAAM,OAAO,OAAO,aAAa,IAAI,MAAM;CAC3C,MAAM,QAAQ,OAAO,aAAa,IAAI,OAAO;CAE7C,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO;CAG5B,MAAM,cAAc,QAAQ,IAAI,YAAY,KAAK;CACjD,IAAI,eAAe,gBAAgB,OACjC,MAAM,IAAI,mBAAmB,4CAA4C;CAI3E,QAAQ,IAAI,uBAAuB,IAAI;CAEvC,OAAO;EAAE;EAAM;CAAM;AACvB;;;;;;;AC5BA,IAAa,YAAb,MAAuC;CACrC;CAEA,YAAY,SAA2B;EACrC,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,mBAAmB,gCAAgC;EACvF,KAAKI,eAAe,IAAI,YAAY,QAAQ,WAAW;CACzD;CAEA,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aAAa,OAAe,aAAyB,UAA8C;EACvG,OAAO;GACL,aAAa,KAAKA;GAClB,YAAY,KAAK,IAAI;EACvB;CACF;AAGF;;;;;;;AC1BA,IAAa,gBAAb,MAA2C;CACzC,IAAI,cAAsB;EACxB,OAAO;CACT;CAEA,MAAM,aAAa,OAAe,aAAyB,UAA8C;EACvG,OAAO;GACL,aAAa,IAAI,YAAY,EAAE;GAC/B,YAAY,KAAK,IAAI;EACvB;CACF;AACF;;;ACXA,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;;;;;AAMhC,IAAa,kBAAb,MAA6B;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA,aAAa;CAEb,YAAY,MAAc,SAAiC;EACzD,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB,iCAAiC;EACzE,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI,mBAAmB,2CAA2C;EAC3F,KAAKC,QAAQ,aAAa,IAAI;EAC9B,KAAKC,QAAQ,QAAQ;EACrB,KAAKC,cAAc,QAAQ,cAAc;EACzC,KAAKC,WAAW,QAAQ,WAAW;EACnC,KAAKC,eAAe,QAAQ,gBAAgB;EAC5C,KAAKC,MAAM,QAAQ;EACnB,KAAKC,UAAU,QAAQ,WAAW;EAClC,KAAKC,WAAW,IAAI,cAAc;CACpC;;CAGA,IAAI,OAAe;EACjB,OAAO,KAAKP;CACd;;CAGA,IAAI,aAAqB;EACvB,OAAO,KAAKE;CACd;;CAGA,IAAI,KAAkC;EACpC,OAAO,KAAKG;CACd;;CAGA,IAAI,SAAkB;EACpB,OAAO,KAAKC;CACd;;CAGA,IAAI,cAAuB;EACzB,OAAO,KAAKE;CACd;;;;;CAMA,WAAW,SAAgC;EACzC,KAAKD,WAAW;EAChB,OAAO;CACT;;;;;;;CAQA,cAAc,YAA8B;EAC1C,KAAKE,cAAc;EACnB,OAAO;CACT;;;;;;CAOA,MAAM,UAAyB;EAC7B,IAAI,CAAC,KAAKA,aACR,MAAM,IAAI,mBACR,mIACF;EAGF,KAAKC,YAAY,MAAM,KAAKT,MAAM,aAAa,KAAKD,OAAO,KAAKS,aAAa,KAAKF,QAAQ;EAC1F,IAAI,CAAC,KAAKG,UAAU,YAAY,OAAO,GACrC,MAAM,IAAI,oBAAoB,4CAA4C;EAE5E,KAAKF,aAAa;CACpB;;;;CAKA,MAAM,aAA4B;EAChC,KAAKE,YAAY,KAAA;EACjB,KAAKF,aAAa;EAClB,KAAKC,aAAa,UAAU;CAC9B;;;;CAKA,kCAA0C;EACxC,IAAI,CAAC,KAAKC,WAAW,WAAW,OAAO;EACvC,MAAM,WAAW,KAAK,IAAI,IAAI,KAAKA,UAAU,cAAc;EAC3D,OAAO,KAAK,IAAI,GAAG,KAAKA,UAAU,YAAY,OAAO;CACvD;CAIA,MAAM,IAAiB,SAAkB,aAAqB,SAAsC;EAClG,OAAO,KAAK,OAAU,SAAA,OAAyB,aAAa,OAAO;CACrE;CAEA,MAAM,KAAkB,SAAkB,aAAqB,SAAsC;EACnG,OAAO,KAAK,OAAU,SAAA,QAA0B,aAAa,OAAO;CACtE;CAEA,MAAM,IAAiB,SAAkB,aAAqB,SAAsC;EAClG,OAAO,KAAK,OAAU,SAAA,OAAyB,aAAa,OAAO;CACrE;CAEA,MAAM,OAAoB,SAAkB,aAAqB,SAAsC;EACrG,OAAO,KAAK,OAAU,SAAA,UAA4B,aAAa,OAAO;CACxE;CAEA,MAAM,MAAmB,SAAkB,aAAqB,SAAsC;EACpG,OAAO,KAAK,OAAU,SAAA,SAA2B,aAAa,OAAO;CACvE;;;;;;;CAUA,MAAM,OACJ,SACA,QACA,aACA,SACY;EACZ,IAAI,CAAC,KAAKF,cAAc,CAAC,KAAKC,aAC5B,MAAM,IAAI,mBAAmB,6CAA6C;EAI5E,IAAI,KAAKL,cACP,MAAM,KAAKO,kBAAkB;EAG/B,MAAM,MAAM,gBAAgB,KAAKX,OAAO,SAAS,aAAa,SAAS,OAAO,KAAKE,WAAW;EAC9F,MAAM,UAAkC;GACtC,eAAe,UAAU,KAAKQ,UAAW,YAAY,OAAO;GAC5D,QAAQ;GACR,GAAG,SAAS;EACd;EAEA,IAAI,OAAsB;EAC1B,IAAI,SAAS,QAAQ,MAAM;GACzB,OAAO,KAAK,UAAU,QAAQ,IAAI;GAClC,QAAQ,kBAAkB;EAC5B,OAAO,IAAI,SAAS,QAAQ,MAC1B,OAAO,QAAQ;EAGjB,MAAM,cAA4D;GAChE;GACA;GACA;GACA;GACA,SAAS,SAAS,WAAW,KAAKP;EACpC;EACA,IAAI,SAAS,QAAQ,YAAY,SAAS,QAAQ;EAElD,MAAM,WAAW,MAAM,KAAKM,YAAY,QAAQ,WAAW;EAE3D,IAAI,SAAS,UAAU,KACrB,MAAM,SAAS,aAAa,SAAS,QAAQ,SAAS,IAAI;EAG5D,MAAM,OAAO,SAAS,OAAQ,KAAK,MAAM,SAAS,IAAI,IAAW,KAAA;EAEjE,IAAI,SAAS,cACX,OAAO;GAAE;GAAM,QAAQ,SAAS;GAAQ,SAAS,SAAS;EAAQ;EAGpE,OAAO;CACT;CAIA,MAAME,oBAAmC;EACvC,IAAI,CAAC,KAAKD,WAAW;EACrB,IAAI,CAAC,KAAKA,UAAU,WAAW;EAE/B,MAAM,UAAU,KAAK,IAAI,IAAI,KAAKA,UAAU;EAC5C,MAAM,cAAc,KAAKA,UAAU,YAAY;EAE/C,IAAI,UAAU,2BAA2B,aAAa;GAEpD,IAAI,KAAKT,MAAM,cAAc;IAC3B,MAAM,YAAY,MAAM,KAAKA,MAAM,aAAa,KAAKD,OAAO,KAAKS,aAAc,KAAKF,QAAQ;IAC5F,IAAI,WAAW;KACb,KAAKG,YAAY;KACjB;IACF;GACF;GAEA,KAAKA,YAAY,MAAM,KAAKT,MAAM,aAAa,KAAKD,OAAO,KAAKS,aAAc,KAAKF,QAAQ;EAC7F;CACF;AACF"}

package/dist/{index-ir5Qeequ.d.ts → index-53AwvPfY.d.ts}

@@ -238,17 +238,17 @@ declare function validateHost(host: string): string;
  *
  * @example
  * buildServiceUrl('appliance.example.com', Service.CORE)
- * // => 'https://appliance.example.com/service/core'
+ * // => 'https://appliance.example.com/service/core/v4'
  */
-declare function buildServiceUrl(host: string, service: Service): string;
+declare function buildServiceUrl(host: string, service: Service, apiVersion?: string): string;
 /**
  * Builds a full API URL including path and optional query parameters.
  *
  * @example
- * buildRequestUrl('appliance.example.com', Service.CORE, 'v4/Users', { filter: 'Name eq "admin"' })
+ * buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq "admin"' })
  * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'
  */
-declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>): string;
+declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>, apiVersion?: string): string;
 /**
  * Encodes bytes to a URL-safe base64 string (no padding).
  */
@@ -600,6 +600,8 @@ interface A2AClientOptions {
   ca?: string | Buffer;
   /** Whether to verify TLS. Default: true. */
   verify?: boolean;
+  /** API version string (default: 'v4'). */
+  apiVersion?: string;
 }
 /**
  * Application-to-Application client for programmatic credential retrieval.
@@ -665,4 +667,4 @@ declare class A2AClient {
 }
 //#endregion
 export { A2AClient, type A2AClientOptions, AnonymousAuth, ApiError, type ApiErrorBody, type Auth, AuthenticationError, AuthorizationError, type BrokeredAccessRequest, BrokeredAccessRequestType, type BrokeredAccessResponse, BrowserHttpClient, BrowserSessionStorage, CertificateAuth, type CertificateAuthOptions, ConfigurationError, type HttpClient, HttpMethod, type HttpRequestOptions, type HttpResponse, MemoryStorage, NodeHttpClient, NotFoundError, PasswordAuth, type PasswordAuthOptions, PkceAuth, type PkceAuthOptions, type PkceCallbackResult, PkceNonInteractiveAuth, type PkceNonInteractiveAuthOptions, type RequestOptions, type RetrievableAccount, SafeguardClient, type SafeguardClientOptions, SafeguardError, type SafeguardResponse, SecretValue, Service, SshKeyFormat, StorageKeys, type StorageProvider, type TlsOptions, TokenAuth, type TokenAuthOptions, type TokenSet, TransportError, base64UrlEncode, buildRequestUrl, buildServiceUrl, generateCodeChallenge, generateCodeVerifier, generateState, handlePkceCallback, validateHost };
-//# sourceMappingURL=index-ir5Qeequ.d.ts.map
+//# sourceMappingURL=index-53AwvPfY.d.ts.map

package/dist/index-53AwvPfY.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-53AwvPfY.d.ts","names":[],"sources":["../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/types.ts","../src/errors.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/http/node.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/certificate.ts","../src/auth/pkce.ts","../src/auth/pkce-noninteractive.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts","../src/a2a/types.ts","../src/a2a/index.ts"],"mappings":";;AAIA;;AAGY,UAHK,kBAAA,CAGL;KACM,EAAA,MAAA;QACP,EAAA,MAAA;EAAW,OAAA,CAAA,EAFV,MAEU,CAAA,MAAA,EAAA,MAAA,CAAA;EAIL,IAAA,CAAA,EAAA,MAAA,GALC,MAKW,GAAA,IAElB;EAIM,MAAA,CAAA,EAVN,WAUgB;EAAA,OAAA,CAAA,EAAA,MAAA;;AAIT,UAVD,YAAA,CAUC;QAED,EAAA,MAAA;EAAM,OAAA,EAVZ,MAUY,CAAA,MAAA,EAAA,MAAA,CAAA;EAWN,IAAA,EAAA,MAAA;;AACE,UAlBF,UAAA,CAkBE;;KAAqB,EAAA,MAAA,GAhBxB,MAgBwB;EAAO;kBAd7B;;iBAED;ECtBA;EAQJ,UAAA,CAAA,EAAA,MAGH;;;;ACJV;;;;ACHiB,UH6BA,UAAA,CG3BF;EAUE,OAAI,CAAA,OAAA,EHkBF,kBGlBE,CAAA,EHkBmB,OGlBnB,CHkB2B,YGlB3B,CAAA;EAAA,OAAA,GAAA,EAAA,IAAA;;;;;;AHfrB;;AAGY,UCJK,eAAA,CDIL;KACM,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;KACP,CAAA,GAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAW,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAIL,KAAA,EAAA,EAAA,IAAA;AAMjB;;AAEgB,cCVH,WDUG,EAAA;WAEE,KAAA,EAAA,iBAAA;WAED,aAAA,EAAA,yBAAA;AAAM,CAAA;AAWvB;;;;AAhCA;;;;;AAKsB;AAItB;AAMiB,cETJ,WAAA,CFSc;EAAA,CAAA,OAAA;aAEX,CAAA,KAAA,EAAA,MAAA;;QAIC,CAAA,CAAA,EAAA,MAAA;EAAM,QAAA,CAAA,CAAA,EAAA,MAAA;EAWN,MAAA,CAAA,CAAA,EAAA,MAAU;EAAA,KEDpB,MAAA,CAAO,WAAW,GFCE,EAAA,MAAA;;;;;;;;AA3BL,UGFL,QAAA,CHEK;EAIL;EAMA,WAAA,EGVF,WHUY;EAAA;WAEX,CAAA,EAAA,MAAA;;YAIC,EAAA,MAAA;AAAM;AAWvB;;;AACgD,UGlB/B,IAAA,CHkB+B;;AAAD;;;;AClC/C;EAQa,YAAA,CAAA,IAGH,EAAA,MAAA,EAAA,UAAA,EEY+B,UFZ/B,EAAA,OAAA,EEYoD,eFZpD,CAAA,EEYsE,OFZtE,CEY8E,QFZ9E,CAAA;;;;ECJG,YAAA,EAAW,IAAA,EAAA,MAyBjB,EAAA,UAAO,ECJ4B,UDIjB,EAAA,OAAA,ECJsC,eDItC,CAAA,ECJwD,ODIxD,CCJgE,QDIhE,GAAA,IAAA,CAAA;;;;AC5BzB;;;;AHHA;;AAGY,aIJA,OAAA;MJKM,GAAA,MAAA;WACP,GAAA,WAAA;EAAW,YAAA,GAAA,cAAA;EAIL,GAAA,GAAA,KAAA;EAMA,KAAA,GAAA,OAAU;EAAA,IAAA,GAAA,MAAA;;;;AAMJ;AAWN,aIrBL,UAAA;EJqBe,GAAA,GAAA,KAAA;MACR,GAAA,MAAA;KAA6B,GAAA,KAAA;QAAR,GAAA,QAAA;EAAO,KAAA,GAAA,OAAA;;;;AClC/C;AAQa,UGeI,iBHZP,CAAA,IAAA,OAAA,CAAA,CAAA;QGaF;;WAEG;AFnBX;;;;ACHiB,UC4BA,cAAA,CD1BF;EAUE;EAAI,IAAA,CAAA,EAAA,OAAA;;MAOyC,CAAA,ECarD,QDbqD,GAAA,IAAA;;SAAkB,CAAA,ECepE,MDfoE,CAAA,MAAA,EAAA,MAAA,CAAA;;OAKjB,CAAA,ECYrD,MDZqD,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA;;QAAkB,CAAA,ECctE,WDdsE;EAAO;;;;AC5BxF;AAYA;AAWA;;AACQ,UA4BS,sBAAA,CA5BT;;EAES,IAAA,EA0BsB,IA1BtB;EAMA;EAAc,EAAA,CAAA,EAAA,MAAA,GAwBf,MAxBe;;QAMnB,CAAA,EAAA,OAAA;;YAID,CAAA,EAAA,MAAA;EAAW;EAUL,OAAA,CAAA,EAAA,MAAA;EAAsB;aAAA,CAAA,EAAA,OAAA;;AAIjB;;;;AJvDtB;;;;;AAKsB;AAItB;AAMA;;;AAIkB,cKXL,cAAA,SAAuB,KAAA,CLWlB;aAED,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EKZwB,YLYxB;AAAM;AAWN,UKjBA,YAAA,CLiBU;EAAA,IAAA,CAAA,EAAA,MAAA;SACR,CAAA,EAAA,MAAA;YAA6B,CAAA,EAAA;IAAR,OAAA,CAAA,EAAA,MAAA;EAAO,CAAA;;;cKXlC,QAAA,SAAiB,cAAA;EJvBb,SAAA,MAAA,EAAA,MAAe;EAQnB,SAAA,IAAA,EIiBI,YJdP,GAAA,IAAA;sDIgB2C,+BAAsC;;;AHpB3F;qDG8BqD,sBAAsB;;;AFjC3E;AAYiB,cEwDJ,mBAAA,SAA4B,QAAA,CFxDpB;EAAA,WAAA,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EEyDgB,YFzDhB,GAAA,IAAA,EAAA,OAAA,CAAA,EEyDsD,YFzDtD;;AAOyC,cEwDjD,kBAAA,SAA2B,QAAA,CFxDsB;aAA0B,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EEyDnD,YFzDmD,GAAA,IAAA,EAAA,OAAA,CAAA,EEyDb,YFzDa;;AAK9C,cE0D7B,aAAA,SAAsB,QAAA,CF1DO;aAAqB,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EE2D1B,YF3D0B,GAAA,IAAA,EAAA,OAAA,CAAA,EE2DY,YF3DZ;;AAAkB,cEiEpE,cAAA,SAAuB,cAAA,CFjE6C;EAAO,WAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EEkE/C,YFlE+C;;cEwE3E,kBAAA,SAA2B,cAAA;yCACC;ADrGzC;AAYA;;;AJXA;;;;;AAKsB;AAIL,iBMJD,YAAA,CNMC,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAIjB;;;;;AAMuB;AAWvB;AAA2B,iBMYX,eAAA,CNZW,IAAA,EAAA,MAAA,EAAA,OAAA,EMY4B,ONZ5B,EAAA,UAAA,CAAA,EAAA,MAAA,CAAA,EAAA,MAAA;;;;AACoB;;;;AClC9B,iBK2DD,eAAA,CL3DgB,IAAA,EAAA,MAAA,EAAA,OAAA,EK6DrB,OL7DqB,EAAA,WAAA,EAAA,MAAA,EAAA,KAAA,CAAA,EK+DtB,ML/DsB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,EAAA,UAAA,CAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAQhC;;;iBK0EgB,eAAA,QAAuB;AJ3EvC;;;;ACHiB,iBGuFD,oBAAA,CAAA,CHrFU,EAAA,MAAA;AAU1B;;;;AAOwF,iBG8ElE,qBAAA,CH9EkE,QAAA,EAAA,MAAA,CAAA,EG8EzB,OH9EyB,CAAA,MAAA,CAAA;;;;AAKC,iBGmFzE,aAAA,CAAA,CHnFyE,EAAA,MAAA;;AAAD;;;;;AH3BxF;;;;AAKW,cOHE,aAAA,YAAyB,ePG3B,CAAA;EAAW,CAAA,OAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,CAAA,EAAA,MAAA,GAElB,IAAA;EAIM,GAAA,CAAA,GAAA,EAAA,MAAU,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAA,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OAEX,CAAA,CAAA,EAAA,IAAA;;;;;AAjBhB;;;;AAKW,cQHE,qBAAA,YAAiC,eRGnC,CAAA;EAAW,GAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,EAAA,KAAA,EAAA,MAElB,CAAA,EAAM,IAAA;EAIA,MAAA,CAAA,GAAA,EAAA,MAAU,CAAA,EAAA,IAAA;EAAA,KAAA,CAAA,CAAA,EAAA,IAAA;;;;;AAf3B;;;;AAKW,cSFE,cAAA,YAA0B,UTE5B,CAAA;EAAW,CAAA,OAAA;EAIL,WAAA,CAAA,UAEA,CAFY,ESHF,UTKV;EAIA,OAAA,CAAA,OAAU,ESGF,kBTHE,CAAA,ESGmB,OTHnB,CSG2B,YTH3B,CAAA;EAAA,OAAA,CAAA,CAAA,EAAA,IAAA;;;;;AAf3B;;;;AAKW,cUHE,iBAAA,YAA6B,UVG/B,CAAA;EAAW,CAAA,OAAA;EAIL,WAAA,CAAA,OAMU,CANE,EAAA;IAMZ,WAAU,CAAA,EUVa,kBVUb;EAAA,CAAA;SAEX,CAAA,OAAA,EURS,kBVQT,CAAA,EUR8B,OVQ9B,CURsC,YVQtC,CAAA;;;;;AAdJ,UWAK,mBAAA,CXAL;UACM,EAAA,MAAA;UACP,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAM7B;;;;AAMiB,cWRJ,YAAA,YAAwB,IXQpB,CAAA;EAAM,CAAA,OAAA;EAWN,WAAA,CAAA,OAAU,EWdJ,mBXcI;EAAA,IAAA,WAAA,CAAA,CAAA,EAAA,MAAA;cACR,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EWF4B,UXE5B,EAAA,QAAA,EWFkD,eXElD,CAAA,EWFoE,OXEpE,CWF4E,QXE5E,CAAA;cAA6B,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EWQD,UXRC,EAAA,OAAA,EWQoB,eXRpB,CAAA,EWQsC,OXRtC,CWQ8C,QXR9C,GAAA,IAAA,CAAA;;AAAD;;;AA9BnC,UYAK,sBAAA,CZAL;;UAED,CAAA,EAAA,MAAA;EAAW;EAIL,OAAA,CAAA,EAAA,MAAY;EAMZ;EAAU,IAAA,CAAA,EAAA,MAAA,GYNT,MZMS;;KAIT,CAAA,EAAA,MAAA,GYRD,MZQC;;EAEK,OAAA,CAAA,EAAA,MAAA;EAWN;EAAU,GAAA,CAAA,EAAA,MAAA,GYjBV,MZiBU;;YACqB,CAAA,EAAA,MAAA;;EAAD,QAAA,CAAA,EAAA,MAAA;;;;AClC/C;AAQA;cWmBa,eAAA,YAA2B;;uBAUjB;EV9BV,IAAA,WAAW,CAAA,CAAA,EAAA,MAyBjB;;;oBU0B8B;ITtDpB,GAAA,CAAA,EAAA,MAAQ,GSsDmC,MTpD7C;IAUE,GAAI,CAAA,EAAA,MAAA,GS0C8D,MT1C9D;IAAA,UAAA,CAAA,EAAA,MAAA;;cAOyC,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,ES+Cf,UT/Ce,EAAA,QAAA,ES+CO,eT/CP,CAAA,ES+CyB,OT/CzB,CS+CiC,QT/CjC,CAAA;cAA0B,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,ESuDzC,UTvDyC,EAAA,OAAA,ESuDpB,eTvDoB,CAAA,ESuDF,OTvDE,CSuDM,QTvDN,GAAA,IAAA,CAAA;;;;;AHnB5E,UaCK,eAAA,CbDL;;aAED,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAM7B;;;;;AAMuB,caNV,QAAA,YAAoB,IbMV,CAAA;EAWN,CAAA,OAAA;EAAU,WAAA,CAAA,OAAA,EabJ,ebaI;MACR,WAAA,CAAA,CAAA,EAAA,MAAA;;;AAA4B;;yCaCA,qBAAqB,kBAAkB,QAAQ;;AZnC9F;;;ADIY,UcAK,6BAAA,CdAL;;UAED,CAAA,EAAA,MAAA;EAAW;EAIL,YAAA,CAAA,EAAY,MAAA;AAM7B;;;;;AAMuB;AAWvB;;AACmB,cchBN,sBAAA,YAAkC,IdgB5B,CAAA;UAA6B;aAAR,CAAA,OAAA,CAAA,EcZhB,6BdYgB;EAAO,IAAA,WAAA,CAAA,CAAA,EAAA,MAAA;yCcHA,sBAAsB,kBAAkB,QAAQ;;;;;Ad9B9E,UeAA,kBAAA,CfAkB;EAAA,IAAA,EAAA,MAAA;OAGvB,EAAA,MAAA;;;AAEU;AAItB;AAMA;;;;;AAMuB;AAWvB;;AACmB,iBejBH,kBAAA,CfiBG,OAAA,EehBR,efgBQ,EAAA,GAAA,CAAA,EAAA,MAAA,CAAA,EedhB,kBfcgB,GAAA,IAAA;;;;AA9BP,UgBDK,gBAAA,ChBCL;;aAED,EAAA,MAAA;AAAW;AAItB;AAMA;;;AAIkB,cgBRL,SAAA,YAAqB,IhBQhB,CAAA;UAED;EAAM,WAAA,CAAA,OAAA,EgBPA,gBhBOA;EAWN,IAAA,WAAU,CAAA,CAAA,EAAA,MAAA;EAAA,YAAA,CAAA,KAAA,EAAA,MAAA,EAAA,WAAA,EgBTsB,UhBStB,EAAA,QAAA,EgBT4C,ehBS5C,CAAA,EgBT8D,OhBS9D,CgBTsE,QhBStE,CAAA;;;;;;;;AA3BL;AAIL,ciBJJ,aAAA,YAAyB,IjBMrB,CAAA;EAIA,IAAA,WAAU,CAAA,CAAA,EAAA,MAAA;EAAA,YAAA,CAAA,KAAA,EAAA,MAAA,EAAA,WAAA,EiBLsB,UjBKtB,EAAA,QAAA,EiBL4C,ejBK5C,CAAA,EiBL8D,OjBK9D,CiBLsE,QjBKtE,CAAA;;;;;;;AAVL;AAItB;AAMiB,ckBFJ,eAAA,ClBEc;EAAA,CAAA,OAAA;aAEX,CAAA,IAAA,EAAA,MAAA,EAAA,OAAA,EkBUqB,sBlBVrB;;MAIC,IAAA,CAAA,CAAA,EAAA,MAAA;EAAM;EAWN,IAAA,UAAU,CAAA,CAAA,EAAA,MAAA;EAAA;MACR,EAAA,CAAA,CAAA,EAAA,MAAA,GkBkBE,MlBlBF,GAAA,SAAA;;MAAqB,MAAA,CAAA,CAAA,EAAA,OAAA;EAAO;;;;AClC/C;AAQA;sBiB8DsB;;;AhB/DtB;;;;ECHiB,aAAQ,CAAA,UAEV,Ee2Ea,Uf3EF,CAAA,EAAA,IAAA;EAUT;;;;;SAO+D,CAAA,CAAA,EeoE7D,OfpE6D,CAAA,IAAA,CAAA;;;;YAKC,CAAA,CAAA,EegF3D,OfhF2D,CAAA,IAAA,CAAA;EAAO;;;;EC5B5E,GAAA,CAAA,IAAA,OAAO,CAAA,CAAA,OAAA,Ec6He,Od7Hf,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,Ec6HuD,cd7HvD,CAAA,Ec6HwE,Od7HxE,Cc6HgF,Cd7HhF,CAAA;EAYP,IAAA,CAAA,IAAA,OAAU,CAAA,CAAA,OAAA,EcqHa,OdrHb,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EcqHqD,cdrHrD,CAAA,EcqHsE,OdrHtE,CcqH8E,CdrH9E,CAAA;EAWL,GAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAiB,Ec8GA,Od9GA,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,Ec8GwC,cd9GxC,CAAA,Ec8GyD,Od9GzD,Cc8GiE,Cd9GjE,CAAA;EAAA,MAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EckHG,OdlHH,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EckH2C,cdlH3C,CAAA,EckH4D,OdlH5D,CckHoE,CdlHpE,CAAA;OAC1B,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EcqH4B,OdrH5B,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EcqHoE,cdrHpE,CAAA,EcqHqF,OdrHrF,CcqH6F,CdrH7F,CAAA;;AAES;AAMjB;;;;QAQU,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EckHG,OdlHH,EAAA,MAAA,EcmHE,UdnHF,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EcqHI,cdrHJ,CAAA,EcsHL,OdtHK,CcsHG,CdtHH,CAAA;;AAEY;;;;AJzCtB;;AAGY,amBJA,YAAA;SnBKM,GAAA,SAAA;MACP,GAAA,MAAA;EAAW,KAAA,GAAA,OAAA;AAItB;AAMA;;;AAIkB,UmBXD,kBAAA,CnBWC;WAED,EAAA,MAAA;EAAM,OAAA,EAAA,MAAA;EAWN,SAAA,EAAA,MAAU;EAAA,WAAA,EAAA,MAAA;YACR,EAAA,MAAA;aAA6B,EAAA,MAAA;QAAR,EAAA,MAAA;AAAO;;;;AClC9B,akBsBL,yBAAA;ElBdC,QAAA,GAAA,UAGH;;;;ECJG,OAAA,GAAA,SAAW;;;;ACHxB;AAYA;;AAOyC,UgBYxB,qBAAA,ChBZwB;YAAqB,EgBahD,yBhBbgD;WAA0B,CAAA,EAAA,MAAA;aAAR,CAAA,EAAA,MAAA;SAKtC,CAAA,EAAA,MAAA;WAAqB,CAAA,EAAA,MAAA;gBAA0B,CAAA,EAAA,MAAA;aAAR,CAAA,EAAA,MAAA;EAAO,SAAA,CAAA,EAAA,MAAA;;;;AC5BxF;AAYA;AAWiB,Ue2BA,sBAAA,Cf3BiB;EAAA,SAAA,EAAA,MAAA;aAC1B,CAAA,EAAA,MAAA;MAEG,EAAA,MAAA,CAAA,EAAA,OAAA;AAAM;AAMjB;;;AJ1BW,UoBEM,gBAAA,CpBFN;EAAW;EAIL,IAAA,EoBAT,epBAqB;EAMZ;EAAU,EAAA,CAAA,EAAA,MAAA,GoBJX,MpBIW;;QAIT,CAAA,EAAA,OAAA;;EAEK,UAAA,CAAA,EAAA,MAAA;AAWvB;;;;;AAC+C;;coBTlC,SAAA;;EnBzBI,WAAA,CAAA,IAAA,EAAe,MAAA,EAAA,OAAA,EmBiCK,gBnBjCL;EAQnB;;;qBmByCQ;ElB1CR;;;ckBoDC;EjBvDG;AAYjB;;eAOyC,CAAA,UAAA,EiB2Cb,UjB3Ca,CAAA,EAAA,IAAA;;;;;kBAKsB,CAAA,MAAA,EAAA,MAAA,CAAA,EiB+CrB,OjB/CqB,CiB+Cb,WjB/Ca,CAAA;;;AAAyB;;;8CiByDpC,eAAe,QAAQ;EhBrF/D;AAYZ;AAWA;;sBACQ,CAAA,MAAA,EAAA,MAAA,CAAA,EgB0EsC,OhB1EtC,CgB0E8C,WhB1E9C,CAAA;;AAES;AAMjB;EAA+B,sBAAA,CAAA,CAAA,EgB0EG,OhB1EH,CgB0EW,kBhB1EX,EAAA,CAAA;;;;;AAUT;EAUL,WAAA,CAAA,MAAA,EAAA,MAAsB,EAAA,QAAA,EAAA,MAAA,CAAA,EgB4EgB,OhB5EhB,CAAA,IAAA,CAAA;EAAA;;;AAIjB;;;;EC/CT,aAAA,CAAA,MAAe,EAAA,MAAA,EAAA,GAAA,EAAA,MAAA,EAAA,UAAA,CAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EeoJf,YfpJe,CAAA,EeqJvB,OfrJuB,CAAA,IAAA,CAAA;EAAA;;;AAAa;AAOzC;EAOa,mBAAS,CAAA,MAAA,EAAA,MAAA,EAAA,OAAA,EeoKT,qBfpKS,CAAA,EeqKjB,OfrKiB,CeqKT,sBfrKS,CAAA"}

package/dist/{index-BN3IescB.d.cts → index-Bny9XduO.d.cts}

@@ -238,17 +238,17 @@ declare function validateHost(host: string): string;
  *
  * @example
  * buildServiceUrl('appliance.example.com', Service.CORE)
- * // => 'https://appliance.example.com/service/core'
+ * // => 'https://appliance.example.com/service/core/v4'
  */
-declare function buildServiceUrl(host: string, service: Service): string;
+declare function buildServiceUrl(host: string, service: Service, apiVersion?: string): string;
 /**
  * Builds a full API URL including path and optional query parameters.
  *
  * @example
- * buildRequestUrl('appliance.example.com', Service.CORE, 'v4/Users', { filter: 'Name eq "admin"' })
+ * buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq "admin"' })
  * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'
  */
-declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>): string;
+declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>, apiVersion?: string): string;
 /**
  * Encodes bytes to a URL-safe base64 string (no padding).
  */
@@ -600,6 +600,8 @@ interface A2AClientOptions {
   ca?: string | Buffer;
   /** Whether to verify TLS. Default: true. */
   verify?: boolean;
+  /** API version string (default: 'v4'). */
+  apiVersion?: string;
 }
 /**
  * Application-to-Application client for programmatic credential retrieval.
@@ -665,4 +667,4 @@ declare class A2AClient {
 }
 //#endregion
 export { A2AClient, type A2AClientOptions, AnonymousAuth, ApiError, type ApiErrorBody, type Auth, AuthenticationError, AuthorizationError, type BrokeredAccessRequest, BrokeredAccessRequestType, type BrokeredAccessResponse, BrowserHttpClient, BrowserSessionStorage, CertificateAuth, type CertificateAuthOptions, ConfigurationError, type HttpClient, HttpMethod, type HttpRequestOptions, type HttpResponse, MemoryStorage, NodeHttpClient, NotFoundError, PasswordAuth, type PasswordAuthOptions, PkceAuth, type PkceAuthOptions, type PkceCallbackResult, PkceNonInteractiveAuth, type PkceNonInteractiveAuthOptions, type RequestOptions, type RetrievableAccount, SafeguardClient, type SafeguardClientOptions, SafeguardError, type SafeguardResponse, SecretValue, Service, SshKeyFormat, StorageKeys, type StorageProvider, type TlsOptions, TokenAuth, type TokenAuthOptions, type TokenSet, TransportError, base64UrlEncode, buildRequestUrl, buildServiceUrl, generateCodeChallenge, generateCodeVerifier, generateState, handlePkceCallback, validateHost };
-//# sourceMappingURL=index-BN3IescB.d.cts.map
+//# sourceMappingURL=index-Bny9XduO.d.cts.map

package/dist/index-Bny9XduO.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-Bny9XduO.d.cts","names":[],"sources":["../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/types.ts","../src/errors.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/http/node.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/certificate.ts","../src/auth/pkce.ts","../src/auth/pkce-noninteractive.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts","../src/a2a/types.ts","../src/a2a/index.ts"],"mappings":";;AAIA;;AAGY,UAHK,kBAAA,CAGL;KACM,EAAA,MAAA;QACP,EAAA,MAAA;EAAW,OAAA,CAAA,EAFV,MAEU,CAAA,MAAA,EAAA,MAAA,CAAA;EAIL,IAAA,CAAA,EAAA,MAAA,GALC,MAKW,GAAA,IAElB;EAIM,MAAA,CAAA,EAVN,WAUgB;EAAA,OAAA,CAAA,EAAA,MAAA;;AAIT,UAVD,YAAA,CAUC;QAED,EAAA,MAAA;EAAM,OAAA,EAVZ,MAUY,CAAA,MAAA,EAAA,MAAA,CAAA;EAWN,IAAA,EAAA,MAAA;;AACE,UAlBF,UAAA,CAkBE;;KAAqB,EAAA,MAAA,GAhBxB,MAgBwB;EAAO;kBAd7B;;iBAED;ECtBA;EAQJ,UAAA,CAAA,EAAA,MAGH;;;;ACJV;;;;ACHiB,UH6BA,UAAA,CG3BF;EAUE,OAAI,CAAA,OAAA,EHkBF,kBGlBE,CAAA,EHkBmB,OGlBnB,CHkB2B,YGlB3B,CAAA;EAAA,OAAA,GAAA,EAAA,IAAA;;;;;;AHfrB;;AAGY,UCJK,eAAA,CDIL;KACM,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;KACP,CAAA,GAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAW,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAIL,KAAA,EAAA,EAAA,IAAA;AAMjB;;AAEgB,cCVH,WDUG,EAAA;WAEE,KAAA,EAAA,iBAAA;WAED,aAAA,EAAA,yBAAA;AAAM,CAAA;AAWvB;;;;AAhCA;;;;;AAKsB;AAItB;AAMiB,cETJ,WAAA,CFSc;EAAA,CAAA,OAAA;aAEX,CAAA,KAAA,EAAA,MAAA;;QAIC,CAAA,CAAA,EAAA,MAAA;EAAM,QAAA,CAAA,CAAA,EAAA,MAAA;EAWN,MAAA,CAAA,CAAA,EAAA,MAAU;EAAA,KEDpB,MAAA,CAAO,WAAW,GFCE,EAAA,MAAA;;;;;;;;AA3BL,UGFL,QAAA,CHEK;EAIL;EAMA,WAAA,EGVF,WHUY;EAAA;WAEX,CAAA,EAAA,MAAA;;YAIC,EAAA,MAAA;AAAM;AAWvB;;;AACgD,UGlB/B,IAAA,CHkB+B;;AAAD;;;;AClC/C;EAQa,YAAA,CAAA,IAGH,EAAA,MAAA,EAAA,UAAA,EEY+B,UFZ/B,EAAA,OAAA,EEYoD,eFZpD,CAAA,EEYsE,OFZtE,CEY8E,QFZ9E,CAAA;;;;ECJG,YAAA,EAAW,IAAA,EAAA,MAyBjB,EAAA,UAAO,ECJ4B,UDIjB,EAAA,OAAA,ECJsC,eDItC,CAAA,ECJwD,ODIxD,CCJgE,QDIhE,GAAA,IAAA,CAAA;;;;AC5BzB;;;;AHHA;;AAGY,aIJA,OAAA;MJKM,GAAA,MAAA;WACP,GAAA,WAAA;EAAW,YAAA,GAAA,cAAA;EAIL,GAAA,GAAA,KAAA;EAMA,KAAA,GAAA,OAAU;EAAA,IAAA,GAAA,MAAA;;;;AAMJ;AAWN,aIrBL,UAAA;EJqBe,GAAA,GAAA,KAAA;MACR,GAAA,MAAA;KAA6B,GAAA,KAAA;QAAR,GAAA,QAAA;EAAO,KAAA,GAAA,OAAA;;;;AClC/C;AAQa,UGeI,iBHZP,CAAA,IAAA,OAAA,CAAA,CAAA;QGaF;;WAEG;AFnBX;;;;ACHiB,UC4BA,cAAA,CD1BF;EAUE;EAAI,IAAA,CAAA,EAAA,OAAA;;MAOyC,CAAA,ECarD,QDbqD,GAAA,IAAA;;SAAkB,CAAA,ECepE,MDfoE,CAAA,MAAA,EAAA,MAAA,CAAA;;OAKjB,CAAA,ECYrD,MDZqD,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA;;QAAkB,CAAA,ECctE,WDdsE;EAAO;;;;AC5BxF;AAYA;AAWA;;AACQ,UA4BS,sBAAA,CA5BT;;EAES,IAAA,EA0BsB,IA1BtB;EAMA;EAAc,EAAA,CAAA,EAAA,MAAA,GAwBf,MAxBe;;QAMnB,CAAA,EAAA,OAAA;;YAID,CAAA,EAAA,MAAA;EAAW;EAUL,OAAA,CAAA,EAAA,MAAA;EAAsB;aAAA,CAAA,EAAA,OAAA;;AAIjB;;;;AJvDtB;;;;;AAKsB;AAItB;AAMA;;;AAIkB,cKXL,cAAA,SAAuB,KAAA,CLWlB;aAED,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EKZwB,YLYxB;AAAM;AAWN,UKjBA,YAAA,CLiBU;EAAA,IAAA,CAAA,EAAA,MAAA;SACR,CAAA,EAAA,MAAA;YAA6B,CAAA,EAAA;IAAR,OAAA,CAAA,EAAA,MAAA;EAAO,CAAA;;;cKXlC,QAAA,SAAiB,cAAA;EJvBb,SAAA,MAAA,EAAA,MAAe;EAQnB,SAAA,IAAA,EIiBI,YJdP,GAAA,IAAA;sDIgB2C,+BAAsC;;;AHpB3F;qDG8BqD,sBAAsB;;;AFjC3E;AAYiB,cEwDJ,mBAAA,SAA4B,QAAA,CFxDpB;EAAA,WAAA,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EEyDgB,YFzDhB,GAAA,IAAA,EAAA,OAAA,CAAA,EEyDsD,YFzDtD;;AAOyC,cEwDjD,kBAAA,SAA2B,QAAA,CFxDsB;aAA0B,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EEyDnD,YFzDmD,GAAA,IAAA,EAAA,OAAA,CAAA,EEyDb,YFzDa;;AAK9C,cE0D7B,aAAA,SAAsB,QAAA,CF1DO;aAAqB,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EE2D1B,YF3D0B,GAAA,IAAA,EAAA,OAAA,CAAA,EE2DY,YF3DZ;;AAAkB,cEiEpE,cAAA,SAAuB,cAAA,CFjE6C;EAAO,WAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EEkE/C,YFlE+C;;cEwE3E,kBAAA,SAA2B,cAAA;yCACC;ADrGzC;AAYA;;;AJXA;;;;;AAKsB;AAIL,iBMJD,YAAA,CNMC,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAIjB;;;;;AAMuB;AAWvB;AAA2B,iBMYX,eAAA,CNZW,IAAA,EAAA,MAAA,EAAA,OAAA,EMY4B,ONZ5B,EAAA,UAAA,CAAA,EAAA,MAAA,CAAA,EAAA,MAAA;;;;AACoB;;;;AClC9B,iBK2DD,eAAA,CL3DgB,IAAA,EAAA,MAAA,EAAA,OAAA,EK6DrB,OL7DqB,EAAA,WAAA,EAAA,MAAA,EAAA,KAAA,CAAA,EK+DtB,ML/DsB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,EAAA,UAAA,CAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAQhC;;;iBK0EgB,eAAA,QAAuB;AJ3EvC;;;;ACHiB,iBGuFD,oBAAA,CAAA,CHrFU,EAAA,MAAA;AAU1B;;;;AAOwF,iBG8ElE,qBAAA,CH9EkE,QAAA,EAAA,MAAA,CAAA,EG8EzB,OH9EyB,CAAA,MAAA,CAAA;;;;AAKC,iBGmFzE,aAAA,CAAA,CHnFyE,EAAA,MAAA;;AAAD;;;;;AH3BxF;;;;AAKW,cOHE,aAAA,YAAyB,ePG3B,CAAA;EAAW,CAAA,OAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,CAAA,EAAA,MAAA,GAElB,IAAA;EAIM,GAAA,CAAA,GAAA,EAAA,MAAU,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAA,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OAEX,CAAA,CAAA,EAAA,IAAA;;;;;AAjBhB;;;;AAKW,cQHE,qBAAA,YAAiC,eRGnC,CAAA;EAAW,GAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,EAAA,KAAA,EAAA,MAElB,CAAA,EAAM,IAAA;EAIA,MAAA,CAAA,GAAA,EAAA,MAAU,CAAA,EAAA,IAAA;EAAA,KAAA,CAAA,CAAA,EAAA,IAAA;;;;;AAf3B;;;;AAKW,cSFE,cAAA,YAA0B,UTE5B,CAAA;EAAW,CAAA,OAAA;EAIL,WAAA,CAAA,UAEA,CAFY,ESHF,UTKV;EAIA,OAAA,CAAA,OAAU,ESGF,kBTHE,CAAA,ESGmB,OTHnB,CSG2B,YTH3B,CAAA;EAAA,OAAA,CAAA,CAAA,EAAA,IAAA;;;;;AAf3B;;;;AAKW,cUHE,iBAAA,YAA6B,UVG/B,CAAA;EAAW,CAAA,OAAA;EAIL,WAAA,CAAA,OAMU,CANE,EAAA;IAMZ,WAAU,CAAA,EUVa,kBVUb;EAAA,CAAA;SAEX,CAAA,OAAA,EURS,kBVQT,CAAA,EUR8B,OVQ9B,CURsC,YVQtC,CAAA;;;;;AAdJ,UWAK,mBAAA,CXAL;UACM,EAAA,MAAA;UACP,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAM7B;;;;AAMiB,cWRJ,YAAA,YAAwB,IXQpB,CAAA;EAAM,CAAA,OAAA;EAWN,WAAA,CAAA,OAAU,EWdJ,mBXcI;EAAA,IAAA,WAAA,CAAA,CAAA,EAAA,MAAA;cACR,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EWF4B,UXE5B,EAAA,QAAA,EWFkD,eXElD,CAAA,EWFoE,OXEpE,CWF4E,QXE5E,CAAA;cAA6B,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EWQD,UXRC,EAAA,OAAA,EWQoB,eXRpB,CAAA,EWQsC,OXRtC,CWQ8C,QXR9C,GAAA,IAAA,CAAA;;AAAD;;;AA9BnC,UYAK,sBAAA,CZAL;;UAED,CAAA,EAAA,MAAA;EAAW;EAIL,OAAA,CAAA,EAAA,MAAY;EAMZ;EAAU,IAAA,CAAA,EAAA,MAAA,GYNT,MZMS;;KAIT,CAAA,EAAA,MAAA,GYRD,MZQC;;EAEK,OAAA,CAAA,EAAA,MAAA;EAWN;EAAU,GAAA,CAAA,EAAA,MAAA,GYjBV,MZiBU;;YACqB,CAAA,EAAA,MAAA;;EAAD,QAAA,CAAA,EAAA,MAAA;;;;AClC/C;AAQA;cWmBa,eAAA,YAA2B;;uBAUjB;EV9BV,IAAA,WAAW,CAAA,CAAA,EAAA,MAyBjB;;;oBU0B8B;ITtDpB,GAAA,CAAA,EAAA,MAAQ,GSsDmC,MTpD7C;IAUE,GAAI,CAAA,EAAA,MAAA,GS0C8D,MT1C9D;IAAA,UAAA,CAAA,EAAA,MAAA;;cAOyC,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,ES+Cf,UT/Ce,EAAA,QAAA,ES+CO,eT/CP,CAAA,ES+CyB,OT/CzB,CS+CiC,QT/CjC,CAAA;cAA0B,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,ESuDzC,UTvDyC,EAAA,OAAA,ESuDpB,eTvDoB,CAAA,ESuDF,OTvDE,CSuDM,QTvDN,GAAA,IAAA,CAAA;;;;;AHnB5E,UaCK,eAAA,CbDL;;aAED,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAM7B;;;;;AAMuB,caNV,QAAA,YAAoB,IbMV,CAAA;EAWN,CAAA,OAAA;EAAU,WAAA,CAAA,OAAA,EabJ,ebaI;MACR,WAAA,CAAA,CAAA,EAAA,MAAA;;;AAA4B;;yCaCA,qBAAqB,kBAAkB,QAAQ;;AZnC9F;;;ADIY,UcAK,6BAAA,CdAL;;UAED,CAAA,EAAA,MAAA;EAAW;EAIL,YAAA,CAAA,EAAY,MAAA;AAM7B;;;;;AAMuB;AAWvB;;AACmB,cchBN,sBAAA,YAAkC,IdgB5B,CAAA;UAA6B;aAAR,CAAA,OAAA,CAAA,EcZhB,6BdYgB;EAAO,IAAA,WAAA,CAAA,CAAA,EAAA,MAAA;yCcHA,sBAAsB,kBAAkB,QAAQ;;;;;Ad9B9E,UeAA,kBAAA,CfAkB;EAAA,IAAA,EAAA,MAAA;OAGvB,EAAA,MAAA;;;AAEU;AAItB;AAMA;;;;;AAMuB;AAWvB;;AACmB,iBejBH,kBAAA,CfiBG,OAAA,EehBR,efgBQ,EAAA,GAAA,CAAA,EAAA,MAAA,CAAA,EedhB,kBfcgB,GAAA,IAAA;;;;AA9BP,UgBDK,gBAAA,ChBCL;;aAED,EAAA,MAAA;AAAW;AAItB;AAMA;;;AAIkB,cgBRL,SAAA,YAAqB,IhBQhB,CAAA;UAED;EAAM,WAAA,CAAA,OAAA,EgBPA,gBhBOA;EAWN,IAAA,WAAU,CAAA,CAAA,EAAA,MAAA;EAAA,YAAA,CAAA,KAAA,EAAA,MAAA,EAAA,WAAA,EgBTsB,UhBStB,EAAA,QAAA,EgBT4C,ehBS5C,CAAA,EgBT8D,OhBS9D,CgBTsE,QhBStE,CAAA;;;;;;;;AA3BL;AAIL,ciBJJ,aAAA,YAAyB,IjBMrB,CAAA;EAIA,IAAA,WAAU,CAAA,CAAA,EAAA,MAAA;EAAA,YAAA,CAAA,KAAA,EAAA,MAAA,EAAA,WAAA,EiBLsB,UjBKtB,EAAA,QAAA,EiBL4C,ejBK5C,CAAA,EiBL8D,OjBK9D,CiBLsE,QjBKtE,CAAA;;;;;;;AAVL;AAItB;AAMiB,ckBFJ,eAAA,ClBEc;EAAA,CAAA,OAAA;aAEX,CAAA,IAAA,EAAA,MAAA,EAAA,OAAA,EkBUqB,sBlBVrB;;MAIC,IAAA,CAAA,CAAA,EAAA,MAAA;EAAM;EAWN,IAAA,UAAU,CAAA,CAAA,EAAA,MAAA;EAAA;MACR,EAAA,CAAA,CAAA,EAAA,MAAA,GkBkBE,MlBlBF,GAAA,SAAA;;MAAqB,MAAA,CAAA,CAAA,EAAA,OAAA;EAAO;;;;AClC/C;AAQA;sBiB8DsB;;;AhB/DtB;;;;ECHiB,aAAQ,CAAA,UAEV,Ee2Ea,Uf3EF,CAAA,EAAA,IAAA;EAUT;;;;;SAO+D,CAAA,CAAA,EeoE7D,OfpE6D,CAAA,IAAA,CAAA;;;;YAKC,CAAA,CAAA,EegF3D,OfhF2D,CAAA,IAAA,CAAA;EAAO;;;;EC5B5E,GAAA,CAAA,IAAA,OAAO,CAAA,CAAA,OAAA,Ec6He,Od7Hf,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,Ec6HuD,cd7HvD,CAAA,Ec6HwE,Od7HxE,Cc6HgF,Cd7HhF,CAAA;EAYP,IAAA,CAAA,IAAA,OAAU,CAAA,CAAA,OAAA,EcqHa,OdrHb,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EcqHqD,cdrHrD,CAAA,EcqHsE,OdrHtE,CcqH8E,CdrH9E,CAAA;EAWL,GAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAiB,Ec8GA,Od9GA,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,Ec8GwC,cd9GxC,CAAA,Ec8GyD,Od9GzD,Cc8GiE,Cd9GjE,CAAA;EAAA,MAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EckHG,OdlHH,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EckH2C,cdlH3C,CAAA,EckH4D,OdlH5D,CckHoE,CdlHpE,CAAA;OAC1B,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EcqH4B,OdrH5B,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EcqHoE,cdrHpE,CAAA,EcqHqF,OdrHrF,CcqH6F,CdrH7F,CAAA;;AAES;AAMjB;;;;QAQU,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EckHG,OdlHH,EAAA,MAAA,EcmHE,UdnHF,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EcqHI,cdrHJ,CAAA,EcsHL,OdtHK,CcsHG,CdtHH,CAAA;;AAEY;;;;AJzCtB;;AAGY,amBJA,YAAA;SnBKM,GAAA,SAAA;MACP,GAAA,MAAA;EAAW,KAAA,GAAA,OAAA;AAItB;AAMA;;;AAIkB,UmBXD,kBAAA,CnBWC;WAED,EAAA,MAAA;EAAM,OAAA,EAAA,MAAA;EAWN,SAAA,EAAA,MAAU;EAAA,WAAA,EAAA,MAAA;YACR,EAAA,MAAA;aAA6B,EAAA,MAAA;QAAR,EAAA,MAAA;AAAO;;;;AClC9B,akBsBL,yBAAA;ElBdC,QAAA,GAAA,UAGH;;;;ECJG,OAAA,GAAA,SAAW;;;;ACHxB;AAYA;;AAOyC,UgBYxB,qBAAA,ChBZwB;YAAqB,EgBahD,yBhBbgD;WAA0B,CAAA,EAAA,MAAA;aAAR,CAAA,EAAA,MAAA;SAKtC,CAAA,EAAA,MAAA;WAAqB,CAAA,EAAA,MAAA;gBAA0B,CAAA,EAAA,MAAA;aAAR,CAAA,EAAA,MAAA;EAAO,SAAA,CAAA,EAAA,MAAA;;;;AC5BxF;AAYA;AAWiB,Ue2BA,sBAAA,Cf3BiB;EAAA,SAAA,EAAA,MAAA;aAC1B,CAAA,EAAA,MAAA;MAEG,EAAA,MAAA,CAAA,EAAA,OAAA;AAAM;AAMjB;;;AJ1BW,UoBEM,gBAAA,CpBFN;EAAW;EAIL,IAAA,EoBAT,epBAqB;EAMZ;EAAU,EAAA,CAAA,EAAA,MAAA,GoBJX,MpBIW;;QAIT,CAAA,EAAA,OAAA;;EAEK,UAAA,CAAA,EAAA,MAAA;AAWvB;;;;;AAC+C;;coBTlC,SAAA;;EnBzBI,WAAA,CAAA,IAAA,EAAe,MAAA,EAAA,OAAA,EmBiCK,gBnBjCL;EAQnB;;;qBmByCQ;ElB1CR;;;ckBoDC;EjBvDG;AAYjB;;eAOyC,CAAA,UAAA,EiB2Cb,UjB3Ca,CAAA,EAAA,IAAA;;;;;kBAKsB,CAAA,MAAA,EAAA,MAAA,CAAA,EiB+CrB,OjB/CqB,CiB+Cb,WjB/Ca,CAAA;;;AAAyB;;;8CiByDpC,eAAe,QAAQ;EhBrF/D;AAYZ;AAWA;;sBACQ,CAAA,MAAA,EAAA,MAAA,CAAA,EgB0EsC,OhB1EtC,CgB0E8C,WhB1E9C,CAAA;;AAES;AAMjB;EAA+B,sBAAA,CAAA,CAAA,EgB0EG,OhB1EH,CgB0EW,kBhB1EX,EAAA,CAAA;;;;;AAUT;EAUL,WAAA,CAAA,MAAA,EAAA,MAAsB,EAAA,QAAA,EAAA,MAAA,CAAA,EgB4EgB,OhB5EhB,CAAA,IAAA,CAAA;EAAA;;;AAIjB;;;;EC/CT,aAAA,CAAA,MAAe,EAAA,MAAA,EAAA,GAAA,EAAA,MAAA,EAAA,UAAA,CAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EeoJf,YfpJe,CAAA,EeqJvB,OfrJuB,CAAA,IAAA,CAAA;EAAA;;;AAAa;AAOzC;EAOa,mBAAS,CAAA,MAAA,EAAA,MAAA,EAAA,OAAA,EeoKT,qBfpKS,CAAA,EeqKjB,OfrKiB,CeqKT,sBfrKS,CAAA"}