@oneidentity/safeguard 8.0.1 → 8.0.2

package/dist/index.d.ts

@@ -35,7 +35,6 @@ interface HttpClient {
   request(options: HttpRequestOptions): Promise<HttpResponse>;
   dispose?(): void;
 }
-//# sourceMappingURL=types.d.ts.map
 //#endregion
 //#region src/storage/types.d.ts
 /**
@@ -52,7 +51,6 @@ declare const StorageKeys: {
   readonly STATE: "safeguard_state";
   readonly CODE_VERIFIER: "safeguard_code_verifier";
 };
-//# sourceMappingURL=types.d.ts.map
 //#endregion
 //#region src/secret.d.ts
 /**
@@ -72,7 +70,6 @@ declare class SecretValue {
   toJSON(): string;
   get [Symbol.toStringTag](): string;
 }
-//# sourceMappingURL=secret.d.ts.map
 //#endregion
 //#region src/auth/types.d.ts
 /**
@@ -104,7 +101,6 @@ interface Auth {
   /** Human-readable description of this auth strategy (for logging). */
   readonly description: string;
 }
-//# sourceMappingURL=types.d.ts.map
 //#endregion
 //#region src/types.d.ts
 /**
@@ -116,7 +112,7 @@ declare enum Service {
   NOTIFICATION = "notification",
   A2A = "a2a",
   EVENT = "event",
-  RSTS = "RSTS",
+  RSTS = "RSTS"
 }
 /**
  * HTTP methods supported by the Safeguard API.
@@ -126,7 +122,7 @@ declare enum HttpMethod {
   POST = "POST",
   PUT = "PUT",
   DELETE = "DELETE",
-  PATCH = "PATCH",
+  PATCH = "PATCH"
 }
 /**
  * Full response from a Safeguard API call (returned when fullResponse: true).
@@ -172,7 +168,6 @@ interface SafeguardClientOptions {
   /** Auto-refresh tokens before expiry. Default: true. */
   autoRefresh?: boolean;
 }
-//# sourceMappingURL=types.d.ts.map
 //#endregion
 //#region src/errors.d.ts
 /**
@@ -223,7 +218,6 @@ declare class TransportError extends SafeguardError {
 declare class ConfigurationError extends SafeguardError {
   constructor(message: string, options?: ErrorOptions);
 }
-//# sourceMappingURL=errors.d.ts.map
 //#endregion
 //#region src/utils.d.ts
 /**
@@ -267,10 +261,6 @@ declare function generateCodeChallenge(verifier: string): Promise<string>;
  * Generates a random state parameter for OAuth flows.
  */
 declare function generateState(): string;
-/**
- * Extracts the `exp` claim from a JWT and returns expiresIn (seconds from now).
- * Returns undefined if the token is not a valid JWT or has no `exp` claim.
- */
 //#endregion
 //#region src/storage/memory.d.ts
 /**
@@ -284,7 +274,6 @@ declare class MemoryStorage implements StorageProvider {
   remove(key: string): void;
   clear(): void;
 }
-//# sourceMappingURL=memory.d.ts.map
 //#endregion
 //#region src/storage/session.d.ts
 /**
@@ -297,7 +286,6 @@ declare class BrowserSessionStorage implements StorageProvider {
   remove(key: string): void;
   clear(): void;
 }
-//# sourceMappingURL=session.d.ts.map
 //#endregion
 //#region src/http/node.d.ts
 /**
@@ -310,7 +298,6 @@ declare class NodeHttpClient implements HttpClient {
   request(options: HttpRequestOptions): Promise<HttpResponse>;
   dispose(): void;
 }
-//# sourceMappingURL=node.d.ts.map
 //#endregion
 //#region src/http/browser.d.ts
 /**
@@ -324,7 +311,6 @@ declare class BrowserHttpClient implements HttpClient {
   });
   request(options: HttpRequestOptions): Promise<HttpResponse>;
 }
-//# sourceMappingURL=browser.d.ts.map
 //#endregion
 //#region src/auth/password.d.ts
 interface PasswordAuthOptions {
@@ -343,7 +329,6 @@ declare class PasswordAuth implements Auth {
   authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
   refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null>;
 }
-//# sourceMappingURL=password.d.ts.map
 //#endregion
 //#region src/auth/certificate.d.ts
 interface CertificateAuthOptions {
@@ -382,7 +367,6 @@ declare class CertificateAuth implements Auth {
   authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
   refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null>;
 }
-//# sourceMappingURL=certificate.d.ts.map
 //#endregion
 //#region src/auth/pkce.d.ts
 interface PkceAuthOptions {
@@ -405,7 +389,6 @@ declare class PkceAuth implements Auth {
    */
   authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet>;
 }
-//# sourceMappingURL=pkce.d.ts.map
 //#endregion
 //#region src/auth/pkce-noninteractive.d.ts
 interface PkceNonInteractiveAuthOptions {
@@ -427,7 +410,6 @@ declare class PkceNonInteractiveAuth implements Auth {
   get description(): string;
   authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
 }
-//# sourceMappingURL=pkce-noninteractive.d.ts.map
 //#endregion
 //#region src/auth/pkce-callback.d.ts
 interface PkceCallbackResult {
@@ -446,7 +428,6 @@ interface PkceCallbackResult {
  * @returns The parsed code and state, or null if not a valid callback
  */
 declare function handlePkceCallback(storage: StorageProvider, url?: string): PkceCallbackResult | null;
-//# sourceMappingURL=pkce-callback.d.ts.map
 //#endregion
 //#region src/auth/token.d.ts
 interface TokenAuthOptions {
@@ -463,7 +444,6 @@ declare class TokenAuth implements Auth {
   get description(): string;
   authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
 }
-//# sourceMappingURL=token.d.ts.map
 //#endregion
 //#region src/auth/anonymous.d.ts
 /**
@@ -474,7 +454,6 @@ declare class AnonymousAuth implements Auth {
   get description(): string;
   authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
 }
-//# sourceMappingURL=anonymous.d.ts.map
 //#endregion
 //#region src/client.d.ts
 /**
@@ -533,7 +512,6 @@ declare class SafeguardClient {
    */
   invoke<T = unknown>(service: Service, method: HttpMethod, relativeUrl: string, options?: RequestOptions): Promise<T>;
 }
-//# sourceMappingURL=client.d.ts.map
 //#endregion
 //#region src/a2a/types.d.ts
 /**
@@ -542,7 +520,7 @@ declare class SafeguardClient {
 declare enum SshKeyFormat {
   OpenSsh = "OpenSsh",
   Ssh2 = "Ssh2",
-  Putty = "Putty",
+  Putty = "Putty"
 }
 /**
  * An A2A retrievable account as returned by the discovery endpoint.
@@ -566,7 +544,7 @@ declare enum BrokeredAccessRequestType {
   Token = "Token",
   RdpFile = "RdpFile",
   RemoteDesktop = "RemoteDesktop",
-  SshSession = "SshSession",
+  SshSession = "SshSession"
 }
 /**
  * Options for creating a brokered access request.
@@ -590,7 +568,6 @@ interface BrokeredAccessResponse {
   AccessToken?: string;
   [key: string]: unknown;
 }
-//# sourceMappingURL=types.d.ts.map
 //#endregion
 //#region src/a2a/index.d.ts
 interface A2AClientOptions {
@@ -667,4 +644,4 @@ declare class A2AClient {
 }
 //#endregion
 export { A2AClient, type A2AClientOptions, AnonymousAuth, ApiError, type ApiErrorBody, type Auth, AuthenticationError, AuthorizationError, type BrokeredAccessRequest, BrokeredAccessRequestType, type BrokeredAccessResponse, BrowserHttpClient, BrowserSessionStorage, CertificateAuth, type CertificateAuthOptions, ConfigurationError, type HttpClient, HttpMethod, type HttpRequestOptions, type HttpResponse, MemoryStorage, NodeHttpClient, NotFoundError, PasswordAuth, type PasswordAuthOptions, PkceAuth, type PkceAuthOptions, type PkceCallbackResult, PkceNonInteractiveAuth, type PkceNonInteractiveAuthOptions, type RequestOptions, type RetrievableAccount, SafeguardClient, type SafeguardClientOptions, SafeguardError, type SafeguardResponse, SecretValue, Service, SshKeyFormat, StorageKeys, type StorageProvider, type TlsOptions, TokenAuth, type TokenAuthOptions, type TokenSet, TransportError, base64UrlEncode, buildRequestUrl, buildServiceUrl, generateCodeChallenge, generateCodeVerifier, generateState, handlePkceCallback, validateHost };
-//# sourceMappingURL=index-53AwvPfY.d.ts.map
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/types.ts","../src/errors.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/http/node.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/certificate.ts","../src/auth/pkce.ts","../src/auth/pkce-noninteractive.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts","../src/a2a/types.ts","../src/a2a/index.ts"],"mappings":";;AAIA;;UAAiB,kBAAA;EACf,GAAA;EACA,MAAA;EACA,OAAA,GAAU,MAAA;EACV,IAAA,YAAgB,MAAA;EAChB,MAAA,GAAS,WAAA;EACT,OAAA;AAAA;AAAA,UAGe,YAAA;EACf,MAAA;EACA,OAAA,EAAS,MAAM;EACf,IAAA;AAAA;AAAA,UAGe,UAAA;EATf;EAWA,EAAA,YAAc,MAAA;EAXP;EAaP,IAAA,YAAgB,MAAA;EAVW;EAY3B,GAAA,YAAe,MAAA;EAVA;EAYf,UAAA;EAZA;EAcA,kBAAA;AAAA;;AAbI;AAGN;;UAiBiB,UAAA;EACf,OAAA,CAAQ,OAAA,EAAS,kBAAA,GAAqB,OAAA,CAAQ,YAAA;EAC9C,OAAA;AAAA;;;;AAlCF;;UCDiB,eAAA;EACf,GAAA,CAAI,GAAA;EACJ,GAAA,CAAI,GAAA,UAAa,KAAA;EACjB,MAAA,CAAO,GAAA;EACP,KAAA;AAAA;;cAIW,WAAA;EAAA,SAGH,KAAA;EAAA,SAAA,aAAA;AAAA;;;;ADVV;;;;;;;cEMa,WAAA;EAAA;cAGC,KAAA;EFNZ;EEWA,MAAA,CAAA;EAIA,QAAA,CAAA;EAIA,MAAA,CAAA;EAAA,KASK,MAAA,CAAO,WAAW;AAAA;;;;;;UC5BR,QAAA;EHEK;EGApB,WAAA,EAAa,WAAW;EHJxB;EGMA,SAAA;EHJA;EGMA,UAAA;AAAA;;;;UAMe,IAAA;EHTR;AAAA;AAGT;;;;EGaE,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;EHXtF;;;EGgBA,YAAA,EAAc,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;EHfnF;EAAA,SGkBK,WAAA;AAAA;;;;AH9BX;;aIDY,OAAA;EACV,IAAA;EACA,SAAA;EACA,YAAA;EACA,GAAA;EACA,KAAA;EACA,IAAA;AAAA;;;;aAMU,UAAA;EACV,GAAA;EACA,IAAA;EACA,GAAA;EACA,MAAA;EACA,KAAA;AAAA;;;;UAMe,iBAAA;EACf,IAAA,EAAM,CAAA;EACN,MAAA;EACA,OAAA,EAAS,MAAM;AAAA;AJbX;AAGN;;AAHM,UImBW,cAAA;EJdD;EIgBd,IAAA;EJZe;EIcf,IAAA,GAAO,QAAA;EJdc;EIgBrB,OAAA,GAAU,MAAA;EJpBI;EIsBd,KAAA,GAAQ,MAAA;EJpBQ;EIsBhB,MAAA,GAAS,WAAA;EJpBM;EIsBf,OAAA;EJlBA;EIoBA,YAAA;AAAA;AJbF;;;AAAA,UImBiB,sBAAA;EJlB+B;EIoB9C,IAAA,EAFqC,IAAA;EJlBQ;EIsB7C,EAAA,YAAc,MAAM;EJtBpB;EIwBA,MAAA;EJxBQ;EI0BR,UAAA;EJ1B8C;EI4B9C,OAAA;EJ3BO;EI6BP,WAAA;AAAA;;;;AJ/DF;;;;;;;;;;cKQa,cAAA,SAAuB,KAAK;cAC3B,OAAA,UAAiB,OAAA,GAAU,YAAA;AAAA;AAAA,UAMxB,YAAA;EACf,IAAA;EACA,OAAA;EACA,UAAA;IAAe,OAAA;EAAA;EAAA,CACd,GAAA;AAAA;AAAA,cAGU,QAAA,SAAiB,cAAA;EAAA,SACnB,MAAA;EAAA,SACA,IAAA,EAAM,YAAA;cAEH,OAAA,UAAiB,MAAA,UAAgB,IAAA,GAAM,YAAA,SAA4B,OAAA,GAAU,YAAA;ELfhF;;;EAAA,OKyBF,YAAA,CAAa,MAAA,UAAgB,IAAA,WAAe,YAAA,UAAsB,QAAA;EAAA,eAgB1D,SAAA;EAAA,eAUA,YAAA;AAAA;AAAA,cASJ,mBAAA,SAA4B,QAAA;cAC3B,OAAA,UAAiB,IAAA,GAAM,YAAA,SAA4B,OAAA,GAAU,YAAA;AAAA;AAAA,cAM9D,kBAAA,SAA2B,QAAA;cAC1B,OAAA,UAAiB,IAAA,GAAM,YAAA,SAA4B,OAAA,GAAU,YAAA;AAAA;AAAA,cAM9D,aAAA,SAAsB,QAAA;cACrB,OAAA,UAAiB,IAAA,GAAM,YAAA,SAA4B,OAAA,GAAU,YAAA;AAAA;AAAA,cAM9D,cAAA,SAAuB,cAAc;cACpC,OAAA,UAAiB,OAAA,GAAU,YAAA;AAAA;AAAA,cAM5B,kBAAA,SAA2B,cAAc;cACxC,OAAA,UAAiB,OAAA,GAAU,YAAA;AAAA;;;ALpGzC;;;;;;AAAA,iBMKgB,YAAA,CAAa,IAAY;;;;;;;;iBAuCzB,eAAA,CAAgB,IAAA,UAAc,OAAA,EAAS,OAAO,EAAE,UAAA;;;;ANtCvD;AAGT;;;iBMiDgB,eAAA,CACd,IAAA,UACA,OAAA,EAAS,OAAA,EACT,WAAA,UACA,KAAA,GAAQ,MAAM,qCACd,UAAA;;;;iBAkBc,eAAA,CAAgB,KAAiB,EAAV,UAAU;;ANrE3C;AAGN;;iBM2EgB,oBAAA,CAAA;;;;;iBAUM,qBAAA,CAAsB,QAAA,WAAmB,OAAO;;;;iBAUtD,aAAA,CAAA;;;AN9GhB;;;;AAAA,cOEa,aAAA,YAAyB,eAAe;EAAA;EAGnD,GAAA,CAAI,GAAA;EAIJ,GAAA,CAAI,GAAA,UAAa,KAAA;EAIjB,MAAA,CAAO,GAAA;EAIP,KAAA,CAAA;AAAA;;;APjBF;;;;AAAA,cQEa,qBAAA,YAAiC,eAAe;EAC3D,GAAA,CAAI,GAAA;EAIJ,GAAA,CAAI,GAAA,UAAa,KAAA;EAIjB,MAAA,CAAO,GAAA;EAIP,KAAA,CAAA;AAAA;;;ARfF;;;;AAAA,cSGa,cAAA,YAA0B,UAAA;EAAA;cAGzB,UAAA,GAAa,UAAA;EAYnB,OAAA,CAAQ,OAAA,EAAS,kBAAA,GAAqB,OAAA,CAAQ,YAAA;EAmCpD,OAAA,CAAA;AAAA;;;ATrDF;;;;AAAA,cUEa,iBAAA,YAA6B,UAAA;EAAA;cAG5B,OAAA;IAAY,WAAA,GAAc,kBAAA;EAAA;EAIhC,OAAA,CAAQ,OAAA,EAAS,kBAAA,GAAqB,OAAA,CAAQ,YAAA;AAAA;;;UCNrC,mBAAA;EACf,QAAA;EACA,QAAA;EXAS;EWET,QAAA;AAAA;;;;cAMW,YAAA,YAAwB,IAAA;EAAA;cAKvB,OAAA,EAAS,mBAAA;EAAA,IASjB,WAAA,CAAA;EAIE,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;EAUvF,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;UCtC7E,sBAAA;EZAL;EYEV,QAAA;EZAS;EYET,OAAA;EZFoB;EYIpB,IAAA,YAAgB,MAAA;EZPhB;EYSA,GAAA,YAAe,MAAA;EZRL;EYUV,OAAA;EZTgB;EYWhB,GAAA,YAAe,MAAA;EZVN;EYYT,UAAA;EZXO;EYaP,QAAA;AAAA;;;;;cAOW,eAAA,YAA2B,IAAA;EAAA;cAU1B,OAAA,EAAS,sBAAA;EAAA,IAgBjB,WAAA,CAAA;EZxCA;EY6CJ,aAAA,CAAA;IAAmB,IAAA,YAAgB,MAAA;IAAQ,GAAA,YAAe,MAAA;IAAQ,GAAA,YAAe,MAAA;IAAQ,UAAA;EAAA;EAYnF,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;EAQvF,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;UCzE7E,eAAA;EbDL;EaGV,WAAA;EbDS;EaGT,QAAQ;AAAA;;;;;cAOG,QAAA,YAAoB,IAAA;EAAA;cAInB,OAAA,EAAS,eAAA;EAAA,IAOjB,WAAA,CAAA;EbpBJ;;AAAO;AAGT;EayBQ,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;UC/B7E,6BAAA;EdAL;EcEV,QAAA;EdAS;EcET,YAAY;AAAA;;;;;;;;cAUD,sBAAA,YAAkC,IAAA;EAAA;cAIjC,OAAA,GAAU,6BAAA;EAAA,IAKlB,WAAA,CAAA;EAIE,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;UC9B9E,kBAAA;EACf,IAAA;EACA,KAAK;AAAA;;;;;;;;;;;;iBAcS,kBAAA,CACd,OAAA,EAAS,eAAA,EACT,GAAA,YACC,kBAAkB;;;UCjBJ,gBAAA;EhBCL;EgBCV,WAAW;AAAA;;;;;cAOA,SAAA,YAAqB,IAAA;EAAA;cAGpB,OAAA,EAAS,gBAAA;EAAA,IAKjB,WAAA,CAAA;EAIE,YAAA,CAAa,KAAA,UAAe,WAAA,EAAa,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;;;;;cClBpF,aAAA,YAAyB,IAAA;EAAA,IAChC,WAAA,CAAA;EAIE,YAAA,CAAa,KAAA,UAAe,WAAA,EAAa,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;;;;;cCGpF,eAAA;EAAA;cAgBC,IAAA,UAAc,OAAA,EAAS,sBAAA;ElB1BnC;EAAA,IkBwCI,IAAA,CAAA;ElBvCJ;EAAA,IkB4CI,UAAA,CAAA;ElB3CJ;EAAA,IkBgDI,EAAA,CAAA,YAAe,MAAA;ElB/CnB;EAAA,IkBoDI,MAAA,CAAA;ElBpDG;EAAA,IkByDH,WAAA,CAAA;ElBtDuB;;;;EkB8D3B,UAAA,CAAW,OAAA,EAAS,eAAA;ElB5DX;;;AACL;AAGN;;EkBmEE,aAAA,CAAc,UAAA,EAAY,UAAA;ElBjEZ;;;;;EkB2ER,OAAA,CAAA,GAAW,OAAA;ElB3EH;;;EkB4FR,UAAA,CAAA,GAAc,OAAA;ElBxFL;;;EkBiGf,+BAAA,CAAA;EAQM,GAAA,aAAA,CAAiB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;EAI3F,IAAA,aAAA,CAAkB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;EAI5F,GAAA,aAAA,CAAiB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;EAI3F,MAAA,aAAA,CAAoB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;EAI9F,KAAA,aAAA,CAAmB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;ElB7GrD;;;;;;EkByHxC,MAAA,aAAA,CACJ,OAAA,EAAS,OAAA,EACT,MAAA,EAAQ,UAAA,EACR,WAAA,UACA,OAAA,GAAU,cAAA,GACT,OAAA,CAAQ,CAAA;AAAA;;;;AlB/Jb;;amBDY,YAAA;EACV,OAAA;EACA,IAAA;EACA,KAAA;AAAA;;;;UAMe,kBAAA;EACf,SAAA;EACA,OAAA;EACA,SAAA;EACA,WAAA;EACA,UAAA;EACA,WAAA;EACA,MAAA;AAAA;AnBNF;;;AAAA,amBYY,yBAAA;EACV,QAAA;EACA,MAAA;EACA,MAAA;EACA,KAAA;EACA,OAAA;EACA,aAAA;EACA,UAAA;AAAA;;;;UAMe,qBAAA;EACf,UAAA,EAAY,yBAAyB;EACrC,SAAA;EACA,WAAA;EACA,OAAA;EACA,SAAA;EACA,cAAA;EACA,WAAA;EACA,SAAA;EACA,UAAA;AAAA;;AnBlBkB;AAOpB;UmBiBiB,sBAAA;EACf,SAAA;EACA,WAAA;EAAA,CACC,GAAA;AAAA;;;UC7Cc,gBAAA;EpBFN;EoBIT,IAAA,EAAM,eAAA;EpBJc;EoBMpB,EAAA,YAAc,MAAM;EpBTpB;EoBWA,MAAA;EpBVU;EoBYV,UAAA;AAAA;;;;;ApBTO;AAGT;coBea,SAAA;EAAA;cAQC,IAAA,UAAc,OAAA,EAAS,gBAAA;EpBtBnC;EAAA,IoBiCI,IAAA,CAAA;EpBhCK;EAAA,IoBqCL,EAAA,CAAA,YAAe,MAAA;EpBpCf;EAAA,IoByCA,MAAA,CAAA;EpBtCW;EAAA,IoB2CX,IAAA,CAAA,GAAQ,eAAA;;;;EAOZ,aAAA,CAAc,UAAA,EAAY,UAAA;EpB5CL;;;;EoBqDf,gBAAA,CAAiB,MAAA,WAAiB,OAAA,CAAQ,WAAA;EpBvDhC;;;;;EoBiEV,kBAAA,CAAmB,MAAA,UAAgB,MAAA,GAAS,YAAA,GAAe,OAAA,CAAQ,WAAA;EpB3DvD;AAOpB;;;EoBiEQ,oBAAA,CAAqB,MAAA,WAAiB,OAAA,CAAQ,WAAA;EpBhEN;;;EoBwExC,sBAAA,CAAA,GAA0B,OAAA,CAAQ,kBAAA;EpBxExC;;;;;EoB8FM,WAAA,CAAY,MAAA,UAAgB,QAAA,WAAmB,OAAA;EpB7F9C;AAAA;;;;ACnCT;;EmByJQ,aAAA,CACJ,MAAA,UACA,GAAA,UACA,UAAA,WACA,MAAA,GAAS,YAAA,GACR,OAAA;EnB9J2B;;;;;EmByLxB,mBAAA,CACJ,MAAA,UACA,OAAA,EAAS,qBAAA,GACR,OAAA,CAAQ,sBAAA;AAAA"}

package/dist/index.js

@@ -683,7 +683,7 @@ var PkceNonInteractiveAuth = class {
 		const state = generateState();
 		const redirectUri = `http://localhost:${String(this.#callbackPort)}/callback`;
 		const server = createServer();
-		server.listen(this.#callbackPort);
+		server.listen(this.#callbackPort, "127.0.0.1");
 		const authUrl = `https://${host}/RSTS/Login?${new URLSearchParams({
 			response_type: "code",
 			client_id: "safeguard.js",
@@ -874,6 +874,8 @@ var SafeguardClient = class {
 	#storage;
 	#tokenSet;
 	#connected = false;
+	/** Single-flight refresh promise to prevent thundering herd on token expiry. */
+	#tokenRefreshPromise;
 	constructor(host, options) {
 		if (!host) throw new ConfigurationError("SafeguardClient requires a host");
 		if (!options.auth) throw new ConfigurationError("SafeguardClient requires an auth strategy");
@@ -1009,7 +1011,12 @@ var SafeguardClient = class {
 		if (!this.#tokenSet.expiresIn) return;
 		const elapsed = Date.now() - this.#tokenSet.acquiredAt;
 		const expiresInMs = this.#tokenSet.expiresIn * 1e3;
-		if (elapsed + TOKEN_REFRESH_MARGIN_MS >= expiresInMs) {
+		if (elapsed + TOKEN_REFRESH_MARGIN_MS < expiresInMs) return;
+		if (this.#tokenRefreshPromise) {
+			await this.#tokenRefreshPromise;
+			return;
+		}
+		this.#tokenRefreshPromise = (async () => {
 			if (this.#auth.refreshToken) {
 				const refreshed = await this.#auth.refreshToken(this.#host, this.#httpClient, this.#storage);
 				if (refreshed) {
@@ -1018,6 +1025,11 @@ var SafeguardClient = class {
 				}
 			}
 			this.#tokenSet = await this.#auth.authenticate(this.#host, this.#httpClient, this.#storage);
+		})();
+		try {
+			await this.#tokenRefreshPromise;
+		} finally {
+			this.#tokenRefreshPromise = void 0;
 		}
 	}
 };