@oneidentity/safeguard 8.0.1 → 8.0.2

package/dist/index-53AwvPfY.d.ts

@@ -1,670 +0,0 @@
-//#region src/http/types.d.ts
-/**
- * Platform-agnostic HTTP client interface for the Safeguard SDK.
- */
-interface HttpRequestOptions {
-  url: string;
-  method: string;
-  headers?: Record<string, string>;
-  body?: string | Buffer | null;
-  signal?: AbortSignal;
-  timeout?: number;
-}
-interface HttpResponse {
-  status: number;
-  headers: Record<string, string>;
-  body: string;
-}
-interface TlsOptions {
-  /** Custom CA certificate (PEM). */
-  ca?: string | Buffer;
-  /** Client certificate (PEM) for mTLS. */
-  cert?: string | Buffer;
-  /** Client private key (PEM) for mTLS. */
-  key?: string | Buffer;
-  /** Passphrase for encrypted private key. */
-  passphrase?: string;
-  /** Whether to verify server certificate. Default: true. */
-  rejectUnauthorized?: boolean;
-}
-/**
- * Abstract HTTP client interface.
- * Implementations: NodeHttpClient (undici), BrowserHttpClient (fetch).
- */
-interface HttpClient {
-  request(options: HttpRequestOptions): Promise<HttpResponse>;
-  dispose?(): void;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/storage/types.d.ts
-/**
- * Interface for token/state storage backends.
- */
-interface StorageProvider {
-  get(key: string): string | null;
-  set(key: string, value: string): void;
-  remove(key: string): void;
-  clear(): void;
-}
-/** Well-known storage keys used by the SDK. */
-declare const StorageKeys: {
-  readonly STATE: "safeguard_state";
-  readonly CODE_VERIFIER: "safeguard_code_verifier";
-};
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/secret.d.ts
-/**
- * A wrapper that prevents accidental logging of sensitive values.
- *
- * - `toString()` returns "[REDACTED]"
- * - `toJSON()` returns "[REDACTED]"
- * - `console.log(secretValue)` prints "[REDACTED]"
- * - `.expose()` returns the raw value when intentionally needed
- */
-declare class SecretValue {
-  #private;
-  constructor(value: string);
-  /** Returns the raw secret. Use only when you intentionally need the plaintext. */
-  expose(): string;
-  toString(): string;
-  toJSON(): string;
-  get [Symbol.toStringTag](): string;
-}
-//# sourceMappingURL=secret.d.ts.map
-//#endregion
-//#region src/auth/types.d.ts
-/**
- * Token set returned by authentication.
- */
-interface TokenSet {
-  /** The Safeguard user access token (wrapped to prevent accidental logging). */
-  accessToken: SecretValue;
-  /** Token lifetime in seconds from when it was issued. */
-  expiresIn?: number;
-  /** Timestamp (ms since epoch) when the token was acquired. */
-  acquiredAt: number;
-}
-/**
- * Auth strategy interface. All authentication methods implement this.
- */
-interface Auth {
-  /**
-   * Authenticate against the Safeguard RSTS and return a token set.
-   * @param host - Appliance hostname
-   * @param httpClient - HTTP client to use for requests
-   * @param storage - Storage provider for persisting tokens/state
-   */
-  authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet>;
-  /**
-   * Refresh the token if possible. Returns new token set or null if refresh not supported.
-   */
-  refreshToken?(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null>;
-  /** Human-readable description of this auth strategy (for logging). */
-  readonly description: string;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/types.d.ts
-/**
- * Safeguard appliance service endpoints.
- */
-declare enum Service {
-  CORE = "core",
-  APPLIANCE = "appliance",
-  NOTIFICATION = "notification",
-  A2A = "a2a",
-  EVENT = "event",
-  RSTS = "RSTS",
-}
-/**
- * HTTP methods supported by the Safeguard API.
- */
-declare enum HttpMethod {
-  GET = "GET",
-  POST = "POST",
-  PUT = "PUT",
-  DELETE = "DELETE",
-  PATCH = "PATCH",
-}
-/**
- * Full response from a Safeguard API call (returned when fullResponse: true).
- */
-interface SafeguardResponse<T = unknown> {
-  data: T;
-  status: number;
-  headers: Record<string, string>;
-}
-/**
- * Options for individual API requests.
- */
-interface RequestOptions {
-  /** Request body as JSON-serializable object. */
-  json?: unknown;
-  /** Raw request body. */
-  body?: BodyInit | null;
-  /** Additional HTTP headers. */
-  headers?: Record<string, string>;
-  /** URL query parameters. */
-  query?: Record<string, string | number | boolean>;
-  /** AbortSignal for request cancellation. */
-  signal?: AbortSignal;
-  /** Request timeout in milliseconds (overrides client default). */
-  timeout?: number;
-  /** If true, returns full response with status and headers. */
-  fullResponse?: boolean;
-}
-/**
- * Options for constructing a SafeguardClient.
- */
-interface SafeguardClientOptions {
-  /** Authentication strategy. */
-  auth: Auth;
-  /** Custom CA certificate (PEM string or Buffer). Node.js only. */
-  ca?: string | Buffer;
-  /** Whether to verify TLS certificates. Default: true. */
-  verify?: boolean;
-  /** Safeguard API version prefix. Default: 'v4'. */
-  apiVersion?: string;
-  /** Request timeout in milliseconds. Default: 300_000 (5 min). */
-  timeout?: number;
-  /** Auto-refresh tokens before expiry. Default: true. */
-  autoRefresh?: boolean;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/errors.d.ts
-/**
- * Error hierarchy for the Safeguard SDK.
- *
- * SafeguardError
- * ├── ApiError              (HTTP errors from Safeguard API)
- * │   ├── AuthenticationError  (401)
- * │   ├── AuthorizationError   (403)
- * │   └── NotFoundError        (404)
- * ├── TransportError        (Network/connection failures)
- * └── ConfigurationError    (Invalid client options)
- */
-declare class SafeguardError extends Error {
-  constructor(message: string, options?: ErrorOptions);
-}
-interface ApiErrorBody {
-  Code?: string;
-  Message?: string;
-  InnerError?: {
-    Message?: string;
-  };
-  [key: string]: unknown;
-}
-declare class ApiError extends SafeguardError {
-  readonly status: number;
-  readonly body: ApiErrorBody | null;
-  constructor(message: string, status: number, body?: ApiErrorBody | null, options?: ErrorOptions);
-  /**
-   * Creates an appropriate ApiError subclass based on HTTP status code.
-   */
-  static fromResponse(status: number, body: string | ApiErrorBody | null): ApiError;
-  private static parseBody;
-  private static buildMessage;
-}
-declare class AuthenticationError extends ApiError {
-  constructor(message: string, body?: ApiErrorBody | null, options?: ErrorOptions);
-}
-declare class AuthorizationError extends ApiError {
-  constructor(message: string, body?: ApiErrorBody | null, options?: ErrorOptions);
-}
-declare class NotFoundError extends ApiError {
-  constructor(message: string, body?: ApiErrorBody | null, options?: ErrorOptions);
-}
-declare class TransportError extends SafeguardError {
-  constructor(message: string, options?: ErrorOptions);
-}
-declare class ConfigurationError extends SafeguardError {
-  constructor(message: string, options?: ErrorOptions);
-}
-//# sourceMappingURL=errors.d.ts.map
-//#endregion
-//#region src/utils.d.ts
-/**
- * Validates that a host string is a bare hostname or IP address.
- * Rejects URLs, paths, query strings, userinfo, and embedded ports.
- *
- * @throws {ConfigurationError} if the host contains disallowed characters
- */
-declare function validateHost(host: string): string;
-/**
- * Builds the base URL for a Safeguard service endpoint.
- *
- * @example
- * buildServiceUrl('appliance.example.com', Service.CORE)
- * // => 'https://appliance.example.com/service/core/v4'
- */
-declare function buildServiceUrl(host: string, service: Service, apiVersion?: string): string;
-/**
- * Builds a full API URL including path and optional query parameters.
- *
- * @example
- * buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq "admin"' })
- * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'
- */
-declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>, apiVersion?: string): string;
-/**
- * Encodes bytes to a URL-safe base64 string (no padding).
- */
-declare function base64UrlEncode(bytes: Uint8Array): string;
-/**
- * Generates a cryptographically random code verifier for PKCE.
- * Returns a 43-character base64url string (32 random bytes).
- */
-declare function generateCodeVerifier(): string;
-/**
- * Computes the S256 code challenge from a code verifier.
- * Uses Web Crypto API (available in Node 20+ and all modern browsers).
- */
-declare function generateCodeChallenge(verifier: string): Promise<string>;
-/**
- * Generates a random state parameter for OAuth flows.
- */
-declare function generateState(): string;
-/**
- * Extracts the `exp` claim from a JWT and returns expiresIn (seconds from now).
- * Returns undefined if the token is not a valid JWT or has no `exp` claim.
- */
-//#endregion
-//#region src/storage/memory.d.ts
-/**
- * In-memory storage provider. Default for Node.js environments.
- * Data does not persist across process restarts.
- */
-declare class MemoryStorage implements StorageProvider {
-  #private;
-  get(key: string): string | null;
-  set(key: string, value: string): void;
-  remove(key: string): void;
-  clear(): void;
-}
-//# sourceMappingURL=memory.d.ts.map
-//#endregion
-//#region src/storage/session.d.ts
-/**
- * Browser sessionStorage adapter. Data persists for the browser tab lifetime.
- * Requires a DOM environment (browser or jsdom).
- */
-declare class BrowserSessionStorage implements StorageProvider {
-  get(key: string): string | null;
-  set(key: string, value: string): void;
-  remove(key: string): void;
-  clear(): void;
-}
-//# sourceMappingURL=session.d.ts.map
-//#endregion
-//#region src/http/node.d.ts
-/**
- * Node.js HTTP client using undici for full TLS control.
- * Creates a per-instance Agent — no global state mutation.
- */
-declare class NodeHttpClient implements HttpClient {
-  #private;
-  constructor(tlsOptions?: TlsOptions);
-  request(options: HttpRequestOptions): Promise<HttpResponse>;
-  dispose(): void;
-}
-//# sourceMappingURL=node.d.ts.map
-//#endregion
-//#region src/http/browser.d.ts
-/**
- * Browser HTTP client using native fetch API.
- * No TLS configuration needed — browser handles certificates.
- */
-declare class BrowserHttpClient implements HttpClient {
-  #private;
-  constructor(options?: {
-    credentials?: RequestCredentials;
-  });
-  request(options: HttpRequestOptions): Promise<HttpResponse>;
-}
-//# sourceMappingURL=browser.d.ts.map
-//#endregion
-//#region src/auth/password.d.ts
-interface PasswordAuthOptions {
-  username: string;
-  password: string;
-  /** Identity provider name. Default: 'local'. */
-  provider?: string;
-}
-/**
- * Authenticates using username/password via RSTS Resource Owner grant.
- */
-declare class PasswordAuth implements Auth {
-  #private;
-  constructor(options: PasswordAuthOptions);
-  get description(): string;
-  authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
-  refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null>;
-}
-//# sourceMappingURL=password.d.ts.map
-//#endregion
-//#region src/auth/certificate.d.ts
-interface CertificateAuthOptions {
-  /** Path to PEM certificate file, or PEM string. */
-  certFile?: string;
-  /** Path to PEM private key file, or PEM string. */
-  keyFile?: string;
-  /** PEM certificate content (alternative to certFile). */
-  cert?: string | Buffer;
-  /** PEM key content (alternative to keyFile). */
-  key?: string | Buffer;
-  /** Path to PFX/PKCS12 file (alternative to cert+key). */
-  pfxFile?: string;
-  /** PFX/PKCS12 content (alternative to cert+key). */
-  pfx?: string | Buffer;
-  /** Passphrase for encrypted private key or PFX. */
-  passphrase?: string;
-  /** Identity provider name. Default: 'certificate'. */
-  provider?: string;
-}
-/**
- * Authenticates using a client certificate (mTLS) against RSTS.
- * Node.js only — requires TLS client cert support in HttpClient.
- */
-declare class CertificateAuth implements Auth {
-  #private;
-  constructor(options: CertificateAuthOptions);
-  get description(): string;
-  /** Returns the TLS options needed to create an mTLS HttpClient. */
-  getTlsOptions(): {
-    cert?: string | Buffer;
-    key?: string | Buffer;
-    pfx?: string | Buffer;
-    passphrase?: string;
-  };
-  authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
-  refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null>;
-}
-//# sourceMappingURL=certificate.d.ts.map
-//#endregion
-//#region src/auth/pkce.d.ts
-interface PkceAuthOptions {
-  /** OAuth redirect URI (must match RSTS configuration). */
-  redirectUri: string;
-  /** Identity provider name. Default: 'local'. */
-  provider?: string;
-}
-/**
- * Authenticates using PKCE (Proof Key for Code Exchange) with browser redirect.
- * For browser environments where the user is redirected to RSTS login.
- */
-declare class PkceAuth implements Auth {
-  #private;
-  constructor(options: PkceAuthOptions);
-  get description(): string;
-  /**
-   * Initiates the PKCE flow. If a stored authorization code exists (from callback),
-   * exchanges it for a token. Otherwise, redirects to RSTS login.
-   */
-  authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet>;
-}
-//# sourceMappingURL=pkce.d.ts.map
-//#endregion
-//#region src/auth/pkce-noninteractive.d.ts
-interface PkceNonInteractiveAuthOptions {
-  /** Identity provider name. Default: 'local'. */
-  provider?: string;
-  /** Port for the local callback server. Default: 8400. */
-  callbackPort?: number;
-}
-/**
- * Non-interactive PKCE authentication for Node.js automation.
- * Starts a local HTTP server to receive the callback, opens the system browser
- * for login, and waits for the redirect.
- *
- * Matches PySafeguard's PkceAuth behavior (local server pattern).
- */
-declare class PkceNonInteractiveAuth implements Auth {
-  #private;
-  constructor(options?: PkceNonInteractiveAuthOptions);
-  get description(): string;
-  authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
-}
-//# sourceMappingURL=pkce-noninteractive.d.ts.map
-//#endregion
-//#region src/auth/pkce-callback.d.ts
-interface PkceCallbackResult {
-  code: string;
-  state: string;
-}
-/**
- * Parses the PKCE callback URL and stores the authorization code.
- * Call this on the callback/redirect page to complete the PKCE flow.
- *
- * This is the explicit replacement for the legacy `safeguardJsAccessTokenChecker.js`
- * script that ran as a side-effect on import.
- *
- * @param storage - StorageProvider to persist the code
- * @param url - The callback URL to parse (defaults to window.location.href)
- * @returns The parsed code and state, or null if not a valid callback
- */
-declare function handlePkceCallback(storage: StorageProvider, url?: string): PkceCallbackResult | null;
-//# sourceMappingURL=pkce-callback.d.ts.map
-//#endregion
-//#region src/auth/token.d.ts
-interface TokenAuthOptions {
-  /** Pre-existing Safeguard access token. */
-  accessToken: string;
-}
-/**
- * Uses a pre-existing access token. No authentication flow — the token is assumed valid.
- * Useful when tokens are obtained externally or for service-to-service scenarios.
- */
-declare class TokenAuth implements Auth {
-  #private;
-  constructor(options: TokenAuthOptions);
-  get description(): string;
-  authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
-}
-//# sourceMappingURL=token.d.ts.map
-//#endregion
-//#region src/auth/anonymous.d.ts
-/**
- * Anonymous authentication — no credentials.
- * Used for accessing public Safeguard endpoints (e.g., appliance status).
- */
-declare class AnonymousAuth implements Auth {
-  get description(): string;
-  authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
-}
-//# sourceMappingURL=anonymous.d.ts.map
-//#endregion
-//#region src/client.d.ts
-/**
- * Main entry point for the Safeguard SDK.
- * Instance-based — no global state. Multiple clients to different appliances are supported.
- */
-declare class SafeguardClient {
-  #private;
-  constructor(host: string, options: SafeguardClientOptions);
-  /** The appliance hostname this client connects to. */
-  get host(): string;
-  /** The API version prefix (e.g. 'v4'). */
-  get apiVersion(): string;
-  /** Custom CA certificate, if provided. */
-  get ca(): string | Buffer | undefined;
-  /** Whether TLS verification is enabled. */
-  get verify(): boolean;
-  /** Whether the client has an active authenticated session. */
-  get isConnected(): boolean;
-  /**
-   * Sets a custom StorageProvider (e.g., BrowserSessionStorage).
-   * Must be called before connect().
-   */
-  setStorage(storage: StorageProvider): this;
-  /**
-   * Sets the HttpClient implementation. If not called, must be set before connect().
-   * The factory pattern allows platform-specific client injection:
-   *   - Node: `new NodeHttpClient({ ca, rejectUnauthorized })`
-   *   - Browser: `new BrowserHttpClient()`
-   */
-  setHttpClient(httpClient: HttpClient): this;
-  /**
-   * Authenticate and establish a session.
-   * @throws {AuthenticationError} if authentication fails
-   * @throws {ConfigurationError} if httpClient not set
-   */
-  connect(): Promise<void>;
-  /**
-   * Disconnect — dispose HTTP client and clear token.
-   */
-  disconnect(): Promise<void>;
-  /**
-   * Returns seconds until the current access token expires, or -1 if unknown.
-   */
-  getAccessTokenLifetimeRemaining(): number;
-  get<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  post<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  put<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  delete<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  patch<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  /**
-   * Low-level request method. Convenience verbs delegate here.
-   *
-   * When `options.fullResponse` is true, returns SafeguardResponse<T> with status + headers.
-   * Otherwise returns just the parsed response body as T.
-   */
-  invoke<T = unknown>(service: Service, method: HttpMethod, relativeUrl: string, options?: RequestOptions): Promise<T>;
-}
-//# sourceMappingURL=client.d.ts.map
-//#endregion
-//#region src/a2a/types.d.ts
-/**
- * SSH key formats for private key retrieval.
- */
-declare enum SshKeyFormat {
-  OpenSsh = "OpenSsh",
-  Ssh2 = "Ssh2",
-  Putty = "Putty",
-}
-/**
- * An A2A retrievable account as returned by the discovery endpoint.
- */
-interface RetrievableAccount {
-  AccountId: number;
-  AssetId: number;
-  AssetName: string;
-  AccountName: string;
-  DomainName: string;
-  AccountType: string;
-  ApiKey: string;
-}
-/**
- * Brokered access request types.
- */
-declare enum BrokeredAccessRequestType {
-  Password = "Password",
-  SshKey = "SshKey",
-  ApiKey = "ApiKey",
-  Token = "Token",
-  RdpFile = "RdpFile",
-  RemoteDesktop = "RemoteDesktop",
-  SshSession = "SshSession",
-}
-/**
- * Options for creating a brokered access request.
- */
-interface BrokeredAccessRequest {
-  AccessType: BrokeredAccessRequestType;
-  ForUserId?: number;
-  ForUserName?: string;
-  AssetId?: number;
-  AccountId?: number;
-  AccountAssetId?: number;
-  AccountName?: string;
-  AssetName?: string;
-  DomainName?: string;
-}
-/**
- * Response from a brokered access request.
- */
-interface BrokeredAccessResponse {
-  RequestId: string;
-  AccessToken?: string;
-  [key: string]: unknown;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/a2a/index.d.ts
-interface A2AClientOptions {
-  /** Certificate-based auth (A2A always uses client certificates). */
-  auth: CertificateAuth;
-  /** Custom CA certificate (PEM). */
-  ca?: string | Buffer;
-  /** Whether to verify TLS. Default: true. */
-  verify?: boolean;
-  /** API version string (default: 'v4'). */
-  apiVersion?: string;
-}
-/**
- * Application-to-Application client for programmatic credential retrieval.
- * Uses client certificate authentication exclusively.
- *
- * Full parity with PySafeguard and SafeguardDotNet A2A clients.
- */
-declare class A2AClient {
-  #private;
-  constructor(host: string, options: A2AClientOptions);
-  /** The appliance hostname. */
-  get host(): string;
-  /** Custom CA, if set. */
-  get ca(): string | Buffer | undefined;
-  /** Whether TLS verification is enabled. */
-  get verify(): boolean;
-  /** The CertificateAuth providing TLS client cert configuration. */
-  get auth(): CertificateAuth;
-  /**
-   * Sets the HttpClient (must be configured with client cert TLS).
-   */
-  setHttpClient(httpClient: HttpClient): this;
-  /**
-   * Retrieve a password credential via A2A.
-   * @param apiKey - The API key for the retrievable account
-   */
-  retrievePassword(apiKey: string): Promise<SecretValue>;
-  /**
-   * Retrieve an SSH private key credential via A2A.
-   * @param apiKey - The API key for the retrievable account
-   * @param format - SSH key format (default: OpenSsh)
-   */
-  retrievePrivateKey(apiKey: string, format?: SshKeyFormat): Promise<SecretValue>;
-  /**
-   * Retrieve an API key secret credential via A2A.
-   * @param apiKey - The API key for the retrievable account
-   */
-  retrieveApiKeySecret(apiKey: string): Promise<SecretValue>;
-  /**
-   * Get the list of retrievable accounts available to this certificate.
-   */
-  getRetrievableAccounts(): Promise<RetrievableAccount[]>;
-  /**
-   * Set a password on a managed account via A2A.
-   * @param apiKey - The API key for the account
-   * @param password - The new password value
-   */
-  setPassword(apiKey: string, password: string): Promise<void>;
-  /**
-   * Set a private key on a managed account via A2A.
-   * @param apiKey - The API key for the account
-   * @param key - The private key content
-   * @param passphrase - Optional passphrase for the key
-   * @param format - SSH key format (default: OpenSsh)
-   */
-  setPrivateKey(apiKey: string, key: string, passphrase?: string, format?: SshKeyFormat): Promise<void>;
-  /**
-   * Submit a brokered access request via A2A.
-   * @param apiKey - The API key for the access request
-   * @param request - The access request details
-   */
-  brokerAccessRequest(apiKey: string, request: BrokeredAccessRequest): Promise<BrokeredAccessResponse>;
-}
-//#endregion
-export { A2AClient, type A2AClientOptions, AnonymousAuth, ApiError, type ApiErrorBody, type Auth, AuthenticationError, AuthorizationError, type BrokeredAccessRequest, BrokeredAccessRequestType, type BrokeredAccessResponse, BrowserHttpClient, BrowserSessionStorage, CertificateAuth, type CertificateAuthOptions, ConfigurationError, type HttpClient, HttpMethod, type HttpRequestOptions, type HttpResponse, MemoryStorage, NodeHttpClient, NotFoundError, PasswordAuth, type PasswordAuthOptions, PkceAuth, type PkceAuthOptions, type PkceCallbackResult, PkceNonInteractiveAuth, type PkceNonInteractiveAuthOptions, type RequestOptions, type RetrievableAccount, SafeguardClient, type SafeguardClientOptions, SafeguardError, type SafeguardResponse, SecretValue, Service, SshKeyFormat, StorageKeys, type StorageProvider, type TlsOptions, TokenAuth, type TokenAuthOptions, type TokenSet, TransportError, base64UrlEncode, buildRequestUrl, buildServiceUrl, generateCodeChallenge, generateCodeVerifier, generateState, handlePkceCallback, validateHost };
-//# sourceMappingURL=index-53AwvPfY.d.ts.map

package/dist/index-53AwvPfY.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-53AwvPfY.d.ts","names":[],"sources":["../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/types.ts","../src/errors.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/http/node.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/certificate.ts","../src/auth/pkce.ts","../src/auth/pkce-noninteractive.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts","../src/a2a/types.ts","../src/a2a/index.ts"],"mappings":";;AAIA;;AAGY,UAHK,kBAAA,CAGL;KACM,EAAA,MAAA;QACP,EAAA,MAAA;EAAW,OAAA,CAAA,EAFV,MAEU,CAAA,MAAA,EAAA,MAAA,CAAA;EAIL,IAAA,CAAA,EAAA,MAAA,GALC,MAKW,GAAA,IAElB;EAIM,MAAA,CAAA,EAVN,WAUgB;EAAA,OAAA,CAAA,EAAA,MAAA;;AAIT,UAVD,YAAA,CAUC;QAED,EAAA,MAAA;EAAM,OAAA,EAVZ,MAUY,CAAA,MAAA,EAAA,MAAA,CAAA;EAWN,IAAA,EAAA,MAAA;;AACE,UAlBF,UAAA,CAkBE;;KAAqB,EAAA,MAAA,GAhBxB,MAgBwB;EAAO;kBAd7B;;iBAED;ECtBA;EAQJ,UAAA,CAAA,EAAA,MAGH;;;;ACJV;;;;ACHiB,UH6BA,UAAA,CG3BF;EAUE,OAAI,CAAA,OAAA,EHkBF,kBGlBE,CAAA,EHkBmB,OGlBnB,CHkB2B,YGlB3B,CAAA;EAAA,OAAA,GAAA,EAAA,IAAA;;;;;;AHfrB;;AAGY,UCJK,eAAA,CDIL;KACM,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;KACP,CAAA,GAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAW,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAIL,KAAA,EAAA,EAAA,IAAA;AAMjB;;AAEgB,cCVH,WDUG,EAAA;WAEE,KAAA,EAAA,iBAAA;WAED,aAAA,EAAA,yBAAA;AAAM,CAAA;AAWvB;;;;AAhCA;;;;;AAKsB;AAItB;AAMiB,cETJ,WAAA,CFSc;EAAA,CAAA,OAAA;aAEX,CAAA,KAAA,EAAA,MAAA;;QAIC,CAAA,CAAA,EAAA,MAAA;EAAM,QAAA,CAAA,CAAA,EAAA,MAAA;EAWN,MAAA,CAAA,CAAA,EAAA,MAAU;EAAA,KEDpB,MAAA,CAAO,WAAW,GFCE,EAAA,MAAA;;;;;;;;AA3BL,UGFL,QAAA,CHEK;EAIL;EAMA,WAAA,EGVF,WHUY;EAAA;WAEX,CAAA,EAAA,MAAA;;YAIC,EAAA,MAAA;AAAM;AAWvB;;;AACgD,UGlB/B,IAAA,CHkB+B;;AAAD;;;;AClC/C;EAQa,YAAA,CAAA,IAGH,EAAA,MAAA,EAAA,UAAA,EEY+B,UFZ/B,EAAA,OAAA,EEYoD,eFZpD,CAAA,EEYsE,OFZtE,CEY8E,QFZ9E,CAAA;;;;ECJG,YAAA,EAAW,IAAA,EAAA,MAyBjB,EAAA,UAAO,ECJ4B,UDIjB,EAAA,OAAA,ECJsC,eDItC,CAAA,ECJwD,ODIxD,CCJgE,QDIhE,GAAA,IAAA,CAAA;;;;AC5BzB;;;;AHHA;;AAGY,aIJA,OAAA;MJKM,GAAA,MAAA;WACP,GAAA,WAAA;EAAW,YAAA,GAAA,cAAA;EAIL,GAAA,GAAA,KAAA;EAMA,KAAA,GAAA,OAAU;EAAA,IAAA,GAAA,MAAA;;;;AAMJ;AAWN,aIrBL,UAAA;EJqBe,GAAA,GAAA,KAAA;MACR,GAAA,MAAA;KAA6B,GAAA,KAAA;QAAR,GAAA,QAAA;EAAO,KAAA,GAAA,OAAA;;;;AClC/C;AAQa,UGeI,iBHZP,CAAA,IAAA,OAAA,CAAA,CAAA;QGaF;;WAEG;AFnBX;;;;ACHiB,UC4BA,cAAA,CD1BF;EAUE;EAAI,IAAA,CAAA,EAAA,OAAA;;MAOyC,CAAA,ECarD,QDbqD,GAAA,IAAA;;SAAkB,CAAA,ECepE,MDfoE,CAAA,MAAA,EAAA,MAAA,CAAA;;OAKjB,CAAA,ECYrD,MDZqD,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA;;QAAkB,CAAA,ECctE,WDdsE;EAAO;;;;AC5BxF;AAYA;AAWA;;AACQ,UA4BS,sBAAA,CA5BT;;EAES,IAAA,EA0BsB,IA1BtB;EAMA;EAAc,EAAA,CAAA,EAAA,MAAA,GAwBf,MAxBe;;QAMnB,CAAA,EAAA,OAAA;;YAID,CAAA,EAAA,MAAA;EAAW;EAUL,OAAA,CAAA,EAAA,MAAA;EAAsB;aAAA,CAAA,EAAA,OAAA;;AAIjB;;;;AJvDtB;;;;;AAKsB;AAItB;AAMA;;;AAIkB,cKXL,cAAA,SAAuB,KAAA,CLWlB;aAED,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EKZwB,YLYxB;AAAM;AAWN,UKjBA,YAAA,CLiBU;EAAA,IAAA,CAAA,EAAA,MAAA;SACR,CAAA,EAAA,MAAA;YAA6B,CAAA,EAAA;IAAR,OAAA,CAAA,EAAA,MAAA;EAAO,CAAA;;;cKXlC,QAAA,SAAiB,cAAA;EJvBb,SAAA,MAAA,EAAA,MAAe;EAQnB,SAAA,IAAA,EIiBI,YJdP,GAAA,IAAA;sDIgB2C,+BAAsC;;;AHpB3F;qDG8BqD,sBAAsB;;;AFjC3E;AAYiB,cEwDJ,mBAAA,SAA4B,QAAA,CFxDpB;EAAA,WAAA,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EEyDgB,YFzDhB,GAAA,IAAA,EAAA,OAAA,CAAA,EEyDsD,YFzDtD;;AAOyC,cEwDjD,kBAAA,SAA2B,QAAA,CFxDsB;aAA0B,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EEyDnD,YFzDmD,GAAA,IAAA,EAAA,OAAA,CAAA,EEyDb,YFzDa;;AAK9C,cE0D7B,aAAA,SAAsB,QAAA,CF1DO;aAAqB,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EE2D1B,YF3D0B,GAAA,IAAA,EAAA,OAAA,CAAA,EE2DY,YF3DZ;;AAAkB,cEiEpE,cAAA,SAAuB,cAAA,CFjE6C;EAAO,WAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EEkE/C,YFlE+C;;cEwE3E,kBAAA,SAA2B,cAAA;yCACC;ADrGzC;AAYA;;;AJXA;;;;;AAKsB;AAIL,iBMJD,YAAA,CNMC,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAIjB;;;;;AAMuB;AAWvB;AAA2B,iBMYX,eAAA,CNZW,IAAA,EAAA,MAAA,EAAA,OAAA,EMY4B,ONZ5B,EAAA,UAAA,CAAA,EAAA,MAAA,CAAA,EAAA,MAAA;;;;AACoB;;;;AClC9B,iBK2DD,eAAA,CL3DgB,IAAA,EAAA,MAAA,EAAA,OAAA,EK6DrB,OL7DqB,EAAA,WAAA,EAAA,MAAA,EAAA,KAAA,CAAA,EK+DtB,ML/DsB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,EAAA,UAAA,CAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAQhC;;;iBK0EgB,eAAA,QAAuB;AJ3EvC;;;;ACHiB,iBGuFD,oBAAA,CAAA,CHrFU,EAAA,MAAA;AAU1B;;;;AAOwF,iBG8ElE,qBAAA,CH9EkE,QAAA,EAAA,MAAA,CAAA,EG8EzB,OH9EyB,CAAA,MAAA,CAAA;;;;AAKC,iBGmFzE,aAAA,CAAA,CHnFyE,EAAA,MAAA;;AAAD;;;;;AH3BxF;;;;AAKW,cOHE,aAAA,YAAyB,ePG3B,CAAA;EAAW,CAAA,OAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,CAAA,EAAA,MAAA,GAElB,IAAA;EAIM,GAAA,CAAA,GAAA,EAAA,MAAU,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAA,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OAEX,CAAA,CAAA,EAAA,IAAA;;;;;AAjBhB;;;;AAKW,cQHE,qBAAA,YAAiC,eRGnC,CAAA;EAAW,GAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,EAAA,KAAA,EAAA,MAElB,CAAA,EAAM,IAAA;EAIA,MAAA,CAAA,GAAA,EAAA,MAAU,CAAA,EAAA,IAAA;EAAA,KAAA,CAAA,CAAA,EAAA,IAAA;;;;;AAf3B;;;;AAKW,cSFE,cAAA,YAA0B,UTE5B,CAAA;EAAW,CAAA,OAAA;EAIL,WAAA,CAAA,UAEA,CAFY,ESHF,UTKV;EAIA,OAAA,CAAA,OAAU,ESGF,kBTHE,CAAA,ESGmB,OTHnB,CSG2B,YTH3B,CAAA;EAAA,OAAA,CAAA,CAAA,EAAA,IAAA;;;;;AAf3B;;;;AAKW,cUHE,iBAAA,YAA6B,UVG/B,CAAA;EAAW,CAAA,OAAA;EAIL,WAAA,CAAA,OAMU,CANE,EAAA;IAMZ,WAAU,CAAA,EUVa,kBVUb;EAAA,CAAA;SAEX,CAAA,OAAA,EURS,kBVQT,CAAA,EUR8B,OVQ9B,CURsC,YVQtC,CAAA;;;;;AAdJ,UWAK,mBAAA,CXAL;UACM,EAAA,MAAA;UACP,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAM7B;;;;AAMiB,cWRJ,YAAA,YAAwB,IXQpB,CAAA;EAAM,CAAA,OAAA;EAWN,WAAA,CAAA,OAAU,EWdJ,mBXcI;EAAA,IAAA,WAAA,CAAA,CAAA,EAAA,MAAA;cACR,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EWF4B,UXE5B,EAAA,QAAA,EWFkD,eXElD,CAAA,EWFoE,OXEpE,CWF4E,QXE5E,CAAA;cAA6B,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EWQD,UXRC,EAAA,OAAA,EWQoB,eXRpB,CAAA,EWQsC,OXRtC,CWQ8C,QXR9C,GAAA,IAAA,CAAA;;AAAD;;;AA9BnC,UYAK,sBAAA,CZAL;;UAED,CAAA,EAAA,MAAA;EAAW;EAIL,OAAA,CAAA,EAAA,MAAY;EAMZ;EAAU,IAAA,CAAA,EAAA,MAAA,GYNT,MZMS;;KAIT,CAAA,EAAA,MAAA,GYRD,MZQC;;EAEK,OAAA,CAAA,EAAA,MAAA;EAWN;EAAU,GAAA,CAAA,EAAA,MAAA,GYjBV,MZiBU;;YACqB,CAAA,EAAA,MAAA;;EAAD,QAAA,CAAA,EAAA,MAAA;;;;AClC/C;AAQA;cWmBa,eAAA,YAA2B;;uBAUjB;EV9BV,IAAA,WAAW,CAAA,CAAA,EAAA,MAyBjB;;;oBU0B8B;ITtDpB,GAAA,CAAA,EAAA,MAAQ,GSsDmC,MTpD7C;IAUE,GAAI,CAAA,EAAA,MAAA,GS0C8D,MT1C9D;IAAA,UAAA,CAAA,EAAA,MAAA;;cAOyC,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,ES+Cf,UT/Ce,EAAA,QAAA,ES+CO,eT/CP,CAAA,ES+CyB,OT/CzB,CS+CiC,QT/CjC,CAAA;cAA0B,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,ESuDzC,UTvDyC,EAAA,OAAA,ESuDpB,eTvDoB,CAAA,ESuDF,OTvDE,CSuDM,QTvDN,GAAA,IAAA,CAAA;;;;;AHnB5E,UaCK,eAAA,CbDL;;aAED,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAM7B;;;;;AAMuB,caNV,QAAA,YAAoB,IbMV,CAAA;EAWN,CAAA,OAAA;EAAU,WAAA,CAAA,OAAA,EabJ,ebaI;MACR,WAAA,CAAA,CAAA,EAAA,MAAA;;;AAA4B;;yCaCA,qBAAqB,kBAAkB,QAAQ;;AZnC9F;;;ADIY,UcAK,6BAAA,CdAL;;UAED,CAAA,EAAA,MAAA;EAAW;EAIL,YAAA,CAAA,EAAY,MAAA;AAM7B;;;;;AAMuB;AAWvB;;AACmB,cchBN,sBAAA,YAAkC,IdgB5B,CAAA;UAA6B;aAAR,CAAA,OAAA,CAAA,EcZhB,6BdYgB;EAAO,IAAA,WAAA,CAAA,CAAA,EAAA,MAAA;yCcHA,sBAAsB,kBAAkB,QAAQ;;;;;Ad9B9E,UeAA,kBAAA,CfAkB;EAAA,IAAA,EAAA,MAAA;OAGvB,EAAA,MAAA;;;AAEU;AAItB;AAMA;;;;;AAMuB;AAWvB;;AACmB,iBejBH,kBAAA,CfiBG,OAAA,EehBR,efgBQ,EAAA,GAAA,CAAA,EAAA,MAAA,CAAA,EedhB,kBfcgB,GAAA,IAAA;;;;AA9BP,UgBDK,gBAAA,ChBCL;;aAED,EAAA,MAAA;AAAW;AAItB;AAMA;;;AAIkB,cgBRL,SAAA,YAAqB,IhBQhB,CAAA;UAED;EAAM,WAAA,CAAA,OAAA,EgBPA,gBhBOA;EAWN,IAAA,WAAU,CAAA,CAAA,EAAA,MAAA;EAAA,YAAA,CAAA,KAAA,EAAA,MAAA,EAAA,WAAA,EgBTsB,UhBStB,EAAA,QAAA,EgBT4C,ehBS5C,CAAA,EgBT8D,OhBS9D,CgBTsE,QhBStE,CAAA;;;;;;;;AA3BL;AAIL,ciBJJ,aAAA,YAAyB,IjBMrB,CAAA;EAIA,IAAA,WAAU,CAAA,CAAA,EAAA,MAAA;EAAA,YAAA,CAAA,KAAA,EAAA,MAAA,EAAA,WAAA,EiBLsB,UjBKtB,EAAA,QAAA,EiBL4C,ejBK5C,CAAA,EiBL8D,OjBK9D,CiBLsE,QjBKtE,CAAA;;;;;;;AAVL;AAItB;AAMiB,ckBFJ,eAAA,ClBEc;EAAA,CAAA,OAAA;aAEX,CAAA,IAAA,EAAA,MAAA,EAAA,OAAA,EkBUqB,sBlBVrB;;MAIC,IAAA,CAAA,CAAA,EAAA,MAAA;EAAM;EAWN,IAAA,UAAU,CAAA,CAAA,EAAA,MAAA;EAAA;MACR,EAAA,CAAA,CAAA,EAAA,MAAA,GkBkBE,MlBlBF,GAAA,SAAA;;MAAqB,MAAA,CAAA,CAAA,EAAA,OAAA;EAAO;;;;AClC/C;AAQA;sBiB8DsB;;;AhB/DtB;;;;ECHiB,aAAQ,CAAA,UAEV,Ee2Ea,Uf3EF,CAAA,EAAA,IAAA;EAUT;;;;;SAO+D,CAAA,CAAA,EeoE7D,OfpE6D,CAAA,IAAA,CAAA;;;;YAKC,CAAA,CAAA,EegF3D,OfhF2D,CAAA,IAAA,CAAA;EAAO;;;;EC5B5E,GAAA,CAAA,IAAA,OAAO,CAAA,CAAA,OAAA,Ec6He,Od7Hf,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,Ec6HuD,cd7HvD,CAAA,Ec6HwE,Od7HxE,Cc6HgF,Cd7HhF,CAAA;EAYP,IAAA,CAAA,IAAA,OAAU,CAAA,CAAA,OAAA,EcqHa,OdrHb,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EcqHqD,cdrHrD,CAAA,EcqHsE,OdrHtE,CcqH8E,CdrH9E,CAAA;EAWL,GAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAiB,Ec8GA,Od9GA,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,Ec8GwC,cd9GxC,CAAA,Ec8GyD,Od9GzD,Cc8GiE,Cd9GjE,CAAA;EAAA,MAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EckHG,OdlHH,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EckH2C,cdlH3C,CAAA,EckH4D,OdlH5D,CckHoE,CdlHpE,CAAA;OAC1B,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EcqH4B,OdrH5B,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EcqHoE,cdrHpE,CAAA,EcqHqF,OdrHrF,CcqH6F,CdrH7F,CAAA;;AAES;AAMjB;;;;QAQU,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EckHG,OdlHH,EAAA,MAAA,EcmHE,UdnHF,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EcqHI,cdrHJ,CAAA,EcsHL,OdtHK,CcsHG,CdtHH,CAAA;;AAEY;;;;AJzCtB;;AAGY,amBJA,YAAA;SnBKM,GAAA,SAAA;MACP,GAAA,MAAA;EAAW,KAAA,GAAA,OAAA;AAItB;AAMA;;;AAIkB,UmBXD,kBAAA,CnBWC;WAED,EAAA,MAAA;EAAM,OAAA,EAAA,MAAA;EAWN,SAAA,EAAA,MAAU;EAAA,WAAA,EAAA,MAAA;YACR,EAAA,MAAA;aAA6B,EAAA,MAAA;QAAR,EAAA,MAAA;AAAO;;;;AClC9B,akBsBL,yBAAA;ElBdC,QAAA,GAAA,UAGH;;;;ECJG,OAAA,GAAA,SAAW;;;;ACHxB;AAYA;;AAOyC,UgBYxB,qBAAA,ChBZwB;YAAqB,EgBahD,yBhBbgD;WAA0B,CAAA,EAAA,MAAA;aAAR,CAAA,EAAA,MAAA;SAKtC,CAAA,EAAA,MAAA;WAAqB,CAAA,EAAA,MAAA;gBAA0B,CAAA,EAAA,MAAA;aAAR,CAAA,EAAA,MAAA;EAAO,SAAA,CAAA,EAAA,MAAA;;;;AC5BxF;AAYA;AAWiB,Ue2BA,sBAAA,Cf3BiB;EAAA,SAAA,EAAA,MAAA;aAC1B,CAAA,EAAA,MAAA;MAEG,EAAA,MAAA,CAAA,EAAA,OAAA;AAAM;AAMjB;;;AJ1BW,UoBEM,gBAAA,CpBFN;EAAW;EAIL,IAAA,EoBAT,epBAqB;EAMZ;EAAU,EAAA,CAAA,EAAA,MAAA,GoBJX,MpBIW;;QAIT,CAAA,EAAA,OAAA;;EAEK,UAAA,CAAA,EAAA,MAAA;AAWvB;;;;;AAC+C;;coBTlC,SAAA;;EnBzBI,WAAA,CAAA,IAAA,EAAe,MAAA,EAAA,OAAA,EmBiCK,gBnBjCL;EAQnB;;;qBmByCQ;ElB1CR;;;ckBoDC;EjBvDG;AAYjB;;eAOyC,CAAA,UAAA,EiB2Cb,UjB3Ca,CAAA,EAAA,IAAA;;;;;kBAKsB,CAAA,MAAA,EAAA,MAAA,CAAA,EiB+CrB,OjB/CqB,CiB+Cb,WjB/Ca,CAAA;;;AAAyB;;;8CiByDpC,eAAe,QAAQ;EhBrF/D;AAYZ;AAWA;;sBACQ,CAAA,MAAA,EAAA,MAAA,CAAA,EgB0EsC,OhB1EtC,CgB0E8C,WhB1E9C,CAAA;;AAES;AAMjB;EAA+B,sBAAA,CAAA,CAAA,EgB0EG,OhB1EH,CgB0EW,kBhB1EX,EAAA,CAAA;;;;;AAUT;EAUL,WAAA,CAAA,MAAA,EAAA,MAAsB,EAAA,QAAA,EAAA,MAAA,CAAA,EgB4EgB,OhB5EhB,CAAA,IAAA,CAAA;EAAA;;;AAIjB;;;;EC/CT,aAAA,CAAA,MAAe,EAAA,MAAA,EAAA,GAAA,EAAA,MAAA,EAAA,UAAA,CAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EeoJf,YfpJe,CAAA,EeqJvB,OfrJuB,CAAA,IAAA,CAAA;EAAA;;;AAAa;AAOzC;EAOa,mBAAS,CAAA,MAAA,EAAA,MAAA,EAAA,OAAA,EeoKT,qBfpKS,CAAA,EeqKjB,OfrKiB,CeqKT,sBfrKS,CAAA"}