@oneidentity/safeguard 8.1.0 → 8.2.0

package/dist/index.d.ts

@@ -15,6 +15,11 @@ interface HttpResponse {
   headers: Record<string, string>;
   body: string;
 }
+/**
+ * Supported TLS protocol versions for {@link TlsOptions.minVersion} /
+ * {@link TlsOptions.maxVersion}. Matches Node's `tls` `SecureVersion` strings.
+ */
+type TlsVersion = 'TLSv1.3' | 'TLSv1.2' | 'TLSv1.1' | 'TLSv1';
 interface TlsOptions {
   /** Custom CA certificate (PEM). */
   ca?: string | Buffer;
@@ -22,10 +27,31 @@ interface TlsOptions {
   cert?: string | Buffer;
   /** Client private key (PEM) for mTLS. */
   key?: string | Buffer;
-  /** Passphrase for encrypted private key. */
+  /** Client certificate in PFX/PKCS12 format for mTLS (alternative to cert+key). */
+  pfx?: string | Buffer;
+  /** Passphrase for encrypted private key or PFX. */
   passphrase?: string;
   /** Whether to verify server certificate. Default: true. */
   rejectUnauthorized?: boolean;
+  /**
+   * Minimum TLS version to negotiate (opt-in). Default: unset — Node negotiates
+   * from its default floor (TLS 1.2). Pin to `'TLSv1.3'` to require TLS 1.3,
+   * e.g. for certificate auth against a Safeguard Cert SNI hostname on SPP 9.0.
+   */
+  minVersion?: TlsVersion;
+  /**
+   * Maximum TLS version to negotiate (opt-in). Default: unset — Node negotiates
+   * up to its default ceiling (TLS 1.3).
+   *
+   * Special case: when a client certificate (`cert`/`key`/`pfx`) is present and
+   * **neither** `minVersion` nor `maxVersion` is set, the connection is capped
+   * at `'TLSv1.2'`. Node cannot present a client certificate via TLS 1.3
+   * post-handshake authentication, so capping at TLS 1.2 lets the certificate be
+   * requested in-handshake and keeps certificate/A2A auth working by default on
+   * SPP 9.0's Standard binding. Setting either bound explicitly disables this
+   * auto-cap.
+   */
+  maxVersion?: TlsVersion;
 }
 /**
  * Abstract HTTP client interface.
@@ -673,6 +699,11 @@ declare class A2AClient {
   retrieveApiKeySecret(apiKey: string): Promise<SecretValue>;
   /**
    * Get the list of retrievable accounts available to this certificate.
+   *
+   * Retrievable accounts live under the Core service and are authorized by the
+   * client certificate alone (no per-account API key). Enumerate every A2A
+   * registration bound to the certificate, then collect each registration's
+   * retrievable accounts.
    */
   getRetrievableAccounts(): Promise<RetrievableAccount[]>;
   /**
@@ -697,5 +728,5 @@ declare class A2AClient {
   brokerAccessRequest(apiKey: string, request: BrokeredAccessRequest): Promise<BrokeredAccessResponse>;
 }
 //#endregion
-export { A2AClient, type A2AClientOptions, AnonymousAuth, ApiError, type ApiErrorBody, type Auth, AuthenticationError, AuthorizationError, type BrokeredAccessRequest, BrokeredAccessRequestType, type BrokeredAccessResponse, BrowserHttpClient, BrowserSessionStorage, CertificateAuth, type CertificateAuthOptions, ConfigurationError, DeviceCodeAuth, type DeviceCodeAuthOptions, type DeviceCodeInfo, type HttpClient, HttpMethod, type HttpRequestOptions, type HttpResponse, MemoryStorage, NodeHttpClient, NotFoundError, PasswordAuth, type PasswordAuthOptions, PkceAuth, type PkceAuthOptions, type PkceCallbackResult, PkceNonInteractiveAuth, type PkceNonInteractiveAuthOptions, type RequestOptions, type RetrievableAccount, SafeguardClient, type SafeguardClientOptions, SafeguardError, type SafeguardResponse, SecretValue, Service, SshKeyFormat, StorageKeys, type StorageProvider, type TlsOptions, TokenAuth, type TokenAuthOptions, type TokenSet, TransportError, base64UrlEncode, buildRequestUrl, buildServiceUrl, generateCodeChallenge, generateCodeVerifier, generateState, handlePkceCallback, validateHost };
+export { A2AClient, type A2AClientOptions, AnonymousAuth, ApiError, type ApiErrorBody, type Auth, AuthenticationError, AuthorizationError, type BrokeredAccessRequest, BrokeredAccessRequestType, type BrokeredAccessResponse, BrowserHttpClient, BrowserSessionStorage, CertificateAuth, type CertificateAuthOptions, ConfigurationError, DeviceCodeAuth, type DeviceCodeAuthOptions, type DeviceCodeInfo, type HttpClient, HttpMethod, type HttpRequestOptions, type HttpResponse, MemoryStorage, NodeHttpClient, NotFoundError, PasswordAuth, type PasswordAuthOptions, PkceAuth, type PkceAuthOptions, type PkceCallbackResult, PkceNonInteractiveAuth, type PkceNonInteractiveAuthOptions, type RequestOptions, type RetrievableAccount, SafeguardClient, type SafeguardClientOptions, SafeguardError, type SafeguardResponse, SecretValue, Service, SshKeyFormat, StorageKeys, type StorageProvider, type TlsOptions, type TlsVersion, TokenAuth, type TokenAuthOptions, type TokenSet, TransportError, base64UrlEncode, buildRequestUrl, buildServiceUrl, generateCodeChallenge, generateCodeVerifier, generateState, handlePkceCallback, validateHost };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/types.ts","../src/errors.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/http/node.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/certificate.ts","../src/auth/pkce.ts","../src/auth/pkce-noninteractive.ts","../src/auth/device-code.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts","../src/a2a/types.ts","../src/a2a/index.ts"],"mappings":";;AAIA;;UAAiB,kBAAA;EACf,GAAA;EACA,MAAA;EACA,OAAA,GAAU,MAAA;EACV,IAAA,YAAgB,MAAA;EAChB,MAAA,GAAS,WAAA;EACT,OAAA;AAAA;AAAA,UAGe,YAAA;EACf,MAAA;EACA,OAAA,EAAS,MAAM;EACf,IAAA;AAAA;AAAA,UAGe,UAAA;EATf;EAWA,EAAA,YAAc,MAAA;EAXP;EAaP,IAAA,YAAgB,MAAA;EAVW;EAY3B,GAAA,YAAe,MAAA;EAVA;EAYf,UAAA;EAZA;EAcA,kBAAA;AAAA;;AAbI;AAGN;;UAiBiB,UAAA;EACf,OAAA,CAAQ,OAAA,EAAS,kBAAA,GAAqB,OAAA,CAAQ,YAAA;EAC9C,OAAA;AAAA;;;;AAlCF;;UCDiB,eAAA;EACf,GAAA,CAAI,GAAA;EACJ,GAAA,CAAI,GAAA,UAAa,KAAA;EACjB,MAAA,CAAO,GAAA;EACP,KAAA;AAAA;;cAIW,WAAA;EAAA,SAGH,KAAA;EAAA,SAAA,aAAA;AAAA;;;;ADVV;;;;;;;cEMa,WAAA;EAAA;cAGC,KAAA;EFNZ;EEWA,MAAA;EAIA,QAAA;EAIA,MAAA;EAAA,KASK,MAAA,CAAO,WAAW;AAAA;;;;;;UC5BR,QAAA;EHEK;EGApB,WAAA,EAAa,WAAW;EHJxB;EGMA,SAAA;EHJA;EGMA,UAAA;AAAA;;;;UAMe,IAAA;EHTR;AAAA;AAGT;;;;EGaE,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;EHXtF;;;EGgBA,YAAA,EAAc,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;EHfnF;EAAA,SGkBK,WAAA;AAAA;;;;AH9BX;;aIDY,OAAA;EACV,IAAA;EACA,SAAA;EACA,YAAA;EACA,GAAA;EACA,KAAA;EACA,IAAA;AAAA;;;;aAMU,UAAA;EACV,GAAA;EACA,IAAA;EACA,GAAA;EACA,MAAA;EACA,KAAA;AAAA;;;;UAMe,iBAAA;EACf,IAAA,EAAM,CAAA;EACN,MAAA;EACA,OAAA,EAAS,MAAM;AAAA;AJbX;AAGN;;AAHM,UImBW,cAAA;EJdD;EIgBd,IAAA;EJZe;EIcf,IAAA,GAAO,QAAA;EJdc;EIgBrB,OAAA,GAAU,MAAA;EJpBI;EIsBd,KAAA,GAAQ,MAAA;EJpBQ;EIsBhB,MAAA,GAAS,WAAA;EJpBM;EIsBf,OAAA;EJlBA;EIoBA,YAAA;AAAA;AJbF;;;AAAA,UImBiB,sBAAA;EJlB+B;EIoB9C,IAAA,EAFqC,IAAA;EJlBQ;EIsB7C,EAAA,YAAc,MAAM;EJtBpB;EIwBA,MAAA;EJxBQ;EI0BR,UAAA;EJ1B8C;EI4B9C,OAAA;EJ3BO;EI6BP,WAAA;AAAA;;;;AJ/DF;;;;;;;;;;cKQa,cAAA,SAAuB,KAAK;cAC3B,OAAA,UAAiB,OAAA,GAAU,YAAA;AAAA;AAAA,UAMxB,YAAA;EACf,IAAA;EACA,OAAA;EACA,UAAA;IAAe,OAAA;EAAA;EAAA,CACd,GAAA;AAAA;AAAA,cAGU,QAAA,SAAiB,cAAA;EAAA,SACnB,MAAA;EAAA,SACA,IAAA,EAAM,YAAA;cAEH,OAAA,UAAiB,MAAA,UAAgB,IAAA,GAAM,YAAA,SAA4B,OAAA,GAAU,YAAA;ELfhF;;;EAAA,OKyBF,YAAA,CAAa,MAAA,UAAgB,IAAA,WAAe,YAAA,UAAsB,QAAA;EAAA,eAgB1D,SAAA;EAAA,eAUA,YAAA;AAAA;AAAA,cASJ,mBAAA,SAA4B,QAAA;cAC3B,OAAA,UAAiB,IAAA,GAAM,YAAA,SAA4B,OAAA,GAAU,YAAA;AAAA;AAAA,cAM9D,kBAAA,SAA2B,QAAA;cAC1B,OAAA,UAAiB,IAAA,GAAM,YAAA,SAA4B,OAAA,GAAU,YAAA;AAAA;AAAA,cAM9D,aAAA,SAAsB,QAAA;cACrB,OAAA,UAAiB,IAAA,GAAM,YAAA,SAA4B,OAAA,GAAU,YAAA;AAAA;AAAA,cAM9D,cAAA,SAAuB,cAAc;cACpC,OAAA,UAAiB,OAAA,GAAU,YAAA;AAAA;AAAA,cAM5B,kBAAA,SAA2B,cAAc;cACxC,OAAA,UAAiB,OAAA,GAAU,YAAA;AAAA;;;ALpGzC;;;;;;AAAA,iBMKgB,YAAA,CAAa,IAAY;;;;;;;;iBAuCzB,eAAA,CAAgB,IAAA,UAAc,OAAA,EAAS,OAAO,EAAE,UAAA;;;;ANtCvD;AAGT;;;iBMiDgB,eAAA,CACd,IAAA,UACA,OAAA,EAAS,OAAA,EACT,WAAA,UACA,KAAA,GAAQ,MAAM,qCACd,UAAA;;;;iBAkBc,eAAA,CAAgB,KAAiB,EAAV,UAAU;;ANrE3C;AAGN;;iBM2EgB,oBAAA;;;;;iBAUM,qBAAA,CAAsB,QAAA,WAAmB,OAAO;;;;iBAUtD,aAAA;;;AN9GhB;;;;AAAA,cOEa,aAAA,YAAyB,eAAe;EAAA;EAGnD,GAAA,CAAI,GAAA;EAIJ,GAAA,CAAI,GAAA,UAAa,KAAA;EAIjB,MAAA,CAAO,GAAA;EAIP,KAAA;AAAA;;;APjBF;;;;AAAA,cQEa,qBAAA,YAAiC,eAAe;EAC3D,GAAA,CAAI,GAAA;EAIJ,GAAA,CAAI,GAAA,UAAa,KAAA;EAIjB,MAAA,CAAO,GAAA;EAIP,KAAA;AAAA;;;ARfF;;;;AAAA,cSGa,cAAA,YAA0B,UAAA;EAAA;cAGzB,UAAA,GAAa,UAAA;EAYnB,OAAA,CAAQ,OAAA,EAAS,kBAAA,GAAqB,OAAA,CAAQ,YAAA;EAmCpD,OAAA;AAAA;;;ATrDF;;;;AAAA,cUEa,iBAAA,YAA6B,UAAA;EAAA;cAG5B,OAAA;IAAY,WAAA,GAAc,kBAAA;EAAA;EAIhC,OAAA,CAAQ,OAAA,EAAS,kBAAA,GAAqB,OAAA,CAAQ,YAAA;AAAA;;;UCNrC,mBAAA;EACf,QAAA;EACA,QAAA;EXAS;EWET,QAAA;AAAA;;;;cAMW,YAAA,YAAwB,IAAA;EAAA;cAKvB,OAAA,EAAS,mBAAA;EAAA,IASjB,WAAA;EAIE,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;EAUvF,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;UCtC7E,sBAAA;EZAL;EYEV,QAAA;EZAS;EYET,OAAA;EZFoB;EYIpB,IAAA,YAAgB,MAAA;EZPhB;EYSA,GAAA,YAAe,MAAA;EZRL;EYUV,OAAA;EZTgB;EYWhB,GAAA,YAAe,MAAA;EZVN;EYYT,UAAA;EZXO;EYaP,QAAA;AAAA;;;;;cAOW,eAAA,YAA2B,IAAA;EAAA;cAU1B,OAAA,EAAS,sBAAA;EAAA,IAgBjB,WAAA;EZxCA;EY6CJ,aAAA;IAAmB,IAAA,YAAgB,MAAA;IAAQ,GAAA,YAAe,MAAA;IAAQ,GAAA,YAAe,MAAA;IAAQ,UAAA;EAAA;EAYnF,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;EAQvF,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;UCzE7E,eAAA;EbDL;EaGV,WAAA;EbDS;EaGT,QAAQ;AAAA;;;;;cAOG,QAAA,YAAoB,IAAA;EAAA;cAInB,OAAA,EAAS,eAAA;EAAA,IAOjB,WAAA;EbpBJ;;AAAO;AAGT;EayBQ,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,OAAA,EAAS,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;UC/B7E,6BAAA;EdAL;EcEV,QAAA;EdAS;EcET,YAAY;AAAA;;;;;;;;cAUD,sBAAA,YAAkC,IAAA;EAAA;cAIjC,OAAA,GAAU,6BAAA;EAAA,IAKlB,WAAA;EAIE,YAAA,CAAa,IAAA,UAAc,UAAA,EAAY,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;;;;;;;UCtB9E,cAAA;EfNf;EeQA,eAAA;EfPU;EeSV,QAAA;EfRgB;EeUhB,uBAAA;EfTS;EeWT,SAAA;EfVO;EeYP,QAAA;AAAA;;;;UAMe,qBAAA;Efbf;;;;AACI;EekBJ,YAAA,GAAe,IAAA,EAAM,cAAA,YAA0B,OAAA;EfftB;EeiBzB,QAAA;Effc;EeiBd,QAAA;Efbe;Eeef,sBAAA;EffqB;EeiBrB,MAAA,GAAS,WAAA;AAAA;;;;;;;;AfbS;AAOpB;cemEa,cAAA,YAA0B,IAAA;EAAA;cAOzB,OAAA,EAAS,qBAAA;EAAA,IAcjB,WAAA;EAIE,YAAA,CACJ,IAAA,UACA,UAAA,EAAY,UAAA,EACZ,QAAA,EAAU,eAAA,GACT,OAAA,CAAQ,QAAA;AAAA;;;UChII,kBAAA;EACf,IAAA;EACA,KAAK;AAAA;;;;;;;;;;;;iBAcS,kBAAA,CACd,OAAA,EAAS,eAAA,EACT,GAAA,YACC,kBAAkB;;;UCjBJ,gBAAA;EjBCL;EiBCV,WAAW;AAAA;;;;;cAOA,SAAA,YAAqB,IAAA;EAAA;cAGpB,OAAA,EAAS,gBAAA;EAAA,IAKjB,WAAA;EAIE,YAAA,CAAa,KAAA,UAAe,WAAA,EAAa,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;;;;;cClBpF,aAAA,YAAyB,IAAA;EAAA,IAChC,WAAA;EAIE,YAAA,CAAa,KAAA,UAAe,WAAA,EAAa,UAAA,EAAY,QAAA,EAAU,eAAA,GAAkB,OAAA,CAAQ,QAAA;AAAA;;;;;;;cCGpF,eAAA;EAAA;cAgBC,IAAA,UAAc,OAAA,EAAS,sBAAA;EnB1BnC;EAAA,ImBwCI,IAAA;EnBvCJ;EAAA,ImB4CI,UAAA;EnB3CJ;EAAA,ImBgDI,EAAA,aAAe,MAAA;EnB/CnB;EAAA,ImBoDI,MAAA;EnBpDG;EAAA,ImByDH,WAAA;EnBtDuB;;;;EmB8D3B,UAAA,CAAW,OAAA,EAAS,eAAA;EnB5DX;;;AACL;AAGN;;EmBmEE,aAAA,CAAc,UAAA,EAAY,UAAA;EnBjEZ;;;;;EmB2ER,OAAA,IAAW,OAAA;EnB3EH;;;EmB4FR,UAAA,IAAc,OAAA;EnBxFL;;;EmBiGf,+BAAA;EAQM,GAAA,cAAiB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;EAI3F,IAAA,cAAkB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;EAI5F,GAAA,cAAiB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;EAI3F,MAAA,cAAoB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;EAI9F,KAAA,cAAmB,OAAA,EAAS,OAAA,EAAS,WAAA,UAAqB,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,CAAA;EnB7GrD;;;;;;EmByHxC,MAAA,cACJ,OAAA,EAAS,OAAA,EACT,MAAA,EAAQ,UAAA,EACR,WAAA,UACA,OAAA,GAAU,cAAA,GACT,OAAA,CAAQ,CAAA;AAAA;;;;AnB/Jb;;aoBDY,YAAA;EACV,OAAA;EACA,IAAA;EACA,KAAA;AAAA;;;;UAMe,kBAAA;EACf,SAAA;EACA,OAAA;EACA,SAAA;EACA,WAAA;EACA,UAAA;EACA,WAAA;EACA,MAAA;AAAA;ApBNF;;;AAAA,aoBYY,yBAAA;EACV,QAAA;EACA,MAAA;EACA,MAAA;EACA,KAAA;EACA,OAAA;EACA,aAAA;EACA,UAAA;AAAA;;;;UAMe,qBAAA;EACf,UAAA,EAAY,yBAAyB;EACrC,SAAA;EACA,WAAA;EACA,OAAA;EACA,SAAA;EACA,cAAA;EACA,WAAA;EACA,SAAA;EACA,UAAA;AAAA;;ApBlBkB;AAOpB;UoBiBiB,sBAAA;EACf,SAAA;EACA,WAAA;EAAA,CACC,GAAA;AAAA;;;UC7Cc,gBAAA;ErBFN;EqBIT,IAAA,EAAM,eAAA;ErBJc;EqBMpB,EAAA,YAAc,MAAM;ErBTpB;EqBWA,MAAA;ErBVU;EqBYV,UAAA;AAAA;;;;;ArBTO;AAGT;cqBea,SAAA;EAAA;cAQC,IAAA,UAAc,OAAA,EAAS,gBAAA;ErBtBnC;EAAA,IqBiCI,IAAA;ErBhCK;EAAA,IqBqCL,EAAA,aAAe,MAAA;ErBpCf;EAAA,IqByCA,MAAA;ErBtCW;EAAA,IqB2CX,IAAA,IAAQ,eAAA;;;;EAOZ,aAAA,CAAc,UAAA,EAAY,UAAA;ErB5CL;;;;EqBqDf,gBAAA,CAAiB,MAAA,WAAiB,OAAA,CAAQ,WAAA;ErBvDhC;;;;;EqBiEV,kBAAA,CAAmB,MAAA,UAAgB,MAAA,GAAS,YAAA,GAAe,OAAA,CAAQ,WAAA;ErB3DvD;AAOpB;;;EqBiEQ,oBAAA,CAAqB,MAAA,WAAiB,OAAA,CAAQ,WAAA;ErBhEN;;;EqBwExC,sBAAA,IAA0B,OAAA,CAAQ,kBAAA;ErBxExC;;;;;EqB8FM,WAAA,CAAY,MAAA,UAAgB,QAAA,WAAmB,OAAA;ErB7F9C;AAAA;;;;ACnCT;;EoByJQ,aAAA,CACJ,MAAA,UACA,GAAA,UACA,UAAA,WACA,MAAA,GAAS,YAAA,GACR,OAAA;EpB9J2B;;;;;EoByLxB,mBAAA,CACJ,MAAA,UACA,OAAA,EAAS,qBAAA,GACR,OAAA,CAAQ,sBAAA;AAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/types.ts","../src/errors.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/http/node.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/certificate.ts","../src/auth/pkce.ts","../src/auth/pkce-noninteractive.ts","../src/auth/device-code.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts","../src/a2a/types.ts","../src/a2a/index.ts"],"mappings":";;;;UAIiB;EACf;EACA;EACA,UAAU;EACV,gBAAgB;EAChB,SAAS;EACT;;UAGe;EACf;EACA,SAAS;EACT;;;;;;KAOU;UAEK;;EAEf,cAAc;;EAEd,gBAAgB;;EAEhB,eAAe;;EAEf,eAAe;;EAEf;;EAEA;;;;;;EAMA,aAAa;;;;;;;;;;;;;EAab,aAAa;;;;;;UAOE;EACf,QAAQ,SAAS,qBAAqB,QAAQ;EAC9C;;;;;;;UC9De;EACf,IAAI;EACJ,IAAI,aAAa;EACjB,OAAO;EACP;;;cAIW;WAAA;WAAA;;;;;;;;;;;;cCDA;;EAGC,YAAA;;EAKZ;EAIA;EAIA;OASK,OAAO;;;;;;;UC5BG;;EAEf,aAAa;;EAEb;;EAEA;;;;;UAMe;;;;;;;EAOf,aAAa,cAAc,YAAY,YAAY,SAAS,kBAAkB,QAAQ;;;;EAKtF,cAAc,cAAc,YAAY,YAAY,SAAS,kBAAkB,QAAQ;;WAG9E;;;;;;;aC/BC;EACV;EACA;EACA;EACA;EACA;EACA;;;;;aAMU;EACV;EACA;EACA;EACA;EACA;;;;;UAMe,kBAAkB;EACjC,MAAM;EACN;EACA,SAAS;;;;;UAMM;;EAEf;;EAEA,OAAO;;EAEP,UAAU;;EAEV,QAAQ;;EAER,SAAS;;EAET;;EAEA;;;;;UAMe;;EAEf,MAFe;;EAIf,cAAc;;EAEd;;EAEA;;EAEA;;EAEA;;;;;;;;;;;;;;;cCvDW,uBAAuB;EACtB,YAAA,iBAAiB,UAAU;;UAMxB;EACf;EACA;EACA;IAAe;;GACd;;cAGU,iBAAiB;WACnB;WACA,MAAM;EAEH,YAAA,iBAAiB,gBAAgB,OAAM,qBAA4B,UAAU;;;;SAUlF,aAAa,gBAAgB,eAAe,sBAAsB;iBAgB1D;iBAUA;;cASJ,4BAA4B;EAC3B,YAAA,iBAAiB,OAAM,qBAA4B,UAAU;;cAM9D,2BAA2B;EAC1B,YAAA,iBAAiB,OAAM,qBAA4B,UAAU;;cAM9D,sBAAsB;EACrB,YAAA,iBAAiB,OAAM,qBAA4B,UAAU;;cAM9D,uBAAuB;EACtB,YAAA,iBAAiB,UAAU;;cAM5B,2BAA2B;EAC1B,YAAA,iBAAiB,UAAU;;;;;;;;;;iBC/FzB,aAAa;;;;;;;;iBAuCb,gBAAgB,cAAc,SAAS,SAAS;;;;;;;;iBAchD,gBACd,cACA,SAAS,SACT,qBACA,QAAQ,2CACR;;;;iBAkBc,gBAAgB,OAAO;;;;;iBASvB;;;;;iBAUM,sBAAsB,mBAAmB;;;;iBAU/C;;;;;;;cC5GH,yBAAyB;;EAGpC,IAAI;EAIJ,IAAI,aAAa;EAIjB,OAAO;EAIP;;;;;;;;cCfW,iCAAiC;EAC5C,IAAI;EAIJ,IAAI,aAAa;EAIjB,OAAO;EAIP;;;;;;;;cCoCW,0BAA0B;;EAGzB,YAAA,aAAa;EAgBnB,QAAQ,SAAS,qBAAqB,QAAQ;EAmCpD;;;;;;;;cCvGW,6BAA6B;;EAG5B,YAAA;IAAY,cAAc;;EAIhC,QAAQ,SAAS,qBAAqB,QAAQ;;;;UCNrC;EACf;EACA;;EAEA;;;;;cAMW,wBAAwB;;EAKvB,YAAA,SAAS;MASjB;EAIE,aAAa,cAAc,YAAY,YAAY,UAAU,kBAAkB,QAAQ;EAUvF,aAAa,cAAc,YAAY,YAAY,SAAS,kBAAkB,QAAQ;;;;UCtC7E;;EAEf;;EAEA;;EAEA,gBAAgB;;EAEhB,eAAe;;EAEf;;EAEA,eAAe;;EAEf;;EAEA;;;;;;cAOW,2BAA2B;;EAU1B,YAAA,SAAS;MAgBjB;;EAKJ;IAAmB,gBAAgB;IAAQ,eAAe;IAAQ,eAAe;IAAQ;;EAYnF,aAAa,cAAc,YAAY,YAAY,UAAU,kBAAkB,QAAQ;EAQvF,aAAa,cAAc,YAAY,YAAY,SAAS,kBAAkB,QAAQ;;;;UCzE7E;;EAEf;;EAEA;;;;;;cAOW,oBAAoB;;EAInB,YAAA,SAAS;MAOjB;;;;;EAQE,aAAa,cAAc,YAAY,YAAY,SAAS,kBAAkB,QAAQ;;;;UC/B7E;;EAEf;;EAEA;;;;;;;;;cAUW,kCAAkC;;EAIjC,YAAA,UAAU;MAKlB;EAIE,aAAa,cAAc,YAAY,YAAY,UAAU,kBAAkB,QAAQ;;;;;;;;;;UCtB9E;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;;;;UAMe;;;;;;EAMf,eAAe,MAAM,0BAA0B;;EAE/C;;EAEA;;EAEA;;EAEA,SAAS;;;;;;;;;;;cA6DE,0BAA0B;;EAOzB,YAAA,SAAS;MAcjB;EAIE,aACJ,cACA,YAAY,YACZ,UAAU,kBACT,QAAQ;;;;UChII;EACf;EACA;;;;;;;;;;;;;iBAcc,mBACd,SAAS,iBACT,eACC;;;UCjBc;;EAEf;;;;;;cAOW,qBAAqB;;EAGpB,YAAA,SAAS;MAKjB;EAIE,aAAa,eAAe,aAAa,YAAY,UAAU,kBAAkB,QAAQ;;;;;;;;cClBpF,yBAAyB;MAChC;EAIE,aAAa,eAAe,aAAa,YAAY,UAAU,kBAAkB,QAAQ;;;;;;;;cCGpF;;EAgBC,YAAA,cAAc,SAAS;;MAc/B;;MAKA;;MAKA,eAAe;;MAKf;;MAKA;;;;;EAQJ,WAAW,SAAS;;;;;;;EAWpB,cAAc,YAAY;;;;;;EAUpB,WAAW;;;;EAiBX,cAAc;;;;EASpB;EAQM,IAAI,aAAa,SAAS,SAAS,qBAAqB,UAAU,iBAAiB,QAAQ;EAI3F,KAAK,aAAa,SAAS,SAAS,qBAAqB,UAAU,iBAAiB,QAAQ;EAI5F,IAAI,aAAa,SAAS,SAAS,qBAAqB,UAAU,iBAAiB,QAAQ;EAI3F,OAAO,aAAa,SAAS,SAAS,qBAAqB,UAAU,iBAAiB,QAAQ;EAI9F,MAAM,aAAa,SAAS,SAAS,qBAAqB,UAAU,iBAAiB,QAAQ;;;;;;;EAY7F,OAAO,aACX,SAAS,SACT,QAAQ,YACR,qBACA,UAAU,iBACT,QAAQ;;;;;;;aChKD;EACV;EACA;EACA;;;;;UAMe;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;;;;aAMU;EACV;EACA;EACA;EACA;EACA;EACA;EACA;;;;;UAMe;EACf,YAAY;EACZ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;UAMe;EACf;EACA;GACC;;;;UC7Cc;;EAEf,MAAM;;EAEN,cAAc;;EAEd;;EAEA;;;;;;;;cASW;;EAQC,YAAA,cAAc,SAAS;;MAW/B;;MAKA,eAAe;;MAKf;;MAKA,QAAQ;;;;EAOZ,cAAc,YAAY;;;;;EASpB,iBAAiB,iBAAiB,QAAQ;;;;;;EAY1C,mBAAmB,gBAAgB,SAAS,eAAe,QAAQ;;;;;EAgBnE,qBAAqB,iBAAiB,QAAQ;;;;;;;;;EAa9C,0BAA0B,QAAQ;;;;;;EAwClC,YAAY,gBAAgB,mBAAmB;;;;;;;;EAyB/C,cACJ,gBACA,aACA,qBACA,SAAS,eACR;;;;;;EA+BG,oBACJ,gBACA,SAAS,wBACR,QAAQ"}

package/dist/index.js

@@ -217,7 +217,7 @@ function base64UrlEncode(bytes) {
 * Returns a 43-character base64url string (32 random bytes).
 */
 function generateCodeVerifier() {
-	const bytes = new Uint8Array(32);
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
 	crypto.getRandomValues(bytes);
 	return base64UrlEncode(bytes);
 }
@@ -234,7 +234,7 @@ async function generateCodeChallenge(verifier) {
 * Generates a random state parameter for OAuth flows.
 */
 function generateState() {
-	const bytes = new Uint8Array(16);
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
 	crypto.getRandomValues(bytes);
 	return base64UrlEncode(bytes);
 }
@@ -307,19 +307,46 @@ const StorageKeys = {
 //#endregion
 //#region src/http/node.ts
 /**
+* Resolve the undici Agent `connect` (TLS) options from {@link TlsOptions}.
+*
+* Applies the opt-in `minVersion`/`maxVersion` pins. When a client certificate
+* is present and the caller has pinned neither bound, the connection is capped
+* at TLS 1.2: Node has no client-side TLS 1.3 post-handshake authentication
+* (see https://github.com/nodejs/node/issues/46120), so on TLS 1.3 the client
+* never presents its certificate and cert/A2A auth fails (error 60094) on the
+* appliance's Standard binding. Capping at TLS 1.2 keeps the cert request
+* in-handshake so it works by default. Setting either bound explicitly (for
+* example `minVersion: 'TLSv1.3'` when targeting a Cert SNI hostname) disables
+* the auto-cap. Password/token connections carry no certificate and keep
+* negotiating up to TLS 1.3.
+*/
+function resolveTlsConnectOptions(tlsOptions) {
+	const connect = {
+		ca: tlsOptions?.ca,
+		cert: tlsOptions?.cert,
+		key: tlsOptions?.key,
+		pfx: tlsOptions?.pfx,
+		passphrase: tlsOptions?.passphrase,
+		rejectUnauthorized: tlsOptions?.rejectUnauthorized ?? true
+	};
+	const hasClientCert = Boolean(tlsOptions?.cert ?? tlsOptions?.key ?? tlsOptions?.pfx);
+	if (tlsOptions?.minVersion) connect.minVersion = tlsOptions.minVersion;
+	if (tlsOptions?.maxVersion) connect.maxVersion = tlsOptions.maxVersion;
+	else if (hasClientCert && !tlsOptions?.minVersion) connect.maxVersion = "TLSv1.2";
+	return connect;
+}
+/**
 * Node.js HTTP client using undici for full TLS control.
 * Creates a per-instance Agent — no global state mutation.
 */
 var NodeHttpClient = class {
 	#agent;
 	constructor(tlsOptions) {
-		this.#agent = new Agent({ connect: {
-			ca: tlsOptions?.ca,
-			cert: tlsOptions?.cert,
-			key: tlsOptions?.key,
-			passphrase: tlsOptions?.passphrase,
-			rejectUnauthorized: tlsOptions?.rejectUnauthorized ?? true
-		} });
+		const hasClientCert = Boolean(tlsOptions?.cert ?? tlsOptions?.key ?? tlsOptions?.pfx);
+		this.#agent = new Agent({
+			connect: resolveTlsConnectOptions(tlsOptions),
+			...hasClientCert ? { allowH2: false } : {}
+		});
 	}
 	async request(options) {
 		const { url, method, headers, body, signal, timeout } = options;
@@ -1255,7 +1282,8 @@ var A2AClient = class {
 	* @param apiKey - The API key for the retrievable account
 	*/
 	async retrievePassword(apiKey) {
-		return new SecretValue(await this.#a2aRequest(apiKey, "GET", "Credentials", { type: "Password" }));
+		const body = await this.#a2aRequest(apiKey, "GET", "Credentials", { type: "Password" });
+		return new SecretValue(JSON.parse(body));
 	}
 	/**
 	* Retrieve an SSH private key credential via A2A.
@@ -1264,10 +1292,11 @@ var A2AClient = class {
 	*/
 	async retrievePrivateKey(apiKey, format) {
 		const keyType = format ?? "OpenSsh";
-		return new SecretValue(await this.#a2aRequest(apiKey, "GET", "Credentials", {
-			type: "SshKey",
+		const body = await this.#a2aRequest(apiKey, "GET", "Credentials", {
+			type: "PrivateKey",
 			keyFormat: keyType
-		}));
+		});
+		return new SecretValue(JSON.parse(body));
 	}
 	/**
 	* Retrieve an API key secret credential via A2A.
@@ -1278,16 +1307,32 @@ var A2AClient = class {
 	}
 	/**
 	* Get the list of retrievable accounts available to this certificate.
+	*
+	* Retrievable accounts live under the Core service and are authorized by the
+	* client certificate alone (no per-account API key). Enumerate every A2A
+	* registration bound to the certificate, then collect each registration's
+	* retrievable accounts.
 	*/
 	async getRetrievableAccounts() {
 		this.#ensureHttpClient();
-		const response = await this.#httpClient.request({
-			url: `https://${this.#host}/service/a2a/${this.#apiVersion}/A2ARegistrations`,
+		const regResponse = await this.#httpClient.request({
+			url: `https://${this.#host}/service/core/${this.#apiVersion}/A2ARegistrations`,
 			method: "GET",
 			headers: { Accept: "application/json" }
 		});
-		if (response.status !== 200) throw ApiError.fromResponse(response.status, response.body);
-		return JSON.parse(response.body);
+		if (regResponse.status !== 200) throw ApiError.fromResponse(regResponse.status, regResponse.body);
+		const registrations = JSON.parse(regResponse.body);
+		const accounts = [];
+		for (const reg of registrations) {
+			const acctResponse = await this.#httpClient.request({
+				url: `https://${this.#host}/service/core/${this.#apiVersion}/A2ARegistrations/${reg.Id}/RetrievableAccounts`,
+				method: "GET",
+				headers: { Accept: "application/json" }
+			});
+			if (acctResponse.status !== 200) throw ApiError.fromResponse(acctResponse.status, acctResponse.body);
+			accounts.push(...JSON.parse(acctResponse.body));
+		}
+		return accounts;
 	}
 	/**
 	* Set a password on a managed account via A2A.
@@ -1297,7 +1342,7 @@ var A2AClient = class {
 	async setPassword(apiKey, password) {
 		this.#ensureHttpClient();
 		const response = await this.#httpClient.request({
-			url: `https://${this.#host}/service/a2a/${this.#apiVersion}/Credentials?type=Password`,
+			url: `https://${this.#host}/service/a2a/${this.#apiVersion}/Credentials/Password`,
 			method: "PUT",
 			headers: {
 				Authorization: `A2A ${apiKey}`,
@@ -1317,13 +1362,11 @@ var A2AClient = class {
 	*/
 	async setPrivateKey(apiKey, key, passphrase, format) {
 		this.#ensureHttpClient();
-		const payload = {
-			PrivateKey: key,
-			KeyFormat: format ?? "OpenSsh"
-		};
+		const keyFormat = format ?? "OpenSsh";
+		const payload = { PrivateKey: key };
 		if (passphrase) payload["Passphrase"] = passphrase;
 		const response = await this.#httpClient.request({
-			url: `https://${this.#host}/service/a2a/${this.#apiVersion}/Credentials?type=SshKey`,
+			url: `https://${this.#host}/service/a2a/${this.#apiVersion}/Credentials/SshKey?keyFormat=${keyFormat}`,
 			method: "PUT",
 			headers: {
 				Authorization: `A2A ${apiKey}`,