@ovok/core 0.4.37 → 0.4.38

package/dist/client/auth/account-storage.d.ts

@@ -1,5 +1,6 @@
 import { IClientStorage } from "@medplum/core";
 export declare const LOGINS_STORAGE_KEY = "logins";
+export declare const ACTIVE_LOGIN_STORAGE_KEY = "activeLogin";
 export declare const EXPIRED_ACCOUNTS_STORAGE_KEY = "ovok.core.expired-accounts";
 export declare const setStoredAccountExpired: (storage: IClientStorage, accountId: string, expired: boolean) => void;
 export declare const removeStoredAccount: (storage: IClientStorage, accountId: string) => void;

package/dist/client/auth/account-storage.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.removeStoredAccount = exports.setStoredAccountExpired = exports.EXPIRED_ACCOUNTS_STORAGE_KEY = exports.LOGINS_STORAGE_KEY = void 0;
+exports.removeStoredAccount = exports.setStoredAccountExpired = exports.EXPIRED_ACCOUNTS_STORAGE_KEY = exports.ACTIVE_LOGIN_STORAGE_KEY = exports.LOGINS_STORAGE_KEY = void 0;
 exports.LOGINS_STORAGE_KEY = "logins";
+exports.ACTIVE_LOGIN_STORAGE_KEY = "activeLogin";
 exports.EXPIRED_ACCOUNTS_STORAGE_KEY = "ovok.core.expired-accounts";
 const setStoredAccountExpired = (storage, accountId, expired) => {
     var _a;

package/dist/{utils → client}/auth/exchange-code.d.ts

@@ -1,6 +1,6 @@
 import type { MedplumRequestOptions } from "@medplum/core";
-import { OvokClient } from "../../client/ovok-client";
 import { AuthResponse } from "../../types";
+import { OvokClient } from "../ovok-client";
 type ExchangeCodeProps = {
     client: OvokClient;
     sessionCode: string;

package/dist/{utils → client}/auth/generate-code-challenge-and-verifier.js

@@ -6,26 +6,16 @@ function generateRandomString(length) {
     const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
     let result = "";
     const randomValues = new Uint8Array(length);
-    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
-        crypto.getRandomValues(randomValues);
-    }
-    else {
-        for (let i = 0; i < length; i++) {
-            randomValues[i] = Math.floor(Math.random() * 256);
-        }
+    // A predictable verifier defeats PKCE, so there is no Math.random fallback.
+    if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") {
+        throw new Error("PKCE needs crypto.getRandomValues. On React Native, install a polyfill such as react-native-get-random-values (or use @ovok/native, which provides one).");
     }
+    crypto.getRandomValues(randomValues);
     for (let i = 0; i < length; i++) {
         result += charset[randomValues[i] % charset.length];
     }
     return result;
 }
-function hexToUint8Array(hex) {
-    const bytes = new Uint8Array(hex.length / 2);
-    for (let i = 0; i < hex.length; i += 2) {
-        bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
-    }
-    return bytes;
-}
 function base64URLEncode(data) {
     let binary = "";
     for (let i = 0; i < data.length; i++) {
@@ -35,9 +25,7 @@ function base64URLEncode(data) {
 }
 function generateCodeChallengeAndVerifier() {
     const codeVerifier = generateRandomString(128);
-    const hexHash = sha256_1.sha256.hex(codeVerifier);
-    const hashBytes = hexToUint8Array(hexHash);
-    const codeChallenge = base64URLEncode(hashBytes);
+    const codeChallenge = base64URLEncode((0, sha256_1.sha256Bytes)(codeVerifier));
     return {
         codeVerifier,
         codeChallenge,

package/dist/{utils → client}/auth/handle-tenant-code.d.ts

@@ -1,4 +1,4 @@
-import { StartLoginResponse } from "../../client/auth/types/StartLoginResponse";
+import { StartLoginResponse } from "./types/StartLoginResponse";
 export declare const handleTenantCode: ({ profiles, tenantCode, type, }: {
     profiles: StartLoginResponse["profiles"];
     tenantCode?: string;

package/dist/{utils → client}/auth/handle-tenant-code.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleTenantCode = void 0;
-const LoginError_1 = require("../../client/auth/types/LoginError");
+const LoginError_1 = require("./types/LoginError");
 const handleTenantCode = ({ profiles, tenantCode, type, }) => {
     if (type !== "Practitioner") {
         if (!tenantCode) {

package/dist/client/auth/methods/appleLogin.js

@@ -1,11 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.appleLogin = appleLogin;
+const socialLogin_1 = require("./socialLogin");
 async function appleLogin(body, requestOptions) {
-    const { internalId, ...rest } = body;
-    const queryParams = new URLSearchParams({
-        client: `ClientApplication/${this.socialLoginClientId}`,
-        internalId,
-    });
-    return this.post(`auth/external/apple?${queryParams.toString()}`, rest, "application/json", requestOptions);
+    return socialLogin_1.socialLogin.call(this, "apple", body, requestOptions);
 }

package/dist/client/auth/methods/changePassword.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.changePassword = changePassword;
+const request_options_1 = require("../../request-options");
 async function changePassword(body, requestOptions) {
     const { oldPassword, newPassword } = body;
-    return this.patch("v2/auth/change-password", { oldPassword, newPassword }, ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.patch("v2/auth/change-password", { oldPassword, newPassword }, ...(0, request_options_1.optionalArg)(requestOptions));
 }

package/dist/client/auth/methods/getSessions.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getSessions = getSessions;
+const request_options_1 = require("../../request-options");
 /** Lists the server-side sessions for the current account. */
 async function getSessions(requestOptions) {
-    return this.get("auth/session", ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.get("auth/session", ...(0, request_options_1.optionalArg)(requestOptions));
 }

package/dist/client/auth/methods/googleLogin.js

@@ -1,11 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.googleLogin = googleLogin;
+const socialLogin_1 = require("./socialLogin");
 async function googleLogin(body, requestOptions) {
-    const { internalId, ...rest } = body;
-    const queryParams = new URLSearchParams({
-        client: `ClientApplication/${this.socialLoginClientId}`,
-        internalId,
-    });
-    return this.post(`auth/external/google?${queryParams.toString()}`, rest, "application/json", requestOptions);
+    return socialLogin_1.socialLogin.call(this, "google", body, requestOptions);
 }

package/dist/client/auth/methods/login.js

@@ -2,11 +2,20 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startTenantLogin = startTenantLogin;
 exports.login = login;
-const exchange_code_1 = require("../../../utils/auth/exchange-code");
-const generate_code_challenge_and_verifier_1 = require("../../../utils/auth/generate-code-challenge-and-verifier");
-const handle_tenant_code_1 = require("../../../utils/auth/handle-tenant-code");
-const start_login_1 = require("../../../utils/auth/start-login");
+const request_options_1 = require("../../request-options");
+const exchange_code_1 = require("../exchange-code");
+const generate_code_challenge_and_verifier_1 = require("../generate-code-challenge-and-verifier");
+const handle_tenant_code_1 = require("../handle-tenant-code");
+const start_login_1 = require("../start-login");
 const LoginError_1 = require("../types/LoginError");
+/** The MFA step: verifying the code yields a session code that `exchange` turns into a session. */
+const mfaStep = (client, type, loginId, exchange, requestOptions) => ({
+    nextStep: "mfa",
+    verify: async (code) => {
+        const { sessionCode } = await client.post(`auth/tenant/${type}/login/mfa`, { loginId, mfaToken: code }, "application/json", requestOptions);
+        return exchange(sessionCode);
+    },
+});
 /** Starts practitioner sign-in and lets the app choose among returned projects. */
 async function startTenantLogin(body, requestOptions) {
     const { codeVerifier, codeChallenge } = (0, generate_code_challenge_and_verifier_1.generateCodeChallengeAndVerifier)();
@@ -23,36 +32,23 @@ async function startTenantLogin(body, requestOptions) {
             if (!tenantCode) {
                 throw new LoginError_1.LoginError("tenant_code_required", "Choose a project before completing sign-in.", profiles);
             }
-            if (startResponse.nextStep === "mfa") {
-                return {
-                    nextStep: "mfa",
-                    verify: async (code) => {
-                        const mfaResponse = await this.post("auth/tenant/Practitioner/login/mfa", { loginId: startResponse.loginId, mfaToken: code }, "application/json", requestOptions);
-                        return (0, exchange_code_1.exchangeCode)({
-                            client: this,
-                            type: "Practitioner",
-                            sessionCode: mfaResponse.sessionCode,
-                            codeVerifier,
-                            tenantCode,
-                            requestOptions,
-                        });
-                    },
-                };
-            }
-            return (0, exchange_code_1.exchangeCode)({
+            const exchange = (sessionCode) => (0, exchange_code_1.exchangeCode)({
                 client: this,
                 type: "Practitioner",
-                sessionCode: startResponse.sessionCode,
+                sessionCode,
                 codeVerifier,
                 tenantCode,
                 requestOptions,
             });
+            return startResponse.nextStep === "mfa"
+                ? mfaStep(this, "Practitioner", startResponse.loginId, exchange, requestOptions)
+                : exchange(startResponse.sessionCode);
         },
     };
 }
 async function login(body, requestOptions) {
     if (body.type === "Practitioner") {
-        const start = await startTenantLogin.call(this, body, ...(requestOptions === undefined ? [] : [requestOptions]));
+        const start = await startTenantLogin.call(this, body, ...(0, request_options_1.optionalArg)(requestOptions));
         return start.exchange(body.tenantCode);
     }
     const { codeVerifier, codeChallenge } = (0, generate_code_challenge_and_verifier_1.generateCodeChallengeAndVerifier)();
@@ -62,30 +58,16 @@ async function login(body, requestOptions) {
         codeChallenge,
         requestOptions,
     });
-    if (startResponse.nextStep === "mfa") {
-        return {
-            nextStep: "mfa",
-            verify: async (code) => {
-                const mfaResponse = await this.post(`auth/tenant/${body.type}/login/mfa`, {
-                    loginId: startResponse.loginId,
-                    mfaToken: code,
-                }, "application/json", requestOptions);
-                return (0, exchange_code_1.exchangeCode)({
-                    client: this,
-                    type: "Patient",
-                    sessionCode: mfaResponse.sessionCode,
-                    codeVerifier,
-                    requestOptions,
-                });
-            },
-        };
-    }
-    (0, handle_tenant_code_1.handleTenantCode)({ profiles: startResponse.profiles, tenantCode: body.tenantCode, type: "Patient" });
-    return (0, exchange_code_1.exchangeCode)({
+    const exchange = (sessionCode) => (0, exchange_code_1.exchangeCode)({
         client: this,
         type: "Patient",
-        sessionCode: startResponse.sessionCode,
+        sessionCode,
         codeVerifier,
         requestOptions,
     });
+    if (startResponse.nextStep === "mfa") {
+        return mfaStep(this, body.type, startResponse.loginId, exchange, requestOptions);
+    }
+    (0, handle_tenant_code_1.handleTenantCode)({ profiles: startResponse.profiles, tenantCode: body.tenantCode, type: "Patient" });
+    return exchange(startResponse.sessionCode);
 }

package/dist/client/auth/methods/logout.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.logout = logout;
+const request_options_1 = require("../../request-options");
 const account_storage_1 = require("../account-storage");
 /** Revokes the current server session and always removes its local account. */
 async function logout(requestOptions) {
     var _a, _b;
     const accountId = (_b = (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference;
     try {
-        await this.delete("auth/session/current", ...(requestOptions === undefined ? [] : [requestOptions]));
+        await this.delete("auth/session/current", ...(0, request_options_1.optionalArg)(requestOptions));
     }
     finally {
         this.clearActiveLogin();

package/dist/client/auth/methods/requestDeleteUser.js

@@ -9,8 +9,9 @@ exports.requestDeleteUser = requestDeleteUser;
  * @returns {Promise<RequestDeleteUserResponse>} Response containing scheduled deletion status and user information
  */
 async function requestDeleteUser(body, requestOptions) {
-    return this.delete("auth/delete", { ...{
-            body: JSON.stringify(body),
-            headers: { "Content-Type": "application/json" },
-        }, ...requestOptions });
+    return this.delete("auth/delete", {
+        body: JSON.stringify(body),
+        headers: { "Content-Type": "application/json" },
+        ...requestOptions,
+    });
 }

package/dist/client/auth/methods/revokeSessions.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.revokeSessions = revokeSessions;
+const request_options_1 = require("../../request-options");
 /** Revokes the selected server-side session or session group. */
 async function revokeSessions(option, requestOptions) {
-    await this.delete(`auth/session/${encodeURIComponent(option)}`, ...(requestOptions === undefined ? [] : [requestOptions]));
+    await this.delete(`auth/session/${encodeURIComponent(option)}`, ...(0, request_options_1.optionalArg)(requestOptions));
     if (option === "current") {
         this.clearActiveLogin();
     }

package/dist/client/auth/methods/socialLogin.d.ts

@@ -0,0 +1,7 @@
+import type { MedplumRequestOptions } from "@medplum/core";
+import { OvokClient } from "../../ovok-client";
+import { AppleLoginBody } from "../types/AppleLoginBody";
+import { AuthResponse } from "../types/AuthResponse";
+import { GoogleLoginBody } from "../types/GoogleLoginBody";
+/** Signs in with a provider token through the social-login client. Not bound onto OvokClient itself. */
+export declare function socialLogin(this: OvokClient, provider: "apple" | "google", { internalId, ...rest }: AppleLoginBody | GoogleLoginBody, requestOptions?: MedplumRequestOptions): Promise<AuthResponse>;

package/dist/client/auth/methods/socialLogin.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.socialLogin = socialLogin;
+/** Signs in with a provider token through the social-login client. Not bound onto OvokClient itself. */
+function socialLogin(provider, { internalId, ...rest }, requestOptions) {
+    const queryParams = new URLSearchParams({
+        client: `ClientApplication/${this.socialLoginClientId}`,
+        internalId,
+    });
+    return this.post(`auth/external/${provider}?${queryParams.toString()}`, rest, "application/json", requestOptions);
+}

package/dist/client/auth/session-fetch.js

@@ -19,15 +19,14 @@ function createSessionFetch({ config, storage, fetchImplementation, normalizedBa
         (options === null || options === void 0 ? void 0 : options.method) === "POST" &&
         typeof options.body === "string" &&
         new URLSearchParams(options.body).get("grant_type") === "refresh_token";
+    const activeAccountId = () => { var _a, _b; return (_b = (_a = storage.getObject(account_storage_1.ACTIVE_LOGIN_STORAGE_KEY)) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference; };
     const markActiveAccountExpired = () => {
-        var _a, _b;
-        const accountId = (_b = (_a = storage.getObject("activeLogin")) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference;
+        const accountId = activeAccountId();
         if (accountId) {
             (0, account_storage_1.setStoredAccountExpired)(storage, accountId, true);
         }
     };
     const fetchOnce = async (url, options) => {
-        var _a, _b;
         const response = await (0, session_http_1.fetchWithTimeout)(fetchImplementation, url, options, config.requestTimeoutMs);
         const requestUrl = new URL(url, normalizedBaseUrl);
         if (isTokenRefresh(url, options)) {
@@ -36,7 +35,7 @@ function createSessionFetch({ config, storage, fetchImplementation, normalizedBa
                 try {
                     invalidGrant = (await response.clone().json()).error === "invalid_grant";
                 }
-                catch (_c) {
+                catch (_a) {
                     // Do not sign out unless the response confirms that the refresh token was revoked.
                 }
                 if (!invalidGrant) {
@@ -51,7 +50,7 @@ function createSessionFetch({ config, storage, fetchImplementation, normalizedBa
                 markActiveAccountExpired();
             }
             else if (response.ok) {
-                const accountId = (_b = (_a = storage.getObject("activeLogin")) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference;
+                const accountId = activeAccountId();
                 if (accountId) {
                     (0, account_storage_1.setStoredAccountExpired)(storage, accountId, false);
                 }
@@ -82,7 +81,7 @@ function createSessionFetch({ config, storage, fetchImplementation, normalizedBa
             }
             return response;
         }
-        const login = storage.getObject("activeLogin");
+        const login = storage.getObject(account_storage_1.ACTIVE_LOGIN_STORAGE_KEY);
         if (terminalRefreshError) {
             if ((login === null || login === void 0 ? void 0 : login.accessToken) && login.accessToken !== terminalRefreshToken) {
                 terminalRefreshToken = undefined;

package/dist/client/auth/session-http.js

@@ -16,11 +16,7 @@ const retryAfterMs = (response) => {
     return Number.isFinite(date) ? Math.max(0, date - Date.now()) : undefined;
 };
 exports.retryAfterMs = retryAfterMs;
-const timeoutError = () => {
-    const error = new Error("The request timed out.");
-    error.name = "TimeoutError";
-    return error;
-};
+const timeoutError = () => (0, ovok_error_utils_1.namedError)("TimeoutError", "The request timed out.");
 const withHttpErrorMetadata = async (response) => {
     var _a, _b;
     if (response.ok || typeof response.clone !== "function") {
@@ -94,9 +90,7 @@ exports.withHttpErrorMetadata = withHttpErrorMetadata;
 const waitForRetry = (milliseconds, signal) => new Promise((resolve, reject) => {
     var _a;
     if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
-        const error = new Error("Token refresh aborted");
-        error.name = "AbortError";
-        reject((_a = signal.reason) !== null && _a !== void 0 ? _a : error);
+        reject((_a = signal.reason) !== null && _a !== void 0 ? _a : (0, ovok_error_utils_1.namedError)("AbortError", "Token refresh aborted"));
         return;
     }
     const timer = setTimeout(() => {
@@ -106,9 +100,7 @@ const waitForRetry = (milliseconds, signal) => new Promise((resolve, reject) =>
     const abort = () => {
         var _a;
         clearTimeout(timer);
-        const error = new Error("Token refresh aborted");
-        error.name = "AbortError";
-        reject((_a = signal === null || signal === void 0 ? void 0 : signal.reason) !== null && _a !== void 0 ? _a : error);
+        reject((_a = signal === null || signal === void 0 ? void 0 : signal.reason) !== null && _a !== void 0 ? _a : (0, ovok_error_utils_1.namedError)("AbortError", "Token refresh aborted"));
     };
     signal === null || signal === void 0 ? void 0 : signal.addEventListener("abort", abort, { once: true });
 });
@@ -116,17 +108,14 @@ exports.waitForRetry = waitForRetry;
 const isTemporaryRefreshFailure = (status) => status === 429 || (status >= 500 && status <= 599);
 exports.isTemporaryRefreshFailure = isTemporaryRefreshFailure;
 const refreshUnavailableError = (response) => {
-    const error = new Error("Token refresh is temporarily unavailable");
-    error.name = "NetworkError";
-    Object.assign(error, { cause: response });
-    return error;
+    return Object.assign((0, ovok_error_utils_1.namedError)("NetworkError", "Token refresh is temporarily unavailable"), { cause: response });
 };
 exports.refreshUnavailableError = refreshUnavailableError;
 const refreshResponseError = (response) => {
-    const error = new Error(`Token refresh returned HTTP ${response.status}`);
-    error.name = "TokenRefreshError";
-    Object.assign(error, { status: response.status, cause: response });
-    return error;
+    return Object.assign((0, ovok_error_utils_1.namedError)("TokenRefreshError", `Token refresh returned HTTP ${response.status}`), {
+        status: response.status,
+        cause: response,
+    });
 };
 exports.refreshResponseError = refreshResponseError;
 const isNetworkError = (error) => {

package/dist/client/auth/sha256.d.ts

@@ -0,0 +1,2 @@
+/** SHA-256 digest of an ASCII string (a PKCE verifier is `[A-Za-z0-9-._~]`). */
+export declare const sha256Bytes: (ascii: string) => Uint8Array;

package/dist/client/auth/sha256.js

@@ -0,0 +1,65 @@
+"use strict";
+// SHA-256 (FIPS 180-4), synchronous and dependency-free: React Native has no `crypto.subtle`,
+// and the PKCE login start is synchronous.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sha256Bytes = void 0;
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+/** SHA-256 digest of an ASCII string (a PKCE verifier is `[A-Za-z0-9-._~]`). */
+const sha256Bytes = (ascii) => {
+    const blocks = new Uint8Array(Math.ceil((ascii.length + 9) / 64) * 64);
+    const view = new DataView(blocks.buffer);
+    for (let i = 0; i < ascii.length; i += 1) {
+        const code = ascii.charCodeAt(i);
+        if (code > 0x7f) {
+            throw new RangeError("sha256Bytes hashes ASCII input only.");
+        }
+        blocks[i] = code;
+    }
+    blocks[ascii.length] = 0x80;
+    view.setUint32(blocks.length - 4, ascii.length * 8);
+    const hash = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const w = new Uint32Array(64);
+    for (let offset = 0; offset < blocks.length; offset += 64) {
+        for (let t = 0; t < 16; t += 1) {
+            w[t] = view.getUint32(offset + t * 4);
+        }
+        for (let t = 16; t < 64; t += 1) {
+            const s0 = rotr(w[t - 15], 7) ^ rotr(w[t - 15], 18) ^ (w[t - 15] >>> 3);
+            const s1 = rotr(w[t - 2], 17) ^ rotr(w[t - 2], 19) ^ (w[t - 2] >>> 10);
+            w[t] = w[t - 16] + s0 + w[t - 7] + s1;
+        }
+        let [a, b, c, d, e, f, g, h] = hash;
+        for (let t = 0; t < 64; t += 1) {
+            const t1 = (h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[t] + w[t]) >>> 0;
+            const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        [a, b, c, d, e, f, g, h].forEach((value, index) => {
+            hash[index] += value;
+        });
+    }
+    const digest = new Uint8Array(32);
+    const digestView = new DataView(digest.buffer);
+    hash.forEach((word, index) => digestView.setUint32(index * 4, word));
+    return digest;
+};
+exports.sha256Bytes = sha256Bytes;

package/dist/{utils → client}/auth/start-login.d.ts

@@ -1,7 +1,7 @@
 import type { MedplumRequestOptions } from "@medplum/core";
-import { StartLoginResponse } from "../../client/auth/types/StartLoginResponse";
-import { OvokClient } from "../../client/ovok-client";
 import { LoginBody } from "../../types";
+import { OvokClient } from "../ovok-client";
+import { StartLoginResponse } from "./types/StartLoginResponse";
 type StartLoginProps = {
     client: OvokClient;
     body: LoginBody;

package/dist/client/change-history/methods.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.serializeChangeHistoryQuery = serializeChangeHistoryQuery;
 exports.listChangeHistory = listChangeHistory;
+const request_options_1 = require("../request-options");
 function serializeChangeHistoryQuery(params = {}) {
     const search = new URLSearchParams();
     for (const [key, value] of Object.entries(params)) {
@@ -21,5 +22,5 @@ function serializeChangeHistoryQuery(params = {}) {
     return encoded ? `?${encoded}` : "";
 }
 function listChangeHistory(params = {}, requestOptions) {
-    return this.get(`/v1/slim/change-history${serializeChangeHistoryQuery(params)}`, ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.get(`/v1/slim/change-history${serializeChangeHistoryQuery(params)}`, ...(0, request_options_1.optionalArg)(requestOptions));
 }

package/dist/client/cms/methods.js

@@ -6,31 +6,19 @@ exports.getLegalPage = getLegalPage;
 exports.listReleaseNotes = listReleaseNotes;
 exports.getTranslations = getTranslations;
 const sign_in_required_error_1 = require("../errors/sign-in-required-error");
+const query_string_1 = require("../query-string");
+const request_options_1 = require("../request-options");
 const locale_1 = require("./locale");
 const collectionPath = (collection) => `/v1/public/cms/collections/${encodeURIComponent(collection)}/items`;
-const cmsQuery = ({ locale, tenantCode, environment, page, limit, sort }) => {
-    const params = new URLSearchParams();
-    if (locale) {
-        params.set("locale", (0, locale_1.toCmsLocale)(locale));
-    }
-    if (tenantCode) {
-        params.set("tenant", tenantCode);
-    }
-    if (environment) {
-        params.set("environment", environment);
-    }
-    if (page !== undefined) {
-        params.set("page", String(page));
-    }
-    if (limit !== undefined) {
-        params.set("limit", String(limit));
-    }
-    if (sort) {
-        params.set("sort", sort);
-    }
-    const query = params.toString();
-    return query ? `?${query}` : "";
-};
+// Empty strings count as absent, like undefined.
+const cmsQuery = ({ locale, tenantCode, environment, page, limit, sort }) => (0, query_string_1.toQueryString)({
+    locale: locale ? (0, locale_1.toCmsLocale)(locale) : undefined,
+    tenant: tenantCode || undefined,
+    environment,
+    page,
+    limit,
+    sort: sort || undefined,
+});
 /**
  * Signed out, the backend serves only a few collections, read by tenant code;
  * any other read is a 401, which MedplumClient answers by clearing its
@@ -53,7 +41,7 @@ async function getCmsDocument(collection, slug, options = {}, requestOptions) {
         throw new Error("A CMS document read needs a slug.");
     }
     assertReadable(this, collection, options);
-    return this.get(`${collectionPath(collection)}/${encodeURIComponent(slug)}${cmsQuery(options)}`, ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.get(`${collectionPath(collection)}/${encodeURIComponent(slug)}${cmsQuery(options)}`, ...(0, request_options_1.optionalArg)(requestOptions));
 }
 /**
  * A page of a CMS collection's published documents, merged with the shared
@@ -61,17 +49,17 @@ async function getCmsDocument(collection, slug, options = {}, requestOptions) {
  */
 async function listCmsDocuments(collection, options = {}, requestOptions) {
     assertReadable(this, collection, options);
-    return this.get(`${collectionPath(collection)}${cmsQuery(options)}`, ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.get(`${collectionPath(collection)}${cmsQuery(options)}`, ...(0, request_options_1.optionalArg)(requestOptions));
 }
 /** A legal page ("terms-and-conditions", "data-privacy", …). Readable before sign-in with a tenant code. */
 function getLegalPage(slug, options = {}, requestOptions) {
     var _a;
-    return this.getCmsDocument("legal-pages", slug, { ...options, allowSignedOut: (_a = options.allowSignedOut) !== null && _a !== void 0 ? _a : true }, ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.getCmsDocument("legal-pages", slug, { ...options, allowSignedOut: (_a = options.allowSignedOut) !== null && _a !== void 0 ? _a : true }, ...(0, request_options_1.optionalArg)(requestOptions));
 }
 /** Release notes, newest first unless `sort` says otherwise. Needs a session. */
 function listReleaseNotes(options = {}, requestOptions) {
     var _a;
-    return this.listCmsDocuments("release-notes", { ...options, sort: (_a = options.sort) !== null && _a !== void 0 ? _a : "-publishedAt" }, ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.listCmsDocuments("release-notes", { ...options, sort: (_a = options.sort) !== null && _a !== void 0 ? _a : "-publishedAt" }, ...(0, request_options_1.optionalArg)(requestOptions));
 }
 /** A translations read takes pages of 50 documents, the CMS's most, and at most this many. */
 const MAX_TRANSLATION_PAGES = 20;
@@ -127,7 +115,7 @@ async function getTranslations(options = {}, requestOptions) {
     const readOptions = { ...options, allowSignedOut: (_a = options.allowSignedOut) !== null && _a !== void 0 ? _a : true };
     const translations = {};
     for (let page = 1; page <= MAX_TRANSLATION_PAGES; page++) {
-        const { docs, hasNextPage } = await this.listCmsDocuments("translations", { ...readOptions, page, limit: 50 }, ...(requestOptions === undefined ? [] : [requestOptions]));
+        const { docs, hasNextPage } = await this.listCmsDocuments("translations", { ...readOptions, page, limit: 50 }, ...(0, request_options_1.optionalArg)(requestOptions));
         addTranslations(translations, docs);
         if (!hasNextPage) {
             break;

package/dist/client/consent/methods.js

@@ -4,15 +4,16 @@ exports.getLegalConsent = getLegalConsent;
 exports.setLegalConsent = setLegalConsent;
 exports.getMedicalConsent = getMedicalConsent;
 exports.setMedicalConsent = setMedicalConsent;
+const request_options_1 = require("../request-options");
 function getLegalConsent(requestOptions) {
-    return this.get("/v1/me/consent/legal", ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.get("/v1/me/consent/legal", ...(0, request_options_1.optionalArg)(requestOptions));
 }
 function setLegalConsent(accepted, requestOptions) {
     const body = { termsAndConditionsConsent: accepted };
     return this.post("/v1/me/consent/legal", body, undefined, requestOptions);
 }
 function getMedicalConsent(requestOptions) {
-    return this.get("/v1/me/consent/medical", ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.get("/v1/me/consent/medical", ...(0, request_options_1.optionalArg)(requestOptions));
 }
 function setMedicalConsent(accepted, requestOptions) {
     const body = { medicalSettingsNotificationsConsent: accepted };

package/dist/client/email/methods.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getEmailTemplates = getEmailTemplates;
+const request_options_1 = require("../request-options");
 function getEmailTemplates(requestOptions) {
-    return this.get("/v1/email/templates", ...(requestOptions === undefined ? [] : [requestOptions]));
+    return this.get("/v1/email/templates", ...(0, request_options_1.optionalArg)(requestOptions));
 }