@uengage.io/platform-sdk 0.3.0 → 0.7.0

package/dist/errors.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Platform-SDK error hierarchy. Consumers should `instanceof`-check
+ * against `PlatformError` for the catch-all and the specific subclasses
+ * for the cases they care about. Status codes mirror the HTTP responses
+ * the platform API actually emits, so `error.status` is the simplest
+ * routing signal.
+ */
+export declare class PlatformError extends Error {
+    readonly status?: number;
+    readonly cause?: unknown;
+    constructor(message: string, opts?: {
+        status?: number;
+        cause?: unknown;
+    });
+}
+export declare class AuthenticationError extends PlatformError {
+    constructor(message?: string, opts?: {
+        cause?: unknown;
+    });
+}
+export declare class AuthorizationError extends PlatformError {
+    /** When the API returns a `requiredScope`, surface it for the consumer. */
+    readonly requiredScope?: string;
+    constructor(message?: string, opts?: {
+        requiredScope?: string;
+        cause?: unknown;
+    });
+}
+export declare class NotFoundError extends PlatformError {
+    constructor(message?: string, opts?: {
+        cause?: unknown;
+    });
+}
+export declare class ValidationError extends PlatformError {
+    /** Per-field issues in the platform's standard `issues` array shape. */
+    readonly issues?: unknown[];
+    constructor(message?: string, opts?: {
+        issues?: unknown[];
+        cause?: unknown;
+    });
+}
+export declare class RateLimitError extends PlatformError {
+    /** Seconds the consumer should back off (from `Retry-After`). */
+    readonly retryAfter?: number;
+    constructor(message?: string, opts?: {
+        retryAfter?: number;
+        cause?: unknown;
+    });
+}
+/**
+ * Thrown when the SDK detects an expired access token before the request
+ * is sent. Callers using a static externally-supplied token must update
+ * the config with a fresh one.
+ */
+export declare class TokenExpiredError extends PlatformError {
+    constructor(message?: string);
+}
+/** Thrown for missing / inconsistent SDK configuration. */
+export declare class ConfigError extends PlatformError {
+    constructor(message: string);
+}

package/dist/errors.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigError = exports.TokenExpiredError = exports.RateLimitError = exports.ValidationError = exports.NotFoundError = exports.AuthorizationError = exports.AuthenticationError = exports.PlatformError = void 0;
+/**
+ * Platform-SDK error hierarchy. Consumers should `instanceof`-check
+ * against `PlatformError` for the catch-all and the specific subclasses
+ * for the cases they care about. Status codes mirror the HTTP responses
+ * the platform API actually emits, so `error.status` is the simplest
+ * routing signal.
+ */
+class PlatformError extends Error {
+    status;
+    cause;
+    constructor(message, opts) {
+        super(message);
+        this.name = 'PlatformError';
+        this.status = opts?.status;
+        this.cause = opts?.cause;
+    }
+}
+exports.PlatformError = PlatformError;
+class AuthenticationError extends PlatformError {
+    constructor(message = 'authentication failed', opts) {
+        super(message, { status: 401, cause: opts?.cause });
+        this.name = 'AuthenticationError';
+    }
+}
+exports.AuthenticationError = AuthenticationError;
+class AuthorizationError extends PlatformError {
+    /** When the API returns a `requiredScope`, surface it for the consumer. */
+    requiredScope;
+    constructor(message = 'authorization failed', opts) {
+        super(message, { status: 403, cause: opts?.cause });
+        this.name = 'AuthorizationError';
+        this.requiredScope = opts?.requiredScope;
+    }
+}
+exports.AuthorizationError = AuthorizationError;
+class NotFoundError extends PlatformError {
+    constructor(message = 'not found', opts) {
+        super(message, { status: 404, cause: opts?.cause });
+        this.name = 'NotFoundError';
+    }
+}
+exports.NotFoundError = NotFoundError;
+class ValidationError extends PlatformError {
+    /** Per-field issues in the platform's standard `issues` array shape. */
+    issues;
+    constructor(message = 'validation failed', opts) {
+        super(message, { status: 422, cause: opts?.cause });
+        this.name = 'ValidationError';
+        this.issues = opts?.issues;
+    }
+}
+exports.ValidationError = ValidationError;
+class RateLimitError extends PlatformError {
+    /** Seconds the consumer should back off (from `Retry-After`). */
+    retryAfter;
+    constructor(message = 'rate limited', opts) {
+        super(message, { status: 429, cause: opts?.cause });
+        this.name = 'RateLimitError';
+        this.retryAfter = opts?.retryAfter;
+    }
+}
+exports.RateLimitError = RateLimitError;
+/**
+ * Thrown when the SDK detects an expired access token before the request
+ * is sent. Callers using a static externally-supplied token must update
+ * the config with a fresh one.
+ */
+class TokenExpiredError extends PlatformError {
+    constructor(message = 'access token has expired') {
+        super(message, { status: 401 });
+        this.name = 'TokenExpiredError';
+    }
+}
+exports.TokenExpiredError = TokenExpiredError;
+/** Thrown for missing / inconsistent SDK configuration. */
+class ConfigError extends PlatformError {
+    constructor(message) {
+        super(message);
+        this.name = 'ConfigError';
+    }
+}
+exports.ConfigError = ConfigError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2Vycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQTs7Ozs7O0dBTUc7QUFDSCxNQUFhLGFBQWMsU0FBUSxLQUFLO0lBQzdCLE1BQU0sQ0FBVTtJQUNoQixLQUFLLENBQVc7SUFDekIsWUFBWSxPQUFlLEVBQUUsSUFBMkM7UUFDdEUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyxlQUFlLENBQUM7UUFDNUIsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLEVBQUUsTUFBTSxDQUFDO1FBQzNCLElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxFQUFFLEtBQUssQ0FBQztJQUMzQixDQUFDO0NBQ0Y7QUFURCxzQ0FTQztBQUVELE1BQWEsbUJBQW9CLFNBQVEsYUFBYTtJQUNwRCxZQUFZLE9BQU8sR0FBRyx1QkFBdUIsRUFBRSxJQUEwQjtRQUN2RSxLQUFLLENBQUMsT0FBTyxFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLElBQUksR0FBRyxxQkFBcUIsQ0FBQztJQUNwQyxDQUFDO0NBQ0Y7QUFMRCxrREFLQztBQUVELE1BQWEsa0JBQW1CLFNBQVEsYUFBYTtJQUNuRCwyRUFBMkU7SUFDbEUsYUFBYSxDQUFVO0lBQ2hDLFlBQ0UsT0FBTyxHQUFHLHNCQUFzQixFQUNoQyxJQUFrRDtRQUVsRCxLQUFLLENBQUMsT0FBTyxFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLElBQUksR0FBRyxvQkFBb0IsQ0FBQztRQUNqQyxJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksRUFBRSxhQUFhLENBQUM7SUFDM0MsQ0FBQztDQUNGO0FBWEQsZ0RBV0M7QUFFRCxNQUFhLGFBQWMsU0FBUSxhQUFhO0lBQzlDLFlBQVksT0FBTyxHQUFHLFdBQVcsRUFBRSxJQUEwQjtRQUMzRCxLQUFLLENBQUMsT0FBTyxFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLElBQUksR0FBRyxlQUFlLENBQUM7SUFDOUIsQ0FBQztDQUNGO0FBTEQsc0NBS0M7QUFFRCxNQUFhLGVBQWdCLFNBQVEsYUFBYTtJQUNoRCx3RUFBd0U7SUFDL0QsTUFBTSxDQUFhO0lBQzVCLFlBQVksT0FBTyxHQUFHLG1CQUFtQixFQUFFLElBQThDO1FBQ3ZGLEtBQUssQ0FBQyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNwRCxJQUFJLENBQUMsSUFBSSxHQUFHLGlCQUFpQixDQUFDO1FBQzlCLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxFQUFFLE1BQU0sQ0FBQztJQUM3QixDQUFDO0NBQ0Y7QUFSRCwwQ0FRQztBQUVELE1BQWEsY0FBZSxTQUFRLGFBQWE7SUFDL0MsaUVBQWlFO0lBQ3hELFVBQVUsQ0FBVTtJQUM3QixZQUFZLE9BQU8sR0FBRyxjQUFjLEVBQUUsSUFBK0M7UUFDbkYsS0FBSyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ3BELElBQUksQ0FBQyxJQUFJLEdBQUcsZ0JBQWdCLENBQUM7UUFDN0IsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLEVBQUUsVUFBVSxDQUFDO0lBQ3JDLENBQUM7Q0FDRjtBQVJELHdDQVFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQWEsaUJBQWtCLFNBQVEsYUFBYTtJQUNsRCxZQUFZLE9BQU8sR0FBRywwQkFBMEI7UUFDOUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ2hDLElBQUksQ0FBQyxJQUFJLEdBQUcsbUJBQW1CLENBQUM7SUFDbEMsQ0FBQztDQUNGO0FBTEQsOENBS0M7QUFFRCwyREFBMkQ7QUFDM0QsTUFBYSxXQUFZLFNBQVEsYUFBYTtJQUM1QyxZQUFZLE9BQWU7UUFDekIsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyxhQUFhLENBQUM7SUFDNUIsQ0FBQztDQUNGO0FBTEQsa0NBS0MiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFBsYXRmb3JtLVNESyBlcnJvciBoaWVyYXJjaHkuIENvbnN1bWVycyBzaG91bGQgYGluc3RhbmNlb2ZgLWNoZWNrXG4gKiBhZ2FpbnN0IGBQbGF0Zm9ybUVycm9yYCBmb3IgdGhlIGNhdGNoLWFsbCBhbmQgdGhlIHNwZWNpZmljIHN1YmNsYXNzZXNcbiAqIGZvciB0aGUgY2FzZXMgdGhleSBjYXJlIGFib3V0LiBTdGF0dXMgY29kZXMgbWlycm9yIHRoZSBIVFRQIHJlc3BvbnNlc1xuICogdGhlIHBsYXRmb3JtIEFQSSBhY3R1YWxseSBlbWl0cywgc28gYGVycm9yLnN0YXR1c2AgaXMgdGhlIHNpbXBsZXN0XG4gKiByb3V0aW5nIHNpZ25hbC5cbiAqL1xuZXhwb3J0IGNsYXNzIFBsYXRmb3JtRXJyb3IgZXh0ZW5kcyBFcnJvciB7XG4gIHJlYWRvbmx5IHN0YXR1cz86IG51bWJlcjtcbiAgcmVhZG9ubHkgY2F1c2U/OiB1bmtub3duO1xuICBjb25zdHJ1Y3RvcihtZXNzYWdlOiBzdHJpbmcsIG9wdHM/OiB7IHN0YXR1cz86IG51bWJlcjsgY2F1c2U/OiB1bmtub3duIH0pIHtcbiAgICBzdXBlcihtZXNzYWdlKTtcbiAgICB0aGlzLm5hbWUgPSAnUGxhdGZvcm1FcnJvcic7XG4gICAgdGhpcy5zdGF0dXMgPSBvcHRzPy5zdGF0dXM7XG4gICAgdGhpcy5jYXVzZSA9IG9wdHM/LmNhdXNlO1xuICB9XG59XG5cbmV4cG9ydCBjbGFzcyBBdXRoZW50aWNhdGlvbkVycm9yIGV4dGVuZHMgUGxhdGZvcm1FcnJvciB7XG4gIGNvbnN0cnVjdG9yKG1lc3NhZ2UgPSAnYXV0aGVudGljYXRpb24gZmFpbGVkJywgb3B0cz86IHsgY2F1c2U/OiB1bmtub3duIH0pIHtcbiAgICBzdXBlcihtZXNzYWdlLCB7IHN0YXR1czogNDAxLCBjYXVzZTogb3B0cz8uY2F1c2UgfSk7XG4gICAgdGhpcy5uYW1lID0gJ0F1dGhlbnRpY2F0aW9uRXJyb3InO1xuICB9XG59XG5cbmV4cG9ydCBjbGFzcyBBdXRob3JpemF0aW9uRXJyb3IgZXh0ZW5kcyBQbGF0Zm9ybUVycm9yIHtcbiAgLyoqIFdoZW4gdGhlIEFQSSByZXR1cm5zIGEgYHJlcXVpcmVkU2NvcGVgLCBzdXJmYWNlIGl0IGZvciB0aGUgY29uc3VtZXIuICovXG4gIHJlYWRvbmx5IHJlcXVpcmVkU2NvcGU/OiBzdHJpbmc7XG4gIGNvbnN0cnVjdG9yKFxuICAgIG1lc3NhZ2UgPSAnYXV0aG9yaXphdGlvbiBmYWlsZWQnLFxuICAgIG9wdHM/OiB7IHJlcXVpcmVkU2NvcGU/OiBzdHJpbmc7IGNhdXNlPzogdW5rbm93biB9LFxuICApIHtcbiAgICBzdXBlcihtZXNzYWdlLCB7IHN0YXR1czogNDAzLCBjYXVzZTogb3B0cz8uY2F1c2UgfSk7XG4gICAgdGhpcy5uYW1lID0gJ0F1dGhvcml6YXRpb25FcnJvcic7XG4gICAgdGhpcy5yZXF1aXJlZFNjb3BlID0gb3B0cz8ucmVxdWlyZWRTY29wZTtcbiAgfVxufVxuXG5leHBvcnQgY2xhc3MgTm90Rm91bmRFcnJvciBleHRlbmRzIFBsYXRmb3JtRXJyb3Ige1xuICBjb25zdHJ1Y3RvcihtZXNzYWdlID0gJ25vdCBmb3VuZCcsIG9wdHM/OiB7IGNhdXNlPzogdW5rbm93biB9KSB7XG4gICAgc3VwZXIobWVzc2FnZSwgeyBzdGF0dXM6IDQwNCwgY2F1c2U6IG9wdHM/LmNhdXNlIH0pO1xuICAgIHRoaXMubmFtZSA9ICdOb3RGb3VuZEVycm9yJztcbiAgfVxufVxuXG5leHBvcnQgY2xhc3MgVmFsaWRhdGlvbkVycm9yIGV4dGVuZHMgUGxhdGZvcm1FcnJvciB7XG4gIC8qKiBQZXItZmllbGQgaXNzdWVzIGluIHRoZSBwbGF0Zm9ybSdzIHN0YW5kYXJkIGBpc3N1ZXNgIGFycmF5IHNoYXBlLiAqL1xuICByZWFkb25seSBpc3N1ZXM/OiB1bmtub3duW107XG4gIGNvbnN0cnVjdG9yKG1lc3NhZ2UgPSAndmFsaWRhdGlvbiBmYWlsZWQnLCBvcHRzPzogeyBpc3N1ZXM/OiB1bmtub3duW107IGNhdXNlPzogdW5rbm93biB9KSB7XG4gICAgc3VwZXIobWVzc2FnZSwgeyBzdGF0dXM6IDQyMiwgY2F1c2U6IG9wdHM/LmNhdXNlIH0pO1xuICAgIHRoaXMubmFtZSA9ICdWYWxpZGF0aW9uRXJyb3InO1xuICAgIHRoaXMuaXNzdWVzID0gb3B0cz8uaXNzdWVzO1xuICB9XG59XG5cbmV4cG9ydCBjbGFzcyBSYXRlTGltaXRFcnJvciBleHRlbmRzIFBsYXRmb3JtRXJyb3Ige1xuICAvKiogU2Vjb25kcyB0aGUgY29uc3VtZXIgc2hvdWxkIGJhY2sgb2ZmIChmcm9tIGBSZXRyeS1BZnRlcmApLiAqL1xuICByZWFkb25seSByZXRyeUFmdGVyPzogbnVtYmVyO1xuICBjb25zdHJ1Y3RvcihtZXNzYWdlID0gJ3JhdGUgbGltaXRlZCcsIG9wdHM/OiB7IHJldHJ5QWZ0ZXI/OiBudW1iZXI7IGNhdXNlPzogdW5rbm93biB9KSB7XG4gICAgc3VwZXIobWVzc2FnZSwgeyBzdGF0dXM6IDQyOSwgY2F1c2U6IG9wdHM/LmNhdXNlIH0pO1xuICAgIHRoaXMubmFtZSA9ICdSYXRlTGltaXRFcnJvcic7XG4gICAgdGhpcy5yZXRyeUFmdGVyID0gb3B0cz8ucmV0cnlBZnRlcjtcbiAgfVxufVxuXG4vKipcbiAqIFRocm93biB3aGVuIHRoZSBTREsgZGV0ZWN0cyBhbiBleHBpcmVkIGFjY2VzcyB0b2tlbiBiZWZvcmUgdGhlIHJlcXVlc3RcbiAqIGlzIHNlbnQuIENhbGxlcnMgdXNpbmcgYSBzdGF0aWMgZXh0ZXJuYWxseS1zdXBwbGllZCB0b2tlbiBtdXN0IHVwZGF0ZVxuICogdGhlIGNvbmZpZyB3aXRoIGEgZnJlc2ggb25lLlxuICovXG5leHBvcnQgY2xhc3MgVG9rZW5FeHBpcmVkRXJyb3IgZXh0ZW5kcyBQbGF0Zm9ybUVycm9yIHtcbiAgY29uc3RydWN0b3IobWVzc2FnZSA9ICdhY2Nlc3MgdG9rZW4gaGFzIGV4cGlyZWQnKSB7XG4gICAgc3VwZXIobWVzc2FnZSwgeyBzdGF0dXM6IDQwMSB9KTtcbiAgICB0aGlzLm5hbWUgPSAnVG9rZW5FeHBpcmVkRXJyb3InO1xuICB9XG59XG5cbi8qKiBUaHJvd24gZm9yIG1pc3NpbmcgLyBpbmNvbnNpc3RlbnQgU0RLIGNvbmZpZ3VyYXRpb24uICovXG5leHBvcnQgY2xhc3MgQ29uZmlnRXJyb3IgZXh0ZW5kcyBQbGF0Zm9ybUVycm9yIHtcbiAgY29uc3RydWN0b3IobWVzc2FnZTogc3RyaW5nKSB7XG4gICAgc3VwZXIobWVzc2FnZSk7XG4gICAgdGhpcy5uYW1lID0gJ0NvbmZpZ0Vycm9yJztcbiAgfVxufVxuIl19

package/dist/http.d.ts

@@ -7,9 +7,18 @@ export interface SignedHeaderParams {
     body?: string;
 }
 /**
- * Build the headers required for a request to the platform API, given the
- * effective auth on `config`. With no auth configured we still return any
- * non-auth headers (e.g. content-type) - some endpoints accept anonymous
- * callers and the server decides whether to allow.
+ * Build the headers for a request to the platform API.
+ *
+ * Adds three platform-wide headers automatically:
+ *   - `User-Agent` so the gateway can attribute traffic to SDK version
+ *   - `Idempotency-Key` (UUID v4) on mutating methods, so callers don't
+ *     have to generate one per call
+ *   - `content-type: application/json` when a body is supplied
+ *
+ * Auth comes from `config.auth`:
+ *   - `bearer`: the token is sent verbatim (caller is responsible for
+ *     freshness; SDK throws TokenExpiredError on local-detected expiry)
+ *   - `token-source`: SDK mints + caches via OAuth2 client_credentials
+ *     and refreshes on expiry / 401
  */
-export declare function buildHeaders(config: PlatformConfig, params: SignedHeaderParams): Record<string, string>;
+export declare function buildHeaders(config: PlatformConfig, params: SignedHeaderParams): Promise<Record<string, string>>;

package/dist/http.js

@@ -2,39 +2,42 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildHeaders = buildHeaders;
 const node_crypto_1 = require("node:crypto");
-const sign_1 = require("./audit/sign");
+const token_source_1 = require("./token-source");
+const version_1 = require("./version");
+const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 /**
- * Build the headers required for a request to the platform API, given the
- * effective auth on `config`. With no auth configured we still return any
- * non-auth headers (e.g. content-type) - some endpoints accept anonymous
- * callers and the server decides whether to allow.
+ * Build the headers for a request to the platform API.
+ *
+ * Adds three platform-wide headers automatically:
+ *   - `User-Agent` so the gateway can attribute traffic to SDK version
+ *   - `Idempotency-Key` (UUID v4) on mutating methods, so callers don't
+ *     have to generate one per call
+ *   - `content-type: application/json` when a body is supplied
+ *
+ * Auth comes from `config.auth`:
+ *   - `bearer`: the token is sent verbatim (caller is responsible for
+ *     freshness; SDK throws TokenExpiredError on local-detected expiry)
+ *   - `token-source`: SDK mints + caches via OAuth2 client_credentials
+ *     and refreshes on expiry / 401
  */
-function buildHeaders(config, params) {
-    const headers = {};
+async function buildHeaders(config, params) {
+    const headers = {
+        'user-agent': `uengage-platform-sdk/${version_1.SDK_VERSION}`,
+    };
     if (params.body !== undefined)
         headers['content-type'] = 'application/json';
+    if (MUTATING_METHODS.has(params.method.toUpperCase())) {
+        headers['idempotency-key'] = (0, node_crypto_1.randomUUID)();
+    }
     if (!config.auth)
         return headers;
     if (config.auth.type === 'bearer') {
         headers['authorization'] = `Bearer ${config.auth.token}`;
         return headers;
     }
-    // HMAC
-    const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
-    const nonce = (0, node_crypto_1.randomUUID)();
-    const signature = (0, sign_1.signRequest)({
-        method: params.method,
-        path: params.path,
-        serviceId: config.auth.serviceId,
-        timestamp,
-        nonce,
-        body: params.body ?? '',
-        secret: config.auth.secret,
-    });
-    headers['x-service-id'] = config.auth.serviceId;
-    headers['x-timestamp'] = timestamp;
-    headers['x-nonce'] = nonce;
-    headers['x-signature'] = signature;
+    // token-source: mint + cache + refresh-dedup happens in getAccessToken
+    const token = await (0, token_source_1.getAccessToken)(config.auth.state);
+    headers['authorization'] = `Bearer ${token}`;
     return headers;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaHR0cC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9odHRwLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBa0JBLG9DQStCQztBQWpERCw2Q0FBeUM7QUFDekMsdUNBQTJDO0FBVzNDOzs7OztHQUtHO0FBQ0gsU0FBZ0IsWUFBWSxDQUMxQixNQUFzQixFQUN0QixNQUEwQjtJQUUxQixNQUFNLE9BQU8sR0FBMkIsRUFBRSxDQUFDO0lBQzNDLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxTQUFTO1FBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxHQUFHLGtCQUFrQixDQUFDO0lBRTVFLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSTtRQUFFLE9BQU8sT0FBTyxDQUFDO0lBRWpDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDbEMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxHQUFHLFVBQVUsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUN6RCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsT0FBTztJQUNQLE1BQU0sU0FBUyxHQUFHLElBQUksSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxHQUFHLENBQUMsQ0FBQztJQUNyRSxNQUFNLEtBQUssR0FBRyxJQUFBLHdCQUFVLEdBQUUsQ0FBQztJQUMzQixNQUFNLFNBQVMsR0FBRyxJQUFBLGtCQUFXLEVBQUM7UUFDNUIsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNO1FBQ3JCLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSTtRQUNqQixTQUFTLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTO1FBQ2hDLFNBQVM7UUFDVCxLQUFLO1FBQ0wsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLElBQUksRUFBRTtRQUN2QixNQUFNLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNO0tBQzNCLENBQUMsQ0FBQztJQUNILE9BQU8sQ0FBQyxjQUFjLENBQUMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUNoRCxPQUFPLENBQUMsYUFBYSxDQUFDLEdBQUcsU0FBUyxDQUFDO0lBQ25DLE9BQU8sQ0FBQyxTQUFTLENBQUMsR0FBRyxLQUFLLENBQUM7SUFDM0IsT0FBTyxDQUFDLGFBQWEsQ0FBQyxHQUFHLFNBQVMsQ0FBQztJQUNuQyxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgcmFuZG9tVVVJRCB9IGZyb20gJ25vZGU6Y3J5cHRvJztcbmltcG9ydCB7IHNpZ25SZXF1ZXN0IH0gZnJvbSAnLi9hdWRpdC9zaWduJztcbmltcG9ydCB0eXBlIHsgUGxhdGZvcm1Db25maWcgfSBmcm9tICcuL2NvbmZpZyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgU2lnbmVkSGVhZGVyUGFyYW1zIHtcbiAgbWV0aG9kOiBzdHJpbmc7XG4gIC8qKiBVUkwgcGF0aG5hbWUgb25seSwgd2l0aG91dCBxdWVyeSBzdHJpbmcuIE11c3QgbWF0Y2ggYGMucmVxLnBhdGhgIHNlcnZlci1zaWRlLiAqL1xuICBwYXRoOiBzdHJpbmc7XG4gIC8qKiBSYXcgSlNPTiBib2R5IHN0cmluZywgb3IgZW1wdHkgZm9yIG5vbmUuICovXG4gIGJvZHk/OiBzdHJpbmc7XG59XG5cbi8qKlxuICogQnVpbGQgdGhlIGhlYWRlcnMgcmVxdWlyZWQgZm9yIGEgcmVxdWVzdCB0byB0aGUgcGxhdGZvcm0gQVBJLCBnaXZlbiB0aGVcbiAqIGVmZmVjdGl2ZSBhdXRoIG9uIGBjb25maWdgLiBXaXRoIG5vIGF1dGggY29uZmlndXJlZCB3ZSBzdGlsbCByZXR1cm4gYW55XG4gKiBub24tYXV0aCBoZWFkZXJzIChlLmcuIGNvbnRlbnQtdHlwZSkgLSBzb21lIGVuZHBvaW50cyBhY2NlcHQgYW5vbnltb3VzXG4gKiBjYWxsZXJzIGFuZCB0aGUgc2VydmVyIGRlY2lkZXMgd2hldGhlciB0byBhbGxvdy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGJ1aWxkSGVhZGVycyhcbiAgY29uZmlnOiBQbGF0Zm9ybUNvbmZpZyxcbiAgcGFyYW1zOiBTaWduZWRIZWFkZXJQYXJhbXMsXG4pOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+IHtcbiAgY29uc3QgaGVhZGVyczogUmVjb3JkPHN0cmluZywgc3RyaW5nPiA9IHt9O1xuICBpZiAocGFyYW1zLmJvZHkgIT09IHVuZGVmaW5lZCkgaGVhZGVyc1snY29udGVudC10eXBlJ10gPSAnYXBwbGljYXRpb24vanNvbic7XG5cbiAgaWYgKCFjb25maWcuYXV0aCkgcmV0dXJuIGhlYWRlcnM7XG5cbiAgaWYgKGNvbmZpZy5hdXRoLnR5cGUgPT09ICdiZWFyZXInKSB7XG4gICAgaGVhZGVyc1snYXV0aG9yaXphdGlvbiddID0gYEJlYXJlciAke2NvbmZpZy5hdXRoLnRva2VufWA7XG4gICAgcmV0dXJuIGhlYWRlcnM7XG4gIH1cblxuICAvLyBITUFDXG4gIGNvbnN0IHRpbWVzdGFtcCA9IG5ldyBEYXRlKCkudG9JU09TdHJpbmcoKS5yZXBsYWNlKC9cXC5cXGR7M31aJC8sICdaJyk7XG4gIGNvbnN0IG5vbmNlID0gcmFuZG9tVVVJRCgpO1xuICBjb25zdCBzaWduYXR1cmUgPSBzaWduUmVxdWVzdCh7XG4gICAgbWV0aG9kOiBwYXJhbXMubWV0aG9kLFxuICAgIHBhdGg6IHBhcmFtcy5wYXRoLFxuICAgIHNlcnZpY2VJZDogY29uZmlnLmF1dGguc2VydmljZUlkLFxuICAgIHRpbWVzdGFtcCxcbiAgICBub25jZSxcbiAgICBib2R5OiBwYXJhbXMuYm9keSA/PyAnJyxcbiAgICBzZWNyZXQ6IGNvbmZpZy5hdXRoLnNlY3JldCxcbiAgfSk7XG4gIGhlYWRlcnNbJ3gtc2VydmljZS1pZCddID0gY29uZmlnLmF1dGguc2VydmljZUlkO1xuICBoZWFkZXJzWyd4LXRpbWVzdGFtcCddID0gdGltZXN0YW1wO1xuICBoZWFkZXJzWyd4LW5vbmNlJ10gPSBub25jZTtcbiAgaGVhZGVyc1sneC1zaWduYXR1cmUnXSA9IHNpZ25hdHVyZTtcbiAgcmV0dXJuIGhlYWRlcnM7XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaHR0cC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9odHRwLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBOEJBLG9DQXVCQztBQXJERCw2Q0FBeUM7QUFFekMsaURBQWdEO0FBQ2hELHVDQUF3QztBQVV4QyxNQUFNLGdCQUFnQixHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUVyRTs7Ozs7Ozs7Ozs7Ozs7R0FjRztBQUNJLEtBQUssVUFBVSxZQUFZLENBQ2hDLE1BQXNCLEVBQ3RCLE1BQTBCO0lBRTFCLE1BQU0sT0FBTyxHQUEyQjtRQUN0QyxZQUFZLEVBQUUsd0JBQXdCLHFCQUFXLEVBQUU7S0FDcEQsQ0FBQztJQUNGLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxTQUFTO1FBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxHQUFHLGtCQUFrQixDQUFDO0lBQzVFLElBQUksZ0JBQWdCLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3RELE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLElBQUEsd0JBQVUsR0FBRSxDQUFDO0lBQzVDLENBQUM7SUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUk7UUFBRSxPQUFPLE9BQU8sQ0FBQztJQUVqQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sQ0FBQyxlQUFlLENBQUMsR0FBRyxVQUFVLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDekQsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUVELHVFQUF1RTtJQUN2RSxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUEsNkJBQWMsRUFBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3RELE9BQU8sQ0FBQyxlQUFlLENBQUMsR0FBRyxVQUFVLEtBQUssRUFBRSxDQUFDO0lBQzdDLE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyByYW5kb21VVUlEIH0gZnJvbSAnbm9kZTpjcnlwdG8nO1xuaW1wb3J0IHR5cGUgeyBQbGF0Zm9ybUNvbmZpZyB9IGZyb20gJy4vY29uZmlnJztcbmltcG9ydCB7IGdldEFjY2Vzc1Rva2VuIH0gZnJvbSAnLi90b2tlbi1zb3VyY2UnO1xuaW1wb3J0IHsgU0RLX1ZFUlNJT04gfSBmcm9tICcuL3ZlcnNpb24nO1xuXG5leHBvcnQgaW50ZXJmYWNlIFNpZ25lZEhlYWRlclBhcmFtcyB7XG4gIG1ldGhvZDogc3RyaW5nO1xuICAvKiogVVJMIHBhdGhuYW1lIG9ubHksIHdpdGhvdXQgcXVlcnkgc3RyaW5nLiBNdXN0IG1hdGNoIGBjLnJlcS5wYXRoYCBzZXJ2ZXItc2lkZS4gKi9cbiAgcGF0aDogc3RyaW5nO1xuICAvKiogUmF3IEpTT04gYm9keSBzdHJpbmcsIG9yIGVtcHR5IGZvciBub25lLiAqL1xuICBib2R5Pzogc3RyaW5nO1xufVxuXG5jb25zdCBNVVRBVElOR19NRVRIT0RTID0gbmV3IFNldChbJ1BPU1QnLCAnUFVUJywgJ1BBVENIJywgJ0RFTEVURSddKTtcblxuLyoqXG4gKiBCdWlsZCB0aGUgaGVhZGVycyBmb3IgYSByZXF1ZXN0IHRvIHRoZSBwbGF0Zm9ybSBBUEkuXG4gKlxuICogQWRkcyB0aHJlZSBwbGF0Zm9ybS13aWRlIGhlYWRlcnMgYXV0b21hdGljYWxseTpcbiAqICAgLSBgVXNlci1BZ2VudGAgc28gdGhlIGdhdGV3YXkgY2FuIGF0dHJpYnV0ZSB0cmFmZmljIHRvIFNESyB2ZXJzaW9uXG4gKiAgIC0gYElkZW1wb3RlbmN5LUtleWAgKFVVSUQgdjQpIG9uIG11dGF0aW5nIG1ldGhvZHMsIHNvIGNhbGxlcnMgZG9uJ3RcbiAqICAgICBoYXZlIHRvIGdlbmVyYXRlIG9uZSBwZXIgY2FsbFxuICogICAtIGBjb250ZW50LXR5cGU6IGFwcGxpY2F0aW9uL2pzb25gIHdoZW4gYSBib2R5IGlzIHN1cHBsaWVkXG4gKlxuICogQXV0aCBjb21lcyBmcm9tIGBjb25maWcuYXV0aGA6XG4gKiAgIC0gYGJlYXJlcmA6IHRoZSB0b2tlbiBpcyBzZW50IHZlcmJhdGltIChjYWxsZXIgaXMgcmVzcG9uc2libGUgZm9yXG4gKiAgICAgZnJlc2huZXNzOyBTREsgdGhyb3dzIFRva2VuRXhwaXJlZEVycm9yIG9uIGxvY2FsLWRldGVjdGVkIGV4cGlyeSlcbiAqICAgLSBgdG9rZW4tc291cmNlYDogU0RLIG1pbnRzICsgY2FjaGVzIHZpYSBPQXV0aDIgY2xpZW50X2NyZWRlbnRpYWxzXG4gKiAgICAgYW5kIHJlZnJlc2hlcyBvbiBleHBpcnkgLyA0MDFcbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGJ1aWxkSGVhZGVycyhcbiAgY29uZmlnOiBQbGF0Zm9ybUNvbmZpZyxcbiAgcGFyYW1zOiBTaWduZWRIZWFkZXJQYXJhbXMsXG4pOiBQcm9taXNlPFJlY29yZDxzdHJpbmcsIHN0cmluZz4+IHtcbiAgY29uc3QgaGVhZGVyczogUmVjb3JkPHN0cmluZywgc3RyaW5nPiA9IHtcbiAgICAndXNlci1hZ2VudCc6IGB1ZW5nYWdlLXBsYXRmb3JtLXNkay8ke1NES19WRVJTSU9OfWAsXG4gIH07XG4gIGlmIChwYXJhbXMuYm9keSAhPT0gdW5kZWZpbmVkKSBoZWFkZXJzWydjb250ZW50LXR5cGUnXSA9ICdhcHBsaWNhdGlvbi9qc29uJztcbiAgaWYgKE1VVEFUSU5HX01FVEhPRFMuaGFzKHBhcmFtcy5tZXRob2QudG9VcHBlckNhc2UoKSkpIHtcbiAgICBoZWFkZXJzWydpZGVtcG90ZW5jeS1rZXknXSA9IHJhbmRvbVVVSUQoKTtcbiAgfVxuXG4gIGlmICghY29uZmlnLmF1dGgpIHJldHVybiBoZWFkZXJzO1xuXG4gIGlmIChjb25maWcuYXV0aC50eXBlID09PSAnYmVhcmVyJykge1xuICAgIGhlYWRlcnNbJ2F1dGhvcml6YXRpb24nXSA9IGBCZWFyZXIgJHtjb25maWcuYXV0aC50b2tlbn1gO1xuICAgIHJldHVybiBoZWFkZXJzO1xuICB9XG5cbiAgLy8gdG9rZW4tc291cmNlOiBtaW50ICsgY2FjaGUgKyByZWZyZXNoLWRlZHVwIGhhcHBlbnMgaW4gZ2V0QWNjZXNzVG9rZW5cbiAgY29uc3QgdG9rZW4gPSBhd2FpdCBnZXRBY2Nlc3NUb2tlbihjb25maWcuYXV0aC5zdGF0ZSk7XG4gIGhlYWRlcnNbJ2F1dGhvcml6YXRpb24nXSA9IGBCZWFyZXIgJHt0b2tlbn1gO1xuICByZXR1cm4gaGVhZGVycztcbn1cbiJdfQ==

package/dist/index.d.ts

@@ -1,17 +1,24 @@
 export * from './audit';
 export * from './business';
+export * from './errors';
+export { auth } from './auth';
+export type { PkcePair, AuthorizeUrlInput, ExchangeCodeInput, RefreshInput, TokenPair, } from './auth';
 export { type PlatformAuth, type PlatformAuthInput, type PlatformConfig, type PlatformConfigInput, DEFAULT_BASE_URL, } from './config';
+export { createClient, platform, withToken, type ClientConfig, type PlatformClient, } from './client';
 /**
  * Default singleton clients. Both read defaults from the environment on
  * every call:
- *   - PLATFORM_BASE_URL          (defaults to https://api.platform.uengage.io)
- *   - PLATFORM_SIGNING_SECRET    HMAC secret hex
- *   - PLATFORM_SERVICE_ID        HMAC service id
- *   - PLATFORM_AUTH_TOKEN        Bearer token (overrides HMAC if set)
+ *   - UENGAGE_BASE_URL          defaults to https://api.platform.uengage.io
+ *   - UENGAGE_AUTH_TOKEN        static Bearer token
+ *   - UENGAGE_SERVICE_ID        OAuth2 client_credentials clientId
+ *   - UENGAGE_SERVICE_SECRET    OAuth2 client_credentials clientSecret
+ *   - UENGAGE_SERVICE_SCOPE     optional space-separated scope list
  *
- * Override per-instance with `.config({...})` and/or `.auth({...})`. For
- * isolated configuration (tests, multi-tenant code paths), construct your
- * own via `createAuditClient(...)` or `createBusinessClient(...)` instead.
+ * The chainable `.config({...})` / `.auth({...})` API on the audit and
+ * business clients is preserved for back-compat. `.auth({token})`
+ * accepts a static Bearer token; for OAuth2 client_credentials use the
+ * unified `createClient(...)` factory instead — that builds a
+ * TokenSource which handles caching + refresh dedup + 401 retry.
  */
 export declare const audit: import("./audit").AuditClient;
 export declare const business: import("./business").BusinessClient;

package/dist/index.js

@@ -14,25 +14,35 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.business = exports.audit = exports.DEFAULT_BASE_URL = void 0;
+exports.business = exports.audit = exports.withToken = exports.platform = exports.createClient = exports.DEFAULT_BASE_URL = exports.auth = void 0;
 __exportStar(require("./audit"), exports);
 __exportStar(require("./business"), exports);
+__exportStar(require("./errors"), exports);
+var auth_1 = require("./auth");
+Object.defineProperty(exports, "auth", { enumerable: true, get: function () { return auth_1.auth; } });
 var config_1 = require("./config");
 Object.defineProperty(exports, "DEFAULT_BASE_URL", { enumerable: true, get: function () { return config_1.DEFAULT_BASE_URL; } });
+var client_1 = require("./client");
+Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return client_1.createClient; } });
+Object.defineProperty(exports, "platform", { enumerable: true, get: function () { return client_1.platform; } });
+Object.defineProperty(exports, "withToken", { enumerable: true, get: function () { return client_1.withToken; } });
 const audit_1 = require("./audit");
 const business_1 = require("./business");
 /**
  * Default singleton clients. Both read defaults from the environment on
  * every call:
- *   - PLATFORM_BASE_URL          (defaults to https://api.platform.uengage.io)
- *   - PLATFORM_SIGNING_SECRET    HMAC secret hex
- *   - PLATFORM_SERVICE_ID        HMAC service id
- *   - PLATFORM_AUTH_TOKEN        Bearer token (overrides HMAC if set)
+ *   - UENGAGE_BASE_URL          defaults to https://api.platform.uengage.io
+ *   - UENGAGE_AUTH_TOKEN        static Bearer token
+ *   - UENGAGE_SERVICE_ID        OAuth2 client_credentials clientId
+ *   - UENGAGE_SERVICE_SECRET    OAuth2 client_credentials clientSecret
+ *   - UENGAGE_SERVICE_SCOPE     optional space-separated scope list
  *
- * Override per-instance with `.config({...})` and/or `.auth({...})`. For
- * isolated configuration (tests, multi-tenant code paths), construct your
- * own via `createAuditClient(...)` or `createBusinessClient(...)` instead.
+ * The chainable `.config({...})` / `.auth({...})` API on the audit and
+ * business clients is preserved for back-compat. `.auth({token})`
+ * accepts a static Bearer token; for OAuth2 client_credentials use the
+ * unified `createClient(...)` factory instead — that builds a
+ * TokenSource which handles caching + refresh dedup + 401 retry.
  */
 exports.audit = (0, audit_1.createAuditClient)();
 exports.business = (0, business_1.createBusinessClient)();
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwwQ0FBd0I7QUFDeEIsNkNBQTJCO0FBQzNCLG1DQU1rQjtBQURoQiwwR0FBQSxnQkFBZ0IsT0FBQTtBQUdsQixtQ0FBNEM7QUFDNUMseUNBQWtEO0FBRWxEOzs7Ozs7Ozs7OztHQVdHO0FBQ1UsUUFBQSxLQUFLLEdBQUcsSUFBQSx5QkFBaUIsR0FBRSxDQUFDO0FBQzVCLFFBQUEsUUFBUSxHQUFHLElBQUEsK0JBQW9CLEdBQUUsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vYXVkaXQnO1xuZXhwb3J0ICogZnJvbSAnLi9idXNpbmVzcyc7XG5leHBvcnQge1xuICB0eXBlIFBsYXRmb3JtQXV0aCxcbiAgdHlwZSBQbGF0Zm9ybUF1dGhJbnB1dCxcbiAgdHlwZSBQbGF0Zm9ybUNvbmZpZyxcbiAgdHlwZSBQbGF0Zm9ybUNvbmZpZ0lucHV0LFxuICBERUZBVUxUX0JBU0VfVVJMLFxufSBmcm9tICcuL2NvbmZpZyc7XG5cbmltcG9ydCB7IGNyZWF0ZUF1ZGl0Q2xpZW50IH0gZnJvbSAnLi9hdWRpdCc7XG5pbXBvcnQgeyBjcmVhdGVCdXNpbmVzc0NsaWVudCB9IGZyb20gJy4vYnVzaW5lc3MnO1xuXG4vKipcbiAqIERlZmF1bHQgc2luZ2xldG9uIGNsaWVudHMuIEJvdGggcmVhZCBkZWZhdWx0cyBmcm9tIHRoZSBlbnZpcm9ubWVudCBvblxuICogZXZlcnkgY2FsbDpcbiAqICAgLSBQTEFURk9STV9CQVNFX1VSTCAgICAgICAgICAoZGVmYXVsdHMgdG8gaHR0cHM6Ly9hcGkucGxhdGZvcm0udWVuZ2FnZS5pbylcbiAqICAgLSBQTEFURk9STV9TSUdOSU5HX1NFQ1JFVCAgICBITUFDIHNlY3JldCBoZXhcbiAqICAgLSBQTEFURk9STV9TRVJWSUNFX0lEICAgICAgICBITUFDIHNlcnZpY2UgaWRcbiAqICAgLSBQTEFURk9STV9BVVRIX1RPS0VOICAgICAgICBCZWFyZXIgdG9rZW4gKG92ZXJyaWRlcyBITUFDIGlmIHNldClcbiAqXG4gKiBPdmVycmlkZSBwZXItaW5zdGFuY2Ugd2l0aCBgLmNvbmZpZyh7Li4ufSlgIGFuZC9vciBgLmF1dGgoey4uLn0pYC4gRm9yXG4gKiBpc29sYXRlZCBjb25maWd1cmF0aW9uICh0ZXN0cywgbXVsdGktdGVuYW50IGNvZGUgcGF0aHMpLCBjb25zdHJ1Y3QgeW91clxuICogb3duIHZpYSBgY3JlYXRlQXVkaXRDbGllbnQoLi4uKWAgb3IgYGNyZWF0ZUJ1c2luZXNzQ2xpZW50KC4uLilgIGluc3RlYWQuXG4gKi9cbmV4cG9ydCBjb25zdCBhdWRpdCA9IGNyZWF0ZUF1ZGl0Q2xpZW50KCk7XG5leHBvcnQgY29uc3QgYnVzaW5lc3MgPSBjcmVhdGVCdXNpbmVzc0NsaWVudCgpO1xuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwwQ0FBd0I7QUFDeEIsNkNBQTJCO0FBQzNCLDJDQUF5QjtBQUN6QiwrQkFBOEI7QUFBckIsNEZBQUEsSUFBSSxPQUFBO0FBUWIsbUNBTWtCO0FBRGhCLDBHQUFBLGdCQUFnQixPQUFBO0FBRWxCLG1DQU1rQjtBQUxoQixzR0FBQSxZQUFZLE9BQUE7QUFDWixrR0FBQSxRQUFRLE9BQUE7QUFDUixtR0FBQSxTQUFTLE9BQUE7QUFLWCxtQ0FBNEM7QUFDNUMseUNBQWtEO0FBRWxEOzs7Ozs7Ozs7Ozs7OztHQWNHO0FBQ1UsUUFBQSxLQUFLLEdBQUcsSUFBQSx5QkFBaUIsR0FBRSxDQUFDO0FBQzVCLFFBQUEsUUFBUSxHQUFHLElBQUEsK0JBQW9CLEdBQUUsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vYXVkaXQnO1xuZXhwb3J0ICogZnJvbSAnLi9idXNpbmVzcyc7XG5leHBvcnQgKiBmcm9tICcuL2Vycm9ycyc7XG5leHBvcnQgeyBhdXRoIH0gZnJvbSAnLi9hdXRoJztcbmV4cG9ydCB0eXBlIHtcbiAgUGtjZVBhaXIsXG4gIEF1dGhvcml6ZVVybElucHV0LFxuICBFeGNoYW5nZUNvZGVJbnB1dCxcbiAgUmVmcmVzaElucHV0LFxuICBUb2tlblBhaXIsXG59IGZyb20gJy4vYXV0aCc7XG5leHBvcnQge1xuICB0eXBlIFBsYXRmb3JtQXV0aCxcbiAgdHlwZSBQbGF0Zm9ybUF1dGhJbnB1dCxcbiAgdHlwZSBQbGF0Zm9ybUNvbmZpZyxcbiAgdHlwZSBQbGF0Zm9ybUNvbmZpZ0lucHV0LFxuICBERUZBVUxUX0JBU0VfVVJMLFxufSBmcm9tICcuL2NvbmZpZyc7XG5leHBvcnQge1xuICBjcmVhdGVDbGllbnQsXG4gIHBsYXRmb3JtLFxuICB3aXRoVG9rZW4sXG4gIHR5cGUgQ2xpZW50Q29uZmlnLFxuICB0eXBlIFBsYXRmb3JtQ2xpZW50LFxufSBmcm9tICcuL2NsaWVudCc7XG5cbmltcG9ydCB7IGNyZWF0ZUF1ZGl0Q2xpZW50IH0gZnJvbSAnLi9hdWRpdCc7XG5pbXBvcnQgeyBjcmVhdGVCdXNpbmVzc0NsaWVudCB9IGZyb20gJy4vYnVzaW5lc3MnO1xuXG4vKipcbiAqIERlZmF1bHQgc2luZ2xldG9uIGNsaWVudHMuIEJvdGggcmVhZCBkZWZhdWx0cyBmcm9tIHRoZSBlbnZpcm9ubWVudCBvblxuICogZXZlcnkgY2FsbDpcbiAqICAgLSBVRU5HQUdFX0JBU0VfVVJMICAgICAgICAgIGRlZmF1bHRzIHRvIGh0dHBzOi8vYXBpLnBsYXRmb3JtLnVlbmdhZ2UuaW9cbiAqICAgLSBVRU5HQUdFX0FVVEhfVE9LRU4gICAgICAgIHN0YXRpYyBCZWFyZXIgdG9rZW5cbiAqICAgLSBVRU5HQUdFX1NFUlZJQ0VfSUQgICAgICAgIE9BdXRoMiBjbGllbnRfY3JlZGVudGlhbHMgY2xpZW50SWRcbiAqICAgLSBVRU5HQUdFX1NFUlZJQ0VfU0VDUkVUICAgIE9BdXRoMiBjbGllbnRfY3JlZGVudGlhbHMgY2xpZW50U2VjcmV0XG4gKiAgIC0gVUVOR0FHRV9TRVJWSUNFX1NDT1BFICAgICBvcHRpb25hbCBzcGFjZS1zZXBhcmF0ZWQgc2NvcGUgbGlzdFxuICpcbiAqIFRoZSBjaGFpbmFibGUgYC5jb25maWcoey4uLn0pYCAvIGAuYXV0aCh7Li4ufSlgIEFQSSBvbiB0aGUgYXVkaXQgYW5kXG4gKiBidXNpbmVzcyBjbGllbnRzIGlzIHByZXNlcnZlZCBmb3IgYmFjay1jb21wYXQuIGAuYXV0aCh7dG9rZW59KWBcbiAqIGFjY2VwdHMgYSBzdGF0aWMgQmVhcmVyIHRva2VuOyBmb3IgT0F1dGgyIGNsaWVudF9jcmVkZW50aWFscyB1c2UgdGhlXG4gKiB1bmlmaWVkIGBjcmVhdGVDbGllbnQoLi4uKWAgZmFjdG9yeSBpbnN0ZWFkIOKAlCB0aGF0IGJ1aWxkcyBhXG4gKiBUb2tlblNvdXJjZSB3aGljaCBoYW5kbGVzIGNhY2hpbmcgKyByZWZyZXNoIGRlZHVwICsgNDAxIHJldHJ5LlxuICovXG5leHBvcnQgY29uc3QgYXVkaXQgPSBjcmVhdGVBdWRpdENsaWVudCgpO1xuZXhwb3J0IGNvbnN0IGJ1c2luZXNzID0gY3JlYXRlQnVzaW5lc3NDbGllbnQoKTtcbiJdfQ==

package/dist/token-source.d.ts

@@ -0,0 +1,60 @@
+/**
+ * How the SDK gets a fresh access token. Three shapes per the brief:
+ *
+ *   - `static-string` — caller hands in a token string. Used until its
+ *     `exp` has passed; on expiry we throw `TokenExpiredError` rather
+ *     than try to refresh (the SDK has no way to refresh a static
+ *     externally-supplied token).
+ *
+ *   - `callback` — caller supplies a function the SDK calls on miss
+ *     and on 401 invalidation. The consumer's logic is responsible for
+ *     refresh; the SDK just caches the result between invocations.
+ *
+ *   - `service-credentials` — `client_id` + `client_secret` for the
+ *     OAuth2 `client_credentials` grant. SDK mints + caches; on
+ *     expiry it re-mints with the same credentials.
+ */
+export type TokenSource = {
+    kind: 'static-string';
+    token: string;
+} | {
+    kind: 'callback';
+    getToken: () => string | Promise<string>;
+} | {
+    kind: 'service-credentials';
+    clientId: string;
+    clientSecret: string;
+    authBaseUrl: string;
+    scope?: string;
+};
+export interface TokenSourceState {
+    source: TokenSource;
+    cached?: {
+        token: string;
+        expiresAt: number;
+    };
+    /** Refresh dedup: concurrent requests share the same fetch. */
+    inflight?: Promise<{
+        token: string;
+        expiresAt: number;
+    }>;
+    /** Buffer (ms) before `exp` at which we treat a token as expired. */
+    expiryBufferMs: number;
+    /** Used only by the service-credentials path. */
+    fetchFn: typeof fetch;
+}
+export declare function makeTokenSourceState(source: TokenSource, options?: {
+    expiryBufferMs?: number;
+    fetchFn?: typeof fetch;
+}): TokenSourceState;
+/**
+ * Return a fresh access token, using the cache when warm. Concurrent
+ * callers during a refresh share the in-flight Promise so we don't
+ * stampede the auth server.
+ */
+export declare function getAccessToken(state: TokenSourceState): Promise<string>;
+/**
+ * Drop the cached token. The next `getAccessToken` will mint or
+ * re-fetch. Called by the request layer on 401.
+ */
+export declare function invalidateToken(state: TokenSourceState): void;

package/dist/token-source.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeTokenSourceState = makeTokenSourceState;
+exports.getAccessToken = getAccessToken;
+exports.invalidateToken = invalidateToken;
+const errors_1 = require("./errors");
+const issuer_1 = require("./auth/issuer");
+const DEFAULT_EXPIRY_BUFFER_MS = 5000;
+function makeTokenSourceState(source, options = {}) {
+    return {
+        source,
+        expiryBufferMs: options.expiryBufferMs ?? DEFAULT_EXPIRY_BUFFER_MS,
+        fetchFn: options.fetchFn ?? globalThis.fetch,
+    };
+}
+/**
+ * Return a fresh access token, using the cache when warm. Concurrent
+ * callers during a refresh share the in-flight Promise so we don't
+ * stampede the auth server.
+ */
+async function getAccessToken(state) {
+    const now = Date.now();
+    if (state.cached && state.cached.expiresAt > now + state.expiryBufferMs) {
+        return state.cached.token;
+    }
+    if (state.inflight) {
+        const fresh = await state.inflight;
+        return fresh.token;
+    }
+    const inflight = mintToken(state).then((res) => {
+        state.cached = res;
+        state.inflight = undefined;
+        return res;
+    });
+    state.inflight = inflight;
+    try {
+        const fresh = await inflight;
+        return fresh.token;
+    }
+    catch (err) {
+        state.inflight = undefined;
+        throw err;
+    }
+}
+/**
+ * Drop the cached token. The next `getAccessToken` will mint or
+ * re-fetch. Called by the request layer on 401.
+ */
+function invalidateToken(state) {
+    state.cached = undefined;
+}
+async function mintToken(state) {
+    switch (state.source.kind) {
+        case 'static-string': {
+            const exp = (0, issuer_1.getExpiry)(state.source.token);
+            if (exp !== null && exp * 1000 < Date.now() + state.expiryBufferMs) {
+                throw new errors_1.TokenExpiredError('static access token has expired; consumer must update the config with a fresh token');
+            }
+            return {
+                token: state.source.token,
+                // No `exp`? Treat as opaque non-expiring; cache for 1h to avoid
+                // re-using the same string forever in case the issuer rotates.
+                expiresAt: exp !== null ? exp * 1000 : Date.now() + 60 * 60 * 1000,
+            };
+        }
+        case 'callback': {
+            const token = await state.source.getToken();
+            const exp = (0, issuer_1.getExpiry)(token);
+            return {
+                token,
+                expiresAt: exp !== null ? exp * 1000 : Date.now() + 5 * 60 * 1000,
+            };
+        }
+        case 'service-credentials': {
+            const body = new URLSearchParams({ grant_type: 'client_credentials' });
+            if (state.source.scope)
+                body.set('scope', state.source.scope);
+            const basic = base64(`${state.source.clientId}:${state.source.clientSecret}`);
+            const res = await state.fetchFn(`${state.source.authBaseUrl}/oauth/token`, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/x-www-form-urlencoded',
+                    authorization: `Basic ${basic}`,
+                },
+                body: body.toString(),
+            });
+            if (!res.ok) {
+                const text = await res.text();
+                throw new errors_1.ConfigError(`client_credentials mint failed: HTTP ${res.status} ${text}`);
+            }
+            const json = (await res.json());
+            if (!json.access_token) {
+                throw new errors_1.ConfigError('auth server response missing access_token');
+            }
+            const ttl = (json.expires_in ?? 0) * 1000;
+            return {
+                token: json.access_token,
+                expiresAt: ttl > 0 ? Date.now() + ttl : Date.now() + 5 * 60 * 1000,
+            };
+        }
+    }
+}
+function base64(s) {
+    // Works in Node and browser (Buffer is polyfilled via @types/node and
+    // most bundlers; btoa is a fallback for envs without Buffer).
+    if (typeof Buffer !== 'undefined')
+        return Buffer.from(s, 'utf8').toString('base64');
+    // eslint-disable-next-line no-undef
+    return btoa(s);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4tc291cmNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3Rva2VuLXNvdXJjZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQTJDQSxvREFTQztBQU9ELHdDQXNCQztBQU1ELDBDQUVDO0FBekZELHFDQUEwRDtBQUMxRCwwQ0FBMEM7QUF3QzFDLE1BQU0sd0JBQXdCLEdBQUcsSUFBSSxDQUFDO0FBRXRDLFNBQWdCLG9CQUFvQixDQUNsQyxNQUFtQixFQUNuQixVQUErRCxFQUFFO0lBRWpFLE9BQU87UUFDTCxNQUFNO1FBQ04sY0FBYyxFQUFFLE9BQU8sQ0FBQyxjQUFjLElBQUksd0JBQXdCO1FBQ2xFLE9BQU8sRUFBRSxPQUFPLENBQUMsT0FBTyxJQUFLLFVBQVUsQ0FBQyxLQUFzQjtLQUMvRCxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7O0dBSUc7QUFDSSxLQUFLLFVBQVUsY0FBYyxDQUFDLEtBQXVCO0lBQzFELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUN2QixJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxTQUFTLEdBQUcsR0FBRyxHQUFHLEtBQUssQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUN4RSxPQUFPLEtBQUssQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO0lBQzVCLENBQUM7SUFDRCxJQUFJLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNuQixNQUFNLEtBQUssR0FBRyxNQUFNLEtBQUssQ0FBQyxRQUFRLENBQUM7UUFDbkMsT0FBTyxLQUFLLENBQUMsS0FBSyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUU7UUFDN0MsS0FBSyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7UUFDbkIsS0FBSyxDQUFDLFFBQVEsR0FBRyxTQUFTLENBQUM7UUFDM0IsT0FBTyxHQUFHLENBQUM7SUFDYixDQUFDLENBQUMsQ0FBQztJQUNILEtBQUssQ0FBQyxRQUFRLEdBQUcsUUFBUSxDQUFDO0lBQzFCLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLE1BQU0sUUFBUSxDQUFDO1FBQzdCLE9BQU8sS0FBSyxDQUFDLEtBQUssQ0FBQztJQUNyQixDQUFDO0lBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztRQUNiLEtBQUssQ0FBQyxRQUFRLEdBQUcsU0FBUyxDQUFDO1FBQzNCLE1BQU0sR0FBRyxDQUFDO0lBQ1osQ0FBQztBQUNILENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFnQixlQUFlLENBQUMsS0FBdUI7SUFDckQsS0FBSyxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUM7QUFDM0IsQ0FBQztBQUVELEtBQUssVUFBVSxTQUFTLENBQUMsS0FBdUI7SUFDOUMsUUFBUSxLQUFLLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQzFCLEtBQUssZUFBZSxDQUFDLENBQUMsQ0FBQztZQUNyQixNQUFNLEdBQUcsR0FBRyxJQUFBLGtCQUFTLEVBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMxQyxJQUFJLEdBQUcsS0FBSyxJQUFJLElBQUksR0FBRyxHQUFHLElBQUksR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBSyxDQUFDLGNBQWMsRUFBRSxDQUFDO2dCQUNuRSxNQUFNLElBQUksMEJBQWlCLENBQ3pCLHFGQUFxRixDQUN0RixDQUFDO1lBQ0osQ0FBQztZQUNELE9BQU87Z0JBQ0wsS0FBSyxFQUFFLEtBQUssQ0FBQyxNQUFNLENBQUMsS0FBSztnQkFDekIsZ0VBQWdFO2dCQUNoRSwrREFBK0Q7Z0JBQy9ELFNBQVMsRUFBRSxHQUFHLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJO2FBQ25FLENBQUM7UUFDSixDQUFDO1FBQ0QsS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDO1lBQ2hCLE1BQU0sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUM1QyxNQUFNLEdBQUcsR0FBRyxJQUFBLGtCQUFTLEVBQUMsS0FBSyxDQUFDLENBQUM7WUFDN0IsT0FBTztnQkFDTCxLQUFLO2dCQUNMLFNBQVMsRUFBRSxHQUFHLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJO2FBQ2xFLENBQUM7UUFDSixDQUFDO1FBQ0QsS0FBSyxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7WUFDM0IsTUFBTSxJQUFJLEdBQUcsSUFBSSxlQUFlLENBQUMsRUFBRSxVQUFVLEVBQUUsb0JBQW9CLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZFLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLO2dCQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDOUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDO1lBQzlFLE1BQU0sR0FBRyxHQUFHLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUMsV0FBVyxjQUFjLEVBQUU7Z0JBQ3pFLE1BQU0sRUFBRSxNQUFNO2dCQUNkLE9BQU8sRUFBRTtvQkFDUCxjQUFjLEVBQUUsbUNBQW1DO29CQUNuRCxhQUFhLEVBQUUsU0FBUyxLQUFLLEVBQUU7aUJBQ2hDO2dCQUNELElBQUksRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFO2FBQ3RCLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUM7Z0JBQ1osTUFBTSxJQUFJLEdBQUcsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQzlCLE1BQU0sSUFBSSxvQkFBVyxDQUFDLHdDQUF3QyxHQUFHLENBQUMsTUFBTSxJQUFJLElBQUksRUFBRSxDQUFDLENBQUM7WUFDdEYsQ0FBQztZQUNELE1BQU0sSUFBSSxHQUFHLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQW1ELENBQUM7WUFDbEYsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztnQkFDdkIsTUFBTSxJQUFJLG9CQUFXLENBQUMsMkNBQTJDLENBQUMsQ0FBQztZQUNyRSxDQUFDO1lBQ0QsTUFBTSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQztZQUMxQyxPQUFPO2dCQUNMLEtBQUssRUFBRSxJQUFJLENBQUMsWUFBWTtnQkFDeEIsU0FBUyxFQUFFLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUk7YUFDbkUsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsTUFBTSxDQUFDLENBQVM7SUFDdkIsc0VBQXNFO0lBQ3RFLDhEQUE4RDtJQUM5RCxJQUFJLE9BQU8sTUFBTSxLQUFLLFdBQVc7UUFBRSxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNwRixvQ0FBb0M7SUFDcEMsT0FBTyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDakIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbmZpZ0Vycm9yLCBUb2tlbkV4cGlyZWRFcnJvciB9IGZyb20gJy4vZXJyb3JzJztcbmltcG9ydCB7IGdldEV4cGlyeSB9IGZyb20gJy4vYXV0aC9pc3N1ZXInO1xuXG4vKipcbiAqIEhvdyB0aGUgU0RLIGdldHMgYSBmcmVzaCBhY2Nlc3MgdG9rZW4uIFRocmVlIHNoYXBlcyBwZXIgdGhlIGJyaWVmOlxuICpcbiAqICAgLSBgc3RhdGljLXN0cmluZ2Ag4oCUIGNhbGxlciBoYW5kcyBpbiBhIHRva2VuIHN0cmluZy4gVXNlZCB1bnRpbCBpdHNcbiAqICAgICBgZXhwYCBoYXMgcGFzc2VkOyBvbiBleHBpcnkgd2UgdGhyb3cgYFRva2VuRXhwaXJlZEVycm9yYCByYXRoZXJcbiAqICAgICB0aGFuIHRyeSB0byByZWZyZXNoICh0aGUgU0RLIGhhcyBubyB3YXkgdG8gcmVmcmVzaCBhIHN0YXRpY1xuICogICAgIGV4dGVybmFsbHktc3VwcGxpZWQgdG9rZW4pLlxuICpcbiAqICAgLSBgY2FsbGJhY2tgIOKAlCBjYWxsZXIgc3VwcGxpZXMgYSBmdW5jdGlvbiB0aGUgU0RLIGNhbGxzIG9uIG1pc3NcbiAqICAgICBhbmQgb24gNDAxIGludmFsaWRhdGlvbi4gVGhlIGNvbnN1bWVyJ3MgbG9naWMgaXMgcmVzcG9uc2libGUgZm9yXG4gKiAgICAgcmVmcmVzaDsgdGhlIFNESyBqdXN0IGNhY2hlcyB0aGUgcmVzdWx0IGJldHdlZW4gaW52b2NhdGlvbnMuXG4gKlxuICogICAtIGBzZXJ2aWNlLWNyZWRlbnRpYWxzYCDigJQgYGNsaWVudF9pZGAgKyBgY2xpZW50X3NlY3JldGAgZm9yIHRoZVxuICogICAgIE9BdXRoMiBgY2xpZW50X2NyZWRlbnRpYWxzYCBncmFudC4gU0RLIG1pbnRzICsgY2FjaGVzOyBvblxuICogICAgIGV4cGlyeSBpdCByZS1taW50cyB3aXRoIHRoZSBzYW1lIGNyZWRlbnRpYWxzLlxuICovXG5leHBvcnQgdHlwZSBUb2tlblNvdXJjZSA9XG4gIHwgeyBraW5kOiAnc3RhdGljLXN0cmluZyc7IHRva2VuOiBzdHJpbmcgfVxuICB8IHsga2luZDogJ2NhbGxiYWNrJzsgZ2V0VG9rZW46ICgpID0+IHN0cmluZyB8IFByb21pc2U8c3RyaW5nPiB9XG4gIHwge1xuICAgICAga2luZDogJ3NlcnZpY2UtY3JlZGVudGlhbHMnO1xuICAgICAgY2xpZW50SWQ6IHN0cmluZztcbiAgICAgIGNsaWVudFNlY3JldDogc3RyaW5nO1xuICAgICAgYXV0aEJhc2VVcmw6IHN0cmluZztcbiAgICAgIHNjb3BlPzogc3RyaW5nO1xuICAgIH07XG5cbmV4cG9ydCBpbnRlcmZhY2UgVG9rZW5Tb3VyY2VTdGF0ZSB7XG4gIHNvdXJjZTogVG9rZW5Tb3VyY2U7XG4gIGNhY2hlZD86IHsgdG9rZW46IHN0cmluZzsgZXhwaXJlc0F0OiBudW1iZXIgfTtcbiAgLyoqIFJlZnJlc2ggZGVkdXA6IGNvbmN1cnJlbnQgcmVxdWVzdHMgc2hhcmUgdGhlIHNhbWUgZmV0Y2guICovXG4gIGluZmxpZ2h0PzogUHJvbWlzZTx7IHRva2VuOiBzdHJpbmc7IGV4cGlyZXNBdDogbnVtYmVyIH0+O1xuICAvKiogQnVmZmVyIChtcykgYmVmb3JlIGBleHBgIGF0IHdoaWNoIHdlIHRyZWF0IGEgdG9rZW4gYXMgZXhwaXJlZC4gKi9cbiAgZXhwaXJ5QnVmZmVyTXM6IG51bWJlcjtcbiAgLyoqIFVzZWQgb25seSBieSB0aGUgc2VydmljZS1jcmVkZW50aWFscyBwYXRoLiAqL1xuICBmZXRjaEZuOiB0eXBlb2YgZmV0Y2g7XG59XG5cbmNvbnN0IERFRkFVTFRfRVhQSVJZX0JVRkZFUl9NUyA9IDUwMDA7XG5cbmV4cG9ydCBmdW5jdGlvbiBtYWtlVG9rZW5Tb3VyY2VTdGF0ZShcbiAgc291cmNlOiBUb2tlblNvdXJjZSxcbiAgb3B0aW9uczogeyBleHBpcnlCdWZmZXJNcz86IG51bWJlcjsgZmV0Y2hGbj86IHR5cGVvZiBmZXRjaCB9ID0ge30sXG4pOiBUb2tlblNvdXJjZVN0YXRlIHtcbiAgcmV0dXJuIHtcbiAgICBzb3VyY2UsXG4gICAgZXhwaXJ5QnVmZmVyTXM6IG9wdGlvbnMuZXhwaXJ5QnVmZmVyTXMgPz8gREVGQVVMVF9FWFBJUllfQlVGRkVSX01TLFxuICAgIGZldGNoRm46IG9wdGlvbnMuZmV0Y2hGbiA/PyAoZ2xvYmFsVGhpcy5mZXRjaCBhcyB0eXBlb2YgZmV0Y2gpLFxuICB9O1xufVxuXG4vKipcbiAqIFJldHVybiBhIGZyZXNoIGFjY2VzcyB0b2tlbiwgdXNpbmcgdGhlIGNhY2hlIHdoZW4gd2FybS4gQ29uY3VycmVudFxuICogY2FsbGVycyBkdXJpbmcgYSByZWZyZXNoIHNoYXJlIHRoZSBpbi1mbGlnaHQgUHJvbWlzZSBzbyB3ZSBkb24ndFxuICogc3RhbXBlZGUgdGhlIGF1dGggc2VydmVyLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZ2V0QWNjZXNzVG9rZW4oc3RhdGU6IFRva2VuU291cmNlU3RhdGUpOiBQcm9taXNlPHN0cmluZz4ge1xuICBjb25zdCBub3cgPSBEYXRlLm5vdygpO1xuICBpZiAoc3RhdGUuY2FjaGVkICYmIHN0YXRlLmNhY2hlZC5leHBpcmVzQXQgPiBub3cgKyBzdGF0ZS5leHBpcnlCdWZmZXJNcykge1xuICAgIHJldHVybiBzdGF0ZS5jYWNoZWQudG9rZW47XG4gIH1cbiAgaWYgKHN0YXRlLmluZmxpZ2h0KSB7XG4gICAgY29uc3QgZnJlc2ggPSBhd2FpdCBzdGF0ZS5pbmZsaWdodDtcbiAgICByZXR1cm4gZnJlc2gudG9rZW47XG4gIH1cbiAgY29uc3QgaW5mbGlnaHQgPSBtaW50VG9rZW4oc3RhdGUpLnRoZW4oKHJlcykgPT4ge1xuICAgIHN0YXRlLmNhY2hlZCA9IHJlcztcbiAgICBzdGF0ZS5pbmZsaWdodCA9IHVuZGVmaW5lZDtcbiAgICByZXR1cm4gcmVzO1xuICB9KTtcbiAgc3RhdGUuaW5mbGlnaHQgPSBpbmZsaWdodDtcbiAgdHJ5IHtcbiAgICBjb25zdCBmcmVzaCA9IGF3YWl0IGluZmxpZ2h0O1xuICAgIHJldHVybiBmcmVzaC50b2tlbjtcbiAgfSBjYXRjaCAoZXJyKSB7XG4gICAgc3RhdGUuaW5mbGlnaHQgPSB1bmRlZmluZWQ7XG4gICAgdGhyb3cgZXJyO1xuICB9XG59XG5cbi8qKlxuICogRHJvcCB0aGUgY2FjaGVkIHRva2VuLiBUaGUgbmV4dCBgZ2V0QWNjZXNzVG9rZW5gIHdpbGwgbWludCBvclxuICogcmUtZmV0Y2guIENhbGxlZCBieSB0aGUgcmVxdWVzdCBsYXllciBvbiA0MDEuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpbnZhbGlkYXRlVG9rZW4oc3RhdGU6IFRva2VuU291cmNlU3RhdGUpOiB2b2lkIHtcbiAgc3RhdGUuY2FjaGVkID0gdW5kZWZpbmVkO1xufVxuXG5hc3luYyBmdW5jdGlvbiBtaW50VG9rZW4oc3RhdGU6IFRva2VuU291cmNlU3RhdGUpOiBQcm9taXNlPHsgdG9rZW46IHN0cmluZzsgZXhwaXJlc0F0OiBudW1iZXIgfT4ge1xuICBzd2l0Y2ggKHN0YXRlLnNvdXJjZS5raW5kKSB7XG4gICAgY2FzZSAnc3RhdGljLXN0cmluZyc6IHtcbiAgICAgIGNvbnN0IGV4cCA9IGdldEV4cGlyeShzdGF0ZS5zb3VyY2UudG9rZW4pO1xuICAgICAgaWYgKGV4cCAhPT0gbnVsbCAmJiBleHAgKiAxMDAwIDwgRGF0ZS5ub3coKSArIHN0YXRlLmV4cGlyeUJ1ZmZlck1zKSB7XG4gICAgICAgIHRocm93IG5ldyBUb2tlbkV4cGlyZWRFcnJvcihcbiAgICAgICAgICAnc3RhdGljIGFjY2VzcyB0b2tlbiBoYXMgZXhwaXJlZDsgY29uc3VtZXIgbXVzdCB1cGRhdGUgdGhlIGNvbmZpZyB3aXRoIGEgZnJlc2ggdG9rZW4nLFxuICAgICAgICApO1xuICAgICAgfVxuICAgICAgcmV0dXJuIHtcbiAgICAgICAgdG9rZW46IHN0YXRlLnNvdXJjZS50b2tlbixcbiAgICAgICAgLy8gTm8gYGV4cGA/IFRyZWF0IGFzIG9wYXF1ZSBub24tZXhwaXJpbmc7IGNhY2hlIGZvciAxaCB0byBhdm9pZFxuICAgICAgICAvLyByZS11c2luZyB0aGUgc2FtZSBzdHJpbmcgZm9yZXZlciBpbiBjYXNlIHRoZSBpc3N1ZXIgcm90YXRlcy5cbiAgICAgICAgZXhwaXJlc0F0OiBleHAgIT09IG51bGwgPyBleHAgKiAxMDAwIDogRGF0ZS5ub3coKSArIDYwICogNjAgKiAxMDAwLFxuICAgICAgfTtcbiAgICB9XG4gICAgY2FzZSAnY2FsbGJhY2snOiB7XG4gICAgICBjb25zdCB0b2tlbiA9IGF3YWl0IHN0YXRlLnNvdXJjZS5nZXRUb2tlbigpO1xuICAgICAgY29uc3QgZXhwID0gZ2V0RXhwaXJ5KHRva2VuKTtcbiAgICAgIHJldHVybiB7XG4gICAgICAgIHRva2VuLFxuICAgICAgICBleHBpcmVzQXQ6IGV4cCAhPT0gbnVsbCA/IGV4cCAqIDEwMDAgOiBEYXRlLm5vdygpICsgNSAqIDYwICogMTAwMCxcbiAgICAgIH07XG4gICAgfVxuICAgIGNhc2UgJ3NlcnZpY2UtY3JlZGVudGlhbHMnOiB7XG4gICAgICBjb25zdCBib2R5ID0gbmV3IFVSTFNlYXJjaFBhcmFtcyh7IGdyYW50X3R5cGU6ICdjbGllbnRfY3JlZGVudGlhbHMnIH0pO1xuICAgICAgaWYgKHN0YXRlLnNvdXJjZS5zY29wZSkgYm9keS5zZXQoJ3Njb3BlJywgc3RhdGUuc291cmNlLnNjb3BlKTtcbiAgICAgIGNvbnN0IGJhc2ljID0gYmFzZTY0KGAke3N0YXRlLnNvdXJjZS5jbGllbnRJZH06JHtzdGF0ZS5zb3VyY2UuY2xpZW50U2VjcmV0fWApO1xuICAgICAgY29uc3QgcmVzID0gYXdhaXQgc3RhdGUuZmV0Y2hGbihgJHtzdGF0ZS5zb3VyY2UuYXV0aEJhc2VVcmx9L29hdXRoL3Rva2VuYCwge1xuICAgICAgICBtZXRob2Q6ICdQT1NUJyxcbiAgICAgICAgaGVhZGVyczoge1xuICAgICAgICAgICdjb250ZW50LXR5cGUnOiAnYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkJyxcbiAgICAgICAgICBhdXRob3JpemF0aW9uOiBgQmFzaWMgJHtiYXNpY31gLFxuICAgICAgICB9LFxuICAgICAgICBib2R5OiBib2R5LnRvU3RyaW5nKCksXG4gICAgICB9KTtcbiAgICAgIGlmICghcmVzLm9rKSB7XG4gICAgICAgIGNvbnN0IHRleHQgPSBhd2FpdCByZXMudGV4dCgpO1xuICAgICAgICB0aHJvdyBuZXcgQ29uZmlnRXJyb3IoYGNsaWVudF9jcmVkZW50aWFscyBtaW50IGZhaWxlZDogSFRUUCAke3Jlcy5zdGF0dXN9ICR7dGV4dH1gKTtcbiAgICAgIH1cbiAgICAgIGNvbnN0IGpzb24gPSAoYXdhaXQgcmVzLmpzb24oKSkgYXMgeyBhY2Nlc3NfdG9rZW4/OiBzdHJpbmc7IGV4cGlyZXNfaW4/OiBudW1iZXIgfTtcbiAgICAgIGlmICghanNvbi5hY2Nlc3NfdG9rZW4pIHtcbiAgICAgICAgdGhyb3cgbmV3IENvbmZpZ0Vycm9yKCdhdXRoIHNlcnZlciByZXNwb25zZSBtaXNzaW5nIGFjY2Vzc190b2tlbicpO1xuICAgICAgfVxuICAgICAgY29uc3QgdHRsID0gKGpzb24uZXhwaXJlc19pbiA/PyAwKSAqIDEwMDA7XG4gICAgICByZXR1cm4ge1xuICAgICAgICB0b2tlbjoganNvbi5hY2Nlc3NfdG9rZW4sXG4gICAgICAgIGV4cGlyZXNBdDogdHRsID4gMCA/IERhdGUubm93KCkgKyB0dGwgOiBEYXRlLm5vdygpICsgNSAqIDYwICogMTAwMCxcbiAgICAgIH07XG4gICAgfVxuICB9XG59XG5cbmZ1bmN0aW9uIGJhc2U2NChzOiBzdHJpbmcpOiBzdHJpbmcge1xuICAvLyBXb3JrcyBpbiBOb2RlIGFuZCBicm93c2VyIChCdWZmZXIgaXMgcG9seWZpbGxlZCB2aWEgQHR5cGVzL25vZGUgYW5kXG4gIC8vIG1vc3QgYnVuZGxlcnM7IGJ0b2EgaXMgYSBmYWxsYmFjayBmb3IgZW52cyB3aXRob3V0IEJ1ZmZlcikuXG4gIGlmICh0eXBlb2YgQnVmZmVyICE9PSAndW5kZWZpbmVkJykgcmV0dXJuIEJ1ZmZlci5mcm9tKHMsICd1dGY4JykudG9TdHJpbmcoJ2Jhc2U2NCcpO1xuICAvLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgbm8tdW5kZWZcbiAgcmV0dXJuIGJ0b2Eocyk7XG59XG4iXX0=

package/dist/version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Manually-maintained version string surfaced via the `User-Agent`
+ * header. Kept in sync with `package.json` by hand because pulling the
+ * value from package.json at runtime would require either a JSON import
+ * (TS lib settings dependent) or a build-time replacement, and the
+ * cost of one bump-in-two-places per release is small.
+ */
+export declare const SDK_VERSION = "0.7.0";

package/dist/version.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SDK_VERSION = void 0;
+/**
+ * Manually-maintained version string surfaced via the `User-Agent`
+ * header. Kept in sync with `package.json` by hand because pulling the
+ * value from package.json at runtime would require either a JSON import
+ * (TS lib settings dependent) or a build-time replacement, and the
+ * cost of one bump-in-two-places per release is small.
+ */
+exports.SDK_VERSION = '0.7.0';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy92ZXJzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7Ozs7R0FNRztBQUNVLFFBQUEsV0FBVyxHQUFHLE9BQU8sQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogTWFudWFsbHktbWFpbnRhaW5lZCB2ZXJzaW9uIHN0cmluZyBzdXJmYWNlZCB2aWEgdGhlIGBVc2VyLUFnZW50YFxuICogaGVhZGVyLiBLZXB0IGluIHN5bmMgd2l0aCBgcGFja2FnZS5qc29uYCBieSBoYW5kIGJlY2F1c2UgcHVsbGluZyB0aGVcbiAqIHZhbHVlIGZyb20gcGFja2FnZS5qc29uIGF0IHJ1bnRpbWUgd291bGQgcmVxdWlyZSBlaXRoZXIgYSBKU09OIGltcG9ydFxuICogKFRTIGxpYiBzZXR0aW5ncyBkZXBlbmRlbnQpIG9yIGEgYnVpbGQtdGltZSByZXBsYWNlbWVudCwgYW5kIHRoZVxuICogY29zdCBvZiBvbmUgYnVtcC1pbi10d28tcGxhY2VzIHBlciByZWxlYXNlIGlzIHNtYWxsLlxuICovXG5leHBvcnQgY29uc3QgU0RLX1ZFUlNJT04gPSAnMC43LjAnO1xuIl19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uengage.io/platform-sdk",
-  "version": "0.3.0",
+  "version": "0.7.0",
   "description": "Client SDK for the uEngage platform API (audit, business, ...). Namespaced singletons with HMAC or Bearer auth.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -21,6 +21,7 @@
     "hmac"
   ],
   "dependencies": {
+    "jose": "^5.9.6",
     "ulid": "^2.3.0",
     "zod": "^3.23.8",
     "@uengage.io/js-logger": "0.10.0"

package/dist/audit/sign.d.ts

@@ -1,24 +0,0 @@
-export interface SignRequestParams {
-    method: string;
-    path: string;
-    serviceId: string;
-    timestamp: string;
-    nonce: string;
-    /** Raw JSON body string, or empty string for no body. */
-    body: string;
-    secret: string;
-}
-/**
- * HMAC-SHA256 signature over a canonical request representation. Producer
- * (this SDK) and verifier (`serviceAuthMiddleware` in `@uengage/common`) must
- * compute the same canonical string, so any change here MUST be mirrored
- * there. The canonical form is newline-separated, with no trailing newline:
- *
- *   <METHOD>
- *   <PATH>
- *   <X-Service-Id>
- *   <X-Timestamp>
- *   <X-Nonce>
- *   <sha256-hex of body, or empty string for no body>
- */
-export declare function signRequest(params: SignRequestParams): string;