abb-rws-client 0.7.1 → 1.0.0

package/CHANGELOG.md

@@ -4,6 +4,175 @@ All notable changes to `abb-rws-client` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.0] — 2026-07-09
+
+The library is feature-complete for both controller generations and every wire
+recipe below has been verified against live controllers (RW 6.16 IRC5 +
+RW 7.21 OmniCore). Time to call it 1.0.
+
+### Added
+
+- **mDNS/Bonjour controller discovery** — `RobotManager.discoverControllersMdns()`
+  finds every ABB controller (real or virtual) announcing on the local network:
+  zero-dependency DNS-SD implementation, returns system name, host, RWS port,
+  RobotWare version, system GUID, and a protocol classification. No more port
+  scanning to find RobotStudio's randomly-assigned VC ports.
+- **HAL JSON parsing for RWS 2.0** — GETs negotiate
+  `application/hal+json;v=2.0` (officially supported; live-verified) with an
+  automatic, remembered per-controller fallback to XHTML for older RobotWare 7
+  releases. Byte-identical results across both representations verified live
+  over seven read families.
+- **Simulation panel (virtual controllers, RW7)** — `simEmergencyStop()`,
+  `simResetEmergencyStop()`, `simGeneralStop()`, `simAutoStop()`,
+  `simEnableSwitch(on)`, and `teleportMechunit(mechunit, joints)`. Drive the
+  E-stop/guard-stop chain and reposition the simulated robot from the API —
+  every recipe converged from live controller validation errors, including the
+  undocumented inverted `state=off`-engages polarity.
+- **`RWS1Adapter.saveModule` migrated off a dead endpoint** — the legacy
+  `?action=savemod` form returns a blanket 400 on RW6 regardless of body; the
+  method now uses the live-verified `?action=save` recipe (and percent-encodes
+  the destination path).
+
+### Changed
+
+- Published packages now include `src/` so the shipped source maps resolve;
+  the `exports` map lists `types` first for `nodenext` consumers.
+- 169 new unit tests (368 total): every previously-untested `ResourceMapper`
+  builder and `ResponseParser` parser, the RWS 1.0 digest/cookie/pacing
+  request path, the mDNS wire parser, HAL/XHTML parity, and the simulation
+  panel.
+
+## [0.8.0] — 2026-07-09
+
+### Fixed
+
+- **RWS 2.0 real-time subscriptions actually work now.** The WebSocket handshake
+  offered `robapi2_subscription` — the RWS **1.0** subprotocol name — and
+  RobotWare 7 rejects it with HTTP 400, so every OmniCore connection silently
+  fell back to polling since the feature shipped. The client now offers the
+  official `rws_subscription` (RWS 2.0 manual 3HAC073675-001). Live-verified on
+  RW 7.21: handshake 101, real event frames delivered.
+- **RWS 2.0 WebSocket drops no longer kill live updates for the session** — the
+  25 s ping interval is cleared on close, the client re-registers the
+  subscription with bounded exponential backoff, and when it finally gives up
+  it tells the owner (see `onLost` below) so `RobotManager` can restore fast
+  polling instead of idling at the slow cadence forever.
+- **`getModuleSource` works for modules with no backing file** (loaded from
+  `.pgf`, RobotStudio, or the FlexPendant — [abb-rws-vscode#3](https://github.com/ichbinmeraj/abb-rws-vscode/issues/3)):
+  both protocols now fall back to saving the module to the controller's TEMP
+  volume, reading it, and deleting it. On RWS 1.0 the save round-trip is the
+  primary path so a stale `$HOME` copy can never shadow program memory.
+  Wire recipes live-verified on RW 6.16 + RW 7.21 (no mastership needed).
+- **CFG writes were broken on both protocols**: `setCfgInstance` POSTed a
+  non-existent RWS 2.0 path (missing `/instances/`) and sent plain values where
+  RobotWare 7 requires the bracket representation (`Attr=[value,1]`);
+  `createCfgInstance` used an endpoint that does not exist (`…/{i}/create`) —
+  the real flow is `instances/create-default` + set. RWS 1.0 had no CFG write
+  support at all; the adapter now implements set/create/remove with the
+  plain-value forms. Full create → set → readback → delete cycles live-verified
+  on both controllers.
+- **`probeProtocol` no longer misdetects arbitrary web servers as RWS 2.0** —
+  classification now requires a Digest (RWS 1.0) or Basic (RWS 2.0) challenge;
+  Bearer challenges and plain 200 responses are rejected.
+- **`createAdapter` gained the Default-User fallback** `createClient` already
+  had — and the fallback predicate now keys on the typed `AUTH_FAILED` error
+  code (the old message regex never matched RWS 1.0 login failures).
+- **`connect()`/`disconnect()` races**: disconnecting during an in-flight
+  connect no longer resurrects timers or subscriptions; a second `connect()`
+  with different host/credentials supersedes the in-flight attempt instead of
+  being silently coalesced; a poll that loses the race with `disconnect()` can
+  no longer write stale task state back into a cleared manager.
+- **`writeSignal` with unknown network/device** now throws a descriptive
+  `RwsError` instead of firing a malformed `/signals///…` request.
+- **Fileservice paths are percent-encoded per segment on both protocols** —
+  file names containing space, `#`, or `%` no longer break (or truncate at the
+  `#`) list/read/upload/delete/copy operations. `$HOME`/`$TEMP` prefixes stay
+  literal.
+- **`RWS1Adapter.listMechunits` returns the controller's real mechunit list**
+  instead of a hardcoded `['ROB_1']`.
+- **Session-cookie store writes are atomic** (temp file + rename), so
+  concurrent connects can't drop each other's entries.
+- **Digest `qop=auth-int`** is now rejected with a clear error instead of
+  silently hashing as `auth` and failing authentication downstream.
+- **Class-name minification safety**: protocol detection for config
+  persistence uses `instanceof`, not `constructor.name`.
+
+### Added
+
+- **`RobotManagerOptions`** — `new RobotManager({ refreshIntervalMs, strictTls })`
+  and `MultiRobotManager.fromConfigs(configs, options)`:
+  - `refreshIntervalMs` (default 1000, min 200) controls the polling cadence;
+    the subscription-active slow poll scales at 5×.
+  - `strictTls` (default false) turns real TLS certificate verification on for
+    controllers with proper certificates. Off by default because controllers
+    ship self-signed certs.
+- **`RwsClient2` constructor options** `{ timeout, rejectUnauthorized }` — the
+  per-request timeout is finally configurable (was hardcoded 10 s), and callers
+  can opt into certificate verification.
+- **`onLost` subscription callback** on the adapter `subscribe` surface —
+  invoked once when the event stream is terminally lost so callers can degrade
+  gracefully.
+- **CI workflow** (Node 18/20/22 matrix: build, tests, lint) and `SECURITY.md`.
+
+## [0.7.3] — 2026-07-03
+
+### Fixed
+
+- **TLS bypass now applied per-request, not only on the HTTP agent** — fixes
+  connections to real controllers from inside VS Code
+  ([abb-rws-vscode#2](https://github.com/ichbinmeraj/abb-rws-vscode/issues/2)).
+  VS Code's extension host patches Node's `http`/`https` modules and replaces
+  custom agents for non-localhost targets, which silently dropped the
+  agent-level `rejectUnauthorized: false` and re-enabled certificate
+  verification — every real OmniCore (self-signed cert) then failed with
+  `self signed certificate`. Localhost VCs were never affected because the
+  extension host doesn't intercept localhost traffic. The setting is now also
+  set on each request's options in `RwsClient2.req()`, the subscription POST,
+  `RobotManager` port probing, and `detect.probeProtocol()`.
+- **Examples 05 & 06 rewritten against the real API** — they previously used an
+  options-object `RwsClient2` constructor and `RobotManager` methods that never
+  existed. Both now use `new RobotManager()` + `connect(host, user, pass, port?)`.
+- **`repository`/`homepage`** now point at the actual GitHub org (`ichbinmeraj`);
+  the previous links 404'd from the npm package page.
+- Stale `types.ts` header no longer claims the package is RWS 1.0-only.
+
+### Added
+
+- **`prepack` guard** — `npm pack`/`npm publish` now runs the build and the full
+  116-test suite first, so a stale or broken artifact cannot be packed.
+
+## [0.7.2] — 2026-05-08
+
+### Documentation
+
+- **Fixed the embarrassing compatibility table** that incorrectly claimed
+  RobotWare 7.x / OmniCore was "Not compatible". The package has supported
+  both protocols since v0.7.0 — the table was a stale leftover from when
+  only RWS 1.0 shipped. Now correctly shows both ✅, with live-tested
+  versions called out (RW7.21 + RW6.16).
+- **Documented `RobotManager` higher-level surface** — the README's
+  API-reference tables only covered the protocol-level `RwsClient`, so
+  callers couldn't see what `RobotManager` adds on top: RMMP, mastership
+  status, opmode auto-routing, backup, FK, service-routine call,
+  tool/wobj activation, CFG write surface, DIPC messaging, file volumes,
+  module source, compress, value validation. New section lists all of
+  these with descriptions.
+- **Clarified RWS 2.0 subscription quirks** — the polling-fallback
+  paragraph now names the specific RWS 2.0 VC `robapi2_subscription`
+  rejection that triggers the fallback, rather than implying it's
+  always 5s polling.
+- **Session-pool clarifications** — IRC5's 70-session number was being
+  presented as universal; called out OmniCore's also-finite-but-different
+  pool with the empirical 503-once-full behaviour we observed during
+  protocol probes.
+- **`RobotManager` polling cadence** correctly described as hybrid:
+  5 s when WS subscriptions handle state changes, 1 s when polling
+  covers everything.
+
+No code changes — pure README updates. `RwsClient`, `RwsClient2`,
+`RobotManager`, `MultiRobotManager`, `createClient`, all examples and
+unit tests are bit-for-bit identical to v0.7.1.
+
 ## [0.7.1] — 2026-05-07
 
 ### Added

package/README.md

@@ -25,7 +25,7 @@ Prefer a GUI? The companion VS Code extension gives you live status, motion data
 - **Connection lifecycle** — `RobotManager` handles port discovery, polling, WebSocket subscriptions with polling fallback, reconnect-on-failure
 - **Typed adapter pattern** — `IRWSAdapter` lets you write code that works across both protocols
 - **WebSocket subscriptions** for real-time events (panel state, RAPID exec, signals, persvar, elog, jointtarget, …)
-- Session cookie management (avoids the controller's 70-session pool fill)
+- Session cookie management (IRC5: avoids the controller's 70-session pool fill; OmniCore: avoids 503 lockout from session-pool exhaustion)
 - Automatic `/logout` on disconnect to release server-side mastership and free the session slot
 - Request rate limiting (< 20 req/sec)
 - Fully typed public API — every method throws `RwsError` with a typed `code`
@@ -159,7 +159,9 @@ console.log('joints:', await client.getJointPositions());
 // (`/rw/rapid/symbol/{symburl}/data`); the method shape is the same.
 const tool0 = await client.getRapidVariable('T_ROB1', 'BASE', 'tool0');
 
-// WebSocket subscriptions over `robapi2_subscription` subprotocol.
+// WebSocket subscriptions over the `rws_subscription` subprotocol
+// (RWS 1.0 uses `robapi2_subscription` — the names are NOT interchangeable:
+// RobotWare 7 rejects the 1.0 name with HTTP 400).
 const unsubscribe = await client.subscribe(
   ['controllerstate', 'execution'],
   (event) => console.log(event.resource, '=', event.value),
@@ -180,8 +182,10 @@ These are documented because they bite anyone who tries to write an RWS 2.0 clie
 - **File service home** is `'HOME'`, not `'$HOME'`.
 - **Symbol API path is suffix-style** — `/rw/rapid/symbol/{symburl}/data` (RWS 1.0 puts `/data` at the front).
 - **Module unload** is `POST /rw/rapid/tasks/{task}/unloadmod` with body, NOT `DELETE` on the module URL (returns 405).
-- **Self-signed TLS** on virtual controllers — library uses `rejectUnauthorized: false` for HTTPS.
-- **WebSocket subscription URL** comes from the `Location` header (real hardware) or the XHTML body (VC). Subprotocol: `robapi2_subscription`.
+- **Self-signed TLS** everywhere — controllers ship self-signed certs, so certificate
+  verification is off by default. Pass `strictTls: true` (`RobotManagerOptions`) or
+  `rejectUnauthorized: true` (`RwsClient2` options) if your plant installed real certs.
+- **WebSocket subscription URL** comes from the `Location` header (real hardware) or the XHTML body (VC). Subprotocol: `rws_subscription` (RWS 2.0) / `robapi2_subscription` (RWS 1.0).
 
 ---
 
@@ -195,7 +199,10 @@ import { MultiRobotManager } from 'abb-rws-client';
 const multi = MultiRobotManager.fromConfigs([
   { id: 'cell-A', name: 'Cell A IRB120',  host: '192.168.125.1', port: 80,   useHttps: false, username: 'Admin', password: 'robotics' },
   { id: 'cell-B', name: 'Cell B IRB1200', host: '192.168.125.2', port: 443,  useHttps: true,  username: 'Admin', password: 'robotics' },
-]);
+], {
+  refreshIntervalMs: 1000, // polling cadence (min 200); slow poll scales at 5×
+  strictTls: false,        // true = verify controller TLS certificates
+});
 
 multi.onError((msg, actions) => {
   console.error(`Robot error: ${msg}`);
@@ -214,17 +221,42 @@ multi.setActive('cell-B');
 ```
 
 `MultiRobotManager` wraps individual `RobotManager` instances. Each `RobotManager` handles its own:
-- Auto port discovery (probes 5466/9403/443/80/11811, plus a wide-scan fallback)
-- Protocol auto-detection (Digest vs Basic challenge)
-- 5-second polling for non-subscription state
-- WebSocket subscriptions with automatic polling fallback
-- Reconnect-on-failure (3-strike)
-- Clean `/logout` on disconnect (avoids orphan mastership locks)
+- Auto port discovery (probes 5466 / 9403 / 443 / 80 / 11811 in that order, plus a wide-scan fallback when none of those answer — RobotStudio assigns random VC ports above 30000)
+- Protocol auto-detection (`WWW-Authenticate: Digest` → RWS 1.0; `Basic` → RWS 2.0)
+- Hybrid polling cadence: **5× the refresh interval when WebSocket subscriptions are active** (positions only — state-change resources stream over WS); **the plain refresh interval when subscriptions are unavailable** (full state coverage via polling). Default 1 s / 5 s, configurable via `refreshIntervalMs`.
+- WebSocket subscriptions on both protocols, with dropped-socket auto-reconnect and automatic degradation to fast polling if the event stream is terminally lost
+- Reconnect-on-failure (3-strike, surfaces via `onError` listener)
+- Clean `GET /logout` on disconnect — releases server-side mastership and frees the session slot
 
 You can also create a `RobotManager` directly if you only have one robot.
 
 ---
 
+## `RobotManager` — higher-level surface
+
+`RobotManager` wraps either client with operational helpers that handle mastership, polling, and protocol differences for you. In addition to delegating every protocol method to the underlying client, it exposes:
+
+- **`getRmmpPrivilege()`**, **`requestRmmp(level)`** — Remote Mastership Privilege management. Required on OmniCore in AUTO mode for any modify op.
+- **`getMastershipStatus(domain?)`** — read who currently holds rapid/cfg/motion mastership (uid + application name).
+- **`setOperationMode('AUTO' | 'MANR' | 'MANF')`** — VC-only switch with auto-routing through MANR for AUTO ↔ MANF (the controller rejects direct transitions). Acquires `edit` mastership for the higher-privilege direction.
+- **`setSpeedRatio(0..100)`** — wraps `edit` mastership; uses the live-verified `?action=setspeedratio&speed-ratio=N` form on RWS 2.0 (the bare endpoint returns 400).
+- **`createBackup(name)`**, **`restoreBackup(name)`**, **`getBackupStatus()`**, **`listBackups()`** — `/ctrl/backup/...`
+- **`callServiceRoutine(task, name, args?)`** — invoke a service routine remotely (calibration, brake check, etc.).
+- **`calcJointsFromCartesian(...)`** — inverse kinematics. **`calcCartesianFromJoints(...)`** — forward kinematics.
+- **`setActiveTool(mechunit, name)`**, **`setActiveWobj(mechunit, name)`** — switch active persistent tooldata / wobjdata.
+- **CFG write** — `setCfgInstance` / `createCfgInstance` / `removeCfgInstance` / `loadCfgFile` / `saveCfgFile`, on **both** protocols (RWS 2.0 uses `instances/create-default` + the bracket value representation; RWS 1.0 uses the `?action=` forms — handled by the adapters). Each acquires the needed mastership for the duration.
+- **DIPC** — `listDipcQueues` / `createDipcQueue` / `sendDipcMessage` / `readDipcMessage` / `removeDipcQueue`. Bidirectional messaging between RAPID and external clients.
+- **`listFileVolumes()`** — every controller volume (HOME, BACKUP, DATA, ADDINDATA, PRODUCTS, RAMDISK, TEMP).
+- **`getModuleSource(task, name)`** — pull a module's RAPID text in one call. Works even when the module has no backing file in `HOME` (loaded from `.pgf`/RobotStudio/pendant): the client saves it to the controller's TEMP volume, reads it, and deletes it.
+- **`compressPath(source, dest)`** — controller-side compression.
+- **`validateRapidValue(task, value, datatype)`** — pre-flight a literal before writing.
+- **`RobotManager.discoverControllersMdns(opts?)`** *(static)* — find every ABB controller (real or virtual) announcing on the local network via mDNS/Bonjour. Returns system name, host, RWS port, RobotWare version, system GUID, and a `'rws1' | 'rws2'` classification — no port scanning needed.
+- **Simulation panel** *(RWS 2.0 virtual controllers only)* — `simEmergencyStop()`, `simResetEmergencyStop()`, `simGeneralStop(engage?)`, `simAutoStop(engage?)`, `simEnableSwitch(on)`, `teleportMechunit(mechunit, joints, extJoints?)`. Drive the E-stop / guard-stop chain and reposition the simulated robot from the API. Throw `RwsError` on real hardware and RW6 (VC-only endpoints).
+
+Every method returns `Promise<...>` and throws `RwsError` on failure.
+
+---
+
 ## Logging
 
 The lib ships a no-op logger by default. Hosts (CLIs, services, the VS Code extension) install their own:
@@ -460,7 +492,7 @@ try {
 
 ## Session Persistence
 
-The IRC5 controller allows a maximum of **70 concurrent RWS sessions**. Persist the session cookie across restarts to always reuse the same slot:
+IRC5 controllers allow a maximum of **70 concurrent RWS sessions**; OmniCore controllers also have a finite session pool (the exact number isn't published, but heavy probing without `/logout` returns HTTP 503 once it fills). Persist the session cookie across restarts to always reuse the same slot — the lib calls `/logout` on `disconnect()` to free the slot cleanly, but a saved cookie is the most robust path:
 
 ```ts
 import fs from 'fs';
@@ -481,14 +513,16 @@ await client.connect(); // reuses the existing session slot
 
 ## Rate Limits
 
-| Constraint | Value |
-|------------|-------|
-| Max request rate | 20 req/sec |
-| Client enforced interval | 55 ms between requests |
-| Max concurrent sessions | 70 |
-| Session inactivity timeout | 5 minutes |
-| Max session lifetime | 25 minutes |
-| Max file upload | 800 MB |
+| Constraint | Value | Source |
+|------------|-------|--------|
+| Max request rate | 20 req/sec | Both protocols (controller-enforced) |
+| Client-enforced interval | 55 ms between requests | This package, default |
+| Max concurrent sessions | 70 (IRC5) / finite (OmniCore) | Controller-enforced |
+| Session inactivity timeout | 5 minutes (IRC5) | Controller-enforced |
+| Max session lifetime | 25 minutes (IRC5) | Controller-enforced |
+| Max file upload | 800 MB (IRC5) | Controller-enforced; OmniCore is similar |
+
+OmniCore-specific limits aren't fully documented by ABB; what the lib observes empirically matches the IRC5 numbers within an order of magnitude.
 
 ---
 
@@ -496,10 +530,13 @@ await client.connect(); // reuses the existing session slot
 
 | | RobotWare 6.x (RWS 1.0) | RobotWare 7.x (RWS 2.0) |
 |--|--|--|
-| This package | ✅ Supported | ❌ Not compatible |
-| IRC5 controller | ✅ | n/a |
-| OmniCore controller | n/a | ❌ |
-| RobotStudio virtual | ✅ (127.0.0.1) | ❌ |
+| This package | ✅ `RwsClient` | ✅ `RwsClient2` |
+| IRC5 controller (real) | ✅ | n/a |
+| OmniCore controller (real) | n/a | ✅ |
+| RobotStudio virtual controller | ✅ (RW6.x VC) | ✅ (RW7.x VC) |
+| Auto-detect from one entry point | ✅ via `createClient()` | ✅ via `createClient()` |
+
+**Live-tested matrix** as of v0.7.1: RobotWare 7.21 (OmniCore VC, RWS 2.0), RobotWare 6.16 (IRC5 VC, RWS 1.0). 116 unit tests + 339 live protocol-coverage tests pass against both.
 
 ---
 

package/dist/HalJsonParser.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Parser for RWS 2.0 HAL JSON responses (`application/hal+json;v=2.0`) — the
+ * officially supported primary GET representation on OmniCore controllers.
+ *
+ * Live-verified 2026-07-09 on OmniCore VC RW7.21 across every GET endpoint
+ * family the client touches (panel, rapid, motionsystem, system, ctrl, elog,
+ * iosystem, cfg, mastership, users/rmmp). The wire shape is:
+ *
+ *   { "_links":    { "base": {...}, "self": {...} [, "next": {...}] },
+ *     "status":    { "code": 294912 },                  // negative on errors, plus "msg"
+ *     "state":     [ { "_type": "...", "_title": "...", ...fields } ],
+ *     "_embedded": { "resources": [ { "_type": "...", ...fields } ] } }
+ *
+ * `_type` carries the same identifier the XHTML representation puts in the
+ * `<li class="...">` attribute, `_title` mirrors the `title` attribute, and
+ * the former `<span class="X">` fields become plain JSON keys. Resources can
+ * nest (e.g. `sys-options-li` holds an `options` array of typed objects,
+ * `cfg-dt-instance-li` an `attrib` array of `cfg-ia-t` entries), so lookups
+ * recurse — mirroring how the XHTML parser finds `<li>` anywhere in the
+ * document. Presents the same read interface as `XhtmlParser` so `RwsClient2`
+ * can treat both representations alike.
+ */
+export declare class HalJsonParser {
+    private readonly root;
+    constructor(body: string);
+    /** Cheap sniff used to pick a parser: HAL bodies are single JSON objects. */
+    static looksLikeJson(body: string): boolean;
+    /** Returns the field map of the first resource whose `_type` matches. */
+    getState(type: string): Record<string, string>;
+    /** Returns field maps for every resource with a matching `_type`, in document order. */
+    getAllStates(type: string): Array<Record<string, string>>;
+    /** First scalar value stored under `key` in any resource (XhtmlParser.get analogue). */
+    get(key: string): string | undefined;
+    /**
+     * Error details from the top-level status block. Success responses carry a
+     * positive code (294912 observed live); errors a negative code plus `msg`.
+     */
+    getError(): {
+        code: string;
+        msg: string;
+    } | null;
+    /**
+     * Pagination link (`_links.next.href`), raw as sent. Live-verified quirk:
+     * the controller XML-escapes ampersands even inside JSON strings
+     * (`"signals?start=3&amp;limit=3"`) — callers must unescape, exactly as on
+     * the XHTML `rel="next"` path.
+     */
+    nextHref(): string | undefined;
+    private rootObject;
+    /** Depth-first visit of every object in the tree, skipping `_links` blocks. */
+    private walk;
+    /** Scalar fields → strings; `_title` kept; self link exposed as `_href` (XHTML parity). */
+    private static flatten;
+}
+//# sourceMappingURL=HalJsonParser.d.ts.map

package/dist/HalJsonParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HalJsonParser.d.ts","sourceRoot":"","sources":["../src/HalJsonParser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;gBAE3B,IAAI,EAAE,MAAM;IAMxB,6EAA6E;IAC7E,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI3C,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAI9C,wFAAwF;IACxF,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQzD,wFAAwF;IACxF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAYpC;;;OAGG;IACH,QAAQ,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAShD;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,GAAG,SAAS;IAS9B,OAAO,CAAC,UAAU;IAMlB,+EAA+E;IAC/E,OAAO,CAAC,IAAI;IAcZ,2FAA2F;IAC3F,OAAO,CAAC,MAAM,CAAC,OAAO;CAmBvB"}

package/dist/HalJsonParser.js

@@ -0,0 +1,155 @@
+/**
+ * Parser for RWS 2.0 HAL JSON responses (`application/hal+json;v=2.0`) — the
+ * officially supported primary GET representation on OmniCore controllers.
+ *
+ * Live-verified 2026-07-09 on OmniCore VC RW7.21 across every GET endpoint
+ * family the client touches (panel, rapid, motionsystem, system, ctrl, elog,
+ * iosystem, cfg, mastership, users/rmmp). The wire shape is:
+ *
+ *   { "_links":    { "base": {...}, "self": {...} [, "next": {...}] },
+ *     "status":    { "code": 294912 },                  // negative on errors, plus "msg"
+ *     "state":     [ { "_type": "...", "_title": "...", ...fields } ],
+ *     "_embedded": { "resources": [ { "_type": "...", ...fields } ] } }
+ *
+ * `_type` carries the same identifier the XHTML representation puts in the
+ * `<li class="...">` attribute, `_title` mirrors the `title` attribute, and
+ * the former `<span class="X">` fields become plain JSON keys. Resources can
+ * nest (e.g. `sys-options-li` holds an `options` array of typed objects,
+ * `cfg-dt-instance-li` an `attrib` array of `cfg-ia-t` entries), so lookups
+ * recurse — mirroring how the XHTML parser finds `<li>` anywhere in the
+ * document. Presents the same read interface as `XhtmlParser` so `RwsClient2`
+ * can treat both representations alike.
+ */
+export class HalJsonParser {
+    root;
+    constructor(body) {
+        let parsed = null;
+        try {
+            parsed = JSON.parse(body);
+        }
+        catch {
+            parsed = null;
+        }
+        this.root = parsed;
+    }
+    /** Cheap sniff used to pick a parser: HAL bodies are single JSON objects. */
+    static looksLikeJson(body) {
+        return body.trimStart().startsWith('{');
+    }
+    /** Returns the field map of the first resource whose `_type` matches. */
+    getState(type) {
+        return this.getAllStates(type)[0] ?? {};
+    }
+    /** Returns field maps for every resource with a matching `_type`, in document order. */
+    getAllStates(type) {
+        const results = [];
+        this.walk(this.root, obj => {
+            if (obj['_type'] === type) {
+                results.push(HalJsonParser.flatten(obj));
+            }
+        });
+        return results;
+    }
+    /** First scalar value stored under `key` in any resource (XhtmlParser.get analogue). */
+    get(key) {
+        let found;
+        this.walk(this.root, obj => {
+            if (found !== undefined) {
+                return;
+            }
+            const v = obj[key];
+            if (v !== undefined && v !== null && typeof v !== 'object' && !key.startsWith('_')) {
+                found = String(v);
+            }
+        });
+        return found;
+    }
+    /**
+     * Error details from the top-level status block. Success responses carry a
+     * positive code (294912 observed live); errors a negative code plus `msg`.
+     */
+    getError() {
+        const status = this.rootObject()?.['status'];
+        if (!status || typeof status !== 'object' || Array.isArray(status)) {
+            return null;
+        }
+        const code = status['code'];
+        if (typeof code !== 'number' || code >= 0) {
+            return null;
+        }
+        const msg = status['msg'];
+        return { code: String(code), msg: typeof msg === 'string' ? msg : '' };
+    }
+    /**
+     * Pagination link (`_links.next.href`), raw as sent. Live-verified quirk:
+     * the controller XML-escapes ampersands even inside JSON strings
+     * (`"signals?start=3&amp;limit=3"`) — callers must unescape, exactly as on
+     * the XHTML `rel="next"` path.
+     */
+    nextHref() {
+        const links = this.rootObject()?.['_links'];
+        if (!links || typeof links !== 'object' || Array.isArray(links)) {
+            return undefined;
+        }
+        const next = links['next'];
+        if (!next || typeof next !== 'object' || Array.isArray(next)) {
+            return undefined;
+        }
+        const href = next['href'];
+        return typeof href === 'string' && href ? href : undefined;
+    }
+    rootObject() {
+        return this.root && typeof this.root === 'object' && !Array.isArray(this.root)
+            ? this.root
+            : null;
+    }
+    /** Depth-first visit of every object in the tree, skipping `_links` blocks. */
+    walk(node, visit) {
+        if (Array.isArray(node)) {
+            for (const item of node) {
+                this.walk(item, visit);
+            }
+            return;
+        }
+        if (node && typeof node === 'object') {
+            visit(node);
+            for (const [key, value] of Object.entries(node)) {
+                if (key === '_links') {
+                    continue;
+                }
+                if (value && typeof value === 'object') {
+                    this.walk(value, visit);
+                }
+            }
+        }
+    }
+    /** Scalar fields → strings; `_title` kept; self link exposed as `_href` (XHTML parity). */
+    static flatten(obj) {
+        const fields = {};
+        const title = obj['_title'];
+        if (typeof title === 'string') {
+            fields['_title'] = title;
+        }
+        const links = obj['_links'];
+        if (links && typeof links === 'object' && !Array.isArray(links)) {
+            const self = links['self'];
+            if (self && typeof self === 'object' && !Array.isArray(self)) {
+                const href = self['href'];
+                if (typeof href === 'string') {
+                    fields['_href'] = href;
+                }
+            }
+        }
+        for (const [key, value] of Object.entries(obj)) {
+            if (key.startsWith('_')) {
+                continue;
+            }
+            if (value === null || typeof value === 'object') {
+                continue;
+            } // nested resources have their own _type
+            fields[key] = String(value);
+        }
+        return fields;
+    }
+}
+//# sourceMappingURL=HalJsonParser.js.map

package/dist/HalJsonParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HalJsonParser.js","sourceRoot":"","sources":["../src/HalJsonParser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,MAAM,OAAO,aAAa;IACP,IAAI,CAAkB;IAEvC,YAAY,IAAY;QACtB,IAAI,MAAM,GAAoB,IAAI,CAAC;QACnC,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;QACvE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;IACrB,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,aAAa,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,yEAAyE;IACzE,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,wFAAwF;IACxF,YAAY,CAAC,IAAY;QACvB,MAAM,OAAO,GAAkC,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;YACzB,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,wFAAwF;IACxF,GAAG,CAAC,GAAW;QACb,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;YACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACpC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnF,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACpF,MAAM,IAAI,GAAI,MAAqB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC3D,MAAM,GAAG,GAAI,MAAqB,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACH,QAAQ;QACN,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QACtF,MAAM,IAAI,GAAI,KAAoB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QACnF,MAAM,IAAI,GAAI,IAAmB,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5E,CAAC,CAAC,IAAI,CAAC,IAAkB;YACzB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,+EAA+E;IACvE,IAAI,CAAC,IAAqB,EAAE,KAAgC;QAClE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,KAAK,CAAC,IAAkB,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACnC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IAED,2FAA2F;IACnF,MAAM,CAAC,OAAO,CAAC,GAAe;QACpC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAI,KAAoB,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,GAAI,IAAmB,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;gBAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC,CAAC,wCAAwC;YACvG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/HttpSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HttpSession.d.ts","sourceRoot":"","sources":["../src/HttpSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAmB,YAAY,EAAE,MAAM,YAAY,CAAC;AAchE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,2DAA2D;IAC3D,OAAO,CAAC,OAAO,CAAkC;IAEjD,yDAAyD;IACzD,OAAO,CAAC,eAAe,CAAgC;IAEvD,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAK;IAEvB,gDAAgD;IAChD,OAAO,CAAC,eAAe,CAAK;IAE5B,iFAAiF;IACjF,OAAO,CAAC,gBAAgB,CAAK;IAE7B,0DAA0D;IAC1D,OAAO,CAAC,YAAY,CAAoC;IAExD,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;gBAE/C,OAAO,EAAE,kBAAkB;IAqBvC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIxC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIxD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IAInE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAI3C,yEAAyE;IACzE,eAAe,IAAI,MAAM;IAIzB,yFAAyF;IACzF,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAKjC;;;;;;;;OAQG;IACH,YAAY,IAAI,IAAI;IAMpB;;;;OAIG;IACH,OAAO,CAAC,OAAO;YAsBD,OAAO;IA4ErB,iFAAiF;YACnE,QAAQ;IAoDtB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA8B5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAwCvB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAyBpB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,aAAa;CAetB"}
+{"version":3,"file":"HttpSession.d.ts","sourceRoot":"","sources":["../src/HttpSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAmB,YAAY,EAAE,MAAM,YAAY,CAAC;AAchE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,2DAA2D;IAC3D,OAAO,CAAC,OAAO,CAAkC;IAEjD,yDAAyD;IACzD,OAAO,CAAC,eAAe,CAAgC;IAEvD,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAK;IAEvB,gDAAgD;IAChD,OAAO,CAAC,eAAe,CAAK;IAE5B,iFAAiF;IACjF,OAAO,CAAC,gBAAgB,CAAK;IAE7B,0DAA0D;IAC1D,OAAO,CAAC,YAAY,CAAoC;IAExD,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAiB;gBAE/C,OAAO,EAAE,kBAAkB;IAqBvC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIxC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIxD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IAInE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAI3C,yEAAyE;IACzE,eAAe,IAAI,MAAM;IAIzB,yFAAyF;IACzF,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAKjC;;;;;;;;OAQG;IACH,YAAY,IAAI,IAAI;IAMpB;;;;OAIG;IACH,OAAO,CAAC,OAAO;YAsBD,OAAO;IA4ErB,iFAAiF;YACnE,QAAQ;IAoDtB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA8B5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAwDvB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAyBpB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,aAAa;CAetB"}

package/dist/HttpSession.js

@@ -267,12 +267,23 @@ export class HttpSession {
      */
     buildAuthHeader(method, uri) {
         const challenge = this.digestChallenge;
+        // qop may be a comma-separated list, e.g. qop="auth,auth-int". Pick auth when
+        // offered; auth-int (body-hash mode) is not implemented, so an auth-int-only
+        // challenge must fail loudly rather than answer with a plain-auth hash.
+        let useQopAuth = false;
+        if (challenge.qop) {
+            const offered = challenge.qop.split(',').map((q) => q.trim());
+            if (!offered.includes('auth')) {
+                throw new RwsError(`Digest qop "${challenge.qop}" is not supported — only qop=auth`, 'AUTH_FAILED');
+            }
+            useQopAuth = true;
+        }
         const nc = (++this.nonceCount).toString(16).padStart(8, '0');
         const cnonce = randomBytes(16).toString('hex');
         const ha1 = md5(`${this.username}:${challenge.realm}:${this.password}`);
         const ha2 = md5(`${method}:${uri}`);
         let responseHash;
-        if (challenge.qop === 'auth' || challenge.qop === 'auth-int') {
+        if (useQopAuth) {
             // RFC 2617 qop mode
             responseHash = md5(`${ha1}:${challenge.nonce}:${nc}:${cnonce}:auth:${ha2}`);
         }
@@ -290,7 +301,7 @@ export class HttpSession {
             `cnonce="${cnonce}"`,
             `response="${responseHash}"`,
         ];
-        if (challenge.qop) {
+        if (useQopAuth) {
             parts.push(`qop=auth`);
         }
         if (challenge.opaque) {