vesant-sdk 1.7.0-dev.5305eb7 → 1.7.0-dev.6f300f7

package/dist/{client-C3DCmGe9.d.ts → client-749WqhDT.d.ts}

@@ -1,6 +1,6 @@
-import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-DoMSYMMR.js';
+import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-D9JZgN3X.js';
 import { RiskProfileClient } from './risk-profile/index.js';
-import { V as VesantConfig, R as RequestOptions } from './client-BolQlL5e.js';
+import { V as VesantConfig, R as RequestOptions } from './client-q9fN8Hhf.js';
 import { C as CustomerProfile } from './types-UGyDl1fd.js';
 import { E as EntityType, B as BlockReason, P as PaginationParams } from './types-CBQRNL-l.js';
 

package/dist/{client-DMIRx7Tu.d.mts → client-BG8KtVMc.d.mts}

@@ -1,4 +1,4 @@
-import { L as Logger, B as BaseClient, R as RequestOptions } from './client-BolQlL5e.mjs';
+import { L as Logger, B as BaseClient, R as RequestOptions } from './client-q9fN8Hhf.mjs';
 import { B as BlockReason, P as PaginationParams } from './types-CBQRNL-l.mjs';
 
 interface DeviceFingerprintRequest {
@@ -212,6 +212,19 @@ interface ValidateCipherTextResponse {
     geofence_evaluation?: GeofenceEvaluation;
     record_id?: string;
     gps_required?: boolean;
+    /**
+     * IP-derived location the GPS coordinates were cross-validated against.
+     * `location` carries the GPS-derived city when GPS was provided, so this is
+     * what explains a gps_ip_location_mismatch risk factor.
+     */
+    ip_location?: {
+        country?: string;
+        country_iso?: string;
+        city?: string;
+        region?: string;
+        latitude: number;
+        longitude: number;
+    };
 }
 interface VerifyIPRequest {
     ip_address: string;

package/dist/{client-ZNdnpWe7.d.mts → client-CRZea-eJ.d.mts}

@@ -1,6 +1,6 @@
-import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-DMIRx7Tu.mjs';
+import { D as DeviceFingerprintRequest, L as LocationVerification, V as ValidateCipherTextResponse, a as LocationRequest, G as GeolocationClient, b as LocationRequestFilters, c as LocationRequestListResponse } from './client-BG8KtVMc.mjs';
 import { RiskProfileClient } from './risk-profile/index.mjs';
-import { V as VesantConfig, R as RequestOptions } from './client-BolQlL5e.mjs';
+import { V as VesantConfig, R as RequestOptions } from './client-q9fN8Hhf.mjs';
 import { C as CustomerProfile } from './types-BOFaMQxI.mjs';
 import { E as EntityType, B as BlockReason, P as PaginationParams } from './types-CBQRNL-l.mjs';
 

package/dist/{client-DoMSYMMR.d.ts → client-D9JZgN3X.d.ts}

@@ -1,4 +1,4 @@
-import { L as Logger, B as BaseClient, R as RequestOptions } from './client-BolQlL5e.js';
+import { L as Logger, B as BaseClient, R as RequestOptions } from './client-q9fN8Hhf.js';
 import { B as BlockReason, P as PaginationParams } from './types-CBQRNL-l.js';
 
 interface DeviceFingerprintRequest {
@@ -212,6 +212,19 @@ interface ValidateCipherTextResponse {
     geofence_evaluation?: GeofenceEvaluation;
     record_id?: string;
     gps_required?: boolean;
+    /**
+     * IP-derived location the GPS coordinates were cross-validated against.
+     * `location` carries the GPS-derived city when GPS was provided, so this is
+     * what explains a gps_ip_location_mismatch risk factor.
+     */
+    ip_location?: {
+        country?: string;
+        country_iso?: string;
+        city?: string;
+        region?: string;
+        latitude: number;
+        longitude: number;
+    };
 }
 interface VerifyIPRequest {
     ip_address: string;

package/dist/{client-BolQlL5e.d.mts → client-q9fN8Hhf.d.mts}

@@ -50,6 +50,80 @@ declare class CircuitBreaker {
     reset(): void;
 }
 
+/**
+ * Pluggable authentication for BaseClient.
+ *
+ * A TokenProvider supplies the credential used for the Authorization header on
+ * every request, resolved per-request (async) so callers can source short-lived
+ * or rotating credentials (OAuth2 client-credentials, STS, Vault / Secrets
+ * Manager) instead of a single static API key. The default StaticApiKeyProvider
+ * preserves the original `apiKey` behavior with zero change for existing callers.
+ */
+interface AuthCredential {
+    /** Authorization scheme (e.g. 'Bearer'); defaults to 'Bearer' when omitted. */
+    scheme?: string;
+    /** The credential value (bearer token / API key). */
+    token: string;
+}
+interface TokenProviderContext {
+    tenantId: string;
+    requestId: string;
+    /** When true, bypass any cache and obtain a fresh credential (e.g. after a 401). */
+    forceRefresh?: boolean;
+}
+interface TokenProvider {
+    /** Resolve the credential for a request, or null to send no Authorization header. */
+    getCredential(ctx: TokenProviderContext): Promise<AuthCredential | null>;
+    /** Whether this provider can obtain a fresh credential on demand (drives 401 retry). */
+    canRefresh?(): boolean;
+}
+/**
+ * Default provider: wraps a static API key. Returns null when the key is empty
+ * so the client sends no Authorization header, matching the pre-provider behavior.
+ */
+declare class StaticApiKeyProvider implements TokenProvider {
+    private readonly apiKey;
+    constructor(apiKey: string);
+    getCredential(): Promise<AuthCredential | null>;
+    canRefresh(): boolean;
+}
+interface CachedToken {
+    token: string;
+    expiresAt?: number;
+}
+interface RefreshingTokenProviderOptions {
+    /** Fetches a fresh token. `expiresAt` is epoch milliseconds (optional). */
+    fetchToken: () => Promise<CachedToken>;
+    /** Refresh this many ms before expiry (default: 30_000). */
+    skewMs?: number;
+    /** Authorization scheme to emit (default: 'Bearer'). */
+    scheme?: string;
+    /** Observe each successful (re)fetch — for logging / metrics. */
+    onRotate?: (meta: {
+        expiresAt?: number;
+    }) => void;
+    /** Injectable clock (default: Date.now). */
+    now?: () => number;
+}
+/**
+ * Caches a fetched token and refreshes it when it is within the skew window of
+ * expiry or when `forceRefresh` is requested. Concurrent refreshes are de-duped
+ * into a single in-flight fetch.
+ */
+declare class RefreshingTokenProvider implements TokenProvider {
+    private readonly opts;
+    private cached;
+    private inFlight;
+    private readonly skewMs;
+    private readonly scheme;
+    private readonly now;
+    constructor(opts: RefreshingTokenProviderOptions);
+    canRefresh(): boolean;
+    getCredential(ctx?: TokenProviderContext): Promise<AuthCredential | null>;
+    private isExpiring;
+    private refresh;
+}
+
 /**
  * Configuration types for Vesant SDK clients
  */
@@ -82,6 +156,16 @@ interface BaseClientConfig {
     tenantId: string;
     /** Optional API key for authentication */
     apiKey?: string;
+    /**
+     * Pluggable auth token provider. When set, it supplies the Authorization
+     * credential per-request (overriding `apiKey`), enabling OAuth2 / STS / rotating
+     * secrets and single-shot 401 re-auth. Defaults to a static-apiKey provider.
+     */
+    authProvider?: TokenProvider;
+    /** Observe credential rotation triggered by a 401 re-auth (logging / metrics). */
+    onCredentialRotated?: (meta: {
+        reason: string;
+    }) => void;
     /** Custom headers to include in all requests */
     headers?: Record<string, string>;
     /** Request timeout in milliseconds (default: 10000) */
@@ -108,6 +192,16 @@ interface VesantConfig {
     tenantId: string;
     /** Optional API key for authentication */
     apiKey?: string;
+    /**
+     * Pluggable auth token provider. When set, it supplies the Authorization
+     * credential per-request (overriding `apiKey`), enabling OAuth2 / STS / rotating
+     * secrets and single-shot 401 re-auth. Defaults to a static-apiKey provider.
+     */
+    authProvider?: TokenProvider;
+    /** Observe credential rotation triggered by a 401 re-auth (logging / metrics). */
+    onCredentialRotated?: (meta: {
+        reason: string;
+    }) => void;
     /** Custom headers to include in all requests */
     headers?: Record<string, string>;
     /** Request timeout in milliseconds (default: 10000) */
@@ -195,7 +289,15 @@ declare abstract class BaseClient {
     private interceptors;
     private circuitBreaker;
     private rateLimitTracker;
+    private authProvider;
     constructor(config: BaseClientConfig);
+    /**
+     * Resolve the Idempotency-Key for a request. Mutating methods (POST/PUT/PATCH)
+     * get the caller-supplied key or a freshly minted UUID; non-mutating methods get
+     * none. requestWithRetry resolves this once and injects it so every retry reuses
+     * one key (letting the server dedup replays); a direct request() resolves per call.
+     */
+    private resolveIdempotencyKey;
     /**
      * Make an HTTP request with timeout and error handling
      */
@@ -237,4 +339,4 @@ declare abstract class BaseClient {
     }>;
 }
 
-export { BaseClient as B, type CGSConfig as C, type Logger as L, type RequestOptions as R, type VesantConfig as V, type BaseClientConfig as a, CircuitBreaker as b, type CircuitBreakerConfig as c, type CircuitBreakerState as d, type CircuitBreakerStatus as e, type RateLimitStatus as f, RateLimitTracker as g, type RequestInterceptor as h, type RequiredBaseClientConfig as i, type RequiredCGSConfig as j, type RequiredVesantConfig as k };
+export { type AuthCredential as A, BaseClient as B, type CGSConfig as C, type Logger as L, type RequestOptions as R, StaticApiKeyProvider as S, type TokenProvider as T, type VesantConfig as V, type BaseClientConfig as a, CircuitBreaker as b, type CircuitBreakerConfig as c, type CircuitBreakerState as d, type CircuitBreakerStatus as e, type RateLimitStatus as f, RateLimitTracker as g, RefreshingTokenProvider as h, type RefreshingTokenProviderOptions as i, type RequestInterceptor as j, type RequiredBaseClientConfig as k, type RequiredCGSConfig as l, type RequiredVesantConfig as m, type TokenProviderContext as n };

package/dist/{client-BolQlL5e.d.ts → client-q9fN8Hhf.d.ts}

@@ -50,6 +50,80 @@ declare class CircuitBreaker {
     reset(): void;
 }
 
+/**
+ * Pluggable authentication for BaseClient.
+ *
+ * A TokenProvider supplies the credential used for the Authorization header on
+ * every request, resolved per-request (async) so callers can source short-lived
+ * or rotating credentials (OAuth2 client-credentials, STS, Vault / Secrets
+ * Manager) instead of a single static API key. The default StaticApiKeyProvider
+ * preserves the original `apiKey` behavior with zero change for existing callers.
+ */
+interface AuthCredential {
+    /** Authorization scheme (e.g. 'Bearer'); defaults to 'Bearer' when omitted. */
+    scheme?: string;
+    /** The credential value (bearer token / API key). */
+    token: string;
+}
+interface TokenProviderContext {
+    tenantId: string;
+    requestId: string;
+    /** When true, bypass any cache and obtain a fresh credential (e.g. after a 401). */
+    forceRefresh?: boolean;
+}
+interface TokenProvider {
+    /** Resolve the credential for a request, or null to send no Authorization header. */
+    getCredential(ctx: TokenProviderContext): Promise<AuthCredential | null>;
+    /** Whether this provider can obtain a fresh credential on demand (drives 401 retry). */
+    canRefresh?(): boolean;
+}
+/**
+ * Default provider: wraps a static API key. Returns null when the key is empty
+ * so the client sends no Authorization header, matching the pre-provider behavior.
+ */
+declare class StaticApiKeyProvider implements TokenProvider {
+    private readonly apiKey;
+    constructor(apiKey: string);
+    getCredential(): Promise<AuthCredential | null>;
+    canRefresh(): boolean;
+}
+interface CachedToken {
+    token: string;
+    expiresAt?: number;
+}
+interface RefreshingTokenProviderOptions {
+    /** Fetches a fresh token. `expiresAt` is epoch milliseconds (optional). */
+    fetchToken: () => Promise<CachedToken>;
+    /** Refresh this many ms before expiry (default: 30_000). */
+    skewMs?: number;
+    /** Authorization scheme to emit (default: 'Bearer'). */
+    scheme?: string;
+    /** Observe each successful (re)fetch — for logging / metrics. */
+    onRotate?: (meta: {
+        expiresAt?: number;
+    }) => void;
+    /** Injectable clock (default: Date.now). */
+    now?: () => number;
+}
+/**
+ * Caches a fetched token and refreshes it when it is within the skew window of
+ * expiry or when `forceRefresh` is requested. Concurrent refreshes are de-duped
+ * into a single in-flight fetch.
+ */
+declare class RefreshingTokenProvider implements TokenProvider {
+    private readonly opts;
+    private cached;
+    private inFlight;
+    private readonly skewMs;
+    private readonly scheme;
+    private readonly now;
+    constructor(opts: RefreshingTokenProviderOptions);
+    canRefresh(): boolean;
+    getCredential(ctx?: TokenProviderContext): Promise<AuthCredential | null>;
+    private isExpiring;
+    private refresh;
+}
+
 /**
  * Configuration types for Vesant SDK clients
  */
@@ -82,6 +156,16 @@ interface BaseClientConfig {
     tenantId: string;
     /** Optional API key for authentication */
     apiKey?: string;
+    /**
+     * Pluggable auth token provider. When set, it supplies the Authorization
+     * credential per-request (overriding `apiKey`), enabling OAuth2 / STS / rotating
+     * secrets and single-shot 401 re-auth. Defaults to a static-apiKey provider.
+     */
+    authProvider?: TokenProvider;
+    /** Observe credential rotation triggered by a 401 re-auth (logging / metrics). */
+    onCredentialRotated?: (meta: {
+        reason: string;
+    }) => void;
     /** Custom headers to include in all requests */
     headers?: Record<string, string>;
     /** Request timeout in milliseconds (default: 10000) */
@@ -108,6 +192,16 @@ interface VesantConfig {
     tenantId: string;
     /** Optional API key for authentication */
     apiKey?: string;
+    /**
+     * Pluggable auth token provider. When set, it supplies the Authorization
+     * credential per-request (overriding `apiKey`), enabling OAuth2 / STS / rotating
+     * secrets and single-shot 401 re-auth. Defaults to a static-apiKey provider.
+     */
+    authProvider?: TokenProvider;
+    /** Observe credential rotation triggered by a 401 re-auth (logging / metrics). */
+    onCredentialRotated?: (meta: {
+        reason: string;
+    }) => void;
     /** Custom headers to include in all requests */
     headers?: Record<string, string>;
     /** Request timeout in milliseconds (default: 10000) */
@@ -195,7 +289,15 @@ declare abstract class BaseClient {
     private interceptors;
     private circuitBreaker;
     private rateLimitTracker;
+    private authProvider;
     constructor(config: BaseClientConfig);
+    /**
+     * Resolve the Idempotency-Key for a request. Mutating methods (POST/PUT/PATCH)
+     * get the caller-supplied key or a freshly minted UUID; non-mutating methods get
+     * none. requestWithRetry resolves this once and injects it so every retry reuses
+     * one key (letting the server dedup replays); a direct request() resolves per call.
+     */
+    private resolveIdempotencyKey;
     /**
      * Make an HTTP request with timeout and error handling
      */
@@ -237,4 +339,4 @@ declare abstract class BaseClient {
     }>;
 }
 
-export { BaseClient as B, type CGSConfig as C, type Logger as L, type RequestOptions as R, type VesantConfig as V, type BaseClientConfig as a, CircuitBreaker as b, type CircuitBreakerConfig as c, type CircuitBreakerState as d, type CircuitBreakerStatus as e, type RateLimitStatus as f, RateLimitTracker as g, type RequestInterceptor as h, type RequiredBaseClientConfig as i, type RequiredCGSConfig as j, type RequiredVesantConfig as k };
+export { type AuthCredential as A, BaseClient as B, type CGSConfig as C, type Logger as L, type RequestOptions as R, StaticApiKeyProvider as S, type TokenProvider as T, type VesantConfig as V, type BaseClientConfig as a, CircuitBreaker as b, type CircuitBreakerConfig as c, type CircuitBreakerState as d, type CircuitBreakerStatus as e, type RateLimitStatus as f, RateLimitTracker as g, RefreshingTokenProvider as h, type RefreshingTokenProviderOptions as i, type RequestInterceptor as j, type RequiredBaseClientConfig as k, type RequiredCGSConfig as l, type RequiredVesantConfig as m, type TokenProviderContext as n };

package/dist/compliance/index.d.mts

@@ -1,8 +1,8 @@
 import { B as BlockReason } from '../types-CBQRNL-l.mjs';
-export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from '../client-ZNdnpWe7.mjs';
-export { p as CreateLocationRequestRequest, H as LocationCaptureRequest, I as LocationCaptureResponse, a as LocationRequest, K as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, M as LocationRequestResult, N as LocationRequestStatus, O as LocationShareInfo, R as ResendLocationRequestRequest } from '../client-DMIRx7Tu.mjs';
+export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from '../client-CRZea-eJ.mjs';
+export { p as CreateLocationRequestRequest, H as LocationCaptureRequest, I as LocationCaptureResponse, a as LocationRequest, K as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, M as LocationRequestResult, N as LocationRequestStatus, O as LocationShareInfo, R as ResendLocationRequestRequest } from '../client-BG8KtVMc.mjs';
 import '../risk-profile/index.mjs';
-import '../client-BolQlL5e.mjs';
+import '../client-q9fN8Hhf.mjs';
 import '../types-BOFaMQxI.mjs';
 
 declare const sdkReasons: {

package/dist/compliance/index.d.ts

@@ -1,8 +1,8 @@
 import { B as BlockReason } from '../types-CBQRNL-l.js';
-export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from '../client-C3DCmGe9.js';
-export { p as CreateLocationRequestRequest, H as LocationCaptureRequest, I as LocationCaptureResponse, a as LocationRequest, K as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, M as LocationRequestResult, N as LocationRequestStatus, O as LocationShareInfo, R as ResendLocationRequestRequest } from '../client-DoMSYMMR.js';
+export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from '../client-749WqhDT.js';
+export { p as CreateLocationRequestRequest, H as LocationCaptureRequest, I as LocationCaptureResponse, a as LocationRequest, K as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, M as LocationRequestResult, N as LocationRequestStatus, O as LocationShareInfo, R as ResendLocationRequestRequest } from '../client-D9JZgN3X.js';
 import '../risk-profile/index.js';
-import '../client-BolQlL5e.js';
+import '../client-q9fN8Hhf.js';
 import '../types-UGyDl1fd.js';
 
 declare const sdkReasons: {

package/dist/compliance/index.js

@@ -75,6 +75,19 @@ var sdkReasons = {
   })
 };
 
+// src/core/auth.ts
+var StaticApiKeyProvider = class {
+  constructor(apiKey) {
+    this.apiKey = apiKey;
+  }
+  async getCredential() {
+    return this.apiKey ? { scheme: "Bearer", token: this.apiKey } : null;
+  }
+  canRefresh() {
+    return false;
+  }
+};
+
 // src/core/errors.ts
 var VesantError = class _VesantError extends Error {
   constructor(message, code, statusCode, details) {
@@ -404,6 +417,7 @@ var BaseClient = class {
       interceptors: this.interceptors,
       logger: this.logger
     };
+    this.authProvider = config.authProvider ?? (apiKey ? new StaticApiKeyProvider(apiKey) : void 0);
     if (config.circuitBreaker) {
       this.circuitBreaker = new CircuitBreaker(config.circuitBreaker);
     }
@@ -411,6 +425,19 @@ var BaseClient = class {
       this.rateLimitTracker = new RateLimitTracker();
     }
   }
+  /**
+   * Resolve the Idempotency-Key for a request. Mutating methods (POST/PUT/PATCH)
+   * get the caller-supplied key or a freshly minted UUID; non-mutating methods get
+   * none. requestWithRetry resolves this once and injects it so every retry reuses
+   * one key (letting the server dedup replays); a direct request() resolves per call.
+   */
+  resolveIdempotencyKey(method, requestOptions) {
+    const isMutating = ["POST", "PUT", "PATCH"].includes((method || "GET").toUpperCase());
+    if (!isMutating) {
+      return void 0;
+    }
+    return requestOptions?.idempotencyKey ?? generateUUID();
+  }
   /**
    * Make an HTTP request with timeout and error handling
    */
@@ -436,15 +463,20 @@ var BaseClient = class {
       ...this.config.headers,
       ...options.headers || {}
     };
-    if (this.config.apiKey) {
-      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
+    const credential = await this.authProvider?.getCredential({
+      tenantId: this.config.tenantId,
+      requestId
+    });
+    if (credential) {
+      headers["Authorization"] = `${credential.scheme ?? "Bearer"} ${credential.token}`;
     }
     if (this.config.environment === "sandbox") {
       headers["X-Sandbox"] = "true";
     }
     const method = (options.method || "GET").toUpperCase();
-    if (["POST", "PUT", "PATCH"].includes(method)) {
-      headers["Idempotency-Key"] = requestOptions?.idempotencyKey || generateUUID();
+    const idempotencyKey = this.resolveIdempotencyKey(method, requestOptions);
+    if (idempotencyKey) {
+      headers["Idempotency-Key"] = idempotencyKey;
     }
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
@@ -465,10 +497,28 @@ var BaseClient = class {
       if (this.config.debug) {
         this.logger.debug(`${finalOptions.method || "GET"} ${endpoint}`);
       }
-      const response = await fetch(url, {
+      let response = await fetch(url, {
         ...finalOptions,
         signal: controller.signal
       });
+      if (response.status === 401 && this.authProvider?.canRefresh?.()) {
+        const refreshed = await this.authProvider.getCredential({
+          tenantId: this.config.tenantId,
+          requestId,
+          forceRefresh: true
+        });
+        if (refreshed) {
+          this.config.onCredentialRotated?.({ reason: "unauthorized" });
+          finalOptions = {
+            ...finalOptions,
+            headers: {
+              ...finalOptions.headers,
+              Authorization: `${refreshed.scheme ?? "Bearer"} ${refreshed.token}`
+            }
+          };
+          response = await fetch(url, { ...finalOptions, signal: controller.signal });
+        }
+      }
       clearTimeout(timeoutId);
       if (this.rateLimitTracker) {
         this.rateLimitTracker.updateFromHeaders(response.headers);
@@ -557,9 +607,11 @@ var BaseClient = class {
    */
   async requestWithRetry(endpoint, options = {}, serviceURL, retries = this.config.retries, requestOptions) {
     let lastError;
+    const idempotencyKey = this.resolveIdempotencyKey(options.method || "GET", requestOptions);
+    const attemptOptions = idempotencyKey ? { ...requestOptions, idempotencyKey } : requestOptions;
     for (let attempt = 0; attempt <= retries; attempt++) {
       try {
-        return await this.request(endpoint, options, serviceURL, requestOptions);
+        return await this.request(endpoint, options, serviceURL, attemptOptions);
       } catch (error) {
         lastError = error instanceof Error ? error : new Error("Unknown error");
         if (requestOptions?.signal?.aborted) {
@@ -656,6 +708,9 @@ var BaseClient = class {
     if (config.interceptors) {
       this.interceptors = config.interceptors;
     }
+    if (config.authProvider !== void 0 || config.apiKey !== void 0) {
+      this.authProvider = this.config.authProvider ?? (this.config.apiKey ? new StaticApiKeyProvider(this.config.apiKey) : void 0);
+    }
   }
   /**
    * Get current configuration (readonly)
@@ -1714,9 +1769,6 @@ var ComplianceClient = class {
       if (cipherTextResult.risk?.is_blocked) {
         blockReasons.push(...cipherTextResult.risk.block_reasons_structured ?? []);
       }
-      if (cipherTextResult.risk?.location_mismatch) {
-        blockReasons.push(sdkReasons.gpsIPMismatch());
-      }
     }
     if (geoVerification.gps_required && !cipherTextResult) {
       blockReasons.push(sdkReasons.gpsRequired());