@adatechnology/keycloak-admin 0.1.15 → 1.0.0-rc.0

package/README.md

@@ -0,0 +1,59 @@
+# @adatechnology/keycloak-admin
+
+Cliente do Keycloak Admin API autenticado como **service account** (`client_credentials`).
+Agnóstico de framework e de runtime: só depende de `fetch` e de `zod`.
+
+Diferença deliberada para o `@adatechnology/nestjs-keycloak-admin`: aquele obtém token com
+`grant_type=password` usando o usuário administrador do realm `master`. Este **nunca** envia senha
+nem usuário — a identidade é do client confidencial, com `manage-users` do `realm-management`.
+
+## Uso
+
+```ts
+import { createKeycloakAdminClient } from '@adatechnology/keycloak-admin'
+
+const keycloak = createKeycloakAdminClient({
+  config: {
+    baseUrl: process.env.KEYCLOAK_URL,
+    clientId: process.env.KEYCLOAK_ADMIN_CLIENT_ID,
+    clientSecret: process.env.KEYCLOAK_ADMIN_CLIENT_SECRET,
+    realm: process.env.KEYCLOAK_REALM,
+  },
+})
+
+const { id } = await keycloak.createUser({
+  attributes: { company_id: companyId },
+  email: 'admin@transportadora.example',
+  enabled: true,
+  firstName: 'Ada',
+  lastName: 'Lovelace',
+  password: { temporary: false, value: chosenPassword },
+  username: 'admin@transportadora.example',
+})
+```
+
+Operações: `createUser`, `findUserByEmail`, `updateUser`, `setEnabled`, `updateAttributes`,
+`deleteUser`, `setPassword`, `setTemporaryPassword`.
+
+## Token
+
+Obtido sob demanda, guardado em memória e renovado 30s antes de expirar
+(`KEYCLOAK_ADMIN_TOKEN_RENEWAL_SKEW_MS`). Chamadas concorrentes compartilham a mesma requisição em
+voo — o Keycloak recebe uma, não N.
+
+## Injeção
+
+`fetch` e `now` são injetáveis, o que torna rede e relógio observáveis em teste:
+
+```ts
+createKeycloakAdminClient({ config, fetch: stubFetch, now: clock.now })
+```
+
+## Erros
+
+Toda falha vira `KeycloakAdminError` com `code` estável (`KEYCLOAK_ADMIN_ERROR_CODE`), `status` e
+`context`. O contexto é montado por allowlist e passa por um redator que substitui `clientSecret`,
+access token e senha por `[REDACTED]` — nem a mensagem nem o erro serializado carregam segredo.
+
+Configuração inválida falha na construção do cliente, com o **caminho** do campo no contexto e nunca
+o valor.

package/dist/index.d.ts

@@ -1,91 +1,144 @@
-import { DynamicModule } from "@nestjs/common";
+import { z } from 'zod';
 
-export interface KeycloakAdminConfig {
-  baseUrl: string;
-  realm: string;
-  adminUser: string;
-  adminPassword: string;
-}
-
-export interface GetAdminTokenResult {
-  accessToken: string;
-  expiresIn: number;
-  tokenType: string;
-}
-
-export interface UpdateUserParams {
-  userId: string;
-  userData: Record<string, unknown>;
-  adminToken: string;
-}
+declare const KEYCLOAK_ADMIN_TOKEN_RENEWAL_SKEW_MS = 30000;
+declare const KEYCLOAK_ADMIN_ERROR_CODE: {
+    readonly CONFIGURATION_INVALID: "KEYCLOAK_ADMIN_CONFIGURATION_INVALID";
+    readonly REQUEST_FAILED: "KEYCLOAK_ADMIN_REQUEST_FAILED";
+    readonly TOKEN_REQUEST_FAILED: "KEYCLOAK_ADMIN_TOKEN_REQUEST_FAILED";
+    readonly TOKEN_RESPONSE_INVALID: "KEYCLOAK_ADMIN_TOKEN_RESPONSE_INVALID";
+    readonly USER_ALREADY_EXISTS: "KEYCLOAK_ADMIN_USER_ALREADY_EXISTS";
+    readonly USER_ID_MISSING: "KEYCLOAK_ADMIN_USER_ID_MISSING";
+    readonly USER_NOT_FOUND: "KEYCLOAK_ADMIN_USER_NOT_FOUND";
+};
+type KeycloakAdminErrorCode = (typeof KEYCLOAK_ADMIN_ERROR_CODE)[keyof typeof KEYCLOAK_ADMIN_ERROR_CODE];
+type BuildKeycloakAdminEndpointsParams = {
+    readonly baseUrl: string;
+    readonly realm: string;
+};
+declare function buildKeycloakAdminEndpoints({ baseUrl, realm }: BuildKeycloakAdminEndpointsParams): {
+    readonly token: `${string}/realms/${string}/protocol/openid-connect/token`;
+    readonly user: (userId: string) => string;
+    readonly userPassword: (userId: string) => string;
+    readonly users: string;
+};
+type KeycloakAdminEndpoints = ReturnType<typeof buildKeycloakAdminEndpoints>;
 
-export interface ResetPasswordParams {
-  userId: string;
-  password: string;
-  temporary: boolean;
-  adminToken: string;
+type KeycloakAdminErrorContext = Readonly<Record<string, unknown>>;
+type KeycloakAdminErrorParams = {
+    readonly code: KeycloakAdminErrorCode;
+    readonly context?: KeycloakAdminErrorContext;
+    readonly message: string;
+    readonly status?: number;
+};
+type SerializedKeycloakAdminError = {
+    readonly code: KeycloakAdminErrorCode;
+    readonly context: KeycloakAdminErrorContext;
+    readonly message: string;
+    readonly name: string;
+    readonly status: number | undefined;
+};
+/**
+ * Falha de qualquer operação do Admin API, com código estável para o consumidor decidir.
+ * O contexto é montado por allowlist e passa pelo redator — segredo, token e senha nunca entram.
+ */
+declare class KeycloakAdminError extends Error {
+    readonly code: KeycloakAdminErrorCode;
+    readonly context: KeycloakAdminErrorContext;
+    readonly status: number | undefined;
+    constructor({ code, context, message, status }: KeycloakAdminErrorParams);
+    toJSON(): SerializedKeycloakAdminError;
 }
+declare function isKeycloakAdminError(value: unknown): value is KeycloakAdminError;
 
-export interface ToggleUserEnabledParams {
-  userId: string;
-  enabled: boolean;
-  adminToken: string;
-}
-
-export interface DeleteUserParams {
-  userId: string;
-  adminToken: string;
-}
-
-export interface UpdateUserAttributesParams {
-  userId: string;
-  attributes: Record<string, string | string[]>;
-  adminToken: string;
-}
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+type KeycloakAdminConfig = {
+    readonly baseUrl: string;
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly realm: string;
+};
+type KeycloakUserAttributes = Readonly<Record<string, string | readonly string[]>>;
+type KeycloakUser = {
+    readonly attributes?: KeycloakUserAttributes;
+    readonly email?: string;
+    readonly emailVerified?: boolean;
+    readonly enabled?: boolean;
+    readonly firstName?: string;
+    readonly id: string;
+    readonly lastName?: string;
+    readonly username?: string;
+};
+type KeycloakPassword = {
+    readonly temporary: boolean;
+    readonly value: string;
+};
+type CreateUserParams = {
+    readonly attributes?: KeycloakUserAttributes;
+    readonly email: string;
+    readonly emailVerified?: boolean;
+    readonly enabled?: boolean;
+    readonly firstName?: string;
+    readonly lastName?: string;
+    readonly password?: KeycloakPassword;
+    readonly username: string;
+};
+type CreateUserResult = {
+    readonly id: string;
+};
+type FindUserByEmailParams = {
+    readonly email: string;
+};
+type UpdateUserParams = {
+    readonly user: Readonly<Partial<Pick<KeycloakUser, 'email' | 'emailVerified' | 'firstName' | 'lastName' | 'username'>>>;
+    readonly userId: string;
+};
+type SetEnabledParams = {
+    readonly enabled: boolean;
+    readonly userId: string;
+};
+type UpdateAttributesParams = {
+    readonly attributes: KeycloakUserAttributes;
+    readonly userId: string;
+};
+type DeleteUserParams = {
+    readonly userId: string;
+};
+type SetPasswordParams = {
+    readonly password: string;
+    readonly temporary: boolean;
+    readonly userId: string;
+};
+type SetTemporaryPasswordParams = {
+    readonly password: string;
+    readonly userId: string;
+};
+type KeycloakAdminClient = {
+    createUser(params: CreateUserParams): Promise<CreateUserResult>;
+    deleteUser(params: DeleteUserParams): Promise<void>;
+    findUserByEmail(params: FindUserByEmailParams): Promise<KeycloakUser | undefined>;
+    setEnabled(params: SetEnabledParams): Promise<void>;
+    setPassword(params: SetPasswordParams): Promise<void>;
+    setTemporaryPassword(params: SetTemporaryPasswordParams): Promise<void>;
+    updateAttributes(params: UpdateAttributesParams): Promise<void>;
+    updateUser(params: UpdateUserParams): Promise<void>;
+};
+type CreateKeycloakAdminClientParams = {
+    readonly config: KeycloakAdminConfig;
+    readonly fetch?: FetchLike;
+    readonly now?: () => number;
+};
 
-export interface SendVerifyEmailParams {
-  userId: string;
-  adminToken: string;
-}
-
-export interface KeycloakAdminClientInterface {
-  getAdminToken(): Promise<GetAdminTokenResult>;
-  updateUser(params: UpdateUserParams): Promise<void>;
-  resetPassword(params: ResetPasswordParams): Promise<void>;
-  toggleUserEnabled(params: ToggleUserEnabledParams): Promise<void>;
-  deleteUser(params: DeleteUserParams): Promise<void>;
-  updateUserAttributes(params: UpdateUserAttributesParams): Promise<void>;
-  sendVerifyEmail(params: SendVerifyEmailParams): Promise<void>;
-}
-
-export class KeycloakAdminError extends Error {
-  readonly statusCode?: number;
-  readonly code?: string;
-  readonly context?: Record<string, unknown>;
-  constructor(params: {
-    message: string;
-    statusCode?: number;
-    code?: string;
-    context?: Record<string, unknown>;
-  });
-}
-
-export class KeycloakAdminClient implements KeycloakAdminClientInterface {
-  getAdminToken(): Promise<GetAdminTokenResult>;
-  updateUser(params: UpdateUserParams): Promise<void>;
-  resetPassword(params: ResetPasswordParams): Promise<void>;
-  toggleUserEnabled(params: ToggleUserEnabledParams): Promise<void>;
-  deleteUser(params: DeleteUserParams): Promise<void>;
-  updateUserAttributes(params: UpdateUserAttributesParams): Promise<void>;
-  sendVerifyEmail(params: SendVerifyEmailParams): Promise<void>;
-}
-
-export class KeycloakAdminModule {
-  static forRoot(config: KeycloakAdminConfig): DynamicModule;
-}
+declare const keycloakAdminConfigSchema: z.ZodObject<{
+    baseUrl: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    realm: z.ZodString;
+}, z.core.$strip>;
+/**
+ * A falha carrega só o caminho do campo inválido. O valor nunca entra — seria o `clientSecret`.
+ */
+declare function parseKeycloakAdminConfig(value: unknown): KeycloakAdminConfig;
 
-export function validateKeycloakAdminConfig(config: KeycloakAdminConfig): void;
+declare function createKeycloakAdminClient({ config: rawConfig, fetch: injectedFetch, now, }: CreateKeycloakAdminClientParams): KeycloakAdminClient;
 
-export const KEYCLOAK_ADMIN_CLIENT = "KEYCLOAK_ADMIN_CLIENT";
-export const KEYCLOAK_ADMIN_CONFIG = "KEYCLOAK_ADMIN_CONFIG";
-export const KEYCLOAK_ADMIN_PROVIDER = "KEYCLOAK_ADMIN_PROVIDER";
+export { type CreateKeycloakAdminClientParams, type CreateUserParams, type CreateUserResult, type DeleteUserParams, type FetchLike, type FindUserByEmailParams, KEYCLOAK_ADMIN_ERROR_CODE, KEYCLOAK_ADMIN_TOKEN_RENEWAL_SKEW_MS, type KeycloakAdminClient, type KeycloakAdminConfig, type KeycloakAdminEndpoints, KeycloakAdminError, type KeycloakAdminErrorCode, type KeycloakAdminErrorContext, type KeycloakAdminErrorParams, type KeycloakPassword, type KeycloakUser, type KeycloakUserAttributes, type SerializedKeycloakAdminError, type SetEnabledParams, type SetPasswordParams, type SetTemporaryPasswordParams, type UpdateAttributesParams, type UpdateUserParams, buildKeycloakAdminEndpoints, createKeycloakAdminClient, isKeycloakAdminError, keycloakAdminConfigSchema, parseKeycloakAdminConfig };

package/dist/index.js

@@ -1,702 +1,324 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+// src/keycloak-admin.constant.ts
+var KEYCLOAK_ADMIN_GRANT_TYPE_CLIENT_CREDENTIALS = "client_credentials";
+var KEYCLOAK_ADMIN_FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+var KEYCLOAK_ADMIN_JSON_CONTENT_TYPE = "application/json";
+var KEYCLOAK_ADMIN_REDACTED = "[REDACTED]";
+var KEYCLOAK_ADMIN_TOKEN_RENEWAL_SKEW_MS = 3e4;
+var KEYCLOAK_ADMIN_ERROR_CODE = {
+  CONFIGURATION_INVALID: "KEYCLOAK_ADMIN_CONFIGURATION_INVALID",
+  REQUEST_FAILED: "KEYCLOAK_ADMIN_REQUEST_FAILED",
+  TOKEN_REQUEST_FAILED: "KEYCLOAK_ADMIN_TOKEN_REQUEST_FAILED",
+  TOKEN_RESPONSE_INVALID: "KEYCLOAK_ADMIN_TOKEN_RESPONSE_INVALID",
+  USER_ALREADY_EXISTS: "KEYCLOAK_ADMIN_USER_ALREADY_EXISTS",
+  USER_ID_MISSING: "KEYCLOAK_ADMIN_USER_ID_MISSING",
+  USER_NOT_FOUND: "KEYCLOAK_ADMIN_USER_NOT_FOUND"
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  KEYCLOAK_ADMIN_CLIENT: () => KEYCLOAK_ADMIN_CLIENT,
-  KEYCLOAK_ADMIN_CONFIG: () => KEYCLOAK_ADMIN_CONFIG,
-  KEYCLOAK_ADMIN_PROVIDER: () => KEYCLOAK_ADMIN_PROVIDER,
-  KeycloakAdminClient: () => KeycloakAdminClient,
-  KeycloakAdminError: () => KeycloakAdminError,
-  KeycloakAdminModule: () => KeycloakAdminModule,
-  validateKeycloakAdminConfig: () => validateKeycloakAdminConfig
-});
-module.exports = __toCommonJS(index_exports);
-
-// src/keycloak-admin.module.ts
-var import_common2 = require("@nestjs/common");
-var import_http_client2 = require("@adatechnology/http-client");
-
-// src/keycloak-admin.token.ts
-var KEYCLOAK_ADMIN_CLIENT = "KEYCLOAK_ADMIN_CLIENT";
-var KEYCLOAK_ADMIN_CONFIG = "KEYCLOAK_ADMIN_CONFIG";
-var KEYCLOAK_ADMIN_PROVIDER = "KEYCLOAK_ADMIN_PROVIDER";
-
-// src/keycloak-admin.client.ts
-var import_common = require("@nestjs/common");
-var import_http_client = require("@adatechnology/http-client");
-var import_logger = require("@adatechnology/logger");
+function buildKeycloakAdminEndpoints({ baseUrl, realm }) {
+  const origin = baseUrl.replace(/\/+$/, "");
+  const encodedRealm = encodeURIComponent(realm);
+  const users = `${origin}/admin/realms/${encodedRealm}/users`;
+  return {
+    token: `${origin}/realms/${encodedRealm}/protocol/openid-connect/token`,
+    user: (userId) => `${users}/${encodeURIComponent(userId)}`,
+    userPassword: (userId) => `${users}/${encodeURIComponent(userId)}/reset-password`,
+    users
+  };
+}
 
-// src/errors/keycloak-admin.error.ts
-var _KeycloakAdminError = class _KeycloakAdminError extends Error {
-  statusCode;
+// src/keycloak-admin.error.ts
+var KeycloakAdminError = class _KeycloakAdminError extends Error {
   code;
   context;
-  constructor(params) {
-    super(params.message);
+  status;
+  constructor({ code, context = {}, message, status }) {
+    super(message);
     this.name = "KeycloakAdminError";
-    this.statusCode = params.statusCode;
-    this.code = params.code;
-    this.context = params.context;
+    this.code = code;
+    this.context = context;
+    this.status = status;
     Object.setPrototypeOf(this, _KeycloakAdminError.prototype);
   }
-};
-__name(_KeycloakAdminError, "KeycloakAdminError");
-var KeycloakAdminError = _KeycloakAdminError;
-
-// package.json
-var package_default = {
-  name: "@adatechnology/keycloak-admin",
-  version: "0.1.15",
-  publishConfig: {
-    access: "public"
-  },
-  main: "dist/index.js",
-  module: "dist/index.mjs",
-  types: "dist/index.d.ts",
-  files: [
-    "dist"
-  ],
-  scripts: {
-    build: "rm -rf dist && tsup && cp index.d.ts dist/index.d.ts",
-    "build:watch": "tsup --watch",
-    check: "tsc -p tsconfig.json --noEmit"
-  },
-  dependencies: {
-    "@adatechnology/http-client": "workspace:*",
-    "@adatechnology/logger": "workspace:*"
-  },
-  peerDependencies: {
-    "@nestjs/common": "^11.0.16",
-    "@nestjs/core": "^11"
-  },
-  devDependencies: {
-    "@adatechnology/shared": "workspace:*",
-    "@esbuild-plugins/tsconfig-paths": "^0.1.2",
-    "@swc/core": "^1.15.24",
-    tsup: "^8.5.1",
-    typescript: "^5.2.0"
+  toJSON() {
+    return {
+      code: this.code,
+      context: this.context,
+      message: this.message,
+      name: this.name,
+      status: this.status
+    };
   }
 };
+function isKeycloakAdminError(value) {
+  return value instanceof KeycloakAdminError;
+}
 
-// src/constants/keycloak-admin.constants.ts
-var KEYCLOAK_ADMIN_LIB_NAME = package_default.name;
-var KEYCLOAK_ADMIN_LIB_VERSION = package_default.version;
-var KEYCLOAK_ADMIN_GRANT_TYPE_PASSWORD = "password";
-var KEYCLOAK_ADMIN_CLIENT_ID_ADMIN_CLI = "admin-cli";
-var KEYCLOAK_ADMIN_CONTENT_TYPE_FORM = "application/x-www-form-urlencoded";
-var KEYCLOAK_ADMIN_CONTENT_TYPE_JSON = "application/json";
-var KEYCLOAK_ADMIN_AUTHORIZATION_HEADER = "Authorization";
-var KEYCLOAK_ADMIN_BEARER_PREFIX = "Bearer ";
-var KEYCLOAK_ADMIN_ENDPOINTS = {
-  MASTER_TOKEN: "/realms/master/protocol/openid-connect/token",
-  ADMIN_USERS: /* @__PURE__ */ __name((baseUrl, realm, userId) => userId ? `${baseUrl}/admin/realms/${realm}/users/${userId}` : `${baseUrl}/admin/realms/${realm}/users`, "ADMIN_USERS"),
-  ADMIN_RESET_PASSWORD: /* @__PURE__ */ __name((baseUrl, realm, userId) => `${baseUrl}/admin/realms/${realm}/users/${userId}/reset-password`, "ADMIN_RESET_PASSWORD"),
-  ADMIN_SEND_VERIFY_EMAIL: /* @__PURE__ */ __name((baseUrl, realm, userId) => `${baseUrl}/admin/realms/${realm}/users/${userId}/send-verify-email`, "ADMIN_SEND_VERIFY_EMAIL")
-};
-var KEYCLOAK_ADMIN_ERROR_CODES = {
-  ADMIN_TOKEN_ERROR: "KEYCLOAK_ADMIN_TOKEN_ERROR",
-  CREATE_USER_ERROR: "KEYCLOAK_CREATE_USER_ERROR",
-  UPDATE_USER_ERROR: "KEYCLOAK_UPDATE_USER_ERROR",
-  RESET_PASSWORD_ERROR: "KEYCLOAK_RESET_PASSWORD_ERROR",
-  TOGGLE_ENABLED_ERROR: "KEYCLOAK_TOGGLE_ENABLED_ERROR",
-  DELETE_USER_ERROR: "KEYCLOAK_DELETE_USER_ERROR",
-  UPDATE_ATTRIBUTES_ERROR: "KEYCLOAK_UPDATE_ATTRIBUTES_ERROR",
-  SEND_VERIFY_EMAIL_ERROR: "KEYCLOAK_SEND_VERIFY_EMAIL_ERROR"
-};
-
-// src/utils/extract-http-error.ts
-function extractHttpError(err) {
-  const unknownErr = err;
-  const response = unknownErr == null ? void 0 : unknownErr.response;
-  const responseData = response == null ? void 0 : response.data;
-  let statusCode = void 0;
-  if (typeof (unknownErr == null ? void 0 : unknownErr.status) === "number") {
-    statusCode = unknownErr.status;
-  } else if (typeof (response == null ? void 0 : response.status) === "number") {
-    statusCode = response.status;
+// src/keycloak-admin.schema.ts
+import { z } from "zod";
+function isAbsoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
   }
-  const details = responseData ?? (unknownErr == null ? void 0 : unknownErr.message);
-  const rawError = (responseData == null ? void 0 : responseData.error) ?? (responseData == null ? void 0 : responseData.errorMessage);
-  const errorCode = typeof rawError === "string" ? rawError : typeof (unknownErr == null ? void 0 : unknownErr.code) === "string" ? unknownErr.code : void 0;
-  return {
-    statusCode,
-    details,
-    errorCode
-  };
 }
-__name(extractHttpError, "extractHttpError");
+var keycloakAdminConfigSchema = z.object({
+  baseUrl: z.string().min(1).refine(isAbsoluteHttpUrl, { message: "must be an absolute http(s) URL" }),
+  clientId: z.string().min(1),
+  clientSecret: z.string().min(1),
+  realm: z.string().min(1)
+});
+function parseKeycloakAdminConfig(value) {
+  const parsed = keycloakAdminConfigSchema.safeParse(value);
+  if (parsed.success) return parsed.data;
+  throw new KeycloakAdminError({
+    code: KEYCLOAK_ADMIN_ERROR_CODE.CONFIGURATION_INVALID,
+    context: { fields: parsed.error.issues.map((issue) => issue.path.join(".")).sort() },
+    message: "Invalid Keycloak admin configuration"
+  });
+}
 
-// src/keycloak-admin.client.ts
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
+// src/keycloak-admin.redaction.ts
+function replaceAll({ secrets, text }) {
+  return secrets.reduce((current, secret) => current.split(secret).join(KEYCLOAK_ADMIN_REDACTED), text);
 }
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function redactDeep({ secrets, value }) {
+  if (typeof value === "string") return replaceAll({ secrets, text: value });
+  if (Array.isArray(value)) return value.map((item) => redactDeep({ secrets, value: item }));
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactDeep({ secrets, value: item })]));
+  }
+  return value;
 }
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
+function createSecretRedactor(...secrets) {
+  const known = secrets.filter((secret) => typeof secret === "string" && secret !== "");
+  return {
+    text(value) {
+      return replaceAll({ secrets: known, text: value });
+    },
+    value(value) {
+      return redactDeep({ secrets: known, value });
+    },
+    with(...additional) {
+      return createSecretRedactor(...known, ...additional);
+    }
   };
 }
-__name(_ts_param, "_ts_param");
-var _KeycloakAdminClient = class _KeycloakAdminClient {
-  config;
-  httpProvider;
-  logger;
-  className = this.constructor.name;
-  constructor(config, httpProvider, logger) {
-    this.config = config;
-    this.httpProvider = httpProvider;
-    this.logger = logger;
+
+// src/keycloak-admin.response.ts
+var MAX_DETAIL_LENGTH = 200;
+async function readKeycloakDetail(response) {
+  const text = await response.text().catch(() => "");
+  if (text === "") return void 0;
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed === null || typeof parsed !== "object") return text.slice(0, MAX_DETAIL_LENGTH);
+    const payload = parsed;
+    const detail = payload.errorMessage ?? payload.error_description ?? payload.error;
+    return typeof detail === "string" ? detail.slice(0, MAX_DETAIL_LENGTH) : void 0;
+  } catch {
+    return text.slice(0, MAX_DETAIL_LENGTH);
   }
-  log(level, message, libMethod, meta) {
-    if (!this.logger) return;
-    const payload = {
-      message,
-      context: this.className,
-      lib: KEYCLOAK_ADMIN_LIB_NAME,
-      libVersion: KEYCLOAK_ADMIN_LIB_VERSION,
-      libMethod,
-      meta
-    };
-    if (level === "info") this.logger.info(payload);
-    else if (level === "warn") this.logger.warn(payload);
-    else if (level === "error") this.logger.error(payload);
+}
+
+// src/keycloak-admin.token.ts
+function createKeycloakTokenProvider({
+  config,
+  endpoint,
+  fetch: fetchImpl,
+  now,
+  redactor
+}) {
+  let cached;
+  let inFlight;
+  function isFresh(state) {
+    return state.expiresAtMs - KEYCLOAK_ADMIN_TOKEN_RENEWAL_SKEW_MS > now();
   }
-  async getAdminToken() {
-    const method = "getAdminToken";
-    this.log("info", `${method} - Start`, method, {
-      realm: this.config.realm
+  async function requestToken() {
+    const requestedAtMs = now();
+    const response = await fetchImpl(endpoint, {
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: KEYCLOAK_ADMIN_GRANT_TYPE_CLIENT_CREDENTIALS
+      }),
+      headers: { "content-type": KEYCLOAK_ADMIN_FORM_CONTENT_TYPE },
+      method: "POST"
     });
-    const url = `${this.config.baseUrl}${KEYCLOAK_ADMIN_ENDPOINTS.MASTER_TOKEN}`;
-    const body = new URLSearchParams();
-    body.append("grant_type", KEYCLOAK_ADMIN_GRANT_TYPE_PASSWORD);
-    body.append("client_id", KEYCLOAK_ADMIN_CLIENT_ID_ADMIN_CLI);
-    body.append("username", this.config.adminUser);
-    body.append("password", this.config.adminPassword);
-    try {
-      const response = await this.httpProvider.post({
-        url,
-        data: body,
-        config: {
-          headers: {
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_FORM
-          }
-        }
-      });
-      const result = {
-        accessToken: response.data.access_token,
-        expiresIn: response.data.expires_in,
-        tokenType: response.data.token_type
-      };
-      this.log("info", `${method} - Success`, method);
-      return result;
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        statusCode,
-        errorCode
-      });
+    if (!response.ok) {
       throw new KeycloakAdminError({
-        message: "Keycloak admin token request failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.ADMIN_TOKEN_ERROR,
-        context: {
-          url,
-          method: "POST",
-          details,
-          errorCode
-        }
+        code: KEYCLOAK_ADMIN_ERROR_CODE.TOKEN_REQUEST_FAILED,
+        context: redactor.value({ detail: await readKeycloakDetail(response), realm: config.realm }),
+        message: "Keycloak refused the service account token request",
+        status: response.status
       });
     }
-  }
-  async createUser(params) {
-    var _a, _b;
-    const method = "createUser";
-    const { username, email, firstName, lastName, enabled, emailVerified, credentials, attributes, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      username,
-      email
-    });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm);
-    const userData = {
-      username,
-      email,
-      firstName,
-      lastName,
-      enabled,
-      emailVerified,
-      ...credentials ? {
-        credentials
-      } : {},
-      ...attributes ? {
-        attributes
-      } : {}
-    };
-    try {
-      const response = await this.httpProvider.post({
-        url,
-        data: userData,
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      const locationHeader = ((_a = response.headers) == null ? void 0 : _a["location"]) ?? ((_b = response.headers) == null ? void 0 : _b["Location"]);
-      const userId = typeof locationHeader === "string" ? locationHeader.split("/").pop() ?? "" : "";
-      this.log("info", `${method} - Success`, method, {
-        username,
-        email,
-        userId
-      });
-      return userId;
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        username,
-        email,
-        statusCode,
-        errorCode
-      });
+    const payload = await response.json();
+    if (typeof payload.access_token !== "string" || typeof payload.expires_in !== "number") {
       throw new KeycloakAdminError({
-        message: "Keycloak create user failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.CREATE_USER_ERROR,
-        context: {
-          url,
-          method: "POST",
-          username,
-          email,
-          details,
-          errorCode
-        }
+        code: KEYCLOAK_ADMIN_ERROR_CODE.TOKEN_RESPONSE_INVALID,
+        context: { realm: config.realm },
+        message: "Keycloak returned a token response without access_token or expires_in",
+        status: response.status
       });
     }
+    return {
+      accessToken: payload.access_token,
+      expiresAtMs: requestedAtMs + payload.expires_in * 1e3
+    };
   }
-  async updateUser(params) {
-    const method = "updateUser";
-    const { userId, userData, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId
-    });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: userData,
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak update user failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.UPDATE_USER_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          details,
-          errorCode
-        }
-      });
+  return {
+    async getAccessToken() {
+      if (cached && isFresh(cached)) return cached.accessToken;
+      inFlight ??= requestToken();
+      try {
+        const state = await inFlight;
+        cached = state;
+        return state.accessToken;
+      } finally {
+        inFlight = void 0;
+      }
     }
-  }
-  async resetPassword(params) {
-    const method = "resetPassword";
-    const { userId, password, temporary, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId,
-      temporary
+  };
+}
+
+// src/keycloak-admin.client.ts
+var HTTP_CONFLICT = 409;
+var HTTP_NOT_FOUND = 404;
+function errorCodeOf(status) {
+  if (status === HTTP_NOT_FOUND) return KEYCLOAK_ADMIN_ERROR_CODE.USER_NOT_FOUND;
+  if (status === HTTP_CONFLICT) return KEYCLOAK_ADMIN_ERROR_CODE.USER_ALREADY_EXISTS;
+  return KEYCLOAK_ADMIN_ERROR_CODE.REQUEST_FAILED;
+}
+function normalizeAttributes(attributes) {
+  return Object.fromEntries(
+    Object.entries(attributes).map(([key, value]) => [key, typeof value === "string" ? [value] : [...value]])
+  );
+}
+function userIdFromLocation(response) {
+  const location = response.headers.get("location");
+  const id = location?.split("/").filter(Boolean).at(-1);
+  if (id === void 0 || id === "") {
+    throw new KeycloakAdminError({
+      code: KEYCLOAK_ADMIN_ERROR_CODE.USER_ID_MISSING,
+      message: "Keycloak created the user without a usable Location header",
+      status: response.status
     });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_RESET_PASSWORD(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: {
-          type: "password",
-          value: password,
-          temporary
-        },
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak reset password failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.RESET_PASSWORD_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          details,
-          errorCode
-        }
-      });
-    }
   }
-  async toggleUserEnabled(params) {
-    const method = "toggleUserEnabled";
-    const { userId, enabled, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId,
-      enabled
+  return id;
+}
+function createKeycloakAdminClient({
+  config: rawConfig,
+  fetch: injectedFetch,
+  now = Date.now
+}) {
+  const config = parseKeycloakAdminConfig(rawConfig);
+  const endpoints = buildKeycloakAdminEndpoints(config);
+  const redactor = createSecretRedactor(config.clientSecret);
+  const fetchImpl = injectedFetch ?? ((input, init) => globalThis.fetch(input, init));
+  const tokenProvider = createKeycloakTokenProvider({
+    config,
+    endpoint: endpoints.token,
+    fetch: fetchImpl,
+    now,
+    redactor
+  });
+  async function adminRequest({ body, method, secrets = [], url }) {
+    const accessToken = await tokenProvider.getAccessToken();
+    const response = await fetchImpl(url, {
+      ...body === void 0 ? {} : { body: JSON.stringify(body) },
+      headers: {
+        authorization: `Bearer ${accessToken}`,
+        ...body === void 0 ? {} : { "content-type": KEYCLOAK_ADMIN_JSON_CONTENT_TYPE }
+      },
+      method
     });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: {
-          enabled
-        },
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId,
-        enabled
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        enabled,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak toggle user enabled failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.TOGGLE_ENABLED_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          enabled,
-          details,
-          errorCode
-        }
-      });
-    }
-  }
-  async deleteUser(params) {
-    const method = "deleteUser";
-    const { userId, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId
+    if (response.ok) return response;
+    const callRedactor = redactor.with(accessToken, ...secrets);
+    throw new KeycloakAdminError({
+      code: errorCodeOf(response.status),
+      context: callRedactor.value({
+        detail: await readKeycloakDetail(response),
+        method,
+        realm: config.realm
+      }),
+      message: callRedactor.text(`Keycloak admin request failed with status ${response.status}`),
+      status: response.status
     });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.delete({
-        url,
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak delete user failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.DELETE_USER_ERROR,
-        context: {
-          url,
-          method: "DELETE",
-          userId,
-          details,
-          errorCode
-        }
-      });
-    }
   }
-  async updateUserAttributes(params) {
-    const method = "updateUserAttributes";
-    const { userId, attributes, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId,
-      attributeKeys: Object.keys(attributes)
+  async function setPassword({ password, temporary, userId }) {
+    await adminRequest({
+      body: { temporary, type: "password", value: password },
+      method: "PUT",
+      secrets: [password],
+      url: endpoints.userPassword(userId)
     });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: {
-          attributes
-        },
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak update user attributes failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.UPDATE_ATTRIBUTES_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          details,
-          errorCode
-        }
-      });
-    }
   }
-  async sendVerifyEmail(params) {
-    const method = "sendVerifyEmail";
-    const { userId, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId
-    });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_SEND_VERIFY_EMAIL(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: {},
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
+  return {
+    async createUser({
+      attributes,
+      email,
+      emailVerified,
+      enabled,
+      firstName,
+      lastName,
+      password,
+      username
+    }) {
+      const response = await adminRequest({
+        body: {
+          ...attributes === void 0 ? {} : { attributes: normalizeAttributes(attributes) },
+          ...password === void 0 ? {} : {
+            credentials: [{ temporary: password.temporary, type: "password", value: password.value }]
+          },
+          email,
+          emailVerified: emailVerified ?? false,
+          enabled: enabled ?? true,
+          firstName,
+          lastName,
+          username
+        },
+        method: "POST",
+        secrets: [password?.value],
+        url: endpoints.users
       });
-      throw new KeycloakAdminError({
-        message: "Keycloak send verify email failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.SEND_VERIFY_EMAIL_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          details,
-          errorCode
-        }
+      return { id: userIdFromLocation(response) };
+    },
+    async deleteUser({ userId }) {
+      await adminRequest({ method: "DELETE", url: endpoints.user(userId) });
+    },
+    async findUserByEmail({ email }) {
+      const query = new URLSearchParams({ email, exact: "true" });
+      const response = await adminRequest({ method: "GET", url: `${endpoints.users}?${query}` });
+      const found = await response.json();
+      return found.at(0);
+    },
+    async setEnabled({ enabled, userId }) {
+      await adminRequest({ body: { enabled }, method: "PUT", url: endpoints.user(userId) });
+    },
+    setPassword,
+    async setTemporaryPassword({ password, userId }) {
+      await setPassword({ password, temporary: true, userId });
+    },
+    async updateAttributes({ attributes, userId }) {
+      await adminRequest({
+        body: { attributes: normalizeAttributes(attributes) },
+        method: "PUT",
+        url: endpoints.user(userId)
       });
+    },
+    async updateUser({ user, userId }) {
+      await adminRequest({ body: user, method: "PUT", url: endpoints.user(userId) });
     }
-  }
-};
-__name(_KeycloakAdminClient, "KeycloakAdminClient");
-var KeycloakAdminClient = _KeycloakAdminClient;
-KeycloakAdminClient = _ts_decorate([
-  (0, import_common.Injectable)(),
-  _ts_param(0, (0, import_common.Inject)(KEYCLOAK_ADMIN_CONFIG)),
-  _ts_param(1, (0, import_common.Inject)(import_http_client.HTTP_PROVIDER)),
-  _ts_param(2, (0, import_common.Optional)()),
-  _ts_param(2, (0, import_common.Inject)(import_logger.LOGGER_PROVIDER)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof KeycloakAdminConfig === "undefined" ? Object : KeycloakAdminConfig,
-    typeof HttpProviderInterface === "undefined" ? Object : HttpProviderInterface,
-    typeof LoggerProviderInterface === "undefined" ? Object : LoggerProviderInterface
-  ])
-], KeycloakAdminClient);
-
-// src/utils/validate-config.ts
-function validateKeycloakAdminConfig(config) {
-  const issues = [];
-  if (!config) {
-    throw new KeycloakAdminError({
-      message: "KeycloakAdminConfig is required. Provide an object with baseUrl, realm, adminUser and adminPassword.",
-      statusCode: 400,
-      code: "KEYCLOAK_ADMIN_CONFIG_MISSING"
-    });
-  }
-  if (typeof config.baseUrl !== "string" || config.baseUrl.trim() === "") {
-    issues.push({
-      field: "baseUrl",
-      message: "baseUrl is required and must be a non-empty string (e.g. 'http://localhost:8081')"
-    });
-  } else if (!config.baseUrl.startsWith("http://") && !config.baseUrl.startsWith("https://")) {
-    issues.push({
-      field: "baseUrl",
-      message: `baseUrl must start with 'http://' or 'https://'. Received: '${config.baseUrl}'`
-    });
-  }
-  if (typeof config.realm !== "string" || config.realm.trim() === "") {
-    issues.push({
-      field: "realm",
-      message: "realm is required and must be a non-empty string (e.g. 'BACKEND')"
-    });
-  }
-  if (typeof config.adminUser !== "string" || config.adminUser.trim() === "") {
-    issues.push({
-      field: "adminUser",
-      message: "adminUser is required and must be a non-empty string"
-    });
-  }
-  if (typeof config.adminPassword !== "string" || config.adminPassword.trim() === "") {
-    issues.push({
-      field: "adminPassword",
-      message: "adminPassword is required and must be a non-empty string"
-    });
-  }
-  if (issues.length > 0) {
-    const summary = issues.map((i) => `  - ${i.field}: ${i.message}`).join("\n");
-    throw new KeycloakAdminError({
-      message: `KeycloakAdminConfig validation failed:
-${summary}`,
-      statusCode: 400,
-      code: "KEYCLOAK_ADMIN_CONFIG_INVALID",
-      context: {
-        issues
-      }
-    });
-  }
-}
-__name(validateKeycloakAdminConfig, "validateKeycloakAdminConfig");
-
-// src/keycloak-admin.module.ts
-function _ts_decorate2(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
+  };
 }
-__name(_ts_decorate2, "_ts_decorate");
-var _KeycloakAdminModule = class _KeycloakAdminModule {
-  static forRoot(config) {
-    validateKeycloakAdminConfig(config);
-    return {
-      module: _KeycloakAdminModule,
-      global: true,
-      imports: [
-        import_http_client2.HttpModule.forRoot({
-          baseURL: config.baseUrl,
-          timeout: 5e3
-        }, {
-          logging: {
-            enabled: true,
-            includeBody: true,
-            context: "KeycloakAdminHttpClient",
-            environments: [
-              "development",
-              "test"
-            ]
-          }
-        })
-      ],
-      providers: [
-        {
-          provide: KEYCLOAK_ADMIN_CONFIG,
-          useValue: config
-        },
-        {
-          provide: KEYCLOAK_ADMIN_CLIENT,
-          useClass: KeycloakAdminClient
-        },
-        {
-          provide: KEYCLOAK_ADMIN_PROVIDER,
-          useExisting: KEYCLOAK_ADMIN_CLIENT
-        }
-      ],
-      exports: [
-        KEYCLOAK_ADMIN_CLIENT,
-        KEYCLOAK_ADMIN_PROVIDER,
-        KEYCLOAK_ADMIN_CONFIG
-      ]
-    };
-  }
-};
-__name(_KeycloakAdminModule, "KeycloakAdminModule");
-var KeycloakAdminModule = _KeycloakAdminModule;
-KeycloakAdminModule = _ts_decorate2([
-  (0, import_common2.Module)({})
-], KeycloakAdminModule);
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  KEYCLOAK_ADMIN_CLIENT,
-  KEYCLOAK_ADMIN_CONFIG,
-  KEYCLOAK_ADMIN_PROVIDER,
-  KeycloakAdminClient,
+export {
+  KEYCLOAK_ADMIN_ERROR_CODE,
+  KEYCLOAK_ADMIN_TOKEN_RENEWAL_SKEW_MS,
   KeycloakAdminError,
-  KeycloakAdminModule,
-  validateKeycloakAdminConfig
-});
+  buildKeycloakAdminEndpoints,
+  createKeycloakAdminClient,
+  isKeycloakAdminError,
+  keycloakAdminConfigSchema,
+  parseKeycloakAdminConfig
+};

package/package.json

@@ -1,33 +1,42 @@
 {
   "name": "@adatechnology/keycloak-admin",
-  "version": "0.1.15",
-  "publishConfig": {
-    "access": "public"
-  },
+  "version": "1.0.0-rc.0",
+  "description": "Agnostic Keycloak Admin API client authenticated as a service account (client_credentials)",
+  "type": "module",
   "main": "dist/index.js",
-  "module": "dist/index.mjs",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
   "files": [
     "dist"
   ],
-  "dependencies": {
-    "@adatechnology/http-client": "0.0.23",
-    "@adatechnology/logger": "0.0.19"
-  },
+  "keywords": [
+    "keycloak",
+    "admin",
+    "client-credentials",
+    "service-account",
+    "identity"
+  ],
   "peerDependencies": {
-    "@nestjs/common": "^11.0.16",
-    "@nestjs/core": "^11"
+    "zod": "^3.24.1 || ^4.0.0"
   },
   "devDependencies": {
-    "@esbuild-plugins/tsconfig-paths": "^0.1.2",
-    "@swc/core": "^1.15.24",
-    "tsup": "^8.5.1",
-    "typescript": "^5.2.0",
-    "@adatechnology/shared": "0.0.2"
+    "@types/bun": "latest",
+    "tsup": "^8.0.0",
+    "typescript": "^5.0.0",
+    "zod": "^4.4.3"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
   },
   "scripts": {
-    "build": "rm -rf dist && tsup && cp index.d.ts dist/index.d.ts",
-    "build:watch": "tsup --watch",
-    "check": "tsc -p tsconfig.json --noEmit"
+    "build": "tsup",
+    "check": "tsc --noEmit",
+    "test": "bun test"
   }
 }