@authyon/server 0.2.0-beta.0 → 0.2.0-beta.11

package/dist/index.js

@@ -1,33 +1,314 @@
-// src/errors.ts
-var AuthyonError = class extends Error {
-  constructor(status, body) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
-    this.name = "AuthyonError";
-    this.status = status;
-    this.code = body.code ?? "unknown";
-    this.title = body.title ?? "Error";
-    this.detail = body.detail;
-  }
-  is(code) {
-    return this.code === code;
+import {
+  AuthyonError,
+  DEFAULT_BASE_URL,
+  DEFAULT_EXPIRY_SKEW_MS,
+  ErrorCodes,
+  FetchHttpAdapter,
+  JsonHttpClient,
+  LoggingHttpAdapter,
+  createSharedTransport
+} from "./chunk-56H66KLG.js";
+import {
+  AuthorizationError,
+  AuthyonAbility,
+  AuthyonAbilityBuilder,
+  JwksTokenVerifier,
+  TokenVerificationError,
+  authorizeRequest,
+  authorizeToken,
+  clientIpHeaders,
+  createAuthorizationErrorResponse,
+  createAuthyonAbility,
+  createAuthyonRules,
+  createExpressAuthorizationMiddleware,
+  hasPermission,
+  hasPermissionGroup,
+  normalizeClientIp
+} from "./chunk-NKWQMYB3.js";
+import {
+  __privateAdd,
+  __privateGet,
+  __privateSet
+} from "./chunk-77J4NURK.js";
+
+// src/client/credentialManagement.ts
+function segment(value) {
+  if (typeof value !== "string" || !value.trim() || value === "." || value === ".." || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
+    throw new TypeError("Authyon: invalid route identifier.");
   }
-};
+  return encodeURIComponent(value);
+}
+function permissionsBody(input) {
+  if (input.permissions !== void 0 && input.scopes !== void 0) {
+    throw new TypeError("Authyon: supply permissions or scopes, not both.");
+  }
+  const values = input.permissions ?? input.scopes;
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new TypeError("Authyon: explicit credential permissions are required.");
+  }
+  const permissions = values.map((value) => {
+    if (typeof value !== "string") throw new TypeError("Authyon: invalid permission.");
+    const normalized = value.trim().toLowerCase();
+    if (!/^(?:\*|[a-z][a-z0-9_-]*):(?:\*|[a-z][a-z0-9_-]*):(?:\*|[a-z][a-z0-9_-]*)$/u.test(normalized)) {
+      throw new TypeError("Authyon: permissions must have namespace:resource:action format.");
+    }
+    return normalized;
+  });
+  return { permissions: [...new Set(permissions)] };
+}
+function lifetimeBody(input) {
+  if (input.lifetimeDays === void 0 || input.lifetimeDays === null) return {};
+  if (!Number.isInteger(input.lifetimeDays) || input.lifetimeDays < 1 || input.lifetimeDays > 3650) {
+    throw new RangeError("Authyon: lifetimeDays must be between 1 and 3650.");
+  }
+  return { lifetimeDays: input.lifetimeDays };
+}
+function credentialQuery(options = {}) {
+  const { skip, take, search } = options;
+  if (skip !== void 0 && (!Number.isInteger(skip) || skip < 0 || skip > 2147483647))
+    throw new RangeError("Authyon: invalid skip.");
+  if (take !== void 0 && (!Number.isInteger(take) || take < 1 || take > 100))
+    throw new RangeError("Authyon: take must be between 1 and 100.");
+  if (search !== void 0 && (typeof search !== "string" || search.trim().length > 200))
+    throw new RangeError("Authyon: search must contain at most 200 characters.");
+  return { search: search?.trim() || void 0, skip, take };
+}
+function credentialSummary(value) {
+  return {
+    id: value.id,
+    clientId: value.clientId,
+    description: value.description,
+    createdAt: value.createdAt,
+    lastUsedAt: value.lastUsedAt,
+    revokedAt: value.revokedAt,
+    expiresAt: value.expiresAt ?? null,
+    isActive: value.isActive,
+    permissions: [...value.permissions]
+  };
+}
+function credentialDetail(value) {
+  return {
+    ...credentialSummary(value),
+    createdBy: value.createdBy == null ? null : {
+      id: value.createdBy.id,
+      type: value.createdBy.type,
+      displayName: value.createdBy.displayName
+    },
+    updatedAt: value.updatedAt,
+    secretRotatedAt: value.secretRotatedAt,
+    expiresAt: value.expiresAt ?? null,
+    ageSeconds: value.ageSeconds,
+    lifetimeSeconds: value.lifetimeSeconds,
+    accessTokenLifetimeSeconds: value.accessTokenLifetimeSeconds
+  };
+}
+async function credentialPage(request, path, options = {}) {
+  const query = credentialQuery(options);
+  const page = await request(path, { query });
+  if (!page || !Array.isArray(page.data))
+    throw new TypeError("Authyon: expected a paginated credential response.");
+  return {
+    data: page.data.map(credentialSummary),
+    ...page.perPage === void 0 ? {} : { perPage: page.perPage },
+    pageSize: page.pageSize,
+    total: page.total,
+    pages: page.pages,
+    hasNext: page.hasNext,
+    hasPrev: page.hasPrev
+  };
+}
+async function allCredentials(request, path) {
+  const result = [];
+  const seen = /* @__PURE__ */ new Set();
+  let skip = 0;
+  for (let iteration = 0; iteration < 1e3; iteration++) {
+    const page = await request(
+      path,
+      iteration === 0 ? {} : { query: { skip, take: 100 } }
+    );
+    if (Array.isArray(page)) {
+      if (iteration !== 0)
+        throw new Error("Authyon: credential pagination changed during listing.");
+      return page.map(credentialSummary);
+    }
+    if (!page || !Array.isArray(page.data))
+      throw new TypeError("Authyon: invalid credential page.");
+    for (const row of page.data) {
+      if (seen.has(row.id))
+        throw new Error("Authyon: credential pages overlapped; retry the listing.");
+      seen.add(row.id);
+      result.push(credentialSummary(row));
+    }
+    if (!page.hasNext) return result;
+    if (page.data.length === 0) throw new Error("Authyon: credential pagination made no progress.");
+    skip += page.data.length;
+  }
+  throw new Error("Authyon: use listPage for more than 1000 credential pages.");
+}
 
-// src/client.ts
-var DEFAULT_BASE_URL = "https://api.authyon.com";
-var EXPIRY_SKEW_MS = 3e4;
-function toQuery(params = {}) {
-  const query = new URLSearchParams();
-  for (const [key, value] of Object.entries(params)) {
-    if (value !== void 0) query.set(key, String(value));
-  }
-  const qs = query.toString();
-  return qs ? `?${qs}` : "";
+// src/client/scopedManagementClient.ts
+function scopedRequest(request, source) {
+  return async (path, options = {}) => {
+    const token = typeof source === "function" ? await source() : source;
+    if (typeof token !== "string" || !token.trim() || /\s/u.test(token))
+      throw new TypeError("Authyon: a valid access token is required.");
+    return request(path, {
+      ...options,
+      headers: { ...options.headers, Authorization: `Bearer ${token}` }
+    });
+  };
+}
+function environmentPath(scope) {
+  return `/platform/workspaces/${segment(scope.workspaceId)}/environments/${segment(scope.environmentId)}`;
+}
+function tenantPath(scope) {
+  return `${environmentPath(scope)}/tenants/${segment(scope.tenantId)}`;
+}
+function credentialPath(scope) {
+  return `${scope.tenantId === void 0 ? environmentPath(scope) : tenantPath(scope)}/credentials`;
+}
+function workspacePath(id) {
+  return `/platform/workspaces/${segment(id)}`;
 }
+function workspaceRole(role) {
+  if (role !== "admin" && role !== "auditor")
+    throw new TypeError("Authyon: workspace role must be admin or auditor.");
+  return role;
+}
+var _request;
+var PlatformScopedClient = class {
+  /** @hidden */
+  constructor(request, token) {
+    __privateAdd(this, _request);
+    this.credentials = {
+      list: (scope, options = {}) => credentialPage(__privateGet(this, _request), credentialPath(scope), options),
+      get: async (scope, credentialId) => credentialDetail(await __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`)),
+      create: (scope, input) => __privateGet(this, _request).call(this, credentialPath(scope), {
+        method: "POST",
+        body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
+      }),
+      updatePermissions: (scope, credentialId, input) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/permissions`, {
+        method: "PUT",
+        body: permissionsBody(input)
+      }),
+      updateScopes: (scope, credentialId, scopes) => this.credentials.updatePermissions(scope, credentialId, { scopes }),
+      /** Returns a new secret once. API may require an explicit step-up first. */
+      rotate: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/rotate`, { method: "POST" }),
+      revoke: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`, { method: "DELETE" })
+    };
+    this.workspaces = {
+      team: (workspaceId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/team`),
+      members: {
+        invite: (workspaceId, input) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites`, {
+          method: "POST",
+          body: { email: input.email, role: workspaceRole(input.role) }
+        }),
+        /** memberId comes from team.members; it is not the platform userId. */
+        remove: (workspaceId, memberId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
+          method: "DELETE"
+        }),
+        changeRole: (workspaceId, memberId, role) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
+          method: "PATCH",
+          body: { role: workspaceRole(role) }
+        })
+      },
+      invites: {
+        create: (workspaceId, input) => this.workspaces.members.invite(workspaceId, input),
+        revoke: (workspaceId, inviteId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites/${segment(inviteId)}`, {
+          method: "DELETE"
+        })
+      }
+    };
+    this.tenants = {
+      members: {
+        list: (scope, options = {}) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { query: options }),
+        add: (scope, userId, roles) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { method: "POST", body: { userId, roles } }),
+        remove: (scope, userId) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members/${segment(userId)}`, { method: "DELETE" })
+      }
+    };
+    this.auth = {
+      /** Explicitly confirms the current platform session; passwords are not retained. */
+      stepUp: (currentPassword) => __privateGet(this, _request).call(this, "/platform/auth/step-up", { method: "POST", body: { currentPassword } })
+    };
+    __privateSet(this, _request, scopedRequest(request, token));
+  }
+};
+_request = new WeakMap();
+var _request2;
+var UserScopedClient = class {
+  /** @hidden */
+  constructor(request, token) {
+    __privateAdd(this, _request2);
+    this.tenants = {
+      members: {
+        list: (tenantId, options = {}) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, { query: options }),
+        /** Adds an existing environment user by email; does not send an invitation email. */
+        invite: (tenantId, input) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, {
+          method: "POST",
+          body: { email: input.email, roles: input.roles }
+        }),
+        remove: (tenantId, userId) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
+          method: "DELETE"
+        })
+      }
+    };
+    __privateSet(this, _request2, scopedRequest(request, token));
+  }
+};
+_request2 = new WeakMap();
+var _request3;
+var WorkspaceInvitesClient = class {
+  /** @hidden */
+  constructor(request) {
+    __privateAdd(this, _request3);
+    __privateSet(this, _request3, request);
+  }
+  preview(token) {
+    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}`);
+  }
+  accept(token, input = {}) {
+    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}/accept`, {
+      method: "POST",
+      body: { name: input.name, password: input.password }
+    });
+  }
+};
+_request3 = new WeakMap();
+
+// ../../internal/core/auth/expiringTokenProvider.ts
+var _token, _inFlight;
+var ExpiringTokenProvider = class {
+  constructor(acquire, expirySkewMs = DEFAULT_EXPIRY_SKEW_MS) {
+    this.acquire = acquire;
+    this.expirySkewMs = expirySkewMs;
+    __privateAdd(this, _token, null);
+    __privateAdd(this, _inFlight, null);
+  }
+  async getAccessToken() {
+    if (__privateGet(this, _token) && Date.now() < __privateGet(this, _token).expiresAt - this.expirySkewMs) {
+      return __privateGet(this, _token).accessToken;
+    }
+    if (__privateGet(this, _inFlight)) return __privateGet(this, _inFlight);
+    __privateSet(this, _inFlight, this.acquire().then((token) => {
+      __privateSet(this, _token, token);
+      return token.accessToken;
+    }).finally(() => {
+      __privateSet(this, _inFlight, null);
+    }));
+    return __privateGet(this, _inFlight);
+  }
+  clear() {
+    __privateSet(this, _token, null);
+  }
+};
+_token = new WeakMap();
+_inFlight = new WeakMap();
+
+// src/client/authyonServerClient.ts
+var _clientSecret;
 var AuthyonServerClient = class {
   constructor(options = {}) {
-    this.environmentToken = null;
-    this.environmentTokenInFlight = null;
+    __privateAdd(this, _clientSecret);
     // ── Discovery ──────────────────────────────────────────────────────────────
     this.discovery = {
       /** GET /.well-known/jwks.json — the environment's public signing keys. */
@@ -61,8 +342,19 @@ var AuthyonServerClient = class {
           client_id: credentials.clientId,
           client_secret: credentials.clientSecret
         }
+      }),
+      /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+      validate: (accessToken, context) => this.request("/tenant/auth/validate", {
+        method: "POST",
+        headers: {
+          ...clientIpHeaders(context),
+          Authorization: `Bearer ${accessToken}`
+        }
       })
     };
+    this.workspaceInvites = new WorkspaceInvitesClient(
+      (path, options) => this.http.request(path, options)
+    );
     // ── Environment management (users, tenants, roles, permissions, audit) ───
     this.environment = {
       users: {
@@ -154,8 +446,53 @@ var AuthyonServerClient = class {
         )
       },
       tenants: {
-        /** GET /env/tenants — list tenants in the environment. */
-        list: () => this.request("/env/tenants", { envBearer: true }),
+        credentials: {
+          /** GET /env/tenants/{tenantId}/credentials. Returns metadata only, including revoked credentials. */
+          list: (tenantId) => allCredentials(
+            (path, options) => this.request(path, { ...options, envBearer: true }),
+            `/env/tenants/${segment(tenantId)}/credentials`
+          ),
+          /** Paginated searchable listing. Prefer this over loading every credential. */
+          listPage: (tenantId, options = {}) => credentialPage(
+            (path, requestOptions) => this.request(path, { ...requestOptions, envBearer: true }),
+            `/env/tenants/${segment(tenantId)}/credentials`,
+            options
+          ),
+          get: async (tenantId, credentialId) => credentialDetail(
+            await this.request(
+              `/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}`,
+              { envBearer: true }
+            )
+          ),
+          /** Explicit scopes/permissions; only issuance returns the client secret. */
+          create: (tenantId, input) => this.request(`/env/tenants/${segment(tenantId)}/credentials`, {
+            method: "POST",
+            envBearer: true,
+            body: {
+              description: input.description,
+              ...lifetimeBody(input),
+              ...permissionsBody(input)
+            }
+          }),
+          /** Returns a new secret once while keeping the same client id. */
+          rotate: (tenantId, credentialId) => this.request(
+            `/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}/rotate`,
+            { method: "POST", envBearer: true }
+          ),
+          updatePermissions: (tenantId, credentialId, input) => this.request(
+            `/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}/permissions`,
+            { method: "PUT", envBearer: true, body: permissionsBody(input) }
+          ),
+          updateScopes: (tenantId, credentialId, scopes) => this.environment.tenants.credentials.updatePermissions(tenantId, credentialId, {
+            scopes
+          }),
+          revoke: (tenantId, credentialId) => this.request(`/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}`, {
+            method: "DELETE",
+            envBearer: true
+          })
+        },
+        /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
         /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
         /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
@@ -166,7 +503,18 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: input
         }),
-        /** DELETE /env/tenants/{tenantId} — delete a tenant. */
+        /** PUT /env/tenants/{tenantId}/metadata - replace public and private metadata. */
+        updateMetadata: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/metadata`, {
+          method: "PUT",
+          envBearer: true,
+          body: input
+        }),
+        /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+        disable: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/disable`, {
+          method: "POST",
+          envBearer: true
+        }),
+        /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
         delete: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
           method: "DELETE",
           envBearer: true
@@ -300,54 +648,60 @@ var AuthyonServerClient = class {
     };
     this.envKey = options.envKey;
     this.clientId = options.clientId;
-    this.clientSecret = options.clientSecret;
-    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
-    this.fetchImpl = options.fetch ?? fetch.bind(globalThis);
+    __privateSet(this, _clientSecret, options.clientSecret);
+    this.clientIp = options.clientIp;
+    this.transport = createSharedTransport({
+      baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
+      allowInsecureHttp: options.allowInsecureHttp,
+      timeoutMs: options.timeoutMs,
+      httpAdapter: options.httpAdapter,
+      httpLogger: options.httpLogger,
+      fetch: options.fetch
+    });
+    this.http = new JsonHttpClient(this.transport);
+    this.environmentTokenProvider = new ExpiringTokenProvider(async () => {
+      if (!this.clientId || !__privateGet(this, _clientSecret)) {
+        throw new Error(
+          "Authyon: `clientId`/`clientSecret` are required for environment management calls (mint a pair in the console, under the environment's OAuth clients)."
+        );
+      }
+      const token = await this.environmentAuth.token({
+        clientId: this.clientId,
+        clientSecret: __privateGet(this, _clientSecret)
+      });
+      return {
+        accessToken: token.access_token,
+        expiresAt: Date.now() + token.expires_in * 1e3
+      };
+    });
   }
   async request(path, options = {}) {
-    const headers = { ...options.headers };
-    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    const headers = {
+      ...clientIpHeaders({ clientIp: this.clientIp }),
+      ...options.headers
+    };
     if (options.envBearer) {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
     if (this.envKey) headers["X-Authyon-Environment"] = this.envKey;
-    const response = await this.fetchImpl(`${this.baseUrl}${path}${toQuery(options.query)}`, {
-      method: options.method ?? "GET",
-      headers,
-      body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
-    });
-    if (!response.ok) {
-      let body = {};
-      try {
-        body = await response.json();
-      } catch {
-      }
-      throw new AuthyonError(response.status, body);
-    }
-    if (response.status === 204) return void 0;
-    return await response.json();
+    return this.http.request(path, { ...options, headers });
   }
   /** Mints (and caches) an environment access token from `clientId`/`clientSecret`. */
   async getEnvironmentAccessToken() {
-    if (this.environmentToken && Date.now() < this.environmentToken.expiresAt - EXPIRY_SKEW_MS) {
-      return this.environmentToken.accessToken;
-    }
-    if (this.environmentTokenInFlight) return this.environmentTokenInFlight;
-    if (!this.clientId || !this.clientSecret) {
-      throw new Error(
-        "Authyon: `clientId`/`clientSecret` are required for environment management calls (mint a pair in the console, under the environment's OAuth clients)."
-      );
+    return this.environmentTokenProvider.getAccessToken();
+  }
+  /** Discovers Authyon's trusted issuer/JWKS and creates a cached local access-token verifier. */
+  async createJwksTokenVerifier(options) {
+    const { publishableKey, issuer, ...verifierOptions } = options;
+    const configuration = await this.discovery.openidConfiguration(publishableKey);
+    if (issuer && configuration.issuer !== issuer) {
+      throw new Error("Authyon: discovered JWT issuer does not match the configured issuer");
     }
-    this.environmentTokenInFlight = this.environmentAuth.token({ clientId: this.clientId, clientSecret: this.clientSecret }).then((token) => {
-      this.environmentToken = {
-        accessToken: token.access_token,
-        expiresAt: Date.now() + token.expires_in * 1e3
-      };
-      return token.access_token;
-    }).finally(() => {
-      this.environmentTokenInFlight = null;
+    return new JwksTokenVerifier({
+      ...verifierOptions,
+      issuer: issuer ?? configuration.issuer,
+      jwksUri: configuration.jwks_uri
     });
-    return this.environmentTokenInFlight;
   }
   // ── Token verification ────────────────────────────────────────────────────
   //
@@ -358,12 +712,22 @@ var AuthyonServerClient = class {
   // endpoint with only the `X-Authyon-Environment` header (no bearer)
   // returns 401 with `WWW-Authenticate: Bearer`.
   /** POST /auth/introspect — lightweight token introspection (RFC 7662). */
-  introspect(token) {
-    return this.request("/auth/introspect", { method: "POST", envBearer: true, body: { token } });
+  introspect(token, context) {
+    return this.request("/auth/introspect", {
+      method: "POST",
+      envBearer: true,
+      body: { token },
+      headers: clientIpHeaders(context)
+    });
   }
   /** POST /auth/validate — recommended: cross-checks DB state, catches revocation immediately. */
-  async validate(token) {
-    const raw = await this.request("/auth/validate", { method: "POST", envBearer: true, body: { token } });
+  async validate(token, context) {
+    const raw = await this.request("/auth/validate", {
+      method: "POST",
+      envBearer: true,
+      body: { token },
+      headers: clientIpHeaders(context)
+    });
     return { valid: raw.valid, reason: raw.reason ?? null, user: raw.profile };
   }
   /**
@@ -375,6 +739,14 @@ var AuthyonServerClient = class {
   tenant(credentials) {
     return new TenantScopedClient(this, credentials);
   }
+  /** Uses only the supplied platform-user access token. */
+  platform(token) {
+    return new PlatformScopedClient((path, options) => this.http.request(path, options), token);
+  }
+  /** Uses an end-user token; the configured environment key selects the environment. */
+  user(token) {
+    return new UserScopedClient((path, options) => this.request(path, options), token);
+  }
   /** @internal used by {@link TenantScopedClient} to share the base URL/fetch/error handling. */
   _requestAsTenant(accessToken, path, options = {}) {
     return this.request(path, {
@@ -384,10 +756,9 @@ var AuthyonServerClient = class {
     });
   }
 };
+_clientSecret = new WeakMap();
 var TenantScopedClient = class {
   constructor(server, credentials) {
-    this.token = null;
-    this.tokenInFlight = null;
     this.members = {
       /**
        * GET /tenant/members — members of the token's tenant.
@@ -444,34 +815,94 @@ var TenantScopedClient = class {
       delete: (roleId) => this.request(`/tenant/roles/${encodeURIComponent(roleId)}`, { method: "DELETE" })
     };
     this.server = server;
-    this.credentials = credentials;
-  }
-  async getAccessToken() {
-    if (this.token && Date.now() < this.token.expiresAt - EXPIRY_SKEW_MS) {
-      return this.token.accessToken;
-    }
-    if (this.tokenInFlight) return this.tokenInFlight;
-    this.tokenInFlight = this.server.tenantAuth.token(this.credentials).then((token) => {
-      this.token = {
+    this.tokenProvider = new ExpiringTokenProvider(async () => {
+      const token = await this.server.tenantAuth.token(credentials);
+      return {
         accessToken: token.access_token,
         expiresAt: Date.now() + token.expires_in * 1e3
       };
-      return token.access_token;
-    }).finally(() => {
-      this.tokenInFlight = null;
     });
-    return this.tokenInFlight;
+  }
+  async getAccessToken() {
+    return this.tokenProvider.getAccessToken();
   }
   async request(path, options = {}) {
     return this.server._requestAsTenant(await this.getAccessToken(), path, options);
   }
+  /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
+  async validate(context) {
+    return this.server.tenantAuth.validate(await this.getAccessToken(), context);
+  }
 };
 function createClient(options = {}) {
   return new AuthyonServerClient(options);
 }
+
+// src/client/authyonServerClientBuilder.ts
+var _options;
+var AuthyonServerClientBuilder = class {
+  constructor() {
+    __privateAdd(this, _options, {});
+  }
+  withEnvironmentKey(envKey) {
+    __privateGet(this, _options).envKey = envKey;
+    return this;
+  }
+  withEnvironmentCredentials(clientId, clientSecret) {
+    __privateGet(this, _options).clientId = clientId;
+    __privateGet(this, _options).clientSecret = clientSecret;
+    return this;
+  }
+  withClientIp(clientIp) {
+    __privateGet(this, _options).clientIp = clientIp;
+    return this;
+  }
+  withBaseUrl(baseUrl, allowInsecureHttp = false) {
+    __privateGet(this, _options).baseUrl = baseUrl;
+    __privateGet(this, _options).allowInsecureHttp = allowInsecureHttp;
+    return this;
+  }
+  withTimeout(timeoutMs) {
+    __privateGet(this, _options).timeoutMs = timeoutMs;
+    return this;
+  }
+  withHttpAdapter(httpAdapter) {
+    __privateGet(this, _options).httpAdapter = httpAdapter;
+    return this;
+  }
+  withHttpLogger(httpLogger) {
+    __privateGet(this, _options).httpLogger = httpLogger;
+    return this;
+  }
+  build() {
+    return new AuthyonServerClient({ ...__privateGet(this, _options) });
+  }
+};
+_options = new WeakMap();
 export {
+  AuthorizationError,
+  AuthyonAbility,
+  AuthyonAbilityBuilder,
   AuthyonError,
   AuthyonServerClient,
+  AuthyonServerClientBuilder,
+  ErrorCodes,
+  FetchHttpAdapter,
+  JwksTokenVerifier,
+  LoggingHttpAdapter,
+  PlatformScopedClient,
   TenantScopedClient,
-  createClient
+  TokenVerificationError,
+  UserScopedClient,
+  WorkspaceInvitesClient,
+  authorizeRequest,
+  authorizeToken,
+  createAuthorizationErrorResponse,
+  createAuthyonAbility,
+  createAuthyonRules,
+  createClient,
+  createExpressAuthorizationMiddleware,
+  hasPermission,
+  hasPermissionGroup,
+  normalizeClientIp
 };