@blimu/backend 1.1.1 → 1.1.3

package/dist/services/{users.js → users.cjs}

@@ -23,6 +23,7 @@ __export(users_exports, {
   UsersService: () => UsersService
 });
 module.exports = __toCommonJS(users_exports);
+var import_fetch = require("@blimu/fetch");
 var UsersService = class {
   constructor(core) {
     this.core = core;
@@ -36,7 +37,7 @@ var UsersService = class {
       method: "GET",
       path: `/v1/users`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -48,7 +49,7 @@ var UsersService = class {
       method: "POST",
       path: `/v1/users`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -59,7 +60,7 @@ var UsersService = class {
     return this.core.request({
       method: "DELETE",
       path: `/v1/users/${encodeURIComponent(userId)}`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -70,7 +71,7 @@ var UsersService = class {
     return this.core.request({
       method: "GET",
       path: `/v1/users/${encodeURIComponent(userId)}`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -82,7 +83,7 @@ var UsersService = class {
       method: "PUT",
       path: `/v1/users/${encodeURIComponent(userId)}`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -93,7 +94,7 @@ var UsersService = class {
     return this.core.request({
       method: "GET",
       path: `/v1/users/${encodeURIComponent(userId)}/effective-user-resources-roles`,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };
@@ -101,4 +102,4 @@ var UsersService = class {
 0 && (module.exports = {
   UsersService
 });
-//# sourceMappingURL=users.js.map
+//# sourceMappingURL=users.cjs.map

package/dist/services/users.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/services/users.ts"],"sourcesContent":["import { FetchClient } from '@blimu/fetch';\nimport * as Schema from '../schema';\n\nexport class UsersService {\n  constructor(private core: FetchClient) {}\n\n  /**\n   * GET /v1/users*\n   * @summary List users*\n   * @description Retrieves a paginated list of users in your environment. Supports search functionality to filter users by email, name, or lookup key.*/\n  list(\n    query?: Schema.UsersListQuery,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.UserList> {\n    return this.core.request({\n      method: 'GET',\n      path: `/v1/users`,\n      query,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * POST /v1/users*\n   * @summary Create a user*\n   * @description Creates a new user in your environment. The lookupKey is a unique identifier that you can use to reference the user in your system. It should be stable and not change over time.*/\n  create(\n    body: Schema.UserCreateBody,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.User> {\n    return this.core.request({\n      method: 'POST',\n      path: `/v1/users`,\n      body,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * DELETE /v1/users/{userId}*\n   * @summary Delete a user*\n   * @description Deletes a user by their ID or lookup key. This operation is permanent and cannot be undone. Deleting a user will also remove all role assignments for that user.*/\n  delete(userId: string, init?: Omit<RequestInit, 'method' | 'body'>): Promise<unknown> {\n    return this.core.request({\n      method: 'DELETE',\n      path: `/v1/users/${encodeURIComponent(userId)}`,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * GET /v1/users/{userId}*\n   * @summary Get a user by ID*\n   * @description Retrieves a single user by their ID or lookup key. Returns user information including email, name, and metadata.*/\n  read(userId: string, init?: Omit<RequestInit, 'method' | 'body'>): Promise<Schema.User> {\n    return this.core.request({\n      method: 'GET',\n      path: `/v1/users/${encodeURIComponent(userId)}`,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * PUT /v1/users/{userId}*\n   * @summary Update a user*\n   * @description Updates an existing user. You can modify email, name, and other user properties. The lookupKey can be updated but should remain stable.*/\n  update(\n    userId: string,\n    body: Schema.UserUpdateBody,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.User> {\n    return this.core.request({\n      method: 'PUT',\n      path: `/v1/users/${encodeURIComponent(userId)}`,\n      body,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * GET /v1/users/{userId}/effective-user-resources-roles*\n   * @summary List effective user resources roles*\n   * @description Retrieves all resources and roles for a user, including inherited roles from parent resources. The response indicates whether each role is directly assigned or inherited through resource hierarchies.*/\n  listEffectiveUserResourcesRoles(\n    userId: string,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.UserResourceList> {\n    return this.core.request({\n      method: 'GET',\n      path: `/v1/users/${encodeURIComponent(userId)}/effective-user-resources-roles`,\n      ...(init ?? {}),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA4B;AAGrB,IAAM,eAAN,MAAmB;AAAA,EACxB,YAAoB,MAAmB;AAAnB;AAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxC,KACE,OACA,MAC0B;AAC1B,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,MACA,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OACE,MACA,MACsB;AACtB,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,MACA,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,QAAgB,MAA+D;AACpF,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAK,QAAgB,MAAmE;AACtF,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OACE,QACA,MACA,MACsB;AACtB,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C;AAAA,MACA,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gCACE,QACA,MACkC;AAClC,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/services/users.d.mts

@@ -1,11 +1,9 @@
-import { CoreClient } from '../client.mjs';
-import { A as UsersListQuery, D as UserList, F as UserCreateBody, G as User, H as UserUpdateBody, I as UserResourceList } from '../schema-B1usIXCr.mjs';
-import '@blimu/fetch';
-import '@blimu/types';
+import { FetchClient } from '@blimu/fetch';
+import { A as UsersListQuery, D as UserList, F as UserCreateBody, G as User, H as UserUpdateBody, I as UserResourceList } from '../schema-BbKn_i-U.mjs';
 
 declare class UsersService {
     private core;
-    constructor(core: CoreClient);
+    constructor(core: FetchClient);
     list(query?: UsersListQuery, init?: Omit<RequestInit, 'method' | 'body'>): Promise<UserList>;
     create(body: UserCreateBody, init?: Omit<RequestInit, 'method' | 'body'>): Promise<User>;
     delete(userId: string, init?: Omit<RequestInit, 'method' | 'body'>): Promise<unknown>;

package/dist/services/users.d.ts

@@ -1,11 +1,9 @@
-import { CoreClient } from '../client.js';
-import { A as UsersListQuery, D as UserList, F as UserCreateBody, G as User, H as UserUpdateBody, I as UserResourceList } from '../schema-B1usIXCr.js';
-import '@blimu/fetch';
-import '@blimu/types';
+import { FetchClient } from '@blimu/fetch';
+import { A as UsersListQuery, D as UserList, F as UserCreateBody, G as User, H as UserUpdateBody, I as UserResourceList } from '../schema-BbKn_i-U.js';
 
 declare class UsersService {
     private core;
-    constructor(core: CoreClient);
+    constructor(core: FetchClient);
     list(query?: UsersListQuery, init?: Omit<RequestInit, 'method' | 'body'>): Promise<UserList>;
     create(body: UserCreateBody, init?: Omit<RequestInit, 'method' | 'body'>): Promise<User>;
     delete(userId: string, init?: Omit<RequestInit, 'method' | 'body'>): Promise<unknown>;

package/dist/services/users.mjs

@@ -1,4 +1,5 @@
 // src/services/users.ts
+import "@blimu/fetch";
 var UsersService = class {
   constructor(core) {
     this.core = core;
@@ -12,7 +13,7 @@ var UsersService = class {
       method: "GET",
       path: `/v1/users`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -24,7 +25,7 @@ var UsersService = class {
       method: "POST",
       path: `/v1/users`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -35,7 +36,7 @@ var UsersService = class {
     return this.core.request({
       method: "DELETE",
       path: `/v1/users/${encodeURIComponent(userId)}`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -46,7 +47,7 @@ var UsersService = class {
     return this.core.request({
       method: "GET",
       path: `/v1/users/${encodeURIComponent(userId)}`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -58,7 +59,7 @@ var UsersService = class {
       method: "PUT",
       path: `/v1/users/${encodeURIComponent(userId)}`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -69,7 +70,7 @@ var UsersService = class {
     return this.core.request({
       method: "GET",
       path: `/v1/users/${encodeURIComponent(userId)}/effective-user-resources-roles`,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };

package/dist/services/users.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/services/users.ts"],"sourcesContent":["import { CoreClient } from '../client';\nimport * as Schema from '../schema';\n\nexport class UsersService {\n  constructor(private core: CoreClient) {}\n\n  /**\n   * GET /v1/users*\n   * @summary List users*\n   * @description Retrieves a paginated list of users in your environment. Supports search functionality to filter users by email, name, or lookup key.*/\n  list(\n    query?: Schema.UsersListQuery,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.UserList> {\n    return this.core.request({\n      method: 'GET',\n      path: `/v1/users`,\n      query,\n      ...(init || {}),\n    });\n  }\n\n  /**\n   * POST /v1/users*\n   * @summary Create a user*\n   * @description Creates a new user in your environment. The lookupKey is a unique identifier that you can use to reference the user in your system. It should be stable and not change over time.*/\n  create(\n    body: Schema.UserCreateBody,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.User> {\n    return this.core.request({\n      method: 'POST',\n      path: `/v1/users`,\n      body: body as any,\n      ...(init || {}),\n    });\n  }\n\n  /**\n   * DELETE /v1/users/{userId}*\n   * @summary Delete a user*\n   * @description Deletes a user by their ID or lookup key. This operation is permanent and cannot be undone. Deleting a user will also remove all role assignments for that user.*/\n  delete(\n    userId: string,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<unknown> {\n    return this.core.request({\n      method: 'DELETE',\n      path: `/v1/users/${encodeURIComponent(userId)}`,\n      ...(init || {}),\n    });\n  }\n\n  /**\n   * GET /v1/users/{userId}*\n   * @summary Get a user by ID*\n   * @description Retrieves a single user by their ID or lookup key. Returns user information including email, name, and metadata.*/\n  read(\n    userId: string,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.User> {\n    return this.core.request({\n      method: 'GET',\n      path: `/v1/users/${encodeURIComponent(userId)}`,\n      ...(init || {}),\n    });\n  }\n\n  /**\n   * PUT /v1/users/{userId}*\n   * @summary Update a user*\n   * @description Updates an existing user. You can modify email, name, and other user properties. The lookupKey can be updated but should remain stable.*/\n  update(\n    userId: string,\n    body: Schema.UserUpdateBody,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.User> {\n    return this.core.request({\n      method: 'PUT',\n      path: `/v1/users/${encodeURIComponent(userId)}`,\n      body: body as any,\n      ...(init || {}),\n    });\n  }\n\n  /**\n   * GET /v1/users/{userId}/effective-user-resources-roles*\n   * @summary List effective user resources roles*\n   * @description Retrieves all resources and roles for a user, including inherited roles from parent resources. The response indicates whether each role is directly assigned or inherited through resource hierarchies.*/\n  listEffectiveUserResourcesRoles(\n    userId: string,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.UserResourceList> {\n    return this.core.request({\n      method: 'GET',\n      path: `/v1/users/${encodeURIComponent(userId)}/effective-user-resources-roles`,\n      ...(init || {}),\n    });\n  }\n}\n"],"mappings":";AAGO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAAoB,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvC,KACE,OACA,MAC0B;AAC1B,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,MACA,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OACE,MACA,MACsB;AACtB,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,MACA,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OACE,QACA,MACkB;AAClB,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KACE,QACA,MACsB;AACtB,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OACE,QACA,MACA,MACsB;AACtB,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C;AAAA,MACA,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gCACE,QACA,MACkC;AAClC,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AACF;","names":[]}
+{"version":3,"sources":["../../src/services/users.ts"],"sourcesContent":["import { FetchClient } from '@blimu/fetch';\nimport * as Schema from '../schema';\n\nexport class UsersService {\n  constructor(private core: FetchClient) {}\n\n  /**\n   * GET /v1/users*\n   * @summary List users*\n   * @description Retrieves a paginated list of users in your environment. Supports search functionality to filter users by email, name, or lookup key.*/\n  list(\n    query?: Schema.UsersListQuery,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.UserList> {\n    return this.core.request({\n      method: 'GET',\n      path: `/v1/users`,\n      query,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * POST /v1/users*\n   * @summary Create a user*\n   * @description Creates a new user in your environment. The lookupKey is a unique identifier that you can use to reference the user in your system. It should be stable and not change over time.*/\n  create(\n    body: Schema.UserCreateBody,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.User> {\n    return this.core.request({\n      method: 'POST',\n      path: `/v1/users`,\n      body,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * DELETE /v1/users/{userId}*\n   * @summary Delete a user*\n   * @description Deletes a user by their ID or lookup key. This operation is permanent and cannot be undone. Deleting a user will also remove all role assignments for that user.*/\n  delete(userId: string, init?: Omit<RequestInit, 'method' | 'body'>): Promise<unknown> {\n    return this.core.request({\n      method: 'DELETE',\n      path: `/v1/users/${encodeURIComponent(userId)}`,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * GET /v1/users/{userId}*\n   * @summary Get a user by ID*\n   * @description Retrieves a single user by their ID or lookup key. Returns user information including email, name, and metadata.*/\n  read(userId: string, init?: Omit<RequestInit, 'method' | 'body'>): Promise<Schema.User> {\n    return this.core.request({\n      method: 'GET',\n      path: `/v1/users/${encodeURIComponent(userId)}`,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * PUT /v1/users/{userId}*\n   * @summary Update a user*\n   * @description Updates an existing user. You can modify email, name, and other user properties. The lookupKey can be updated but should remain stable.*/\n  update(\n    userId: string,\n    body: Schema.UserUpdateBody,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.User> {\n    return this.core.request({\n      method: 'PUT',\n      path: `/v1/users/${encodeURIComponent(userId)}`,\n      body,\n      ...(init ?? {}),\n    });\n  }\n\n  /**\n   * GET /v1/users/{userId}/effective-user-resources-roles*\n   * @summary List effective user resources roles*\n   * @description Retrieves all resources and roles for a user, including inherited roles from parent resources. The response indicates whether each role is directly assigned or inherited through resource hierarchies.*/\n  listEffectiveUserResourcesRoles(\n    userId: string,\n    init?: Omit<RequestInit, 'method' | 'body'>\n  ): Promise<Schema.UserResourceList> {\n    return this.core.request({\n      method: 'GET',\n      path: `/v1/users/${encodeURIComponent(userId)}/effective-user-resources-roles`,\n      ...(init ?? {}),\n    });\n  }\n}\n"],"mappings":";AAAA,OAA4B;AAGrB,IAAM,eAAN,MAAmB;AAAA,EACxB,YAAoB,MAAmB;AAAnB;AAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMxC,KACE,OACA,MAC0B;AAC1B,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,MACA,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OACE,MACA,MACsB;AACtB,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,MACA,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,QAAgB,MAA+D;AACpF,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAK,QAAgB,MAAmE;AACtF,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OACE,QACA,MACA,MACsB;AACtB,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C;AAAA,MACA,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gCACE,QACA,MACkC;AAClC,WAAO,KAAK,KAAK,QAAQ;AAAA,MACvB,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,CAAC;AAAA,MAC7C,GAAI,QAAQ,CAAC;AAAA,IACf,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/{token-verifier.js → token-verifier.cjs}

@@ -37,6 +37,7 @@ module.exports = __toCommonJS(token_verifier_exports);
 
 // src/client.ts
 var import_fetch = require("@blimu/fetch");
+var import_fetch2 = require("@blimu/fetch");
 
 // src/token-verifier.ts
 var crypto = __toESM(require("crypto"));
@@ -47,8 +48,7 @@ var TokenVerifier = class {
   runtimeApiUrl;
   constructor(options) {
     this.cacheTTL = options?.cacheTTL ?? 60 * 60 * 1e3;
-    const blimuAuthApiUrl = typeof process !== "undefined" && process.env.BLIMU_AUTH_API_URL ? process.env.BLIMU_AUTH_API_URL : void 0;
-    this.runtimeApiUrl = blimuAuthApiUrl ?? "https://api.blimu.dev";
+    this.runtimeApiUrl = options?.runtimeApiUrl ?? "https://api.blimu.dev";
   }
   /**
    * Fetch JWK Set from runtime-api
@@ -67,20 +67,14 @@ var TokenVerifier = class {
         ...headers
       }
     });
-    console.log(
-      `[TokenVerifier] \u{1F4E1} Response status: ${response.status} ${response.statusText}`
-    );
+    console.log(`[TokenVerifier] \u{1F4E1} Response status: ${response.status} ${response.statusText}`);
     if (!response.ok) {
       const errorText = await response.text();
-      console.error(
-        `[TokenVerifier] \u274C Failed to fetch JWKs: ${response.status} ${errorText}`
-      );
+      console.error(`[TokenVerifier] \u274C Failed to fetch JWKs: ${response.status} ${errorText}`);
       throw new import_fetch.FetchError("Failed to fetch JWKs", response.status, errorText);
     }
     const jwkSet = await response.json();
-    console.log(
-      `[TokenVerifier] \u2705 Successfully fetched JWK Set with ${jwkSet.keys.length} keys`
-    );
+    console.log(`[TokenVerifier] \u2705 Successfully fetched JWK Set with ${jwkSet.keys.length} keys`);
     return jwkSet;
   }
   /**
@@ -106,9 +100,7 @@ var TokenVerifier = class {
       console.log(`[TokenVerifier] \u2705 Using cached key for kid: ${kid}`);
       return cached.key;
     }
-    console.log(
-      `[TokenVerifier] \u{1F50D} Cache miss or expired. Fetching new key for kid: ${kid}`
-    );
+    console.log(`[TokenVerifier] \u{1F50D} Cache miss or expired. Fetching new key for kid: ${kid}`);
     const jwkSet = await this.fetchJWKSet(endpoint, headers);
     const jwk = jwkSet.keys.find((k) => k.kid === kid);
     if (!jwk) {
@@ -170,15 +162,8 @@ var TokenVerifier = class {
     }
     let publicKey;
     try {
-      publicKey = await this.getPublicKey(
-        header.kid,
-        cacheKey,
-        endpoint,
-        headers
-      );
-      console.log(
-        `[TokenVerifier] \u2705 Successfully retrieved public key for kid: ${header.kid}`
-      );
+      publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);
+      console.log(`[TokenVerifier] \u2705 Successfully retrieved public key for kid: ${header.kid}`);
     } catch (error) {
       console.error(
         `[TokenVerifier] \u274C Failed to get public key (first attempt): ${error instanceof Error ? error.message : String(error)}`
@@ -186,12 +171,7 @@ var TokenVerifier = class {
       this.clearCache(cacheKey);
       console.log(`[TokenVerifier] \u{1F504} Retrying after cache clear...`);
       try {
-        publicKey = await this.getPublicKey(
-          header.kid,
-          cacheKey,
-          endpoint,
-          headers
-        );
+        publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);
         console.log(
           `[TokenVerifier] \u2705 Successfully retrieved public key for kid: ${header.kid} (retry)`
         );
@@ -235,4 +215,4 @@ async function verifyToken(options) {
   TokenVerifier,
   verifyToken
 });
-//# sourceMappingURL=token-verifier.js.map
+//# sourceMappingURL=token-verifier.cjs.map

package/dist/token-verifier.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/token-verifier.ts","../src/client.ts"],"sourcesContent":["import { FetchError } from './client';\nimport * as crypto from 'crypto';\nimport * as jwt from 'jsonwebtoken';\n\nexport interface JWK {\n  kty: string;\n  use: string;\n  kid: string;\n  alg: string;\n  n: string;\n  e: string;\n}\n\nexport interface JWKSet {\n  keys: JWK[];\n}\n\ninterface CachedJWK {\n  key: crypto.KeyObject;\n  kid: string;\n  expiresAt: number;\n}\n\nexport interface VerifyTokenOptions {\n  url?: string; // Direct URL to JWK endpoint (for custom scenarios)\n  secretKey?: string; // API key/secret key - uses runtimeApiUrl + JWK endpoint\n  token: string;\n  runtimeApiUrl?: string | undefined; // Optional override for runtime API URL\n}\n\nexport interface TokenVerifierOptions {\n  runtimeApiUrl?: string | undefined;\n  cacheTTL?: number | undefined; // Default: 1 hour\n}\n\nexport class TokenVerifier {\n  private readonly cache = new Map<string, CachedJWK>();\n  private readonly cacheTTL: number;\n  private readonly runtimeApiUrl: string;\n\n  constructor(options?: TokenVerifierOptions) {\n    this.cacheTTL = options?.cacheTTL ?? 60 * 60 * 1000; // 1 hour\n\n    this.runtimeApiUrl = options?.runtimeApiUrl ?? 'https://api.blimu.dev';\n  }\n\n  /**\n   * Fetch JWK Set from runtime-api\n   */\n  private async fetchJWKSet(endpoint: string, headers?: Record<string, string>): Promise<JWKSet> {\n    console.log(`[TokenVerifier] 📡 Fetching JWK Set from: ${endpoint}`);\n    if (headers) {\n      console.log(\n        `[TokenVerifier] 📡 Request headers: ${JSON.stringify(Object.keys(headers).map((k) => `${k}: ${k === 'x-api-key' ? '***' : headers[k]}`))}`\n      );\n    }\n\n    const response = await fetch(endpoint, {\n      method: 'GET',\n      headers: {\n        'Content-Type': 'application/json',\n        ...headers,\n      },\n    });\n\n    console.log(`[TokenVerifier] 📡 Response status: ${response.status} ${response.statusText}`);\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      console.error(`[TokenVerifier] ❌ Failed to fetch JWKs: ${response.status} ${errorText}`);\n      throw new FetchError('Failed to fetch JWKs', response.status, errorText);\n    }\n\n    const jwkSet = (await response.json()) as JWKSet;\n    console.log(`[TokenVerifier] ✅ Successfully fetched JWK Set with ${jwkSet.keys.length} keys`);\n    return jwkSet;\n  }\n\n  /**\n   * Convert JWK to KeyObject\n   */\n  private jwkToKeyObject(jwk: JWK): crypto.KeyObject {\n    return crypto.createPublicKey({\n      key: {\n        kty: jwk.kty,\n        n: jwk.n,\n        e: jwk.e,\n        alg: jwk.alg,\n      },\n      format: 'jwk',\n    });\n  }\n\n  /**\n   * Get public key for a specific key ID\n   */\n  private async getPublicKey(\n    kid: string,\n    cacheKey: string,\n    endpoint: string,\n    headers?: Record<string, string>\n  ): Promise<crypto.KeyObject> {\n    // Check cache first\n    const cached = this.cache.get(cacheKey);\n    if (cached && cached.expiresAt > Date.now()) {\n      console.log(`[TokenVerifier] ✅ Using cached key for kid: ${kid}`);\n      return cached.key;\n    }\n\n    console.log(`[TokenVerifier] 🔍 Cache miss or expired. Fetching new key for kid: ${kid}`);\n\n    // Fetch JWK Set\n    const jwkSet = await this.fetchJWKSet(endpoint, headers);\n\n    // Find the key with matching kid\n    const jwk = jwkSet.keys.find((k) => k.kid === kid);\n    if (!jwk) {\n      const availableKids = jwkSet.keys.map((k) => k.kid).join(', ');\n      console.error(\n        `[TokenVerifier] ❌ Key with kid '${kid}' not found in JWK Set. Available kids: ${availableKids}`\n      );\n      throw new Error(\n        `Key with kid '${kid}' not found in JWK Set. Available kids: ${availableKids}`\n      );\n    }\n\n    console.log(`[TokenVerifier] ✅ Found key with kid: ${kid}`);\n\n    // Convert JWK to KeyObject\n    const keyObject = this.jwkToKeyObject(jwk);\n\n    // Cache the key\n    this.cache.set(cacheKey, {\n      key: keyObject,\n      kid,\n      expiresAt: Date.now() + this.cacheTTL,\n    });\n\n    return keyObject;\n  }\n\n  /**\n   * Verify JWT token using JWKs from runtime-api\n   */\n  async verifyToken<T = unknown>(options: VerifyTokenOptions): Promise<T> {\n    const { url, secretKey, token, runtimeApiUrl } = options;\n\n    if (!url && !secretKey) {\n      throw new Error('Either url or secretKey must be provided');\n    }\n\n    if (url && secretKey) {\n      throw new Error('Cannot provide both url and secretKey');\n    }\n\n    // Decode token header to get kid (without verification)\n    const decoded = jwt.decode(token, { complete: true });\n    if (!decoded || typeof decoded === 'string') {\n      throw new Error('Invalid token format');\n    }\n\n    const header = decoded.header;\n    if (!header.kid) {\n      throw new Error('Token missing kid in header');\n    }\n\n    let endpoint: string;\n    let cacheKey: string;\n    let headers: Record<string, string> | undefined;\n\n    if (secretKey) {\n      // Use secretKey with runtimeApiUrl\n      const apiUrl = runtimeApiUrl ?? this.runtimeApiUrl;\n      endpoint = `${apiUrl}/v1/auth/.well-known/jwks.json`;\n      cacheKey = secretKey;\n      headers = {\n        'x-api-key': secretKey,\n      };\n      console.log(\n        `[TokenVerifier] 🔍 Verifying token with kid: ${header.kid}, endpoint: ${endpoint}`\n      );\n    } else {\n      // Use direct URL\n      endpoint = url!;\n      cacheKey = url!;\n      console.log(\n        `[TokenVerifier] 🔍 Verifying token with kid: ${header.kid}, endpoint: ${endpoint}`\n      );\n    }\n\n    // Get public key for this kid\n    let publicKey: crypto.KeyObject;\n    try {\n      publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);\n      console.log(`[TokenVerifier] ✅ Successfully retrieved public key for kid: ${header.kid}`);\n    } catch (error) {\n      console.error(\n        `[TokenVerifier] ❌ Failed to get public key (first attempt): ${error instanceof Error ? error.message : String(error)}`\n      );\n      // If verification fails, clear cache and retry once (handles key rotation)\n      this.clearCache(cacheKey);\n      console.log(`[TokenVerifier] 🔄 Retrying after cache clear...`);\n      try {\n        publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);\n        console.log(\n          `[TokenVerifier] ✅ Successfully retrieved public key for kid: ${header.kid} (retry)`\n        );\n      } catch (retryError) {\n        console.error(\n          `[TokenVerifier] ❌ Failed to get public key (retry): ${retryError instanceof Error ? retryError.message : String(retryError)}`\n        );\n        throw retryError;\n      }\n    }\n\n    // Verify token\n    try {\n      const payload = jwt.verify(token, publicKey, {\n        algorithms: ['RS256'],\n      }) as T;\n      console.log(`[TokenVerifier] ✅ Token verified successfully`);\n      return payload;\n    } catch (error) {\n      console.error(\n        `[TokenVerifier] ❌ JWT verification failed: ${error instanceof Error ? error.message : String(error)}`\n      );\n      throw error;\n    }\n  }\n\n  /**\n   * Clear cache (useful for testing or key rotation)\n   */\n  clearCache(secretKeyOrUrl?: string): void {\n    if (secretKeyOrUrl) {\n      this.cache.delete(secretKeyOrUrl);\n    } else {\n      this.cache.clear();\n    }\n  }\n}\n\n/**\n * Convenience function to verify a token\n */\nexport async function verifyToken<T = unknown>(options: VerifyTokenOptions): Promise<T> {\n  const verifier = new TokenVerifier();\n  return verifier.verifyToken<T>(options);\n}\n","import { FetchClient, FetchError } from '@blimu/fetch';\nimport { type FetchClientConfig, type ApiKeyAuthStrategy } from '@blimu/fetch';\nimport { buildAuthStrategies } from './auth-strategies';\nimport { BulkResourcesService } from './services/bulk_resources';\nimport { BulkRolesService } from './services/bulk_roles';\nimport { EntitlementsService } from './services/entitlements';\nimport { PlansService } from './services/plans';\nimport { ResourceMembersService } from './services/resource_members';\nimport { ResourcesService } from './services/resources';\nimport { RolesService } from './services/roles';\nimport { UsageService } from './services/usage';\nimport { UsersService } from './services/users';\n\nexport type ClientOption = FetchClientConfig & {\n  apiKey?: ApiKeyAuthStrategy['key'];\n};\n\nexport class Blimu {\n  readonly bulkResources: BulkResourcesService;\n  readonly bulkRoles: BulkRolesService;\n  readonly entitlements: EntitlementsService;\n  readonly plans: PlansService;\n  readonly resourceMembers: ResourceMembersService;\n  readonly resources: ResourcesService;\n  readonly roles: RolesService;\n  readonly usage: UsageService;\n  readonly users: UsersService;\n\n  constructor(options?: ClientOption) {\n    const restCfg = { ...(options ?? {}) };\n    delete restCfg.apiKey;\n\n    const authStrategies = buildAuthStrategies(options ?? {});\n\n    const core = new FetchClient({\n      ...restCfg,\n      baseURL: options?.baseURL ?? 'https://api.blimu.dev',\n      ...(authStrategies.length > 0 ? { authStrategies } : {}),\n    });\n\n    this.bulkResources = new BulkResourcesService(core);\n    this.bulkRoles = new BulkRolesService(core);\n    this.entitlements = new EntitlementsService(core);\n    this.plans = new PlansService(core);\n    this.resourceMembers = new ResourceMembersService(core);\n    this.resources = new ResourcesService(core);\n    this.roles = new RolesService(core);\n    this.usage = new UsageService(core);\n    this.users = new UsersService(core);\n  }\n}\n\n// Re-export FetchError for backward compatibility\nexport { FetchError };\nexport const BlimuError = FetchError;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,mBAAwC;AACxC,IAAAA,gBAAgE;;;ADAhE,aAAwB;AACxB,UAAqB;AAiCd,IAAM,gBAAN,MAAoB;AAAA,EACR,QAAQ,oBAAI,IAAuB;AAAA,EACnC;AAAA,EACA;AAAA,EAEjB,YAAY,SAAgC;AAC1C,SAAK,WAAW,SAAS,YAAY,KAAK,KAAK;AAE/C,SAAK,gBAAgB,SAAS,iBAAiB;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,UAAkB,SAAmD;AAC7F,YAAQ,IAAI,oDAA6C,QAAQ,EAAE;AACnE,QAAI,SAAS;AACX,cAAQ;AAAA,QACN,8CAAuC,KAAK,UAAU,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,MAAM,cAAc,QAAQ,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAAA,MAC3I;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAED,YAAQ,IAAI,8CAAuC,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAE3F,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,cAAQ,MAAM,gDAA2C,SAAS,MAAM,IAAI,SAAS,EAAE;AACvF,YAAM,IAAI,wBAAW,wBAAwB,SAAS,QAAQ,SAAS;AAAA,IACzE;AAEA,UAAM,SAAU,MAAM,SAAS,KAAK;AACpC,YAAQ,IAAI,4DAAuD,OAAO,KAAK,MAAM,OAAO;AAC5F,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,KAA4B;AACjD,WAAc,uBAAgB;AAAA,MAC5B,KAAK;AAAA,QACH,KAAK,IAAI;AAAA,QACT,GAAG,IAAI;AAAA,QACP,GAAG,IAAI;AAAA,QACP,KAAK,IAAI;AAAA,MACX;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,aACZ,KACA,UACA,UACA,SAC2B;AAE3B,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,cAAQ,IAAI,oDAA+C,GAAG,EAAE;AAChE,aAAO,OAAO;AAAA,IAChB;AAEA,YAAQ,IAAI,8EAAuE,GAAG,EAAE;AAGxF,UAAM,SAAS,MAAM,KAAK,YAAY,UAAU,OAAO;AAGvD,UAAM,MAAM,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG;AACjD,QAAI,CAAC,KAAK;AACR,YAAM,gBAAgB,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,IAAI;AAC7D,cAAQ;AAAA,QACN,wCAAmC,GAAG,2CAA2C,aAAa;AAAA,MAChG;AACA,YAAM,IAAI;AAAA,QACR,iBAAiB,GAAG,2CAA2C,aAAa;AAAA,MAC9E;AAAA,IACF;AAEA,YAAQ,IAAI,8CAAyC,GAAG,EAAE;AAG1D,UAAM,YAAY,KAAK,eAAe,GAAG;AAGzC,SAAK,MAAM,IAAI,UAAU;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IAC/B,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAyB,SAAyC;AACtE,UAAM,EAAE,KAAK,WAAW,OAAO,cAAc,IAAI;AAEjD,QAAI,CAAC,OAAO,CAAC,WAAW;AACtB,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,QAAI,OAAO,WAAW;AACpB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAGA,UAAM,UAAc,WAAO,OAAO,EAAE,UAAU,KAAK,CAAC;AACpD,QAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AAEA,UAAM,SAAS,QAAQ;AACvB,QAAI,CAAC,OAAO,KAAK;AACf,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,WAAW;AAEb,YAAM,SAAS,iBAAiB,KAAK;AACrC,iBAAW,GAAG,MAAM;AACpB,iBAAW;AACX,gBAAU;AAAA,QACR,aAAa;AAAA,MACf;AACA,cAAQ;AAAA,QACN,uDAAgD,OAAO,GAAG,eAAe,QAAQ;AAAA,MACnF;AAAA,IACF,OAAO;AAEL,iBAAW;AACX,iBAAW;AACX,cAAQ;AAAA,QACN,uDAAgD,OAAO,GAAG,eAAe,QAAQ;AAAA,MACnF;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,KAAK,aAAa,OAAO,KAAK,UAAU,UAAU,OAAO;AAC3E,cAAQ,IAAI,qEAAgE,OAAO,GAAG,EAAE;AAAA,IAC1F,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,oEAA+D,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACvH;AAEA,WAAK,WAAW,QAAQ;AACxB,cAAQ,IAAI,yDAAkD;AAC9D,UAAI;AACF,oBAAY,MAAM,KAAK,aAAa,OAAO,KAAK,UAAU,UAAU,OAAO;AAC3E,gBAAQ;AAAA,UACN,qEAAgE,OAAO,GAAG;AAAA,QAC5E;AAAA,MACF,SAAS,YAAY;AACnB,gBAAQ;AAAA,UACN,4DAAuD,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU,CAAC;AAAA,QAC9H;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI;AACF,YAAM,UAAc,WAAO,OAAO,WAAW;AAAA,QAC3C,YAAY,CAAC,OAAO;AAAA,MACtB,CAAC;AACD,cAAQ,IAAI,oDAA+C;AAC3D,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,mDAA8C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACtG;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,gBAA+B;AACxC,QAAI,gBAAgB;AAClB,WAAK,MAAM,OAAO,cAAc;AAAA,IAClC,OAAO;AACL,WAAK,MAAM,MAAM;AAAA,IACnB;AAAA,EACF;AACF;AAKA,eAAsB,YAAyB,SAAyC;AACtF,QAAM,WAAW,IAAI,cAAc;AACnC,SAAO,SAAS,YAAe,OAAO;AACxC;","names":["import_fetch"]}

package/dist/token-verifier.d.mts

@@ -13,11 +13,11 @@ interface VerifyTokenOptions {
     url?: string;
     secretKey?: string;
     token: string;
-    runtimeApiUrl?: string;
+    runtimeApiUrl?: string | undefined;
 }
 interface TokenVerifierOptions {
-    runtimeApiUrl?: string;
-    cacheTTL?: number;
+    runtimeApiUrl?: string | undefined;
+    cacheTTL?: number | undefined;
 }
 declare class TokenVerifier {
     private readonly cache;
@@ -27,9 +27,9 @@ declare class TokenVerifier {
     private fetchJWKSet;
     private jwkToKeyObject;
     private getPublicKey;
-    verifyToken<T = any>(options: VerifyTokenOptions): Promise<T>;
+    verifyToken<T = unknown>(options: VerifyTokenOptions): Promise<T>;
     clearCache(secretKeyOrUrl?: string): void;
 }
-declare function verifyToken<T = any>(options: VerifyTokenOptions): Promise<T>;
+declare function verifyToken<T = unknown>(options: VerifyTokenOptions): Promise<T>;
 
 export { type JWK, type JWKSet, TokenVerifier, type TokenVerifierOptions, type VerifyTokenOptions, verifyToken };

package/dist/token-verifier.d.ts

@@ -13,11 +13,11 @@ interface VerifyTokenOptions {
     url?: string;
     secretKey?: string;
     token: string;
-    runtimeApiUrl?: string;
+    runtimeApiUrl?: string | undefined;
 }
 interface TokenVerifierOptions {
-    runtimeApiUrl?: string;
-    cacheTTL?: number;
+    runtimeApiUrl?: string | undefined;
+    cacheTTL?: number | undefined;
 }
 declare class TokenVerifier {
     private readonly cache;
@@ -27,9 +27,9 @@ declare class TokenVerifier {
     private fetchJWKSet;
     private jwkToKeyObject;
     private getPublicKey;
-    verifyToken<T = any>(options: VerifyTokenOptions): Promise<T>;
+    verifyToken<T = unknown>(options: VerifyTokenOptions): Promise<T>;
     clearCache(secretKeyOrUrl?: string): void;
 }
-declare function verifyToken<T = any>(options: VerifyTokenOptions): Promise<T>;
+declare function verifyToken<T = unknown>(options: VerifyTokenOptions): Promise<T>;
 
 export { type JWK, type JWKSet, TokenVerifier, type TokenVerifierOptions, type VerifyTokenOptions, verifyToken };

package/dist/token-verifier.mjs

@@ -1,8 +1,6 @@
 // src/client.ts
-import {
-  FetchClient,
-  FetchError
-} from "@blimu/fetch";
+import { FetchClient, FetchError } from "@blimu/fetch";
+import "@blimu/fetch";
 
 // src/token-verifier.ts
 import * as crypto from "crypto";
@@ -13,8 +11,7 @@ var TokenVerifier = class {
   runtimeApiUrl;
   constructor(options) {
     this.cacheTTL = options?.cacheTTL ?? 60 * 60 * 1e3;
-    const blimuAuthApiUrl = typeof process !== "undefined" && process.env.BLIMU_AUTH_API_URL ? process.env.BLIMU_AUTH_API_URL : void 0;
-    this.runtimeApiUrl = blimuAuthApiUrl ?? "https://api.blimu.dev";
+    this.runtimeApiUrl = options?.runtimeApiUrl ?? "https://api.blimu.dev";
   }
   /**
    * Fetch JWK Set from runtime-api
@@ -33,20 +30,14 @@ var TokenVerifier = class {
         ...headers
       }
     });
-    console.log(
-      `[TokenVerifier] \u{1F4E1} Response status: ${response.status} ${response.statusText}`
-    );
+    console.log(`[TokenVerifier] \u{1F4E1} Response status: ${response.status} ${response.statusText}`);
     if (!response.ok) {
       const errorText = await response.text();
-      console.error(
-        `[TokenVerifier] \u274C Failed to fetch JWKs: ${response.status} ${errorText}`
-      );
+      console.error(`[TokenVerifier] \u274C Failed to fetch JWKs: ${response.status} ${errorText}`);
       throw new FetchError("Failed to fetch JWKs", response.status, errorText);
     }
     const jwkSet = await response.json();
-    console.log(
-      `[TokenVerifier] \u2705 Successfully fetched JWK Set with ${jwkSet.keys.length} keys`
-    );
+    console.log(`[TokenVerifier] \u2705 Successfully fetched JWK Set with ${jwkSet.keys.length} keys`);
     return jwkSet;
   }
   /**
@@ -72,9 +63,7 @@ var TokenVerifier = class {
       console.log(`[TokenVerifier] \u2705 Using cached key for kid: ${kid}`);
       return cached.key;
     }
-    console.log(
-      `[TokenVerifier] \u{1F50D} Cache miss or expired. Fetching new key for kid: ${kid}`
-    );
+    console.log(`[TokenVerifier] \u{1F50D} Cache miss or expired. Fetching new key for kid: ${kid}`);
     const jwkSet = await this.fetchJWKSet(endpoint, headers);
     const jwk = jwkSet.keys.find((k) => k.kid === kid);
     if (!jwk) {
@@ -136,15 +125,8 @@ var TokenVerifier = class {
     }
     let publicKey;
     try {
-      publicKey = await this.getPublicKey(
-        header.kid,
-        cacheKey,
-        endpoint,
-        headers
-      );
-      console.log(
-        `[TokenVerifier] \u2705 Successfully retrieved public key for kid: ${header.kid}`
-      );
+      publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);
+      console.log(`[TokenVerifier] \u2705 Successfully retrieved public key for kid: ${header.kid}`);
     } catch (error) {
       console.error(
         `[TokenVerifier] \u274C Failed to get public key (first attempt): ${error instanceof Error ? error.message : String(error)}`
@@ -152,12 +134,7 @@ var TokenVerifier = class {
       this.clearCache(cacheKey);
       console.log(`[TokenVerifier] \u{1F504} Retrying after cache clear...`);
       try {
-        publicKey = await this.getPublicKey(
-          header.kid,
-          cacheKey,
-          endpoint,
-          headers
-        );
+        publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);
         console.log(
           `[TokenVerifier] \u2705 Successfully retrieved public key for kid: ${header.kid} (retry)`
         );

package/dist/token-verifier.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/token-verifier.ts"],"sourcesContent":["import {\n  FetchClient,\n  FetchError,\n  type FetchClientConfig,\n  type AuthStrategy,\n} from '@blimu/fetch';\n\nexport type ClientOption = FetchClientConfig & { apiKey?: string };\n\n// Re-export FetchError for backward compatibility\nexport { FetchError };\n\nexport class CoreClient extends FetchClient {\n  constructor(cfg: ClientOption = {}) {\n    // Build auth strategies from OpenAPI security schemes\n    const authStrategies: AuthStrategy[] = [];\n\n    // Extract auth and security scheme properties to avoid passing them to FetchClient\n    const { auth: _existingAuth, apiKey, ...restCfg } = cfg;\n    if (cfg?.apiKey) {\n      const apiKeyValue = cfg.apiKey;\n      authStrategies.push({\n        type: 'apiKey',\n        key: () => apiKeyValue,\n        location: 'header',\n        name: 'X-API-KEY',\n      });\n    } // Build final auth config (merge existing with new strategies)\n    const finalAuthStrategies = [\n      ...(_existingAuth?.strategies || []),\n      ...authStrategies,\n    ];\n\n    // Build fetchConfig, ensuring auth comes after restCfg spread to override any existing auth\n    const fetchConfig: FetchClientConfig = {\n      ...restCfg,\n      baseURL: cfg.baseURL ?? 'https://api.blimu.dev',\n      // Explicitly set auth after restCfg to ensure it's not overwritten\n      // (restCfg might have an auth property that we want to replace)\n      ...(finalAuthStrategies.length > 0\n        ? {\n            auth: {\n              strategies: finalAuthStrategies,\n            },\n          }\n        : {}),\n      // Hooks are passed through directly from FetchClientConfig (no mapping needed)\n    };\n\n    super(fetchConfig);\n  }\n\n  async request(\n    init: RequestInit & {\n      path: string;\n      method: string;\n      query?: Record<string, any>;\n    }\n  ) {\n    return await super.request(init);\n  }\n\n  async *requestStream<T = any>(\n    init: RequestInit & {\n      path: string;\n      method: string;\n      query?: Record<string, any>;\n      contentType: string;\n      streamingFormat?: 'sse' | 'ndjson' | 'chunked';\n    }\n  ): AsyncGenerator<T, void, unknown> {\n    yield* super.requestStream(init);\n  }\n}\n","import { FetchError } from 'client';\nimport * as crypto from 'crypto';\nimport * as jwt from 'jsonwebtoken';\n\nexport interface JWK {\n  kty: string;\n  use: string;\n  kid: string;\n  alg: string;\n  n: string;\n  e: string;\n}\n\nexport interface JWKSet {\n  keys: JWK[];\n}\n\ninterface CachedJWK {\n  key: crypto.KeyObject;\n  kid: string;\n  expiresAt: number;\n}\n\nexport interface VerifyTokenOptions {\n  url?: string; // Direct URL to JWK endpoint (for custom scenarios)\n  secretKey?: string; // API key/secret key - uses runtimeApiUrl + JWK endpoint\n  token: string;\n  runtimeApiUrl?: string; // Optional override for runtime API URL\n}\n\nexport interface TokenVerifierOptions {\n  runtimeApiUrl?: string; // Default from BLIMU_AUTH_API_URL env var\n  cacheTTL?: number; // Default: 1 hour\n}\n\nexport class TokenVerifier {\n  private readonly cache = new Map<string, CachedJWK>();\n  private readonly cacheTTL: number;\n  private readonly runtimeApiUrl: string;\n\n  constructor(options?: TokenVerifierOptions) {\n    this.cacheTTL = options?.cacheTTL ?? 60 * 60 * 1000; // 1 hour\n\n    const blimuAuthApiUrl =\n      typeof process !== 'undefined' && process.env.BLIMU_AUTH_API_URL\n        ? process.env.BLIMU_AUTH_API_URL\n        : undefined;\n\n    // if we have secretKey, we can call runtime-api directly, otherwise we need to use customer specific auth-api\n    this.runtimeApiUrl = blimuAuthApiUrl ?? 'https://api.blimu.dev';\n  }\n\n  /**\n   * Fetch JWK Set from runtime-api\n   */\n  private async fetchJWKSet(\n    endpoint: string,\n    headers?: Record<string, string>\n  ): Promise<JWKSet> {\n    console.log(`[TokenVerifier] 📡 Fetching JWK Set from: ${endpoint}`);\n    if (headers) {\n      console.log(\n        `[TokenVerifier] 📡 Request headers: ${JSON.stringify(Object.keys(headers).map((k) => `${k}: ${k === 'x-api-key' ? '***' : headers[k]}`))}`\n      );\n    }\n\n    const response = await fetch(endpoint, {\n      method: 'GET',\n      headers: {\n        'Content-Type': 'application/json',\n        ...headers,\n      },\n    });\n\n    console.log(\n      `[TokenVerifier] 📡 Response status: ${response.status} ${response.statusText}`\n    );\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      console.error(\n        `[TokenVerifier] ❌ Failed to fetch JWKs: ${response.status} ${errorText}`\n      );\n      throw new FetchError('Failed to fetch JWKs', response.status, errorText);\n    }\n\n    const jwkSet = (await response.json()) as JWKSet;\n    console.log(\n      `[TokenVerifier] ✅ Successfully fetched JWK Set with ${jwkSet.keys.length} keys`\n    );\n    return jwkSet;\n  }\n\n  /**\n   * Convert JWK to KeyObject\n   */\n  private jwkToKeyObject(jwk: JWK): crypto.KeyObject {\n    return crypto.createPublicKey({\n      key: {\n        kty: jwk.kty,\n        n: jwk.n,\n        e: jwk.e,\n        alg: jwk.alg,\n      },\n      format: 'jwk',\n    });\n  }\n\n  /**\n   * Get public key for a specific key ID\n   */\n  private async getPublicKey(\n    kid: string,\n    cacheKey: string,\n    endpoint: string,\n    headers?: Record<string, string>\n  ): Promise<crypto.KeyObject> {\n    // Check cache first\n    const cached = this.cache.get(cacheKey);\n    if (cached && cached.expiresAt > Date.now()) {\n      console.log(`[TokenVerifier] ✅ Using cached key for kid: ${kid}`);\n      return cached.key;\n    }\n\n    console.log(\n      `[TokenVerifier] 🔍 Cache miss or expired. Fetching new key for kid: ${kid}`\n    );\n\n    // Fetch JWK Set\n    const jwkSet = await this.fetchJWKSet(endpoint, headers);\n\n    // Find the key with matching kid\n    const jwk = jwkSet.keys.find((k) => k.kid === kid);\n    if (!jwk) {\n      const availableKids = jwkSet.keys.map((k) => k.kid).join(', ');\n      console.error(\n        `[TokenVerifier] ❌ Key with kid '${kid}' not found in JWK Set. Available kids: ${availableKids}`\n      );\n      throw new Error(\n        `Key with kid '${kid}' not found in JWK Set. Available kids: ${availableKids}`\n      );\n    }\n\n    console.log(`[TokenVerifier] ✅ Found key with kid: ${kid}`);\n\n    // Convert JWK to KeyObject\n    const keyObject = this.jwkToKeyObject(jwk);\n\n    // Cache the key\n    this.cache.set(cacheKey, {\n      key: keyObject,\n      kid,\n      expiresAt: Date.now() + this.cacheTTL,\n    });\n\n    return keyObject;\n  }\n\n  /**\n   * Verify JWT token using JWKs from runtime-api\n   */\n  async verifyToken<T = any>(options: VerifyTokenOptions): Promise<T> {\n    const { url, secretKey, token, runtimeApiUrl } = options;\n\n    if (!url && !secretKey) {\n      throw new Error('Either url or secretKey must be provided');\n    }\n\n    if (url && secretKey) {\n      throw new Error('Cannot provide both url and secretKey');\n    }\n\n    // Decode token header to get kid (without verification)\n    const decoded = jwt.decode(token, { complete: true });\n    if (!decoded || typeof decoded === 'string') {\n      throw new Error('Invalid token format');\n    }\n\n    const header = decoded.header;\n    if (!header.kid) {\n      throw new Error('Token missing kid in header');\n    }\n\n    let endpoint: string;\n    let cacheKey: string;\n    let headers: Record<string, string> | undefined;\n\n    if (secretKey) {\n      // Use secretKey with runtimeApiUrl\n      const apiUrl = runtimeApiUrl ?? this.runtimeApiUrl;\n      endpoint = `${apiUrl}/v1/auth/.well-known/jwks.json`;\n      cacheKey = secretKey;\n      headers = {\n        'x-api-key': secretKey,\n      };\n      console.log(\n        `[TokenVerifier] 🔍 Verifying token with kid: ${header.kid}, endpoint: ${endpoint}`\n      );\n    } else {\n      // Use direct URL\n      endpoint = url!;\n      cacheKey = url!;\n      console.log(\n        `[TokenVerifier] 🔍 Verifying token with kid: ${header.kid}, endpoint: ${endpoint}`\n      );\n    }\n\n    // Get public key for this kid\n    let publicKey: crypto.KeyObject;\n    try {\n      publicKey = await this.getPublicKey(\n        header.kid,\n        cacheKey,\n        endpoint,\n        headers\n      );\n      console.log(\n        `[TokenVerifier] ✅ Successfully retrieved public key for kid: ${header.kid}`\n      );\n    } catch (error) {\n      console.error(\n        `[TokenVerifier] ❌ Failed to get public key (first attempt): ${error instanceof Error ? error.message : String(error)}`\n      );\n      // If verification fails, clear cache and retry once (handles key rotation)\n      this.clearCache(cacheKey);\n      console.log(`[TokenVerifier] 🔄 Retrying after cache clear...`);\n      try {\n        publicKey = await this.getPublicKey(\n          header.kid,\n          cacheKey,\n          endpoint,\n          headers\n        );\n        console.log(\n          `[TokenVerifier] ✅ Successfully retrieved public key for kid: ${header.kid} (retry)`\n        );\n      } catch (retryError) {\n        console.error(\n          `[TokenVerifier] ❌ Failed to get public key (retry): ${retryError instanceof Error ? retryError.message : String(retryError)}`\n        );\n        throw retryError;\n      }\n    }\n\n    // Verify token\n    try {\n      const payload = jwt.verify(token, publicKey, {\n        algorithms: ['RS256'],\n      }) as T;\n      console.log(`[TokenVerifier] ✅ Token verified successfully`);\n      return payload;\n    } catch (error) {\n      console.error(\n        `[TokenVerifier] ❌ JWT verification failed: ${error instanceof Error ? error.message : String(error)}`\n      );\n      throw error;\n    }\n  }\n\n  /**\n   * Clear cache (useful for testing or key rotation)\n   */\n  clearCache(secretKeyOrUrl?: string): void {\n    if (secretKeyOrUrl) {\n      this.cache.delete(secretKeyOrUrl);\n    } else {\n      this.cache.clear();\n    }\n  }\n}\n\n/**\n * Convenience function to verify a token\n */\nexport async function verifyToken<T = any>(\n  options: VerifyTokenOptions\n): Promise<T> {\n  const verifier = new TokenVerifier();\n  return verifier.verifyToken<T>(options);\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;;;ACJP,YAAY,YAAY;AACxB,YAAY,SAAS;AAiCd,IAAM,gBAAN,MAAoB;AAAA,EACR,QAAQ,oBAAI,IAAuB;AAAA,EACnC;AAAA,EACA;AAAA,EAEjB,YAAY,SAAgC;AAC1C,SAAK,WAAW,SAAS,YAAY,KAAK,KAAK;AAE/C,UAAM,kBACJ,OAAO,YAAY,eAAe,QAAQ,IAAI,qBAC1C,QAAQ,IAAI,qBACZ;AAGN,SAAK,gBAAgB,mBAAmB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YACZ,UACA,SACiB;AACjB,YAAQ,IAAI,oDAA6C,QAAQ,EAAE;AACnE,QAAI,SAAS;AACX,cAAQ;AAAA,QACN,8CAAuC,KAAK,UAAU,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,MAAM,cAAc,QAAQ,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAAA,MAC3I;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAED,YAAQ;AAAA,MACN,8CAAuC,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,IAC/E;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,cAAQ;AAAA,QACN,gDAA2C,SAAS,MAAM,IAAI,SAAS;AAAA,MACzE;AACA,YAAM,IAAI,WAAW,wBAAwB,SAAS,QAAQ,SAAS;AAAA,IACzE;AAEA,UAAM,SAAU,MAAM,SAAS,KAAK;AACpC,YAAQ;AAAA,MACN,4DAAuD,OAAO,KAAK,MAAM;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,KAA4B;AACjD,WAAc,uBAAgB;AAAA,MAC5B,KAAK;AAAA,QACH,KAAK,IAAI;AAAA,QACT,GAAG,IAAI;AAAA,QACP,GAAG,IAAI;AAAA,QACP,KAAK,IAAI;AAAA,MACX;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,aACZ,KACA,UACA,UACA,SAC2B;AAE3B,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,cAAQ,IAAI,oDAA+C,GAAG,EAAE;AAChE,aAAO,OAAO;AAAA,IAChB;AAEA,YAAQ;AAAA,MACN,8EAAuE,GAAG;AAAA,IAC5E;AAGA,UAAM,SAAS,MAAM,KAAK,YAAY,UAAU,OAAO;AAGvD,UAAM,MAAM,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG;AACjD,QAAI,CAAC,KAAK;AACR,YAAM,gBAAgB,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,IAAI;AAC7D,cAAQ;AAAA,QACN,wCAAmC,GAAG,2CAA2C,aAAa;AAAA,MAChG;AACA,YAAM,IAAI;AAAA,QACR,iBAAiB,GAAG,2CAA2C,aAAa;AAAA,MAC9E;AAAA,IACF;AAEA,YAAQ,IAAI,8CAAyC,GAAG,EAAE;AAG1D,UAAM,YAAY,KAAK,eAAe,GAAG;AAGzC,SAAK,MAAM,IAAI,UAAU;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IAC/B,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAqB,SAAyC;AAClE,UAAM,EAAE,KAAK,WAAW,OAAO,cAAc,IAAI;AAEjD,QAAI,CAAC,OAAO,CAAC,WAAW;AACtB,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,QAAI,OAAO,WAAW;AACpB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAGA,UAAM,UAAc,WAAO,OAAO,EAAE,UAAU,KAAK,CAAC;AACpD,QAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AAEA,UAAM,SAAS,QAAQ;AACvB,QAAI,CAAC,OAAO,KAAK;AACf,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,WAAW;AAEb,YAAM,SAAS,iBAAiB,KAAK;AACrC,iBAAW,GAAG,MAAM;AACpB,iBAAW;AACX,gBAAU;AAAA,QACR,aAAa;AAAA,MACf;AACA,cAAQ;AAAA,QACN,uDAAgD,OAAO,GAAG,eAAe,QAAQ;AAAA,MACnF;AAAA,IACF,OAAO;AAEL,iBAAW;AACX,iBAAW;AACX,cAAQ;AAAA,QACN,uDAAgD,OAAO,GAAG,eAAe,QAAQ;AAAA,MACnF;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,KAAK;AAAA,QACrB,OAAO;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,cAAQ;AAAA,QACN,qEAAgE,OAAO,GAAG;AAAA,MAC5E;AAAA,IACF,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,oEAA+D,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACvH;AAEA,WAAK,WAAW,QAAQ;AACxB,cAAQ,IAAI,yDAAkD;AAC9D,UAAI;AACF,oBAAY,MAAM,KAAK;AAAA,UACrB,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,gBAAQ;AAAA,UACN,qEAAgE,OAAO,GAAG;AAAA,QAC5E;AAAA,MACF,SAAS,YAAY;AACnB,gBAAQ;AAAA,UACN,4DAAuD,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU,CAAC;AAAA,QAC9H;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI;AACF,YAAM,UAAc,WAAO,OAAO,WAAW;AAAA,QAC3C,YAAY,CAAC,OAAO;AAAA,MACtB,CAAC;AACD,cAAQ,IAAI,oDAA+C;AAC3D,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,mDAA8C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACtG;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,gBAA+B;AACxC,QAAI,gBAAgB;AAClB,WAAK,MAAM,OAAO,cAAc;AAAA,IAClC,OAAO;AACL,WAAK,MAAM,MAAM;AAAA,IACnB;AAAA,EACF;AACF;AAKA,eAAsB,YACpB,SACY;AACZ,QAAM,WAAW,IAAI,cAAc;AACnC,SAAO,SAAS,YAAe,OAAO;AACxC;","names":[]}
+{"version":3,"sources":["../src/client.ts","../src/token-verifier.ts"],"sourcesContent":["import { FetchClient, FetchError } from '@blimu/fetch';\nimport { type FetchClientConfig, type ApiKeyAuthStrategy } from '@blimu/fetch';\nimport { buildAuthStrategies } from './auth-strategies';\nimport { BulkResourcesService } from './services/bulk_resources';\nimport { BulkRolesService } from './services/bulk_roles';\nimport { EntitlementsService } from './services/entitlements';\nimport { PlansService } from './services/plans';\nimport { ResourceMembersService } from './services/resource_members';\nimport { ResourcesService } from './services/resources';\nimport { RolesService } from './services/roles';\nimport { UsageService } from './services/usage';\nimport { UsersService } from './services/users';\n\nexport type ClientOption = FetchClientConfig & {\n  apiKey?: ApiKeyAuthStrategy['key'];\n};\n\nexport class Blimu {\n  readonly bulkResources: BulkResourcesService;\n  readonly bulkRoles: BulkRolesService;\n  readonly entitlements: EntitlementsService;\n  readonly plans: PlansService;\n  readonly resourceMembers: ResourceMembersService;\n  readonly resources: ResourcesService;\n  readonly roles: RolesService;\n  readonly usage: UsageService;\n  readonly users: UsersService;\n\n  constructor(options?: ClientOption) {\n    const restCfg = { ...(options ?? {}) };\n    delete restCfg.apiKey;\n\n    const authStrategies = buildAuthStrategies(options ?? {});\n\n    const core = new FetchClient({\n      ...restCfg,\n      baseURL: options?.baseURL ?? 'https://api.blimu.dev',\n      ...(authStrategies.length > 0 ? { authStrategies } : {}),\n    });\n\n    this.bulkResources = new BulkResourcesService(core);\n    this.bulkRoles = new BulkRolesService(core);\n    this.entitlements = new EntitlementsService(core);\n    this.plans = new PlansService(core);\n    this.resourceMembers = new ResourceMembersService(core);\n    this.resources = new ResourcesService(core);\n    this.roles = new RolesService(core);\n    this.usage = new UsageService(core);\n    this.users = new UsersService(core);\n  }\n}\n\n// Re-export FetchError for backward compatibility\nexport { FetchError };\nexport const BlimuError = FetchError;\n","import { FetchError } from './client';\nimport * as crypto from 'crypto';\nimport * as jwt from 'jsonwebtoken';\n\nexport interface JWK {\n  kty: string;\n  use: string;\n  kid: string;\n  alg: string;\n  n: string;\n  e: string;\n}\n\nexport interface JWKSet {\n  keys: JWK[];\n}\n\ninterface CachedJWK {\n  key: crypto.KeyObject;\n  kid: string;\n  expiresAt: number;\n}\n\nexport interface VerifyTokenOptions {\n  url?: string; // Direct URL to JWK endpoint (for custom scenarios)\n  secretKey?: string; // API key/secret key - uses runtimeApiUrl + JWK endpoint\n  token: string;\n  runtimeApiUrl?: string | undefined; // Optional override for runtime API URL\n}\n\nexport interface TokenVerifierOptions {\n  runtimeApiUrl?: string | undefined;\n  cacheTTL?: number | undefined; // Default: 1 hour\n}\n\nexport class TokenVerifier {\n  private readonly cache = new Map<string, CachedJWK>();\n  private readonly cacheTTL: number;\n  private readonly runtimeApiUrl: string;\n\n  constructor(options?: TokenVerifierOptions) {\n    this.cacheTTL = options?.cacheTTL ?? 60 * 60 * 1000; // 1 hour\n\n    this.runtimeApiUrl = options?.runtimeApiUrl ?? 'https://api.blimu.dev';\n  }\n\n  /**\n   * Fetch JWK Set from runtime-api\n   */\n  private async fetchJWKSet(endpoint: string, headers?: Record<string, string>): Promise<JWKSet> {\n    console.log(`[TokenVerifier] 📡 Fetching JWK Set from: ${endpoint}`);\n    if (headers) {\n      console.log(\n        `[TokenVerifier] 📡 Request headers: ${JSON.stringify(Object.keys(headers).map((k) => `${k}: ${k === 'x-api-key' ? '***' : headers[k]}`))}`\n      );\n    }\n\n    const response = await fetch(endpoint, {\n      method: 'GET',\n      headers: {\n        'Content-Type': 'application/json',\n        ...headers,\n      },\n    });\n\n    console.log(`[TokenVerifier] 📡 Response status: ${response.status} ${response.statusText}`);\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      console.error(`[TokenVerifier] ❌ Failed to fetch JWKs: ${response.status} ${errorText}`);\n      throw new FetchError('Failed to fetch JWKs', response.status, errorText);\n    }\n\n    const jwkSet = (await response.json()) as JWKSet;\n    console.log(`[TokenVerifier] ✅ Successfully fetched JWK Set with ${jwkSet.keys.length} keys`);\n    return jwkSet;\n  }\n\n  /**\n   * Convert JWK to KeyObject\n   */\n  private jwkToKeyObject(jwk: JWK): crypto.KeyObject {\n    return crypto.createPublicKey({\n      key: {\n        kty: jwk.kty,\n        n: jwk.n,\n        e: jwk.e,\n        alg: jwk.alg,\n      },\n      format: 'jwk',\n    });\n  }\n\n  /**\n   * Get public key for a specific key ID\n   */\n  private async getPublicKey(\n    kid: string,\n    cacheKey: string,\n    endpoint: string,\n    headers?: Record<string, string>\n  ): Promise<crypto.KeyObject> {\n    // Check cache first\n    const cached = this.cache.get(cacheKey);\n    if (cached && cached.expiresAt > Date.now()) {\n      console.log(`[TokenVerifier] ✅ Using cached key for kid: ${kid}`);\n      return cached.key;\n    }\n\n    console.log(`[TokenVerifier] 🔍 Cache miss or expired. Fetching new key for kid: ${kid}`);\n\n    // Fetch JWK Set\n    const jwkSet = await this.fetchJWKSet(endpoint, headers);\n\n    // Find the key with matching kid\n    const jwk = jwkSet.keys.find((k) => k.kid === kid);\n    if (!jwk) {\n      const availableKids = jwkSet.keys.map((k) => k.kid).join(', ');\n      console.error(\n        `[TokenVerifier] ❌ Key with kid '${kid}' not found in JWK Set. Available kids: ${availableKids}`\n      );\n      throw new Error(\n        `Key with kid '${kid}' not found in JWK Set. Available kids: ${availableKids}`\n      );\n    }\n\n    console.log(`[TokenVerifier] ✅ Found key with kid: ${kid}`);\n\n    // Convert JWK to KeyObject\n    const keyObject = this.jwkToKeyObject(jwk);\n\n    // Cache the key\n    this.cache.set(cacheKey, {\n      key: keyObject,\n      kid,\n      expiresAt: Date.now() + this.cacheTTL,\n    });\n\n    return keyObject;\n  }\n\n  /**\n   * Verify JWT token using JWKs from runtime-api\n   */\n  async verifyToken<T = unknown>(options: VerifyTokenOptions): Promise<T> {\n    const { url, secretKey, token, runtimeApiUrl } = options;\n\n    if (!url && !secretKey) {\n      throw new Error('Either url or secretKey must be provided');\n    }\n\n    if (url && secretKey) {\n      throw new Error('Cannot provide both url and secretKey');\n    }\n\n    // Decode token header to get kid (without verification)\n    const decoded = jwt.decode(token, { complete: true });\n    if (!decoded || typeof decoded === 'string') {\n      throw new Error('Invalid token format');\n    }\n\n    const header = decoded.header;\n    if (!header.kid) {\n      throw new Error('Token missing kid in header');\n    }\n\n    let endpoint: string;\n    let cacheKey: string;\n    let headers: Record<string, string> | undefined;\n\n    if (secretKey) {\n      // Use secretKey with runtimeApiUrl\n      const apiUrl = runtimeApiUrl ?? this.runtimeApiUrl;\n      endpoint = `${apiUrl}/v1/auth/.well-known/jwks.json`;\n      cacheKey = secretKey;\n      headers = {\n        'x-api-key': secretKey,\n      };\n      console.log(\n        `[TokenVerifier] 🔍 Verifying token with kid: ${header.kid}, endpoint: ${endpoint}`\n      );\n    } else {\n      // Use direct URL\n      endpoint = url!;\n      cacheKey = url!;\n      console.log(\n        `[TokenVerifier] 🔍 Verifying token with kid: ${header.kid}, endpoint: ${endpoint}`\n      );\n    }\n\n    // Get public key for this kid\n    let publicKey: crypto.KeyObject;\n    try {\n      publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);\n      console.log(`[TokenVerifier] ✅ Successfully retrieved public key for kid: ${header.kid}`);\n    } catch (error) {\n      console.error(\n        `[TokenVerifier] ❌ Failed to get public key (first attempt): ${error instanceof Error ? error.message : String(error)}`\n      );\n      // If verification fails, clear cache and retry once (handles key rotation)\n      this.clearCache(cacheKey);\n      console.log(`[TokenVerifier] 🔄 Retrying after cache clear...`);\n      try {\n        publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);\n        console.log(\n          `[TokenVerifier] ✅ Successfully retrieved public key for kid: ${header.kid} (retry)`\n        );\n      } catch (retryError) {\n        console.error(\n          `[TokenVerifier] ❌ Failed to get public key (retry): ${retryError instanceof Error ? retryError.message : String(retryError)}`\n        );\n        throw retryError;\n      }\n    }\n\n    // Verify token\n    try {\n      const payload = jwt.verify(token, publicKey, {\n        algorithms: ['RS256'],\n      }) as T;\n      console.log(`[TokenVerifier] ✅ Token verified successfully`);\n      return payload;\n    } catch (error) {\n      console.error(\n        `[TokenVerifier] ❌ JWT verification failed: ${error instanceof Error ? error.message : String(error)}`\n      );\n      throw error;\n    }\n  }\n\n  /**\n   * Clear cache (useful for testing or key rotation)\n   */\n  clearCache(secretKeyOrUrl?: string): void {\n    if (secretKeyOrUrl) {\n      this.cache.delete(secretKeyOrUrl);\n    } else {\n      this.cache.clear();\n    }\n  }\n}\n\n/**\n * Convenience function to verify a token\n */\nexport async function verifyToken<T = unknown>(options: VerifyTokenOptions): Promise<T> {\n  const verifier = new TokenVerifier();\n  return verifier.verifyToken<T>(options);\n}\n"],"mappings":";AAAA,SAAS,aAAa,kBAAkB;AACxC,OAAgE;;;ACAhE,YAAY,YAAY;AACxB,YAAY,SAAS;AAiCd,IAAM,gBAAN,MAAoB;AAAA,EACR,QAAQ,oBAAI,IAAuB;AAAA,EACnC;AAAA,EACA;AAAA,EAEjB,YAAY,SAAgC;AAC1C,SAAK,WAAW,SAAS,YAAY,KAAK,KAAK;AAE/C,SAAK,gBAAgB,SAAS,iBAAiB;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,UAAkB,SAAmD;AAC7F,YAAQ,IAAI,oDAA6C,QAAQ,EAAE;AACnE,QAAI,SAAS;AACX,cAAQ;AAAA,QACN,8CAAuC,KAAK,UAAU,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,MAAM,cAAc,QAAQ,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAAA,MAC3I;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAED,YAAQ,IAAI,8CAAuC,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAE3F,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,cAAQ,MAAM,gDAA2C,SAAS,MAAM,IAAI,SAAS,EAAE;AACvF,YAAM,IAAI,WAAW,wBAAwB,SAAS,QAAQ,SAAS;AAAA,IACzE;AAEA,UAAM,SAAU,MAAM,SAAS,KAAK;AACpC,YAAQ,IAAI,4DAAuD,OAAO,KAAK,MAAM,OAAO;AAC5F,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,KAA4B;AACjD,WAAc,uBAAgB;AAAA,MAC5B,KAAK;AAAA,QACH,KAAK,IAAI;AAAA,QACT,GAAG,IAAI;AAAA,QACP,GAAG,IAAI;AAAA,QACP,KAAK,IAAI;AAAA,MACX;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,aACZ,KACA,UACA,UACA,SAC2B;AAE3B,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,cAAQ,IAAI,oDAA+C,GAAG,EAAE;AAChE,aAAO,OAAO;AAAA,IAChB;AAEA,YAAQ,IAAI,8EAAuE,GAAG,EAAE;AAGxF,UAAM,SAAS,MAAM,KAAK,YAAY,UAAU,OAAO;AAGvD,UAAM,MAAM,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG;AACjD,QAAI,CAAC,KAAK;AACR,YAAM,gBAAgB,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,IAAI;AAC7D,cAAQ;AAAA,QACN,wCAAmC,GAAG,2CAA2C,aAAa;AAAA,MAChG;AACA,YAAM,IAAI;AAAA,QACR,iBAAiB,GAAG,2CAA2C,aAAa;AAAA,MAC9E;AAAA,IACF;AAEA,YAAQ,IAAI,8CAAyC,GAAG,EAAE;AAG1D,UAAM,YAAY,KAAK,eAAe,GAAG;AAGzC,SAAK,MAAM,IAAI,UAAU;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IAC/B,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAyB,SAAyC;AACtE,UAAM,EAAE,KAAK,WAAW,OAAO,cAAc,IAAI;AAEjD,QAAI,CAAC,OAAO,CAAC,WAAW;AACtB,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AAEA,QAAI,OAAO,WAAW;AACpB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAGA,UAAM,UAAc,WAAO,OAAO,EAAE,UAAU,KAAK,CAAC;AACpD,QAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AAEA,UAAM,SAAS,QAAQ;AACvB,QAAI,CAAC,OAAO,KAAK;AACf,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,QAAI;AACJ,QAAI;AACJ,QAAI;AAEJ,QAAI,WAAW;AAEb,YAAM,SAAS,iBAAiB,KAAK;AACrC,iBAAW,GAAG,MAAM;AACpB,iBAAW;AACX,gBAAU;AAAA,QACR,aAAa;AAAA,MACf;AACA,cAAQ;AAAA,QACN,uDAAgD,OAAO,GAAG,eAAe,QAAQ;AAAA,MACnF;AAAA,IACF,OAAO;AAEL,iBAAW;AACX,iBAAW;AACX,cAAQ;AAAA,QACN,uDAAgD,OAAO,GAAG,eAAe,QAAQ;AAAA,MACnF;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,KAAK,aAAa,OAAO,KAAK,UAAU,UAAU,OAAO;AAC3E,cAAQ,IAAI,qEAAgE,OAAO,GAAG,EAAE;AAAA,IAC1F,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,oEAA+D,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACvH;AAEA,WAAK,WAAW,QAAQ;AACxB,cAAQ,IAAI,yDAAkD;AAC9D,UAAI;AACF,oBAAY,MAAM,KAAK,aAAa,OAAO,KAAK,UAAU,UAAU,OAAO;AAC3E,gBAAQ;AAAA,UACN,qEAAgE,OAAO,GAAG;AAAA,QAC5E;AAAA,MACF,SAAS,YAAY;AACnB,gBAAQ;AAAA,UACN,4DAAuD,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU,CAAC;AAAA,QAC9H;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI;AACF,YAAM,UAAc,WAAO,OAAO,WAAW;AAAA,QAC3C,YAAY,CAAC,OAAO;AAAA,MACtB,CAAC;AACD,cAAQ,IAAI,oDAA+C;AAC3D,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,mDAA8C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACtG;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,gBAA+B;AACxC,QAAI,gBAAgB;AAClB,WAAK,MAAM,OAAO,cAAc;AAAA,IAClC,OAAO;AACL,WAAK,MAAM,MAAM;AAAA,IACnB;AAAA,EACF;AACF;AAKA,eAAsB,YAAyB,SAAyC;AACtF,QAAM,WAAW,IAAI,cAAc;AACnC,SAAO,SAAS,YAAe,OAAO;AACxC;","names":[]}