@blimu/backend 1.1.1 → 1.1.4

package/dist/index.mjs

@@ -5,48 +5,28 @@ var __export = (target, all) => {
 };
 
 // src/client.ts
-import {
-  FetchClient,
-  FetchError
-} from "@blimu/fetch";
-var CoreClient = class extends FetchClient {
-  constructor(cfg = {}) {
-    const authStrategies = [];
-    const { auth: _existingAuth, apiKey, ...restCfg } = cfg;
-    if (cfg?.apiKey) {
-      const apiKeyValue = cfg.apiKey;
-      authStrategies.push({
-        type: "apiKey",
-        key: () => apiKeyValue,
-        location: "header",
-        name: "X-API-KEY"
-      });
-    }
-    const finalAuthStrategies = [
-      ..._existingAuth?.strategies || [],
-      ...authStrategies
-    ];
-    const fetchConfig = {
-      ...restCfg,
-      baseURL: cfg.baseURL ?? "https://api.blimu.dev",
-      // Explicitly set auth after restCfg to ensure it's not overwritten
-      // (restCfg might have an auth property that we want to replace)
-      ...finalAuthStrategies.length > 0 ? {
-        auth: {
-          strategies: finalAuthStrategies
-        }
-      } : {}
-      // Hooks are passed through directly from FetchClientConfig (no mapping needed)
-    };
-    super(fetchConfig);
-  }
-  async request(init) {
-    return await super.request(init);
-  }
-  async *requestStream(init) {
-    yield* super.requestStream(init);
+import { FetchClient as FetchClient10, FetchError } from "@blimu/fetch";
+import "@blimu/fetch";
+
+// src/auth-strategies.ts
+function buildAuthStrategies(cfg) {
+  const authStrategies = [...cfg?.authStrategies ?? []];
+  if (cfg.apiKey) {
+    authStrategies.push({
+      type: "apiKey",
+      key: cfg.apiKey,
+      location: "header",
+      name: "X-API-KEY"
+    });
   }
-};
+  return authStrategies;
+}
+
+// src/services/bulk_resources.ts
+import "@blimu/fetch";
+
+// src/schema.ts
+var schema_exports = {};
 
 // src/services/bulk_resources.ts
 var BulkResourcesService = class {
@@ -62,12 +42,13 @@ var BulkResourcesService = class {
       method: "POST",
       path: `/v1/resources/${encodeURIComponent(resourceType)}/bulk`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };
 
 // src/services/bulk_roles.ts
+import "@blimu/fetch";
 var BulkRolesService = class {
   constructor(core) {
     this.core = core;
@@ -81,12 +62,13 @@ var BulkRolesService = class {
       method: "POST",
       path: `/v1/users/roles/bulk`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };
 
 // src/services/entitlements.ts
+import "@blimu/fetch";
 var EntitlementsService = class {
   constructor(core) {
     this.core = core;
@@ -100,7 +82,7 @@ var EntitlementsService = class {
       method: "POST",
       path: `/v1/entitlements/check`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -112,7 +94,7 @@ var EntitlementsService = class {
       method: "GET",
       path: `/v1/entitlements/list-for-resource/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -124,12 +106,13 @@ var EntitlementsService = class {
       method: "GET",
       path: `/v1/entitlements/list-for-tenant/${encodeURIComponent(tenantResourceId)}`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };
 
 // src/services/plans.ts
+import "@blimu/fetch";
 var PlansService = class {
   constructor(core) {
     this.core = core;
@@ -142,7 +125,7 @@ var PlansService = class {
     return this.core.request({
       method: "DELETE",
       path: `/v1/resources/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}/plan`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -153,7 +136,7 @@ var PlansService = class {
     return this.core.request({
       method: "GET",
       path: `/v1/resources/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}/plan`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -165,12 +148,13 @@ var PlansService = class {
       method: "POST",
       path: `/v1/resources/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}/plan`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };
 
 // src/services/resource_members.ts
+import "@blimu/fetch";
 var ResourceMembersService = class {
   constructor(core) {
     this.core = core;
@@ -184,12 +168,13 @@ var ResourceMembersService = class {
       method: "GET",
       path: `/v1/resources/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}/members`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };
 
 // src/services/resources.ts
+import "@blimu/fetch";
 var ResourcesService = class {
   constructor(core) {
     this.core = core;
@@ -203,7 +188,7 @@ var ResourcesService = class {
       method: "GET",
       path: `/v1/resources/${encodeURIComponent(resourceType)}`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -215,7 +200,7 @@ var ResourcesService = class {
       method: "POST",
       path: `/v1/resources/${encodeURIComponent(resourceType)}`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -226,7 +211,7 @@ var ResourcesService = class {
     return this.core.request({
       method: "DELETE",
       path: `/v1/resources/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -237,7 +222,7 @@ var ResourcesService = class {
     return this.core.request({
       method: "GET",
       path: `/v1/resources/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -249,12 +234,13 @@ var ResourcesService = class {
       method: "PUT",
       path: `/v1/resources/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };
 
 // src/services/roles.ts
+import "@blimu/fetch";
 var RolesService = class {
   constructor(core) {
     this.core = core;
@@ -268,7 +254,7 @@ var RolesService = class {
       method: "GET",
       path: `/v1/users/${encodeURIComponent(userId)}/roles`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -280,7 +266,7 @@ var RolesService = class {
       method: "POST",
       path: `/v1/users/${encodeURIComponent(userId)}/roles`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -291,12 +277,13 @@ var RolesService = class {
     return this.core.request({
       method: "DELETE",
       path: `/v1/users/${encodeURIComponent(userId)}/roles/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}`,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };
 
 // src/services/usage.ts
+import "@blimu/fetch";
 var UsageService = class {
   constructor(core) {
     this.core = core;
@@ -310,7 +297,7 @@ var UsageService = class {
       method: "GET",
       path: `/v1/usage/balance/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}/${encodeURIComponent(limitType)}`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -322,7 +309,7 @@ var UsageService = class {
       method: "POST",
       path: `/v1/usage/check`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -334,7 +321,7 @@ var UsageService = class {
       method: "POST",
       path: `/v1/usage/consume`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -346,7 +333,7 @@ var UsageService = class {
       method: "POST",
       path: `/v1/usage/credit`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -358,12 +345,13 @@ var UsageService = class {
       method: "GET",
       path: `/v1/usage/transactions/${encodeURIComponent(resourceType)}/${encodeURIComponent(resourceId)}/${encodeURIComponent(limitType)}`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
 };
 
 // src/services/users.ts
+import "@blimu/fetch";
 var UsersService = class {
   constructor(core) {
     this.core = core;
@@ -377,7 +365,7 @@ var UsersService = class {
       method: "GET",
       path: `/v1/users`,
       query,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -389,7 +377,7 @@ var UsersService = class {
       method: "POST",
       path: `/v1/users`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -400,7 +388,7 @@ var UsersService = class {
     return this.core.request({
       method: "DELETE",
       path: `/v1/users/${encodeURIComponent(userId)}`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -411,7 +399,7 @@ var UsersService = class {
     return this.core.request({
       method: "GET",
       path: `/v1/users/${encodeURIComponent(userId)}`,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -423,7 +411,7 @@ var UsersService = class {
       method: "PUT",
       path: `/v1/users/${encodeURIComponent(userId)}`,
       body,
-      ...init || {}
+      ...init ?? {}
     });
   }
   /**
@@ -434,10 +422,43 @@ var UsersService = class {
     return this.core.request({
       method: "GET",
       path: `/v1/users/${encodeURIComponent(userId)}/effective-user-resources-roles`,
-      ...init || {}
+      ...init ?? {}
+    });
+  }
+};
+
+// src/client.ts
+var Blimu = class {
+  bulkResources;
+  bulkRoles;
+  entitlements;
+  plans;
+  resourceMembers;
+  resources;
+  roles;
+  usage;
+  users;
+  constructor(options) {
+    const restCfg = { ...options ?? {} };
+    delete restCfg.apiKey;
+    const authStrategies = buildAuthStrategies(options ?? {});
+    const core = new FetchClient10({
+      ...restCfg,
+      baseURL: options?.baseURL ?? "https://api.blimu.dev",
+      ...authStrategies.length > 0 ? { authStrategies } : {}
     });
+    this.bulkResources = new BulkResourcesService(core);
+    this.bulkRoles = new BulkRolesService(core);
+    this.entitlements = new EntitlementsService(core);
+    this.plans = new PlansService(core);
+    this.resourceMembers = new ResourceMembersService(core);
+    this.resources = new ResourcesService(core);
+    this.roles = new RolesService(core);
+    this.usage = new UsageService(core);
+    this.users = new UsersService(core);
   }
 };
+var BlimuError = FetchError;
 
 // src/index.ts
 export * from "@blimu/fetch";
@@ -460,13 +481,14 @@ async function* paginate(fetchPage, initialQuery = {}, pageSize = 100) {
 }
 async function listAll(fetchPage, query = {}, pageSize = 100) {
   const out = [];
-  for await (const item of paginate(fetchPage, query, pageSize))
-    out.push(item);
+  for await (const item of paginate(fetchPage, query, pageSize)) out.push(item);
   return out;
 }
-
-// src/schema.ts
-var schema_exports = {};
+function isNotUndefined(arr) {
+  return arr.filter(
+    (item) => item !== void 0
+  );
+}
 
 // src/schema.zod.ts
 var schema_zod_exports = {};
@@ -475,15 +497,12 @@ __export(schema_zod_exports, {
   CheckLimitResponseSchema: () => CheckLimitResponseSchema,
   EntitlementCheckBodySchema: () => EntitlementCheckBodySchema,
   EntitlementCheckResultSchema: () => EntitlementCheckResultSchema,
-  EntitlementTypeSchema: () => EntitlementTypeSchema,
   EntitlementsListForResourceQuerySchema: () => EntitlementsListForResourceQuerySchema,
   EntitlementsListForTenantQuerySchema: () => EntitlementsListForTenantQuerySchema,
   EntitlementsListResultSchema: () => EntitlementsListResultSchema,
-  LimitTypeSchema: () => LimitTypeSchema,
   PlanAssignBodySchema: () => PlanAssignBodySchema,
   PlanDeleteResponseSchema: () => PlanDeleteResponseSchema,
   PlanResponseSchema: () => PlanResponseSchema,
-  PlanTypeSchema: () => PlanTypeSchema,
   ResourceBulkCreateBodySchema: () => ResourceBulkCreateBodySchema,
   ResourceBulkResultSchema: () => ResourceBulkResultSchema,
   ResourceCreateBodySchema: () => ResourceCreateBodySchema,
@@ -491,7 +510,6 @@ __export(schema_zod_exports, {
   ResourceMemberListSchema: () => ResourceMemberListSchema,
   ResourceMembersListQuerySchema: () => ResourceMembersListQuerySchema,
   ResourceSchema: () => ResourceSchema,
-  ResourceTypeSchema: () => ResourceTypeSchema,
   ResourceUpdateBodySchema: () => ResourceUpdateBodySchema,
   ResourcesListQuerySchema: () => ResourcesListQuerySchema,
   RoleBulkCreateBodySchema: () => RoleBulkCreateBodySchema,
@@ -506,7 +524,6 @@ __export(schema_zod_exports, {
   UsageCreditBodySchema: () => UsageCreditBodySchema,
   UsageGetBalanceQuerySchema: () => UsageGetBalanceQuerySchema,
   UsageGetTransactionHistoryQuerySchema: () => UsageGetTransactionHistoryQuerySchema,
-  UsageLimitTypeSchema: () => UsageLimitTypeSchema,
   UsageWalletResponseSchema: () => UsageWalletResponseSchema,
   UserCreateBodySchema: () => UserCreateBodySchema,
   UserListSchema: () => UserListSchema,
@@ -516,11 +533,6 @@ __export(schema_zod_exports, {
   UsersListQuerySchema: () => UsersListQuerySchema
 });
 import { z } from "zod";
-var EntitlementTypeSchema = z.string();
-var LimitTypeSchema = z.string();
-var PlanTypeSchema = z.string();
-var ResourceTypeSchema = z.string();
-var UsageLimitTypeSchema = z.string();
 var BalanceResponseSchema = z.object({ balance: z.number() });
 var CheckLimitResponseSchema = z.object({
   allowed: z.boolean(),
@@ -530,7 +542,7 @@ var CheckLimitResponseSchema = z.object({
 });
 var EntitlementCheckBodySchema = z.object({
   amount: z.number().int().optional(),
-  entitlement: EntitlementTypeSchema,
+  entitlement: z.string(),
   resourceId: z.string(),
   userId: z.string()
 });
@@ -547,109 +559,89 @@ var EntitlementCheckResultSchema = z.object({
   }).nullable().optional(),
   plans: z.object({
     allowed: z.boolean(),
-    allowedPlans: z.array(z.string()).optional(),
+    allowedPlans: z.string().array().optional(),
     plan: z.string().nullable().optional(),
     reason: z.string().optional()
   }).nullable().optional(),
   roles: z.object({
     allowed: z.boolean(),
-    allowedRoles: z.array(z.string()).optional(),
+    allowedRoles: z.string().array().optional(),
     reason: z.string().optional(),
-    userRoles: z.array(z.string()).optional()
+    userRoles: z.string().array().optional()
   }).nullable().optional()
 });
 var EntitlementsListResultSchema = z.object({
-  results: z.array(
-    z.object({
-      entitlements: z.array(
-        z.object({
-          allowed: z.boolean(),
-          allowedByPlan: z.boolean(),
-          allowedByRole: z.boolean(),
-          allowedPlans: z.array(z.string()).optional(),
-          allowedRoles: z.array(z.string()),
-          currentPlan: z.string().optional(),
-          currentRole: z.string().optional(),
-          entitlement: EntitlementTypeSchema
-        })
-      ),
-      resourceId: z.string(),
-      resourceType: ResourceTypeSchema
-    })
-  )
+  results: z.object({
+    entitlements: z.object({
+      allowed: z.boolean(),
+      allowedByPlan: z.boolean(),
+      allowedByRole: z.boolean(),
+      allowedPlans: z.string().array().optional(),
+      allowedRoles: z.string().array(),
+      currentPlan: z.string().optional(),
+      currentRole: z.string().optional(),
+      entitlement: z.string()
+    }).array(),
+    resourceId: z.string(),
+    resourceType: z.string()
+  }).array()
 });
-var PlanAssignBodySchema = z.object({ planKey: PlanTypeSchema });
+var PlanAssignBodySchema = z.object({ planKey: z.string() });
 var PlanDeleteResponseSchema = z.object({ success: z.boolean() });
 var PlanResponseSchema = z.object({
-  createdAt: z.string().datetime(),
+  createdAt: z.iso.datetime(),
   environmentId: z.string(),
-  planKey: PlanTypeSchema,
+  planKey: z.string(),
   resourceId: z.string(),
-  resourceType: ResourceTypeSchema,
-  updatedAt: z.string().datetime()
+  resourceType: z.string(),
+  updatedAt: z.iso.datetime()
 });
 var ResourceSchema = z.object({
-  createdAt: z.string().datetime(),
+  createdAt: z.iso.datetime(),
   id: z.string(),
   name: z.string().nullable(),
-  parents: z.array(
-    z.object({
-      id: z.string(),
-      type: ResourceTypeSchema
-    })
-  ).optional(),
-  type: ResourceTypeSchema
+  parents: z.object({
+    id: z.string(),
+    type: z.string()
+  }).array().optional(),
+  type: z.string()
 });
 var ResourceBulkCreateBodySchema = z.object({
-  resources: z.array(
-    z.object({
-      id: z.string().optional(),
-      name: z.string().optional(),
-      parents: z.array(
-        z.object({
-          id: z.string(),
-          type: ResourceTypeSchema
-        })
-      ).optional(),
-      roles: z.array(
-        z.object({
-          role: z.string(),
-          userId: z.string()
-        })
-      ).optional()
-    })
-  )
+  resources: z.object({
+    id: z.string().optional(),
+    name: z.string().optional(),
+    parents: z.object({
+      id: z.string(),
+      type: z.string()
+    }).array().optional(),
+    roles: z.object({
+      role: z.string(),
+      userId: z.string()
+    }).array().optional()
+  }).array()
 });
 var ResourceBulkResultSchema = z.object({
-  created: z.array(
-    z.object({
-      environmentId: z.string(),
-      id: z.string(),
-      type: ResourceTypeSchema
-    })
-  ),
-  errors: z.array(
-    z.object({
-      error: z.string(),
-      index: z.number(),
-      resource: z.object({
-        id: z.string().optional(),
-        name: z.string().optional(),
-        parents: z.array(
-          z.object({
-            id: z.string(),
-            type: ResourceTypeSchema
-          })
-        ).optional(),
-        roles: z.array(
-          z.object({
-            role: z.string(),
-            userId: z.string()
-          })
-        ).optional()
-      })
+  created: z.object({
+    environmentId: z.string(),
+    id: z.string(),
+    type: z.string()
+  }).array(),
+  errors: z.object({
+    error: z.string(),
+    index: z.number(),
+    resource: z.object({
+      id: z.string().optional(),
+      name: z.string().optional(),
+      parents: z.object({
+        id: z.string(),
+        type: z.string()
+      }).array().optional(),
+      roles: z.object({
+        role: z.string(),
+        userId: z.string()
+      }).array().optional()
     })
-  ),
+  }).array(),
   success: z.boolean(),
   summary: z.object({
     failed: z.number(),
@@ -660,58 +652,33 @@ var ResourceBulkResultSchema = z.object({
 var ResourceCreateBodySchema = z.object({
   id: z.string().optional(),
   name: z.string().optional(),
-  parents: z.array(
-    z.object({
-      id: z.string(),
-      type: ResourceTypeSchema
-    })
-  ).optional(),
-  roles: z.array(
-    z.object({
-      role: z.string(),
-      userId: z.string()
-    })
-  ).optional()
-});
-var ResourceListSchema = z.object({
-  items: z.array(
-    z.object({
-      createdAt: z.string().datetime(),
-      id: z.string(),
-      name: z.string().nullable(),
-      parents: z.array(
-        z.object({
-          id: z.string(),
-          type: ResourceTypeSchema
-        })
-      ).optional(),
-      type: ResourceTypeSchema
-    })
-  ),
-  limit: z.number(),
-  page: z.number(),
-  total: z.number()
+  parents: z.object({
+    id: z.string(),
+    type: z.string()
+  }).array().optional(),
+  roles: z.object({
+    role: z.string(),
+    userId: z.string()
+  }).array().optional()
 });
 var ResourceMemberListSchema = z.object({
-  items: z.array(
-    z.object({
-      inherited: z.boolean(),
-      role: z.string(),
-      user: z.object({
-        avatarUrl: z.string().nullable(),
-        createdAt: z.string().datetime(),
-        email: z.string().email(),
-        emailVerified: z.boolean(),
-        firstName: z.string().nullable(),
-        id: z.string(),
-        lastLoginAt: z.string().datetime().nullable(),
-        lastName: z.string().nullable(),
-        lookupKey: z.string().nullable(),
-        updatedAt: z.string().datetime()
-      }),
-      userId: z.string()
-    })
-  ),
+  items: z.object({
+    inherited: z.boolean(),
+    role: z.string(),
+    user: z.object({
+      avatarUrl: z.string().nullable(),
+      createdAt: z.iso.datetime(),
+      email: z.email(),
+      emailVerified: z.boolean(),
+      firstName: z.string().nullable(),
+      id: z.string(),
+      lastLoginAt: z.iso.datetime().nullable(),
+      lastName: z.string().nullable(),
+      lookupKey: z.string().nullable(),
+      updatedAt: z.iso.datetime()
+    }),
+    userId: z.string()
+  }).array(),
   limit: z.number(),
   page: z.number(),
   total: z.number()
@@ -719,54 +686,46 @@ var ResourceMemberListSchema = z.object({
 var ResourceUpdateBodySchema = z.object({
   name: z.string().optional(),
   /** Creates relationships with other resources. Parent resources must already exist. */
-  parents: z.array(
-    z.object({
-      id: z.string(),
-      type: ResourceTypeSchema
-    })
-  ).optional()
+  parents: z.object({
+    id: z.string(),
+    type: z.string()
+  }).array().optional()
 });
 var RoleSchema = z.object({
   createdAt: z.string(),
   environmentId: z.string(),
   resourceId: z.string(),
-  resourceType: ResourceTypeSchema,
+  resourceType: z.string(),
   role: z.string(),
   userId: z.string()
 });
 var RoleBulkCreateBodySchema = z.object({
-  roles: z.array(
-    z.object({
-      resourceId: z.string(),
-      resourceType: ResourceTypeSchema,
-      role: z.string(),
-      userId: z.string()
-    })
-  )
+  roles: z.object({
+    resourceId: z.string(),
+    resourceType: z.string(),
+    role: z.string(),
+    userId: z.string()
+  }).array()
 });
 var RoleBulkResultSchema = z.object({
-  created: z.array(
-    z.object({
-      createdAt: z.string(),
-      environmentId: z.string(),
+  created: z.object({
+    createdAt: z.string(),
+    environmentId: z.string(),
+    resourceId: z.string(),
+    resourceType: z.string(),
+    role: z.string(),
+    userId: z.string()
+  }).array(),
+  errors: z.object({
+    error: z.string(),
+    index: z.number(),
+    role: z.object({
       resourceId: z.string(),
-      resourceType: ResourceTypeSchema,
+      resourceType: z.string(),
       role: z.string(),
       userId: z.string()
     })
-  ),
-  errors: z.array(
-    z.object({
-      error: z.string(),
-      index: z.number(),
-      role: z.object({
-        resourceId: z.string(),
-        resourceType: ResourceTypeSchema,
-        role: z.string(),
-        userId: z.string()
-      })
-    })
-  ),
+  }).array(),
   success: z.boolean(),
   summary: z.object({
     failed: z.number(),
@@ -776,84 +735,80 @@ var RoleBulkResultSchema = z.object({
 });
 var RoleCreateBodySchema = z.object({
   resourceId: z.string(),
-  resourceType: ResourceTypeSchema,
+  resourceType: z.string(),
   role: z.string()
 });
 var RoleListSchema = z.object({
   limit: z.number(),
   page: z.number(),
-  roles: z.array(
-    z.object({
-      createdAt: z.string(),
-      environmentId: z.string(),
-      resourceId: z.string(),
-      resourceType: ResourceTypeSchema,
-      role: z.string(),
-      userId: z.string()
-    })
-  ),
+  roles: z.object({
+    createdAt: z.string(),
+    environmentId: z.string(),
+    resourceId: z.string(),
+    resourceType: z.string(),
+    role: z.string(),
+    userId: z.string()
+  }).array(),
   total: z.number()
 });
 var TransactionHistoryResponseSchema = z.object({
-  items: z.array(
-    z.object({
-      amount: z.number().int(),
-      createdAt: z.string().datetime(),
-      environmentId: z.string(),
-      id: z.string(),
-      limitType: LimitTypeSchema,
-      resourceId: z.string(),
-      resourceType: ResourceTypeSchema,
-      tags: z.record(z.string(), z.unknown()).nullable()
-    })
-  )
+  items: z.object({
+    amount: z.number().int(),
+    createdAt: z.iso.datetime(),
+    environmentId: z.string(),
+    id: z.string(),
+    limitType: z.string(),
+    resourceId: z.string(),
+    resourceType: z.string(),
+    tags: z.record(z.string(), z.unknown()).nullable()
+  }).array()
 });
 var UsageCheckBodySchema = z.object({
   amount: z.number().int(),
-  limitType: UsageLimitTypeSchema,
+  limitType: z.string(),
   period: z.enum(["monthly", "yearly", "lifetime"]),
   resourceId: z.string(),
-  resourceType: ResourceTypeSchema
+  resourceType: z.string()
 });
 var UsageConsumeBodySchema = z.object({
   amount: z.number().int(),
-  limitType: UsageLimitTypeSchema,
+  limitType: z.string(),
   resourceId: z.string(),
-  resourceType: ResourceTypeSchema,
+  resourceType: z.string(),
   tags: z.record(z.string(), z.unknown()).optional()
 });
 var UsageCreditBodySchema = z.object({
   amount: z.number().int(),
-  limitType: UsageLimitTypeSchema,
+  limitType: z.string(),
   resourceId: z.string(),
-  resourceType: ResourceTypeSchema,
+  resourceType: z.string(),
   tags: z.record(z.string(), z.unknown()).optional()
 });
 var UsageWalletResponseSchema = z.object({
   amount: z.number().int(),
-  createdAt: z.string().datetime(),
+  createdAt: z.iso.datetime(),
   environmentId: z.string(),
   id: z.string(),
-  limitType: UsageLimitTypeSchema,
+  limitType: z.string(),
   resourceId: z.string(),
-  resourceType: ResourceTypeSchema,
+  resourceType: z.string(),
   tags: z.record(z.string(), z.unknown()).nullable()
 });
 var UserSchema = z.object({
   avatarUrl: z.string().nullable(),
-  createdAt: z.string().datetime(),
-  email: z.string().email(),
+  createdAt: z.iso.datetime(),
+  email: z.email(),
   emailVerified: z.boolean(),
   firstName: z.string().nullable(),
   id: z.string(),
-  lastLoginAt: z.string().datetime().nullable(),
+  lastLoginAt: z.iso.datetime().nullable(),
   lastName: z.string().nullable(),
   lookupKey: z.string().nullable(),
-  updatedAt: z.string().datetime()
+  updatedAt: z.iso.datetime()
 });
 var UserCreateBodySchema = z.object({
-  avatarUrl: z.string().url().optional(),
-  email: z.string().email(),
+  avatarUrl: z.url().optional(),
+  email: z.email(),
   firstName: z.string().nullable().optional(),
   lastName: z.string().nullable().optional(),
   lookupKey: z.string(),
@@ -861,20 +816,18 @@ var UserCreateBodySchema = z.object({
   password: z.string().nullable().optional()
 });
 var UserListSchema = z.object({
-  items: z.array(
-    z.object({
-      avatarUrl: z.string().nullable(),
-      createdAt: z.string().datetime(),
-      email: z.string().email(),
-      emailVerified: z.boolean(),
-      firstName: z.string().nullable(),
-      id: z.string(),
-      lastLoginAt: z.string().datetime().nullable(),
-      lastName: z.string().nullable(),
-      lookupKey: z.string().nullable(),
-      updatedAt: z.string().datetime()
-    })
-  ),
+  items: z.object({
+    avatarUrl: z.string().nullable(),
+    createdAt: z.iso.datetime(),
+    email: z.email(),
+    emailVerified: z.boolean(),
+    firstName: z.string().nullable(),
+    id: z.string(),
+    lastLoginAt: z.iso.datetime().nullable(),
+    lastName: z.string().nullable(),
+    lookupKey: z.string().nullable(),
+    updatedAt: z.iso.datetime()
+  }).array(),
   limit: z.number(),
   page: z.number(),
   total: z.number()
@@ -885,25 +838,29 @@ var UserResourceListSchema = z.array(
     resource: z.object({
       id: z.string(),
       name: z.string(),
-      parents: z.array(
-        z.object({
-          id: z.string(),
-          type: ResourceTypeSchema
-        })
-      ),
-      type: ResourceTypeSchema
+      parents: z.object({
+        id: z.string(),
+        type: z.string()
+      }).array(),
+      type: z.string()
     }).catchall(z.unknown()),
     role: z.string()
   })
 );
 var UserUpdateBodySchema = z.object({
-  avatarUrl: z.string().url().nullable().optional(),
-  email: z.string().email().optional(),
+  avatarUrl: z.url().nullable().optional(),
+  email: z.email().optional(),
   firstName: z.string().nullable().optional(),
   lastName: z.string().nullable().optional(),
   lookupKey: z.string().optional(),
   password: z.string().optional()
 });
+var ResourceListSchema = z.object({
+  items: ResourceSchema.array(),
+  limit: z.number(),
+  page: z.number(),
+  total: z.number()
+});
 var EntitlementsListForResourceQuerySchema = z.object({
   /** The unique identifier of the user */
   userId: z.string()
@@ -936,17 +893,13 @@ var RolesListQuerySchema = z.object({
   /** Filter roles by specific resource ID */
   resourceId: z.string().optional(),
   /** Filter roles by resource type */
-  resourceType: ResourceTypeSchema.optional(),
+  resourceType: z.string().optional(),
   /** Filter by role name */
   role: z.string().optional()
 });
 var UsageGetBalanceQuerySchema = z.object({
   /** Time period for the balance calculation */
-  period: z.enum([
-    "monthly",
-    "yearly",
-    "lifetime"
-  ])
+  period: z.enum(["monthly", "yearly", "lifetime"])
 });
 var UsageGetTransactionHistoryQuerySchema = z.object({
   /** End date for filtering transactions (ISO 8601 format) */
@@ -965,37 +918,182 @@ var UsersListQuerySchema = z.object({
   search: z.string().optional()
 });
 
-// src/index.ts
-var Blimu = class {
-  bulkResources;
-  bulkRoles;
-  entitlements;
-  plans;
-  resourceMembers;
-  resources;
-  roles;
-  usage;
-  users;
+// src/token-verifier.ts
+import * as crypto from "crypto";
+import * as jwt from "jsonwebtoken";
+var TokenVerifier = class {
+  cache = /* @__PURE__ */ new Map();
+  cacheTTL;
+  runtimeApiUrl;
   constructor(options) {
-    const core = new CoreClient(options);
-    this.bulkResources = new BulkResourcesService(core);
-    this.bulkRoles = new BulkRolesService(core);
-    this.entitlements = new EntitlementsService(core);
-    this.plans = new PlansService(core);
-    this.resourceMembers = new ResourceMembersService(core);
-    this.resources = new ResourcesService(core);
-    this.roles = new RolesService(core);
-    this.usage = new UsageService(core);
-    this.users = new UsersService(core);
+    this.cacheTTL = options?.cacheTTL ?? 60 * 60 * 1e3;
+    this.runtimeApiUrl = options?.runtimeApiUrl ?? "https://api.blimu.dev";
+  }
+  /**
+   * Fetch JWK Set from runtime-api
+   */
+  async fetchJWKSet(endpoint, headers) {
+    console.log(`[TokenVerifier] \u{1F4E1} Fetching JWK Set from: ${endpoint}`);
+    if (headers) {
+      console.log(
+        `[TokenVerifier] \u{1F4E1} Request headers: ${JSON.stringify(Object.keys(headers).map((k) => `${k}: ${k === "x-api-key" ? "***" : headers[k]}`))}`
+      );
+    }
+    const response = await fetch(endpoint, {
+      method: "GET",
+      headers: {
+        "Content-Type": "application/json",
+        ...headers
+      }
+    });
+    console.log(`[TokenVerifier] \u{1F4E1} Response status: ${response.status} ${response.statusText}`);
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error(`[TokenVerifier] \u274C Failed to fetch JWKs: ${response.status} ${errorText}`);
+      throw new FetchError("Failed to fetch JWKs", response.status, errorText);
+    }
+    const jwkSet = await response.json();
+    console.log(`[TokenVerifier] \u2705 Successfully fetched JWK Set with ${jwkSet.keys.length} keys`);
+    return jwkSet;
+  }
+  /**
+   * Convert JWK to KeyObject
+   */
+  jwkToKeyObject(jwk) {
+    return crypto.createPublicKey({
+      key: {
+        kty: jwk.kty,
+        n: jwk.n,
+        e: jwk.e,
+        alg: jwk.alg
+      },
+      format: "jwk"
+    });
+  }
+  /**
+   * Get public key for a specific key ID
+   */
+  async getPublicKey(kid, cacheKey, endpoint, headers) {
+    const cached = this.cache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now()) {
+      console.log(`[TokenVerifier] \u2705 Using cached key for kid: ${kid}`);
+      return cached.key;
+    }
+    console.log(`[TokenVerifier] \u{1F50D} Cache miss or expired. Fetching new key for kid: ${kid}`);
+    const jwkSet = await this.fetchJWKSet(endpoint, headers);
+    const jwk = jwkSet.keys.find((k) => k.kid === kid);
+    if (!jwk) {
+      const availableKids = jwkSet.keys.map((k) => k.kid).join(", ");
+      console.error(
+        `[TokenVerifier] \u274C Key with kid '${kid}' not found in JWK Set. Available kids: ${availableKids}`
+      );
+      throw new Error(
+        `Key with kid '${kid}' not found in JWK Set. Available kids: ${availableKids}`
+      );
+    }
+    console.log(`[TokenVerifier] \u2705 Found key with kid: ${kid}`);
+    const keyObject = this.jwkToKeyObject(jwk);
+    this.cache.set(cacheKey, {
+      key: keyObject,
+      kid,
+      expiresAt: Date.now() + this.cacheTTL
+    });
+    return keyObject;
+  }
+  /**
+   * Verify JWT token using JWKs from runtime-api
+   */
+  async verifyToken(options) {
+    const { url, secretKey, token, runtimeApiUrl } = options;
+    if (!url && !secretKey) {
+      throw new Error("Either url or secretKey must be provided");
+    }
+    if (url && secretKey) {
+      throw new Error("Cannot provide both url and secretKey");
+    }
+    const decoded = jwt.decode(token, { complete: true });
+    if (!decoded || typeof decoded === "string") {
+      throw new Error("Invalid token format");
+    }
+    const header = decoded.header;
+    if (!header.kid) {
+      throw new Error("Token missing kid in header");
+    }
+    let endpoint;
+    let cacheKey;
+    let headers;
+    if (secretKey) {
+      const apiUrl = runtimeApiUrl ?? this.runtimeApiUrl;
+      endpoint = `${apiUrl}/v1/auth/.well-known/jwks.json`;
+      cacheKey = secretKey;
+      headers = {
+        "x-api-key": secretKey
+      };
+      console.log(
+        `[TokenVerifier] \u{1F50D} Verifying token with kid: ${header.kid}, endpoint: ${endpoint}`
+      );
+    } else {
+      endpoint = url;
+      cacheKey = url;
+      console.log(
+        `[TokenVerifier] \u{1F50D} Verifying token with kid: ${header.kid}, endpoint: ${endpoint}`
+      );
+    }
+    let publicKey;
+    try {
+      publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);
+      console.log(`[TokenVerifier] \u2705 Successfully retrieved public key for kid: ${header.kid}`);
+    } catch (error) {
+      console.error(
+        `[TokenVerifier] \u274C Failed to get public key (first attempt): ${error instanceof Error ? error.message : String(error)}`
+      );
+      this.clearCache(cacheKey);
+      console.log(`[TokenVerifier] \u{1F504} Retrying after cache clear...`);
+      try {
+        publicKey = await this.getPublicKey(header.kid, cacheKey, endpoint, headers);
+        console.log(
+          `[TokenVerifier] \u2705 Successfully retrieved public key for kid: ${header.kid} (retry)`
+        );
+      } catch (retryError) {
+        console.error(
+          `[TokenVerifier] \u274C Failed to get public key (retry): ${retryError instanceof Error ? retryError.message : String(retryError)}`
+        );
+        throw retryError;
+      }
+    }
+    try {
+      const payload = jwt.verify(token, publicKey, {
+        algorithms: ["RS256"]
+      });
+      console.log(`[TokenVerifier] \u2705 Token verified successfully`);
+      return payload;
+    } catch (error) {
+      console.error(
+        `[TokenVerifier] \u274C JWT verification failed: ${error instanceof Error ? error.message : String(error)}`
+      );
+      throw error;
+    }
+  }
+  /**
+   * Clear cache (useful for testing or key rotation)
+   */
+  clearCache(secretKeyOrUrl) {
+    if (secretKeyOrUrl) {
+      this.cache.delete(secretKeyOrUrl);
+    } else {
+      this.cache.clear();
+    }
   }
 };
-var BlimuError = FetchError;
+async function verifyToken(options) {
+  const verifier = new TokenVerifier();
+  return verifier.verifyToken(options);
+}
 export {
   Blimu,
   BlimuError,
   BulkResourcesService,
   BulkRolesService,
-  CoreClient,
   EntitlementsService,
   FetchError,
   PlansService,
@@ -1003,12 +1101,15 @@ export {
   ResourcesService,
   RolesService,
   schema_exports as Schema,
+  TokenVerifier,
   UsageService,
   UsersService,
   schema_zod_exports as ZodSchema,
+  isNotUndefined,
   listAll,
   paginate,
   parseNDJSONStream,
-  parseSSEStream
+  parseSSEStream,
+  verifyToken
 };
 //# sourceMappingURL=index.mjs.map