@dehwyyy/auth 1.0.5 → 2.0.0

package/README.md

@@ -1,50 +1,185 @@
-## TokenAttacher & TokenRefresher middleware usage
-
-```ts
-import { GetAuthService } from "@dehwyyy/auth";
-import type { Middleware } from "openapi-fetch";
-
-export const AuthorizationHeaderAttacherMiddleware: Middleware = {
-  async onRequest({ request }) {
-    return GetAuthService(APP, BASE_URL).WithAuthorizationToken(request);
-  },
-}
-
-export const TokenRefresherMiddleware: Middleware = {
-  async onResponse({ response, request }) {
-    if (response.status !== 401 || request.url.includes('/auth/refresh')) {
-      return response;
-    }
-
-    return GetAuthService(APP, BASE_URL).RefreshAndRetry(request, response);
-  }
-}
-
-
-```
-
-## Guard usage example
-
-```ts
-import { Guards } from '@dehwyyy/auth/guard';
-import { createRouter, createWebHistory } from 'vue-router';
-
-enum Roles {
-  ADMIN = "Admin",
-  MANAGER = "Manager",
-  USER = "User"
-}
-
-const g = new Guards(APP, BASE_URL, "/login")
-
-export const router = createRouter({
-  history: createWebHistory(import.meta.env.VITE_BASE_URL),
-  routes: [
-    { path: "/login", name: "Login", component: Login },
-    { path: "/dashboard", name: "DashboardIndex", component: View, beforeEnter: g.Auth([Roles.USER]) },
-    { path: "/dashboard/users", name: "DashboardUsers", component: Users, beforeEnter: g.Auth([Roles.ADMIN, Roles.MANAGER]) },
-    { path: "/:pathMatch(.*)*", redirect: "/login" },
-  ],
-});
-
-```
+# @dehwyyy/auth
+
+Browser-side OIDC auth client for the Paylonium SPAs. Talks directly to Zitadel
+using Authorization Code + PKCE (S256). No backend auth proxy.
+
+- ESM only, single runtime dependency: `openapi-fetch`.
+- PKCE via WebCrypto (no extra deps).
+- Tokens in `localStorage` (`accessToken` / `refreshToken` / `idToken`).
+- PKCE `verifier` / `state` / `returnTo` in `sessionStorage`.
+- Refresh-token rotation with single-flight and cross-tab compare-and-clear.
+- Vue Router guard with role checks and an OIDC-callback anti-loop.
+
+## Install
+
+```bash
+bun add @dehwyyy/auth
+```
+
+Both `@dehwyyy/auth` and `@dehwyyy/auth/v2` resolve to the same v2 entrypoint.
+
+## Configuration
+
+```ts
+import type { ZitadelConfig } from "@dehwyyy/auth"
+
+const config: ZitadelConfig = {
+  issuer: "https://core.auth.my-paylonium.com",
+  clientId: "376852297126373720",
+  redirectUri: window.location.origin + "/auth/callback",
+  postLogoutRedirectUri: window.location.origin + "/",
+  // scopes is optional; this is the default:
+  // ["openid","profile","email","offline_access",
+  //  "urn:zitadel:iam:org:projects:roles","urn:zitadel:iam:user:metadata"]
+}
+```
+
+## Wiring with `createAuth`
+
+`createAuth` is the single wiring entry point. It builds the refresh client, the
+authenticated API client (access-token attach + auto-refresh on 401), the
+services, and a `MiddlewareBuilder` you can reuse for your own API clients.
+
+```ts
+import { createAuth } from "@dehwyyy/auth"
+
+export const auth = createAuth(config)
+// auth.authService      — Login / HandleCallback / GetMe / Logout
+// auth.baseAuthService  — Refresh / RequestWithAccessToken
+// auth.middlewareBuilder — for wiring your own openapi-fetch clients
+// auth.callbackPath     — derived from config.redirectUri (e.g. "/auth/callback")
+```
+
+Reuse the middleware for your domain API client:
+
+```ts
+import createClient from "openapi-fetch"
+import type { paths } from "./api/schema"
+
+export const api = createClient<paths>({ baseUrl: import.meta.env.VITE_API_URL })
+api.use(...auth.middlewareBuilder.buildDefault())
+```
+
+## Login
+
+```ts
+// returnTo is optional; pass the path you want to land on after auth.
+await auth.authService.Login(router.currentRoute.value.fullPath)
+// redirects the browser to Zitadel's /oauth/v2/authorize
+```
+
+## Callback page
+
+Mount this on `config.redirectUri` (e.g. `/auth/callback`). It performs the
+token exchange, fetches the user, and redirects to `returnTo`.
+
+```vue
+<script setup lang="ts">
+import { onMounted } from "vue"
+import { useRouter } from "vue-router"
+import { CallbackError } from "@dehwyyy/auth"
+import { auth } from "@/auth"
+
+const router = useRouter()
+
+onMounted(async () => {
+  try {
+    const { returnTo } = await auth.authService.HandleCallback()
+    // returnTo is already same-origin/relative-validated by the library
+    // (a foreign origin is dropped to null), so it is safe to navigate to.
+    await router.replace(returnTo ?? "/")
+  } catch (e) {
+    if (e instanceof CallbackError) {
+      // e.code: "state_mismatch" | "verifier_missing" | "code_missing" | "exchange_failed"
+      console.error("auth callback failed:", e.code)
+    }
+    await router.replace("/")
+  }
+})
+</script>
+
+<template>
+  <div>Signing you in…</div>
+</template>
+```
+
+`HandleCallback` is idempotent per authorization code: a double mount (Vue dev
+StrictMode) or an F5 on the callback URL reuses the in-flight/resolved exchange
+instead of failing with a state mismatch.
+
+## Route guard
+
+```ts
+import { RouterAuthGuard } from "@dehwyyy/auth"
+import { auth } from "@/auth"
+
+const guard = new RouterAuthGuard(auth.authService, {
+  callbackPath: auth.callbackPath,         // required — only this route may carry ?code&state
+  fallbackPage: "/forbidden",
+  baseServiceURL: window.location.origin,
+  onGetMe: (user) => { /* hydrate your store */ },
+  // cacheTTL is optional, defaults to 15000 (ms)
+})
+
+router.beforeEach(guard.Authorized(["ADMIN", "DEV"]))   // require one of these roles
+// or guard.Authorized() to require only authentication
+// or guard.Unauthorized([{ to: "/dashboard", roles: ["MERCHANT"] }]) on public pages
+```
+
+Security note: the guard only treats a navigation as the OIDC callback when the
+target path equals `callbackPath` **and** `code`+`state` are present. Appending
+`?code&state` to any other protected route does not bypass the guard.
+
+## Logout
+
+```ts
+await auth.authService.Logout()
+// clears tokens and redirects to Zitadel /oidc/v1/end_session
+```
+
+## Composability (without `createAuth`)
+
+The pieces remain individually exported for custom wiring:
+`AuthService`, `BaseAuthService`, `ClientBuilder`, `ClientInstance`,
+`MiddlewareBuilder`, `CreateAuthClientInstance`, `BaseAuthClientInstance`,
+`RouterAuthGuard`, `CallbackError`, plus types
+`ZitadelConfig`, `GetMeResponse`, `VerboseUserInfo`, `HandleCallbackResult`,
+`RouteLocation`, `CallbackErrorCode`, `Auth`.
+
+### Footgun: `BaseAuthClientInstance` is a process-wide singleton
+
+`BaseAuthClientInstance(issuer)` caches its client on first call — the first
+`issuer` wins for the module's lifetime, and later calls with a different issuer
+return the original client. For a single-issuer SPA this is fine. If you need
+multiple issuers (or isolated instances in tests), use `createAuth` instead,
+which constructs fresh clients each call.
+
+## GetMe response shape
+
+```ts
+type GetMeResponse = {
+  user_id: string
+  roles: string[]    // keys of the Zitadel project-roles claim
+  active: boolean     // always true when a userinfo response is returned
+  info?: {            // populated only when verbose
+    username?: string
+    email?: string
+    email_verified?: boolean
+    name?: string
+    picture?: string
+  }
+}
+```
+
+## Development
+
+```bash
+bun install
+bun run gen     # regenerate src/v2/pkg/types/schema.d.ts from spec/zitadel-oidc.yaml
+bun run build   # tsc + tsc-alias (full-path ESM resolution)
+bun test
+```
+
+The OIDC surface (`/oauth/v2/token`, `/oidc/v1/userinfo`, `/oidc/v1/end_session`)
+is described in `spec/zitadel-oidc.yaml`; all schema types are generated from it
+via `openapi-typescript`. Do not hand-edit `schema.d.ts`.

package/dist/v2/auth/client/baseClient.d.ts

@@ -0,0 +1,2 @@
+import { HttpAuthClient } from '../../../v2/pkg/types/index.js';
+export declare const BaseAuthClientInstance: (issuer: string) => HttpAuthClient;

package/dist/v2/auth/client/baseClient.js

@@ -0,0 +1,14 @@
+import { normalizeIssuer } from '../../../v2/pkg/url/index.js';
+import createClient from 'openapi-fetch';
+let baseClient = null;
+// NOTE: process-wide singleton — the first issuer wins for the lifetime of the
+// module. Re-calling with a different issuer returns the original client. Fine
+// for the single-issuer SPA setups this package targets; see README footgun.
+export const BaseAuthClientInstance = (issuer) => {
+    if (!baseClient) {
+        baseClient = createClient({
+            baseUrl: normalizeIssuer(issuer),
+        });
+    }
+    return baseClient;
+};

package/dist/v2/auth/client/client.d.ts

@@ -0,0 +1,3 @@
+import { BaseAuthService } from "../../../v2/pkg/types/index.js";
+import { paths } from "@dehwyyy/auth/v2/pkg/types/schema";
+export declare const CreateAuthClientInstance: (issuer: string, baseAuthService: BaseAuthService, fetchImpl?: typeof fetch) => import("openapi-fetch").Client<paths, `${string}/${string}`>;

package/dist/v2/auth/client/client.js

@@ -0,0 +1,7 @@
+import { ClientBuilder, MiddlewareBuilder } from "../../../v2/client/index.js";
+import { normalizeIssuer } from "../../../v2/pkg/url/index.js";
+export const CreateAuthClientInstance = (issuer, baseAuthService, fetchImpl = fetch) => new ClientBuilder().
+    withMiddleware(...new MiddlewareBuilder(baseAuthService, fetchImpl).buildDefault()).
+    build({
+    baseUrl: normalizeIssuer(issuer),
+});

package/dist/v2/auth/client/index.d.ts

@@ -0,0 +1,3 @@
+import { BaseAuthClientInstance } from "../../../v2/auth/client/baseClient.js";
+import { CreateAuthClientInstance } from "../../../v2/auth/client/client.js";
+export { BaseAuthClientInstance, CreateAuthClientInstance };

package/dist/v2/auth/client/index.js

@@ -0,0 +1,3 @@
+import { BaseAuthClientInstance } from "../../../v2/auth/client/baseClient.js";
+import { CreateAuthClientInstance } from "../../../v2/auth/client/client.js";
+export { BaseAuthClientInstance, CreateAuthClientInstance };

package/dist/v2/auth/factory.d.ts

@@ -0,0 +1,20 @@
+import { BaseAuthService } from "../../v2/auth/service/baseService.js";
+import { AuthService } from "../../v2/auth/service/service.js";
+import { MiddlewareBuilder } from "../../v2/client/index.js";
+import { ZitadelConfig } from "../../v2/pkg/types/index.js";
+export type Auth = {
+    authService: AuthService;
+    baseAuthService: BaseAuthService;
+    middlewareBuilder: MiddlewareBuilder;
+    callbackPath: string;
+};
+/**
+ * Single wiring entry point for the three SPA frontends. Builds:
+ *  - a bare token client for refresh (no auto-refresh middleware to avoid
+ *    a refresh -> 401 -> refresh loop),
+ *  - the BaseAuthService driving that client,
+ *  - an authenticated client (access token attach + auto-refresh on 401),
+ *  - the AuthService over it,
+ *  - a MiddlewareBuilder for callers wiring their own API clients.
+ */
+export declare function createAuth(config: ZitadelConfig, fetchImpl?: typeof fetch): Auth;

package/dist/v2/auth/factory.js

@@ -0,0 +1,31 @@
+import { BaseAuthService } from "../../v2/auth/service/baseService.js";
+import { AuthService } from "../../v2/auth/service/service.js";
+import { ClientBuilder, MiddlewareBuilder } from "../../v2/client/index.js";
+import { normalizeIssuer, pathnameOf } from "../../v2/pkg/url/index.js";
+import createClient from "openapi-fetch";
+/**
+ * Single wiring entry point for the three SPA frontends. Builds:
+ *  - a bare token client for refresh (no auto-refresh middleware to avoid
+ *    a refresh -> 401 -> refresh loop),
+ *  - the BaseAuthService driving that client,
+ *  - an authenticated client (access token attach + auto-refresh on 401),
+ *  - the AuthService over it,
+ *  - a MiddlewareBuilder for callers wiring their own API clients.
+ */
+export function createAuth(config, fetchImpl = fetch) {
+    const issuer = normalizeIssuer(config.issuer);
+    const normalizedConfig = { ...config, issuer };
+    const tokenClient = createClient({ baseUrl: issuer });
+    const baseAuthService = new BaseAuthService(tokenClient, normalizedConfig);
+    const middlewareBuilder = new MiddlewareBuilder(baseAuthService, fetchImpl);
+    const authClient = new ClientBuilder()
+        .withMiddleware(...middlewareBuilder.buildDefault())
+        .build({ baseUrl: issuer });
+    const authService = new AuthService(baseAuthService, authClient, normalizedConfig);
+    return {
+        authService,
+        baseAuthService,
+        middlewareBuilder,
+        callbackPath: pathnameOf(config.redirectUri),
+    };
+}

package/dist/v2/auth/service/baseService.d.ts

@@ -0,0 +1,10 @@
+import { HttpAuthClient, BaseAuthService as IBaseAuthService, ZitadelConfig } from "../../../v2/pkg/types/index.js";
+export declare class BaseAuthService implements IBaseAuthService {
+    private httpAuthClient;
+    private config;
+    private refreshPromise;
+    constructor(httpAuthClient: HttpAuthClient, config: ZitadelConfig);
+    private doRefresh;
+    Refresh(): Promise<string | null>;
+    RequestWithAccessToken(req: Request, token?: string | null): Request;
+}

package/dist/v2/auth/service/baseService.js

@@ -0,0 +1,82 @@
+import { Storage, StorageKey } from "../../../v2/pkg/localStorage/index.js";
+export class BaseAuthService {
+    httpAuthClient;
+    config;
+    refreshPromise = null;
+    constructor(httpAuthClient, config) {
+        this.httpAuthClient = httpAuthClient;
+        this.config = config;
+    }
+    async doRefresh() {
+        const refreshToken = Storage.Get(StorageKey.REFRESH_TOKEN);
+        if (!refreshToken) {
+            return null;
+        }
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: this.config.clientId,
+        });
+        const scopes = this.config.scopes;
+        if (scopes && scopes.length > 0) {
+            body.set('scope', scopes.join(' '));
+        }
+        const { data, error } = await this.httpAuthClient.POST('/oauth/v2/token', {
+            body: body,
+            bodySerializer: () => body.toString(),
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        });
+        if (error || !data?.access_token) {
+            // Compare-and-clear: another tab may have already rotated the token while
+            // this request was in flight. Only drop stored credentials when they are
+            // still the ones we attempted with, and only for a hard auth failure.
+            const stored = Storage.Get(StorageKey.REFRESH_TOKEN);
+            const isInvalidGrant = error?.error === 'invalid_grant';
+            if (isInvalidGrant && stored === refreshToken) {
+                Storage.Delete(StorageKey.ACCESS_TOKEN);
+                Storage.Delete(StorageKey.REFRESH_TOKEN);
+                Storage.Delete(StorageKey.ID_TOKEN);
+                return null;
+            }
+            if (stored && stored !== refreshToken) {
+                // A concurrent refresh succeeded; reuse the freshly stored access token.
+                return Storage.Get(StorageKey.ACCESS_TOKEN);
+            }
+            return null;
+        }
+        Storage.Set(StorageKey.ACCESS_TOKEN, data.access_token);
+        if (data.refresh_token) {
+            Storage.Set(StorageKey.REFRESH_TOKEN, data.refresh_token);
+        }
+        if (data.id_token) {
+            Storage.Set(StorageKey.ID_TOKEN, data.id_token);
+        }
+        return data.access_token;
+    }
+    async Refresh() {
+        if (!this.refreshPromise) {
+            this.refreshPromise = this.doRefresh();
+        }
+        let token = null;
+        try {
+            token = await this.refreshPromise;
+        }
+        catch (e) {
+            console.error(e);
+        }
+        finally {
+            this.refreshPromise = null;
+        }
+        if (!token) {
+            return null;
+        }
+        return token;
+    }
+    RequestWithAccessToken(req, token = null) {
+        token ??= Storage.Get(StorageKey.ACCESS_TOKEN);
+        if (token) {
+            req.headers.set('Authorization', `Bearer ${token}`);
+        }
+        return req;
+    }
+}

package/dist/v2/auth/service/index.d.ts

@@ -0,0 +1,3 @@
+import { BaseAuthService } from "../../../v2/auth/service/baseService.js";
+import { AuthService } from "../../../v2/auth/service/service.js";
+export { AuthService, BaseAuthService };

package/dist/v2/auth/service/index.js

@@ -0,0 +1,3 @@
+import { BaseAuthService } from "../../../v2/auth/service/baseService.js";
+import { AuthService } from "../../../v2/auth/service/service.js";
+export { AuthService, BaseAuthService };

package/dist/v2/auth/service/service.d.ts

@@ -0,0 +1,19 @@
+import { BaseAuthService, GetMeResponse, HandleCallbackResult, HttpAuthClient, AuthService as IAuthService, ZitadelConfig } from "../../../v2/pkg/types/index.js";
+import { components } from "@dehwyyy/auth/v2/pkg/types/schema";
+type UserInfo = components["schemas"]["UserInfo"];
+export declare class AuthService implements IAuthService {
+    private baseAuthService;
+    private authClient;
+    private config;
+    private issuer;
+    private callbackByCode;
+    constructor(baseAuthService: BaseAuthService, authClient: HttpAuthClient, config: ZitadelConfig);
+    private scopes;
+    Login(returnTo?: string): Promise<void>;
+    HandleCallback(): Promise<HandleCallbackResult>;
+    private exchange;
+    GetMe(verbose?: boolean): Promise<GetMeResponse | null>;
+    Logout(): Promise<void>;
+    static mapUserInfo(claims: UserInfo, verbose: boolean): GetMeResponse;
+}
+export {};

package/dist/v2/auth/service/service.js

@@ -0,0 +1,162 @@
+import { SessionKey, SessionStore, Storage, StorageKey } from "../../../v2/pkg/localStorage/index.js";
+import { CallbackError } from "../../../v2/pkg/errors/index.js";
+import { challengeS256, generateState, generateVerifier } from "../../../v2/pkg/pkce/index.js";
+import { normalizeIssuer, sanitizeReturnTo } from "../../../v2/pkg/url/index.js";
+const ROLES_CLAIM = "urn:zitadel:iam:org:project:roles";
+const DEFAULT_SCOPES = [
+    "openid",
+    "profile",
+    "email",
+    "offline_access",
+    "urn:zitadel:iam:org:projects:roles",
+    "urn:zitadel:iam:user:metadata",
+];
+export class AuthService {
+    baseAuthService;
+    authClient;
+    config;
+    issuer;
+    callbackByCode = new Map();
+    constructor(baseAuthService, authClient, config) {
+        this.baseAuthService = baseAuthService;
+        this.authClient = authClient;
+        this.config = config;
+        this.issuer = normalizeIssuer(config.issuer);
+    }
+    scopes() {
+        return (this.config.scopes ?? DEFAULT_SCOPES).join(" ");
+    }
+    async Login(returnTo) {
+        const verifier = generateVerifier();
+        const state = generateState();
+        const challenge = await challengeS256(verifier);
+        SessionStore.Set(SessionKey.PKCE_VERIFIER, verifier);
+        SessionStore.Set(SessionKey.PKCE_STATE, state);
+        if (returnTo) {
+            SessionStore.Set(SessionKey.RETURN_TO, returnTo);
+        }
+        else {
+            SessionStore.Delete(SessionKey.RETURN_TO);
+        }
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            response_type: "code",
+            scope: this.scopes(),
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            state,
+        });
+        location.assign(`${this.issuer}/oauth/v2/authorize?${params.toString()}`);
+    }
+    HandleCallback() {
+        const search = new URLSearchParams(location.search);
+        const code = search.get("code");
+        if (!code) {
+            return Promise.reject(new CallbackError("code_missing", "authorization code missing in callback"));
+        }
+        // Single-flight per authorization code: a double invocation (Vue dev double
+        // mount, manual refresh) reuses the in-flight/resolved exchange instead of
+        // re-running it and tripping a "state mismatch" on cleared session state.
+        const existing = this.callbackByCode.get(code);
+        if (existing) {
+            return existing;
+        }
+        const promise = this.exchange(code, search.get("state"));
+        this.callbackByCode.set(code, promise);
+        return promise;
+    }
+    async exchange(code, state) {
+        const storedState = SessionStore.Get(SessionKey.PKCE_STATE);
+        const verifier = SessionStore.Get(SessionKey.PKCE_VERIFIER);
+        const returnTo = sanitizeReturnTo(SessionStore.Get(SessionKey.RETURN_TO));
+        try {
+            if (!state || state !== storedState) {
+                throw new CallbackError("state_mismatch", "state mismatch in callback");
+            }
+            if (!verifier) {
+                throw new CallbackError("verifier_missing", "pkce verifier missing in callback");
+            }
+            const body = new URLSearchParams({
+                grant_type: "authorization_code",
+                code,
+                redirect_uri: this.config.redirectUri,
+                client_id: this.config.clientId,
+                code_verifier: verifier,
+            });
+            const { data, error } = await this.authClient.POST("/oauth/v2/token", {
+                body: body,
+                bodySerializer: () => body.toString(),
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            });
+            if (error || !data?.access_token) {
+                throw new CallbackError("exchange_failed", "token exchange failed");
+            }
+            Storage.Set(StorageKey.ACCESS_TOKEN, data.access_token);
+            if (data.refresh_token) {
+                Storage.Set(StorageKey.REFRESH_TOKEN, data.refresh_token);
+            }
+            if (data.id_token) {
+                Storage.Set(StorageKey.ID_TOKEN, data.id_token);
+            }
+            const me = await this.GetMe(true);
+            return { me, returnTo };
+        }
+        finally {
+            SessionStore.Delete(SessionKey.PKCE_VERIFIER);
+            SessionStore.Delete(SessionKey.PKCE_STATE);
+            SessionStore.Delete(SessionKey.RETURN_TO);
+        }
+    }
+    async GetMe(verbose = false) {
+        let token = Storage.Get(StorageKey.ACCESS_TOKEN);
+        if (!token) {
+            token = await this.baseAuthService.Refresh();
+            if (!token) {
+                return null;
+            }
+        }
+        const { data, error } = await this.authClient.GET("/oidc/v1/userinfo");
+        if (error) {
+            return null;
+        }
+        if (!data || !data.sub) {
+            return null;
+        }
+        return AuthService.mapUserInfo(data, verbose);
+    }
+    async Logout() {
+        const idToken = Storage.Get(StorageKey.ID_TOKEN);
+        Storage.Delete(StorageKey.ACCESS_TOKEN);
+        Storage.Delete(StorageKey.REFRESH_TOKEN);
+        Storage.Delete(StorageKey.ID_TOKEN);
+        const params = new URLSearchParams();
+        if (idToken) {
+            params.set("id_token_hint", idToken);
+        }
+        const postLogout = this.config.postLogoutRedirectUri;
+        if (postLogout) {
+            params.set("post_logout_redirect_uri", postLogout);
+        }
+        location.assign(`${this.issuer}/oidc/v1/end_session?${params.toString()}`);
+    }
+    static mapUserInfo(claims, verbose) {
+        const rolesClaim = claims[ROLES_CLAIM] ?? {};
+        const roles = Object.keys(rolesClaim);
+        const me = {
+            user_id: claims.sub,
+            roles,
+            active: true,
+        };
+        if (verbose) {
+            me.info = {
+                username: claims.preferred_username,
+                email: claims.email,
+                email_verified: claims.email_verified,
+                name: claims.name,
+                picture: claims.picture,
+            };
+        }
+        return me;
+    }
+}

package/dist/v2/client/builder/builder.d.ts

@@ -0,0 +1,7 @@
+import createClient, { ClientOptions, Middleware as OpenAPIMiddleware } from "openapi-fetch";
+export declare class ClientBuilder<OpenAPIClientDefinitions extends {}> {
+    private middlewares;
+    constructor();
+    withMiddleware(...middlewares: OpenAPIMiddleware[]): this;
+    build(opts?: ClientOptions): ReturnType<typeof createClient<OpenAPIClientDefinitions>>;
+}

package/dist/v2/client/builder/builder.js

@@ -0,0 +1,14 @@
+import createClient from "openapi-fetch";
+export class ClientBuilder {
+    middlewares = [];
+    constructor() { }
+    withMiddleware(...middlewares) {
+        this.middlewares = this.middlewares.concat(middlewares);
+        return this;
+    }
+    build(opts) {
+        const client = createClient(opts);
+        client.use(...this.middlewares);
+        return client;
+    }
+}

package/dist/v2/client/builder/index.d.ts

@@ -0,0 +1,2 @@
+import { ClientBuilder } from "../../../v2/client/builder/builder.js";
+export { ClientBuilder };

package/dist/v2/client/builder/index.js

@@ -0,0 +1,2 @@
+import { ClientBuilder } from "../../../v2/client/builder/builder.js";
+export { ClientBuilder };

package/dist/v2/client/client.d.ts

@@ -0,0 +1,7 @@
+import createClient from "openapi-fetch";
+type Client = ReturnType<typeof createClient<{}>>;
+export declare class ClientInstance {
+    private static map;
+    New<T extends Client>(key: string, clientFactory: () => T): T;
+}
+export {};