@geekmidas/client 10.0.0-alpha.4 → 10.0.0-alpha.41

package/README.md

@@ -40,8 +40,8 @@ import { createEndpointHooks } from '@geekmidas/client/endpoint-hooks';
 // React Query client (class-based)
 import { createTypedQueryClient } from '@geekmidas/client/react-query';
 
-// OpenAPI hooks generation
-import { generateReactQueryHooks } from '@geekmidas/client/openapi';
+// OpenAPI hooks from a paths type
+import { createOpenAPIHooks } from '@geekmidas/client/openapi';
 
 // Type utilities
 import type { TypedApiFunction, FilteredRequestConfig } from '@geekmidas/client/types';
@@ -76,7 +76,7 @@ interface API {
       email: string;
     };
   };
-  'GET /users/:id': {
+  'GET /users/{id}': {
     params: {
       id: string;
     };
@@ -102,7 +102,7 @@ const user = await api('POST /users', {
 });
 // user is typed as { id: string; name: string; email: string }
 
-const singleUser = await api('GET /users/:id', {
+const singleUser = await api('GET /users/{id}', {
   params: { id: '123' }
 });
 // singleUser is typed as { id: string; name: string; email: string }
@@ -280,6 +280,26 @@ function CreateUser() {
 }
 ```
 
+### Method Calls
+
+Every client also answers by method — the same request as
+`api('POST /users', …)`, with the method as the call:
+
+```typescript
+await api.get('/health');                                   // declares nothing → no second argument
+await api.get('/users/{id}', { params: { id: '123' } });    // path params → argument required
+await api.post('/users', { body: { name: 'Ada', email } }); // body → argument required
+await api.get('/search', { query: { q: 'ada' } });          // required query key → required
+await api.get('/users', { query: { page: 2 } });            // optional query → optional
+
+await api.post('/users', { body: { name: 'Ada' } });        // ❌ `email` is missing
+await api.get('/health', { body: {} });                     // ❌ GET /health takes no body
+await api.post('/health');                                  // ❌ /health has no POST
+```
+
+The route autocompletes per method — only routes with a `POST` appear in
+`api.post` — and the second argument has only the keys the endpoint declares.
+
 ### Type-Safe Config Requirements
 
 The generated client enforces config requirements at the type level:
@@ -379,48 +399,10 @@ const api = Object.assign(fetcher, hooks);
 
 ## OpenAPI Code Generation
 
-Generate React Query hooks from OpenAPI specifications:
-
-```bash
-# Using CLI
-pnpm gkm generate:react-query --input api-docs.json --output ./src/api
-
-# Programmatic usage
-import { generateReactQueryHooks } from '@geekmidas/client/openapi';
-import fs from 'fs/promises';
-
-const spec = JSON.parse(await fs.readFile('api-docs.json', 'utf-8'));
-const code = await generateReactQueryHooks(spec);
-await fs.writeFile('./src/api/generated.ts', code);
-```
-
-Generated hooks example:
-
-```typescript
-// Generated from OpenAPI spec
-export const api = createTypedQueryClient<{
-  'GET /users': {
-    response: User[];
-  };
-  'POST /users': {
-    body: CreateUserRequest;
-    response: User;
-  };
-  // ... all your endpoints
-}>({
-  baseUrl: process.env.REACT_APP_API_URL
-});
-
-// Use generated hooks
-function MyComponent() {
-  const { data: users } = api.useQuery('GET /users');
-  const createUser = api.useMutation('POST /users');
-
-  return (
-    // Your component
-  );
-}
-```
+Each surface's typed client is written by `gkm build` (and kept current by
+`gkm dev`) to `.gkm/openapi/<surface>.ts`: its `createApi()` returns a typed
+fetcher with React Query hooks, built from the endpoints themselves rather
+than from a spec file.
 
 ## Advanced Features
 
@@ -433,14 +415,14 @@ Type-safe cache invalidation:
 await api.invalidateQueries('GET /users');
 
 // Invalidate with params
-await api.invalidateQueries('GET /users/:id', {
+await api.invalidateQueries('GET /users/{id}', {
   params: { id: '123' }
 });
 
 // Invalidate multiple queries
 await Promise.all([
   api.invalidateQueries('GET /users'),
-  api.invalidateQueries('GET /users/:id')
+  api.invalidateQueries('GET /users/{id}')
 ]);
 ```
 
@@ -449,20 +431,20 @@ await Promise.all([
 Implement optimistic UI updates:
 
 ```typescript
-const updateUser = api.useMutation('PUT /users/:id', {
+const updateUser = api.useMutation('PUT /users/{id}', {
   onMutate: async (variables) => {
     // Cancel outgoing refetches
-    await api.cancelQueries('GET /users/:id', {
+    await api.cancelQueries('GET /users/{id}', {
       params: { id: variables.params.id }
     });
 
     // Snapshot previous value
-    const previousUser = api.getQueryData('GET /users/:id', {
+    const previousUser = api.getQueryData('GET /users/{id}', {
       params: { id: variables.params.id }
     });
 
     // Optimistically update
-    api.setQueryData('GET /users/:id', {
+    api.setQueryData('GET /users/{id}', {
       params: { id: variables.params.id }
     }, variables.body);
 
@@ -471,14 +453,14 @@ const updateUser = api.useMutation('PUT /users/:id', {
   onError: (err, variables, context) => {
     // Rollback on error
     if (context?.previousUser) {
-      api.setQueryData('GET /users/:id', {
+      api.setQueryData('GET /users/{id}', {
         params: { id: variables.params.id }
       }, context.previousUser);
     }
   },
   onSettled: (data, error, variables) => {
     // Refetch after mutation
-    api.invalidateQueries('GET /users/:id', {
+    api.invalidateQueries('GET /users/{id}', {
       params: { id: variables.params.id }
     });
   }
@@ -499,7 +481,7 @@ const api = createTypedFetcher<API>({
 });
 
 // Per-request headers
-const user = await api('GET /users/:id', {
+const user = await api('GET /users/{id}', {
   params: { id: '123' },
   headers: {
     'X-Request-ID': requestId
@@ -515,7 +497,7 @@ Handle errors with full type safety:
 import { HttpError } from '@geekmidas/errors';
 
 try {
-  const user = await api('GET /users/:id', {
+  const user = await api('GET /users/{id}', {
     params: { id: '123' }
   });
 } catch (error) {
@@ -575,7 +557,7 @@ function UsersList() {
 
   const handleUserHover = (userId: string) => {
     // Prefetch user details on hover
-    api.prefetchQuery('GET /users/:id', {
+    api.prefetchQuery('GET /users/{id}', {
       params: { id: userId }
     });
   };

package/dist/auth-fetcher.cjs

@@ -1,4 +1,79 @@
-require('./fetcher-CwnSqc4D.cjs');
-const require_auth_fetcher = require('./auth-fetcher-HILABmws.cjs');
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_methods = require("./methods.cjs");
+const require_fetcher = require("./fetcher.cjs");
+//#region src/auth-fetcher.ts
+/**
+* Creates an auth-aware fetcher that automatically applies the correct
+* authentication based on the endpoint being called.
+*
+* @example
+* ```typescript
+* import { endpointAuth, securitySchemes, paths } from './openapi';
+* import { TokenClient } from '@geekmidas/auth/client';
+*
+* const tokenClient = new TokenClient({ ... });
+*
+* const api = createAuthAwareFetcher<paths>({
+*   baseURL: 'https://api.example.com',
+*   endpointAuth,
+*   securitySchemes,
+*   authStrategies: {
+*     bearer: { type: 'bearer', tokenProvider: tokenClient },
+*     iam: { type: 'iam', signer: awsSigner },
+*   },
+* });
+*
+* // Bearer auth automatically applied
+* const user = await api('GET /users/{id}', { params: { id: '123' } });
+*
+* // IAM SigV4 auth automatically applied
+* const tenant = await api('POST /tenants', { body: { name: 'Acme' } });
+* ```
+*/
+function createAuthAwareFetcher(options) {
+	const { endpointAuth, securitySchemes, authStrategies, onRequest: userOnRequest, ...fetcherOptions } = options;
+	const baseFetcher = new require_fetcher.TypedFetcher({
+		...fetcherOptions,
+		onRequest: userOnRequest
+	});
+	const fetcher = async (endpoint, config) => {
+		const schemeName = endpointAuth[endpoint];
+		let authHeaders = {};
+		if (schemeName) {
+			const scheme = securitySchemes[schemeName];
+			const strategy = authStrategies[schemeName];
+			if (strategy && scheme) authHeaders = await resolveAuthHeaders(strategy, scheme);
+		}
+		const existingHeaders = config && "headers" in config && config.headers ? config.headers : {};
+		const mergedConfig = {
+			...config,
+			headers: {
+				...authHeaders,
+				...existingHeaders
+			}
+		};
+		return baseFetcher.request(endpoint, mergedConfig);
+	};
+	const api = fetcher;
+	return Object.assign(api, require_methods.methodCalls(api));
+}
+/**
+* Resolves auth headers based on the strategy and scheme.
+*/
+async function resolveAuthHeaders(strategy, scheme) {
+	switch (strategy.type) {
+		case "bearer": return strategy.tokenProvider.createValidAuthHeaders();
+		case "apiKey": {
+			const apiKey = await strategy.apiKeyProvider.getApiKey();
+			const headerName = strategy.headerName || scheme.name || "X-API-Key";
+			if (scheme.in === "header" || !scheme.in) return { [headerName]: apiKey };
+			return {};
+		}
+		case "iam": return {};
+		default: return {};
+	}
+}
+//#endregion
+exports.createAuthAwareFetcher = createAuthAwareFetcher;
 
-exports.createAuthAwareFetcher = require_auth_fetcher.createAuthAwareFetcher;
+//# sourceMappingURL=auth-fetcher.cjs.map

package/dist/auth-fetcher.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fetcher.cjs","names":["TypedFetcher","methodCalls"],"sources":["../src/auth-fetcher.ts"],"sourcesContent":["import { TypedFetcher } from './fetcher';\nimport { type MethodCalls, methodCalls } from './methods';\nimport type {\n\tExtractEndpointResponse,\n\tFetcherOptions,\n\tFilteredRequestConfig,\n\tTypedApiFunction,\n\tTypedEndpoint,\n} from './types';\n\nexport type { FetcherOptions } from './types';\n\n/**\n * Security scheme object matching OpenAPI 3.1 specification.\n */\nexport interface SecuritySchemeObject {\n\ttype: 'apiKey' | 'http' | 'mutualTLS' | 'oauth2' | 'openIdConnect';\n\tdescription?: string;\n\tname?: string;\n\tin?: 'query' | 'header' | 'cookie';\n\tscheme?: string;\n\tbearerFormat?: string;\n\tflows?: Record<string, unknown>;\n\topenIdConnectUrl?: string;\n\t[key: string]: unknown;\n}\n\n/**\n * Extract all non-null security scheme IDs that are actually used in the API.\n * This gives us the union of scheme names that endpoints require.\n */\nexport type UsedSecuritySchemes<\n\tEndpointAuth extends Record<string, string | null>,\n> = NonNullable<EndpointAuth[keyof EndpointAuth]>;\n\n/**\n * Interface for token storage and retrieval.\n * Compatible with @geekmidas/auth TokenClient.\n */\nexport interface TokenProvider {\n\t/**\n\t * Get a valid access token, refreshing if necessary.\n\t */\n\tgetValidAccessToken(): Promise<string | null>;\n\n\t/**\n\t * Create Authorization headers from the current token.\n\t */\n\tcreateValidAuthHeaders(): Promise<Record<string, string>>;\n}\n\n/**\n * Interface for API key providers.\n */\nexport interface ApiKeyProvider {\n\t/**\n\t * Get the API key value.\n\t */\n\tgetApiKey(): Promise<string> | string;\n}\n\n/**\n * Interface for AWS SigV4 request signing.\n */\nexport interface AwsSigner {\n\t/**\n\t * Sign a request with AWS SigV4.\n\t * @param url - The request URL\n\t * @param init - The request init object\n\t * @returns Headers to add to the request\n\t */\n\tsign(url: string, init: RequestInit): Promise<Record<string, string>>;\n}\n\n/**\n * Auth strategy configuration for a specific security scheme type.\n */\nexport type AuthStrategy =\n\t| { type: 'bearer'; tokenProvider: TokenProvider }\n\t| { type: 'apiKey'; apiKeyProvider: ApiKeyProvider; headerName?: string }\n\t| { type: 'iam'; signer: AwsSigner }\n\t| { type: 'none' };\n\n/**\n * Options for creating an auth-aware fetcher.\n *\n * @template EndpointAuth - Map of endpoint strings to their auth scheme (or null for public)\n * @template SecuritySchemes - Available security scheme definitions\n */\nexport interface AuthFetcherOptions<\n\tEndpointAuth extends Record<string, string | null>,\n\tSecuritySchemes extends Record<string, SecuritySchemeObject>,\n> extends Omit<FetcherOptions, 'onRequest'> {\n\t/**\n\t * Runtime map of endpoints to their required auth scheme.\n\t * Generated by `gkm openapi --ts`.\n\t */\n\tendpointAuth: EndpointAuth;\n\n\t/**\n\t * Security scheme definitions.\n\t * Generated by `gkm openapi --ts`.\n\t */\n\tsecuritySchemes: SecuritySchemes;\n\n\t/**\n\t * Auth strategies for security schemes that are actually used.\n\t * Only schemes referenced in endpointAuth are required.\n\t *\n\t * @example\n\t * ```typescript\n\t * // If endpointAuth has: { 'GET /users': 'jwt', 'POST /data': 'iam', 'GET /public': null }\n\t * // Then authStrategies must include strategies for 'jwt' and 'iam'\n\t * authStrategies: {\n\t *   jwt: { type: 'bearer', tokenProvider },\n\t *   iam: { type: 'iam', signer: awsSigner },\n\t * }\n\t * ```\n\t */\n\tauthStrategies: Record<UsedSecuritySchemes<EndpointAuth>, AuthStrategy>;\n\n\t/**\n\t * Optional request interceptor (runs after auth headers are added).\n\t */\n\tonRequest?: (config: RequestInit) => RequestInit | Promise<RequestInit>;\n}\n\n/**\n * Creates an auth-aware fetcher that automatically applies the correct\n * authentication based on the endpoint being called.\n *\n * @example\n * ```typescript\n * import { endpointAuth, securitySchemes, paths } from './openapi';\n * import { TokenClient } from '@geekmidas/auth/client';\n *\n * const tokenClient = new TokenClient({ ... });\n *\n * const api = createAuthAwareFetcher<paths>({\n *   baseURL: 'https://api.example.com',\n *   endpointAuth,\n *   securitySchemes,\n *   authStrategies: {\n *     bearer: { type: 'bearer', tokenProvider: tokenClient },\n *     iam: { type: 'iam', signer: awsSigner },\n *   },\n * });\n *\n * // Bearer auth automatically applied\n * const user = await api('GET /users/{id}', { params: { id: '123' } });\n *\n * // IAM SigV4 auth automatically applied\n * const tenant = await api('POST /tenants', { body: { name: 'Acme' } });\n * ```\n */\nexport function createAuthAwareFetcher<\n\tPaths,\n\tEndpointAuth extends Record<string, string | null> = Record<\n\t\tstring,\n\t\tstring | null\n\t>,\n\tSecuritySchemes extends Record<string, SecuritySchemeObject> = Record<\n\t\tstring,\n\t\tSecuritySchemeObject\n\t>,\n>(\n\toptions: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {\n\t\tbaseURL: string;\n\t},\n): TypedApiFunction<Paths> & MethodCalls<Paths> {\n\tconst {\n\t\tendpointAuth,\n\t\tsecuritySchemes,\n\t\tauthStrategies,\n\t\tonRequest: userOnRequest,\n\t\t...fetcherOptions\n\t} = options;\n\n\t// Create base fetcher with user's onRequest if provided\n\tconst baseFetcher = new TypedFetcher<Paths>({\n\t\t...fetcherOptions,\n\t\tonRequest: userOnRequest,\n\t});\n\n\tconst fetcher = async <T extends TypedEndpoint<Paths>>(\n\t\tendpoint: T,\n\t\tconfig?: FilteredRequestConfig<Paths, T>,\n\t): Promise<ExtractEndpointResponse<Paths, T>> => {\n\t\t// Look up auth requirement for this endpoint\n\t\tconst schemeName = endpointAuth[endpoint as keyof EndpointAuth] as\n\t\t\t| string\n\t\t\t| null;\n\n\t\tlet authHeaders: Record<string, string> = {};\n\n\t\tif (schemeName) {\n\t\t\tconst scheme = securitySchemes[schemeName as keyof SecuritySchemes];\n\t\t\t// Since authStrategies is now required to have all used schemes,\n\t\t\t// we can safely access it - TypeScript ensures the strategy exists\n\t\t\tconst strategy =\n\t\t\t\tauthStrategies[schemeName as UsedSecuritySchemes<EndpointAuth>];\n\n\t\t\tif (strategy && scheme) {\n\t\t\t\tauthHeaders = await resolveAuthHeaders(strategy, scheme);\n\t\t\t}\n\t\t}\n\n\t\t// Merge auth headers with config headers\n\t\tconst existingHeaders =\n\t\t\tconfig && 'headers' in config && config.headers\n\t\t\t\t? (config.headers as Record<string, string>)\n\t\t\t\t: {};\n\n\t\tconst mergedConfig = {\n\t\t\t...config,\n\t\t\theaders: {\n\t\t\t\t...authHeaders,\n\t\t\t\t...existingHeaders,\n\t\t\t},\n\t\t} as unknown as FilteredRequestConfig<Paths, T>;\n\n\t\treturn baseFetcher.request(endpoint, mergedConfig);\n\t};\n\n\tconst api = fetcher as TypedApiFunction<Paths>;\n\treturn Object.assign(api, methodCalls<Paths>(api));\n}\n\n/**\n * Resolves auth headers based on the strategy and scheme.\n */\nasync function resolveAuthHeaders(\n\tstrategy: AuthStrategy,\n\tscheme: SecuritySchemeObject,\n): Promise<Record<string, string>> {\n\tswitch (strategy.type) {\n\t\tcase 'bearer': {\n\t\t\treturn strategy.tokenProvider.createValidAuthHeaders();\n\t\t}\n\n\t\tcase 'apiKey': {\n\t\t\tconst apiKey = await strategy.apiKeyProvider.getApiKey();\n\t\t\tconst headerName = strategy.headerName || scheme.name || 'X-API-Key';\n\n\t\t\tif (scheme.in === 'header' || !scheme.in) {\n\t\t\t\treturn { [headerName]: apiKey };\n\t\t\t}\n\t\t\t// Note: query and cookie API keys are handled differently\n\t\t\t// For now, we only support header-based API keys\n\t\t\treturn {};\n\t\t}\n\n\t\tcase 'iam': {\n\t\t\t// IAM signing requires the full URL and request config\n\t\t\t// This is a simplified version - full implementation would need\n\t\t\t// access to the complete request\n\t\t\t// For now, return empty - the actual signing should be done\n\t\t\t// in a custom onRequest interceptor if needed\n\t\t\treturn {};\n\t\t}\n\t\tdefault:\n\t\t\treturn {};\n\t}\n}\n\n/**\n * Type helper to extract the security scheme ID from an endpoint.\n */\nexport type GetEndpointAuth<\n\tEndpointAuth extends Record<string, string | null>,\n\tEndpoint extends keyof EndpointAuth,\n> = EndpointAuth[Endpoint];\n\n/**\n * Type helper to get all authenticated endpoints.\n */\nexport type AuthenticatedEndpoints<\n\tEndpointAuth extends Record<string, string | null>,\n> = {\n\t[K in keyof EndpointAuth]: EndpointAuth[K] extends null ? never : K;\n}[keyof EndpointAuth];\n\n/**\n * Type helper to get all public endpoints.\n */\nexport type PublicEndpoints<\n\tEndpointAuth extends Record<string, string | null>,\n> = {\n\t[K in keyof EndpointAuth]: EndpointAuth[K] extends null ? K : never;\n}[keyof EndpointAuth];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2JA,SAAgB,uBAWf,SAG+C;CAC/C,MAAM,EACL,cACA,iBACA,gBACA,WAAW,eACX,GAAG,mBACA;CAGJ,MAAM,cAAc,IAAIA,gBAAAA,aAAoB;EAC3C,GAAG;EACH,WAAW;CACZ,CAAC;CAED,MAAM,UAAU,OACf,UACA,WACgD;EAEhD,MAAM,aAAa,aAAa;EAIhC,IAAI,cAAsC,CAAC;EAE3C,IAAI,YAAY;GACf,MAAM,SAAS,gBAAgB;GAG/B,MAAM,WACL,eAAe;GAEhB,IAAI,YAAY,QACf,cAAc,MAAM,mBAAmB,UAAU,MAAM;EAEzD;EAGA,MAAM,kBACL,UAAU,aAAa,UAAU,OAAO,UACpC,OAAO,UACR,CAAC;EAEL,MAAM,eAAe;GACpB,GAAG;GACH,SAAS;IACR,GAAG;IACH,GAAG;GACJ;EACD;EAEA,OAAO,YAAY,QAAQ,UAAU,YAAY;CAClD;CAEA,MAAM,MAAM;CACZ,OAAO,OAAO,OAAO,KAAKC,gBAAAA,YAAmB,GAAG,CAAC;AAClD;;;;AAKA,eAAe,mBACd,UACA,QACkC;CAClC,QAAQ,SAAS,MAAjB;EACC,KAAK,UACJ,OAAO,SAAS,cAAc,uBAAuB;EAGtD,KAAK,UAAU;GACd,MAAM,SAAS,MAAM,SAAS,eAAe,UAAU;GACvD,MAAM,aAAa,SAAS,cAAc,OAAO,QAAQ;GAEzD,IAAI,OAAO,OAAO,YAAY,CAAC,OAAO,IACrC,OAAO,GAAG,aAAa,OAAO;GAI/B,OAAO,CAAC;EACT;EAEA,KAAK,OAMJ,OAAO,CAAC;EAET,SACC,OAAO,CAAC;CACV;AACD"}

package/dist/auth-fetcher.d.cts

@@ -1,3 +1,156 @@
-import { FetcherOptions } from "./types-DMQMHePI.cjs";
-import { ApiKeyProvider, AuthFetcherOptions, AuthStrategy, AuthenticatedEndpoints, AwsSigner, GetEndpointAuth, PublicEndpoints, SecuritySchemeObject, TokenProvider, UsedSecuritySchemes, createAuthAwareFetcher } from "./auth-fetcher-CBYuL6rx.cjs";
-export { ApiKeyProvider, AuthFetcherOptions, AuthStrategy, AuthenticatedEndpoints, AwsSigner, FetcherOptions, GetEndpointAuth, PublicEndpoints, SecuritySchemeObject, TokenProvider, UsedSecuritySchemes, createAuthAwareFetcher };
+import { FetcherOptions, TypedApiFunction } from "./types.cjs";
+import { MethodCalls } from "./methods.cjs";
+//#region src/auth-fetcher.d.ts
+/**
+ * Security scheme object matching OpenAPI 3.1 specification.
+ */
+export interface SecuritySchemeObject {
+  type: 'apiKey' | 'http' | 'mutualTLS' | 'oauth2' | 'openIdConnect';
+  description?: string;
+  name?: string;
+  in?: 'query' | 'header' | 'cookie';
+  scheme?: string;
+  bearerFormat?: string;
+  flows?: Record<string, unknown>;
+  openIdConnectUrl?: string;
+  [key: string]: unknown;
+}
+/**
+ * Extract all non-null security scheme IDs that are actually used in the API.
+ * This gives us the union of scheme names that endpoints require.
+ */
+export type UsedSecuritySchemes<EndpointAuth extends Record<string, string | null>> = NonNullable<EndpointAuth[keyof EndpointAuth]>;
+/**
+ * Interface for token storage and retrieval.
+ * Compatible with @geekmidas/auth TokenClient.
+ */
+export interface TokenProvider {
+  /**
+   * Get a valid access token, refreshing if necessary.
+   */
+  getValidAccessToken(): Promise<string | null>;
+  /**
+   * Create Authorization headers from the current token.
+   */
+  createValidAuthHeaders(): Promise<Record<string, string>>;
+}
+/**
+ * Interface for API key providers.
+ */
+export interface ApiKeyProvider {
+  /**
+   * Get the API key value.
+   */
+  getApiKey(): Promise<string> | string;
+}
+/**
+ * Interface for AWS SigV4 request signing.
+ */
+export interface AwsSigner {
+  /**
+   * Sign a request with AWS SigV4.
+   * @param url - The request URL
+   * @param init - The request init object
+   * @returns Headers to add to the request
+   */
+  sign(url: string, init: RequestInit): Promise<Record<string, string>>;
+}
+/**
+ * Auth strategy configuration for a specific security scheme type.
+ */
+export type AuthStrategy = {
+  type: 'bearer';
+  tokenProvider: TokenProvider;
+} | {
+  type: 'apiKey';
+  apiKeyProvider: ApiKeyProvider;
+  headerName?: string;
+} | {
+  type: 'iam';
+  signer: AwsSigner;
+} | {
+  type: 'none';
+};
+/**
+ * Options for creating an auth-aware fetcher.
+ *
+ * @template EndpointAuth - Map of endpoint strings to their auth scheme (or null for public)
+ * @template SecuritySchemes - Available security scheme definitions
+ */
+export interface AuthFetcherOptions<EndpointAuth extends Record<string, string | null>, SecuritySchemes extends Record<string, SecuritySchemeObject>> extends Omit<FetcherOptions, 'onRequest'> {
+  /**
+   * Runtime map of endpoints to their required auth scheme.
+   * Generated by `gkm openapi --ts`.
+   */
+  endpointAuth: EndpointAuth;
+  /**
+   * Security scheme definitions.
+   * Generated by `gkm openapi --ts`.
+   */
+  securitySchemes: SecuritySchemes;
+  /**
+   * Auth strategies for security schemes that are actually used.
+   * Only schemes referenced in endpointAuth are required.
+   *
+   * @example
+   * ```typescript
+   * // If endpointAuth has: { 'GET /users': 'jwt', 'POST /data': 'iam', 'GET /public': null }
+   * // Then authStrategies must include strategies for 'jwt' and 'iam'
+   * authStrategies: {
+   *   jwt: { type: 'bearer', tokenProvider },
+   *   iam: { type: 'iam', signer: awsSigner },
+   * }
+   * ```
+   */
+  authStrategies: Record<UsedSecuritySchemes<EndpointAuth>, AuthStrategy>;
+  /**
+   * Optional request interceptor (runs after auth headers are added).
+   */
+  onRequest?: (config: RequestInit) => RequestInit | Promise<RequestInit>;
+}
+/**
+ * Creates an auth-aware fetcher that automatically applies the correct
+ * authentication based on the endpoint being called.
+ *
+ * @example
+ * ```typescript
+ * import { endpointAuth, securitySchemes, paths } from './openapi';
+ * import { TokenClient } from '@geekmidas/auth/client';
+ *
+ * const tokenClient = new TokenClient({ ... });
+ *
+ * const api = createAuthAwareFetcher<paths>({
+ *   baseURL: 'https://api.example.com',
+ *   endpointAuth,
+ *   securitySchemes,
+ *   authStrategies: {
+ *     bearer: { type: 'bearer', tokenProvider: tokenClient },
+ *     iam: { type: 'iam', signer: awsSigner },
+ *   },
+ * });
+ *
+ * // Bearer auth automatically applied
+ * const user = await api('GET /users/{id}', { params: { id: '123' } });
+ *
+ * // IAM SigV4 auth automatically applied
+ * const tenant = await api('POST /tenants', { body: { name: 'Acme' } });
+ * ```
+ */
+export declare function createAuthAwareFetcher<Paths, EndpointAuth extends Record<string, string | null> = Record<string, string | null>, SecuritySchemes extends Record<string, SecuritySchemeObject> = Record<string, SecuritySchemeObject>>(options: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {
+  baseURL: string;
+}): TypedApiFunction<Paths> & MethodCalls<Paths>;
+/**
+ * Type helper to extract the security scheme ID from an endpoint.
+ */
+export type GetEndpointAuth<EndpointAuth extends Record<string, string | null>, Endpoint extends keyof EndpointAuth> = EndpointAuth[Endpoint];
+/**
+ * Type helper to get all authenticated endpoints.
+ */
+export type AuthenticatedEndpoints<EndpointAuth extends Record<string, string | null>> = { [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? never : K; }[keyof EndpointAuth];
+/**
+ * Type helper to get all public endpoints.
+ */
+export type PublicEndpoints<EndpointAuth extends Record<string, string | null>> = { [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? K : never; }[keyof EndpointAuth];
+//#endregion
+export type { FetcherOptions };
+//# sourceMappingURL=auth-fetcher.d.cts.map

package/dist/auth-fetcher.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fetcher.d.cts","names":[],"sources":["../src/auth-fetcher.ts"],"mappings":";;;;;;iBAeiB;EAChB;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;GACC;;;;;;YAOU,oBACX,qBAAqB,iCAClB,YAAY,mBAAmB;;;;;iBAMlB;;;;EAIhB,uBAAuB;;;;EAKvB,0BAA0B,QAAQ;;;;;iBAMlB;;;;EAIhB,aAAa;;;;;iBAMG;;;;;;;EAOhB,KAAK,aAAa,MAAM,cAAc,QAAQ;;;;;YAMnC;EACP;EAAgB,eAAe;;EAC/B;EAAgB,gBAAgB;EAAgB;;EAChD;EAAa,QAAQ;;EACrB;;;;;;;;iBAQY,mBAChB,qBAAqB,+BACrB,wBAAwB,eAAe,+BAC9B,KAAK;;;;;EAKd,cAAc;;;;;EAMd,iBAAiB;;;;;;;;;;;;;;;EAgBjB,gBAAgB,OAAO,oBAAoB,eAAe;;;;EAK1D,aAAa,QAAQ,gBAAgB,cAAc,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA+B5C,uBACf,OACA,qBAAqB,gCAAgC,+BAIrD,wBAAwB,eAAe,wBAAwB,eAE9D,uBAGD,SAAS,mBAAmB,cAAc;EACzC;IAEC,iBAAiB,SAAS,YAAY;;;;YAmG7B,gBACX,qBAAqB,+BACrB,uBAAuB,gBACpB,aAAa;;;;YAKL,uBACX,qBAAqB,oCAEpB,WAAW,eAAe,aAAa,0BAA0B,WAC3D;;;;YAKI,gBACX,qBAAqB,oCAEpB,WAAW,eAAe,aAAa,kBAAkB,mBACnD"}

package/dist/auth-fetcher.d.mts

@@ -1,3 +1,156 @@
-import { FetcherOptions } from "./types-BMGM6sZc.mjs";
-import { ApiKeyProvider, AuthFetcherOptions, AuthStrategy, AuthenticatedEndpoints, AwsSigner, GetEndpointAuth, PublicEndpoints, SecuritySchemeObject, TokenProvider, UsedSecuritySchemes, createAuthAwareFetcher } from "./auth-fetcher-DxS8zOLc.mjs";
-export { ApiKeyProvider, AuthFetcherOptions, AuthStrategy, AuthenticatedEndpoints, AwsSigner, FetcherOptions, GetEndpointAuth, PublicEndpoints, SecuritySchemeObject, TokenProvider, UsedSecuritySchemes, createAuthAwareFetcher };
+import { FetcherOptions, TypedApiFunction } from "./types.mjs";
+import { MethodCalls } from "./methods.mjs";
+//#region src/auth-fetcher.d.ts
+/**
+ * Security scheme object matching OpenAPI 3.1 specification.
+ */
+export interface SecuritySchemeObject {
+  type: 'apiKey' | 'http' | 'mutualTLS' | 'oauth2' | 'openIdConnect';
+  description?: string;
+  name?: string;
+  in?: 'query' | 'header' | 'cookie';
+  scheme?: string;
+  bearerFormat?: string;
+  flows?: Record<string, unknown>;
+  openIdConnectUrl?: string;
+  [key: string]: unknown;
+}
+/**
+ * Extract all non-null security scheme IDs that are actually used in the API.
+ * This gives us the union of scheme names that endpoints require.
+ */
+export type UsedSecuritySchemes<EndpointAuth extends Record<string, string | null>> = NonNullable<EndpointAuth[keyof EndpointAuth]>;
+/**
+ * Interface for token storage and retrieval.
+ * Compatible with @geekmidas/auth TokenClient.
+ */
+export interface TokenProvider {
+  /**
+   * Get a valid access token, refreshing if necessary.
+   */
+  getValidAccessToken(): Promise<string | null>;
+  /**
+   * Create Authorization headers from the current token.
+   */
+  createValidAuthHeaders(): Promise<Record<string, string>>;
+}
+/**
+ * Interface for API key providers.
+ */
+export interface ApiKeyProvider {
+  /**
+   * Get the API key value.
+   */
+  getApiKey(): Promise<string> | string;
+}
+/**
+ * Interface for AWS SigV4 request signing.
+ */
+export interface AwsSigner {
+  /**
+   * Sign a request with AWS SigV4.
+   * @param url - The request URL
+   * @param init - The request init object
+   * @returns Headers to add to the request
+   */
+  sign(url: string, init: RequestInit): Promise<Record<string, string>>;
+}
+/**
+ * Auth strategy configuration for a specific security scheme type.
+ */
+export type AuthStrategy = {
+  type: 'bearer';
+  tokenProvider: TokenProvider;
+} | {
+  type: 'apiKey';
+  apiKeyProvider: ApiKeyProvider;
+  headerName?: string;
+} | {
+  type: 'iam';
+  signer: AwsSigner;
+} | {
+  type: 'none';
+};
+/**
+ * Options for creating an auth-aware fetcher.
+ *
+ * @template EndpointAuth - Map of endpoint strings to their auth scheme (or null for public)
+ * @template SecuritySchemes - Available security scheme definitions
+ */
+export interface AuthFetcherOptions<EndpointAuth extends Record<string, string | null>, SecuritySchemes extends Record<string, SecuritySchemeObject>> extends Omit<FetcherOptions, 'onRequest'> {
+  /**
+   * Runtime map of endpoints to their required auth scheme.
+   * Generated by `gkm openapi --ts`.
+   */
+  endpointAuth: EndpointAuth;
+  /**
+   * Security scheme definitions.
+   * Generated by `gkm openapi --ts`.
+   */
+  securitySchemes: SecuritySchemes;
+  /**
+   * Auth strategies for security schemes that are actually used.
+   * Only schemes referenced in endpointAuth are required.
+   *
+   * @example
+   * ```typescript
+   * // If endpointAuth has: { 'GET /users': 'jwt', 'POST /data': 'iam', 'GET /public': null }
+   * // Then authStrategies must include strategies for 'jwt' and 'iam'
+   * authStrategies: {
+   *   jwt: { type: 'bearer', tokenProvider },
+   *   iam: { type: 'iam', signer: awsSigner },
+   * }
+   * ```
+   */
+  authStrategies: Record<UsedSecuritySchemes<EndpointAuth>, AuthStrategy>;
+  /**
+   * Optional request interceptor (runs after auth headers are added).
+   */
+  onRequest?: (config: RequestInit) => RequestInit | Promise<RequestInit>;
+}
+/**
+ * Creates an auth-aware fetcher that automatically applies the correct
+ * authentication based on the endpoint being called.
+ *
+ * @example
+ * ```typescript
+ * import { endpointAuth, securitySchemes, paths } from './openapi';
+ * import { TokenClient } from '@geekmidas/auth/client';
+ *
+ * const tokenClient = new TokenClient({ ... });
+ *
+ * const api = createAuthAwareFetcher<paths>({
+ *   baseURL: 'https://api.example.com',
+ *   endpointAuth,
+ *   securitySchemes,
+ *   authStrategies: {
+ *     bearer: { type: 'bearer', tokenProvider: tokenClient },
+ *     iam: { type: 'iam', signer: awsSigner },
+ *   },
+ * });
+ *
+ * // Bearer auth automatically applied
+ * const user = await api('GET /users/{id}', { params: { id: '123' } });
+ *
+ * // IAM SigV4 auth automatically applied
+ * const tenant = await api('POST /tenants', { body: { name: 'Acme' } });
+ * ```
+ */
+export declare function createAuthAwareFetcher<Paths, EndpointAuth extends Record<string, string | null> = Record<string, string | null>, SecuritySchemes extends Record<string, SecuritySchemeObject> = Record<string, SecuritySchemeObject>>(options: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {
+  baseURL: string;
+}): TypedApiFunction<Paths> & MethodCalls<Paths>;
+/**
+ * Type helper to extract the security scheme ID from an endpoint.
+ */
+export type GetEndpointAuth<EndpointAuth extends Record<string, string | null>, Endpoint extends keyof EndpointAuth> = EndpointAuth[Endpoint];
+/**
+ * Type helper to get all authenticated endpoints.
+ */
+export type AuthenticatedEndpoints<EndpointAuth extends Record<string, string | null>> = { [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? never : K; }[keyof EndpointAuth];
+/**
+ * Type helper to get all public endpoints.
+ */
+export type PublicEndpoints<EndpointAuth extends Record<string, string | null>> = { [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? K : never; }[keyof EndpointAuth];
+//#endregion
+export type { FetcherOptions };
+//# sourceMappingURL=auth-fetcher.d.mts.map

package/dist/auth-fetcher.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fetcher.d.mts","names":[],"sources":["../src/auth-fetcher.ts"],"mappings":";;;;;;iBAeiB;EAChB;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR;GACC;;;;;;YAOU,oBACX,qBAAqB,iCAClB,YAAY,mBAAmB;;;;;iBAMlB;;;;EAIhB,uBAAuB;;;;EAKvB,0BAA0B,QAAQ;;;;;iBAMlB;;;;EAIhB,aAAa;;;;;iBAMG;;;;;;;EAOhB,KAAK,aAAa,MAAM,cAAc,QAAQ;;;;;YAMnC;EACP;EAAgB,eAAe;;EAC/B;EAAgB,gBAAgB;EAAgB;;EAChD;EAAa,QAAQ;;EACrB;;;;;;;;iBAQY,mBAChB,qBAAqB,+BACrB,wBAAwB,eAAe,+BAC9B,KAAK;;;;;EAKd,cAAc;;;;;EAMd,iBAAiB;;;;;;;;;;;;;;;EAgBjB,gBAAgB,OAAO,oBAAoB,eAAe;;;;EAK1D,aAAa,QAAQ,gBAAgB,cAAc,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA+B5C,uBACf,OACA,qBAAqB,gCAAgC,+BAIrD,wBAAwB,eAAe,wBAAwB,eAE9D,uBAGD,SAAS,mBAAmB,cAAc;EACzC;IAEC,iBAAiB,SAAS,YAAY;;;;YAmG7B,gBACX,qBAAqB,+BACrB,uBAAuB,gBACpB,aAAa;;;;YAKL,uBACX,qBAAqB,oCAEpB,WAAW,eAAe,aAAa,0BAA0B,WAC3D;;;;YAKI,gBACX,qBAAqB,oCAEpB,WAAW,eAAe,aAAa,kBAAkB,mBACnD"}