@geekmidas/client 9.0.2 → 10.0.0-alpha.0

package/dist/auth-fetcher-CBYuL6rx.d.cts

@@ -0,0 +1,158 @@
+import { FetcherOptions, TypedApiFunction } from "./types-DMQMHePI.cjs";
+
+//#region src/auth-fetcher.d.ts
+
+/**
+ * Security scheme object matching OpenAPI 3.1 specification.
+ */
+interface SecuritySchemeObject {
+  type: 'apiKey' | 'http' | 'mutualTLS' | 'oauth2' | 'openIdConnect';
+  description?: string;
+  name?: string;
+  in?: 'query' | 'header' | 'cookie';
+  scheme?: string;
+  bearerFormat?: string;
+  flows?: Record<string, unknown>;
+  openIdConnectUrl?: string;
+  [key: string]: unknown;
+}
+/**
+ * Extract all non-null security scheme IDs that are actually used in the API.
+ * This gives us the union of scheme names that endpoints require.
+ */
+type UsedSecuritySchemes<EndpointAuth extends Record<string, string | null>> = NonNullable<EndpointAuth[keyof EndpointAuth]>;
+/**
+ * Interface for token storage and retrieval.
+ * Compatible with @geekmidas/auth TokenClient.
+ */
+interface TokenProvider {
+  /**
+   * Get a valid access token, refreshing if necessary.
+   */
+  getValidAccessToken(): Promise<string | null>;
+  /**
+   * Create Authorization headers from the current token.
+   */
+  createValidAuthHeaders(): Promise<Record<string, string>>;
+}
+/**
+ * Interface for API key providers.
+ */
+interface ApiKeyProvider {
+  /**
+   * Get the API key value.
+   */
+  getApiKey(): Promise<string> | string;
+}
+/**
+ * Interface for AWS SigV4 request signing.
+ */
+interface AwsSigner {
+  /**
+   * Sign a request with AWS SigV4.
+   * @param url - The request URL
+   * @param init - The request init object
+   * @returns Headers to add to the request
+   */
+  sign(url: string, init: RequestInit): Promise<Record<string, string>>;
+}
+/**
+ * Auth strategy configuration for a specific security scheme type.
+ */
+type AuthStrategy = {
+  type: 'bearer';
+  tokenProvider: TokenProvider;
+} | {
+  type: 'apiKey';
+  apiKeyProvider: ApiKeyProvider;
+  headerName?: string;
+} | {
+  type: 'iam';
+  signer: AwsSigner;
+} | {
+  type: 'none';
+};
+/**
+ * Options for creating an auth-aware fetcher.
+ *
+ * @template EndpointAuth - Map of endpoint strings to their auth scheme (or null for public)
+ * @template SecuritySchemes - Available security scheme definitions
+ */
+interface AuthFetcherOptions<EndpointAuth extends Record<string, string | null>, SecuritySchemes extends Record<string, SecuritySchemeObject>> extends Omit<FetcherOptions, 'onRequest'> {
+  /**
+   * Runtime map of endpoints to their required auth scheme.
+   * Generated by `gkm openapi --ts`.
+   */
+  endpointAuth: EndpointAuth;
+  /**
+   * Security scheme definitions.
+   * Generated by `gkm openapi --ts`.
+   */
+  securitySchemes: SecuritySchemes;
+  /**
+   * Auth strategies for security schemes that are actually used.
+   * Only schemes referenced in endpointAuth are required.
+   *
+   * @example
+   * ```typescript
+   * // If endpointAuth has: { 'GET /users': 'jwt', 'POST /data': 'iam', 'GET /public': null }
+   * // Then authStrategies must include strategies for 'jwt' and 'iam'
+   * authStrategies: {
+   *   jwt: { type: 'bearer', tokenProvider },
+   *   iam: { type: 'iam', signer: awsSigner },
+   * }
+   * ```
+   */
+  authStrategies: Record<UsedSecuritySchemes<EndpointAuth>, AuthStrategy>;
+  /**
+   * Optional request interceptor (runs after auth headers are added).
+   */
+  onRequest?: (config: RequestInit) => RequestInit | Promise<RequestInit>;
+}
+/**
+ * Creates an auth-aware fetcher that automatically applies the correct
+ * authentication based on the endpoint being called.
+ *
+ * @example
+ * ```typescript
+ * import { endpointAuth, securitySchemes, paths } from './openapi';
+ * import { TokenClient } from '@geekmidas/auth/client';
+ *
+ * const tokenClient = new TokenClient({ ... });
+ *
+ * const api = createAuthAwareFetcher<paths>({
+ *   baseURL: 'https://api.example.com',
+ *   endpointAuth,
+ *   securitySchemes,
+ *   authStrategies: {
+ *     bearer: { type: 'bearer', tokenProvider: tokenClient },
+ *     iam: { type: 'iam', signer: awsSigner },
+ *   },
+ * });
+ *
+ * // Bearer auth automatically applied
+ * const user = await api('GET /users/{id}', { params: { id: '123' } });
+ *
+ * // IAM SigV4 auth automatically applied
+ * const tenant = await api('POST /tenants', { body: { name: 'Acme' } });
+ * ```
+ */
+declare function createAuthAwareFetcher<Paths, EndpointAuth extends Record<string, string | null> = Record<string, string | null>, SecuritySchemes extends Record<string, SecuritySchemeObject> = Record<string, SecuritySchemeObject>>(options: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {
+  baseURL: string;
+}): TypedApiFunction<Paths>;
+/**
+ * Type helper to extract the security scheme ID from an endpoint.
+ */
+type GetEndpointAuth<EndpointAuth extends Record<string, string | null>, Endpoint extends keyof EndpointAuth> = EndpointAuth[Endpoint];
+/**
+ * Type helper to get all authenticated endpoints.
+ */
+type AuthenticatedEndpoints<EndpointAuth extends Record<string, string | null>> = { [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? never : K }[keyof EndpointAuth];
+/**
+ * Type helper to get all public endpoints.
+ */
+type PublicEndpoints<EndpointAuth extends Record<string, string | null>> = { [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? K : never }[keyof EndpointAuth];
+//# sourceMappingURL=auth-fetcher.d.ts.map
+//#endregion
+export { ApiKeyProvider, AuthFetcherOptions, AuthStrategy, AuthenticatedEndpoints, AwsSigner, GetEndpointAuth, PublicEndpoints, SecuritySchemeObject, TokenProvider, UsedSecuritySchemes, createAuthAwareFetcher };
+//# sourceMappingURL=auth-fetcher-CBYuL6rx.d.cts.map

package/dist/auth-fetcher-CBYuL6rx.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fetcher-CBYuL6rx.d.cts","names":[],"sources":["../src/auth-fetcher.ts"],"sourcesContent":[],"mappings":";;;;;AAcA;AAgBA;AAA+B,UAhBd,oBAAA,CAgBc;EAAA,IACT,EAAA,QAAA,GAAA,MAAA,GAAA,WAAA,GAAA,QAAA,GAAA,eAAA;EAAM,WACZ,CAAA,EAAA,MAAA;EAAY,IAAO,CAAA,EAAA,MAAA;EAAY,EAAA,CAA3C,EAAA,OAAA,GAAA,QAAA,GAAA,QAAA;EAAW,MAAA,CAAA,EAAA,MAAA;EAME,YAAA,CAAA,EAAA,MAAa;EAAA,KAAA,CAAA,EAjBrB,MAiBqB,CAAA,MAAA,EAAA,OAAA,CAAA;EAAA,gBAIN,CAAA,EAAA,MAAA;EAAO,CAAA,GAKI,EAAA,MAAA,CAAA,EAAA,OAAA;;AAAD;AAMlC;AAUA;;AAOyB,KAxCb,mBAwCa,CAAA,qBAvCH,MAuCG,CAAA,MAAA,EAAA,MAAA,GAAA,IAAA,CAAA,CAAA,GAtCrB,WAsCqB,CAtCT,YAsCS,CAAA,MAtCU,YAsCV,CAAA,CAAA;;;AAAqB;AAM9C;AAAwB,UAtCP,aAAA,CAsCO;EAAA;;;EAGW,mBAAA,EAAA,EArCX,OAqCW,CAAA,MAAA,GAAA,IAAA,CAAA;EASlB;;;EACW,sBACY,EAAA,EA3Cb,OA2Ca,CA3CL,MA2CK,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;;;;;AA4BI,UAjE3B,cAAA,CAiE2B;EAAY;;;EAAjC,SAKD,EAAA,EAlER,OAkEQ,CAAA,MAAA,CAAA,GAAA,MAAA;;;;;AAhCR,UA5BG,SAAA,CA4BH;EA+DE;;;;;;EAMe,IAE7B,CAAA,GAAA,EAAA,MAAA,EAAA,IAAA,EA5FuB,WA4FvB,CAAA,EA5FqC,OA4FrC,CA5F6C,MA4F7C,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;;;;;AAMkB,KA5FR,YAAA,GA4FQ;EAAK,IAAtB,EAAA,QAAA;EAAgB,aAAA,EA3FiB,aA2FjB;AAkGnB,CAAA,GAAY;EAAe,IAAA,EAAA,QAAA;EAAA,cACL,EA7Le,cA6Lf;EAAM,UACJ,CAAA,EAAA,MAAA;CAAY,GAAA;EACpB,IAAC,EAAA,KAAA;EAAQ,MAAA,EA9LC,SA8LD;AAKzB,CAAA,GAAY;EAAsB,IAAA,EAAA,MAAA;CAAA;;;;;;AAId;AAKR,UAnMK,kBAmMU,CAAA,qBAlML,MAkMK,CAAA,MAAA,EAAA,MAAA,GAAA,IAAA,CAAA,EAAA,wBAjMF,MAiME,CAAA,MAAA,EAjMa,oBAiMb,CAAA,CAAA,SAhMjB,IAgMiB,CAhMZ,cAgMY,EAAA,WAAA,CAAA,CAAA;EAAA;;;;EAGa,YAAC,EA9L1B,YA8L0B;EAAC;;AACtB;;mBAzLF;;;;;;;;;;;;;;;kBAgBD,OAAO,oBAAoB,eAAe;;;;uBAKrC,gBAAgB,cAAc,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+B5C,mDAEM,gCAAgC,uDAI7B,eAAe,wBAAwB,eAE9D,gCAGQ,mBAAmB,cAAc;;IAGxC,iBAAiB;;;;KAkGR,qCACU,sDACE,gBACpB,aAAa;;;;KAKL,4CACU,+CAET,eAAe,aAAa,0BAA0B,UAC3D;;;;KAKI,qCACU,+CAET,eAAe,aAAa,kBAAkB,kBACnD"}

package/dist/auth-fetcher-DOj0iz21.mjs

@@ -0,0 +1,77 @@
+import { TypedFetcher } from "./fetcher-CakjC9C7.mjs";
+
+//#region src/auth-fetcher.ts
+/**
+* Creates an auth-aware fetcher that automatically applies the correct
+* authentication based on the endpoint being called.
+*
+* @example
+* ```typescript
+* import { endpointAuth, securitySchemes, paths } from './openapi';
+* import { TokenClient } from '@geekmidas/auth/client';
+*
+* const tokenClient = new TokenClient({ ... });
+*
+* const api = createAuthAwareFetcher<paths>({
+*   baseURL: 'https://api.example.com',
+*   endpointAuth,
+*   securitySchemes,
+*   authStrategies: {
+*     bearer: { type: 'bearer', tokenProvider: tokenClient },
+*     iam: { type: 'iam', signer: awsSigner },
+*   },
+* });
+*
+* // Bearer auth automatically applied
+* const user = await api('GET /users/{id}', { params: { id: '123' } });
+*
+* // IAM SigV4 auth automatically applied
+* const tenant = await api('POST /tenants', { body: { name: 'Acme' } });
+* ```
+*/
+function createAuthAwareFetcher(options) {
+	const { endpointAuth, securitySchemes, authStrategies, onRequest: userOnRequest,...fetcherOptions } = options;
+	const baseFetcher = new TypedFetcher({
+		...fetcherOptions,
+		onRequest: userOnRequest
+	});
+	const fetcher = async (endpoint, config) => {
+		const schemeName = endpointAuth[endpoint];
+		let authHeaders = {};
+		if (schemeName) {
+			const scheme = securitySchemes[schemeName];
+			const strategy = authStrategies[schemeName];
+			if (strategy && scheme) authHeaders = await resolveAuthHeaders(strategy, scheme);
+		}
+		const existingHeaders = config && "headers" in config && config.headers ? config.headers : {};
+		const mergedConfig = {
+			...config,
+			headers: {
+				...authHeaders,
+				...existingHeaders
+			}
+		};
+		return baseFetcher.request(endpoint, mergedConfig);
+	};
+	return fetcher;
+}
+/**
+* Resolves auth headers based on the strategy and scheme.
+*/
+async function resolveAuthHeaders(strategy, scheme) {
+	switch (strategy.type) {
+		case "bearer": return strategy.tokenProvider.createValidAuthHeaders();
+		case "apiKey": {
+			const apiKey = await strategy.apiKeyProvider.getApiKey();
+			const headerName = strategy.headerName || scheme.name || "X-API-Key";
+			if (scheme.in === "header" || !scheme.in) return { [headerName]: apiKey };
+			return {};
+		}
+		case "iam": return {};
+		default: return {};
+	}
+}
+
+//#endregion
+export { createAuthAwareFetcher };
+//# sourceMappingURL=auth-fetcher-DOj0iz21.mjs.map

package/dist/auth-fetcher-DOj0iz21.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fetcher-DOj0iz21.mjs","names":["options: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {\n\t\tbaseURL: string;\n\t}","endpoint: T","config?: FilteredRequestConfig<Paths, T>","authHeaders: Record<string, string>","strategy: AuthStrategy","scheme: SecuritySchemeObject"],"sources":["../src/auth-fetcher.ts"],"sourcesContent":["import { TypedFetcher } from './fetcher';\nimport type {\n\tExtractEndpointResponse,\n\tFetcherOptions,\n\tFilteredRequestConfig,\n\tTypedApiFunction,\n\tTypedEndpoint,\n} from './types';\n\nexport type { FetcherOptions } from './types';\n\n/**\n * Security scheme object matching OpenAPI 3.1 specification.\n */\nexport interface SecuritySchemeObject {\n\ttype: 'apiKey' | 'http' | 'mutualTLS' | 'oauth2' | 'openIdConnect';\n\tdescription?: string;\n\tname?: string;\n\tin?: 'query' | 'header' | 'cookie';\n\tscheme?: string;\n\tbearerFormat?: string;\n\tflows?: Record<string, unknown>;\n\topenIdConnectUrl?: string;\n\t[key: string]: unknown;\n}\n\n/**\n * Extract all non-null security scheme IDs that are actually used in the API.\n * This gives us the union of scheme names that endpoints require.\n */\nexport type UsedSecuritySchemes<\n\tEndpointAuth extends Record<string, string | null>,\n> = NonNullable<EndpointAuth[keyof EndpointAuth]>;\n\n/**\n * Interface for token storage and retrieval.\n * Compatible with @geekmidas/auth TokenClient.\n */\nexport interface TokenProvider {\n\t/**\n\t * Get a valid access token, refreshing if necessary.\n\t */\n\tgetValidAccessToken(): Promise<string | null>;\n\n\t/**\n\t * Create Authorization headers from the current token.\n\t */\n\tcreateValidAuthHeaders(): Promise<Record<string, string>>;\n}\n\n/**\n * Interface for API key providers.\n */\nexport interface ApiKeyProvider {\n\t/**\n\t * Get the API key value.\n\t */\n\tgetApiKey(): Promise<string> | string;\n}\n\n/**\n * Interface for AWS SigV4 request signing.\n */\nexport interface AwsSigner {\n\t/**\n\t * Sign a request with AWS SigV4.\n\t * @param url - The request URL\n\t * @param init - The request init object\n\t * @returns Headers to add to the request\n\t */\n\tsign(url: string, init: RequestInit): Promise<Record<string, string>>;\n}\n\n/**\n * Auth strategy configuration for a specific security scheme type.\n */\nexport type AuthStrategy =\n\t| { type: 'bearer'; tokenProvider: TokenProvider }\n\t| { type: 'apiKey'; apiKeyProvider: ApiKeyProvider; headerName?: string }\n\t| { type: 'iam'; signer: AwsSigner }\n\t| { type: 'none' };\n\n/**\n * Options for creating an auth-aware fetcher.\n *\n * @template EndpointAuth - Map of endpoint strings to their auth scheme (or null for public)\n * @template SecuritySchemes - Available security scheme definitions\n */\nexport interface AuthFetcherOptions<\n\tEndpointAuth extends Record<string, string | null>,\n\tSecuritySchemes extends Record<string, SecuritySchemeObject>,\n> extends Omit<FetcherOptions, 'onRequest'> {\n\t/**\n\t * Runtime map of endpoints to their required auth scheme.\n\t * Generated by `gkm openapi --ts`.\n\t */\n\tendpointAuth: EndpointAuth;\n\n\t/**\n\t * Security scheme definitions.\n\t * Generated by `gkm openapi --ts`.\n\t */\n\tsecuritySchemes: SecuritySchemes;\n\n\t/**\n\t * Auth strategies for security schemes that are actually used.\n\t * Only schemes referenced in endpointAuth are required.\n\t *\n\t * @example\n\t * ```typescript\n\t * // If endpointAuth has: { 'GET /users': 'jwt', 'POST /data': 'iam', 'GET /public': null }\n\t * // Then authStrategies must include strategies for 'jwt' and 'iam'\n\t * authStrategies: {\n\t *   jwt: { type: 'bearer', tokenProvider },\n\t *   iam: { type: 'iam', signer: awsSigner },\n\t * }\n\t * ```\n\t */\n\tauthStrategies: Record<UsedSecuritySchemes<EndpointAuth>, AuthStrategy>;\n\n\t/**\n\t * Optional request interceptor (runs after auth headers are added).\n\t */\n\tonRequest?: (config: RequestInit) => RequestInit | Promise<RequestInit>;\n}\n\n/**\n * Creates an auth-aware fetcher that automatically applies the correct\n * authentication based on the endpoint being called.\n *\n * @example\n * ```typescript\n * import { endpointAuth, securitySchemes, paths } from './openapi';\n * import { TokenClient } from '@geekmidas/auth/client';\n *\n * const tokenClient = new TokenClient({ ... });\n *\n * const api = createAuthAwareFetcher<paths>({\n *   baseURL: 'https://api.example.com',\n *   endpointAuth,\n *   securitySchemes,\n *   authStrategies: {\n *     bearer: { type: 'bearer', tokenProvider: tokenClient },\n *     iam: { type: 'iam', signer: awsSigner },\n *   },\n * });\n *\n * // Bearer auth automatically applied\n * const user = await api('GET /users/{id}', { params: { id: '123' } });\n *\n * // IAM SigV4 auth automatically applied\n * const tenant = await api('POST /tenants', { body: { name: 'Acme' } });\n * ```\n */\nexport function createAuthAwareFetcher<\n\tPaths,\n\tEndpointAuth extends Record<string, string | null> = Record<\n\t\tstring,\n\t\tstring | null\n\t>,\n\tSecuritySchemes extends Record<string, SecuritySchemeObject> = Record<\n\t\tstring,\n\t\tSecuritySchemeObject\n\t>,\n>(\n\toptions: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {\n\t\tbaseURL: string;\n\t},\n): TypedApiFunction<Paths> {\n\tconst {\n\t\tendpointAuth,\n\t\tsecuritySchemes,\n\t\tauthStrategies,\n\t\tonRequest: userOnRequest,\n\t\t...fetcherOptions\n\t} = options;\n\n\t// Create base fetcher with user's onRequest if provided\n\tconst baseFetcher = new TypedFetcher<Paths>({\n\t\t...fetcherOptions,\n\t\tonRequest: userOnRequest,\n\t});\n\n\tconst fetcher = async <T extends TypedEndpoint<Paths>>(\n\t\tendpoint: T,\n\t\tconfig?: FilteredRequestConfig<Paths, T>,\n\t): Promise<ExtractEndpointResponse<Paths, T>> => {\n\t\t// Look up auth requirement for this endpoint\n\t\tconst schemeName = endpointAuth[endpoint as keyof EndpointAuth] as\n\t\t\t| string\n\t\t\t| null;\n\n\t\tlet authHeaders: Record<string, string> = {};\n\n\t\tif (schemeName) {\n\t\t\tconst scheme = securitySchemes[schemeName as keyof SecuritySchemes];\n\t\t\t// Since authStrategies is now required to have all used schemes,\n\t\t\t// we can safely access it - TypeScript ensures the strategy exists\n\t\t\tconst strategy =\n\t\t\t\tauthStrategies[schemeName as UsedSecuritySchemes<EndpointAuth>];\n\n\t\t\tif (strategy && scheme) {\n\t\t\t\tauthHeaders = await resolveAuthHeaders(strategy, scheme);\n\t\t\t}\n\t\t}\n\n\t\t// Merge auth headers with config headers\n\t\tconst existingHeaders =\n\t\t\tconfig && 'headers' in config && config.headers\n\t\t\t\t? (config.headers as Record<string, string>)\n\t\t\t\t: {};\n\n\t\tconst mergedConfig = {\n\t\t\t...config,\n\t\t\theaders: {\n\t\t\t\t...authHeaders,\n\t\t\t\t...existingHeaders,\n\t\t\t},\n\t\t} as unknown as FilteredRequestConfig<Paths, T>;\n\n\t\treturn baseFetcher.request(endpoint, mergedConfig);\n\t};\n\n\treturn fetcher as TypedApiFunction<Paths>;\n}\n\n/**\n * Resolves auth headers based on the strategy and scheme.\n */\nasync function resolveAuthHeaders(\n\tstrategy: AuthStrategy,\n\tscheme: SecuritySchemeObject,\n): Promise<Record<string, string>> {\n\tswitch (strategy.type) {\n\t\tcase 'bearer': {\n\t\t\treturn strategy.tokenProvider.createValidAuthHeaders();\n\t\t}\n\n\t\tcase 'apiKey': {\n\t\t\tconst apiKey = await strategy.apiKeyProvider.getApiKey();\n\t\t\tconst headerName = strategy.headerName || scheme.name || 'X-API-Key';\n\n\t\t\tif (scheme.in === 'header' || !scheme.in) {\n\t\t\t\treturn { [headerName]: apiKey };\n\t\t\t}\n\t\t\t// Note: query and cookie API keys are handled differently\n\t\t\t// For now, we only support header-based API keys\n\t\t\treturn {};\n\t\t}\n\n\t\tcase 'iam': {\n\t\t\t// IAM signing requires the full URL and request config\n\t\t\t// This is a simplified version - full implementation would need\n\t\t\t// access to the complete request\n\t\t\t// For now, return empty - the actual signing should be done\n\t\t\t// in a custom onRequest interceptor if needed\n\t\t\treturn {};\n\t\t}\n\t\tdefault:\n\t\t\treturn {};\n\t}\n}\n\n/**\n * Type helper to extract the security scheme ID from an endpoint.\n */\nexport type GetEndpointAuth<\n\tEndpointAuth extends Record<string, string | null>,\n\tEndpoint extends keyof EndpointAuth,\n> = EndpointAuth[Endpoint];\n\n/**\n * Type helper to get all authenticated endpoints.\n */\nexport type AuthenticatedEndpoints<\n\tEndpointAuth extends Record<string, string | null>,\n> = {\n\t[K in keyof EndpointAuth]: EndpointAuth[K] extends null ? never : K;\n}[keyof EndpointAuth];\n\n/**\n * Type helper to get all public endpoints.\n */\nexport type PublicEndpoints<\n\tEndpointAuth extends Record<string, string | null>,\n> = {\n\t[K in keyof EndpointAuth]: EndpointAuth[K] extends null ? K : never;\n}[keyof EndpointAuth];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0JA,SAAgB,uBAWfA,SAG0B;CAC1B,MAAM,EACL,cACA,iBACA,gBACA,WAAW,cACX,GAAG,gBACH,GAAG;CAGJ,MAAM,cAAc,IAAI,aAAoB;EAC3C,GAAG;EACH,WAAW;CACX;CAED,MAAM,UAAU,OACfC,UACAC,WACgD;EAEhD,MAAM,aAAa,aAAa;EAIhC,IAAIC,cAAsC,CAAE;AAE5C,MAAI,YAAY;GACf,MAAM,SAAS,gBAAgB;GAG/B,MAAM,WACL,eAAe;AAEhB,OAAI,YAAY,OACf,eAAc,MAAM,mBAAmB,UAAU,OAAO;EAEzD;EAGD,MAAM,kBACL,UAAU,aAAa,UAAU,OAAO,UACpC,OAAO,UACR,CAAE;EAEN,MAAM,eAAe;GACpB,GAAG;GACH,SAAS;IACR,GAAG;IACH,GAAG;GACH;EACD;AAED,SAAO,YAAY,QAAQ,UAAU,aAAa;CAClD;AAED,QAAO;AACP;;;;AAKD,eAAe,mBACdC,UACAC,QACkC;AAClC,SAAQ,SAAS,MAAjB;EACC,KAAK,SACJ,QAAO,SAAS,cAAc,wBAAwB;EAGvD,KAAK,UAAU;GACd,MAAM,SAAS,MAAM,SAAS,eAAe,WAAW;GACxD,MAAM,aAAa,SAAS,cAAc,OAAO,QAAQ;AAEzD,OAAI,OAAO,OAAO,aAAa,OAAO,GACrC,QAAO,GAAG,aAAa,OAAQ;AAIhC,UAAO,CAAE;EACT;EAED,KAAK,MAMJ,QAAO,CAAE;EAEV,QACC,QAAO,CAAE;CACV;AACD"}

package/dist/auth-fetcher-DxS8zOLc.d.mts

@@ -0,0 +1,158 @@
+import { FetcherOptions, TypedApiFunction } from "./types-BMGM6sZc.mjs";
+
+//#region src/auth-fetcher.d.ts
+
+/**
+ * Security scheme object matching OpenAPI 3.1 specification.
+ */
+interface SecuritySchemeObject {
+  type: 'apiKey' | 'http' | 'mutualTLS' | 'oauth2' | 'openIdConnect';
+  description?: string;
+  name?: string;
+  in?: 'query' | 'header' | 'cookie';
+  scheme?: string;
+  bearerFormat?: string;
+  flows?: Record<string, unknown>;
+  openIdConnectUrl?: string;
+  [key: string]: unknown;
+}
+/**
+ * Extract all non-null security scheme IDs that are actually used in the API.
+ * This gives us the union of scheme names that endpoints require.
+ */
+type UsedSecuritySchemes<EndpointAuth extends Record<string, string | null>> = NonNullable<EndpointAuth[keyof EndpointAuth]>;
+/**
+ * Interface for token storage and retrieval.
+ * Compatible with @geekmidas/auth TokenClient.
+ */
+interface TokenProvider {
+  /**
+   * Get a valid access token, refreshing if necessary.
+   */
+  getValidAccessToken(): Promise<string | null>;
+  /**
+   * Create Authorization headers from the current token.
+   */
+  createValidAuthHeaders(): Promise<Record<string, string>>;
+}
+/**
+ * Interface for API key providers.
+ */
+interface ApiKeyProvider {
+  /**
+   * Get the API key value.
+   */
+  getApiKey(): Promise<string> | string;
+}
+/**
+ * Interface for AWS SigV4 request signing.
+ */
+interface AwsSigner {
+  /**
+   * Sign a request with AWS SigV4.
+   * @param url - The request URL
+   * @param init - The request init object
+   * @returns Headers to add to the request
+   */
+  sign(url: string, init: RequestInit): Promise<Record<string, string>>;
+}
+/**
+ * Auth strategy configuration for a specific security scheme type.
+ */
+type AuthStrategy = {
+  type: 'bearer';
+  tokenProvider: TokenProvider;
+} | {
+  type: 'apiKey';
+  apiKeyProvider: ApiKeyProvider;
+  headerName?: string;
+} | {
+  type: 'iam';
+  signer: AwsSigner;
+} | {
+  type: 'none';
+};
+/**
+ * Options for creating an auth-aware fetcher.
+ *
+ * @template EndpointAuth - Map of endpoint strings to their auth scheme (or null for public)
+ * @template SecuritySchemes - Available security scheme definitions
+ */
+interface AuthFetcherOptions<EndpointAuth extends Record<string, string | null>, SecuritySchemes extends Record<string, SecuritySchemeObject>> extends Omit<FetcherOptions, 'onRequest'> {
+  /**
+   * Runtime map of endpoints to their required auth scheme.
+   * Generated by `gkm openapi --ts`.
+   */
+  endpointAuth: EndpointAuth;
+  /**
+   * Security scheme definitions.
+   * Generated by `gkm openapi --ts`.
+   */
+  securitySchemes: SecuritySchemes;
+  /**
+   * Auth strategies for security schemes that are actually used.
+   * Only schemes referenced in endpointAuth are required.
+   *
+   * @example
+   * ```typescript
+   * // If endpointAuth has: { 'GET /users': 'jwt', 'POST /data': 'iam', 'GET /public': null }
+   * // Then authStrategies must include strategies for 'jwt' and 'iam'
+   * authStrategies: {
+   *   jwt: { type: 'bearer', tokenProvider },
+   *   iam: { type: 'iam', signer: awsSigner },
+   * }
+   * ```
+   */
+  authStrategies: Record<UsedSecuritySchemes<EndpointAuth>, AuthStrategy>;
+  /**
+   * Optional request interceptor (runs after auth headers are added).
+   */
+  onRequest?: (config: RequestInit) => RequestInit | Promise<RequestInit>;
+}
+/**
+ * Creates an auth-aware fetcher that automatically applies the correct
+ * authentication based on the endpoint being called.
+ *
+ * @example
+ * ```typescript
+ * import { endpointAuth, securitySchemes, paths } from './openapi';
+ * import { TokenClient } from '@geekmidas/auth/client';
+ *
+ * const tokenClient = new TokenClient({ ... });
+ *
+ * const api = createAuthAwareFetcher<paths>({
+ *   baseURL: 'https://api.example.com',
+ *   endpointAuth,
+ *   securitySchemes,
+ *   authStrategies: {
+ *     bearer: { type: 'bearer', tokenProvider: tokenClient },
+ *     iam: { type: 'iam', signer: awsSigner },
+ *   },
+ * });
+ *
+ * // Bearer auth automatically applied
+ * const user = await api('GET /users/{id}', { params: { id: '123' } });
+ *
+ * // IAM SigV4 auth automatically applied
+ * const tenant = await api('POST /tenants', { body: { name: 'Acme' } });
+ * ```
+ */
+declare function createAuthAwareFetcher<Paths, EndpointAuth extends Record<string, string | null> = Record<string, string | null>, SecuritySchemes extends Record<string, SecuritySchemeObject> = Record<string, SecuritySchemeObject>>(options: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {
+  baseURL: string;
+}): TypedApiFunction<Paths>;
+/**
+ * Type helper to extract the security scheme ID from an endpoint.
+ */
+type GetEndpointAuth<EndpointAuth extends Record<string, string | null>, Endpoint extends keyof EndpointAuth> = EndpointAuth[Endpoint];
+/**
+ * Type helper to get all authenticated endpoints.
+ */
+type AuthenticatedEndpoints<EndpointAuth extends Record<string, string | null>> = { [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? never : K }[keyof EndpointAuth];
+/**
+ * Type helper to get all public endpoints.
+ */
+type PublicEndpoints<EndpointAuth extends Record<string, string | null>> = { [K in keyof EndpointAuth]: EndpointAuth[K] extends null ? K : never }[keyof EndpointAuth];
+//# sourceMappingURL=auth-fetcher.d.ts.map
+//#endregion
+export { ApiKeyProvider, AuthFetcherOptions, AuthStrategy, AuthenticatedEndpoints, AwsSigner, GetEndpointAuth, PublicEndpoints, SecuritySchemeObject, TokenProvider, UsedSecuritySchemes, createAuthAwareFetcher };
+//# sourceMappingURL=auth-fetcher-DxS8zOLc.d.mts.map

package/dist/auth-fetcher-DxS8zOLc.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fetcher-DxS8zOLc.d.mts","names":[],"sources":["../src/auth-fetcher.ts"],"sourcesContent":[],"mappings":";;;;;AAcA;AAgBA;AAA+B,UAhBd,oBAAA,CAgBc;EAAA,IACT,EAAA,QAAA,GAAA,MAAA,GAAA,WAAA,GAAA,QAAA,GAAA,eAAA;EAAM,WACZ,CAAA,EAAA,MAAA;EAAY,IAAO,CAAA,EAAA,MAAA;EAAY,EAAA,CAA3C,EAAA,OAAA,GAAA,QAAA,GAAA,QAAA;EAAW,MAAA,CAAA,EAAA,MAAA;EAME,YAAA,CAAA,EAAA,MAAa;EAAA,KAAA,CAAA,EAjBrB,MAiBqB,CAAA,MAAA,EAAA,OAAA,CAAA;EAAA,gBAIN,CAAA,EAAA,MAAA;EAAO,CAAA,GAKI,EAAA,MAAA,CAAA,EAAA,OAAA;;AAAD;AAMlC;AAUA;;AAOyB,KAxCb,mBAwCa,CAAA,qBAvCH,MAuCG,CAAA,MAAA,EAAA,MAAA,GAAA,IAAA,CAAA,CAAA,GAtCrB,WAsCqB,CAtCT,YAsCS,CAAA,MAtCU,YAsCV,CAAA,CAAA;;;AAAqB;AAM9C;AAAwB,UAtCP,aAAA,CAsCO;EAAA;;;EAGW,mBAAA,EAAA,EArCX,OAqCW,CAAA,MAAA,GAAA,IAAA,CAAA;EASlB;;;EACW,sBACY,EAAA,EA3Cb,OA2Ca,CA3CL,MA2CK,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;;;;;AA4BI,UAjE3B,cAAA,CAiE2B;EAAY;;;EAAjC,SAKD,EAAA,EAlER,OAkEQ,CAAA,MAAA,CAAA,GAAA,MAAA;;;;;AAhCR,UA5BG,SAAA,CA4BH;EA+DE;;;;;;EAMe,IAE7B,CAAA,GAAA,EAAA,MAAA,EAAA,IAAA,EA5FuB,WA4FvB,CAAA,EA5FqC,OA4FrC,CA5F6C,MA4F7C,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;;;;;AAMkB,KA5FR,YAAA,GA4FQ;EAAK,IAAtB,EAAA,QAAA;EAAgB,aAAA,EA3FiB,aA2FjB;AAkGnB,CAAA,GAAY;EAAe,IAAA,EAAA,QAAA;EAAA,cACL,EA7Le,cA6Lf;EAAM,UACJ,CAAA,EAAA,MAAA;CAAY,GAAA;EACpB,IAAC,EAAA,KAAA;EAAQ,MAAA,EA9LC,SA8LD;AAKzB,CAAA,GAAY;EAAsB,IAAA,EAAA,MAAA;CAAA;;;;;;AAId;AAKR,UAnMK,kBAmMU,CAAA,qBAlML,MAkMK,CAAA,MAAA,EAAA,MAAA,GAAA,IAAA,CAAA,EAAA,wBAjMF,MAiME,CAAA,MAAA,EAjMa,oBAiMb,CAAA,CAAA,SAhMjB,IAgMiB,CAhMZ,cAgMY,EAAA,WAAA,CAAA,CAAA;EAAA;;;;EAGa,YAAC,EA9L1B,YA8L0B;EAAC;;AACtB;;mBAzLF;;;;;;;;;;;;;;;kBAgBD,OAAO,oBAAoB,eAAe;;;;uBAKrC,gBAAgB,cAAc,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+B5C,mDAEM,gCAAgC,uDAI7B,eAAe,wBAAwB,eAE9D,gCAGQ,mBAAmB,cAAc;;IAGxC,iBAAiB;;;;KAkGR,qCACU,sDACE,gBACpB,aAAa;;;;KAKL,4CACU,+CAET,eAAe,aAAa,0BAA0B,UAC3D;;;;KAKI,qCACU,+CAET,eAAe,aAAa,kBAAkB,kBACnD"}

package/dist/auth-fetcher-HILABmws.cjs

@@ -0,0 +1,82 @@
+const require_fetcher = require('./fetcher-CwnSqc4D.cjs');
+
+//#region src/auth-fetcher.ts
+/**
+* Creates an auth-aware fetcher that automatically applies the correct
+* authentication based on the endpoint being called.
+*
+* @example
+* ```typescript
+* import { endpointAuth, securitySchemes, paths } from './openapi';
+* import { TokenClient } from '@geekmidas/auth/client';
+*
+* const tokenClient = new TokenClient({ ... });
+*
+* const api = createAuthAwareFetcher<paths>({
+*   baseURL: 'https://api.example.com',
+*   endpointAuth,
+*   securitySchemes,
+*   authStrategies: {
+*     bearer: { type: 'bearer', tokenProvider: tokenClient },
+*     iam: { type: 'iam', signer: awsSigner },
+*   },
+* });
+*
+* // Bearer auth automatically applied
+* const user = await api('GET /users/{id}', { params: { id: '123' } });
+*
+* // IAM SigV4 auth automatically applied
+* const tenant = await api('POST /tenants', { body: { name: 'Acme' } });
+* ```
+*/
+function createAuthAwareFetcher(options) {
+	const { endpointAuth, securitySchemes, authStrategies, onRequest: userOnRequest,...fetcherOptions } = options;
+	const baseFetcher = new require_fetcher.TypedFetcher({
+		...fetcherOptions,
+		onRequest: userOnRequest
+	});
+	const fetcher = async (endpoint, config) => {
+		const schemeName = endpointAuth[endpoint];
+		let authHeaders = {};
+		if (schemeName) {
+			const scheme = securitySchemes[schemeName];
+			const strategy = authStrategies[schemeName];
+			if (strategy && scheme) authHeaders = await resolveAuthHeaders(strategy, scheme);
+		}
+		const existingHeaders = config && "headers" in config && config.headers ? config.headers : {};
+		const mergedConfig = {
+			...config,
+			headers: {
+				...authHeaders,
+				...existingHeaders
+			}
+		};
+		return baseFetcher.request(endpoint, mergedConfig);
+	};
+	return fetcher;
+}
+/**
+* Resolves auth headers based on the strategy and scheme.
+*/
+async function resolveAuthHeaders(strategy, scheme) {
+	switch (strategy.type) {
+		case "bearer": return strategy.tokenProvider.createValidAuthHeaders();
+		case "apiKey": {
+			const apiKey = await strategy.apiKeyProvider.getApiKey();
+			const headerName = strategy.headerName || scheme.name || "X-API-Key";
+			if (scheme.in === "header" || !scheme.in) return { [headerName]: apiKey };
+			return {};
+		}
+		case "iam": return {};
+		default: return {};
+	}
+}
+
+//#endregion
+Object.defineProperty(exports, 'createAuthAwareFetcher', {
+  enumerable: true,
+  get: function () {
+    return createAuthAwareFetcher;
+  }
+});
+//# sourceMappingURL=auth-fetcher-HILABmws.cjs.map

package/dist/auth-fetcher-HILABmws.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fetcher-HILABmws.cjs","names":["options: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {\n\t\tbaseURL: string;\n\t}","TypedFetcher","endpoint: T","config?: FilteredRequestConfig<Paths, T>","authHeaders: Record<string, string>","strategy: AuthStrategy","scheme: SecuritySchemeObject"],"sources":["../src/auth-fetcher.ts"],"sourcesContent":["import { TypedFetcher } from './fetcher';\nimport type {\n\tExtractEndpointResponse,\n\tFetcherOptions,\n\tFilteredRequestConfig,\n\tTypedApiFunction,\n\tTypedEndpoint,\n} from './types';\n\nexport type { FetcherOptions } from './types';\n\n/**\n * Security scheme object matching OpenAPI 3.1 specification.\n */\nexport interface SecuritySchemeObject {\n\ttype: 'apiKey' | 'http' | 'mutualTLS' | 'oauth2' | 'openIdConnect';\n\tdescription?: string;\n\tname?: string;\n\tin?: 'query' | 'header' | 'cookie';\n\tscheme?: string;\n\tbearerFormat?: string;\n\tflows?: Record<string, unknown>;\n\topenIdConnectUrl?: string;\n\t[key: string]: unknown;\n}\n\n/**\n * Extract all non-null security scheme IDs that are actually used in the API.\n * This gives us the union of scheme names that endpoints require.\n */\nexport type UsedSecuritySchemes<\n\tEndpointAuth extends Record<string, string | null>,\n> = NonNullable<EndpointAuth[keyof EndpointAuth]>;\n\n/**\n * Interface for token storage and retrieval.\n * Compatible with @geekmidas/auth TokenClient.\n */\nexport interface TokenProvider {\n\t/**\n\t * Get a valid access token, refreshing if necessary.\n\t */\n\tgetValidAccessToken(): Promise<string | null>;\n\n\t/**\n\t * Create Authorization headers from the current token.\n\t */\n\tcreateValidAuthHeaders(): Promise<Record<string, string>>;\n}\n\n/**\n * Interface for API key providers.\n */\nexport interface ApiKeyProvider {\n\t/**\n\t * Get the API key value.\n\t */\n\tgetApiKey(): Promise<string> | string;\n}\n\n/**\n * Interface for AWS SigV4 request signing.\n */\nexport interface AwsSigner {\n\t/**\n\t * Sign a request with AWS SigV4.\n\t * @param url - The request URL\n\t * @param init - The request init object\n\t * @returns Headers to add to the request\n\t */\n\tsign(url: string, init: RequestInit): Promise<Record<string, string>>;\n}\n\n/**\n * Auth strategy configuration for a specific security scheme type.\n */\nexport type AuthStrategy =\n\t| { type: 'bearer'; tokenProvider: TokenProvider }\n\t| { type: 'apiKey'; apiKeyProvider: ApiKeyProvider; headerName?: string }\n\t| { type: 'iam'; signer: AwsSigner }\n\t| { type: 'none' };\n\n/**\n * Options for creating an auth-aware fetcher.\n *\n * @template EndpointAuth - Map of endpoint strings to their auth scheme (or null for public)\n * @template SecuritySchemes - Available security scheme definitions\n */\nexport interface AuthFetcherOptions<\n\tEndpointAuth extends Record<string, string | null>,\n\tSecuritySchemes extends Record<string, SecuritySchemeObject>,\n> extends Omit<FetcherOptions, 'onRequest'> {\n\t/**\n\t * Runtime map of endpoints to their required auth scheme.\n\t * Generated by `gkm openapi --ts`.\n\t */\n\tendpointAuth: EndpointAuth;\n\n\t/**\n\t * Security scheme definitions.\n\t * Generated by `gkm openapi --ts`.\n\t */\n\tsecuritySchemes: SecuritySchemes;\n\n\t/**\n\t * Auth strategies for security schemes that are actually used.\n\t * Only schemes referenced in endpointAuth are required.\n\t *\n\t * @example\n\t * ```typescript\n\t * // If endpointAuth has: { 'GET /users': 'jwt', 'POST /data': 'iam', 'GET /public': null }\n\t * // Then authStrategies must include strategies for 'jwt' and 'iam'\n\t * authStrategies: {\n\t *   jwt: { type: 'bearer', tokenProvider },\n\t *   iam: { type: 'iam', signer: awsSigner },\n\t * }\n\t * ```\n\t */\n\tauthStrategies: Record<UsedSecuritySchemes<EndpointAuth>, AuthStrategy>;\n\n\t/**\n\t * Optional request interceptor (runs after auth headers are added).\n\t */\n\tonRequest?: (config: RequestInit) => RequestInit | Promise<RequestInit>;\n}\n\n/**\n * Creates an auth-aware fetcher that automatically applies the correct\n * authentication based on the endpoint being called.\n *\n * @example\n * ```typescript\n * import { endpointAuth, securitySchemes, paths } from './openapi';\n * import { TokenClient } from '@geekmidas/auth/client';\n *\n * const tokenClient = new TokenClient({ ... });\n *\n * const api = createAuthAwareFetcher<paths>({\n *   baseURL: 'https://api.example.com',\n *   endpointAuth,\n *   securitySchemes,\n *   authStrategies: {\n *     bearer: { type: 'bearer', tokenProvider: tokenClient },\n *     iam: { type: 'iam', signer: awsSigner },\n *   },\n * });\n *\n * // Bearer auth automatically applied\n * const user = await api('GET /users/{id}', { params: { id: '123' } });\n *\n * // IAM SigV4 auth automatically applied\n * const tenant = await api('POST /tenants', { body: { name: 'Acme' } });\n * ```\n */\nexport function createAuthAwareFetcher<\n\tPaths,\n\tEndpointAuth extends Record<string, string | null> = Record<\n\t\tstring,\n\t\tstring | null\n\t>,\n\tSecuritySchemes extends Record<string, SecuritySchemeObject> = Record<\n\t\tstring,\n\t\tSecuritySchemeObject\n\t>,\n>(\n\toptions: AuthFetcherOptions<EndpointAuth, SecuritySchemes> & {\n\t\tbaseURL: string;\n\t},\n): TypedApiFunction<Paths> {\n\tconst {\n\t\tendpointAuth,\n\t\tsecuritySchemes,\n\t\tauthStrategies,\n\t\tonRequest: userOnRequest,\n\t\t...fetcherOptions\n\t} = options;\n\n\t// Create base fetcher with user's onRequest if provided\n\tconst baseFetcher = new TypedFetcher<Paths>({\n\t\t...fetcherOptions,\n\t\tonRequest: userOnRequest,\n\t});\n\n\tconst fetcher = async <T extends TypedEndpoint<Paths>>(\n\t\tendpoint: T,\n\t\tconfig?: FilteredRequestConfig<Paths, T>,\n\t): Promise<ExtractEndpointResponse<Paths, T>> => {\n\t\t// Look up auth requirement for this endpoint\n\t\tconst schemeName = endpointAuth[endpoint as keyof EndpointAuth] as\n\t\t\t| string\n\t\t\t| null;\n\n\t\tlet authHeaders: Record<string, string> = {};\n\n\t\tif (schemeName) {\n\t\t\tconst scheme = securitySchemes[schemeName as keyof SecuritySchemes];\n\t\t\t// Since authStrategies is now required to have all used schemes,\n\t\t\t// we can safely access it - TypeScript ensures the strategy exists\n\t\t\tconst strategy =\n\t\t\t\tauthStrategies[schemeName as UsedSecuritySchemes<EndpointAuth>];\n\n\t\t\tif (strategy && scheme) {\n\t\t\t\tauthHeaders = await resolveAuthHeaders(strategy, scheme);\n\t\t\t}\n\t\t}\n\n\t\t// Merge auth headers with config headers\n\t\tconst existingHeaders =\n\t\t\tconfig && 'headers' in config && config.headers\n\t\t\t\t? (config.headers as Record<string, string>)\n\t\t\t\t: {};\n\n\t\tconst mergedConfig = {\n\t\t\t...config,\n\t\t\theaders: {\n\t\t\t\t...authHeaders,\n\t\t\t\t...existingHeaders,\n\t\t\t},\n\t\t} as unknown as FilteredRequestConfig<Paths, T>;\n\n\t\treturn baseFetcher.request(endpoint, mergedConfig);\n\t};\n\n\treturn fetcher as TypedApiFunction<Paths>;\n}\n\n/**\n * Resolves auth headers based on the strategy and scheme.\n */\nasync function resolveAuthHeaders(\n\tstrategy: AuthStrategy,\n\tscheme: SecuritySchemeObject,\n): Promise<Record<string, string>> {\n\tswitch (strategy.type) {\n\t\tcase 'bearer': {\n\t\t\treturn strategy.tokenProvider.createValidAuthHeaders();\n\t\t}\n\n\t\tcase 'apiKey': {\n\t\t\tconst apiKey = await strategy.apiKeyProvider.getApiKey();\n\t\t\tconst headerName = strategy.headerName || scheme.name || 'X-API-Key';\n\n\t\t\tif (scheme.in === 'header' || !scheme.in) {\n\t\t\t\treturn { [headerName]: apiKey };\n\t\t\t}\n\t\t\t// Note: query and cookie API keys are handled differently\n\t\t\t// For now, we only support header-based API keys\n\t\t\treturn {};\n\t\t}\n\n\t\tcase 'iam': {\n\t\t\t// IAM signing requires the full URL and request config\n\t\t\t// This is a simplified version - full implementation would need\n\t\t\t// access to the complete request\n\t\t\t// For now, return empty - the actual signing should be done\n\t\t\t// in a custom onRequest interceptor if needed\n\t\t\treturn {};\n\t\t}\n\t\tdefault:\n\t\t\treturn {};\n\t}\n}\n\n/**\n * Type helper to extract the security scheme ID from an endpoint.\n */\nexport type GetEndpointAuth<\n\tEndpointAuth extends Record<string, string | null>,\n\tEndpoint extends keyof EndpointAuth,\n> = EndpointAuth[Endpoint];\n\n/**\n * Type helper to get all authenticated endpoints.\n */\nexport type AuthenticatedEndpoints<\n\tEndpointAuth extends Record<string, string | null>,\n> = {\n\t[K in keyof EndpointAuth]: EndpointAuth[K] extends null ? never : K;\n}[keyof EndpointAuth];\n\n/**\n * Type helper to get all public endpoints.\n */\nexport type PublicEndpoints<\n\tEndpointAuth extends Record<string, string | null>,\n> = {\n\t[K in keyof EndpointAuth]: EndpointAuth[K] extends null ? K : never;\n}[keyof EndpointAuth];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0JA,SAAgB,uBAWfA,SAG0B;CAC1B,MAAM,EACL,cACA,iBACA,gBACA,WAAW,cACX,GAAG,gBACH,GAAG;CAGJ,MAAM,cAAc,IAAIC,6BAAoB;EAC3C,GAAG;EACH,WAAW;CACX;CAED,MAAM,UAAU,OACfC,UACAC,WACgD;EAEhD,MAAM,aAAa,aAAa;EAIhC,IAAIC,cAAsC,CAAE;AAE5C,MAAI,YAAY;GACf,MAAM,SAAS,gBAAgB;GAG/B,MAAM,WACL,eAAe;AAEhB,OAAI,YAAY,OACf,eAAc,MAAM,mBAAmB,UAAU,OAAO;EAEzD;EAGD,MAAM,kBACL,UAAU,aAAa,UAAU,OAAO,UACpC,OAAO,UACR,CAAE;EAEN,MAAM,eAAe;GACpB,GAAG;GACH,SAAS;IACR,GAAG;IACH,GAAG;GACH;EACD;AAED,SAAO,YAAY,QAAQ,UAAU,aAAa;CAClD;AAED,QAAO;AACP;;;;AAKD,eAAe,mBACdC,UACAC,QACkC;AAClC,SAAQ,SAAS,MAAjB;EACC,KAAK,SACJ,QAAO,SAAS,cAAc,wBAAwB;EAGvD,KAAK,UAAU;GACd,MAAM,SAAS,MAAM,SAAS,eAAe,WAAW;GACxD,MAAM,aAAa,SAAS,cAAc,OAAO,QAAQ;AAEzD,OAAI,OAAO,OAAO,aAAa,OAAO,GACrC,QAAO,GAAG,aAAa,OAAQ;AAIhC,UAAO,CAAE;EACT;EAED,KAAK,MAMJ,QAAO,CAAE;EAEV,QACC,QAAO,CAAE;CACV;AACD"}

package/dist/auth-fetcher.cjs

@@ -1,77 +1,4 @@
-const require_fetcher = require('./fetcher-CwnSqc4D.cjs');
+require('./fetcher-CwnSqc4D.cjs');
+const require_auth_fetcher = require('./auth-fetcher-HILABmws.cjs');
 
-//#region src/auth-fetcher.ts
-/**
-* Creates an auth-aware fetcher that automatically applies the correct
-* authentication based on the endpoint being called.
-*
-* @example
-* ```typescript
-* import { endpointAuth, securitySchemes, paths } from './openapi';
-* import { TokenClient } from '@geekmidas/auth/client';
-*
-* const tokenClient = new TokenClient({ ... });
-*
-* const api = createAuthAwareFetcher<paths>({
-*   baseURL: 'https://api.example.com',
-*   endpointAuth,
-*   securitySchemes,
-*   authStrategies: {
-*     bearer: { type: 'bearer', tokenProvider: tokenClient },
-*     iam: { type: 'iam', signer: awsSigner },
-*   },
-* });
-*
-* // Bearer auth automatically applied
-* const user = await api('GET /users/{id}', { params: { id: '123' } });
-*
-* // IAM SigV4 auth automatically applied
-* const tenant = await api('POST /tenants', { body: { name: 'Acme' } });
-* ```
-*/
-function createAuthAwareFetcher(options) {
-	const { endpointAuth, securitySchemes, authStrategies, onRequest: userOnRequest,...fetcherOptions } = options;
-	const baseFetcher = new require_fetcher.TypedFetcher({
-		...fetcherOptions,
-		onRequest: userOnRequest
-	});
-	const fetcher = async (endpoint, config) => {
-		const schemeName = endpointAuth[endpoint];
-		let authHeaders = {};
-		if (schemeName) {
-			const scheme = securitySchemes[schemeName];
-			const strategy = authStrategies[schemeName];
-			if (strategy && scheme) authHeaders = await resolveAuthHeaders(strategy, scheme);
-		}
-		const existingHeaders = config && "headers" in config && config.headers ? config.headers : {};
-		const mergedConfig = {
-			...config,
-			headers: {
-				...authHeaders,
-				...existingHeaders
-			}
-		};
-		return baseFetcher.request(endpoint, mergedConfig);
-	};
-	return fetcher;
-}
-/**
-* Resolves auth headers based on the strategy and scheme.
-*/
-async function resolveAuthHeaders(strategy, scheme) {
-	switch (strategy.type) {
-		case "bearer": return strategy.tokenProvider.createValidAuthHeaders();
-		case "apiKey": {
-			const apiKey = await strategy.apiKeyProvider.getApiKey();
-			const headerName = strategy.headerName || scheme.name || "X-API-Key";
-			if (scheme.in === "header" || !scheme.in) return { [headerName]: apiKey };
-			return {};
-		}
-		case "iam": return {};
-		default: return {};
-	}
-}
-
-//#endregion
-exports.createAuthAwareFetcher = createAuthAwareFetcher;
-//# sourceMappingURL=auth-fetcher.cjs.map
+exports.createAuthAwareFetcher = require_auth_fetcher.createAuthAwareFetcher;