@go-mondo/identity-sdk 0.0.2-beta.82 → 0.0.2-beta.83

package/dist/esm/app/saml/resources.js

@@ -27,14 +27,14 @@ export class SAMLResources {
     }
 }
 export async function getSAML(instance, appId) {
-    return SAMLSchema.parse(await getItemWithAuthorization(new URL(SAMLResources.buildPath(appId), instance.config.host), instance.authorizer));
+    return SAMLSchema.parse(await getItemWithAuthorization(new URL(SAMLResources.buildPath(appId), instance.config.host), instance.authorize));
 }
 export async function insertSAML(instance, appId, item) {
-    return SAMLSchema.parse(await postItemWithAuthorization(new URL(SAMLResources.buildPath(appId), instance.config.host), instance.authorizer, item ? InsertSAMLPayloadSchema.parse(item) : undefined));
+    return SAMLSchema.parse(await postItemWithAuthorization(new URL(SAMLResources.buildPath(appId), instance.config.host), instance.authorize, item ? InsertSAMLPayloadSchema.parse(item) : undefined));
 }
 export async function updateSAML(instance, appId, item) {
-    return SAMLSchema.parse(await patchItemWithAuthorization(new URL(SAMLResources.buildPath(appId), instance.config.host), instance.authorizer, UpdateSAMLPayloadSchema.parse(item)));
+    return SAMLSchema.parse(await patchItemWithAuthorization(new URL(SAMLResources.buildPath(appId), instance.config.host), instance.authorize, UpdateSAMLPayloadSchema.parse(item)));
 }
 export async function deleteSAML(instance, appId) {
-    return SAMLSchema.parse(await deleteItemWithAuthorization(new URL(SAMLResources.buildPath(appId), instance.config.host), instance.authorizer));
+    return SAMLSchema.parse(await deleteItemWithAuthorization(new URL(SAMLResources.buildPath(appId), instance.config.host), instance.authorize));
 }

package/dist/esm/association/resources.js

@@ -32,11 +32,11 @@ export class AssociationResources {
 }
 export async function listAssociations(instance, id, options, pagination) {
     const url = addPaginationToURL(new URL(AssociationResources.buildListingPath(id, options), instance.config.host), pagination);
-    return PaginationCollectionSchema(AssociationSchema).parse(await getItemWithAuthorization(url, instance.authorizer));
+    return PaginationCollectionSchema(AssociationSchema).parse(await getItemWithAuthorization(url, instance.authorize));
 }
 export async function upsertAssociation(instance, fromId, toId, item) {
-    return AssociationSchema.parse(await putItemWithAuthorization(new URL(AssociationResources.buildPath(fromId, toId), instance.config.host), instance.authorizer, item ? UpsertAssociationPayloadSchema.parse(item) : undefined));
+    return AssociationSchema.parse(await putItemWithAuthorization(new URL(AssociationResources.buildPath(fromId, toId), instance.config.host), instance.authorize, item ? UpsertAssociationPayloadSchema.parse(item) : undefined));
 }
 export async function deleteAssociation(instance, fromId, toId) {
-    return AssociationSchema.parse(await deleteItemWithAuthorization(new URL(AssociationResources.buildPath(fromId, toId), instance.config.host), instance.authorizer));
+    return AssociationSchema.parse(await deleteItemWithAuthorization(new URL(AssociationResources.buildPath(fromId, toId), instance.config.host), instance.authorize));
 }

package/dist/esm/authentication/sessions/resources.js

@@ -30,8 +30,8 @@ export class SessionResources {
 }
 export async function listSessions(instance, options, pagination) {
     const url = addPaginationToURL(new URL(SessionResources.buildListingPath(options), instance.config.host), pagination);
-    return PaginationCollectionSchema(SessionSchema).parse(await getItemWithAuthorization(url, instance.authorizer));
+    return PaginationCollectionSchema(SessionSchema).parse(await getItemWithAuthorization(url, instance.authorize));
 }
 export async function deleteSession(instance, id) {
-    return SessionSchema.parse(await deleteItemWithAuthorization(new URL(SessionResources.buildPath(id), instance.config.host), instance.authorizer));
+    return SessionSchema.parse(await deleteItemWithAuthorization(new URL(SessionResources.buildPath(id), instance.config.host), instance.authorize));
 }

package/dist/esm/authentication/settings/resources.js

@@ -18,8 +18,8 @@ export class SettingsResources {
     }
 }
 export async function getSettings(instance) {
-    return SettingsSchema.parse(await getItemWithAuthorization(new URL(SettingsResources.buildPath(), instance.config.host), instance.authorizer));
+    return SettingsSchema.parse(await getItemWithAuthorization(new URL(SettingsResources.buildPath(), instance.config.host), instance.authorize));
 }
 export async function upsertSettings(instance, item) {
-    return SettingsSchema.parse(await postItemWithAuthorization(new URL(SettingsResources.buildPath(), instance.config.host), instance.authorizer, UpsertSettingsPayloadSchema.parse(item)));
+    return SettingsSchema.parse(await postItemWithAuthorization(new URL(SettingsResources.buildPath(), instance.config.host), instance.authorize, UpsertSettingsPayloadSchema.parse(item)));
 }

package/dist/esm/authentication/strategies/resources.js

@@ -33,17 +33,17 @@ export class StrategyResources {
 }
 export async function listStrategies(instance, pagination) {
     const url = addPaginationToURL(new URL(StrategyResources.buildPath(), instance.config.host), pagination);
-    return PaginationCollectionSchema(StrategySchema).parse(await getItemWithAuthorization(url, instance.authorizer));
+    return PaginationCollectionSchema(StrategySchema).parse(await getItemWithAuthorization(url, instance.authorize));
 }
 export async function getStrategy(instance, id) {
-    return StrategySchema.parse(await getItemWithAuthorization(new URL(StrategyResources.buildItemPath(id), instance.config.host), instance.authorizer));
+    return StrategySchema.parse(await getItemWithAuthorization(new URL(StrategyResources.buildItemPath(id), instance.config.host), instance.authorize));
 }
 export async function insertStrategy(instance, item) {
-    return StrategySchema.parse(await postItemWithAuthorization(new URL(StrategyResources.buildPath(), instance.config.host), instance.authorizer, InsertStrategyPayloadSchema.parse(item)));
+    return StrategySchema.parse(await postItemWithAuthorization(new URL(StrategyResources.buildPath(), instance.config.host), instance.authorize, InsertStrategyPayloadSchema.parse(item)));
 }
 export async function updateStrategy(instance, id, item) {
-    return StrategySchema.parse(await patchItemWithAuthorization(new URL(StrategyResources.buildItemPath(id), instance.config.host), instance.authorizer, UpdateStrategyPayloadSchema.parse(item)));
+    return StrategySchema.parse(await patchItemWithAuthorization(new URL(StrategyResources.buildItemPath(id), instance.config.host), instance.authorize, UpdateStrategyPayloadSchema.parse(item)));
 }
 export async function deleteStrategy(instance, id) {
-    return StrategySchema.parse(await deleteItemWithAuthorization(new URL(StrategyResources.buildItemPath(id), instance.config.host), instance.authorizer));
+    return StrategySchema.parse(await deleteItemWithAuthorization(new URL(StrategyResources.buildItemPath(id), instance.config.host), instance.authorize));
 }

package/dist/esm/authorization/permissions/resources.js

@@ -32,17 +32,17 @@ export class PermissionResources {
 }
 export async function listPermissions(instance, pagination) {
     const url = addPaginationToURL(new URL(PermissionResources.buildPath(), instance.config.host), pagination);
-    return PaginationCollectionSchema(PermissionSchema).parse(await getItemWithAuthorization(url, instance.authorizer));
+    return PaginationCollectionSchema(PermissionSchema).parse(await getItemWithAuthorization(url, instance.authorize));
 }
 export async function getPermission(instance, id) {
-    return PermissionSchema.parse(await getItemWithAuthorization(new URL(PermissionResources.buildPath(id), instance.config.host), instance.authorizer));
+    return PermissionSchema.parse(await getItemWithAuthorization(new URL(PermissionResources.buildPath(id), instance.config.host), instance.authorize));
 }
 export async function insertPermission(instance, item) {
-    return PermissionSchema.parse(await postItemWithAuthorization(new URL(PermissionResources.buildPath(), instance.config.host), instance.authorizer, InsertPermissionPayloadSchema.parse(item)));
+    return PermissionSchema.parse(await postItemWithAuthorization(new URL(PermissionResources.buildPath(), instance.config.host), instance.authorize, InsertPermissionPayloadSchema.parse(item)));
 }
 export async function updatePermission(instance, id, item) {
-    return PermissionSchema.parse(await patchItemWithAuthorization(new URL(PermissionResources.buildPath(id), instance.config.host), instance.authorizer, UpdatePermissionPayloadSchema.parse(item)));
+    return PermissionSchema.parse(await patchItemWithAuthorization(new URL(PermissionResources.buildPath(id), instance.config.host), instance.authorize, UpdatePermissionPayloadSchema.parse(item)));
 }
 export async function deletePermission(instance, id) {
-    return PermissionSchema.parse(await deleteItemWithAuthorization(new URL(PermissionResources.buildPath(id), instance.config.host), instance.authorizer));
+    return PermissionSchema.parse(await deleteItemWithAuthorization(new URL(PermissionResources.buildPath(id), instance.config.host), instance.authorize));
 }

package/dist/esm/authorization/roles/resources.js

@@ -32,17 +32,17 @@ export class RoleResources {
 }
 export async function listRoles(instance, pagination) {
     const url = addPaginationToURL(new URL(RoleResources.buildPath(), instance.config.host), pagination);
-    return PaginationCollectionSchema(RoleSchema).parse(await getItemWithAuthorization(url, instance.authorizer));
+    return PaginationCollectionSchema(RoleSchema).parse(await getItemWithAuthorization(url, instance.authorize));
 }
 export async function getRole(instance, id) {
-    return RoleSchema.parse(await getItemWithAuthorization(new URL(RoleResources.buildPath(id), instance.config.host), instance.authorizer));
+    return RoleSchema.parse(await getItemWithAuthorization(new URL(RoleResources.buildPath(id), instance.config.host), instance.authorize));
 }
 export async function insertRole(instance, item) {
-    return RoleSchema.parse(await postItemWithAuthorization(new URL(RoleResources.buildPath(), instance.config.host), instance.authorizer, InsertRolePayloadSchema.parse(item)));
+    return RoleSchema.parse(await postItemWithAuthorization(new URL(RoleResources.buildPath(), instance.config.host), instance.authorize, InsertRolePayloadSchema.parse(item)));
 }
 export async function updateRole(instance, id, item) {
-    return RoleSchema.parse(await patchItemWithAuthorization(new URL(RoleResources.buildPath(id), instance.config.host), instance.authorizer, UpdateRolePayloadSchema.parse(item)));
+    return RoleSchema.parse(await patchItemWithAuthorization(new URL(RoleResources.buildPath(id), instance.config.host), instance.authorize, UpdateRolePayloadSchema.parse(item)));
 }
 export async function deleteRole(instance, id) {
-    return RoleSchema.parse(await deleteItemWithAuthorization(new URL(RoleResources.buildPath(id), instance.config.host), instance.authorizer));
+    return RoleSchema.parse(await deleteItemWithAuthorization(new URL(RoleResources.buildPath(id), instance.config.host), instance.authorize));
 }

package/dist/esm/common/index.d.ts

@@ -2,6 +2,7 @@ import { MondoIdentity } from './resources/init.js';
 export { defaultMutationRequestHeaders, defaultRequestHeaders, responseToHttpError, toHttpError, } from './resources/utils.js';
 export * from './errors/http.js';
 export * from './errors/validation.js';
+export type { Authorizer } from './resources/authorization.js';
 export * from './schema/schema.js';
 export default MondoIdentity;
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/common/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AAEvC,cAAc,oBAAoB,CAAC;AAEnC,eAAe,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AAEvC,YAAY,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,cAAc,oBAAoB,CAAC;AAEnC,eAAe,aAAa,CAAC"}

package/dist/esm/common/resources/authorization.d.ts

@@ -1,2 +1,19 @@
-export type Authorization = (request: RequestInit) => RequestInit;
+export type AuthorizeOptions = {
+    /** Force a credential refresh before authorizing the request. */
+    refresh?: boolean;
+};
+export type AccessToken = string | {
+    accessToken: string;
+    expiresAt?: number;
+    scope?: string;
+    type?: string;
+};
+export type AccessTokenProvider = (options?: AuthorizeOptions) => AccessToken | Promise<AccessToken>;
+/**
+ * Authorizer function type that adds authentication to requests.
+ * Takes a RequestInit object and returns it with authorization headers added.
+ * Async authorization can refresh credentials before the outbound API request.
+ */
+export type Authorizer = (request: RequestInit, options?: AuthorizeOptions) => RequestInit | Promise<RequestInit>;
+export declare function getAccessTokenValue(accessToken: AccessToken): string;
 //# sourceMappingURL=authorization.d.ts.map

package/dist/esm/common/resources/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/authorization.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,CAAC"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/authorization.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GACnB,MAAM,GACN;IACE,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,CAAC,EAAE,gBAAgB,KACvB,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAExC;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,gBAAgB,KACvB,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAExC,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,CAIpE"}

package/dist/esm/common/resources/authorization.js

@@ -1 +1,5 @@
-export {};
+export function getAccessTokenValue(accessToken) {
+    return typeof accessToken === 'string'
+        ? accessToken
+        : accessToken.accessToken;
+}

package/dist/esm/common/resources/init.d.ts

@@ -1,17 +1,17 @@
 import * as z from 'zod/v4';
+import { type AccessTokenProvider, type Authorizer } from './authorization.js';
 declare const ConfigSchema: z.ZodObject<{
-    accessToken: z.ZodString;
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodCustom<AccessTokenProvider, AccessTokenProvider>]>;
     host: z.ZodPipe<z.ZodDefault<z.ZodURL>, z.ZodTransform<URL, string>>;
 }, z.core.$strip>;
 export type ConfigProps = z.input<typeof ConfigSchema>;
 export type Config = z.output<typeof ConfigSchema>;
 export declare class MondoIdentity {
     readonly config: Config;
+    readonly authorize: Authorizer;
     constructor(config: ConfigProps);
-    /**
-     * Builds an authorizer function based on the type of access token
-     */
-    get authorizer(): (request: RequestInit) => RequestInit;
+    /** The base URL for API requests. */
+    get baseUrl(): URL;
 }
 export {};
 //# sourceMappingURL=init.d.ts.map

package/dist/esm/common/resources/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAc5B,QAAA,MAAM,YAAY;;;iBAA0B,CAAC;AAE7C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACvD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;AAEnD,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEL,MAAM,EAAE,WAAW;IAItC;;OAEG;IACH,IAAW,UAAU,IAAI,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,CAU7D;CAuBF"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,UAAU,EAEhB,MAAM,oBAAoB,CAAC;AAmB5B,QAAA,MAAM,YAAY;;;iBAA0B,CAAC;AAE7C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACvD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;AAEnD,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAgB,SAAS,EAAE,UAAU,CAAC;gBAEnB,MAAM,EAAE,WAAW;IActC,qCAAqC;IACrC,IAAW,OAAO,IAAI,GAAG,CAExB;CACF"}

package/dist/esm/common/resources/init.js

@@ -1,32 +1,38 @@
 import * as z from 'zod/v4';
+import { getAccessTokenValue, } from './authorization.js';
 const BaseConfigSchema = z.object({
     host: z
         .url()
-        .default('https://manage-api.mondoidentity.com')
+        .default('https://api.mondoidentity.com')
         .pipe(z.transform((v) => new URL(v))),
 });
 const AccessTokenConfigSchema = z.object({
     ...BaseConfigSchema.shape,
-    accessToken: z.string().min(1),
+    accessToken: z.union([
+        z.string().min(1),
+        z.custom((value) => typeof value === 'function', {
+            error: 'Access token must be a string or token provider function',
+        }),
+    ]),
 });
 const ConfigSchema = AccessTokenConfigSchema;
 export class MondoIdentity {
     config;
+    authorize;
     constructor(config) {
         this.config = initConfig(config);
+        this.authorize = async (request, options) => {
+            const accessToken = typeof this.config.accessToken === 'function'
+                ? await this.config.accessToken(options)
+                : this.config.accessToken;
+            request.headers = new Headers(request.headers);
+            request.headers.set('authorization', getAccessTokenValue(accessToken));
+            return request;
+        };
     }
-    /**
-     * Builds an authorizer function based on the type of access token
-     */
-    get authorizer() {
-        if (this.config.accessToken) {
-            return (request) => {
-                request.headers = new Headers(request.headers);
-                request.headers.append('authorization', this.config.accessToken);
-                return request;
-            };
-        }
-        return (request) => request;
+    /** The base URL for API requests. */
+    get baseUrl() {
+        return this.config.host;
     }
 }
 function initConfig(config) {

package/dist/esm/common/resources/init.test.js

@@ -1,4 +1,4 @@
-import { describe, expect, test } from 'vitest';
+import { describe, expect, test, vi } from 'vitest';
 import { MondoIdentity } from './init.js';
 describe('Common Resources - Init', () => {
     describe('MondoIdentity class', () => {
@@ -18,7 +18,7 @@ describe('Common Resources - Init', () => {
                 };
                 const mondoIdentity = new MondoIdentity(config);
                 expect(mondoIdentity.config.accessToken).toBe('test-access-token');
-                expect(mondoIdentity.config.host.toString()).toBe('https://manage-api.mondoidentity.com/');
+                expect(mondoIdentity.config.host.toString()).toBe('https://api.mondoidentity.com/');
             });
             test('should parse URL host correctly', () => {
                 const config = {
@@ -62,6 +62,11 @@ describe('Common Resources - Init', () => {
                 };
                 expect(() => new MondoIdentity(config)).toThrow('Invalid configuration');
             });
+            test('should initialize with an access token provider', () => {
+                const accessToken = vi.fn(() => 'provided-token');
+                const mondoIdentity = new MondoIdentity({ accessToken });
+                expect(mondoIdentity.config.accessToken).toBe(accessToken);
+            });
         });
         describe('config property', () => {
             test('should be readonly', () => {
@@ -85,29 +90,29 @@ describe('Common Resources - Init', () => {
                 expect(mondoIdentity.config.host.toString()).toBe(`${config.host}/`);
             });
         });
-        describe('authorizer property', () => {
-            test('should return function that adds authorization header when access token is provided', () => {
+        describe('authorize property', () => {
+            test('should return function that adds authorization header when access token is provided', async () => {
                 const config = {
                     accessToken: 'bearer-token-123',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
-                expect(typeof authorizer).toBe('function');
+                const authorize = mondoIdentity.authorize;
+                expect(typeof authorize).toBe('function');
                 const mockRequest = {
                     method: 'GET',
                     headers: {},
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 expect(authorizedRequest.headers).toBeInstanceOf(Headers);
                 const headers = authorizedRequest.headers;
                 expect(headers.get('authorization')).toBe('bearer-token-123');
             });
-            test('should preserve existing headers when adding authorization', () => {
+            test('should preserve existing headers when adding authorization', async () => {
                 const config = {
                     accessToken: 'test-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 const mockRequest = {
                     method: 'POST',
                     headers: {
@@ -115,18 +120,18 @@ describe('Common Resources - Init', () => {
                         'user-agent': 'test-client',
                     },
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 const headers = authorizedRequest.headers;
                 expect(headers.get('authorization')).toBe('test-token');
                 expect(headers.get('content-type')).toBe('application/json');
                 expect(headers.get('user-agent')).toBe('test-client');
             });
-            test('should handle Headers object as input', () => {
+            test('should handle Headers object as input', async () => {
                 const config = {
                     accessToken: 'header-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 const existingHeaders = new Headers({
                     accept: 'application/json',
                 });
@@ -134,67 +139,87 @@ describe('Common Resources - Init', () => {
                     method: 'GET',
                     headers: existingHeaders,
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 const headers = authorizedRequest.headers;
                 expect(headers.get('authorization')).toBe('header-token');
                 expect(headers.get('accept')).toBe('application/json');
             });
-            test('should handle undefined headers', () => {
+            test('should handle undefined headers', async () => {
                 const config = {
                     accessToken: 'undefined-headers-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 const mockRequest = {
                     method: 'GET',
                     // headers intentionally undefined
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 const headers = authorizedRequest.headers;
                 expect(headers.get('authorization')).toBe('undefined-headers-token');
             });
-            test('should return same request reference with modified headers', () => {
+            test('should return same request reference with modified headers', async () => {
                 const config = {
                     accessToken: 'reference-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 const mockRequest = {
                     method: 'PUT',
                     body: 'test-body',
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 // Should be the same object reference
                 expect(authorizedRequest).toBe(mockRequest);
                 expect(authorizedRequest.method).toBe('PUT');
                 expect(authorizedRequest.body).toBe('test-body');
             });
-            test('should be a getter that returns consistent function', () => {
+            test('should expose a consistent function', async () => {
                 const config = {
                     accessToken: 'consistent-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                // Getting authorizer multiple times should return the same function behavior
-                const authorizer1 = mondoIdentity.authorizer;
-                const authorizer2 = mondoIdentity.authorizer;
+                const authorize1 = mondoIdentity.authorize;
+                const authorize2 = mondoIdentity.authorize;
                 const mockRequest1 = { method: 'GET' };
                 const mockRequest2 = { method: 'POST' };
-                const result1 = authorizer1(mockRequest1);
-                const result2 = authorizer2(mockRequest2);
+                const result1 = await authorize1(mockRequest1);
+                const result2 = await authorize2(mockRequest2);
                 const headers1 = result1.headers;
                 const headers2 = result2.headers;
                 expect(headers1.get('authorization')).toBe('consistent-token');
                 expect(headers2.get('authorization')).toBe('consistent-token');
             });
+            test('should resolve access token providers with authorize options', async () => {
+                const accessToken = vi.fn((options) => options?.refresh ? 'refreshed-token' : 'cached-token');
+                const mondoIdentity = new MondoIdentity({ accessToken });
+                const cachedRequest = await mondoIdentity.authorize({ method: 'GET' });
+                const refreshedRequest = await mondoIdentity.authorize({ method: 'GET' }, { refresh: true });
+                expect(accessToken).toHaveBeenNthCalledWith(1, undefined);
+                expect(accessToken).toHaveBeenNthCalledWith(2, { refresh: true });
+                expect(cachedRequest.headers.get('authorization')).toBe('cached-token');
+                expect(refreshedRequest.headers.get('authorization')).toBe('refreshed-token');
+            });
+            test('should use the accessToken value from provider token objects', async () => {
+                const accessToken = vi.fn(() => ({
+                    accessToken: 'object-token',
+                    expiresAt: Date.now() + 60_000,
+                    scope: 'workspace:read',
+                    type: 'Bearer',
+                }));
+                const mondoIdentity = new MondoIdentity({ accessToken });
+                const request = await mondoIdentity.authorize({ method: 'GET' });
+                expect(request.headers.get('authorization')).toBe('object-token');
+            });
         });
         describe('integration tests', () => {
-            test('should work with real-world configuration', () => {
+            test('should work with real-world configuration', async () => {
                 const config = {
                     accessToken: 'prod_12345abcdef67890',
                     host: 'https://api.mondoidentity.com/v1',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 // Test configuration
                 expect(mondoIdentity.config.accessToken).toBe('prod_12345abcdef67890');
                 expect(mondoIdentity.config.host).instanceOf(URL);
@@ -207,21 +232,20 @@ describe('Common Resources - Init', () => {
                         'user-agent': 'mondo-identity-sdk/1.0.0',
                     },
                 };
-                const authorizedRequest = authorizer(apiRequest);
+                const authorizedRequest = await authorize(apiRequest);
                 const headers = authorizedRequest.headers;
                 expect(headers.get('authorization')).toBe('prod_12345abcdef67890');
                 expect(headers.get('accept')).toBe('application/json');
                 expect(headers.get('user-agent')).toBe('mondo-identity-sdk/1.0.0');
             });
-            test('should handle edge cases gracefully', () => {
+            test('should handle edge cases gracefully', async () => {
                 const config = {
                     accessToken: 'edge-case-token-with-special-chars!@#$%^&*()',
                     host: 'https://localhost:3000',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                expect(() => {
-                    const authorizer = mondoIdentity.authorizer;
-                    const request = authorizer({ method: 'OPTIONS' });
+                await expect(async () => {
+                    const request = await mondoIdentity.authorize({ method: 'OPTIONS' });
                     const headers = request.headers;
                     headers.get('authorization');
                 }).not.toThrow();

package/dist/esm/common/resources/operations.d.ts

@@ -1,8 +1,8 @@
-import type { Authorization } from './authorization.js';
-export declare function listItemsWithAuthorization<Result>(url: URL, authorization: Authorization): Promise<Result>;
-export declare function getItemWithAuthorization<Result>(url: URL, authorization: Authorization): Promise<Result>;
-export declare function patchItemWithAuthorization<Result, Mutation>(url: URL, authorization: Authorization, item: Mutation): Promise<Result>;
-export declare function putItemWithAuthorization<Result, Mutation>(url: URL, authorization: Authorization, item: Mutation): Promise<Result>;
-export declare function postItemWithAuthorization<Result, Mutation>(url: URL, authorization: Authorization, item?: Mutation): Promise<Result>;
-export declare function deleteItemWithAuthorization<Result>(url: URL, authorization: Authorization): Promise<Result>;
+import type { Authorizer } from './authorization.js';
+export declare function listItemsWithAuthorization<Result>(url: URL, authorizer: Authorizer): Promise<Result>;
+export declare function getItemWithAuthorization<Result>(url: URL, authorizer: Authorizer): Promise<Result>;
+export declare function patchItemWithAuthorization<Result, Mutation>(url: URL, authorizer: Authorizer, item: Mutation): Promise<Result>;
+export declare function putItemWithAuthorization<Result, Mutation>(url: URL, authorizer: Authorizer, item: Mutation): Promise<Result>;
+export declare function postItemWithAuthorization<Result, Mutation>(url: URL, authorizer: Authorizer, item?: Mutation): Promise<Result>;
+export declare function deleteItemWithAuthorization<Result>(url: URL, authorizer: Authorizer): Promise<Result>;
 //# sourceMappingURL=operations.d.ts.map

package/dist/esm/common/resources/operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AASxD,wBAAsB,0BAA0B,CAAC,MAAM,EACrD,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EACnD,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,QAAQ,EAC/D,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,EAC5B,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAC7D,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,EAC5B,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,MAAM,CAAC,CAEjB;AA8BD,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,QAAQ,EAC9D,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,EAC5B,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EACtD,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,MAAM,CAAC,CAoBjB"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AASrD,wBAAsB,0BAA0B,CAAC,MAAM,EACrD,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EACnD,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,QAAQ,EAC/D,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAC7D,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,MAAM,CAAC,CAEjB;AA2BD,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,QAAQ,EAC9D,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EACtD,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAiBjB"}

package/dist/esm/common/resources/operations.js

@@ -1,11 +1,11 @@
 import { defaultMutationRequestHeaders, defaultRequestHeaders, jsonBody, responseToHttpError, toHttpError, } from './utils.js';
-export async function listItemsWithAuthorization(url, authorization) {
+export async function listItemsWithAuthorization(url, authorizer) {
     try {
         console.debug('List items', { url });
-        const response = await fetch(url, authorization({
+        const response = await fetchWithAuthorization(url, authorizer, {
             method: 'GET',
             headers: defaultRequestHeaders(),
-        }));
+        });
         if (response.ok) {
             return await response.json();
         }
@@ -15,13 +15,13 @@ export async function listItemsWithAuthorization(url, authorization) {
         throw toHttpError(error);
     }
 }
-export async function getItemWithAuthorization(url, authorization) {
+export async function getItemWithAuthorization(url, authorizer) {
     try {
         console.debug('GET item', { url });
-        const response = await fetch(url, authorization({
+        const response = await fetchWithAuthorization(url, authorizer, {
             method: 'GET',
             headers: defaultRequestHeaders(),
-        }));
+        });
         if (response.ok) {
             return await response.json();
         }
@@ -31,20 +31,20 @@ export async function getItemWithAuthorization(url, authorization) {
         throw toHttpError(error);
     }
 }
-export async function patchItemWithAuthorization(url, authorization, item) {
-    return mutateItemWithAuthorization('PATCH', url, authorization, item);
+export async function patchItemWithAuthorization(url, authorizer, item) {
+    return mutateItemWithAuthorization('PATCH', url, authorizer, item);
 }
-export async function putItemWithAuthorization(url, authorization, item) {
-    return mutateItemWithAuthorization('PUT', url, authorization, item);
+export async function putItemWithAuthorization(url, authorizer, item) {
+    return mutateItemWithAuthorization('PUT', url, authorizer, item);
 }
-async function mutateItemWithAuthorization(method, url, authorization, item) {
+async function mutateItemWithAuthorization(method, url, authorizer, item) {
     try {
         console.debug(`${method} item`, { url, item });
-        const response = await fetch(url, authorization({
+        const response = await fetchWithAuthorization(url, authorizer, {
             method,
             headers: defaultMutationRequestHeaders(),
             body: JSON.stringify(item),
-        }));
+        });
         if (response.ok) {
             return await response.json();
         }
@@ -54,14 +54,14 @@ async function mutateItemWithAuthorization(method, url, authorization, item) {
         throw toHttpError(error);
     }
 }
-export async function postItemWithAuthorization(url, authorization, item) {
+export async function postItemWithAuthorization(url, authorizer, item) {
     try {
         console.debug('POST item', { url, item });
-        const response = await fetch(url, authorization({
+        const response = await fetchWithAuthorization(url, authorizer, {
             method: 'POST',
             headers: defaultMutationRequestHeaders(),
             body: item ? JSON.stringify(item) : undefined,
-        }));
+        });
         if (response.ok) {
             return await response.json();
         }
@@ -71,13 +71,13 @@ export async function postItemWithAuthorization(url, authorization, item) {
         throw toHttpError(error);
     }
 }
-export async function deleteItemWithAuthorization(url, authorization) {
+export async function deleteItemWithAuthorization(url, authorizer) {
     try {
         console.debug('Delete item', { url });
-        const response = await fetch(url, authorization({
+        const response = await fetchWithAuthorization(url, authorizer, {
             method: 'DELETE',
             headers: defaultRequestHeaders(),
-        }));
+        });
         if (response.ok) {
             return (await jsonBody(response));
         }
@@ -87,3 +87,19 @@ export async function deleteItemWithAuthorization(url, authorization) {
         throw toHttpError(error);
     }
 }
+async function fetchWithAuthorization(url, authorizer, request) {
+    const response = await fetch(url, await authorizer(cloneRequestInit(request)));
+    if (!isAuthorizationResponse(response)) {
+        return response;
+    }
+    return fetch(url, await authorizer(cloneRequestInit(request), { refresh: true }));
+}
+function isAuthorizationResponse(response) {
+    return [401, 403].includes(response.status);
+}
+function cloneRequestInit(request) {
+    return {
+        ...request,
+        headers: new Headers(request.headers),
+    };
+}