@go-mondo/identity-sdk 0.0.2-beta.9 → 0.0.2-beta.91

package/dist/esm/authorization/schema.d.ts

@@ -1,3 +1,4 @@
+import * as z from 'zod/v4';
 export declare const Model: {
     readonly Permission: {
         readonly UIDPrefix: "per";
@@ -8,10 +9,10 @@ export declare const Model: {
 };
 export declare function generatePermissionId(): string;
 export declare function generateRoleId(): string;
-export declare const RoleIdSchema: import("arktype/internal/methods/string.ts").StringType<string, {}>;
-export type RoleId = typeof RoleIdSchema.inferOut;
-export declare const RoleIdAssociationsSchema: import("arktype").BaseType<string[] | undefined, {}>;
-export declare const PermissionIdSchema: import("arktype/internal/methods/string.ts").StringType<string, {}>;
-export type PermissionId = typeof PermissionIdSchema.inferOut;
-export declare const PermissionIdAssociationsSchema: import("arktype").BaseType<string[] | undefined, {}>;
+export declare const RoleIdSchema: z.ZodString;
+export type RoleId = z.output<typeof RoleIdSchema>;
+export declare const RoleIdAssociationsSchema: z.ZodUnion<readonly [z.ZodUndefined, z.ZodArray<z.ZodString>]>;
+export declare const PermissionIdSchema: z.ZodString;
+export type PermissionId = z.output<typeof PermissionIdSchema>;
+export declare const PermissionIdAssociationsSchema: z.ZodUnion<readonly [z.ZodUndefined, z.ZodArray<z.ZodString>]>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/esm/authorization/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/authorization/schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,KAAK;;;;;;;CAOR,CAAC;AAEX,wBAAgB,oBAAoB,WAEnC;AAED,wBAAgB,cAAc,WAE7B;AAED,eAAO,MAAM,YAAY,qEAAoC,CAAC;AAC9D,MAAM,MAAM,MAAM,GAAG,OAAO,YAAY,CAAC,QAAQ,CAAC;AAElD,eAAO,MAAM,wBAAwB,sDAEpC,CAAC;AAEF,eAAO,MAAM,kBAAkB,qEAA0C,CAAC;AAC1E,MAAM,MAAM,YAAY,GAAG,OAAO,kBAAkB,CAAC,QAAQ,CAAC;AAE9D,eAAO,MAAM,8BAA8B,sDAE1C,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/authorization/schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,KAAK;;;;;;;CAOR,CAAC;AAEX,wBAAgB,oBAAoB,WAEnC;AAED,wBAAgB,cAAc,WAE7B;AAED,eAAO,MAAM,YAAY,aAAoC,CAAC;AAC9D,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;AAEnD,eAAO,MAAM,wBAAwB,gEAGnC,CAAC;AAEH,eAAO,MAAM,kBAAkB,aAA0C,CAAC;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE/D,eAAO,MAAM,8BAA8B,gEAGzC,CAAC"}

package/dist/esm/authorization/schema.js

@@ -1,5 +1,5 @@
-import { type } from 'arktype';
 import KSUID from 'ksuid';
+import * as z from 'zod/v4';
 import { KSUIDSchema } from '../common/schema/id.js';
 export const Model = {
     Permission: {
@@ -16,6 +16,12 @@ export function generateRoleId() {
     return `${Model.Role.UIDPrefix}_${KSUID.randomSync().string}`;
 }
 export const RoleIdSchema = KSUIDSchema(Model.Role.UIDPrefix);
-export const RoleIdAssociationsSchema = type('undefined').or(RoleIdSchema.array());
+export const RoleIdAssociationsSchema = z.union([
+    z.undefined(),
+    z.array(RoleIdSchema),
+]);
 export const PermissionIdSchema = KSUIDSchema(Model.Permission.UIDPrefix);
-export const PermissionIdAssociationsSchema = type('undefined').or(PermissionIdSchema.array());
+export const PermissionIdAssociationsSchema = z.union([
+    z.undefined(),
+    z.array(PermissionIdSchema),
+]);

package/dist/esm/common/index.d.ts

@@ -2,6 +2,8 @@ import { MondoIdentity } from './resources/init.js';
 export { defaultMutationRequestHeaders, defaultRequestHeaders, responseToHttpError, toHttpError, } from './resources/utils.js';
 export * from './errors/http.js';
 export * from './errors/validation.js';
+export type { MondoInstance } from './resources/init.js';
+export type { AccessTokenProvider, Authorizer, } from './resources/authorization.js';
 export * from './schema/schema.js';
 export default MondoIdentity;
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/common/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AAEvC,cAAc,oBAAoB,CAAC;AAEnC,eAAe,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,YAAY,EACV,mBAAmB,EACnB,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,cAAc,oBAAoB,CAAC;AAEnC,eAAe,aAAa,CAAC"}

package/dist/esm/common/resources/authorization.d.ts

@@ -1,2 +1,19 @@
-export type Authorization = (request: RequestInit) => RequestInit;
+export type AuthorizeOptions = {
+    /** Force a credential refresh before authorizing the request. */
+    refresh?: boolean;
+};
+export type AccessToken = string | {
+    accessToken: string;
+    expiresAt?: number;
+    scope?: string;
+    type?: string;
+};
+export type AccessTokenProvider = (options?: AuthorizeOptions) => AccessToken | Promise<AccessToken>;
+/**
+ * Authorizer function type that adds authentication to requests.
+ * Takes a RequestInit object and returns it with authorization headers added.
+ * Async authorization can refresh credentials before the outbound API request.
+ */
+export type Authorizer = (request: RequestInit, options?: AuthorizeOptions) => RequestInit | Promise<RequestInit>;
+export declare function getAccessTokenValue(accessToken: AccessToken): string;
 //# sourceMappingURL=authorization.d.ts.map

package/dist/esm/common/resources/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/authorization.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,CAAC"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/authorization.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GACnB,MAAM,GACN;IACE,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,CAAC,EAAE,gBAAgB,KACvB,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAExC;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,gBAAgB,KACvB,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAExC,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,CAIpE"}

package/dist/esm/common/resources/authorization.js

@@ -1 +1,5 @@
-export {};
+export function getAccessTokenValue(accessToken) {
+    return typeof accessToken === 'string'
+        ? accessToken
+        : accessToken.accessToken;
+}

package/dist/esm/common/resources/init.d.ts

@@ -1,16 +1,33 @@
-declare const ConfigSchema: import("arktype/internal/methods/object.ts").ObjectType<{
-    host: (In: import("arktype/internal/attributes.ts").Default<string, "https://manage-api.mondoidentity.com">) => import("arktype/internal/attributes.ts").To<URL>;
-    accessToken: string;
-}, {}>;
-export type ConfigProps = typeof ConfigSchema.inferIn;
-export type Config = typeof ConfigSchema.inferOut;
-export declare class MondoIdentity {
+import * as z from 'zod/v4';
+import { type AccessTokenProvider, type Authorizer } from './authorization.js';
+declare const ConfigSchema: z.ZodObject<{
+    accessToken: z.ZodUnion<readonly [z.ZodString, z.ZodCustom<AccessTokenProvider, AccessTokenProvider>]>;
+    host: z.ZodPipe<z.ZodDefault<z.ZodURL>, z.ZodTransform<URL, string>>;
+}, z.core.$strip>;
+export type ConfigProps = z.input<typeof ConfigSchema>;
+export type Config = z.output<typeof ConfigSchema>;
+/**
+ * Interface representing a configured Mondo SDK instance.
+ * Provides the base URL and authorization function for API requests.
+ */
+export type MondoInstance = {
+    /** The base URL for API requests */
+    readonly baseUrl: URL;
+    /** Function that adds authorization headers to requests */
+    readonly authorize: Authorizer;
+};
+/**
+ * Type guard to check if a value is a MondoInstance.
+ * @param value - The value to check
+ * @returns True if the value is a MondoInstance
+ */
+export declare function isMondoInstance(value: unknown): value is MondoInstance;
+export declare class MondoIdentity implements MondoInstance {
     readonly config: Config;
+    readonly authorize: Authorizer;
     constructor(config: ConfigProps);
-    /**
-     * Builds an authorizer function based on the type of access token
-     */
-    get authorizer(): (request: RequestInit) => RequestInit;
+    /** The base URL for API requests. */
+    get baseUrl(): URL;
 }
 export {};
 //# sourceMappingURL=init.d.ts.map

package/dist/esm/common/resources/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/init.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,YAAY;;;MAA0B,CAAC;AAE7C,MAAM,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,OAAO,CAAC;AACtD,MAAM,MAAM,MAAM,GAAG,OAAO,YAAY,CAAC,QAAQ,CAAC;AAElD,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEL,MAAM,EAAE,WAAW;IAItC;;OAEG;IACH,IAAW,UAAU,IAAI,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,CAU7D;CAuBF"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,UAAU,EAEhB,MAAM,oBAAoB,CAAC;AAmB5B,QAAA,MAAM,YAAY;;;iBAA0B,CAAC;AAE7C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACvD,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;AAEnD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAStE;AAED,qBAAa,aAAc,YAAW,aAAa;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,SAAgB,SAAS,EAAE,UAAU,CAAC;gBAEnB,MAAM,EAAE,WAAW;IAiBtC,qCAAqC;IACrC,IAAW,OAAO,IAAI,GAAG,CAExB;CACF"}

package/dist/esm/common/resources/init.js

@@ -1,34 +1,60 @@
-import { type } from 'arktype';
-const BaseConfigSchema = type({
-    host: type('string.url.parse').default('https://manage-api.mondoidentity.com'),
+import * as z from 'zod/v4';
+import { getAccessTokenValue, } from './authorization.js';
+const BaseConfigSchema = z.object({
+    host: z
+        .url()
+        .default('https://api.mondoidentity.com')
+        .pipe(z.transform((v) => new URL(v))),
 });
-const AccessTokenConfigSchema = BaseConfigSchema.and({
-    accessToken: type('string').moreThanLength(0),
+const AccessTokenConfigSchema = z.object({
+    ...BaseConfigSchema.shape,
+    accessToken: z.union([
+        z.string().min(1),
+        z.custom((value) => typeof value === 'function', {
+            error: 'Access token must be a string or token provider function',
+        }),
+    ]),
 });
 const ConfigSchema = AccessTokenConfigSchema;
+/**
+ * Type guard to check if a value is a MondoInstance.
+ * @param value - The value to check
+ * @returns True if the value is a MondoInstance
+ */
+export function isMondoInstance(value) {
+    const maybeInstance = value;
+    return (maybeInstance !== null &&
+        typeof maybeInstance === 'object' &&
+        maybeInstance.baseUrl instanceof URL &&
+        typeof maybeInstance.authorize === 'function');
+}
 export class MondoIdentity {
     config;
+    authorize;
     constructor(config) {
         this.config = initConfig(config);
+        this.authorize = async (request, options) => {
+            const accessToken = typeof this.config.accessToken === 'function'
+                ? await this.config.accessToken(options)
+                : this.config.accessToken;
+            request.headers = new Headers(request.headers);
+            request.headers.set('authorization', `Bearer ${getAccessTokenValue(accessToken)}`);
+            return request;
+        };
     }
-    /**
-     * Builds an authorizer function based on the type of access token
-     */
-    get authorizer() {
-        if (this.config.accessToken) {
-            return (request) => {
-                request.headers = new Headers(request.headers);
-                request.headers.append('authorization', this.config.accessToken);
-                return request;
-            };
-        }
-        return (request) => request;
+    /** The base URL for API requests. */
+    get baseUrl() {
+        return this.config.host;
     }
 }
 function initConfig(config) {
-    const out = ConfigSchema(config);
-    if (out instanceof type.errors) {
-        throw new Error(`Invalid configuration: ${out.summary}`);
+    try {
+        return ConfigSchema.parse(config);
+    }
+    catch (error) {
+        if (error instanceof z.ZodError) {
+            throw new Error(`Invalid configuration: ${error.message}`);
+        }
+        throw error;
     }
-    return out;
 }

package/dist/esm/common/resources/init.test.js

@@ -1,4 +1,4 @@
-import { describe, expect, test } from 'vitest';
+import { describe, expect, test, vi } from 'vitest';
 import { MondoIdentity } from './init.js';
 describe('Common Resources - Init', () => {
     describe('MondoIdentity class', () => {
@@ -18,7 +18,7 @@ describe('Common Resources - Init', () => {
                 };
                 const mondoIdentity = new MondoIdentity(config);
                 expect(mondoIdentity.config.accessToken).toBe('test-access-token');
-                expect(mondoIdentity.config.host.toString()).toBe('https://manage-api.mondoidentity.com/');
+                expect(mondoIdentity.config.host.toString()).toBe('https://api.mondoidentity.com/');
             });
             test('should parse URL host correctly', () => {
                 const config = {
@@ -62,6 +62,11 @@ describe('Common Resources - Init', () => {
                 };
                 expect(() => new MondoIdentity(config)).toThrow('Invalid configuration');
             });
+            test('should initialize with an access token provider', () => {
+                const accessToken = vi.fn(() => 'provided-token');
+                const mondoIdentity = new MondoIdentity({ accessToken });
+                expect(mondoIdentity.config.accessToken).toBe(accessToken);
+            });
         });
         describe('config property', () => {
             test('should be readonly', () => {
@@ -85,29 +90,29 @@ describe('Common Resources - Init', () => {
                 expect(mondoIdentity.config.host.toString()).toBe(`${config.host}/`);
             });
         });
-        describe('authorizer property', () => {
-            test('should return function that adds authorization header when access token is provided', () => {
+        describe('authorize property', () => {
+            test('should return function that adds authorization header when access token is provided', async () => {
                 const config = {
                     accessToken: 'bearer-token-123',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
-                expect(typeof authorizer).toBe('function');
+                const authorize = mondoIdentity.authorize;
+                expect(typeof authorize).toBe('function');
                 const mockRequest = {
                     method: 'GET',
                     headers: {},
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 expect(authorizedRequest.headers).toBeInstanceOf(Headers);
                 const headers = authorizedRequest.headers;
-                expect(headers.get('authorization')).toBe('bearer-token-123');
+                expect(headers.get('authorization')).toBe('Bearer bearer-token-123');
             });
-            test('should preserve existing headers when adding authorization', () => {
+            test('should preserve existing headers when adding authorization', async () => {
                 const config = {
                     accessToken: 'test-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 const mockRequest = {
                     method: 'POST',
                     headers: {
@@ -115,18 +120,18 @@ describe('Common Resources - Init', () => {
                         'user-agent': 'test-client',
                     },
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 const headers = authorizedRequest.headers;
-                expect(headers.get('authorization')).toBe('test-token');
+                expect(headers.get('authorization')).toBe('Bearer test-token');
                 expect(headers.get('content-type')).toBe('application/json');
                 expect(headers.get('user-agent')).toBe('test-client');
             });
-            test('should handle Headers object as input', () => {
+            test('should handle Headers object as input', async () => {
                 const config = {
                     accessToken: 'header-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 const existingHeaders = new Headers({
                     accept: 'application/json',
                 });
@@ -134,67 +139,87 @@ describe('Common Resources - Init', () => {
                     method: 'GET',
                     headers: existingHeaders,
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 const headers = authorizedRequest.headers;
-                expect(headers.get('authorization')).toBe('header-token');
+                expect(headers.get('authorization')).toBe('Bearer header-token');
                 expect(headers.get('accept')).toBe('application/json');
             });
-            test('should handle undefined headers', () => {
+            test('should handle undefined headers', async () => {
                 const config = {
                     accessToken: 'undefined-headers-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 const mockRequest = {
                     method: 'GET',
                     // headers intentionally undefined
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 const headers = authorizedRequest.headers;
-                expect(headers.get('authorization')).toBe('undefined-headers-token');
+                expect(headers.get('authorization')).toBe('Bearer undefined-headers-token');
             });
-            test('should return same request reference with modified headers', () => {
+            test('should return same request reference with modified headers', async () => {
                 const config = {
                     accessToken: 'reference-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 const mockRequest = {
                     method: 'PUT',
                     body: 'test-body',
                 };
-                const authorizedRequest = authorizer(mockRequest);
+                const authorizedRequest = await authorize(mockRequest);
                 // Should be the same object reference
                 expect(authorizedRequest).toBe(mockRequest);
                 expect(authorizedRequest.method).toBe('PUT');
                 expect(authorizedRequest.body).toBe('test-body');
             });
-            test('should be a getter that returns consistent function', () => {
+            test('should expose a consistent function', async () => {
                 const config = {
                     accessToken: 'consistent-token',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                // Getting authorizer multiple times should return the same function behavior
-                const authorizer1 = mondoIdentity.authorizer;
-                const authorizer2 = mondoIdentity.authorizer;
+                const authorize1 = mondoIdentity.authorize;
+                const authorize2 = mondoIdentity.authorize;
                 const mockRequest1 = { method: 'GET' };
                 const mockRequest2 = { method: 'POST' };
-                const result1 = authorizer1(mockRequest1);
-                const result2 = authorizer2(mockRequest2);
+                const result1 = await authorize1(mockRequest1);
+                const result2 = await authorize2(mockRequest2);
                 const headers1 = result1.headers;
                 const headers2 = result2.headers;
-                expect(headers1.get('authorization')).toBe('consistent-token');
-                expect(headers2.get('authorization')).toBe('consistent-token');
+                expect(headers1.get('authorization')).toBe('Bearer consistent-token');
+                expect(headers2.get('authorization')).toBe('Bearer consistent-token');
+            });
+            test('should resolve access token providers with authorize options', async () => {
+                const accessToken = vi.fn((options) => options?.refresh ? 'refreshed-token' : 'cached-token');
+                const mondoIdentity = new MondoIdentity({ accessToken });
+                const cachedRequest = await mondoIdentity.authorize({ method: 'GET' });
+                const refreshedRequest = await mondoIdentity.authorize({ method: 'GET' }, { refresh: true });
+                expect(accessToken).toHaveBeenNthCalledWith(1, undefined);
+                expect(accessToken).toHaveBeenNthCalledWith(2, { refresh: true });
+                expect(cachedRequest.headers.get('authorization')).toBe('Bearer cached-token');
+                expect(refreshedRequest.headers.get('authorization')).toBe('Bearer refreshed-token');
+            });
+            test('should use the accessToken value from provider token objects', async () => {
+                const accessToken = vi.fn(() => ({
+                    accessToken: 'object-token',
+                    expiresAt: Date.now() + 60_000,
+                    scope: 'workspace:read',
+                    type: 'Bearer',
+                }));
+                const mondoIdentity = new MondoIdentity({ accessToken });
+                const request = await mondoIdentity.authorize({ method: 'GET' });
+                expect(request.headers.get('authorization')).toBe('Bearer object-token');
             });
         });
         describe('integration tests', () => {
-            test('should work with real-world configuration', () => {
+            test('should work with real-world configuration', async () => {
                 const config = {
                     accessToken: 'prod_12345abcdef67890',
                     host: 'https://api.mondoidentity.com/v1',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                const authorizer = mondoIdentity.authorizer;
+                const authorize = mondoIdentity.authorize;
                 // Test configuration
                 expect(mondoIdentity.config.accessToken).toBe('prod_12345abcdef67890');
                 expect(mondoIdentity.config.host).instanceOf(URL);
@@ -207,21 +232,20 @@ describe('Common Resources - Init', () => {
                         'user-agent': 'mondo-identity-sdk/1.0.0',
                     },
                 };
-                const authorizedRequest = authorizer(apiRequest);
+                const authorizedRequest = await authorize(apiRequest);
                 const headers = authorizedRequest.headers;
-                expect(headers.get('authorization')).toBe('prod_12345abcdef67890');
+                expect(headers.get('authorization')).toBe('Bearer prod_12345abcdef67890');
                 expect(headers.get('accept')).toBe('application/json');
                 expect(headers.get('user-agent')).toBe('mondo-identity-sdk/1.0.0');
             });
-            test('should handle edge cases gracefully', () => {
+            test('should handle edge cases gracefully', async () => {
                 const config = {
                     accessToken: 'edge-case-token-with-special-chars!@#$%^&*()',
                     host: 'https://localhost:3000',
                 };
                 const mondoIdentity = new MondoIdentity(config);
-                expect(() => {
-                    const authorizer = mondoIdentity.authorizer;
-                    const request = authorizer({ method: 'OPTIONS' });
+                await expect(async () => {
+                    const request = await mondoIdentity.authorize({ method: 'OPTIONS' });
                     const headers = request.headers;
                     headers.get('authorization');
                 }).not.toThrow();

package/dist/esm/common/resources/operations.d.ts

@@ -1,7 +1,8 @@
-import type { Authorization } from './authorization.js';
-export declare function listItemsWithAuthorization<Result>(url: URL, authorization: Authorization): Promise<Result>;
-export declare function getItemWithAuthorization<Result>(url: URL, authorization: Authorization): Promise<Result>;
-export declare function updateItemWithAuthorization<Result, Mutation>(url: URL, authorization: Authorization, item: Mutation): Promise<Result>;
-export declare function insertItemWithAuthorization<Result, Mutation>(url: URL, authorization: Authorization, item?: Mutation): Promise<Result>;
-export declare function deleteItemWithAuthorization<Result>(url: URL, authorization: Authorization): Promise<Result>;
+import type { Authorizer } from './authorization.js';
+export declare function listItemsWithAuthorization<Result>(url: URL, authorizer: Authorizer): Promise<Result>;
+export declare function getItemWithAuthorization<Result>(url: URL, authorizer: Authorizer): Promise<Result>;
+export declare function patchItemWithAuthorization<Result, Mutation>(url: URL, authorizer: Authorizer, item: Mutation): Promise<Result>;
+export declare function putItemWithAuthorization<Result, Mutation>(url: URL, authorizer: Authorizer, item: Mutation): Promise<Result>;
+export declare function postItemWithAuthorization<Result, Mutation>(url: URL, authorizer: Authorizer, item?: Mutation): Promise<Result>;
+export declare function deleteItemWithAuthorization<Result>(url: URL, authorizer: Authorizer): Promise<Result>;
 //# sourceMappingURL=operations.d.ts.map

package/dist/esm/common/resources/operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AASxD,wBAAsB,0BAA0B,CAAC,MAAM,EACrD,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EACnD,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE,QAAQ,EAChE,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,EAC5B,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE,QAAQ,EAChE,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,EAC5B,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EACtD,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,MAAM,CAAC,CAoBjB"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../../../src/common/resources/operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AASrD,wBAAsB,0BAA0B,CAAC,MAAM,EACrD,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EACnD,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,QAAQ,EAC/D,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAC7D,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,MAAM,CAAC,CAEjB;AA2BD,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,QAAQ,EAC9D,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,QAAQ,GACd,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EACtD,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAiBjB"}

package/dist/esm/common/resources/operations.js

@@ -1,11 +1,11 @@
 import { defaultMutationRequestHeaders, defaultRequestHeaders, jsonBody, responseToHttpError, toHttpError, } from './utils.js';
-export async function listItemsWithAuthorization(url, authorization) {
+export async function listItemsWithAuthorization(url, authorizer) {
     try {
         console.debug('List items', { url });
-        const response = await fetch(url, authorization({
+        const response = await fetchWithAuthorization(url, authorizer, {
             method: 'GET',
             headers: defaultRequestHeaders(),
-        }));
+        });
         if (response.ok) {
             return await response.json();
         }
@@ -15,13 +15,13 @@ export async function listItemsWithAuthorization(url, authorization) {
         throw toHttpError(error);
     }
 }
-export async function getItemWithAuthorization(url, authorization) {
+export async function getItemWithAuthorization(url, authorizer) {
     try {
-        console.debug('Get item', { url });
-        const response = await fetch(url, authorization({
+        console.debug('GET item', { url });
+        const response = await fetchWithAuthorization(url, authorizer, {
             method: 'GET',
             headers: defaultRequestHeaders(),
-        }));
+        });
         if (response.ok) {
             return await response.json();
         }
@@ -31,14 +31,20 @@ export async function getItemWithAuthorization(url, authorization) {
         throw toHttpError(error);
     }
 }
-export async function updateItemWithAuthorization(url, authorization, item) {
+export async function patchItemWithAuthorization(url, authorizer, item) {
+    return mutateItemWithAuthorization('PATCH', url, authorizer, item);
+}
+export async function putItemWithAuthorization(url, authorizer, item) {
+    return mutateItemWithAuthorization('PUT', url, authorizer, item);
+}
+async function mutateItemWithAuthorization(method, url, authorizer, item) {
     try {
-        console.debug('Update item', { url, item });
-        const response = await fetch(url, authorization({
-            method: 'PUT',
+        console.debug(`${method} item`, { url, item });
+        const response = await fetchWithAuthorization(url, authorizer, {
+            method,
             headers: defaultMutationRequestHeaders(),
             body: JSON.stringify(item),
-        }));
+        });
         if (response.ok) {
             return await response.json();
         }
@@ -48,14 +54,14 @@ export async function updateItemWithAuthorization(url, authorization, item) {
         throw toHttpError(error);
     }
 }
-export async function insertItemWithAuthorization(url, authorization, item) {
+export async function postItemWithAuthorization(url, authorizer, item) {
     try {
-        console.debug('Insert item', { url, item });
-        const response = await fetch(url, authorization({
+        console.debug('POST item', { url, item });
+        const response = await fetchWithAuthorization(url, authorizer, {
             method: 'POST',
             headers: defaultMutationRequestHeaders(),
             body: item ? JSON.stringify(item) : undefined,
-        }));
+        });
         if (response.ok) {
             return await response.json();
         }
@@ -65,13 +71,13 @@ export async function insertItemWithAuthorization(url, authorization, item) {
         throw toHttpError(error);
     }
 }
-export async function deleteItemWithAuthorization(url, authorization) {
+export async function deleteItemWithAuthorization(url, authorizer) {
     try {
         console.debug('Delete item', { url });
-        const response = await fetch(url, authorization({
+        const response = await fetchWithAuthorization(url, authorizer, {
             method: 'DELETE',
             headers: defaultRequestHeaders(),
-        }));
+        });
         if (response.ok) {
             return (await jsonBody(response));
         }
@@ -81,3 +87,19 @@ export async function deleteItemWithAuthorization(url, authorization) {
         throw toHttpError(error);
     }
 }
+async function fetchWithAuthorization(url, authorizer, request) {
+    const response = await fetch(url, await authorizer(cloneRequestInit(request)));
+    if (!isAuthorizationResponse(response)) {
+        return response;
+    }
+    return fetch(url, await authorizer(cloneRequestInit(request), { refresh: true }));
+}
+function isAuthorizationResponse(response) {
+    return [401, 403].includes(response.status);
+}
+function cloneRequestInit(request) {
+    return {
+        ...request,
+        headers: new Headers(request.headers),
+    };
+}