authmi 1.0.0 → 1.1.0

package/dist/index.js

@@ -22,6 +22,8 @@ var index_exports = {};
 __export(index_exports, {
   AuthMiClient: () => AuthMiClient,
   AuthMiError: () => AuthMiError,
+  CookieTokenStorage: () => CookieTokenStorage,
+  IntrospectCache: () => IntrospectCache,
   LocalStorageTokenStorage: () => LocalStorageTokenStorage,
   MemoryTokenStorage: () => MemoryTokenStorage,
   ScopeError: () => ScopeError,
@@ -29,6 +31,57 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/config.ts
+function resolveConfig(provider) {
+  const raw = typeof provider === "function" ? provider() : provider;
+  return {
+    baseUrl: raw.baseUrl,
+    apiKey: raw.apiKey ?? "",
+    serviceId: raw.serviceId ?? "",
+    clientId: raw.clientId ?? "",
+    clientSecret: raw.clientSecret ?? "",
+    defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
+  };
+}
+
+// src/storage/localStorage.ts
+var STORAGE_KEY = "authmi_token";
+var LocalStorageTokenStorage = class {
+  canAccess() {
+    if (typeof window === "undefined") return false;
+    try {
+      const probe = "__authmi_storage_test__";
+      localStorage.setItem(probe, "1");
+      localStorage.removeItem(probe);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  getToken() {
+    if (!this.canAccess()) return null;
+    try {
+      return localStorage.getItem(STORAGE_KEY);
+    } catch {
+      return null;
+    }
+  }
+  setToken(token) {
+    if (!this.canAccess()) return;
+    try {
+      localStorage.setItem(STORAGE_KEY, token);
+    } catch {
+    }
+  }
+  removeToken() {
+    if (!this.canAccess()) return;
+    try {
+      localStorage.removeItem(STORAGE_KEY);
+    } catch {
+    }
+  }
+};
+
 // src/types.ts
 var AuthMiError = class extends Error {
   constructor(message, code, statusCode) {
@@ -46,82 +99,38 @@ var ScopeError = class extends AuthMiError {
     this.name = "ScopeError";
   }
 };
-var _LocalStorageTokenStorage = class _LocalStorageTokenStorage {
-  getToken() {
-    if (typeof window === "undefined") return null;
-    return localStorage.getItem(_LocalStorageTokenStorage.KEY);
-  }
-  setToken(token) {
-    if (typeof window === "undefined") return;
-    localStorage.setItem(_LocalStorageTokenStorage.KEY, token);
-  }
-  removeToken() {
-    if (typeof window === "undefined") return;
-    localStorage.removeItem(_LocalStorageTokenStorage.KEY);
-  }
-};
-_LocalStorageTokenStorage.KEY = "authmi_token";
-var LocalStorageTokenStorage = _LocalStorageTokenStorage;
-var MemoryTokenStorage = class {
-  constructor() {
-    this.token = null;
-  }
-  getToken() {
-    return this.token;
-  }
-  setToken(token) {
-    this.token = token;
-  }
-  removeToken() {
-    this.token = null;
-  }
-};
 
 // src/client.ts
 var AuthMiClient = class {
-  constructor(config, tokenStorage) {
-    this.config = {
-      apiKey: "",
-      serviceId: "",
-      clientId: "",
-      clientSecret: "",
-      defaultTokenExpiry: 24,
-      ...config
-    };
-    this.tokenStorage = tokenStorage || new LocalStorageTokenStorage();
-  }
-  /** Build Basic auth header from clientId:clientSecret */
-  basicAuthHeader() {
-    if (this.config.clientId && this.config.clientSecret) {
-      const encoded = btoa(`${this.config.clientId}:${this.config.clientSecret}`);
-      return `Basic ${encoded}`;
-    }
-    return null;
-  }
-  // ============ HTTP Utilities ============
-  async request(endpoint, options = {}, requireAuth = false) {
-    const url = `${this.config.baseUrl}${endpoint}`;
+  constructor(config, options) {
+    this.configProvider = config;
+    this.storage = options?.storage ?? new LocalStorageTokenStorage();
+    this.cache = options?.cache || null;
+  }
+  /** Resolve current config (supports lazy evaluation) */
+  get config() {
+    return resolveConfig(this.configProvider);
+  }
+  // ============ HTTP plumbing ============
+  async request(endpoint, options = {}, requireUserToken = false) {
+    const cfg = this.config;
+    const url = `${cfg.baseUrl}${endpoint}`;
     const headers = {
       "Content-Type": "application/json",
       ...options.headers || {}
     };
-    const basic = this.basicAuthHeader();
-    if (basic && !requireAuth && !headers["Authorization"]) {
-      headers["Authorization"] = basic;
-    } else if (this.config.apiKey && !requireAuth && !headers["Authorization"]) {
-      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
-    }
-    if (requireAuth) {
-      const token = this.getAccessToken();
-      if (token && !headers["Authorization"]) {
-        headers["Authorization"] = `Bearer ${token}`;
+    if (!headers["Authorization"]) {
+      if (requireUserToken) {
+        const token = await this.storage.getToken();
+        if (token) headers["Authorization"] = `Bearer ${token}`;
+      } else if (cfg.clientId && cfg.clientSecret) {
+        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
+      } else if (cfg.apiKey) {
+        headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
     }
     try {
-      const response = await fetch(url, {
-        ...options,
-        headers
-      });
+      const response = await fetch(url, { ...options, headers });
       const data = await response.json();
       if (!response.ok) {
         if (response.status === 403 && data.required && data.provided) {
@@ -139,9 +148,7 @@ var AuthMiClient = class {
       }
       return data;
     } catch (error) {
-      if (error instanceof AuthMiError) {
-        throw error;
-      }
+      if (error instanceof AuthMiError) throw error;
       throw new AuthMiError(
         error instanceof Error ? error.message : "Network error",
         "NETWORK_ERROR"
@@ -149,384 +156,497 @@ var AuthMiClient = class {
     }
   }
   // ============ Configuration ============
-  /**
-   * Update the client's service configuration
-   */
   configure(config) {
-    this.config = { ...this.config, ...config };
+    const current = resolveConfig(this.configProvider);
+    this.configProvider = { ...current, ...config };
   }
-  /**
-   * Get current configuration (without sensitive data)
-   */
   getConfig() {
-    const { apiKey: _, clientSecret: __, ...rest } = this.config;
+    const { apiKey: _, clientSecret: __, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
-  /**
-   * Get the stored access token
-   */
-  getAccessToken() {
-    return this.tokenStorage.getToken();
+  async getAccessToken() {
+    return this.storage.getToken();
   }
-  /**
-   * Store an access token
-   */
   setAccessToken(token) {
-    this.tokenStorage.setToken(token);
+    this.storage.setToken(token);
   }
-  /**
-   * Remove the stored access token (logout)
-   */
   clearAccessToken() {
-    this.tokenStorage.removeToken();
+    this.storage.removeToken();
   }
-  /**
-   * Check if user is logged in
-   */
-  isLoggedIn() {
-    return !!this.getAccessToken();
+  async isLoggedIn() {
+    const token = await this.storage.getToken();
+    return !!token;
   }
-  // ============ Scope Validation ============
-  /**
-   * Introspect a token or API key and validate required scopes
-   */
-  async introspect(request) {
-    return this.request("/api/v1/introspect", {
+  // ============ Auth Endpoints ============
+  async signup(credentials) {
+    const response = await this.request("/api/v1/auth/signup", {
       method: "POST",
-      body: JSON.stringify(request)
+      body: JSON.stringify(credentials)
     });
+    return this.mapAuthToken(response);
   }
-  /**
-   * Validate the current token with optional scope checking
-   */
-  async validateWithScopes(requiredScopes) {
-    const token = this.getAccessToken();
-    if (!token) {
-      return { valid: false, error: "No token provided" };
-    }
-    if (!this.config.apiKey && !this.config.clientSecret) {
-      return { valid: false, error: "Service credentials not configured" };
-    }
-    if (!this.config.serviceId) {
-      return { valid: false, error: "Service ID not configured in AuthMiConfig" };
-    }
-    try {
-      const result = await this.introspect({
-        serviceId: this.config.serviceId,
-        token,
-        requiredScopes
-      });
-      return {
-        valid: result.valid,
-        type: result.type === "bearer" ? "token" : "api_key",
-        scopes: result.scopes,
-        userId: result.userId,
-        email: result.email,
-        error: result.error
-      };
-    } catch (error) {
-      if (error instanceof ScopeError) {
-        return {
-          valid: false,
-          error: error.message,
-          scopes: error.providedScopes
-        };
-      }
-      if (error instanceof AuthMiError && error.statusCode === 401) {
-        return { valid: false, error: "Invalid or expired token" };
-      }
-      throw error;
-    }
-  }
-  /**
-   * Check if the current user has all the required scopes
-   * Throws ScopeError if scopes are insufficient
-   */
-  async requireScopes(...requiredScopes) {
-    const result = await this.validateWithScopes(requiredScopes);
-    if (!result.valid) {
-      throw new AuthMiError(
-        result.error || "Authentication required",
-        "UNAUTHORIZED",
-        401
-      );
-    }
-    const hasScopes = requiredScopes.every(
-      (scope) => result.scopes?.includes(scope)
-    );
-    if (!hasScopes) {
-      throw new ScopeError(
-        `Required scopes: ${requiredScopes.join(", ")}`,
-        requiredScopes,
-        result.scopes || []
-      );
-    }
-    return result;
-  }
-  /**
-   * Execute a function only if the user has the required scopes
-   */
-  async withScope(scopes, fn) {
-    await this.requireScopes(...scopes);
-    return fn();
-  }
-  // ============ OAuth ============
-  /**
-   * Initiate OAuth login flow and return the authorization URL
-   */
-  async initiateOAuth(provider, redirectUri) {
-    if (!this.config.apiKey && !this.config.clientSecret) {
-      throw new AuthMiError(
-        "API key or client credentials required for OAuth. Configure the client first.",
-        "MISSING_CREDENTIALS"
-      );
-    }
-    if (!this.config.serviceId) {
-      throw new AuthMiError(
-        "serviceId required for OAuth. Configure the client first.",
-        "MISSING_SERVICE_ID"
-      );
-    }
-    const response = await this.request(
-      "/api/v1/auth/oauth/initiate",
-      {
-        method: "POST",
-        body: JSON.stringify({ provider, redirectUri, client_id: this.config.serviceId })
-      }
-    );
-    return response.url;
-  }
-  /**
-   * Handle OAuth callback URL and store the access token
-   * Returns null if no OAuth params are present in the URL
-   */
-  handleOAuthCallback(url) {
-    const parsedUrl = typeof url === "string" ? new URL(url) : url;
-    const token = parsedUrl.searchParams.get("token");
-    const userId = parsedUrl.searchParams.get("user_id");
-    const email = parsedUrl.searchParams.get("email");
-    if (!token || !userId || !email) {
-      return null;
-    }
-    this.setAccessToken(token);
-    return { token, userId, email };
-  }
-  /**
-   * Check if the current URL contains OAuth callback params
-   */
-  isOAuthCallback(url) {
-    const parsedUrl = typeof url === "string" ? new URL(url) : url;
-    return parsedUrl.searchParams.has("token") && parsedUrl.searchParams.has("user_id") && parsedUrl.searchParams.has("email");
-  }
-  // ============ Authentication ============
-  /**
-   * Login a user and store the access token
-   */
   async login(credentials) {
-    if (!this.config.apiKey && !this.config.clientSecret) {
-      throw new AuthMiError(
-        "API key or client credentials required for login. Configure the client first.",
-        "MISSING_CREDENTIALS"
-      );
-    }
+    const cfg = this.config;
     const response = await this.request("/api/v1/auth/login", {
       method: "POST",
       body: JSON.stringify({
         email: credentials.email,
         password: credentials.password,
-        client_id: this.config.serviceId,
-        expires_in_hours: credentials.expiresInHours || this.config.defaultTokenExpiry,
+        client_id: cfg.serviceId,
+        expires_in_hours: credentials.expiresInHours || cfg.defaultTokenExpiry,
         scopes: credentials.scopes
       })
     });
-    const token = {
-      accessToken: response.access_token,
-      tokenType: response.token_type,
-      expiresIn: response.expires_in,
-      expiresAt: response.expires_at,
-      userId: response.user_id,
-      email: response.email,
-      scopes: response.scopes
-    };
+    const token = this.mapAuthToken(response);
     this.setAccessToken(token.accessToken);
     return token;
   }
-  /**
-   * Logout the current user
-   */
   async logout() {
-    const token = this.getAccessToken();
+    const token = await this.storage.getToken();
     if (token) {
       try {
-        await this.request("/api/v1/auth/logout", {
-          method: "POST"
-        }, true);
-      } catch (error) {
+        await this.request("/api/v1/auth/logout", { method: "POST" }, true);
+      } catch {
       }
     }
     this.clearAccessToken();
   }
-  /**
-   * Validate the current token or an API key
-   * @deprecated Use validateWithScopes instead
-   */
-  async validate(_credential) {
-    return this.validateWithScopes();
-  }
-  /**
-   * Refresh the current token
-   */
   async refreshToken() {
-    const response = await this.request("/api/v1/auth/refresh", {
-      method: "POST"
-    }, true);
+    const response = await this.request("/api/v1/auth/refresh", { method: "POST" }, true);
     const token = {
       accessToken: response.access_token,
-      tokenType: response.token_type,
+      tokenType: "Bearer",
       expiresIn: response.expires_in,
       expiresAt: response.expires_at,
       userId: "",
-      // Refresh doesn't return user info
       email: ""
     };
     this.setAccessToken(token.accessToken);
     return token;
   }
-  // ============ User Management ============
-  /**
-   * Create a new user (requires admin API key)
-   */
-  async createUser(request) {
-    const response = await this.request("/api/v1/users/create", {
+  async getMe() {
+    const response = await this.request("/api/v1/auth/me");
+    return { userId: response.user_id, email: response.email, name: response.name, createdAt: response.created_at };
+  }
+  async forgotPassword(request) {
+    return this.request("/api/v1/auth/forgot-password", {
       method: "POST",
-      body: JSON.stringify(request)
+      body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
+    });
+  }
+  async resetPassword(request) {
+    return this.request("/api/v1/auth/reset-password", {
+      method: "POST",
+      body: JSON.stringify({ token: request.token, new_password: request.newPassword })
+    });
+  }
+  async verifyEmail(request) {
+    return this.request("/api/v1/auth/verify-email", {
+      method: "POST",
+      body: JSON.stringify({ token: request.token })
+    });
+  }
+  async resendVerification(request) {
+    return this.request("/api/v1/auth/resend-verification", {
+      method: "POST",
+      body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
     });
+  }
+  async deactivateAccount(password) {
+    await this.request("/api/v1/auth/deactivate", {
+      method: "POST",
+      body: JSON.stringify({ password })
+    });
+  }
+  mapAuthToken(raw) {
     return {
-      userId: response.user_id,
-      email: response.email,
-      createdAt: response.created_at
+      accessToken: raw.access_token,
+      tokenType: raw.token_type,
+      expiresIn: raw.expires_in,
+      expiresAt: raw.expires_at,
+      userId: raw.user_id,
+      email: raw.email,
+      emailVerified: raw.email_verified,
+      scopes: raw.scopes
     };
   }
-  /**
-   * List all users for the service
-   */
+  // ============ OAuth ============
+  async initiateOAuth(provider, redirectUri) {
+    const cfg = this.config;
+    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+      throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
+    }
+    const response = await this.request("/api/v1/auth/oauth/initiate", {
+      method: "POST",
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
+    });
+    return response.url;
+  }
+  handleOAuthCallback(url) {
+    const parsed = typeof url === "string" ? new URL(url) : url;
+    const token = parsed.searchParams.get("token");
+    const userId = parsed.searchParams.get("user_id");
+    const email = parsed.searchParams.get("email");
+    if (!token || !userId || !email) return null;
+    this.setAccessToken(token);
+    return { token, userId, email };
+  }
+  isOAuthCallback(url) {
+    const parsed = typeof url === "string" ? new URL(url) : url;
+    return !!(parsed.searchParams.has("token") && parsed.searchParams.has("user_id") && parsed.searchParams.has("email"));
+  }
+  // ============ SAML ============
+  async initiateSaml(request) {
+    return this.request("/api/v1/auth/saml/initiate", {
+      method: "POST",
+      body: JSON.stringify({ email: request.email, redirect_uri: request.redirectUri })
+    });
+  }
+  async parseSamlMetadata(xml) {
+    return this.request("/api/v1/auth/saml/parse-metadata", {
+      method: "POST",
+      body: JSON.stringify({ metadata_xml: xml })
+    });
+  }
+  async listSamlConnections() {
+    const response = await this.request("/api/v1/auth/saml/connections");
+    return response.connections;
+  }
+  async createSamlConnection(request) {
+    return this.request("/api/v1/auth/saml/connections", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+  }
+  async deleteSamlConnection(id) {
+    await this.request(`/api/v1/auth/saml/connections/${encodeURIComponent(id)}`, {
+      method: "DELETE"
+    });
+  }
+  // ============ 2FA ============
+  async setup2fa() {
+    return this.request("/api/v1/auth/2fa/setup", { method: "POST" });
+  }
+  async enable2fa(code) {
+    return this.request("/api/v1/auth/2fa/enable", {
+      method: "POST",
+      body: JSON.stringify({ code })
+    });
+  }
+  async disable2fa(password) {
+    await this.request("/api/v1/auth/2fa/disable", {
+      method: "POST",
+      body: JSON.stringify({ password })
+    });
+  }
+  async regenerateBackupCodes() {
+    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" });
+  }
+  async challenge2fa(request) {
+    return this.request("/api/v1/auth/2fa/challenge", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+  }
+  // ============ Users ============
+  async createUser(request) {
+    const response = await this.request(
+      "/api/v1/users/create",
+      {
+        method: "POST",
+        body: JSON.stringify(request)
+      }
+    );
+    return { userId: response.user_id, email: response.email, name: response.name, createdAt: response.created_at };
+  }
   async listUsers() {
     const response = await this.request("/api/v1/users/list");
     return response.users.map((u) => ({
       userId: u.user_id,
       email: u.email,
+      name: u.name,
       createdAt: u.created_at
     }));
   }
-  /**
-   * Delete a user
-   */
+  async getUser(userId) {
+    const response = await this.request(
+      `/api/v1/users/${encodeURIComponent(userId)}`
+    );
+    return { userId: response.user_id, email: response.email, name: response.name, createdAt: response.created_at };
+  }
   async deleteUser(userId) {
     await this.request("/api/v1/users/delete", {
       method: "POST",
       body: JSON.stringify({ user_id: userId })
     });
   }
-  /**
-   * Update user password
-   */
+  async deleteUserById(userId) {
+    await this.request(`/api/v1/users/${encodeURIComponent(userId)}`, { method: "DELETE" });
+  }
   async updatePassword(userId, oldPassword, newPassword) {
     await this.request("/api/v1/users/password", {
       method: "POST",
-      body: JSON.stringify({
-        user_id: userId,
-        old_password: oldPassword,
-        new_password: newPassword
-      })
+      body: JSON.stringify({ user_id: userId, old_password: oldPassword, new_password: newPassword })
     });
   }
-  // ============ Scope Management ============
-  /**
-   * List custom scopes for the service
-   */
-  async listScopes() {
-    const response = await this.request("/api/v1/scopes/list");
-    return response.scopes;
+  // ============ Roles ============
+  async createRole(request) {
+    const response = await this.request(
+      "/api/v1/users/roles/create",
+      { method: "POST", body: JSON.stringify(request) }
+    );
+    return { roleId: response.role_id, name: response.name, description: response.description, createdAt: response.created_at };
+  }
+  async listRoles() {
+    const response = await this.request("/api/v1/users/roles/list");
+    return response.roles.map((r) => ({
+      roleId: r.role_id,
+      name: r.name,
+      description: r.description,
+      createdAt: r.created_at
+    }));
   }
-  /**
-   * Create a custom scope
-   */
-  async createScope(request) {
-    const response = await this.request("/api/v1/scopes/create", {
+  async deleteRole(roleId) {
+    await this.request(`/api/v1/users/roles/${encodeURIComponent(roleId)}`, { method: "DELETE" });
+  }
+  async assignRole(userId, roleId) {
+    await this.request("/api/v1/users/roles/assign", {
       method: "POST",
-      body: JSON.stringify(request)
+      body: JSON.stringify({ user_id: userId, role_id: roleId })
     });
-    return {
-      scopeId: response.scope_id,
-      name: response.name,
-      key: response.key,
-      description: response.description,
-      createdAt: response.created_at
-    };
   }
-  /**
-   * Delete a custom scope
-   */
-  async deleteScope(scopeId) {
-    await this.request("/api/v1/scopes/delete", {
+  async unassignRole(userId, roleId) {
+    await this.request("/api/v1/users/roles/unassign", {
       method: "POST",
-      body: JSON.stringify({ scope_id: scopeId })
+      body: JSON.stringify({ user_id: userId, role_id: roleId })
     });
   }
-  // ============ API Key Management ============
-  /**
-   * List all API keys for the service
-   */
+  async getUserRoles(userId) {
+    const response = await this.request(
+      `/api/v1/users/${encodeURIComponent(userId)}/roles`
+    );
+    return response.roles.map((r) => ({
+      roleId: r.role_id,
+      name: r.name,
+      description: r.description,
+      createdAt: r.created_at
+    }));
+  }
+  // ============ API Keys ============
   async listApiKeys() {
     const response = await this.request("/api/v1/keys/list");
     return response.keys.map((k) => ({
       keyId: k.keyId,
       name: k.name,
       scope: k.scope,
-      scopes: [],
+      scopes: k.scopes,
       keyType: k.keyType,
+      tpsLimit: k.tpsLimit,
       revoked: k.revoked,
-      createdAt: k.createdAt,
-      tpsLimit: k.tpsLimit
+      createdAt: k.createdAt
     }));
   }
-  /**
-   * Create a new API key with optional custom scopes
-   */
   async createApiKey(request) {
-    const response = await this.request("/api/v1/keys/create", {
+    const response = await this.request(
+      "/api/v1/keys/create",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          user_id: request.userId,
+          name: request.name,
+          scope: request.scope || "service",
+          scopes: request.scopes,
+          key_type: request.keyType || "service",
+          tps_limit: request.tpsLimit || 100
+        })
+      }
+    );
+    return { keyId: response.key_id, apiKey: response.api_key, name: response.name, scope: response.scope, scopes: response.scopes };
+  }
+  async revokeApiKey(keyId) {
+    await this.request("/api/v1/keys/revoke", {
+      method: "POST",
+      body: JSON.stringify({ key_id: keyId })
+    });
+  }
+  // ============ Scopes ============
+  async listScopes() {
+    const response = await this.request("/api/v1/scopes/list");
+    return response.scopes;
+  }
+  async createScope(request) {
+    const response = await this.request(
+      "/api/v1/scopes/create",
+      { method: "POST", body: JSON.stringify(request) }
+    );
+    return { scopeId: response.scope_id, name: response.name, key: response.key, description: response.description, createdAt: response.created_at };
+  }
+  async deleteScope(scopeId) {
+    await this.request("/api/v1/scopes/delete", {
+      method: "POST",
+      body: JSON.stringify({ scope_id: scopeId })
+    });
+  }
+  // ============ Introspection & Validation ============
+  async introspect(request) {
+    if (this.cache && request.token) {
+      const cached = this.cache.get(request.token);
+      if (cached) return cached;
+    }
+    const result = await this.request("/api/v1/introspect", {
       method: "POST",
       body: JSON.stringify({
-        user_id: request.userId,
-        name: request.name,
-        scope: request.scope || "service",
-        scopes: request.scopes,
-        key_type: request.keyType || "service",
-        tps_limit: request.tpsLimit || 100
+        serviceId: request.serviceId,
+        token: request.token,
+        apiKey: request.apiKey,
+        requiredScopes: request.requiredScopes
       })
     });
-    return {
-      keyId: response.key_id,
-      apiKey: response.api_key,
-      name: response.name,
-      scope: response.scope,
-      scopes: response.scopes
-    };
+    if (this.cache && request.token) {
+      this.cache.set(request.token, result);
+    }
+    return result;
   }
-  /**
-   * Revoke an API key
-   */
-  async revokeApiKey(keyId) {
-    await this.request("/api/v1/keys/revoke", {
+  async validate() {
+    const cfg = this.config;
+    const token = await this.storage.getToken();
+    if (!token) return { valid: false, error: "No token stored" };
+    if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
+    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    try {
+      const result = await this.introspect({ serviceId: cfg.serviceId, token });
+      return {
+        valid: result.valid,
+        type: result.type === "bearer" ? "token" : "api_key",
+        scopes: result.scopes,
+        userId: result.userId,
+        email: result.email,
+        error: result.error
+      };
+    } catch (error) {
+      if (error instanceof ScopeError) {
+        return { valid: false, error: error.message, scopes: error.providedScopes };
+      }
+      if (error instanceof AuthMiError && error.statusCode === 401) {
+        return { valid: false, error: "Invalid or expired token" };
+      }
+      throw error;
+    }
+  }
+  async validateWithScopes(requiredScopes) {
+    const cfg = this.config;
+    const token = await this.storage.getToken();
+    if (!token) return { valid: false, error: "No token provided" };
+    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
+    try {
+      const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
+      return {
+        valid: result.valid,
+        type: result.type === "bearer" ? "token" : "api_key",
+        scopes: result.scopes,
+        userId: result.userId,
+        email: result.email,
+        error: result.error
+      };
+    } catch (error) {
+      if (error instanceof ScopeError) {
+        return { valid: false, error: error.message, scopes: error.providedScopes };
+      }
+      if (error instanceof AuthMiError && error.statusCode === 401) {
+        return { valid: false, error: "Invalid or expired token" };
+      }
+      throw error;
+    }
+  }
+  async requireScopes(...requiredScopes) {
+    const result = await this.validateWithScopes(requiredScopes);
+    if (!result.valid) {
+      throw new AuthMiError(result.error || "Authentication required", "UNAUTHORIZED", 401);
+    }
+    const hasScopes = requiredScopes.every((s) => result.scopes?.includes(s));
+    if (!hasScopes) {
+      throw new ScopeError(`Required: ${requiredScopes.join(", ")}`, requiredScopes, result.scopes || []);
+    }
+    return result;
+  }
+  async withScope(scopes, fn) {
+    await this.requireScopes(...scopes);
+    return fn();
+  }
+  // ============ Webhooks ============
+  async listWebhooks() {
+    const response = await this.request("/api/v1/webhooks/list");
+    return response.webhooks;
+  }
+  async registerWebhook(request) {
+    const response = await this.request(
+      "/api/v1/webhooks/register",
+      { method: "POST", body: JSON.stringify(request) }
+    );
+    return { webhookId: response.webhook_id, url: response.url, events: response.events, active: response.active, createdAt: response.created_at };
+  }
+  async deleteWebhook(webhookId) {
+    await this.request("/api/v1/webhooks/delete", {
       method: "POST",
-      body: JSON.stringify({ key_id: keyId })
+      body: JSON.stringify({ webhook_id: webhookId })
     });
   }
-  // ============ Service Management ============
-  /**
-   * Onboard a new service (requires master admin key)
-   */
+  // ============ Billing ============
+  async listPlans() {
+    const response = await this.request("/api/v1/billing/plans");
+    return response.plans;
+  }
+  async getSubscription() {
+    return this.request("/api/v1/billing/subscription");
+  }
+  async createCheckout(priceId) {
+    return this.request("/api/v1/billing/checkout", {
+      method: "POST",
+      body: JSON.stringify({ price_id: priceId })
+    });
+  }
+  async createPortalSession() {
+    return this.request("/api/v1/billing/portal", { method: "POST" });
+  }
+  // ============ Audit ============
+  async getAuditLogs(query) {
+    const params = new URLSearchParams();
+    if (query?.limit) params.set("limit", String(query.limit));
+    if (query?.offset) params.set("offset", String(query.offset));
+    if (query?.actorId) params.set("actor_id", query.actorId);
+    if (query?.action) params.set("action", query.action);
+    if (query?.resourceType) params.set("resource_type", query.resourceType);
+    if (query?.startDate) params.set("start_date", query.startDate);
+    if (query?.endDate) params.set("end_date", query.endDate);
+    const qs = params.toString();
+    const response = await this.request(
+      `/api/v1/audit-logs${qs ? `?${qs}` : ""}`
+    );
+    return response.logs;
+  }
+  // ============ Services ============
+  async getService(serviceId) {
+    return this.request(`/api/v1/services/${encodeURIComponent(serviceId)}`);
+  }
+  async updateService(serviceId, data) {
+    return this.request(`/api/v1/services/${encodeURIComponent(serviceId)}`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async rotateClientSecret(serviceId) {
+    return this.request(
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
+      { method: "POST" }
+    );
+  }
+  // ============ JWKS ============
+  async getJwks(serviceId) {
+    return this.request(`/.well-known/jwks.json?service_id=${encodeURIComponent(serviceId)}`);
+  }
+  // ============ Onboarding (admin only) ============
   async onboardService(request, masterAdminKey) {
     const response = await this.request("/api/v1/services/onboard", {
       method: "POST",
@@ -547,9 +667,6 @@ var AuthMiClient = class {
       createdAt: response.created_at
     };
   }
-  /**
-   * Delete a service (requires master admin key)
-   */
   async deleteService(serviceId, masterAdminKey) {
     await this.request("/api/v1/services/deboard", {
       method: "POST",
@@ -559,49 +676,127 @@ var AuthMiClient = class {
       body: JSON.stringify({ service_id: serviceId })
     });
   }
-  // ============ Webhook Management ============
-  /**
-   * List webhooks
-   */
-  async listWebhooks() {
-    const response = await this.request(
-      "/api/v1/webhooks/list"
+};
+
+// src/storage/cookie.ts
+var CookieTokenStorage = class _CookieTokenStorage {
+  /**
+   * @param cookieStr  The raw `Cookie` header value (server-side) or `document.cookie` (browser).
+   *                   Pass an empty string in environments where cookies are managed via Set-Cookie.
+   */
+  constructor(cookieStr = "", options = {}) {
+    this.cookieStr = cookieStr;
+    this.options = {
+      name: "authmi_token",
+      httpOnly: true,
+      secure: typeof process !== "undefined" && process.env?.NODE_ENV === "production",
+      sameSite: "lax",
+      domain: "",
+      path: "/",
+      maxAge: 86400,
+      ...options
+    };
+  }
+  /** Update the raw cookie string (e.g. per-request in server middleware) */
+  setCookieString(cookieStr) {
+    this.cookieStr = cookieStr;
+  }
+  /** Escape special regex characters in a string */
+  static escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }
+  getToken() {
+    const name = _CookieTokenStorage.escapeRegex(this.options.name);
+    const match = this.cookieStr.match(
+      new RegExp(`(?:^|;\\s*)${name}=([^;]*)`)
     );
-    return response.webhooks;
+    return match ? decodeURIComponent(match[1]) : null;
   }
-  /**
-   * Register a webhook
-   */
-  async registerWebhook(request) {
-    const response = await this.request("/api/v1/webhooks/register", {
-      method: "POST",
-      body: JSON.stringify(request)
-    });
-    return {
-      webhookId: response.webhook_id,
-      url: response.url,
-      events: response.events,
-      active: response.active,
-      createdAt: response.created_at
-    };
+  setToken(token) {
+    const { name, httpOnly, secure, sameSite, domain, path, maxAge } = this.options;
+    let cookie = `${name}=${encodeURIComponent(token)}; path=${path}; max-age=${maxAge}`;
+    if (httpOnly) cookie += "; HttpOnly";
+    if (secure) cookie += "; Secure";
+    if (sameSite) cookie += `; SameSite=${sameSite}`;
+    if (domain) cookie += `; domain=${domain}`;
+    this.lastSetCookie = cookie;
+    this.cookieStr = `${name}=${encodeURIComponent(token)}`;
+  }
+  /** The last Set-Cookie header generated by setToken() or removeToken() */
+  getSetCookieHeader() {
+    return this.lastSetCookie;
   }
-  /**
-   * Delete a webhook
-   */
-  async deleteWebhook(webhookId) {
-    await this.request("/api/v1/webhooks/delete", {
-      method: "POST",
-      body: JSON.stringify({ webhook_id: webhookId })
+  removeToken() {
+    const { name, domain, path } = this.options;
+    let cookie = `${name}=; path=${path}; max-age=0`;
+    if (domain) cookie += `; domain=${domain}`;
+    this.lastSetCookie = cookie;
+    this.cookieStr = "";
+  }
+};
+
+// src/storage/memory.ts
+var MemoryTokenStorage = class {
+  constructor() {
+    this.token = null;
+  }
+  getToken() {
+    return this.token;
+  }
+  setToken(token) {
+    this.token = token;
+  }
+  removeToken() {
+    this.token = null;
+  }
+};
+
+// src/cache.ts
+var IntrospectCache = class {
+  constructor(ttlMs = 6e4) {
+    this.store = /* @__PURE__ */ new Map();
+    this.defaultTtlMs = ttlMs;
+  }
+  /** Build a cache key from the token (simple hash) */
+  key(token) {
+    let hash = 0;
+    for (let i = 0; i < token.length; i++) {
+      hash = hash * 31 + token.charCodeAt(i) | 0;
+    }
+    return `tok:${hash.toString(36)}`;
+  }
+  get(token) {
+    const entry = this.store.get(this.key(token));
+    if (!entry) return void 0;
+    if (Date.now() > entry.expiresAt) {
+      this.store.delete(this.key(token));
+      return void 0;
+    }
+    return entry.result;
+  }
+  set(token, result, ttlMs) {
+    if (!result.valid) return;
+    this.store.set(this.key(token), {
+      result,
+      expiresAt: Date.now() + (ttlMs ?? this.defaultTtlMs)
     });
   }
+  invalidate(token) {
+    this.store.delete(this.key(token));
+  }
+  clear() {
+    this.store.clear();
+  }
 };
 
 // src/index.ts
-var VERSION = "1.0.0";
+var VERSION = "1.1.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthMiClient,
   AuthMiError,
+  CookieTokenStorage,
+  IntrospectCache,
   LocalStorageTokenStorage,
   MemoryTokenStorage,
   ScopeError,