authmi 1.0.0 → 1.2.0

package/dist/react.js

@@ -23,9 +23,7 @@ __export(react_exports, {
   AuthMiClient: () => AuthMiClient,
   AuthMiError: () => AuthMiError,
   AuthMiProvider: () => AuthMiProvider,
-  LocalStorageTokenStorage: () => LocalStorageTokenStorage,
   LoginForm: () => LoginForm,
-  MemoryTokenStorage: () => MemoryTokenStorage,
   Protected: () => Protected,
   ScopeError: () => ScopeError,
   useAuthActions: () => useAuthActions,
@@ -37,39 +35,58 @@ __export(react_exports, {
 module.exports = __toCommonJS(react_exports);
 var import_react = require("react");
 
-// src/types.ts
-var AuthMiError = class extends Error {
-  constructor(message, code, statusCode) {
-    super(message);
-    this.code = code;
-    this.statusCode = statusCode;
-    this.name = "AuthMiError";
-  }
-};
-var ScopeError = class extends AuthMiError {
-  constructor(message, requiredScopes, providedScopes) {
-    super(message, "INSUFFICIENT_SCOPES", 403);
-    this.requiredScopes = requiredScopes;
-    this.providedScopes = providedScopes;
-    this.name = "ScopeError";
+// src/config.ts
+function resolveConfig(provider) {
+  const raw = typeof provider === "function" ? provider() : provider;
+  return {
+    baseUrl: raw.baseUrl,
+    apiKey: raw.apiKey ?? "",
+    serviceId: raw.serviceId ?? "",
+    clientId: raw.clientId ?? "",
+    clientSecret: raw.clientSecret ?? "",
+    defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
+  };
+}
+
+// src/storage/localStorage.ts
+var STORAGE_KEY = "authmi_token";
+var LocalStorageTokenStorage = class {
+  canAccess() {
+    if (typeof window === "undefined") return false;
+    try {
+      const probe = "__authmi_storage_test__";
+      localStorage.setItem(probe, "1");
+      localStorage.removeItem(probe);
+      return true;
+    } catch {
+      return false;
+    }
   }
-};
-var _LocalStorageTokenStorage = class _LocalStorageTokenStorage {
   getToken() {
-    if (typeof window === "undefined") return null;
-    return localStorage.getItem(_LocalStorageTokenStorage.KEY);
+    if (!this.canAccess()) return null;
+    try {
+      return localStorage.getItem(STORAGE_KEY);
+    } catch {
+      return null;
+    }
   }
   setToken(token) {
-    if (typeof window === "undefined") return;
-    localStorage.setItem(_LocalStorageTokenStorage.KEY, token);
+    if (!this.canAccess()) return;
+    try {
+      localStorage.setItem(STORAGE_KEY, token);
+    } catch {
+    }
   }
   removeToken() {
-    if (typeof window === "undefined") return;
-    localStorage.removeItem(_LocalStorageTokenStorage.KEY);
+    if (!this.canAccess()) return;
+    try {
+      localStorage.removeItem(STORAGE_KEY);
+    } catch {
+    }
   }
 };
-_LocalStorageTokenStorage.KEY = "authmi_token";
-var LocalStorageTokenStorage = _LocalStorageTokenStorage;
+
+// src/storage/memory.ts
 var MemoryTokenStorage = class {
   constructor() {
     this.token = null;
@@ -85,51 +102,56 @@ var MemoryTokenStorage = class {
   }
 };
 
-// src/client.ts
-var AuthMiClient = class {
-  constructor(config, tokenStorage) {
-    this.config = {
-      apiKey: "",
-      serviceId: "",
-      clientId: "",
-      clientSecret: "",
-      defaultTokenExpiry: 24,
-      ...config
-    };
-    this.tokenStorage = tokenStorage || new LocalStorageTokenStorage();
+// src/types.ts
+var AuthMiError = class extends Error {
+  constructor(message, code, statusCode) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "AuthMiError";
   }
-  /** Build Basic auth header from clientId:clientSecret */
-  basicAuthHeader() {
-    if (this.config.clientId && this.config.clientSecret) {
-      const encoded = btoa(`${this.config.clientId}:${this.config.clientSecret}`);
-      return `Basic ${encoded}`;
-    }
-    return null;
+};
+var ScopeError = class extends AuthMiError {
+  constructor(message, requiredScopes, providedScopes) {
+    super(message, "INSUFFICIENT_SCOPES", 403);
+    this.requiredScopes = requiredScopes;
+    this.providedScopes = providedScopes;
+    this.name = "ScopeError";
   }
-  // ============ HTTP Utilities ============
-  async request(endpoint, options = {}, requireAuth = false) {
-    const url = `${this.config.baseUrl}${endpoint}`;
+};
+
+// src/client.ts
+var AuthMiClient = class {
+  constructor(config, options) {
+    this.configProvider = config;
+    this.storage = options?.storage ?? (typeof window !== "undefined" ? new LocalStorageTokenStorage() : new MemoryTokenStorage());
+    this.cache = options?.cache || null;
+  }
+  /** Resolve current config (supports lazy evaluation) */
+  get config() {
+    return resolveConfig(this.configProvider);
+  }
+  // ============ HTTP plumbing ============
+  async request(endpoint, options = {}, requireUserToken = false, requireServiceAuth = true) {
+    const cfg = this.config;
+    const url = `${cfg.baseUrl}${endpoint}`;
     const headers = {
       "Content-Type": "application/json",
       ...options.headers || {}
     };
-    const basic = this.basicAuthHeader();
-    if (basic && !requireAuth && !headers["Authorization"]) {
-      headers["Authorization"] = basic;
-    } else if (this.config.apiKey && !requireAuth && !headers["Authorization"]) {
-      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
-    }
-    if (requireAuth) {
-      const token = this.getAccessToken();
-      if (token && !headers["Authorization"]) {
-        headers["Authorization"] = `Bearer ${token}`;
+    if (!headers["Authorization"]) {
+      if (requireUserToken) {
+        const token = await this.storage.getToken();
+        if (token) headers["Authorization"] = `Bearer ${token}`;
+      } else if (requireServiceAuth && cfg.clientId && cfg.clientSecret) {
+        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
+        headers["X-Service-ID"] = cfg.serviceId || cfg.clientId;
+      } else if (requireServiceAuth && cfg.apiKey) {
+        headers["Authorization"] = `Bearer ${cfg.apiKey}`;
       }
     }
     try {
-      const response = await fetch(url, {
-        ...options,
-        headers
-      });
+      const response = await fetch(url, { ...options, headers });
       const data = await response.json();
       if (!response.ok) {
         if (response.status === 403 && data.required && data.provided) {
@@ -147,9 +169,7 @@ var AuthMiClient = class {
       }
       return data;
     } catch (error) {
-      if (error instanceof AuthMiError) {
-        throw error;
-      }
+      if (error instanceof AuthMiError) throw error;
       throw new AuthMiError(
         error instanceof Error ? error.message : "Network error",
         "NETWORK_ERROR"
@@ -157,384 +177,497 @@ var AuthMiClient = class {
     }
   }
   // ============ Configuration ============
-  /**
-   * Update the client's service configuration
-   */
   configure(config) {
-    this.config = { ...this.config, ...config };
+    const current = resolveConfig(this.configProvider);
+    this.configProvider = { ...current, ...config };
   }
-  /**
-   * Get current configuration (without sensitive data)
-   */
   getConfig() {
-    const { apiKey: _, clientSecret: __, ...rest } = this.config;
+    const { apiKey: _, clientSecret: __, ...rest } = resolveConfig(this.configProvider);
     return rest;
   }
   // ============ Token Management ============
-  /**
-   * Get the stored access token
-   */
-  getAccessToken() {
-    return this.tokenStorage.getToken();
-  }
-  /**
-   * Store an access token
-   */
+  async getAccessToken() {
+    return this.storage.getToken();
+  }
   setAccessToken(token) {
-    this.tokenStorage.setToken(token);
+    this.storage.setToken(token);
   }
-  /**
-   * Remove the stored access token (logout)
-   */
   clearAccessToken() {
-    this.tokenStorage.removeToken();
-  }
-  /**
-   * Check if user is logged in
-   */
-  isLoggedIn() {
-    return !!this.getAccessToken();
-  }
-  // ============ Scope Validation ============
-  /**
-   * Introspect a token or API key and validate required scopes
-   */
-  async introspect(request) {
-    return this.request("/api/v1/introspect", {
-      method: "POST",
-      body: JSON.stringify(request)
-    });
+    this.storage.removeToken();
   }
-  /**
-   * Validate the current token with optional scope checking
-   */
-  async validateWithScopes(requiredScopes) {
-    const token = this.getAccessToken();
-    if (!token) {
-      return { valid: false, error: "No token provided" };
-    }
-    if (!this.config.apiKey && !this.config.clientSecret) {
-      return { valid: false, error: "Service credentials not configured" };
-    }
-    if (!this.config.serviceId) {
-      return { valid: false, error: "Service ID not configured in AuthMiConfig" };
-    }
-    try {
-      const result = await this.introspect({
-        serviceId: this.config.serviceId,
-        token,
-        requiredScopes
-      });
-      return {
-        valid: result.valid,
-        type: result.type === "bearer" ? "token" : "api_key",
-        scopes: result.scopes,
-        userId: result.userId,
-        email: result.email,
-        error: result.error
-      };
-    } catch (error) {
-      if (error instanceof ScopeError) {
-        return {
-          valid: false,
-          error: error.message,
-          scopes: error.providedScopes
-        };
-      }
-      if (error instanceof AuthMiError && error.statusCode === 401) {
-        return { valid: false, error: "Invalid or expired token" };
-      }
-      throw error;
-    }
+  async isLoggedIn() {
+    const token = await this.storage.getToken();
+    return !!token;
   }
-  /**
-   * Check if the current user has all the required scopes
-   * Throws ScopeError if scopes are insufficient
-   */
-  async requireScopes(...requiredScopes) {
-    const result = await this.validateWithScopes(requiredScopes);
-    if (!result.valid) {
-      throw new AuthMiError(
-        result.error || "Authentication required",
-        "UNAUTHORIZED",
-        401
-      );
-    }
-    const hasScopes = requiredScopes.every(
-      (scope) => result.scopes?.includes(scope)
-    );
-    if (!hasScopes) {
-      throw new ScopeError(
-        `Required scopes: ${requiredScopes.join(", ")}`,
-        requiredScopes,
-        result.scopes || []
-      );
-    }
-    return result;
-  }
-  /**
-   * Execute a function only if the user has the required scopes
-   */
-  async withScope(scopes, fn) {
-    await this.requireScopes(...scopes);
-    return fn();
-  }
-  // ============ OAuth ============
-  /**
-   * Initiate OAuth login flow and return the authorization URL
-   */
-  async initiateOAuth(provider, redirectUri) {
-    if (!this.config.apiKey && !this.config.clientSecret) {
-      throw new AuthMiError(
-        "API key or client credentials required for OAuth. Configure the client first.",
-        "MISSING_CREDENTIALS"
-      );
-    }
-    if (!this.config.serviceId) {
-      throw new AuthMiError(
-        "serviceId required for OAuth. Configure the client first.",
-        "MISSING_SERVICE_ID"
-      );
-    }
-    const response = await this.request(
-      "/api/v1/auth/oauth/initiate",
-      {
-        method: "POST",
-        body: JSON.stringify({ provider, redirectUri, client_id: this.config.serviceId })
-      }
-    );
-    return response.url;
-  }
-  /**
-   * Handle OAuth callback URL and store the access token
-   * Returns null if no OAuth params are present in the URL
-   */
-  handleOAuthCallback(url) {
-    const parsedUrl = typeof url === "string" ? new URL(url) : url;
-    const token = parsedUrl.searchParams.get("token");
-    const userId = parsedUrl.searchParams.get("user_id");
-    const email = parsedUrl.searchParams.get("email");
-    if (!token || !userId || !email) {
-      return null;
-    }
-    this.setAccessToken(token);
-    return { token, userId, email };
-  }
-  /**
-   * Check if the current URL contains OAuth callback params
-   */
-  isOAuthCallback(url) {
-    const parsedUrl = typeof url === "string" ? new URL(url) : url;
-    return parsedUrl.searchParams.has("token") && parsedUrl.searchParams.has("user_id") && parsedUrl.searchParams.has("email");
+  // ============ Auth Endpoints ============
+  async signup(credentials) {
+    const response = await this.request("/api/v1/auth/signup", {
+      method: "POST",
+      body: JSON.stringify(credentials)
+    }, false, false);
+    return this.mapAuthToken(response);
   }
-  // ============ Authentication ============
-  /**
-   * Login a user and store the access token
-   */
   async login(credentials) {
-    if (!this.config.apiKey && !this.config.clientSecret) {
-      throw new AuthMiError(
-        "API key or client credentials required for login. Configure the client first.",
-        "MISSING_CREDENTIALS"
-      );
-    }
+    const cfg = this.config;
     const response = await this.request("/api/v1/auth/login", {
       method: "POST",
       body: JSON.stringify({
         email: credentials.email,
         password: credentials.password,
-        client_id: this.config.serviceId,
-        expires_in_hours: credentials.expiresInHours || this.config.defaultTokenExpiry,
+        client_id: cfg.serviceId,
+        expires_in_hours: credentials.expiresInHours || cfg.defaultTokenExpiry,
         scopes: credentials.scopes
       })
-    });
-    const token = {
-      accessToken: response.access_token,
-      tokenType: response.token_type,
-      expiresIn: response.expires_in,
-      expiresAt: response.expires_at,
-      userId: response.user_id,
-      email: response.email,
-      scopes: response.scopes
-    };
+    }, false, false);
+    const token = this.mapAuthToken(response);
     this.setAccessToken(token.accessToken);
     return token;
   }
-  /**
-   * Logout the current user
-   */
   async logout() {
-    const token = this.getAccessToken();
+    const token = await this.storage.getToken();
     if (token) {
       try {
-        await this.request("/api/v1/auth/logout", {
-          method: "POST"
-        }, true);
-      } catch (error) {
+        await this.request("/api/v1/auth/logout", { method: "POST" }, true);
+      } catch {
       }
     }
     this.clearAccessToken();
   }
-  /**
-   * Validate the current token or an API key
-   * @deprecated Use validateWithScopes instead
-   */
-  async validate(_credential) {
-    return this.validateWithScopes();
-  }
-  /**
-   * Refresh the current token
-   */
   async refreshToken() {
-    const response = await this.request("/api/v1/auth/refresh", {
-      method: "POST"
-    }, true);
+    const response = await this.request("/api/v1/auth/refresh", { method: "POST" }, true);
     const token = {
       accessToken: response.access_token,
-      tokenType: response.token_type,
+      tokenType: "Bearer",
       expiresIn: response.expires_in,
       expiresAt: response.expires_at,
       userId: "",
-      // Refresh doesn't return user info
       email: ""
     };
     this.setAccessToken(token.accessToken);
     return token;
   }
-  // ============ User Management ============
-  /**
-   * Create a new user (requires admin API key)
-   */
-  async createUser(request) {
-    const response = await this.request("/api/v1/users/create", {
+  async getMe() {
+    const response = await this.request("/api/v1/auth/me", {}, true);
+    return { userId: response.user_id, email: response.email, name: response.name, createdAt: response.created_at };
+  }
+  async forgotPassword(request) {
+    return this.request("/api/v1/auth/forgot-password", {
       method: "POST",
-      body: JSON.stringify(request)
-    });
+      body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
+    }, false, false);
+  }
+  async resetPassword(request) {
+    return this.request("/api/v1/auth/reset-password", {
+      method: "POST",
+      body: JSON.stringify({ token: request.token, new_password: request.newPassword })
+    }, false, false);
+  }
+  async verifyEmail(request) {
+    return this.request("/api/v1/auth/verify-email", {
+      method: "POST",
+      body: JSON.stringify({ token: request.token })
+    }, false, false);
+  }
+  async resendVerification(request) {
+    return this.request("/api/v1/auth/resend-verification", {
+      method: "POST",
+      body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
+    }, false, false);
+  }
+  async deactivateAccount(password) {
+    await this.request("/api/v1/auth/deactivate", {
+      method: "POST",
+      body: JSON.stringify({ password })
+    }, true, false);
+  }
+  mapAuthToken(raw) {
     return {
-      userId: response.user_id,
-      email: response.email,
-      createdAt: response.created_at
+      accessToken: raw.access_token,
+      tokenType: raw.token_type,
+      expiresIn: raw.expires_in,
+      expiresAt: raw.expires_at,
+      userId: raw.user_id,
+      email: raw.email,
+      emailVerified: raw.email_verified,
+      scopes: raw.scopes
     };
   }
-  /**
-   * List all users for the service
-   */
+  // ============ OAuth ============
+  async initiateOAuth(provider, redirectUri) {
+    const cfg = this.config;
+    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+      throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
+    }
+    const response = await this.request("/api/v1/auth/oauth/initiate", {
+      method: "POST",
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
+    }, false, false);
+    return response.url;
+  }
+  handleOAuthCallback(url) {
+    const parsed = typeof url === "string" ? new URL(url) : url;
+    const token = parsed.searchParams.get("token");
+    const userId = parsed.searchParams.get("user_id");
+    const email = parsed.searchParams.get("email");
+    if (!token || !userId || !email) return null;
+    this.setAccessToken(token);
+    return { token, userId, email };
+  }
+  isOAuthCallback(url) {
+    const parsed = typeof url === "string" ? new URL(url) : url;
+    return !!(parsed.searchParams.has("token") && parsed.searchParams.has("user_id") && parsed.searchParams.has("email"));
+  }
+  // ============ SAML ============
+  async initiateSaml(request) {
+    return this.request("/api/v1/auth/saml/initiate", {
+      method: "POST",
+      body: JSON.stringify({ email: request.email, redirect_uri: request.redirectUri })
+    }, false, false);
+  }
+  async parseSamlMetadata(xml) {
+    return this.request("/api/v1/auth/saml/parse-metadata", {
+      method: "POST",
+      body: JSON.stringify({ metadata_xml: xml })
+    }, false, false);
+  }
+  async listSamlConnections() {
+    const response = await this.request("/api/v1/auth/saml/connections");
+    return response.connections;
+  }
+  async createSamlConnection(request) {
+    return this.request("/api/v1/auth/saml/connections", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+  }
+  async deleteSamlConnection(id) {
+    await this.request(`/api/v1/auth/saml/connections/${encodeURIComponent(id)}`, {
+      method: "DELETE"
+    });
+  }
+  // ============ 2FA ============
+  async setup2fa() {
+    return this.request("/api/v1/auth/2fa/setup", { method: "POST" }, true, false);
+  }
+  async enable2fa(code) {
+    return this.request("/api/v1/auth/2fa/enable", {
+      method: "POST",
+      body: JSON.stringify({ code })
+    }, true, false);
+  }
+  async disable2fa(password) {
+    await this.request("/api/v1/auth/2fa/disable", {
+      method: "POST",
+      body: JSON.stringify({ password })
+    }, true, false);
+  }
+  async regenerateBackupCodes() {
+    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" }, true, false);
+  }
+  async challenge2fa(request) {
+    return this.request("/api/v1/auth/2fa/challenge", {
+      method: "POST",
+      body: JSON.stringify(request)
+    }, false, false);
+  }
+  // ============ Users ============
+  async createUser(request) {
+    const response = await this.request(
+      "/api/v1/users/create",
+      {
+        method: "POST",
+        body: JSON.stringify(request)
+      }
+    );
+    return { userId: response.user_id, email: response.email, name: response.name, createdAt: response.created_at };
+  }
   async listUsers() {
     const response = await this.request("/api/v1/users/list");
     return response.users.map((u) => ({
       userId: u.user_id,
       email: u.email,
+      name: u.name,
       createdAt: u.created_at
     }));
   }
-  /**
-   * Delete a user
-   */
+  async getUser(userId) {
+    const response = await this.request(
+      `/api/v1/users/${encodeURIComponent(userId)}`
+    );
+    return { userId: response.user_id, email: response.email, name: response.name, createdAt: response.created_at };
+  }
   async deleteUser(userId) {
     await this.request("/api/v1/users/delete", {
       method: "POST",
       body: JSON.stringify({ user_id: userId })
     });
   }
-  /**
-   * Update user password
-   */
+  async deleteUserById(userId) {
+    await this.request(`/api/v1/users/${encodeURIComponent(userId)}`, { method: "DELETE" });
+  }
   async updatePassword(userId, oldPassword, newPassword) {
     await this.request("/api/v1/users/password", {
       method: "POST",
-      body: JSON.stringify({
-        user_id: userId,
-        old_password: oldPassword,
-        new_password: newPassword
-      })
+      body: JSON.stringify({ user_id: userId, old_password: oldPassword, new_password: newPassword })
     });
   }
-  // ============ Scope Management ============
-  /**
-   * List custom scopes for the service
-   */
-  async listScopes() {
-    const response = await this.request("/api/v1/scopes/list");
-    return response.scopes;
+  // ============ Roles ============
+  async createRole(request) {
+    const response = await this.request(
+      "/api/v1/users/roles/create",
+      { method: "POST", body: JSON.stringify(request) }
+    );
+    return { roleId: response.role_id, name: response.name, description: response.description, createdAt: response.created_at };
+  }
+  async listRoles() {
+    const response = await this.request("/api/v1/users/roles/list");
+    return response.roles.map((r) => ({
+      roleId: r.role_id,
+      name: r.name,
+      description: r.description,
+      createdAt: r.created_at
+    }));
   }
-  /**
-   * Create a custom scope
-   */
-  async createScope(request) {
-    const response = await this.request("/api/v1/scopes/create", {
+  async deleteRole(roleId) {
+    await this.request(`/api/v1/users/roles/${encodeURIComponent(roleId)}`, { method: "DELETE" });
+  }
+  async assignRole(userId, roleId) {
+    await this.request("/api/v1/users/roles/assign", {
       method: "POST",
-      body: JSON.stringify(request)
+      body: JSON.stringify({ user_id: userId, role_id: roleId })
     });
-    return {
-      scopeId: response.scope_id,
-      name: response.name,
-      key: response.key,
-      description: response.description,
-      createdAt: response.created_at
-    };
   }
-  /**
-   * Delete a custom scope
-   */
-  async deleteScope(scopeId) {
-    await this.request("/api/v1/scopes/delete", {
+  async unassignRole(userId, roleId) {
+    await this.request("/api/v1/users/roles/unassign", {
       method: "POST",
-      body: JSON.stringify({ scope_id: scopeId })
+      body: JSON.stringify({ user_id: userId, role_id: roleId })
     });
   }
-  // ============ API Key Management ============
-  /**
-   * List all API keys for the service
-   */
+  async getUserRoles(userId) {
+    const response = await this.request(
+      `/api/v1/users/${encodeURIComponent(userId)}/roles`
+    );
+    return response.roles.map((r) => ({
+      roleId: r.role_id,
+      name: r.name,
+      description: r.description,
+      createdAt: r.created_at
+    }));
+  }
+  // ============ API Keys ============
   async listApiKeys() {
     const response = await this.request("/api/v1/keys/list");
     return response.keys.map((k) => ({
       keyId: k.keyId,
       name: k.name,
       scope: k.scope,
-      scopes: [],
+      scopes: k.scopes,
       keyType: k.keyType,
+      tpsLimit: k.tpsLimit,
       revoked: k.revoked,
-      createdAt: k.createdAt,
-      tpsLimit: k.tpsLimit
+      createdAt: k.createdAt
     }));
   }
-  /**
-   * Create a new API key with optional custom scopes
-   */
   async createApiKey(request) {
-    const response = await this.request("/api/v1/keys/create", {
+    const response = await this.request(
+      "/api/v1/keys/create",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          user_id: request.userId,
+          name: request.name,
+          scope: request.scope || "service",
+          scopes: request.scopes,
+          key_type: request.keyType || "service",
+          tps_limit: request.tpsLimit || 100
+        })
+      }
+    );
+    return { keyId: response.key_id, apiKey: response.api_key, name: response.name, scope: response.scope, scopes: response.scopes };
+  }
+  async revokeApiKey(keyId) {
+    await this.request("/api/v1/keys/revoke", {
+      method: "POST",
+      body: JSON.stringify({ key_id: keyId })
+    });
+  }
+  // ============ Scopes ============
+  async listScopes() {
+    const response = await this.request("/api/v1/scopes/list");
+    return response.scopes;
+  }
+  async createScope(request) {
+    const response = await this.request(
+      "/api/v1/scopes/create",
+      { method: "POST", body: JSON.stringify(request) }
+    );
+    return { scopeId: response.scope_id, name: response.name, key: response.key, description: response.description, createdAt: response.created_at };
+  }
+  async deleteScope(scopeId) {
+    await this.request("/api/v1/scopes/delete", {
+      method: "POST",
+      body: JSON.stringify({ scope_id: scopeId })
+    });
+  }
+  // ============ Introspection & Validation ============
+  async introspect(request) {
+    if (this.cache && request.token) {
+      const cached = this.cache.get(request.token);
+      if (cached) return cached;
+    }
+    const result = await this.request("/api/v1/introspect", {
       method: "POST",
       body: JSON.stringify({
-        user_id: request.userId,
-        name: request.name,
-        scope: request.scope || "service",
-        scopes: request.scopes,
-        key_type: request.keyType || "service",
-        tps_limit: request.tpsLimit || 100
+        serviceId: request.serviceId,
+        token: request.token,
+        apiKey: request.apiKey,
+        requiredScopes: request.requiredScopes
       })
     });
-    return {
-      keyId: response.key_id,
-      apiKey: response.api_key,
-      name: response.name,
-      scope: response.scope,
-      scopes: response.scopes
-    };
+    if (this.cache && request.token) {
+      this.cache.set(request.token, result);
+    }
+    return result;
   }
-  /**
-   * Revoke an API key
-   */
-  async revokeApiKey(keyId) {
-    await this.request("/api/v1/keys/revoke", {
+  async validate() {
+    const cfg = this.config;
+    const token = await this.storage.getToken();
+    if (!token) return { valid: false, error: "No token stored" };
+    if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
+    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    try {
+      const result = await this.introspect({ serviceId: cfg.serviceId, token });
+      return {
+        valid: result.valid,
+        type: result.type === "bearer" ? "token" : "api_key",
+        scopes: result.scopes,
+        userId: result.userId,
+        email: result.email,
+        error: result.error
+      };
+    } catch (error) {
+      if (error instanceof ScopeError) {
+        return { valid: false, error: error.message, scopes: error.providedScopes };
+      }
+      if (error instanceof AuthMiError && error.statusCode === 401) {
+        return { valid: false, error: "Invalid or expired token" };
+      }
+      throw error;
+    }
+  }
+  async validateWithScopes(requiredScopes) {
+    const cfg = this.config;
+    const token = await this.storage.getToken();
+    if (!token) return { valid: false, error: "No token provided" };
+    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
+    try {
+      const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
+      return {
+        valid: result.valid,
+        type: result.type === "bearer" ? "token" : "api_key",
+        scopes: result.scopes,
+        userId: result.userId,
+        email: result.email,
+        error: result.error
+      };
+    } catch (error) {
+      if (error instanceof ScopeError) {
+        return { valid: false, error: error.message, scopes: error.providedScopes };
+      }
+      if (error instanceof AuthMiError && error.statusCode === 401) {
+        return { valid: false, error: "Invalid or expired token" };
+      }
+      throw error;
+    }
+  }
+  async requireScopes(...requiredScopes) {
+    const result = await this.validateWithScopes(requiredScopes);
+    if (!result.valid) {
+      throw new AuthMiError(result.error || "Authentication required", "UNAUTHORIZED", 401);
+    }
+    const hasScopes = requiredScopes.every((s) => result.scopes?.includes(s));
+    if (!hasScopes) {
+      throw new ScopeError(`Required: ${requiredScopes.join(", ")}`, requiredScopes, result.scopes || []);
+    }
+    return result;
+  }
+  async withScope(scopes, fn) {
+    await this.requireScopes(...scopes);
+    return fn();
+  }
+  // ============ Webhooks ============
+  async listWebhooks() {
+    const response = await this.request("/api/v1/webhooks/list");
+    return response.webhooks;
+  }
+  async registerWebhook(request) {
+    const response = await this.request(
+      "/api/v1/webhooks/register",
+      { method: "POST", body: JSON.stringify(request) }
+    );
+    return { webhookId: response.webhook_id, url: response.url, events: response.events, active: response.active, createdAt: response.created_at };
+  }
+  async deleteWebhook(webhookId) {
+    await this.request("/api/v1/webhooks/delete", {
       method: "POST",
-      body: JSON.stringify({ key_id: keyId })
+      body: JSON.stringify({ webhook_id: webhookId })
+    });
+  }
+  // ============ Billing ============
+  async listPlans() {
+    const response = await this.request("/api/v1/billing/plans");
+    return response.plans;
+  }
+  async getSubscription() {
+    return this.request("/api/v1/billing/subscription");
+  }
+  async createCheckout(priceId) {
+    return this.request("/api/v1/billing/checkout", {
+      method: "POST",
+      body: JSON.stringify({ price_id: priceId })
     });
   }
-  // ============ Service Management ============
-  /**
-   * Onboard a new service (requires master admin key)
-   */
+  async createPortalSession() {
+    return this.request("/api/v1/billing/portal", { method: "POST" });
+  }
+  // ============ Audit ============
+  async getAuditLogs(query) {
+    const params = new URLSearchParams();
+    if (query?.limit) params.set("limit", String(query.limit));
+    if (query?.offset) params.set("offset", String(query.offset));
+    if (query?.actorId) params.set("actor_id", query.actorId);
+    if (query?.action) params.set("action", query.action);
+    if (query?.resourceType) params.set("resource_type", query.resourceType);
+    if (query?.startDate) params.set("start_date", query.startDate);
+    if (query?.endDate) params.set("end_date", query.endDate);
+    const qs = params.toString();
+    const response = await this.request(
+      `/api/v1/audit-logs${qs ? `?${qs}` : ""}`
+    );
+    return response.logs;
+  }
+  // ============ Services ============
+  async getService(serviceId) {
+    return this.request(`/api/v1/services/${encodeURIComponent(serviceId)}`);
+  }
+  async updateService(serviceId, data) {
+    return this.request(`/api/v1/services/${encodeURIComponent(serviceId)}`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async rotateClientSecret(serviceId) {
+    return this.request(
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
+      { method: "POST" }
+    );
+  }
+  // ============ JWKS ============
+  async getJwks(serviceId) {
+    return this.request(`/.well-known/jwks.json?service_id=${encodeURIComponent(serviceId)}`);
+  }
+  // ============ Onboarding (admin only) ============
   async onboardService(request, masterAdminKey) {
     const response = await this.request("/api/v1/services/onboard", {
       method: "POST",
@@ -555,9 +688,6 @@ var AuthMiClient = class {
       createdAt: response.created_at
     };
   }
-  /**
-   * Delete a service (requires master admin key)
-   */
   async deleteService(serviceId, masterAdminKey) {
     await this.request("/api/v1/services/deboard", {
       method: "POST",
@@ -567,41 +697,6 @@ var AuthMiClient = class {
       body: JSON.stringify({ service_id: serviceId })
     });
   }
-  // ============ Webhook Management ============
-  /**
-   * List webhooks
-   */
-  async listWebhooks() {
-    const response = await this.request(
-      "/api/v1/webhooks/list"
-    );
-    return response.webhooks;
-  }
-  /**
-   * Register a webhook
-   */
-  async registerWebhook(request) {
-    const response = await this.request("/api/v1/webhooks/register", {
-      method: "POST",
-      body: JSON.stringify(request)
-    });
-    return {
-      webhookId: response.webhook_id,
-      url: response.url,
-      events: response.events,
-      active: response.active,
-      createdAt: response.created_at
-    };
-  }
-  /**
-   * Delete a webhook
-   */
-  async deleteWebhook(webhookId) {
-    await this.request("/api/v1/webhooks/delete", {
-      method: "POST",
-      body: JSON.stringify({ webhook_id: webhookId })
-    });
-  }
 };
 
 // src/react.tsx
@@ -609,27 +704,30 @@ var import_jsx_runtime = require("react/jsx-runtime");
 var AuthMiContext = (0, import_react.createContext)(null);
 function AuthMiProvider({
   config,
-  tokenStorage,
+  options,
   children,
   validateOnMount = true,
   validationInterval = 5 * 60 * 1e3
 }) {
-  const [client] = (0, import_react.useState)(() => new AuthMiClient(config, tokenStorage));
+  const [client] = (0, import_react.useState)(() => new AuthMiClient(config, options));
   const [isAuthenticated, setIsAuthenticated] = (0, import_react.useState)(false);
   const [user, setUser] = (0, import_react.useState)(null);
   const [isLoading, setIsLoading] = (0, import_react.useState)(true);
   (0, import_react.useEffect)(() => {
     const checkAuth = async () => {
-      const token = client.getAccessToken();
+      const token = await client.getAccessToken();
       if (token && validateOnMount) {
         try {
           const result = await client.validate();
           if (result.valid) {
             setIsAuthenticated(true);
+            if (result.userId && result.email) {
+              setUser({ userId: result.userId, email: result.email, createdAt: "" });
+            }
           } else {
             client.clearAccessToken();
           }
-        } catch (error) {
+        } catch {
           client.clearAccessToken();
         }
       }
@@ -646,30 +744,34 @@ function AuthMiProvider({
           setIsAuthenticated(false);
           setUser(null);
         }
-      } catch (error) {
+      } catch {
         setIsAuthenticated(false);
         setUser(null);
       }
     }, validationInterval);
     return () => clearInterval(interval);
   }, [client, isAuthenticated, validationInterval]);
-  const login = (0, import_react.useCallback)(
-    async (email, password) => {
-      setIsLoading(true);
-      try {
-        const token = await client.login({ email, password });
-        setIsAuthenticated(true);
-        setUser({
-          userId: token.userId,
-          email: token.email,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-      } finally {
-        setIsLoading(false);
-      }
-    },
-    [client]
-  );
+  const login = (0, import_react.useCallback)(async (email, password) => {
+    setIsLoading(true);
+    try {
+      const token = await client.login({ email, password });
+      setIsAuthenticated(true);
+      setUser({ userId: token.userId, email: token.email, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+    } finally {
+      setIsLoading(false);
+    }
+  }, [client]);
+  const signup = (0, import_react.useCallback)(async (email, password, name) => {
+    setIsLoading(true);
+    try {
+      const cfg = client["config"];
+      const token = await client.signup({ email, password, name, client_id: cfg.serviceId || cfg.clientId });
+      setIsAuthenticated(true);
+      setUser({ userId: token.userId, email: token.email, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+    } finally {
+      setIsLoading(false);
+    }
+  }, [client]);
   const logout = (0, import_react.useCallback)(async () => {
     setIsLoading(true);
     try {
@@ -694,17 +796,26 @@ function AuthMiProvider({
     user,
     isLoading,
     login,
+    signup,
     logout,
-    validate
+    validate,
+    setup2fa: () => client.setup2fa(),
+    enable2fa: (code) => client.enable2fa(code),
+    disable2fa: (password) => client.disable2fa(password),
+    regenerateBackupCodes: () => client.regenerateBackupCodes(),
+    challenge2fa: (request) => client.challenge2fa(request),
+    forgotPassword: (email) => client.forgotPassword({ email }),
+    initiateOAuth: (provider, redirectUri) => client.initiateOAuth(provider, redirectUri),
+    handleOAuthCallback: (url) => client.handleOAuthCallback(url),
+    isOAuthCallback: (url) => client.isOAuthCallback(url),
+    getMe: () => client.getMe()
   };
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AuthMiContext.Provider, { value, children });
 }
 function useAuthMi() {
-  const context = (0, import_react.useContext)(AuthMiContext);
-  if (!context) {
-    throw new Error("useAuthMi must be used within AuthMiProvider");
-  }
-  return context;
+  const ctx = (0, import_react.useContext)(AuthMiContext);
+  if (!ctx) throw new Error("useAuthMi must be used within AuthMiProvider");
+  return ctx;
 }
 function useAuthMiClient() {
   return useAuthMi().client;
@@ -716,17 +827,37 @@ function useUser() {
   return useAuthMi().user;
 }
 function useAuthActions() {
-  const { login, logout, isLoading } = useAuthMi();
-  return { login, logout, isLoading };
+  const {
+    login,
+    signup,
+    logout,
+    isLoading,
+    forgotPassword,
+    setup2fa,
+    enable2fa,
+    disable2fa,
+    regenerateBackupCodes,
+    challenge2fa,
+    initiateOAuth
+  } = useAuthMi();
+  return {
+    login,
+    signup,
+    logout,
+    isLoading,
+    forgotPassword,
+    setup2fa,
+    enable2fa,
+    disable2fa,
+    regenerateBackupCodes,
+    challenge2fa,
+    initiateOAuth
+  };
 }
 function Protected({ children, fallback = null }) {
   const { isAuthenticated, isLoading } = useAuthMi();
-  if (isLoading) {
-    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: fallback });
-  }
-  if (!isAuthenticated) {
-    return null;
-  }
+  if (isLoading) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: fallback });
+  if (!isAuthenticated) return null;
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children });
 }
 function LoginForm({ onSuccess, onError, className }) {
@@ -741,9 +872,9 @@ function LoginForm({ onSuccess, onError, className }) {
       await login(email, password);
       onSuccess?.();
     } catch (err) {
-      const message = err instanceof Error ? err.message : "Login failed";
-      setError(message);
-      onError?.(err instanceof Error ? err : new Error(message));
+      const msg = err instanceof Error ? err.message : "Login failed";
+      setError(msg);
+      onError?.(err instanceof Error ? err : new Error(msg));
     }
   };
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { onSubmit: handleSubmit, className, children: [
@@ -781,14 +912,7 @@ function LoginForm({ onSuccess, onError, className }) {
       {
         type: "submit",
         disabled: isLoading,
-        style: {
-          padding: "0.5rem 1rem",
-          background: isLoading ? "#ccc" : "#007bff",
-          color: "white",
-          border: "none",
-          borderRadius: "4px",
-          cursor: isLoading ? "not-allowed" : "pointer"
-        },
+        style: { padding: "0.5rem 1rem", background: isLoading ? "#ccc" : "#007bff", color: "white", border: "none", borderRadius: "4px", cursor: isLoading ? "not-allowed" : "pointer" },
         children: isLoading ? "Logging in..." : "Login"
       }
     )
@@ -799,9 +923,7 @@ function LoginForm({ onSuccess, onError, className }) {
   AuthMiClient,
   AuthMiError,
   AuthMiProvider,
-  LocalStorageTokenStorage,
   LoginForm,
-  MemoryTokenStorage,
   Protected,
   ScopeError,
   useAuthActions,