cliodot 1.2.2 → 1.2.4

package/dist/__tests__/Events.test.js

@@ -1 +1,191 @@
-'use strict';const _0x47b85d=_0x2344;(function(_0x2116e1,_0x4036f9){const _0x4bc500=_0x2344,_0x26104a=_0x2116e1();while(!![]){try{const _0x14c20b=parseInt(_0x4bc500(0x175))/0x1+parseInt(_0x4bc500(0x150))/0x2*(parseInt(_0x4bc500(0x14f))/0x3)+-parseInt(_0x4bc500(0x14c))/0x4+-parseInt(_0x4bc500(0x15d))/0x5+parseInt(_0x4bc500(0x158))/0x6*(parseInt(_0x4bc500(0x152))/0x7)+parseInt(_0x4bc500(0x173))/0x8*(parseInt(_0x4bc500(0x169))/0x9)+-parseInt(_0x4bc500(0x146))/0xa*(parseInt(_0x4bc500(0x182))/0xb);if(_0x14c20b===_0x4036f9)break;else _0x26104a['push'](_0x26104a['shift']());}catch(_0x37620f){_0x26104a['push'](_0x26104a['shift']());}}}(_0x48a8,0xd428e));var __importDefault=this&&this[_0x47b85d(0x16e)]||function(_0x5d711a){const _0x490b0a=_0x47b85d;return _0x5d711a&&_0x5d711a[_0x490b0a(0x167)]?_0x5d711a:{'default':_0x5d711a};};Object[_0x47b85d(0x163)](exports,_0x47b85d(0x167),{'value':!![]});const axios_1=__importDefault(require('axios')),Events_1=require('../Events'),errors_1=require('../errors');jest['mock'](_0x47b85d(0x176));function _0x2344(_0x8c4169,_0x532e71){_0x8c4169=_0x8c4169-0x13d;const _0x48a894=_0x48a8();let _0x234444=_0x48a894[_0x8c4169];if(_0x2344['auijDx']===undefined){var _0x29d961=function(_0x3d8b73){const _0x3516b8='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x5d711a='',_0x3c6c01='';for(let _0x43f447=0x0,_0x3d9910,_0x12ac55,_0x4cb325=0x0;_0x12ac55=_0x3d8b73['charAt'](_0x4cb325++);~_0x12ac55&&(_0x3d9910=_0x43f447%0x4?_0x3d9910*0x40+_0x12ac55:_0x12ac55,_0x43f447++%0x4)?_0x5d711a+=String['fromCharCode'](0xff&_0x3d9910>>(-0x2*_0x43f447&0x6)):0x0){_0x12ac55=_0x3516b8['indexOf'](_0x12ac55);}for(let _0x2463e4=0x0,_0x1a90b6=_0x5d711a['length'];_0x2463e4<_0x1a90b6;_0x2463e4++){_0x3c6c01+='%'+('00'+_0x5d711a['charCodeAt'](_0x2463e4)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x3c6c01);};_0x2344['yLXVwi']=_0x29d961,_0x2344['WTbZXF']={},_0x2344['auijDx']=!![];}const _0x257e03=_0x48a894[0x0],_0x7f3ad7=_0x8c4169+_0x257e03,_0x3010c5=_0x2344['WTbZXF'][_0x7f3ad7];return!_0x3010c5?(_0x234444=_0x2344['yLXVwi'](_0x234444),_0x2344['WTbZXF'][_0x7f3ad7]=_0x234444):_0x234444=_0x3010c5,_0x234444;}const mockedAxios=axios_1['default'];describe(_0x47b85d(0x168),()=>{const _0x1f69e2=_0x47b85d,_0x3c6c01=jest['fn']();beforeEach(()=>{const _0x3a3995=_0x2344;jest['clearAllMocks'](),mockedAxios[_0x3a3995(0x166)][_0x3a3995(0x15c)](_0x3c6c01);});function _0x43f447(_0x3d9910){const _0x441471=_0x2344;return new Events_1[(_0x441471(0x168))]({'baseUrl':_0x441471(0x161),'appId':_0x441471(0x15f),'apiKey':'eak_test_key',..._0x3d9910});}it('requires\x20baseUrl\x20and\x20appId',()=>{const _0x1da3f0=_0x2344;expect(()=>new Events_1[(_0x1da3f0(0x168))]({'baseUrl':'','appId':_0x1da3f0(0x15f)}))[_0x1da3f0(0x172)](errors_1[_0x1da3f0(0x14e)]),expect(()=>new Events_1[(_0x1da3f0(0x168))]({'baseUrl':_0x1da3f0(0x161),'appId':''}))[_0x1da3f0(0x172)](errors_1['CliodotApiError']);}),it(_0x1f69e2(0x177),async()=>{const _0x452df9=_0x1f69e2;_0x3c6c01['mockResolvedValue']({'data':{'ok':!![],'event_id':_0x452df9(0x155),'accepted':!![]}});const _0x12ac55=_0x43f447(),_0x4cb325=await _0x12ac55['publish'](_0x452df9(0x160),{'id':'ord_1'},{'ordering_key':_0x452df9(0x16c)});expect(_0x4cb325['event_id'])[_0x452df9(0x174)](_0x452df9(0x155)),expect(_0x3c6c01)[_0x452df9(0x17c)](expect[_0x452df9(0x14a)]({'method':_0x452df9(0x147),'url':_0x452df9(0x171),'headers':{'Authorization':_0x452df9(0x145),'x-cliodot-app-id':_0x452df9(0x15f)},'data':{'event':_0x452df9(0x160),'payload':{'id':_0x452df9(0x16c)},'ordering_key':'ord_1'}}));}),it(_0x1f69e2(0x14d),async()=>{const _0x546854=_0x1f69e2;_0x3c6c01['mockResolvedValue']({'data':{'ok':!![],'subscription_id':_0x546854(0x178),'events':[_0x546854(0x160)]}});const _0x2463e4=_0x43f447({'apiKey':undefined,'appSecret':_0x546854(0x154)});await _0x2463e4[_0x546854(0x13d)]({'events':['order.created'],'name':_0x546854(0x148)}),expect(_0x3c6c01)['toHaveBeenCalledWith'](expect[_0x546854(0x14a)]({'method':_0x546854(0x147),'url':_0x546854(0x17f),'headers':{'x-cliodot-app-id':_0x546854(0x15f),'x-cliodot-app-secret':_0x546854(0x154)},'data':{'events':['order.created'],'name':_0x546854(0x148)}}));}),it('unsubscribes\x20by\x20id',async()=>{const _0x2efa4c=_0x1f69e2;_0x3c6c01[_0x2efa4c(0x157)]({'data':{'ok':!![],'deleted':!![]}});const _0x1a90b6=_0x43f447(),_0x3929a2=await _0x1a90b6[_0x2efa4c(0x13f)](_0x2efa4c(0x178));expect(_0x3929a2[_0x2efa4c(0x170)])['toBe'](!![]),expect(_0x3c6c01)['toHaveBeenCalledWith'](expect[_0x2efa4c(0x14a)]({'method':_0x2efa4c(0x141),'url':_0x2efa4c(0x17d)}));}),it(_0x1f69e2(0x165),()=>{const _0x2c407a=_0x1f69e2,_0x328604=_0x43f447(),_0x3b8e1f=_0x328604[_0x2c407a(0x164)]({'events':[_0x2c407a(0x160),_0x2c407a(0x179)]});expect(_0x3b8e1f)[_0x2c407a(0x174)](_0x2c407a(0x151));}),it(_0x1f69e2(0x16d),async()=>{const _0x1cfd2b=_0x1f69e2;_0x3c6c01[_0x1cfd2b(0x157)]({'data':{'ok':!![],'event_id':_0x1cfd2b(0x14b),'accepted':!![]}});const _0xc0ec17=_0x43f447({'apiKey':undefined,'appApiKey':_0x1cfd2b(0x162)});await _0xc0ec17['publish'](_0x1cfd2b(0x144),{}),expect(_0x3c6c01)[_0x1cfd2b(0x17c)](expect[_0x1cfd2b(0x14a)]({'headers':expect[_0x1cfd2b(0x14a)]({'Authorization':'Bearer\x20eak_alias'})}));}),it('auto-reconnects\x20listen\x20after\x20stream\x20ends\x20until\x20close',async()=>{const _0x59838b=_0x1f69e2;jest[_0x59838b(0x159)]();const {EventEmitter:_0x4816c4}=require(_0x59838b(0x143)),_0x3eee80=new _0x4816c4(),_0x2924ff=new _0x4816c4();_0x3eee80[_0x59838b(0x140)]=jest['fn'](),_0x2924ff[_0x59838b(0x140)]=jest['fn'](),_0x3c6c01['mockResolvedValueOnce']({'data':_0x3eee80})['mockResolvedValueOnce']({'data':_0x2924ff});const _0x5181c5=_0x43f447({'debug':![]}),_0x3ac195=[],_0x52ce49=_0x5181c5[_0x59838b(0x17a)]({'events':['order.created']},_0x25c9c6=>{const _0x3fb72a=_0x59838b;_0x3ac195[_0x3fb72a(0x142)](_0x25c9c6);});await Promise['resolve'](),await Promise[_0x59838b(0x156)](),_0x3eee80['emit'](_0x59838b(0x17e),Buffer[_0x59838b(0x15b)]('data:\x20{\x22type\x22:\x22connected\x22,\x22listener_id\x22:\x22sse_1\x22,\x22events\x22:[\x22order.created\x22]}\x0a\x0a')),_0x3eee80[_0x59838b(0x17b)](_0x59838b(0x13e)),await Promise[_0x59838b(0x156)](),expect(_0x3ac195)['toHaveLength'](0x1),await jest[_0x59838b(0x183)](0x3e8),await Promise[_0x59838b(0x156)](),await Promise[_0x59838b(0x156)](),_0x2924ff['emit']('data',Buffer['from'](_0x59838b(0x149))),expect(_0x3ac195)[_0x59838b(0x15e)](0x2),expect(_0x3c6c01)[_0x59838b(0x16a)](0x2),_0x52ce49[_0x59838b(0x16b)](),jest['useRealTimers']();}),it('does\x20not\x20reconnect\x20when\x20reconnect\x20is\x20false',async()=>{const _0x4d426d=_0x1f69e2;jest[_0x4d426d(0x159)]();const {EventEmitter:_0x312caf}=require('events'),_0x1c5125=new _0x312caf();_0x1c5125[_0x4d426d(0x140)]=jest['fn'](),_0x3c6c01[_0x4d426d(0x180)]({'data':_0x1c5125});const _0x3fee3d=_0x43f447();_0x3fee3d[_0x4d426d(0x17a)]({'events':[_0x4d426d(0x160)],'reconnect':![]},()=>{}),await Promise['resolve'](),await Promise[_0x4d426d(0x156)](),_0x1c5125[_0x4d426d(0x17b)](_0x4d426d(0x13e)),await Promise[_0x4d426d(0x156)](),await jest['advanceTimersByTimeAsync'](0x1388),expect(_0x3c6c01)[_0x4d426d(0x16a)](0x1),jest['useRealTimers']();}),it(_0x1f69e2(0x16f),async()=>{const _0x1f92bf=_0x1f69e2;_0x3c6c01[_0x1f92bf(0x157)]({'data':{'ok':!![],'event_id':_0x1f92bf(0x15a),'accepted':!![]}});const _0x5696ea=_0x43f447();await _0x5696ea[_0x1f92bf(0x153)](_0x1f92bf(0x160),{'id':'1'},{'environment':'dev'}),expect(_0x3c6c01)[_0x1f92bf(0x17c)](expect['objectContaining']({'data':expect[_0x1f92bf(0x14a)]({'event':_0x1f92bf(0x160),'environment':_0x1f92bf(0x181)})}));});});function _0x48a8(){const _0x21992c=['y2HLy2TVDxq','zgf0ytOGEYj0ExbLiJOIy29UBMvJDgvKiIWIBgLZDgvUzxjFAwqIoIjZC2vFmIiSiMv2zw50CYi6wYjVCMrLCI5JCMvHDgvKiL19cGO','B2jQzwn0q29UDgfPBMLUzW','zxz0xZi','nta1mJi4uxP3BwPx','DxnLCYbHChaGC2vJCMv0igHLywrLCNmGD2HLBIbHCgKGA2v5igLZigfIC2vUDa','q2XPB2rVDefWAuvYCM9Y','mti4mtnWCurqBe8','mZy2AwfqvMTZ','Ahr0Chm6lY9HCgKUzxHHBxbSzs5JB20VzxzLBNqVDJeVBgLZDgvUp2fWCf9Pzd1LDNrFyxbWx3rLC3qMywnJzxnZx3rVA2vUpwvHA190zxn0x2TLEszLDMvUDhm9B3jKzxiUy3jLyxrLzcuYq3bHEw1LBNqUy29TCgXLDgvK','nJnuvxjfr3i','ChvIBgLZAa','C2vJCMv0xZe','zxz0xZe','CMvZB2X2zq','Bw9JA1jLC29SDMvKvMfSDwu','mZm0nZiYqLvsyLPZ','DxnLrMfRzvrPBwvYCW','zxz0x2vUDG','zNjVBq','Bw9JA1jLDhvYBLzHBhvL','mtyXnJiWnvnVsLbfsW','Dg9iyxzLtgvUz3rO','zxz0x2fWCf90zxn0','B3jKzxiUy3jLyxrLza','Ahr0Chm6lY9HCgKUzxHHBxbSzs5JB20','zwfRx2fSAwfZ','zgvMAw5LuhjVCgvYDhK','BgLZDgvUvxjS','yNvPBgrZigjYB3DZzxiGBgLZDgvUvxjSihDPDgGGCxvLCNKGyxv0Aa','y3jLyxrL','x19LC01VzhvSzq','rxzLBNrZ','ntC4n3f0uvP1wG','Dg9iyxzLqMvLBKnHBgXLzfrPBwvZ','y2XVC2u','B3jKxZe','ywnJzxb0CYbHChbbCgLlzxKGywXPyxm','x19PBxbVCNrezwzHDwX0','CgfZC2vZigvUDMLYB25Tzw50ig9Uihb1yMXPC2G','zgvSzxrLza','l3yXl3b1yMXPC2G','Dg9uAhjVDW','mta1mZzQrMPAAei','Dg9czq','mti4ntmXmuHoALHLtq','yxHPB3m','ChvIBgLZAgvZihDPDgGGyMvHCMvYigfWAsbRzxKGyw5KigfWCcbPzcbOzwfKzxi','zxz0x3n1yL8X','Cgf5BwvUDc5JB21WBgv0zwq','BgLZDgvU','zw1PDa','Dg9iyxzLqMvLBKnHBgXLzfDPDgG','l3yXl3n1yNnJCMLIzs9LDNrFC3vIxZe','zgf0yq','l3yXl3n1yNnJCMLIzq','Bw9JA1jLC29SDMvKvMfSDwvpBMnL','zgv2','mZG0ndK4ngTlDMrHDW','ywr2yw5JzvrPBwvYC0j5vgLTzufZEw5J','C3vIC2nYAwjL','zw5K','Dw5ZDwjZy3jPyMu','zgvZDhjVEq','revmrvrf','ChvZAa','zxzLBNrZ','CgLUzW','qMvHCMvYigvHA190zxn0x2TLEq','nJbYwhbpz2K','ue9tva'];_0x48a8=function(){return _0x21992c;};return _0x48a8();}
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const axios_1 = __importDefault(require("axios"));
+const Events_1 = require("../Events");
+const errors_1 = require("../errors");
+jest.mock("axios");
+const mockedAxios = axios_1.default;
+describe("Events", () => {
+    const mockAxiosInstance = jest.fn();
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockedAxios.create.mockReturnValue(mockAxiosInstance);
+    });
+    function createClient(overrides) {
+        return new Events_1.Events({
+            baseUrl: "https://api.example.com",
+            appId: "evt_app_test",
+            apiKey: "eak_test_key",
+            instanceId: "test-instance",
+            ...overrides,
+        });
+    }
+    it("requires baseUrl and appId", () => {
+        expect(() => new Events_1.Events({ baseUrl: "", appId: "evt_app_test" })).toThrow(errors_1.CliodotApiError);
+        expect(() => new Events_1.Events({ baseUrl: "https://api.example.com", appId: "" })).toThrow(errors_1.CliodotApiError);
+    });
+    it("publishes with bearer api key and app id header", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, event_id: "evt_1", accepted: true },
+        });
+        const client = createClient();
+        const result = await client.publish("order.created", { id: "ord_1" }, {
+            ordering_key: "ord_1",
+        });
+        expect(result.event_id).toBe("evt_1");
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "POST",
+            url: "/v1/publish",
+            headers: {
+                Authorization: "Bearer eak_test_key",
+                "x-cliodot-app-id": "evt_app_test",
+                "x-cliodot-instance-id": "test-instance",
+            },
+            data: {
+                event: "order.created",
+                payload: { id: "ord_1" },
+                ordering_key: "ord_1",
+            },
+        }));
+    });
+    it("uses app secret headers when api key is absent", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, subscription_id: "evt_sub_1", events: ["order.created"] },
+        });
+        const client = createClient({
+            apiKey: undefined,
+            appSecret: "secret_1",
+        });
+        await client.subscribe({ events: ["order.created"], name: "checkout" });
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "POST",
+            url: "/v1/subscribe",
+            headers: {
+                "x-cliodot-app-id": "evt_app_test",
+                "x-cliodot-app-secret": "secret_1",
+                "x-cliodot-instance-id": "test-instance",
+            },
+            data: {
+                events: ["order.created"],
+                name: "checkout",
+                instance_id: "test-instance",
+            },
+        }));
+    });
+    it("unsubscribes by id", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, deleted: true },
+        });
+        const client = createClient();
+        const result = await client.unsubscribe("evt_sub_1");
+        expect(result.deleted).toBe(true);
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "DELETE",
+            url: "/v1/subscribe/evt_sub_1",
+        }));
+    });
+    it("builds browser listenUrl with query auth", () => {
+        const client = createClient();
+        const url = client.listenUrl({ events: ["order.created", "payment.completed"] });
+        expect(url).toBe("https://api.example.com/event/v1/listen?app_id=evt_app_test&access_token=eak_test_key&instance_id=test-instance&events=order.created%2Cpayment.completed");
+    });
+    it("accepts appApiKey alias", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, event_id: "evt_2", accepted: true },
+        });
+        const client = createClient({
+            apiKey: undefined,
+            appApiKey: "eak_alias",
+        });
+        await client.publish("ping", {});
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            headers: expect.objectContaining({
+                Authorization: "Bearer eak_alias",
+            }),
+        }));
+    });
+    it("auto-reconnects listen after stream ends until close", async () => {
+        jest.useFakeTimers();
+        const { EventEmitter } = require("events");
+        const stream1 = new EventEmitter();
+        const stream2 = new EventEmitter();
+        stream1.destroy = jest.fn();
+        stream2.destroy = jest.fn();
+        mockAxiosInstance
+            .mockResolvedValueOnce({ data: stream1 })
+            .mockResolvedValueOnce({ data: stream2 });
+        const client = createClient({ debug: false });
+        const messages = [];
+        const handle = client.listen({ events: ["order.created"] }, (m) => {
+            messages.push(m);
+        });
+        await Promise.resolve();
+        await Promise.resolve();
+        stream1.emit("data", Buffer.from('data: {"type":"connected","listener_id":"sse_1","events":["order.created"]}\n\n'));
+        stream1.emit("end");
+        await Promise.resolve();
+        expect(messages).toHaveLength(1);
+        await jest.advanceTimersByTimeAsync(1000);
+        await Promise.resolve();
+        await Promise.resolve();
+        stream2.emit("data", Buffer.from('data: {"type":"connected","listener_id":"sse_2","events":["order.created"]}\n\n'));
+        expect(messages).toHaveLength(2);
+        expect(mockAxiosInstance).toHaveBeenCalledTimes(2);
+        handle.close();
+        jest.useRealTimers();
+    });
+    it("does not reconnect when reconnect is false", async () => {
+        jest.useFakeTimers();
+        const { EventEmitter } = require("events");
+        const stream1 = new EventEmitter();
+        stream1.destroy = jest.fn();
+        mockAxiosInstance.mockResolvedValueOnce({ data: stream1 });
+        const client = createClient();
+        client.listen({ events: ["order.created"], reconnect: false }, () => { });
+        await Promise.resolve();
+        await Promise.resolve();
+        stream1.emit("end");
+        await Promise.resolve();
+        await jest.advanceTimersByTimeAsync(5000);
+        expect(mockAxiosInstance).toHaveBeenCalledTimes(1);
+        jest.useRealTimers();
+    });
+    it("passes environment on publish", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, event_id: "evt_env", accepted: true },
+        });
+        const client = createClient();
+        await client.publish("order.created", { id: "1" }, { environment: "dev" });
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            data: expect.objectContaining({
+                event: "order.created",
+                environment: "dev",
+            }),
+        }));
+    });
+    it("keeps instance id stable for this client and distinct across computers", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                subscription_id: "evt_sub_1",
+                events: ["order.created"],
+                instance_id: "test-instance",
+            },
+        });
+        const sameBox = createClient();
+        await sameBox.subscribe({ events: ["order.created"] });
+        await sameBox.subscribe({ events: ["order.created"] });
+        const otherBox = createClient({ instanceId: "other-computer" });
+        await otherBox.subscribe({ events: ["order.created"] });
+        const calls = mockAxiosInstance.mock.calls.filter((c) => c[0]?.url === "/v1/subscribe");
+        expect(calls).toHaveLength(3);
+        expect(calls[0][0].data.instance_id).toBe("test-instance");
+        expect(calls[1][0].data.instance_id).toBe("test-instance");
+        expect(calls[2][0].data.instance_id).toBe("other-computer");
+        expect(sameBox.instanceId).toBe("test-instance");
+        expect(otherBox.instanceId).not.toBe(sameBox.instanceId);
+    });
+});

package/dist/__tests__/IdentityAppClient.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=IdentityAppClient.test.d.ts.map

package/dist/__tests__/IdentityAppClient.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityAppClient.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/IdentityAppClient.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/IdentityAppClient.test.js

@@ -0,0 +1,232 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const axios_1 = __importDefault(require("axios"));
+const crypto_1 = __importDefault(require("crypto"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const IdentityAppClient_1 = require("../IdentityAppClient");
+const errors_1 = require("../errors");
+const identity_offline_verify_1 = require("../identity-offline-verify");
+const identity_token_cache_1 = require("../identity-token-cache");
+jest.mock("axios");
+const mockedAxios = axios_1.default;
+describe("IdentityAppClient", () => {
+    const mockAxiosInstance = jest.fn();
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockedAxios.create.mockReturnValue(mockAxiosInstance);
+    });
+    function createClient(overrides) {
+        return new IdentityAppClient_1.IdentityAppClient({
+            baseUrl: "https://api.example.com",
+            appId: "identity_payroll",
+            appApiKey: "iak_test_key",
+            ...overrides,
+        });
+    }
+    it("requires baseUrl and appId", () => {
+        expect(() => new IdentityAppClient_1.IdentityAppClient({ baseUrl: "", appId: "identity_payroll" })).toThrow(errors_1.CliodotApiError);
+        expect(() => new IdentityAppClient_1.IdentityAppClient({
+            baseUrl: "https://api.example.com",
+            appId: "",
+        })).toThrow(errors_1.CliodotApiError);
+    });
+    it("authenticates with bearer api key", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                access_token: "jwt",
+                token_type: "Bearer",
+                expires_in: 3600,
+                caller_app_id: "identity_payroll",
+                target_app_id: "identity_hrms",
+            },
+        });
+        const client = createClient();
+        const result = await client.authenticate({
+            target_app_id: "identity_hrms",
+        });
+        expect(result.access_token).toBe("jwt");
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "POST",
+            url: "/v1/authenticate",
+            headers: {
+                "x-cliodot-app-id": "identity_payroll",
+                Authorization: "Bearer iak_test_key",
+            },
+            data: { target_app_id: "identity_hrms" },
+        }));
+    });
+    it("authenticate and verify pass scopes", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                access_token: "jwt",
+                token_type: "Bearer",
+                expires_in: 3600,
+                caller_app_id: "identity_payroll",
+                target_app_id: "identity_hrms",
+            },
+        });
+        const client = createClient();
+        await client.authenticate({
+            target_app_id: "identity_hrms",
+            scopes: ["employees.read"],
+        });
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            data: {
+                target_app_id: "identity_hrms",
+                scopes: ["employees.read"],
+            },
+        }));
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                valid: true,
+                jti: "j1",
+                caller_app_id: "identity_payroll",
+                target_app_id: "identity_hrms",
+                expires_at: new Date().toISOString(),
+                claims: { scope: "employees.read" },
+            },
+        });
+        await client.verify({
+            access_token: "jwt",
+            required_scopes: ["employees.read"],
+        });
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            data: {
+                access_token: "jwt",
+                required_scopes: ["employees.read"],
+            },
+        }));
+    });
+    it("uses app secret headers when no api key", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                app: {
+                    _id: "identity_payroll",
+                    name: "Payroll",
+                    slug: "identity_payroll",
+                    tenant_id: "t1",
+                    status: "active",
+                },
+            },
+        });
+        const client = createClient({
+            appApiKey: undefined,
+            appSecret: "secret_hex",
+        });
+        await client.me();
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "GET",
+            url: "/v1/me",
+            headers: {
+                "x-cliodot-app-id": "identity_payroll",
+                "x-cliodot-app-secret": "secret_hex",
+            },
+        }));
+    });
+    it("maps API error codes", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: false,
+                error: "Target app does not trust the caller",
+                code: "IDENTITY_TRUST_DENIED",
+            },
+        });
+        const client = createClient();
+        await expect(client.authenticate({ target_app_id: "identity_hrms" })).rejects.toMatchObject({
+            code: "IDENTITY_TRUST_DENIED",
+        });
+    });
+    it("fetches JWKS without auth headers", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { keys: [{ kid: "k1", kty: "RSA" }] },
+        });
+        const client = createClient();
+        const jwks = await client.getJwks("identity_hrms");
+        expect(jwks.keys[0].kid).toBe("k1");
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "GET",
+            url: "/v1/apps/identity_hrms/jwks.json",
+        }));
+    });
+});
+describe("verifyIdentityTokenOffline", () => {
+    beforeEach(() => {
+        (0, identity_offline_verify_1.clearIdentityJwksCache)();
+    });
+    it("verifies HS256 tokens", async () => {
+        const secret = "ijwt_test_secret_value_1234567890";
+        const token = jsonwebtoken_1.default.sign({ sub: "identity_payroll", jti: "j1", exp: Math.floor(Date.now() / 1000) + 60 }, secret, { algorithm: "HS256", noTimestamp: true });
+        const claims = await (0, identity_offline_verify_1.verifyIdentityTokenOffline)(token, {
+            algorithm: "HS256",
+            secret,
+        });
+        expect(claims.jti).toBe("j1");
+    });
+    it("verifies RS256 via JWKS kid", async () => {
+        const { publicKey, privateKey } = crypto_1.default.generateKeyPairSync("rsa", {
+            modulusLength: 2048,
+            publicKeyEncoding: { type: "spki", format: "pem" },
+            privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        });
+        const jwk = crypto_1.default
+            .createPublicKey(publicKey)
+            .export({ format: "jwk" });
+        const token = jsonwebtoken_1.default.sign({ sub: "identity_payroll", jti: "j2", exp: Math.floor(Date.now() / 1000) + 60 }, privateKey, { algorithm: "RS256", keyid: "kid_1", noTimestamp: true });
+        const fetchImpl = jest.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                keys: [
+                    {
+                        kty: jwk.kty || "RSA",
+                        kid: "kid_1",
+                        n: jwk.n,
+                        e: jwk.e,
+                        alg: "RS256",
+                        use: "sig",
+                    },
+                ],
+            }),
+        });
+        const claims = await (0, identity_offline_verify_1.verifyIdentityTokenOffline)(token, {
+            algorithm: "RS256",
+            jwksUrl: "https://api.example.com/identity/v1/apps/identity_hrms/jwks.json",
+            fetch: fetchImpl,
+        });
+        expect(claims.jti).toBe("j2");
+        expect(fetchImpl).toHaveBeenCalled();
+    });
+    it("tokenHasScopes checks JWT scope claim", () => {
+        const token = jsonwebtoken_1.default.sign({ scope: "employees.read employees.write", jti: "j" }, "secret", { algorithm: "HS256", noTimestamp: true });
+        expect((0, identity_offline_verify_1.tokenHasScopes)(token, ["employees.read"])).toBe(true);
+        expect((0, identity_offline_verify_1.tokenHasScopes)(token, ["employees.admin"])).toBe(false);
+    });
+});
+describe("createIdentityTokenCache", () => {
+    it("authenticates then reuses until near expiry", async () => {
+        const authenticate = jest.fn().mockResolvedValue({
+            ok: true,
+            access_token: "at_1",
+            token_type: "Bearer",
+            expires_in: 3600,
+            refresh_token: "irt_1",
+            caller_app_id: "identity_payroll",
+            target_app_id: "identity_hrms",
+        });
+        const refresh = jest.fn();
+        const cache = (0, identity_token_cache_1.createIdentityTokenCache)({
+            client: { authenticate, refresh },
+        });
+        const first = await cache.getAccessToken("identity_hrms");
+        const second = await cache.getAccessToken("identity_hrms");
+        expect(first).toBe("at_1");
+        expect(second).toBe("at_1");
+        expect(authenticate).toHaveBeenCalledTimes(1);
+    });
+});