cliodot 1.2.3 → 1.2.4

package/dist/__tests__/Events.test.js

@@ -1 +1,191 @@
-'use strict';function _0x12b0(){const _0x422706=['lI4VrxzLBNrZ','yxHPB3m','zxz0xZi','mJeWnJC5mezuzxv4rq','rxzLBNrZ','Bw9JAW','l3yXl3n1yNnJCMLIzs9LDNrFC3vIxZe','mJaWBM5is1Pk','yNvPBgrZigjYB3DZzxiGBgLZDgvUvxjSihDPDgGGCxvLCNKGyxv0Aa','BgLZDgvUvxjS','CMvXDwLYzxmGyMfZzvvYBcbHBMqGyxbWswq','Dw5ZDwjZy3jPyMu','Bw9JA1jLC29SDMvKvMfSDwvpBMnL','Bw9JA1jLDhvYBLzHBhvL','lI4VzxjYB3jZ','zw5K','otq5nJGWD1vpAxvZ','Bw9JA1jLC29SDMvKvMfSDwu','CgfZC2vZigvUDMLYB25Tzw50ig9Uihb1yMXPC2G','qMvHCMvYigvHA19HBgLHCW','ou1oB3npwq','y3jLyxrL','zxz0x2fWCf90zxn0','Cgf5BwvUDc5JB21WBgv0zwq','CgLUzW','zgf0ytOGEYj0ExbLiJOIy29UBMvJDgvKiIWIBgLZDgvUzxjFAwqIoIjZC2vFmsiSiMv2zw50CYi6wYjVCMrLCI5JCMvHDgvKiL19cGO','ue9tva','CMvZB2X2zq','zgf0ytOGEYj0ExbLiJOIy29UBMvJDgvKiIWIBgLZDgvUzxjFAwqIoIjZC2vFmIiSiMv2zw50CYi6wYjVCMrLCI5JCMvHDgvKiL19cGO','zw1PDa','B3jKxZe','y2HLy2TVDxq','zgf0yq','B2jQzwn0q29UDgfPBMLUzW','ywr2yw5JzvrPBwvYC0j5vgLTzufZEw5J','l3yXl3b1yMXPC2G','BgLZDgvU','zxz0xZe','zNjVBq','zgv2','otKZmtHSrKrAsxa','yxv0BY1YzwnVBM5Ly3rZigXPC3rLBIbHzNrLCIbZDhjLyw0Gzw5KCYb1BNrPBcbJBg9Zzq','zxz0x3n1yL8X','mtLrtwnyu3a','zgvZDhjVEq','otu4sKzNwfHA','DxnLuMvHBfrPBwvYCW','l3yXl3n1yNnJCMLIzq','zxzLBNrFAwq','Dg9uAhjVDW','revmrvrf','B3jKzxiUy3jLyxrLza','y2XLyxjbBgXnB2nRCW','Dg9czq','ywnJzxb0CYbHChbbCgLlzxKGywXPyxm','zwfRx3rLC3rFA2v5','ChvZAa','zgvSzxrLza','zgvMyxvSDa','Dg9iyxzLqMvLBKnHBgXLzfDPDgG','x19LC01VzhvSzq','mta2mteWohbAEuL5uG','mtu3nxHgC2jOyG','q2XPB2rVDefWAuvYCM9Y','Dg9iyxzLqMvLBKnHBgXLzfrPBwvZ','DxnLCYbHChaGC2vJCMv0igHLywrLCNmGD2HLBIbHCgKGA2v5igLZigfIC2vUDa','Ahr0Chm6lY9HCgKUzxHHBxbSzs5JB20','ChvIBgLZAa','ChvIBgLZAgvZihDPDgGGyMvHCMvYigfWAsbRzxKGyw5KigfWCcbPzcbOzwfKzxi','x19PBxbVCNrezwzHDwX0','zwfRx2fSAwfZ','DxnLrMfRzvrPBwvYCW','C3vIC2nYAwjL','zg9LCYbUB3qGCMvJB25Uzwn0ihDOzw4GCMvJB25Uzwn0igLZigzHBhnL','mta0mZiXn1fgD2Pfta','C2vJCMv0xZe','Dg9iyxzLtgvUz3rO'];_0x12b0=function(){return _0x422706;};return _0x12b0();}const _0x3759b2=_0x2842;(function(_0x227653,_0x47b9a1){const _0x53c5e4=_0x2842,_0x53a193=_0x227653();while(!![]){try{const _0x350971=-parseInt(_0x53c5e4(0x18e))/0x1*(parseInt(_0x53c5e4(0x190))/0x2)+parseInt(_0x53c5e4(0x1ad))/0x3+parseInt(_0x53c5e4(0x1a0))/0x4+-parseInt(_0x53c5e4(0x1c0))/0x5+parseInt(_0x53c5e4(0x18b))/0x6+-parseInt(_0x53c5e4(0x1a1))/0x7*(-parseInt(_0x53c5e4(0x1b7))/0x8)+parseInt(_0x53c5e4(0x1c4))/0x9*(-parseInt(_0x53c5e4(0x1b3))/0xa);if(_0x350971===_0x47b9a1)break;else _0x53a193['push'](_0x53a193['shift']());}catch(_0x532bd5){_0x53a193['push'](_0x53a193['shift']());}}}(_0x12b0,0x370c6));var __importDefault=this&&this[_0x3759b2(0x1a8)]||function(_0x56c90e){const _0xb3d80f=_0x3759b2;return _0x56c90e&&_0x56c90e[_0xb3d80f(0x19f)]?_0x56c90e:{'default':_0x56c90e};};function _0x2842(_0x48a6f7,_0x1e3d1e){_0x48a6f7=_0x48a6f7-0x179;const _0x12b03d=_0x12b0();let _0x284231=_0x12b03d[_0x48a6f7];if(_0x2842['LTwxqR']===undefined){var _0x1b4615=function(_0x574336){const _0x3efb1f='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x56c90e='',_0x128c9a='';for(let _0x31854b=0x0,_0x38fbf1,_0x3edc5b,_0x531f10=0x0;_0x3edc5b=_0x574336['charAt'](_0x531f10++);~_0x3edc5b&&(_0x38fbf1=_0x31854b%0x4?_0x38fbf1*0x40+_0x3edc5b:_0x3edc5b,_0x31854b++%0x4)?_0x56c90e+=String['fromCharCode'](0xff&_0x38fbf1>>(-0x2*_0x31854b&0x6)):0x0){_0x3edc5b=_0x3efb1f['indexOf'](_0x3edc5b);}for(let _0x1c0e94=0x0,_0x30243c=_0x56c90e['length'];_0x1c0e94<_0x30243c;_0x1c0e94++){_0x128c9a+='%'+('00'+_0x56c90e['charCodeAt'](_0x1c0e94)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x128c9a);};_0x2842['lNSbvN']=_0x1b4615,_0x2842['wnTSFz']={},_0x2842['LTwxqR']=!![];}const _0x1055a3=_0x12b03d[0x0],_0x11afa7=_0x48a6f7+_0x1055a3,_0x3f5404=_0x2842['wnTSFz'][_0x11afa7];return!_0x3f5404?(_0x284231=_0x2842['lNSbvN'](_0x284231),_0x2842['wnTSFz'][_0x11afa7]=_0x284231):_0x284231=_0x3f5404,_0x284231;}Object['defineProperty'](exports,'__esModule',{'value':!![]});const axios_1=__importDefault(require(_0x3759b2(0x1b1))),Events_1=require(_0x3759b2(0x1b0)),errors_1=require(_0x3759b2(0x1be));jest[_0x3759b2(0x1b5)](_0x3759b2(0x1b1));const mockedAxios=axios_1[_0x3759b2(0x19d)];describe(_0x3759b2(0x1b4),()=>{const _0x3700d4=_0x3759b2,_0x128c9a=jest['fn']();beforeEach(()=>{const _0x10a346=_0x2842;jest[_0x10a346(0x197)](),mockedAxios[_0x10a346(0x1c5)][_0x10a346(0x1bd)](_0x128c9a);});function _0x31854b(_0x38fbf1){const _0x5205e5=_0x2842;return new Events_1[(_0x5205e5(0x1b4))]({'baseUrl':_0x5205e5(0x1a5),'appId':_0x5205e5(0x179),'apiKey':_0x5205e5(0x19a),..._0x38fbf1});}it(_0x3700d4(0x1ba),()=>{const _0x4802b4=_0x3700d4;expect(()=>new Events_1[(_0x4802b4(0x1b4))]({'baseUrl':'','appId':'evt_app_test'}))[_0x4802b4(0x194)](errors_1[_0x4802b4(0x1a2)]),expect(()=>new Events_1[(_0x4802b4(0x1b4))]({'baseUrl':_0x4802b4(0x1a5),'appId':''}))['toThrow'](errors_1[_0x4802b4(0x1a2)]);}),it(_0x3700d4(0x1a7),async()=>{const _0x16b089=_0x3700d4;_0x128c9a[_0x16b089(0x1c1)]({'data':{'ok':!![],'event_id':_0x16b089(0x188),'accepted':!![]}});const _0x3edc5b=_0x31854b(),_0x531f10=await _0x3edc5b[_0x16b089(0x1a6)](_0x16b089(0x196),{'id':_0x16b089(0x181)},{'ordering_key':_0x16b089(0x181)});expect(_0x531f10[_0x16b089(0x193)])[_0x16b089(0x198)]('evt_1'),expect(_0x128c9a)[_0x16b089(0x19e)](expect[_0x16b089(0x184)]({'method':'POST','url':_0x16b089(0x186),'headers':{'Authorization':'Bearer\x20eak_test_key','x-cliodot-app-id':'evt_app_test'},'data':{'event':'order.created','payload':{'id':'ord_1'},'ordering_key':_0x16b089(0x181)}}));}),it(_0x3700d4(0x1a4),async()=>{const _0xa20d13=_0x3700d4;_0x128c9a[_0xa20d13(0x1c1)]({'data':{'ok':!![],'subscription_id':_0xa20d13(0x18d),'events':[_0xa20d13(0x196)]}});const _0x1c0e94=_0x31854b({'apiKey':undefined,'appSecret':'secret_1'});await _0x1c0e94[_0xa20d13(0x1ab)]({'events':[_0xa20d13(0x196)],'name':_0xa20d13(0x182)}),expect(_0x128c9a)[_0xa20d13(0x19e)](expect[_0xa20d13(0x184)]({'method':_0xa20d13(0x17d),'url':_0xa20d13(0x192),'headers':{'x-cliodot-app-id':'evt_app_test','x-cliodot-app-secret':_0xa20d13(0x1ae)},'data':{'events':['order.created'],'name':_0xa20d13(0x182)}}));}),it('unsubscribes\x20by\x20id',async()=>{const _0x51a608=_0x3700d4;_0x128c9a['mockResolvedValue']({'data':{'ok':!![],'deleted':!![]}});const _0x30243c=_0x31854b(),_0x28d4b1=await _0x30243c[_0x51a608(0x1bb)](_0x51a608(0x18d));expect(_0x28d4b1[_0x51a608(0x19c)])[_0x51a608(0x198)](!![]),expect(_0x128c9a)[_0x51a608(0x19e)](expect[_0x51a608(0x184)]({'method':_0x51a608(0x195),'url':_0x51a608(0x1b6)}));}),it(_0x3700d4(0x1b8),()=>{const _0x4199ad=_0x3700d4,_0x17f952=_0x31854b(),_0xc3b378=_0x17f952[_0x4199ad(0x1b9)]({'events':[_0x4199ad(0x196),_0x4199ad(0x17a)]});expect(_0xc3b378)[_0x4199ad(0x198)]('https://api.example.com/event/v1/listen?app_id=evt_app_test&access_token=eak_test_key&events=order.created%2Cpayment.completed');}),it(_0x3700d4(0x199),async()=>{const _0x534550=_0x3700d4;_0x128c9a['mockResolvedValue']({'data':{'ok':!![],'event_id':_0x534550(0x1b2),'accepted':!![]}});const _0x3c80c5=_0x31854b({'apiKey':undefined,'appApiKey':_0x534550(0x1a9)});await _0x3c80c5[_0x534550(0x1a6)](_0x534550(0x17b),{}),expect(_0x128c9a)[_0x534550(0x19e)](expect[_0x534550(0x184)]({'headers':expect[_0x534550(0x184)]({'Authorization':_0x534550(0x1c3)})}));}),it(_0x3700d4(0x18c),async()=>{const _0x24b868=_0x3700d4;jest[_0x24b868(0x1aa)]();const {EventEmitter:_0x4596db}=require('events'),_0x28c5bd=new _0x4596db(),_0x43c48e=new _0x4596db();_0x28c5bd[_0x24b868(0x18f)]=jest['fn'](),_0x43c48e['destroy']=jest['fn'](),_0x128c9a[_0x24b868(0x1bc)]({'data':_0x28c5bd})[_0x24b868(0x1bc)]({'data':_0x43c48e});const _0x5778c4=_0x31854b({'debug':![]}),_0xd8588=[],_0x42c7b0=_0x5778c4[_0x24b868(0x187)]({'events':[_0x24b868(0x196)]},_0x4d53f6=>{const _0x87c46a=_0x24b868;_0xd8588[_0x87c46a(0x19b)](_0x4d53f6);});await Promise[_0x24b868(0x17e)](),await Promise['resolve'](),_0x28c5bd['emit'](_0x24b868(0x183),Buffer[_0x24b868(0x189)](_0x24b868(0x17c))),_0x28c5bd[_0x24b868(0x180)](_0x24b868(0x1bf)),await Promise[_0x24b868(0x17e)](),expect(_0xd8588)[_0x24b868(0x1af)](0x1),await jest[_0x24b868(0x185)](0x3e8),await Promise[_0x24b868(0x17e)](),await Promise[_0x24b868(0x17e)](),_0x43c48e['emit'](_0x24b868(0x183),Buffer['from'](_0x24b868(0x17f))),expect(_0xd8588)[_0x24b868(0x1af)](0x2),expect(_0x128c9a)['toHaveBeenCalledTimes'](0x2),_0x42c7b0['close'](),jest[_0x24b868(0x191)]();}),it(_0x3700d4(0x1ac),async()=>{const _0x5ee7c3=_0x3700d4;jest[_0x5ee7c3(0x1aa)]();const {EventEmitter:_0x5744e9}=require('events'),_0x325f58=new _0x5744e9();_0x325f58[_0x5ee7c3(0x18f)]=jest['fn'](),_0x128c9a[_0x5ee7c3(0x1bc)]({'data':_0x325f58});const _0x1999e6=_0x31854b();_0x1999e6['listen']({'events':[_0x5ee7c3(0x196)],'reconnect':![]},()=>{}),await Promise[_0x5ee7c3(0x17e)](),await Promise['resolve'](),_0x325f58['emit'](_0x5ee7c3(0x1bf)),await Promise[_0x5ee7c3(0x17e)](),await jest['advanceTimersByTimeAsync'](0x1388),expect(_0x128c9a)[_0x5ee7c3(0x1a3)](0x1),jest[_0x5ee7c3(0x191)]();}),it(_0x3700d4(0x1c2),async()=>{const _0x4dee91=_0x3700d4;_0x128c9a[_0x4dee91(0x1c1)]({'data':{'ok':!![],'event_id':'evt_env','accepted':!![]}});const _0x2bc6e8=_0x31854b();await _0x2bc6e8[_0x4dee91(0x1a6)](_0x4dee91(0x196),{'id':'1'},{'environment':_0x4dee91(0x18a)}),expect(_0x128c9a)['toHaveBeenCalledWith'](expect['objectContaining']({'data':expect[_0x4dee91(0x184)]({'event':_0x4dee91(0x196),'environment':_0x4dee91(0x18a)})}));});});
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const axios_1 = __importDefault(require("axios"));
+const Events_1 = require("../Events");
+const errors_1 = require("../errors");
+jest.mock("axios");
+const mockedAxios = axios_1.default;
+describe("Events", () => {
+    const mockAxiosInstance = jest.fn();
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockedAxios.create.mockReturnValue(mockAxiosInstance);
+    });
+    function createClient(overrides) {
+        return new Events_1.Events({
+            baseUrl: "https://api.example.com",
+            appId: "evt_app_test",
+            apiKey: "eak_test_key",
+            instanceId: "test-instance",
+            ...overrides,
+        });
+    }
+    it("requires baseUrl and appId", () => {
+        expect(() => new Events_1.Events({ baseUrl: "", appId: "evt_app_test" })).toThrow(errors_1.CliodotApiError);
+        expect(() => new Events_1.Events({ baseUrl: "https://api.example.com", appId: "" })).toThrow(errors_1.CliodotApiError);
+    });
+    it("publishes with bearer api key and app id header", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, event_id: "evt_1", accepted: true },
+        });
+        const client = createClient();
+        const result = await client.publish("order.created", { id: "ord_1" }, {
+            ordering_key: "ord_1",
+        });
+        expect(result.event_id).toBe("evt_1");
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "POST",
+            url: "/v1/publish",
+            headers: {
+                Authorization: "Bearer eak_test_key",
+                "x-cliodot-app-id": "evt_app_test",
+                "x-cliodot-instance-id": "test-instance",
+            },
+            data: {
+                event: "order.created",
+                payload: { id: "ord_1" },
+                ordering_key: "ord_1",
+            },
+        }));
+    });
+    it("uses app secret headers when api key is absent", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, subscription_id: "evt_sub_1", events: ["order.created"] },
+        });
+        const client = createClient({
+            apiKey: undefined,
+            appSecret: "secret_1",
+        });
+        await client.subscribe({ events: ["order.created"], name: "checkout" });
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "POST",
+            url: "/v1/subscribe",
+            headers: {
+                "x-cliodot-app-id": "evt_app_test",
+                "x-cliodot-app-secret": "secret_1",
+                "x-cliodot-instance-id": "test-instance",
+            },
+            data: {
+                events: ["order.created"],
+                name: "checkout",
+                instance_id: "test-instance",
+            },
+        }));
+    });
+    it("unsubscribes by id", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, deleted: true },
+        });
+        const client = createClient();
+        const result = await client.unsubscribe("evt_sub_1");
+        expect(result.deleted).toBe(true);
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "DELETE",
+            url: "/v1/subscribe/evt_sub_1",
+        }));
+    });
+    it("builds browser listenUrl with query auth", () => {
+        const client = createClient();
+        const url = client.listenUrl({ events: ["order.created", "payment.completed"] });
+        expect(url).toBe("https://api.example.com/event/v1/listen?app_id=evt_app_test&access_token=eak_test_key&instance_id=test-instance&events=order.created%2Cpayment.completed");
+    });
+    it("accepts appApiKey alias", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, event_id: "evt_2", accepted: true },
+        });
+        const client = createClient({
+            apiKey: undefined,
+            appApiKey: "eak_alias",
+        });
+        await client.publish("ping", {});
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            headers: expect.objectContaining({
+                Authorization: "Bearer eak_alias",
+            }),
+        }));
+    });
+    it("auto-reconnects listen after stream ends until close", async () => {
+        jest.useFakeTimers();
+        const { EventEmitter } = require("events");
+        const stream1 = new EventEmitter();
+        const stream2 = new EventEmitter();
+        stream1.destroy = jest.fn();
+        stream2.destroy = jest.fn();
+        mockAxiosInstance
+            .mockResolvedValueOnce({ data: stream1 })
+            .mockResolvedValueOnce({ data: stream2 });
+        const client = createClient({ debug: false });
+        const messages = [];
+        const handle = client.listen({ events: ["order.created"] }, (m) => {
+            messages.push(m);
+        });
+        await Promise.resolve();
+        await Promise.resolve();
+        stream1.emit("data", Buffer.from('data: {"type":"connected","listener_id":"sse_1","events":["order.created"]}\n\n'));
+        stream1.emit("end");
+        await Promise.resolve();
+        expect(messages).toHaveLength(1);
+        await jest.advanceTimersByTimeAsync(1000);
+        await Promise.resolve();
+        await Promise.resolve();
+        stream2.emit("data", Buffer.from('data: {"type":"connected","listener_id":"sse_2","events":["order.created"]}\n\n'));
+        expect(messages).toHaveLength(2);
+        expect(mockAxiosInstance).toHaveBeenCalledTimes(2);
+        handle.close();
+        jest.useRealTimers();
+    });
+    it("does not reconnect when reconnect is false", async () => {
+        jest.useFakeTimers();
+        const { EventEmitter } = require("events");
+        const stream1 = new EventEmitter();
+        stream1.destroy = jest.fn();
+        mockAxiosInstance.mockResolvedValueOnce({ data: stream1 });
+        const client = createClient();
+        client.listen({ events: ["order.created"], reconnect: false }, () => { });
+        await Promise.resolve();
+        await Promise.resolve();
+        stream1.emit("end");
+        await Promise.resolve();
+        await jest.advanceTimersByTimeAsync(5000);
+        expect(mockAxiosInstance).toHaveBeenCalledTimes(1);
+        jest.useRealTimers();
+    });
+    it("passes environment on publish", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { ok: true, event_id: "evt_env", accepted: true },
+        });
+        const client = createClient();
+        await client.publish("order.created", { id: "1" }, { environment: "dev" });
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            data: expect.objectContaining({
+                event: "order.created",
+                environment: "dev",
+            }),
+        }));
+    });
+    it("keeps instance id stable for this client and distinct across computers", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                subscription_id: "evt_sub_1",
+                events: ["order.created"],
+                instance_id: "test-instance",
+            },
+        });
+        const sameBox = createClient();
+        await sameBox.subscribe({ events: ["order.created"] });
+        await sameBox.subscribe({ events: ["order.created"] });
+        const otherBox = createClient({ instanceId: "other-computer" });
+        await otherBox.subscribe({ events: ["order.created"] });
+        const calls = mockAxiosInstance.mock.calls.filter((c) => c[0]?.url === "/v1/subscribe");
+        expect(calls).toHaveLength(3);
+        expect(calls[0][0].data.instance_id).toBe("test-instance");
+        expect(calls[1][0].data.instance_id).toBe("test-instance");
+        expect(calls[2][0].data.instance_id).toBe("other-computer");
+        expect(sameBox.instanceId).toBe("test-instance");
+        expect(otherBox.instanceId).not.toBe(sameBox.instanceId);
+    });
+});

package/dist/__tests__/IdentityAppClient.test.js

@@ -1 +1,232 @@
-'use strict';const _0x14e0b3=_0x1ad2;(function(_0xb83ce4,_0x44682d){const _0x5a1261=_0x1ad2,_0x134ae7=_0xb83ce4();while(!![]){try{const _0x134fe0=parseInt(_0x5a1261(0x17e))/0x1+-parseInt(_0x5a1261(0x19b))/0x2*(parseInt(_0x5a1261(0x1a5))/0x3)+parseInt(_0x5a1261(0x18c))/0x4*(parseInt(_0x5a1261(0x19f))/0x5)+parseInt(_0x5a1261(0x176))/0x6*(-parseInt(_0x5a1261(0x17c))/0x7)+parseInt(_0x5a1261(0x1ae))/0x8*(parseInt(_0x5a1261(0x1a6))/0x9)+-parseInt(_0x5a1261(0x1b0))/0xa+-parseInt(_0x5a1261(0x16d))/0xb;if(_0x134fe0===_0x44682d)break;else _0x134ae7['push'](_0x134ae7['shift']());}catch(_0x3e404e){_0x134ae7['push'](_0x134ae7['shift']());}}}(_0x2f55,0x91c2a));var __importDefault=this&&this[_0x14e0b3(0x1b3)]||function(_0x17e3b5){const _0x29c9ae=_0x14e0b3;return _0x17e3b5&&_0x17e3b5[_0x29c9ae(0x188)]?_0x17e3b5:{'default':_0x17e3b5};};Object[_0x14e0b3(0x187)](exports,_0x14e0b3(0x188),{'value':!![]});function _0x1ad2(_0x31b049,_0x443475){_0x31b049=_0x31b049-0x16c;const _0x2f5568=_0x2f55();let _0x1ad277=_0x2f5568[_0x31b049];if(_0x1ad2['uucuYr']===undefined){var _0x28d7b4=function(_0x30249a){const _0x5b394e='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x17e3b5='',_0x7022ff='';for(let _0x35f292=0x0,_0x2626d8,_0x418461,_0x5801d2=0x0;_0x418461=_0x30249a['charAt'](_0x5801d2++);~_0x418461&&(_0x2626d8=_0x35f292%0x4?_0x2626d8*0x40+_0x418461:_0x418461,_0x35f292++%0x4)?_0x17e3b5+=String['fromCharCode'](0xff&_0x2626d8>>(-0x2*_0x35f292&0x6)):0x0){_0x418461=_0x5b394e['indexOf'](_0x418461);}for(let _0x120647=0x0,_0x217a63=_0x17e3b5['length'];_0x120647<_0x217a63;_0x120647++){_0x7022ff+='%'+('00'+_0x17e3b5['charCodeAt'](_0x120647)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x7022ff);};_0x1ad2['VClRCh']=_0x28d7b4,_0x1ad2['pgLVQN']={},_0x1ad2['uucuYr']=!![];}const _0x3d2429=_0x2f5568[0x0],_0x3bcace=_0x31b049+_0x3d2429,_0x15a846=_0x1ad2['pgLVQN'][_0x3bcace];return!_0x15a846?(_0x1ad277=_0x1ad2['VClRCh'](_0x1ad277),_0x1ad2['pgLVQN'][_0x3bcace]=_0x1ad277):_0x1ad277=_0x15a846,_0x1ad277;}const axios_1=__importDefault(require('axios')),crypto_1=__importDefault(require(_0x14e0b3(0x1a1))),jsonwebtoken_1=__importDefault(require(_0x14e0b3(0x16f))),IdentityAppClient_1=require(_0x14e0b3(0x193)),errors_1=require(_0x14e0b3(0x184)),identity_offline_verify_1=require(_0x14e0b3(0x16e)),identity_token_cache_1=require(_0x14e0b3(0x18f));jest[_0x14e0b3(0x177)]('axios');const mockedAxios=axios_1['default'];describe(_0x14e0b3(0x1b5),()=>{const _0x529230=_0x14e0b3,_0x7022ff=jest['fn']();beforeEach(()=>{const _0x48a0d1=_0x1ad2;jest[_0x48a0d1(0x192)](),mockedAxios['create'][_0x48a0d1(0x198)](_0x7022ff);});function _0x35f292(_0x2626d8){const _0x3aab7c=_0x1ad2;return new IdentityAppClient_1[(_0x3aab7c(0x1b5))]({'baseUrl':'https://api.example.com','appId':_0x3aab7c(0x1b2),'appApiKey':_0x3aab7c(0x1ad),..._0x2626d8});}it(_0x529230(0x17a),()=>{const _0x1badb1=_0x529230;expect(()=>new IdentityAppClient_1[(_0x1badb1(0x1b5))]({'baseUrl':'','appId':_0x1badb1(0x1b2)}))[_0x1badb1(0x19a)](errors_1[_0x1badb1(0x1a3)]),expect(()=>new IdentityAppClient_1[(_0x1badb1(0x1b5))]({'baseUrl':_0x1badb1(0x17f),'appId':''}))[_0x1badb1(0x19a)](errors_1['CliodotApiError']);}),it(_0x529230(0x1b7),async()=>{const _0x6fac07=_0x529230;_0x7022ff[_0x6fac07(0x1aa)]({'data':{'ok':!![],'access_token':_0x6fac07(0x1a7),'token_type':'Bearer','expires_in':0xe10,'caller_app_id':'identity_payroll','target_app_id':_0x6fac07(0x186)}});const _0x418461=_0x35f292(),_0x5801d2=await _0x418461[_0x6fac07(0x171)]({'target_app_id':_0x6fac07(0x186)});expect(_0x5801d2[_0x6fac07(0x199)])['toBe']('jwt'),expect(_0x7022ff)[_0x6fac07(0x185)](expect['objectContaining']({'method':_0x6fac07(0x182),'url':_0x6fac07(0x191),'headers':{'x-cliodot-app-id':_0x6fac07(0x1b2),'Authorization':_0x6fac07(0x172)},'data':{'target_app_id':'identity_hrms'}}));}),it(_0x529230(0x175),async()=>{const _0x11bd7f=_0x529230;_0x7022ff[_0x11bd7f(0x1aa)]({'data':{'ok':!![],'access_token':_0x11bd7f(0x1a7),'token_type':'Bearer','expires_in':0xe10,'caller_app_id':_0x11bd7f(0x1b2),'target_app_id':'identity_hrms'}});const _0x120647=_0x35f292();await _0x120647['authenticate']({'target_app_id':'identity_hrms','scopes':[_0x11bd7f(0x180)]}),expect(_0x7022ff)[_0x11bd7f(0x185)](expect[_0x11bd7f(0x17d)]({'data':{'target_app_id':_0x11bd7f(0x186),'scopes':[_0x11bd7f(0x180)]}})),_0x7022ff[_0x11bd7f(0x1aa)]({'data':{'ok':!![],'valid':!![],'jti':'j1','caller_app_id':_0x11bd7f(0x1b2),'target_app_id':'identity_hrms','expires_at':new Date()['toISOString'](),'claims':{'scope':_0x11bd7f(0x180)}}}),await _0x120647['verify']({'access_token':'jwt','required_scopes':[_0x11bd7f(0x180)]}),expect(_0x7022ff)[_0x11bd7f(0x185)](expect[_0x11bd7f(0x17d)]({'data':{'access_token':_0x11bd7f(0x1a7),'required_scopes':[_0x11bd7f(0x180)]}}));}),it(_0x529230(0x1a4),async()=>{const _0x8c2d90=_0x529230;_0x7022ff['mockResolvedValue']({'data':{'ok':!![],'app':{'_id':_0x8c2d90(0x1b2),'name':'Payroll','slug':_0x8c2d90(0x1b2),'tenant_id':'t1','status':_0x8c2d90(0x1a2)}}});const _0x217a63=_0x35f292({'appApiKey':undefined,'appSecret':_0x8c2d90(0x170)});await _0x217a63['me'](),expect(_0x7022ff)[_0x8c2d90(0x185)](expect[_0x8c2d90(0x17d)]({'method':_0x8c2d90(0x183),'url':_0x8c2d90(0x1b4),'headers':{'x-cliodot-app-id':_0x8c2d90(0x1b2),'x-cliodot-app-secret':_0x8c2d90(0x170)}}));}),it(_0x529230(0x1b9),async()=>{const _0x275fe3=_0x529230;_0x7022ff[_0x275fe3(0x1aa)]({'data':{'ok':![],'error':_0x275fe3(0x16c),'code':_0x275fe3(0x17b)}});const _0x2122bf=_0x35f292();await expect(_0x2122bf[_0x275fe3(0x171)]({'target_app_id':_0x275fe3(0x186)}))['rejects'][_0x275fe3(0x1a8)]({'code':_0x275fe3(0x17b)});}),it(_0x529230(0x194),async()=>{const _0x2a888f=_0x529230;_0x7022ff[_0x2a888f(0x1aa)]({'data':{'keys':[{'kid':'k1','kty':_0x2a888f(0x1bb)}]}});const _0x13b399=_0x35f292(),_0x4fb268=await _0x13b399[_0x2a888f(0x173)](_0x2a888f(0x186));expect(_0x4fb268[_0x2a888f(0x1ac)][0x0][_0x2a888f(0x195)])['toBe']('k1'),expect(_0x7022ff)[_0x2a888f(0x185)](expect[_0x2a888f(0x17d)]({'method':_0x2a888f(0x183),'url':_0x2a888f(0x19d)}));});}),describe('verifyIdentityTokenOffline',()=>{const _0xe50ff3=_0x14e0b3;beforeEach(()=>{const _0x2ee37d=_0x1ad2;(0x0,identity_offline_verify_1[_0x2ee37d(0x1a0)])();}),it(_0xe50ff3(0x190),async()=>{const _0x18e174=_0xe50ff3,_0x3f5593='ijwt_test_secret_value_1234567890',_0x11c52b=jsonwebtoken_1['default'][_0x18e174(0x189)]({'sub':_0x18e174(0x1b2),'jti':'j1','exp':Math[_0x18e174(0x1ba)](Date['now']()/0x3e8)+0x3c},_0x3f5593,{'algorithm':'HS256','noTimestamp':!![]}),_0x1bc23a=await(0x0,identity_offline_verify_1[_0x18e174(0x1b6)])(_0x11c52b,{'algorithm':'HS256','secret':_0x3f5593});expect(_0x1bc23a['jti'])[_0x18e174(0x181)]('j1');}),it(_0xe50ff3(0x18b),async()=>{const _0x5944d2=_0xe50ff3,{publicKey:_0x25835b,privateKey:_0x2e3003}=crypto_1['default'][_0x5944d2(0x19c)](_0x5944d2(0x1b1),{'modulusLength':0x800,'publicKeyEncoding':{'type':_0x5944d2(0x1bf),'format':_0x5944d2(0x1be)},'privateKeyEncoding':{'type':'pkcs8','format':_0x5944d2(0x1be)}}),_0x19751b=crypto_1[_0x5944d2(0x1a9)][_0x5944d2(0x18a)](_0x25835b)[_0x5944d2(0x18d)]({'format':'jwk'}),_0x2b434b=jsonwebtoken_1['default'][_0x5944d2(0x189)]({'sub':_0x5944d2(0x1b2),'jti':'j2','exp':Math[_0x5944d2(0x1ba)](Date[_0x5944d2(0x1b8)]()/0x3e8)+0x3c},_0x2e3003,{'algorithm':_0x5944d2(0x1c0),'keyid':_0x5944d2(0x18e),'noTimestamp':!![]}),_0x403c43=jest['fn']()[_0x5944d2(0x1aa)]({'ok':!![],'json':async()=>({'keys':[{'kty':_0x19751b[_0x5944d2(0x174)]||_0x5944d2(0x1bb),'kid':_0x5944d2(0x18e),'n':_0x19751b['n'],'e':_0x19751b['e'],'alg':_0x5944d2(0x1c0),'use':_0x5944d2(0x179)}]})}),_0x35d9fc=await(0x0,identity_offline_verify_1['verifyIdentityTokenOffline'])(_0x2b434b,{'algorithm':_0x5944d2(0x1c0),'jwksUrl':_0x5944d2(0x197),'fetch':_0x403c43});expect(_0x35d9fc['jti'])[_0x5944d2(0x181)]('j2'),expect(_0x403c43)['toHaveBeenCalled']();}),it('tokenHasScopes\x20checks\x20JWT\x20scope\x20claim',()=>{const _0x5ce3de=_0xe50ff3,_0xbf2e=jsonwebtoken_1[_0x5ce3de(0x1a9)]['sign']({'scope':_0x5ce3de(0x196),'jti':'j'},_0x5ce3de(0x1bd),{'algorithm':_0x5ce3de(0x1bc),'noTimestamp':!![]});expect((0x0,identity_offline_verify_1[_0x5ce3de(0x1ab)])(_0xbf2e,[_0x5ce3de(0x180)]))['toBe'](!![]),expect((0x0,identity_offline_verify_1[_0x5ce3de(0x1ab)])(_0xbf2e,['employees.admin']))[_0x5ce3de(0x181)](![]);});}),describe(_0x14e0b3(0x178),()=>{const _0x53b7c1=_0x14e0b3;it(_0x53b7c1(0x1c1),async()=>{const _0x23a1bb=_0x53b7c1,_0x5cc0fe=jest['fn']()[_0x23a1bb(0x1aa)]({'ok':!![],'access_token':_0x23a1bb(0x19e),'token_type':'Bearer','expires_in':0xe10,'refresh_token':'irt_1','caller_app_id':_0x23a1bb(0x1b2),'target_app_id':'identity_hrms'}),_0x51bcca=jest['fn'](),_0x2b9d3a=(0x0,identity_token_cache_1[_0x23a1bb(0x178)])({'client':{'authenticate':_0x5cc0fe,'refresh':_0x51bcca}}),_0x599643=await _0x2b9d3a[_0x23a1bb(0x1af)]('identity_hrms'),_0x362f18=await _0x2b9d3a[_0x23a1bb(0x1af)](_0x23a1bb(0x186));expect(_0x599643)[_0x23a1bb(0x181)]('at_1'),expect(_0x362f18)['toBe']('at_1'),expect(_0x5cc0fe)['toHaveBeenCalledTimes'](0x1);});});function _0x2f55(){const _0x2b56c6=['A2LK','zw1WBg95zwvZlNjLywqGzw1WBg95zwvZlNDYAxrL','Ahr0Chm6lY9HCgKUzxHHBxbSzs5JB20VAwrLBNrPDhKVDJeVyxbWCY9PzgvUDgL0Ev9OCM1Zl2P3A3mUANnVBG','Bw9JA1jLDhvYBLzHBhvL','ywnJzxnZx3rVA2vU','Dg9uAhjVDW','mM9pC25LCq','z2vUzxjHDgvlzxLqywLYu3LUyW','l3yXl2fWChmVAwrLBNrPDhLFAhjTCY9QD2TZlMPZB24','yxrFmq','nwHHzgzgyW','y2XLyxjjzgvUDgL0EuP3A3ndywnOzq','y3j5ChrV','ywn0AxzL','q2XPB2rVDefWAuvYCM9Y','DxnLCYbHChaGC2vJCMv0igHLywrLCNmGD2HLBIbUBYbHCgKGA2v5','mJeXoda1mu93Bvrfqq','mty1oduYELfTAMnP','AND0','Dg9nyxrJAe9IAMvJDa','zgvMyxvSDa','Bw9JA1jLC29SDMvKvMfSDwu','Dg9Rzw5iyxnty29Wzxm','A2v5CW','AwfRx3rLC3rFA2v5','mJy0wgj2y0zJ','z2v0qwnJzxnZvg9Rzw4','mJq2otK1mhDMBuHjzq','CNnH','AwrLBNrPDhLFCgf5CM9SBa','x19PBxbVCNrezwzHDwX0','l3yXl21L','swrLBNrPDhLbChbdBgLLBNq','DMvYAwz5swrLBNrPDhLuB2TLBK9MzMXPBMu','yxv0AgvUDgLJyxrLCYb3AxrOigjLyxjLCIbHCgKGA2v5','BM93','BwfWCYbbueKGzxjYB3iGy29Kzxm','zMXVB3i','uLnb','sfmYnty','C2vJCMv0','CgvT','C3bRAq','uLmYnty','yxv0AgvUDgLJyxrLCYb0AgvUihjLDxnLCYb1BNrPBcbUzwfYigv4CgLYEq','vgfYz2v0igfWCcbKB2vZig5VDcb0CNvZDcb0AguGy2fSBgvY','mtuXnta2m0jZCNLsqq','lI4VAwrLBNrPDhKTB2zMBgLUzs12zxjPzNK','ANnVBNDLyNrVA2vU','C2vJCMv0x2HLEa','yxv0AgvUDgLJyxrL','qMvHCMvYigLHA190zxn0x2TLEq','z2v0sNDRCW','A3r5','yxv0AgvUDgLJyxrLigfUzcb2zxjPzNKGCgfZCYbZy29Wzxm','nLHRwNL3zW','Bw9JAW','y3jLyxrLswrLBNrPDhLuB2TLBKnHy2HL','C2LN','CMvXDwLYzxmGyMfZzvvYBcbHBMqGyxbWswq','surftLrjvfLFvfjvu1rFrevosuve','mtG2mZG4m3PsEufOva','B2jQzwn0q29UDgfPBMLUzW','otm4nduZyMHVBxre','Ahr0Chm6lY9HCgKUzxHHBxbSzs5JB20','zw1WBg95zwvZlNjLywq','Dg9czq','ue9tva','r0vu','lI4VzxjYB3jZ','Dg9iyxzLqMvLBKnHBgXLzfDPDgG','AwrLBNrPDhLFAhjTCW','zgvMAw5LuhjVCgvYDhK','x19LC01VzhvSzq','C2LNBG','y3jLyxrLuhvIBgLJs2v5','DMvYAwzPzxmGuLmYntyGDMLHiePxs1mGA2LK','mtyYotG4nfvtrfzvyW','zxHWB3j0','A2LKxZe','lI4VAwrLBNrPDhKTDg9Rzw4Ty2fJAgu','DMvYAwzPzxmGsfmYntyGDg9Rzw5Z','l3yXl2f1DgHLBNrPy2f0zq','y2XLyxjbBgXnB2nRCW','lI4VswrLBNrPDhLbChbdBgLLBNq','zMv0y2HLCYbkv0TtihDPDgHVDxqGyxv0AcbOzwfKzxjZ'];_0x2f55=function(){return _0x2b56c6;};return _0x2f55();}
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const axios_1 = __importDefault(require("axios"));
+const crypto_1 = __importDefault(require("crypto"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const IdentityAppClient_1 = require("../IdentityAppClient");
+const errors_1 = require("../errors");
+const identity_offline_verify_1 = require("../identity-offline-verify");
+const identity_token_cache_1 = require("../identity-token-cache");
+jest.mock("axios");
+const mockedAxios = axios_1.default;
+describe("IdentityAppClient", () => {
+    const mockAxiosInstance = jest.fn();
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockedAxios.create.mockReturnValue(mockAxiosInstance);
+    });
+    function createClient(overrides) {
+        return new IdentityAppClient_1.IdentityAppClient({
+            baseUrl: "https://api.example.com",
+            appId: "identity_payroll",
+            appApiKey: "iak_test_key",
+            ...overrides,
+        });
+    }
+    it("requires baseUrl and appId", () => {
+        expect(() => new IdentityAppClient_1.IdentityAppClient({ baseUrl: "", appId: "identity_payroll" })).toThrow(errors_1.CliodotApiError);
+        expect(() => new IdentityAppClient_1.IdentityAppClient({
+            baseUrl: "https://api.example.com",
+            appId: "",
+        })).toThrow(errors_1.CliodotApiError);
+    });
+    it("authenticates with bearer api key", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                access_token: "jwt",
+                token_type: "Bearer",
+                expires_in: 3600,
+                caller_app_id: "identity_payroll",
+                target_app_id: "identity_hrms",
+            },
+        });
+        const client = createClient();
+        const result = await client.authenticate({
+            target_app_id: "identity_hrms",
+        });
+        expect(result.access_token).toBe("jwt");
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "POST",
+            url: "/v1/authenticate",
+            headers: {
+                "x-cliodot-app-id": "identity_payroll",
+                Authorization: "Bearer iak_test_key",
+            },
+            data: { target_app_id: "identity_hrms" },
+        }));
+    });
+    it("authenticate and verify pass scopes", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                access_token: "jwt",
+                token_type: "Bearer",
+                expires_in: 3600,
+                caller_app_id: "identity_payroll",
+                target_app_id: "identity_hrms",
+            },
+        });
+        const client = createClient();
+        await client.authenticate({
+            target_app_id: "identity_hrms",
+            scopes: ["employees.read"],
+        });
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            data: {
+                target_app_id: "identity_hrms",
+                scopes: ["employees.read"],
+            },
+        }));
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                valid: true,
+                jti: "j1",
+                caller_app_id: "identity_payroll",
+                target_app_id: "identity_hrms",
+                expires_at: new Date().toISOString(),
+                claims: { scope: "employees.read" },
+            },
+        });
+        await client.verify({
+            access_token: "jwt",
+            required_scopes: ["employees.read"],
+        });
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            data: {
+                access_token: "jwt",
+                required_scopes: ["employees.read"],
+            },
+        }));
+    });
+    it("uses app secret headers when no api key", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: true,
+                app: {
+                    _id: "identity_payroll",
+                    name: "Payroll",
+                    slug: "identity_payroll",
+                    tenant_id: "t1",
+                    status: "active",
+                },
+            },
+        });
+        const client = createClient({
+            appApiKey: undefined,
+            appSecret: "secret_hex",
+        });
+        await client.me();
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "GET",
+            url: "/v1/me",
+            headers: {
+                "x-cliodot-app-id": "identity_payroll",
+                "x-cliodot-app-secret": "secret_hex",
+            },
+        }));
+    });
+    it("maps API error codes", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: {
+                ok: false,
+                error: "Target app does not trust the caller",
+                code: "IDENTITY_TRUST_DENIED",
+            },
+        });
+        const client = createClient();
+        await expect(client.authenticate({ target_app_id: "identity_hrms" })).rejects.toMatchObject({
+            code: "IDENTITY_TRUST_DENIED",
+        });
+    });
+    it("fetches JWKS without auth headers", async () => {
+        mockAxiosInstance.mockResolvedValue({
+            data: { keys: [{ kid: "k1", kty: "RSA" }] },
+        });
+        const client = createClient();
+        const jwks = await client.getJwks("identity_hrms");
+        expect(jwks.keys[0].kid).toBe("k1");
+        expect(mockAxiosInstance).toHaveBeenCalledWith(expect.objectContaining({
+            method: "GET",
+            url: "/v1/apps/identity_hrms/jwks.json",
+        }));
+    });
+});
+describe("verifyIdentityTokenOffline", () => {
+    beforeEach(() => {
+        (0, identity_offline_verify_1.clearIdentityJwksCache)();
+    });
+    it("verifies HS256 tokens", async () => {
+        const secret = "ijwt_test_secret_value_1234567890";
+        const token = jsonwebtoken_1.default.sign({ sub: "identity_payroll", jti: "j1", exp: Math.floor(Date.now() / 1000) + 60 }, secret, { algorithm: "HS256", noTimestamp: true });
+        const claims = await (0, identity_offline_verify_1.verifyIdentityTokenOffline)(token, {
+            algorithm: "HS256",
+            secret,
+        });
+        expect(claims.jti).toBe("j1");
+    });
+    it("verifies RS256 via JWKS kid", async () => {
+        const { publicKey, privateKey } = crypto_1.default.generateKeyPairSync("rsa", {
+            modulusLength: 2048,
+            publicKeyEncoding: { type: "spki", format: "pem" },
+            privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        });
+        const jwk = crypto_1.default
+            .createPublicKey(publicKey)
+            .export({ format: "jwk" });
+        const token = jsonwebtoken_1.default.sign({ sub: "identity_payroll", jti: "j2", exp: Math.floor(Date.now() / 1000) + 60 }, privateKey, { algorithm: "RS256", keyid: "kid_1", noTimestamp: true });
+        const fetchImpl = jest.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                keys: [
+                    {
+                        kty: jwk.kty || "RSA",
+                        kid: "kid_1",
+                        n: jwk.n,
+                        e: jwk.e,
+                        alg: "RS256",
+                        use: "sig",
+                    },
+                ],
+            }),
+        });
+        const claims = await (0, identity_offline_verify_1.verifyIdentityTokenOffline)(token, {
+            algorithm: "RS256",
+            jwksUrl: "https://api.example.com/identity/v1/apps/identity_hrms/jwks.json",
+            fetch: fetchImpl,
+        });
+        expect(claims.jti).toBe("j2");
+        expect(fetchImpl).toHaveBeenCalled();
+    });
+    it("tokenHasScopes checks JWT scope claim", () => {
+        const token = jsonwebtoken_1.default.sign({ scope: "employees.read employees.write", jti: "j" }, "secret", { algorithm: "HS256", noTimestamp: true });
+        expect((0, identity_offline_verify_1.tokenHasScopes)(token, ["employees.read"])).toBe(true);
+        expect((0, identity_offline_verify_1.tokenHasScopes)(token, ["employees.admin"])).toBe(false);
+    });
+});
+describe("createIdentityTokenCache", () => {
+    it("authenticates then reuses until near expiry", async () => {
+        const authenticate = jest.fn().mockResolvedValue({
+            ok: true,
+            access_token: "at_1",
+            token_type: "Bearer",
+            expires_in: 3600,
+            refresh_token: "irt_1",
+            caller_app_id: "identity_payroll",
+            target_app_id: "identity_hrms",
+        });
+        const refresh = jest.fn();
+        const cache = (0, identity_token_cache_1.createIdentityTokenCache)({
+            client: { authenticate, refresh },
+        });
+        const first = await cache.getAccessToken("identity_hrms");
+        const second = await cache.getAccessToken("identity_hrms");
+        expect(first).toBe("at_1");
+        expect(second).toBe("at_1");
+        expect(authenticate).toHaveBeenCalledTimes(1);
+    });
+});