@authowl/core 0.10.0

package/dist/server.d.ts

@@ -0,0 +1,2757 @@
+import { O as OrganizationMembership, a as TransportErrorKind, H as HasParams } from './transport-BObDKlIh.js';
+export { A as AuthConfig, R as ResolvedAuthConfig, r as resolveConfig, s as sessionCookieName } from './transport-BObDKlIh.js';
+
+/**
+ * Stateless verification of an AuthOwl project JWT for SERVER-side authorization
+ * (plan §5). This is the REAL enforcement primitive: unlike the client
+ * `<Protect>`/`has()` (advisory, over the browser session), this verifies the
+ * token's ES256 signature against the project's published JWKS and checks
+ * issuer / audience / expiry before reading any claim. A forged or tampered
+ * token fails verification, so no permission is ever granted off an unverified
+ * claim.
+ *
+ * Dependency-free: uses WebCrypto (`globalThis.crypto.subtle`), available in
+ * Node 18+ and the Edge runtime, so `@authowl/next` stays lean and Edge-safe.
+ */
+
+interface VerifiedProjectToken {
+    /** The token subject (the signed-in user id), or null if absent. */
+    sub: string | null;
+    /** The active-org membership carried by the token, or null if none/absent. */
+    membership: OrganizationMembership | null;
+    /** The full verified claim set, for callers that read additional claims. */
+    claims: Record<string, unknown>;
+}
+interface VerifyProjectTokenOptions {
+    /** Expected `iss` - the project's AuthOwl auth base URL. */
+    issuer: string;
+    /** The project's published JWKS URL. */
+    jwksUri: string;
+    /** Expected `aud` - the project id. */
+    audience: string;
+    /** Clock skew tolerance for exp/nbf, in seconds (default 60). */
+    clockToleranceSeconds?: number;
+}
+declare class TokenVerificationError extends Error {
+    readonly code: TokenVerificationErrorCode;
+    constructor(message: string, code?: TokenVerificationErrorCode);
+}
+type TokenVerificationErrorCode = 'TOKEN_VERIFICATION_FAILED' | 'TOKEN_CONFIG_INVALID' | 'TOKEN_MALFORMED' | 'TOKEN_ALGORITHM_UNSUPPORTED' | 'TOKEN_SIGNATURE_INVALID' | 'TOKEN_CLAIM_INVALID' | 'JWKS_FETCH_FAILED' | 'JWKS_FETCH_TIMEOUT' | 'JWKS_HTTP_ERROR' | 'JWKS_RESPONSE_TOO_LARGE' | 'JWKS_DOCUMENT_INVALID' | 'JWKS_TOO_MANY_KEYS' | 'JWKS_KEY_INVALID' | 'JWKS_DUPLICATE_KID' | 'JWKS_KEY_NOT_FOUND' | 'WEBCRYPTO_UNAVAILABLE';
+/**
+ * Verify an AuthOwl project JWT and return its subject, membership, and claims.
+ * Throws {@link TokenVerificationError} on any failure (bad signature, wrong
+ * issuer/audience, expired, unsupported alg, missing key).
+ */
+declare function verifyProjectToken(token: string, options: VerifyProjectTokenOptions): Promise<VerifiedProjectToken>;
+
+interface paths {
+    readonly "/openapi.json": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /** Get this OpenAPI document */
+        readonly get: operations["getOpenApiDocument"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/users": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /** List or search users */
+        readonly get: operations["listUsers"];
+        readonly put?: never;
+        /** Create a user */
+        readonly post: operations["createUser"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/users/export": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /** Start a project user export */
+        readonly post: operations["startUserExport"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/users/{userId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Get a user */
+        readonly get: operations["getUser"];
+        readonly put?: never;
+        readonly post?: never;
+        /** Delete a user */
+        readonly delete: operations["deleteUser"];
+        readonly options?: never;
+        readonly head?: never;
+        /** Update a user */
+        readonly patch: operations["updateUser"];
+        readonly trace?: never;
+    };
+    readonly "/users/{userId}/sessions": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        /** List a user's sessions */
+        readonly get: operations["listUserSessions"];
+        readonly put?: never;
+        readonly post?: never;
+        /** Revoke all sessions for a user */
+        readonly delete: operations["revokeUserSessions"];
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/users/{userId}/metadata": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        /** Patch user metadata with optimistic concurrency */
+        readonly patch: operations["updateUserMetadata"];
+        readonly trace?: never;
+    };
+    readonly "/sessions/verify": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /** Verify a session token */
+        readonly post: operations["verifySession"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/sessions/{sessionId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly sessionId: components["parameters"]["SessionId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Get one session */
+        readonly get: operations["getSession"];
+        readonly put?: never;
+        readonly post?: never;
+        /** Revoke one session */
+        readonly delete: operations["revokeSession"];
+        readonly options?: never;
+        readonly head?: never;
+        /** Patch server-authored session metadata with optimistic concurrency */
+        readonly patch: operations["updateSessionMetadata"];
+        readonly trace?: never;
+    };
+    readonly "/organizations": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /** List organizations */
+        readonly get: operations["listOrganizations"];
+        readonly put?: never;
+        /** Create an organization */
+        readonly post: operations["createOrganization"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/organizations/{organizationId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Get an organization */
+        readonly get: operations["getOrganization"];
+        readonly put?: never;
+        readonly post?: never;
+        /** Delete an organization */
+        readonly delete: operations["deleteOrganization"];
+        readonly options?: never;
+        readonly head?: never;
+        /** Update an organization */
+        readonly patch: operations["updateOrganization"];
+        readonly trace?: never;
+    };
+    readonly "/organizations/{organizationId}/members": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        /** List organization members */
+        readonly get: operations["listOrganizationMembers"];
+        readonly put?: never;
+        /** Add an organization member */
+        readonly post: operations["addOrganizationMember"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/organizations/{organizationId}/members/{userId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        readonly post?: never;
+        /** Remove an organization member */
+        readonly delete: operations["removeOrganizationMember"];
+        readonly options?: never;
+        readonly head?: never;
+        /** Change an organization member's role */
+        readonly patch: operations["updateOrganizationMember"];
+        readonly trace?: never;
+    };
+    readonly "/organizations/{organizationId}/roles": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        /** List custom roles */
+        readonly get: operations["listOrganizationRoles"];
+        readonly put?: never;
+        /** Create a custom role */
+        readonly post: operations["createOrganizationRole"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/organizations/{organizationId}/roles/{roleId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+                readonly roleId: components["parameters"]["RoleId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        readonly post?: never;
+        /** Delete a custom role */
+        readonly delete: operations["deleteOrganizationRole"];
+        readonly options?: never;
+        readonly head?: never;
+        /** Update a custom role */
+        readonly patch: operations["updateOrganizationRole"];
+        readonly trace?: never;
+    };
+    readonly "/invitations": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /** List invitations */
+        readonly get: operations["listInvitations"];
+        readonly put?: never;
+        /** Invite a user to an organization */
+        readonly post: operations["createInvitation"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/invitations/{invitationId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly invitationId: components["parameters"]["InvitationId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Get an invitation */
+        readonly get: operations["getInvitation"];
+        readonly put?: never;
+        readonly post?: never;
+        /** Revoke an invitation */
+        readonly delete: operations["revokeInvitation"];
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/events": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /** List audit events */
+        readonly get: operations["listEvents"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/stats/overview": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /** Get project usage statistics */
+        readonly get: operations["getStatsOverview"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/webhooks": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /** List webhook endpoints */
+        readonly get: operations["listWebhookEndpoints"];
+        readonly put?: never;
+        /**
+         * Create a webhook endpoint
+         * @description The signing secret is returned only in this response.
+         */
+        readonly post: operations["createWebhookEndpoint"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/webhooks/{webhookId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Get a webhook endpoint */
+        readonly get: operations["getWebhookEndpoint"];
+        readonly put?: never;
+        readonly post?: never;
+        /** Delete a webhook endpoint */
+        readonly delete: operations["deleteWebhookEndpoint"];
+        readonly options?: never;
+        readonly head?: never;
+        /** Update a webhook endpoint */
+        readonly patch: operations["updateWebhookEndpoint"];
+        readonly trace?: never;
+    };
+    readonly "/webhooks/{webhookId}/rotate-secret": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Rotate a webhook signing secret
+         * @description During the returned overlap window, deliveries include signatures from both the new and previous secret.
+         */
+        readonly post: operations["rotateWebhookSecret"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/webhooks/{webhookId}/pause": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /** Pause a webhook endpoint */
+        readonly post: operations["pauseWebhookEndpoint"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/webhooks/{webhookId}/resume": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /** Resume a webhook endpoint */
+        readonly post: operations["resumeWebhookEndpoint"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/webhooks/{webhookId}/test": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Queue a test webhook delivery
+         * @description Queues one synthetic `webhook.test` event without changing endpoint health, including while the endpoint is paused.
+         */
+        readonly post: operations["testWebhookEndpoint"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/webhook-deliveries": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /** List webhook delivery attempts */
+        readonly get: operations["listWebhookDeliveries"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/webhook-deliveries/{deliveryId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly deliveryId: components["parameters"]["DeliveryId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Inspect a webhook delivery attempt */
+        readonly get: operations["getWebhookDelivery"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/webhook-deliveries/{deliveryId}/replay": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly deliveryId: components["parameters"]["DeliveryId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Replay an immutable webhook event as a new attempt
+         * @description Starts a new delivery cycle with the original immutable event ID so consumers can deduplicate safely.
+         */
+        readonly post: operations["replayWebhookDelivery"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+}
+interface components {
+    schemas: {
+        readonly Problem: {
+            /** Format: uri */
+            readonly type: string;
+            readonly title: string;
+            readonly status: number;
+            readonly detail: string;
+            /** Format: uri */
+            readonly instance: string;
+            readonly code: string;
+        } & {
+            readonly [key: string]: unknown;
+        };
+        readonly User: {
+            readonly id: string;
+            /** Format: email */
+            readonly email: string;
+            readonly phone: string | null;
+            readonly name: string | null;
+            /** Format: uri */
+            readonly image: string | null;
+            readonly email_verified: boolean;
+            readonly banned: boolean;
+            readonly public_metadata: components["schemas"]["MetadataObject"];
+            readonly private_metadata: components["schemas"]["MetadataObject"];
+            readonly unsafe_metadata: components["schemas"]["MetadataObject"];
+            readonly metadata_version: number;
+            /** Format: date-time */
+            readonly created_at: string;
+            /** Format: date-time */
+            readonly updated_at: string;
+        };
+        readonly CreateUser: {
+            /** Format: email */
+            readonly email: string;
+            readonly password?: string;
+            readonly name?: string;
+            readonly phone?: string;
+        };
+        readonly UpdateUser: {
+            /** Format: email */
+            readonly email?: string;
+            readonly name?: string | null;
+            readonly phone?: string | null;
+            readonly banned?: boolean;
+        };
+        /** @description JSON metadata object. Reserved prototype keys and the authowl_ prefix are rejected at every depth. Encoded object size is limited to 8192 bytes. */
+        readonly MetadataObject: {
+            readonly [key: string]: unknown;
+        };
+        readonly UserMetadata: {
+            readonly public_metadata: components["schemas"]["MetadataObject"];
+            readonly private_metadata: components["schemas"]["MetadataObject"];
+            readonly unsafe_metadata: components["schemas"]["MetadataObject"];
+            readonly metadata_version: number;
+        };
+        readonly UpdateUserMetadata: {
+            readonly expected_version: number;
+            readonly public_metadata?: components["schemas"]["MetadataObject"];
+            readonly private_metadata?: components["schemas"]["MetadataObject"];
+            readonly unsafe_metadata?: components["schemas"]["MetadataObject"];
+        };
+        readonly Session: {
+            readonly id: string;
+            readonly user_id: string;
+            /** Format: date-time */
+            readonly expires_at: string;
+            /** Format: date-time */
+            readonly created_at: string;
+            readonly ip_address?: string | null;
+            readonly user_agent?: string | null;
+            readonly metadata: components["schemas"]["MetadataObject"];
+            readonly metadata_version: number;
+        };
+        readonly SessionMetadata: {
+            readonly metadata: components["schemas"]["MetadataObject"];
+            readonly metadata_version: number;
+        };
+        readonly UpdateSessionMetadata: {
+            readonly expected_version: number;
+            readonly metadata: components["schemas"]["MetadataObject"];
+        };
+        readonly Organization: {
+            readonly id: string;
+            readonly name: string;
+            readonly slug: string;
+            /** Format: uri */
+            readonly logo?: string | null;
+            readonly metadata?: Record<string, never> | null;
+            /** Format: date-time */
+            readonly created_at: string;
+        };
+        readonly CreateOrganization: {
+            readonly name: string;
+            readonly slug: string;
+            /** Format: uri */
+            readonly logo?: string;
+            readonly metadata?: Record<string, never>;
+        };
+        readonly UpdateOrganization: {
+            readonly name?: string;
+            readonly slug?: string;
+            /** Format: uri */
+            readonly logo?: string | null;
+            readonly metadata?: Record<string, never> | null;
+        };
+        readonly OrganizationMember: {
+            readonly organization_id: string;
+            readonly user_id: string;
+            readonly role: string;
+            /** Format: date-time */
+            readonly created_at: string;
+        };
+        readonly AddMember: {
+            readonly user_id: string;
+            readonly role: string;
+        };
+        readonly OrganizationRole: {
+            readonly id: string;
+            readonly organization_id: string;
+            readonly name: string;
+            readonly permissions: readonly components["schemas"]["OrganizationPermissionId"][];
+        };
+        /** @enum {string} */
+        readonly OrganizationPermissionId: "organization:update" | "organization:delete" | "member:create" | "member:update" | "member:delete" | "invitation:create" | "invitation:cancel" | "team:create" | "team:update" | "team:delete" | "ac:create" | "ac:read" | "ac:update" | "ac:delete";
+        readonly RoleInput: {
+            readonly name: string;
+            readonly permissions: readonly components["schemas"]["OrganizationPermissionId"][];
+        };
+        readonly Invitation: {
+            readonly id: string;
+            readonly organization_id: string;
+            /** Format: email */
+            readonly email: string;
+            readonly role: string;
+            readonly status: string;
+            /** Format: date-time */
+            readonly expires_at: string;
+        };
+        readonly CreateInvitation: {
+            readonly organization_id: string;
+            /** Format: email */
+            readonly email: string;
+            readonly role: string;
+        };
+        readonly Event: {
+            readonly id: string;
+            readonly type: string;
+            readonly status: string;
+            readonly user_id?: string | null;
+            readonly metadata?: Record<string, never>;
+            /** Format: date-time */
+            readonly created_at: string;
+        };
+        readonly StatsOverview: {
+            readonly users_total: number;
+            readonly monthly_active_users: number;
+            readonly recent_sign_ins: number;
+        };
+        readonly WebhookInput: {
+            /** Format: uri */
+            readonly url: string;
+            readonly description?: string;
+            readonly events: readonly components["schemas"]["WebhookSubscriptionEventType"][];
+        };
+        /** @enum {string} */
+        readonly WebhookSubscriptionEventType: "user.created" | "user.updated" | "user.deleted" | "user.banned" | "session.created" | "session.updated" | "session.revoked" | "organization.created" | "organization.updated" | "organization.deleted" | "organization_membership.created" | "organization_membership.deleted" | "mfa.enrolled" | "mfa.reset";
+        /** @enum {string} */
+        readonly WebhookEventType: "user.created" | "user.updated" | "user.deleted" | "user.banned" | "session.created" | "session.updated" | "session.revoked" | "organization.created" | "organization.updated" | "organization.deleted" | "organization_membership.created" | "organization_membership.deleted" | "mfa.enrolled" | "mfa.reset" | "webhook.test";
+        readonly WebhookEndpoint: {
+            /** Format: uuid */
+            readonly id: string;
+            /** Format: uri */
+            readonly url: string;
+            readonly description?: string | null;
+            readonly events: readonly components["schemas"]["WebhookSubscriptionEventType"][];
+            /** @enum {string} */
+            readonly status: "active" | "paused" | "auto_paused";
+            /** Format: date-time */
+            readonly created_at: string;
+            /** Format: date-time */
+            readonly updated_at: string;
+        };
+        readonly WebhookSecret: {
+            readonly secret: string;
+            /** Format: date-time */
+            readonly overlap_expires_at: string;
+        };
+        readonly WebhookWithSecret: {
+            readonly endpoint: components["schemas"]["WebhookEndpoint"];
+            readonly secret: string;
+        };
+        readonly WebhookDelivery: {
+            /** Format: uuid */
+            readonly id: string;
+            /** Format: uuid */
+            readonly event_id: string;
+            /** Format: uuid */
+            readonly attempt_id: string;
+            readonly attempt_number: number;
+            /** Format: uuid */
+            readonly webhook_id: string;
+            readonly event_type: components["schemas"]["WebhookEventType"];
+            /** @enum {string} */
+            readonly status: "queued" | "delivering" | "succeeded" | "failed";
+            readonly response_status: number | null;
+            readonly response_body: string | null;
+            readonly error_code: string | null;
+            /** Format: date-time */
+            readonly created_at: string;
+            /** Format: date-time */
+            readonly delivered_at: string | null;
+        };
+        readonly ExportJob: {
+            /** Format: uuid */
+            readonly id: string;
+            /** @enum {string} */
+            readonly status: "pending" | "processing" | "completed" | "failed";
+            /** Format: date-time */
+            readonly created_at: string;
+        };
+        readonly Page: {
+            readonly data: readonly unknown[];
+            readonly next_cursor: string | null;
+        };
+        readonly UserPage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["User"][];
+        };
+        readonly SessionPage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["Session"][];
+        };
+        readonly OrganizationPage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["Organization"][];
+        };
+        readonly MemberPage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["OrganizationMember"][];
+        };
+        readonly RolePage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["OrganizationRole"][];
+        };
+        readonly InvitationPage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["Invitation"][];
+        };
+        readonly EventPage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["Event"][];
+        };
+        readonly WebhookPage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["WebhookEndpoint"][];
+        };
+        readonly DeliveryPage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["WebhookDelivery"][];
+        };
+    };
+    responses: {
+        /** @description Invalid request */
+        readonly InvalidRequest: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/problem+json": components["schemas"]["Problem"];
+            };
+        };
+        /** @description Missing, invalid, or publishable key */
+        readonly Unauthorized: {
+            headers: {
+                readonly "WWW-Authenticate"?: string;
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/problem+json": components["schemas"]["Problem"];
+            };
+        };
+        /** @description Secret key lacks the required scope */
+        readonly Forbidden: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/problem+json": components["schemas"]["Problem"];
+            };
+        };
+        /** @description Resource is missing or belongs to another project */
+        readonly NotFound: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/problem+json": components["schemas"]["Problem"];
+            };
+        };
+        /** @description Metadata changed since the supplied version was read */
+        readonly VersionConflict: {
+            headers: {
+                readonly "X-AuthOwl-Metadata-Version"?: number;
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/problem+json": components["schemas"]["Problem"];
+            };
+        };
+        /** @description Plan rate limit exceeded */
+        readonly RateLimited: {
+            headers: {
+                readonly "Retry-After"?: number;
+                readonly "X-RateLimit-Limit"?: number;
+                readonly "X-RateLimit-Remaining"?: number;
+                readonly "X-RateLimit-Reset"?: number;
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/problem+json": components["schemas"]["Problem"];
+            };
+        };
+        /** @description User page */
+        readonly UserPage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["UserPage"];
+            };
+        };
+        /** @description Session page */
+        readonly SessionPage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["SessionPage"];
+            };
+        };
+        /** @description Organization page */
+        readonly OrganizationPage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["OrganizationPage"];
+            };
+        };
+        /** @description Organization member page */
+        readonly MemberPage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["MemberPage"];
+            };
+        };
+        /** @description Organization role page */
+        readonly RolePage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["RolePage"];
+            };
+        };
+        /** @description Invitation page */
+        readonly InvitationPage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["InvitationPage"];
+            };
+        };
+        /** @description Event page */
+        readonly EventPage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["EventPage"];
+            };
+        };
+        /** @description Webhook endpoint page */
+        readonly WebhookPage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["WebhookPage"];
+            };
+        };
+        /** @description Webhook delivery page */
+        readonly DeliveryPage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["DeliveryPage"];
+            };
+        };
+    };
+    parameters: {
+        readonly Limit: number;
+        readonly Cursor: string;
+        readonly UserId: string;
+        readonly SessionId: string;
+        readonly OrganizationId: string;
+        readonly RoleId: string;
+        readonly InvitationId: string;
+        readonly WebhookId: string;
+        readonly DeliveryId: string;
+    };
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+interface operations {
+    readonly getOpenApiDocument: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description OpenAPI document */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": Record<string, never>;
+                };
+            };
+        };
+    };
+    readonly listUsers: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+                readonly query?: string;
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["UserPage"];
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly createUser: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["CreateUser"];
+            };
+        };
+        readonly responses: {
+            /** @description User created */
+            readonly 201: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["User"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly startUserExport: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Export accepted */
+            readonly 202: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["ExportJob"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getUser: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description User */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["User"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly deleteUser: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description User deleted */
+            readonly 204: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly updateUser: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["UpdateUser"];
+            };
+        };
+        readonly responses: {
+            /** @description Updated user */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["User"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly listUserSessions: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+            };
+            readonly header?: never;
+            readonly path: {
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["SessionPage"];
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly revokeUserSessions: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Sessions revoked */
+            readonly 204: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly updateUserMetadata: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["UpdateUserMetadata"];
+            };
+        };
+        readonly responses: {
+            /** @description Updated user metadata */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["UserMetadata"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 409: components["responses"]["VersionConflict"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly verifySession: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": {
+                    readonly token: string;
+                };
+            };
+        };
+        readonly responses: {
+            /** @description Verified session and user */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": {
+                        readonly user: components["schemas"]["User"];
+                        readonly session: components["schemas"]["Session"];
+                    };
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getSession: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly sessionId: components["parameters"]["SessionId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Session */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["Session"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly revokeSession: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly sessionId: components["parameters"]["SessionId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Session revoked */
+            readonly 204: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly updateSessionMetadata: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly sessionId: components["parameters"]["SessionId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["UpdateSessionMetadata"];
+            };
+        };
+        readonly responses: {
+            /** @description Updated session metadata */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["SessionMetadata"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 409: components["responses"]["VersionConflict"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly listOrganizations: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["OrganizationPage"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly createOrganization: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["CreateOrganization"];
+            };
+        };
+        readonly responses: {
+            /** @description Organization created */
+            readonly 201: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["Organization"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getOrganization: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Organization */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["Organization"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly deleteOrganization: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Organization deleted */
+            readonly 204: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly updateOrganization: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["UpdateOrganization"];
+            };
+        };
+        readonly responses: {
+            /** @description Updated organization */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["Organization"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly listOrganizationMembers: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+            };
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["MemberPage"];
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly addOrganizationMember: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["AddMember"];
+            };
+        };
+        readonly responses: {
+            /** @description Member added */
+            readonly 201: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["OrganizationMember"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly removeOrganizationMember: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Member removed */
+            readonly 204: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly updateOrganizationMember: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+                readonly userId: components["parameters"]["UserId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": {
+                    readonly role: string;
+                };
+            };
+        };
+        readonly responses: {
+            /** @description Updated membership */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["OrganizationMember"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly listOrganizationRoles: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+            };
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["RolePage"];
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly createOrganizationRole: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["RoleInput"];
+            };
+        };
+        readonly responses: {
+            /** @description Role created */
+            readonly 201: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["OrganizationRole"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly deleteOrganizationRole: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+                readonly roleId: components["parameters"]["RoleId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Role deleted */
+            readonly 204: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly updateOrganizationRole: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly organizationId: components["parameters"]["OrganizationId"];
+                readonly roleId: components["parameters"]["RoleId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["RoleInput"];
+            };
+        };
+        readonly responses: {
+            /** @description Updated role */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["OrganizationRole"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly listInvitations: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["InvitationPage"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly createInvitation: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["CreateInvitation"];
+            };
+        };
+        readonly responses: {
+            /** @description Invitation created */
+            readonly 201: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["Invitation"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getInvitation: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly invitationId: components["parameters"]["InvitationId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Invitation */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["Invitation"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly revokeInvitation: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly invitationId: components["parameters"]["InvitationId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Invitation revoked */
+            readonly 204: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly listEvents: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+                readonly type?: string;
+                readonly user_id?: string;
+                readonly since?: string;
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["EventPage"];
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getStatsOverview: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Project statistics */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["StatsOverview"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly listWebhookEndpoints: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["WebhookPage"];
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly createWebhookEndpoint: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["WebhookInput"];
+            };
+        };
+        readonly responses: {
+            /** @description Endpoint and one-time signing secret */
+            readonly 201: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["WebhookWithSecret"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getWebhookEndpoint: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Webhook endpoint */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["WebhookEndpoint"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly deleteWebhookEndpoint: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Endpoint deleted */
+            readonly 204: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content?: never;
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly updateWebhookEndpoint: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["WebhookInput"];
+            };
+        };
+        readonly responses: {
+            /** @description Updated endpoint */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["WebhookEndpoint"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly rotateWebhookSecret: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description New one-time signing secret and old-secret overlap expiry */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["WebhookSecret"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly pauseWebhookEndpoint: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Paused endpoint */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["WebhookEndpoint"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly resumeWebhookEndpoint: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Active endpoint */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["WebhookEndpoint"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly testWebhookEndpoint: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly webhookId: components["parameters"]["WebhookId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Test delivery queued */
+            readonly 202: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["WebhookDelivery"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly listWebhookDeliveries: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+                readonly webhook_id?: string;
+                readonly status?: "queued" | "delivering" | "succeeded" | "failed";
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["DeliveryPage"];
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getWebhookDelivery: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly deliveryId: components["parameters"]["DeliveryId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Delivery attempt */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["WebhookDelivery"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly replayWebhookDelivery: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly deliveryId: components["parameters"]["DeliveryId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Replay queued */
+            readonly 202: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["WebhookDelivery"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+}
+
+/**
+ * Generated from packages/auth-core/openapi/v1.json.
+ * Do not edit directly. Run `pnpm admin:generate`.
+ */
+declare const ADMIN_API_SPEC_SHA256 = "dc1953d9d9b9e1f7002fa045f12788280e5865bacfda94b1d133e9580aa87d62";
+declare const adminOperations: {
+    readonly getOpenApiDocument: {
+        readonly method: "GET";
+        readonly path: "/openapi.json";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly type: "object";
+            };
+        };
+    };
+    readonly listUsers: {
+        readonly method: "GET";
+        readonly path: "/users";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/UserPage";
+            };
+        };
+    };
+    readonly createUser: {
+        readonly method: "POST";
+        readonly path: "/users";
+        readonly successStatuses: readonly [201];
+        readonly responseSchemas: {
+            readonly "201": {
+                readonly $ref: "#/components/schemas/User";
+            };
+        };
+    };
+    readonly startUserExport: {
+        readonly method: "POST";
+        readonly path: "/users/export";
+        readonly successStatuses: readonly [202];
+        readonly responseSchemas: {
+            readonly "202": {
+                readonly $ref: "#/components/schemas/ExportJob";
+            };
+        };
+    };
+    readonly getUser: {
+        readonly method: "GET";
+        readonly path: "/users/{userId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/User";
+            };
+        };
+    };
+    readonly updateUser: {
+        readonly method: "PATCH";
+        readonly path: "/users/{userId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/User";
+            };
+        };
+    };
+    readonly deleteUser: {
+        readonly method: "DELETE";
+        readonly path: "/users/{userId}";
+        readonly successStatuses: readonly [204];
+        readonly responseSchemas: {
+            readonly "204": null;
+        };
+    };
+    readonly listUserSessions: {
+        readonly method: "GET";
+        readonly path: "/users/{userId}/sessions";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/SessionPage";
+            };
+        };
+    };
+    readonly revokeUserSessions: {
+        readonly method: "DELETE";
+        readonly path: "/users/{userId}/sessions";
+        readonly successStatuses: readonly [204];
+        readonly responseSchemas: {
+            readonly "204": null;
+        };
+    };
+    readonly updateUserMetadata: {
+        readonly method: "PATCH";
+        readonly path: "/users/{userId}/metadata";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/UserMetadata";
+            };
+        };
+    };
+    readonly verifySession: {
+        readonly method: "POST";
+        readonly path: "/sessions/verify";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly type: "object";
+                readonly required: readonly ["user", "session"];
+                readonly properties: {
+                    readonly user: {
+                        readonly $ref: "#/components/schemas/User";
+                    };
+                    readonly session: {
+                        readonly $ref: "#/components/schemas/Session";
+                    };
+                };
+            };
+        };
+    };
+    readonly getSession: {
+        readonly method: "GET";
+        readonly path: "/sessions/{sessionId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/Session";
+            };
+        };
+    };
+    readonly updateSessionMetadata: {
+        readonly method: "PATCH";
+        readonly path: "/sessions/{sessionId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/SessionMetadata";
+            };
+        };
+    };
+    readonly revokeSession: {
+        readonly method: "DELETE";
+        readonly path: "/sessions/{sessionId}";
+        readonly successStatuses: readonly [204];
+        readonly responseSchemas: {
+            readonly "204": null;
+        };
+    };
+    readonly listOrganizations: {
+        readonly method: "GET";
+        readonly path: "/organizations";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/OrganizationPage";
+            };
+        };
+    };
+    readonly createOrganization: {
+        readonly method: "POST";
+        readonly path: "/organizations";
+        readonly successStatuses: readonly [201];
+        readonly responseSchemas: {
+            readonly "201": {
+                readonly $ref: "#/components/schemas/Organization";
+            };
+        };
+    };
+    readonly getOrganization: {
+        readonly method: "GET";
+        readonly path: "/organizations/{organizationId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/Organization";
+            };
+        };
+    };
+    readonly updateOrganization: {
+        readonly method: "PATCH";
+        readonly path: "/organizations/{organizationId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/Organization";
+            };
+        };
+    };
+    readonly deleteOrganization: {
+        readonly method: "DELETE";
+        readonly path: "/organizations/{organizationId}";
+        readonly successStatuses: readonly [204];
+        readonly responseSchemas: {
+            readonly "204": null;
+        };
+    };
+    readonly listOrganizationMembers: {
+        readonly method: "GET";
+        readonly path: "/organizations/{organizationId}/members";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/MemberPage";
+            };
+        };
+    };
+    readonly addOrganizationMember: {
+        readonly method: "POST";
+        readonly path: "/organizations/{organizationId}/members";
+        readonly successStatuses: readonly [201];
+        readonly responseSchemas: {
+            readonly "201": {
+                readonly $ref: "#/components/schemas/OrganizationMember";
+            };
+        };
+    };
+    readonly updateOrganizationMember: {
+        readonly method: "PATCH";
+        readonly path: "/organizations/{organizationId}/members/{userId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/OrganizationMember";
+            };
+        };
+    };
+    readonly removeOrganizationMember: {
+        readonly method: "DELETE";
+        readonly path: "/organizations/{organizationId}/members/{userId}";
+        readonly successStatuses: readonly [204];
+        readonly responseSchemas: {
+            readonly "204": null;
+        };
+    };
+    readonly listOrganizationRoles: {
+        readonly method: "GET";
+        readonly path: "/organizations/{organizationId}/roles";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/RolePage";
+            };
+        };
+    };
+    readonly createOrganizationRole: {
+        readonly method: "POST";
+        readonly path: "/organizations/{organizationId}/roles";
+        readonly successStatuses: readonly [201];
+        readonly responseSchemas: {
+            readonly "201": {
+                readonly $ref: "#/components/schemas/OrganizationRole";
+            };
+        };
+    };
+    readonly updateOrganizationRole: {
+        readonly method: "PATCH";
+        readonly path: "/organizations/{organizationId}/roles/{roleId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/OrganizationRole";
+            };
+        };
+    };
+    readonly deleteOrganizationRole: {
+        readonly method: "DELETE";
+        readonly path: "/organizations/{organizationId}/roles/{roleId}";
+        readonly successStatuses: readonly [204];
+        readonly responseSchemas: {
+            readonly "204": null;
+        };
+    };
+    readonly listInvitations: {
+        readonly method: "GET";
+        readonly path: "/invitations";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/InvitationPage";
+            };
+        };
+    };
+    readonly createInvitation: {
+        readonly method: "POST";
+        readonly path: "/invitations";
+        readonly successStatuses: readonly [201];
+        readonly responseSchemas: {
+            readonly "201": {
+                readonly $ref: "#/components/schemas/Invitation";
+            };
+        };
+    };
+    readonly getInvitation: {
+        readonly method: "GET";
+        readonly path: "/invitations/{invitationId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/Invitation";
+            };
+        };
+    };
+    readonly revokeInvitation: {
+        readonly method: "DELETE";
+        readonly path: "/invitations/{invitationId}";
+        readonly successStatuses: readonly [204];
+        readonly responseSchemas: {
+            readonly "204": null;
+        };
+    };
+    readonly listEvents: {
+        readonly method: "GET";
+        readonly path: "/events";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/EventPage";
+            };
+        };
+    };
+    readonly getStatsOverview: {
+        readonly method: "GET";
+        readonly path: "/stats/overview";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/StatsOverview";
+            };
+        };
+    };
+    readonly listWebhookEndpoints: {
+        readonly method: "GET";
+        readonly path: "/webhooks";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/WebhookPage";
+            };
+        };
+    };
+    readonly createWebhookEndpoint: {
+        readonly method: "POST";
+        readonly path: "/webhooks";
+        readonly successStatuses: readonly [201];
+        readonly responseSchemas: {
+            readonly "201": {
+                readonly $ref: "#/components/schemas/WebhookWithSecret";
+            };
+        };
+    };
+    readonly getWebhookEndpoint: {
+        readonly method: "GET";
+        readonly path: "/webhooks/{webhookId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/WebhookEndpoint";
+            };
+        };
+    };
+    readonly updateWebhookEndpoint: {
+        readonly method: "PATCH";
+        readonly path: "/webhooks/{webhookId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/WebhookEndpoint";
+            };
+        };
+    };
+    readonly deleteWebhookEndpoint: {
+        readonly method: "DELETE";
+        readonly path: "/webhooks/{webhookId}";
+        readonly successStatuses: readonly [204];
+        readonly responseSchemas: {
+            readonly "204": null;
+        };
+    };
+    readonly rotateWebhookSecret: {
+        readonly method: "POST";
+        readonly path: "/webhooks/{webhookId}/rotate-secret";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/WebhookSecret";
+            };
+        };
+    };
+    readonly pauseWebhookEndpoint: {
+        readonly method: "POST";
+        readonly path: "/webhooks/{webhookId}/pause";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/WebhookEndpoint";
+            };
+        };
+    };
+    readonly resumeWebhookEndpoint: {
+        readonly method: "POST";
+        readonly path: "/webhooks/{webhookId}/resume";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/WebhookEndpoint";
+            };
+        };
+    };
+    readonly testWebhookEndpoint: {
+        readonly method: "POST";
+        readonly path: "/webhooks/{webhookId}/test";
+        readonly successStatuses: readonly [202];
+        readonly responseSchemas: {
+            readonly "202": {
+                readonly $ref: "#/components/schemas/WebhookDelivery";
+            };
+        };
+    };
+    readonly listWebhookDeliveries: {
+        readonly method: "GET";
+        readonly path: "/webhook-deliveries";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/DeliveryPage";
+            };
+        };
+    };
+    readonly getWebhookDelivery: {
+        readonly method: "GET";
+        readonly path: "/webhook-deliveries/{deliveryId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/WebhookDelivery";
+            };
+        };
+    };
+    readonly replayWebhookDelivery: {
+        readonly method: "POST";
+        readonly path: "/webhook-deliveries/{deliveryId}/replay";
+        readonly successStatuses: readonly [202];
+        readonly responseSchemas: {
+            readonly "202": {
+                readonly $ref: "#/components/schemas/WebhookDelivery";
+            };
+        };
+    };
+};
+type AdminOperationId = keyof typeof adminOperations;
+
+type Operation = operations[AdminOperationId];
+type ParameterKind = 'query' | 'path';
+type ParameterInput<O extends Operation, K extends ParameterKind> = O extends {
+    parameters: infer P;
+} ? K extends keyof P ? [NonNullable<P[K]>] extends [never] ? object : undefined extends P[K] ? {
+    [Field in K]?: NonNullable<P[K]>;
+} : {
+    [Field in K]: P[K];
+} : object : object;
+type BodyInput<O extends Operation> = O extends {
+    requestBody: infer B;
+} ? B extends {
+    content: {
+        'application/json': infer Body;
+    };
+} ? {
+    body: Body;
+} : object : O extends {
+    requestBody?: infer B;
+} ? B extends {
+    content: {
+        'application/json': infer Body;
+    };
+} ? {
+    body?: Body;
+} : object : object;
+type SuccessStatus = 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 226;
+type SuccessResponse<O extends Operation> = O extends {
+    responses: infer Responses;
+} ? {
+    [Status in keyof Responses]: Status extends SuccessStatus ? Responses[Status] : never;
+}[keyof Responses] : never;
+type ResponseBody<Response> = Response extends {
+    content: infer Content;
+} ? Content extends {
+    'application/json': infer Body;
+} ? Body : void : void;
+type Simplify<T> = {
+    [K in keyof T]: T[K];
+} & object;
+type AdminOperationInput<Id extends AdminOperationId> = Simplify<ParameterInput<operations[Id], 'path'> & ParameterInput<operations[Id], 'query'> & BodyInput<operations[Id]> & {
+    signal?: AbortSignal;
+}>;
+type AdminOperationResult<Id extends AdminOperationId> = ResponseBody<SuccessResponse<operations[Id]>>;
+type AdminMethod<Id extends AdminOperationId> = object extends AdminOperationInput<Id> ? (input?: AdminOperationInput<Id>) => Promise<AdminOperationResult<Id>> : (input: AdminOperationInput<Id>) => Promise<AdminOperationResult<Id>>;
+type AdminClient = {
+    readonly [Id in AdminOperationId]: AdminMethod<Id>;
+} & {
+    readonly request: <Id extends AdminOperationId>(operationId: Id, ...args: object extends AdminOperationInput<Id> ? [input?: AdminOperationInput<Id>] : [input: AdminOperationInput<Id>]) => Promise<AdminOperationResult<Id>>;
+};
+type AdminClientConfig = {
+    /** AuthOwl server-side secret key. Never expose this value to browser code. */
+    secretKey: string;
+    /** AuthOwl deployment origin, with an optional trailing `/api/v1`. */
+    apiUrl: string;
+    /** Custom fetch implementation for server runtimes and tests. */
+    fetch?: typeof fetch;
+};
+type AdminApiProblem = components['schemas']['Problem'];
+declare class AuthOwlAdminApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly requestId?: string;
+    readonly problem: AdminApiProblem;
+    readonly retryAfter?: string;
+    constructor(input: {
+        status: number;
+        code: string;
+        requestId?: string;
+        problem: AdminApiProblem;
+        retryAfter?: string;
+    });
+}
+declare class AuthOwlAdminNetworkError extends Error {
+    readonly kind: TransportErrorKind;
+    readonly requestId?: string;
+    constructor(kind: TransportErrorKind, requestId?: string);
+}
+declare function createAdminClient(input: AdminClientConfig): AdminClient;
+
+type VerifyWebhookInput = {
+    /** Exact request bytes. Do not parse and reserialize JSON before verification. */
+    rawBody: string | ArrayBuffer | ArrayBufferView;
+    timestamp: string;
+    signatureHeader: string;
+    /** Current and, during rotation overlap, previous endpoint secret. */
+    secrets: readonly string[];
+    /** Unix seconds, injectable for deterministic tests. */
+    now?: number;
+    /** Accepted timestamp skew. Defaults to 300 seconds and is capped at one hour. */
+    toleranceSeconds?: number;
+};
+/**
+ * Verify an AuthOwl webhook HMAC before parsing or acting on its body.
+ *
+ * Malformed untrusted headers fail closed with `false`. Invalid local
+ * configuration throws so a broken endpoint cannot silently reject deliveries.
+ */
+declare function verifyWebhook(input: VerifyWebhookInput): Promise<boolean>;
+
+/** Server-only AuthOwl configuration, cookies, and generated Admin API client. */
+
+/**
+ * How to reach the project's JWKS + what issuer/audience to expect. Either pass
+ * `publishableKey` + `apiUrl` (the SDK derives the rest, matching the app's
+ * issuer/JWKS layout), or the raw `issuer`/`jwksUri`/`audience` for a fully
+ * custom deployment. Falls back to `AUTHOWL_PUBLISHABLE_KEY` / `AUTHOWL_API_URL`
+ * from the environment (zero-config), like the rest of the server helpers.
+ */
+type VerifyTokenConfigCommon = {
+    clockToleranceSeconds?: number;
+};
+type VerifyTokenConfig = (VerifyTokenConfigCommon & {
+    publishableKey: string;
+    apiUrl: string;
+    issuer?: never;
+    jwksUri?: never;
+    audience?: never;
+}) | (VerifyTokenConfigCommon & {
+    publishableKey?: never;
+    apiUrl?: never;
+    issuer: string;
+    jwksUri: string;
+    audience: string;
+}) | (VerifyTokenConfigCommon & {
+    publishableKey?: never;
+    apiUrl?: never;
+    issuer?: never;
+    jwksUri?: never;
+    audience?: never;
+});
+/**
+ * Verify an AuthOwl project JWT and return its subject, membership, and claims.
+ * Throws {@link TokenVerificationError} on any failure. Use this when you need
+ * the decoded identity; use {@link has}/{@link hasPermission} for a boolean gate.
+ */
+declare function verifyToken(token: string, config?: VerifyTokenConfig): Promise<VerifiedProjectToken>;
+/**
+ * The REAL server-side authorization primitive (plan §5): verify the project
+ * JWT, then evaluate Clerk-style `has({ role?, permission?, teamId? })` against
+ * the token's membership claim. Fails CLOSED - an invalid, tampered, expired, or
+ * wrong-audience token returns `false`, never granting access off an unverified
+ * claim. Handles both `org:sys_*` and custom `org:<feature>:<action>` ids.
+ *
+ * `teamId` checks GROUP membership, not authority: teams grant nothing on their
+ * own. A token minted before teams shipped proves no team and so denies.
+ */
+declare function has(token: string, params: HasParams, config?: VerifyTokenConfig): Promise<boolean>;
+/** Verified-token `hasPermission()`: true only when the token grants `permission`. Fails closed. */
+declare function hasPermission(token: string, params: {
+    permission: string;
+}, config?: VerifyTokenConfig): Promise<boolean>;
+
+export { ADMIN_API_SPEC_SHA256, type components as AdminApiComponents, type operations as AdminApiOperations, type paths as AdminApiPaths, type AdminApiProblem, type AdminClient, type AdminClientConfig, type AdminOperationId, type AdminOperationInput, type AdminOperationResult, AuthOwlAdminApiError, AuthOwlAdminNetworkError, HasParams, OrganizationMembership, TokenVerificationError, type TokenVerificationErrorCode, type VerifiedProjectToken, type VerifyTokenConfig, type VerifyWebhookInput, createAdminClient, has, hasPermission, verifyProjectToken, verifyToken, verifyWebhook };