@authowl/core 0.11.0 → 0.12.0

package/dist/client-1cjryEHU.d.cts

@@ -0,0 +1,1294 @@
+import { R as ResolvedAuthConfig, H as HasParams, O as OrganizationMembership } from './organization-membership-B3m6PbmO.cjs';
+
+type EnvironmentType = 'development' | 'production';
+/**
+ * The public, publishable-key-safe project config the SDK renders its sign-in
+ * UI from (server contract CONTRACTS §2, `GET /api/projects/:id/public-config`).
+ * Nothing here is secret. Method slugs are canonical snake_case.
+ */
+type PublicConfig = {
+    /** Stable workspace product container shared by its environments. */
+    applicationId: string;
+    /** Stable tenant id for the exact environment selected by the publishable key. */
+    environmentId: string;
+    /** Environment class that determines key prefixes and billing treatment. */
+    environmentType: EnvironmentType;
+    /** Canonical authentication endpoint for this environment. */
+    authBaseUrl: string;
+    /**
+     * Public acquisition mode. Optional only for rolling compatibility with
+     * servers released before waitlist support.
+     */
+    signUp?: {
+        mode: 'open' | 'restricted' | 'allowlist' | 'waitlist';
+    };
+    /**
+     * Identity and credential lifecycle policy. Optional only for rolling
+     * compatibility with AuthOwl servers released before plan 35.
+     */
+    authentication?: {
+        email: {
+            signUp: boolean;
+            signIn: Array<'password' | 'magic_link' | 'email_otp'>;
+        };
+        phone: {
+            signUp: boolean;
+            signIn: boolean;
+        };
+        password: {
+            signUp: boolean;
+            add: boolean;
+            /** Server-owned password length policy. Optional for rolling compatibility. */
+            minLength?: number;
+            maxLength?: number;
+        };
+        passkey: {
+            signIn: boolean;
+            add: boolean;
+        };
+        username: {
+            collectOnSignUp: boolean;
+            signIn: boolean;
+        };
+    };
+    /** Email ownership ceremony selected by the project. */
+    emailVerification?: {
+        required: boolean;
+        method: 'link' | 'code';
+    };
+    /** End-user profile fields and self-service permissions. */
+    userModel?: {
+        requireEmail: boolean;
+        firstLastName: boolean;
+        emailChange: boolean;
+        accountDeletion: boolean;
+    };
+    /**
+     * MFA presentation contract. Backup codes follow TOTP and are not an
+     * independently configurable authentication method.
+     */
+    mfa?: {
+        totp: boolean;
+        required: boolean;
+        backupCodes: boolean;
+    };
+    branding: {
+        appName?: string;
+        logoUrl?: string;
+        /** Whether the application name is visible beside the logo. */
+        showAppName?: boolean;
+        /** Alignment of the brand identity within managed component headers. */
+        alignment?: 'left' | 'center' | 'right';
+        primaryColor?: string;
+        theme?: 'light' | 'dark' | 'system';
+    };
+    /** Canonical method slugs, e.g. "password", "magic_link", "passkey". */
+    enabledMethods: string[];
+    /** Configured social provider ids, e.g. "google". */
+    socialProviders: string[];
+    /**
+     * Public OAuth client ids keyed by provider. Optional for rolling compatibility
+     * with servers released before Google One Tap support.
+     */
+    socialProviderClientIds?: Record<string, string>;
+    /**
+     * When true, an email/password sign-up does not create a session - the user
+     * must confirm their address first. <SignUp/> shows a "check your email" state
+     * instead of redirecting. Always false unless password sign-up is enabled.
+     */
+    requireEmailVerification: boolean;
+    /**
+     * Legal consent gate. When `required`, <SignUp/> shows an acceptance checkbox
+     * linking `termsUrl`/`privacyUrl` and blocks sign-up until it's checked, echoing
+     * `version` back so the server records and enforces it. `required` is true only
+     * when the project both requires consent and has a document URL to link.
+     */
+    legal: {
+        termsUrl?: string;
+        privacyUrl?: string;
+        version: number;
+        required: boolean;
+    };
+    /**
+     * Whether the project lets signed-in users enrol a second factor (TOTP). A
+     * capability flag, not a sign-in method (so it's absent from `enabledMethods`):
+     * gate an "enable two-factor" affordance / <MFAEnrollment/> on it. The sign-in
+     * 2FA challenge is handled by <SignIn/> regardless of this flag.
+     */
+    twoFactor: boolean;
+    /** Whether enrolled MFA is mandatory rather than optional for this project. */
+    mfaRequired: boolean;
+    /** Whether signed-in users may delete their own account. */
+    accountDeletion: boolean;
+    /** Whether organization routes and components are available for this project. */
+    organizations: boolean;
+    /**
+     * Whether inbound enterprise SSO is enabled for this project. SSO IS a sign-in
+     * method, so when true the server also pushes `'sso'` into `enabledMethods`;
+     * this flag mirrors the server capability (matching the `twoFactor`
+     * convention). <SignIn/> gates the SSO affordance on `enabledMethods`, not on
+     * this flag, so the two never drift.
+     */
+    sso: boolean;
+    /**
+     * JWT issuer (server contract CONTRACTS §8). Non-null only when the project's
+     * issuer toggle is on: exactly what a third-party verifier needs (Convex
+     * `auth.config.ts` = `{ type: "customJwt", issuer, jwks: jwksUrl,
+     * applicationID: aud, algorithm: "ES256" }`). `getToken` mints from
+     * `<issuer>/token`.
+     */
+    jwtIssuer: {
+        issuer: string;
+        jwksUrl: string;
+        aud: string;
+    } | null;
+    /** Public Cloudflare Turnstile site key for the phone OTP challenge. */
+    turnstileSiteKey: string | null;
+    /** Public Cloudflare Turnstile site key for protected sign-up/sign-in actions. */
+    authTurnstileSiteKey: string | null;
+    locale: string;
+    badge: boolean;
+    configVersion: number;
+};
+/**
+ * Fetch a project's public config. Publishable-key gated server-side; sent
+ * without cookies (the payload is public, so no session is needed). Throws on a
+ * non-2xx response so the caller can distinguish "config unavailable" from a
+ * project that simply has a method disabled.
+ */
+declare function getPublicConfig(config: ResolvedAuthConfig): Promise<PublicConfig>;
+
+/** One compatibility boundary for project-controlled authentication UI. */
+type ProjectCapabilities = {
+    emailSignUp: boolean;
+    passwordSignUp: boolean;
+    phoneSignUp: boolean;
+    passwordSignIn: boolean;
+    passwordMinLength: number;
+    passwordMaxLength: number;
+    magicLinkSignIn: boolean;
+    emailOtpSignIn: boolean;
+    phoneSignIn: boolean;
+    usernameSignIn: boolean;
+    collectUsername: boolean;
+    passkeySignIn: boolean;
+    passkeyAdd: boolean;
+    firstLastName: boolean;
+    emailChange: boolean;
+    accountDeletion: boolean;
+    emailVerificationRequired: boolean;
+    emailVerificationMethod: 'link' | 'code';
+    totp: boolean;
+    mfaRequired: boolean;
+    backupCodes: boolean;
+    /** Preserve the pre-plan-35 display-name field only for an older server. */
+    legacyNameField: boolean;
+};
+/**
+ * Resolve current and legacy public-config shapes once, rather than spreading
+ * compatibility checks through each platform's components.
+ */
+declare function resolveProjectCapabilities(config: PublicConfig | null): ProjectCapabilities;
+
+/** Legal-consent status for the signed-in user (server contract: `GET /consent`). */
+type ConsentStatus = {
+    /** Whether the project has an active consent gate at all. */
+    required: boolean;
+    /**
+     * True when the signed-in user must (re-)accept the current version — either
+     * never accepted, or the operator bumped the version since they did. Absent
+     * when `required` is false or the user isn't signed in.
+     */
+    needsConsent?: boolean;
+    version?: number;
+    termsUrl?: string;
+    privacyUrl?: string;
+};
+type ConsentAcceptResult = {
+    ok: boolean;
+    version?: number;
+};
+/**
+ * Fetch the signed-in user's consent status. Sent WITH cookies (needs the
+ * session). A 401 (not signed in) resolves to `{ required: false }` — new users
+ * are handled by the sign-up consent gate, not this one.
+ */
+declare function getConsentStatus(config: ResolvedAuthConfig): Promise<ConsentStatus>;
+/**
+ * Record the signed-in user's acceptance of the terms version they were shown.
+ * `version` is echoed from {@link getConsentStatus} so the server records only the
+ * exact version the UI displayed; if the operator bumped it in between, the server
+ * rejects with 409 (surfaced as a thrown error) and the caller should re-fetch.
+ */
+declare function acceptConsent(config: ResolvedAuthConfig, version: number): Promise<ConsentAcceptResult>;
+
+/**
+ * Short-lived JWTs for third-party backends (Convex, Supabase, Hasura - server
+ * contract CONTRACTS §8, `GET <issuer>/token`). The server signs a ~15-minute
+ * ES256 token for the signed-in user; verifiers check it statelessly against
+ * the project's published JWKS.
+ *
+ * Contract (recorded from the convex@1.42.1 source, evidence 17-B.9):
+ *  - `forceRefresh: true` MUST bypass only the selected template cache and hit
+ *    the network. A stale token served to a verifier retry is a hard failure
+ *    loop.
+ *  - Tokens are cached in MEMORY ONLY (never localStorage - PLAN.md security
+ *    model), and served only while comfortably inside their `exp`. Named cache
+ *    keys include the client environment, token subject, active organization,
+ *    normalized template name, and server template policy version. The client
+ *    wrapper clears all entries when the auth identity changes.
+ *  - "Not signed in" (401) resolves to `null`; other failures throw (adapters
+ *    map them to null per Convex's error contract).
+ */
+type GetTokenOptions = {
+    /** Named JWT template configured for this environment. */
+    template?: string;
+    /** Bypass the in-memory cache and mint a fresh token from the server. */
+    forceRefresh?: boolean;
+};
+type GetToken = (options?: GetTokenOptions) => Promise<string | null>;
+type TokenClient = {
+    getToken: GetToken;
+    /** Drop the cached token (call on any auth-identity change, e.g. sign-out). */
+    clear: () => void;
+};
+/**
+ * Build a token client bound to one config. `getToken` is cheap to call
+ * repeatedly: fresh cached tokens return without a request, and concurrent
+ * non-forced calls share one in-flight request.
+ */
+declare function createTokenClient(config: ResolvedAuthConfig): TokenClient;
+
+declare const AUTH_CHALLENGE_HEADER = "x-authowl-turnstile-token";
+type ResponseDecoder<T> = (value: unknown) => T;
+type AuthHttpRequest<T = unknown> = {
+    method?: 'GET' | 'POST' | 'PATCH';
+    body?: unknown;
+    query?: Record<string, string | number | boolean | undefined>;
+    fetchOptions?: ActionFetchOptions;
+    decode?: ResponseDecoder<T>;
+    credentials?: RequestCredentials;
+};
+interface AuthHttpClient {
+    request<T>(path: string, options?: AuthHttpRequest<T>): Promise<AuthActionResult<T>>;
+}
+declare function createAuthHttpClient(config: ResolvedAuthConfig, baseURL?: string): AuthHttpClient;
+
+type JsonPrimitive = string | number | boolean | null;
+type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
+type JsonObject = {
+    [key: string]: JsonValue;
+};
+/** Browser-safe metadata for the currently signed-in user. */
+interface UserMetadata {
+    /** Trusted server-authored data. End users can read but cannot write it. */
+    publicMetadata: JsonObject;
+    /** End-user-owned data. Applications must treat every value as untrusted. */
+    unsafeMetadata: JsonObject;
+    /** Pass this value as expectedVersion on the next unsafe metadata write. */
+    metadataVersion: number;
+}
+interface UpdateUnsafeMetadataOptions {
+    expectedVersion: number;
+    /** JSON Merge Patch. Null members delete the matching stored key. */
+    unsafeMetadata: JsonObject;
+}
+
+interface UpdateProfileOptions {
+    name?: string;
+    image?: string | null;
+    username?: string;
+    firstName?: string;
+    lastName?: string;
+}
+interface ChangeEmailOptions {
+    newEmail: string;
+    callbackURL?: string;
+}
+interface ChangePasswordOptions {
+    currentPassword: string;
+    newPassword: string;
+    revokeOtherSessions?: boolean;
+}
+interface ChangePasswordData {
+    user: AuthUser;
+}
+/** Browser-safe metadata for one signed-in session. */
+interface AccountSession {
+    id: string;
+    userId: string;
+    createdAt: Date;
+    updatedAt: Date;
+    expiresAt: Date;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+}
+interface RevokeSessionOptions {
+    sessionId: string;
+}
+interface AccountStatusData {
+    status: boolean;
+}
+interface SocialAccount {
+    id: string;
+    userId: string;
+    providerId: string;
+    accountId: string;
+    scopes: string[];
+    createdAt: Date;
+    updatedAt: Date;
+    /** False when disconnecting this provider would remove the last sign-in method. */
+    canUnlink: boolean;
+}
+interface LinkSocialOptions {
+    provider: string;
+    callbackURL?: string;
+    errorCallbackURL?: string;
+    disableRedirect?: boolean;
+    requestSignUp?: boolean;
+    scopes?: string[];
+    idToken?: SocialIdTokenOptions & {
+        scopes?: string[];
+    };
+}
+interface LinkSocialData {
+    url: string;
+    redirect: boolean;
+}
+interface UnlinkSocialOptions {
+    providerId: string;
+    accountId?: string;
+}
+interface DeleteAccountOptions {
+    callbackURL?: string;
+    password?: string;
+    token?: string;
+}
+interface DeleteAccountData {
+    success: boolean;
+    message: string;
+}
+interface AccountClient {
+    /** Read public and unsafe metadata for the signed-in user. Private metadata is never returned. */
+    getMetadata(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<UserMetadata>>;
+    /** Optimistically apply a JSON Merge Patch to end-user-owned unsafe metadata. */
+    updateUnsafeMetadata(params: UpdateUnsafeMetadataOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<UserMetadata>>;
+    updateProfile(params: UpdateProfileOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AccountStatusData>>;
+    changeEmail(params: ChangeEmailOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AccountStatusData>>;
+    changePassword(params: ChangePasswordOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<ChangePasswordData>>;
+    listSessions(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AccountSession[]>>;
+    revokeSession(params: RevokeSessionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AccountStatusData>>;
+    revokeOtherSessions(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AccountStatusData>>;
+    listSocialAccounts(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<SocialAccount[]>>;
+    linkSocial(params: LinkSocialOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<LinkSocialData>>;
+    unlinkSocial(params: UnlinkSocialOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AccountStatusData>>;
+    /** Available only when `PublicConfig.accountDeletion` is true. */
+    delete(params?: DeleteAccountOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<DeleteAccountData>>;
+}
+
+interface Organization {
+    id: string;
+    name: string;
+    slug: string;
+    createdAt: Date;
+    logo?: string | null;
+    metadata?: unknown;
+}
+interface OrganizationMemberUser {
+    id: string;
+    name: string;
+    email: string;
+    image?: string | null;
+}
+interface OrganizationMember {
+    id: string;
+    organizationId: string;
+    userId: string;
+    role: string;
+    createdAt: Date;
+    user?: OrganizationMemberUser;
+}
+interface OrganizationMemberWithUser extends OrganizationMember {
+    user: OrganizationMemberUser;
+}
+type OrganizationInvitationStatus = 'pending' | 'accepted' | 'rejected' | 'canceled';
+interface OrganizationInvitation {
+    id: string;
+    organizationId: string;
+    email: string;
+    role: string;
+    status: OrganizationInvitationStatus;
+    inviterId: string;
+    expiresAt: Date;
+    createdAt: Date;
+}
+interface OrganizationInvitationDetails extends OrganizationInvitation {
+    organizationName: string;
+    organizationSlug: string;
+    inviterEmail: string;
+}
+interface OrganizationUserInvitation extends OrganizationInvitation {
+    organizationName: string;
+}
+interface OrganizationDetails extends Organization {
+    members: OrganizationMemberWithUser[];
+    invitations: OrganizationInvitation[];
+}
+interface CreateOrganizationOptions {
+    name: string;
+    slug: string;
+    logo?: string | null;
+    metadata?: Record<string, unknown>;
+    keepCurrentActiveOrganization?: boolean;
+}
+interface OrganizationSelector {
+    organizationId?: string;
+    organizationSlug?: string;
+}
+interface GetOrganizationOptions extends OrganizationSelector {
+    membersLimit?: number;
+}
+interface SetActiveOrganizationOptions {
+    organizationId?: string | null;
+    organizationSlug?: string;
+}
+/**
+ * A team: a named sub-group of members inside one organization.
+ *
+ * Teams are GROUPING only. Being on one grants nothing - a member's authority comes
+ * from their organization role. Use a team to decide what your own product shows or
+ * routes, never as an authority check.
+ */
+interface OrganizationTeam {
+    id: string;
+    name: string;
+    organizationId: string;
+    createdAt: Date;
+    updatedAt?: Date;
+}
+interface ListOrganizationTeamsOptions {
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
+interface SetActiveTeamOptions {
+    /** The team to make active, or null to clear it. Must be a team the caller is on. */
+    teamId: string | null;
+}
+interface UpdateOrganizationOptions {
+    organizationId?: string;
+    data: {
+        name?: string;
+        slug?: string;
+        logo?: string | null;
+        metadata?: Record<string, unknown>;
+    };
+}
+interface DeleteOrganizationOptions {
+    organizationId: string;
+}
+type OrganizationFilterOperator = 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'contains' | 'starts_with' | 'ends_with';
+interface ListOrganizationMembersOptions extends OrganizationSelector {
+    limit?: number;
+    offset?: number;
+    sortBy?: string;
+    sortDirection?: 'asc' | 'desc';
+    filterField?: string;
+    filterValue?: string | number | boolean;
+    filterOperator?: OrganizationFilterOperator;
+}
+interface OrganizationMembersData {
+    members: OrganizationMemberWithUser[];
+    total: number;
+}
+interface InviteOrganizationMemberOptions {
+    email: string;
+    role: string | string[];
+    organizationId?: string;
+    resend?: boolean;
+}
+interface ListOrganizationInvitationsOptions {
+    organizationId?: string;
+}
+interface GetOrganizationInvitationOptions {
+    id: string;
+}
+interface OrganizationInvitationActionOptions {
+    invitationId: string;
+}
+interface AcceptOrganizationInvitationData {
+    invitation: OrganizationInvitation;
+    member: OrganizationMember;
+}
+interface RejectOrganizationInvitationData {
+    invitation: OrganizationInvitation | null;
+    member: null;
+}
+interface RemoveOrganizationMemberOptions {
+    memberIdOrEmail: string;
+    organizationId?: string;
+}
+interface RemoveOrganizationMemberData {
+    member: OrganizationMember;
+}
+interface UpdateOrganizationMemberRoleOptions {
+    memberId: string;
+    role: string | string[];
+    organizationId?: string;
+}
+interface LeaveOrganizationOptions {
+    organizationId: string;
+}
+interface ListOrganizationRolesOptions {
+    /** Defaults to the caller's active organization. */
+    organizationId?: string;
+}
+/**
+ * A role assignable in an organization, as returned by the engine's
+ * `/organization/list-roles` (the per-org dynamic roles, which after projection
+ * include this project's custom roles). Built-in `owner`/`admin`/`member` are
+ * static and NOT returned here - the UI adds them alongside this list.
+ */
+interface OrganizationRoleSummary {
+    role: string;
+    /** The role's ⊆14 system-statement document (engine shape); advisory here. */
+    permission?: unknown;
+}
+interface OrganizationClient {
+    create(params: CreateOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization>>;
+    list(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization[]>>;
+    get(params?: GetOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationDetails | null>>;
+    setActive(params: SetActiveOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization | null>>;
+    /**
+     * The teams of an organization, for resolving the team ids carried in the
+     * membership claim to names. Requires membership of that organization.
+     */
+    listTeams(params?: ListOrganizationTeamsOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam[]>>;
+    /**
+     * Select the caller's active team, which surfaces as `activeTeamId` on the session
+     * and `team_id` in the project token. Only a team the caller is on can be made
+     * active; pass null to clear it. Clearing also happens on its own whenever the
+     * active organization changes.
+     */
+    setActiveTeam(params: SetActiveTeamOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationTeam | null>>;
+    update(params: UpdateOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization | null>>;
+    delete(params: DeleteOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<Organization>>;
+    listMembers(params?: ListOrganizationMembersOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationMembersData>>;
+    inviteMember(params: InviteOrganizationMemberOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation>>;
+    listInvitations(params?: ListOrganizationInvitationsOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation[]>>;
+    listUserInvitations(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationUserInvitation[]>>;
+    getInvitation(params: GetOrganizationInvitationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitationDetails>>;
+    acceptInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AcceptOrganizationInvitationData>>;
+    rejectInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RejectOrganizationInvitationData>>;
+    cancelInvitation(params: OrganizationInvitationActionOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationInvitation | null>>;
+    removeMember(params: RemoveOrganizationMemberOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<RemoveOrganizationMemberData>>;
+    updateMemberRole(params: UpdateOrganizationMemberRoleOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationMember>>;
+    leave(params: LeaveOrganizationOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationMember>>;
+    /**
+     * List the roles assignable in an organization (the engine's dynamic roles,
+     * which include this project's projected custom roles). Built-in roles are
+     * static and not returned; surfaces populate the select alongside them.
+     */
+    listRoles(params?: ListOrganizationRolesOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<OrganizationRoleSummary[]>>;
+    /**
+     * Clerk-style `has()` over the ACTIVE membership's advisory claim: true when
+     * the signed-in member's role matches `role` AND/OR their permissions include
+     * `permission`. PURE + synchronous - it reads the local session claim and
+     * NEVER calls `/organization/has-permission` (which only knows the 14 static
+     * statements and would wrongly deny custom permissions). UX affordance only;
+     * enforce real authorization server-side over the verified token.
+     */
+    has(params: HasParams): boolean;
+    /** Clerk-style `hasPermission()`: true when the active membership grants `permission`. Pure. */
+    hasPermission(params: {
+        permission: string;
+    }): boolean;
+}
+
+/**
+ * The narrow, portable surface of the underlying auth client that this SDK
+ * depends on and re-exports.
+ *
+ * We deliberately do NOT expose the engine's full inferred client type: it
+ * references internal module paths (not portable across package boundaries -
+ * TS2742) and is too large to serialize into a `.d.ts` (TS7056). Hand-writing
+ * the surface we actually use keeps the published types small, stable, and
+ * portable. Extend these interfaces as the SDK starts using more of the client
+ * (e.g. two-factor / organization / passkey flows in later plans).
+ */
+/**
+ * Minimal end-user shape the SDK surfaces (mirror of the underlying session
+ * user). `name`/`image` are optional and nullable because the engine omits
+ * them entirely for users that have none - this SDK only casts the response, it
+ * does not normalize missing fields, so the type must not over-promise.
+ */
+interface AuthUser {
+    id: string;
+    /** Null for phone-only users whose internal synthetic email is redacted. */
+    email: string | null;
+    /** Present for phone-authenticated users when the phone plugin is enabled. */
+    phoneNumber?: string | null;
+    /** Canonical project-scoped username, when username support is enabled. */
+    username?: string | null;
+    /** User-facing username casing retained alongside the canonical value. */
+    displayUsername?: string | null;
+    /** Structured profile names, when enabled by the project. */
+    firstName?: string | null;
+    lastName?: string | null;
+    emailVerified: boolean;
+    name?: string | null;
+    image?: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    /**
+     * Whether the user has a verified second factor enrolled. Optional and
+     * nullable because the engine only includes it once the twoFactor plugin is
+     * active and the user has enrolled; treat a missing value as "not enrolled".
+     */
+    twoFactorEnabled?: boolean | null;
+}
+interface AuthSession {
+    id: string;
+    userId: string;
+    expiresAt: Date;
+    /**
+     * The active organization id, present once the organization plugin is in use
+     * and the user has set an active org. Mirrors the JWT's `org_id` claim, so
+     * consumers (e.g. the Convex adapter) can re-mint tokens when it changes.
+     */
+    activeOrganizationId?: string | null;
+    /**
+     * The member's active team within the active organization, or null.
+     *
+     * AuthOwl VALIDATES this before returning it: a stored pointer at a team in
+     * another organization, at a deleted team, or at one the member has been removed
+     * from comes back null, so it never needs re-checking here. The JWT carries the
+     * same value as `team_id`, which is OMITTED rather than null when there is none -
+     * the same convention `org_id` follows.
+     */
+    activeTeamId?: string | null;
+    /**
+     * The active organization membership - the member's canonical role and its
+     * advisory permission claim (`org:sys_*` + custom `org:<feature>:<action>`
+     * ids), populated by AuthOwl's `/get-session` shaping for the active org, else
+     * `null`. This is the array the client `has()`/`hasPermission()` evaluate. It
+     * is a UX affordance, NOT a security boundary: enforce authorization on the
+     * server with the verified token (`@authowl/next`'s server `has()`).
+     */
+    membership?: OrganizationMembership | null;
+    /**
+     * B.5c: true while this session is held at required-MFA enrolment (the
+     * project requires MFA and the user has no verified factor). The SDK and
+     * auth() treat such a session as unauthenticated for app purposes; it is
+     * cleared server-side when enrolment completes (CONTRACTS §5).
+     */
+    pendingMfaEnrollment?: boolean | null;
+}
+interface AuthClientError {
+    message?: string;
+    status?: number;
+    statusText?: string;
+    code?: AuthOwlErrorCode | (string & {});
+    /** Sanitized upstream correlation id, when the service supplied one. */
+    requestId?: string;
+    /** Present on VERSION_CONFLICT so the caller can re-read before retrying. */
+    currentVersion?: number;
+    /**
+     * Seconds to wait before retrying, parsed from the body's `retryAfterSeconds`
+     * field or the `Retry-After` / `X-Retry-After` header (delta-seconds form),
+     * clamped to [1, 86400]. Present on rate-limit / lockout responses so callers
+     * can render a live countdown; the drop-in forms surface it automatically.
+     */
+    retryAfterSeconds?: number;
+}
+/** Secret-free lifecycle metadata exposed before an auth request is sent. */
+type AuthRequestContext = Readonly<{
+    method: 'GET' | 'POST' | 'PATCH';
+    /** Endpoint path only. Query values, headers, cookies, and bodies are omitted. */
+    path: string;
+}>;
+/** Secret-free lifecycle metadata exposed after a parsed response arrives. */
+type AuthResponseContext = Readonly<AuthRequestContext & {
+    status: number;
+    requestId?: string;
+}>;
+/** Secret-free lifecycle metadata exposed for transport or API failures. */
+type AuthErrorContext = Readonly<AuthRequestContext & {
+    status: number;
+    requestId?: string;
+    failure: 'api' | 'aborted' | 'timeout' | 'network' | 'response_too_large' | 'invalid_response';
+}>;
+/** Stable AuthOwl policy codes that callers can handle without matching messages. */
+type AuthOwlErrorCode = 'MAU_BUDGET_REACHED' | 'BOT_CHALLENGE_FAILED' | 'VERSION_CONFLICT' | 'SESSION_NOT_FRESH' | 'ORGANIZATION_LAST_OWNER' | 'ORGANIZATION_NOT_FOUND' | 'MEMBER_NOT_FOUND' | 'INVITATION_NOT_FOUND' | 'EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION' | 'EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION' | 'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION';
+/** Framework-neutral reactive session snapshot. */
+interface SessionState {
+    data: {
+        user: AuthUser;
+        session: AuthSession;
+    } | null;
+    isPending: boolean;
+    isRefetching: boolean;
+    error: AuthClientError | null;
+    /**
+     * Re-fetch the current session from the server. `query.disableCookieCache`
+     * forces a database read AND re-sets the session cookie - the repair path
+     * for a stale cookie-cached `pendingMfaEnrollment` (CONTRACTS §5).
+     */
+    refetch: (options?: {
+        query?: {
+            disableCookieCache?: boolean;
+        };
+    }) => void;
+}
+/**
+ * External-store contract consumed by framework bindings such as
+ * `@authowl/react`. Core never imports a UI framework.
+ */
+interface SessionStore {
+    subscribe(listener: () => void): () => void;
+    getSnapshot(): SessionState;
+}
+/** Standard `{ data, error }` envelope returned by the client's auth actions. */
+interface AuthActionResult<T = Record<string, unknown>> {
+    data: T | null;
+    error: AuthClientError | null;
+}
+/** Success payload of the email sign-in action. */
+interface EmailAuthData {
+    user: AuthUser;
+    /** Whether the server supplied a callback redirect. */
+    redirect: boolean;
+    url?: string;
+}
+/** Success payload of an in-place email one-time-code sign-in. */
+interface EmailOtpAuthData {
+    user: AuthUser;
+}
+/**
+ * Returned by a credential sign-in when the user has two-factor enrolled: NO
+ * session is issued (`token`/`user` are absent) and the client must clear the 2FA
+ * challenge (verify a TOTP or backup code) before it is signed in. This is the
+ * discriminant `<SignIn/>` branches on; a headless consumer must handle it too.
+ */
+interface TwoFactorRedirectData {
+    twoFactorRedirect: true;
+    /** Factors the server will accept, e.g. `["totp"]` / `["otp"]`. */
+    twoFactorMethods?: string[];
+}
+/**
+ * Success payload of the email sign-up action. `sessionCreated` is false when
+ * the project requires email verification or has auto-sign-in disabled, so no
+ * browser session was issued yet.
+ */
+interface EmailSignUpData {
+    sessionCreated: boolean;
+    user: AuthUser;
+}
+/** Success payload of the social sign-in action. */
+type SocialAuthData = {
+    redirect: true;
+    url: string;
+} | {
+    redirect: false;
+    url: string;
+} | {
+    redirect: false;
+    user: AuthUser;
+};
+/**
+ * Success payload of the enterprise SSO sign-in action. OIDC/SAML SSO is always
+ * a redirect flow (there is no in-place ID-token variant), so this is the
+ * social payload's redirect half only: the client sends the browser to the
+ * identity provider and the session is minted when the provider callback lands
+ * on a fresh page.
+ */
+interface SsoAuthData {
+    /** Identity-provider authorization URL to send the browser to. */
+    url: string;
+    redirect: true;
+}
+/** Success payload of the sign-out action. */
+interface SignOutData {
+    success: boolean;
+}
+interface EmailSignInOptions {
+    email: string;
+    password: string;
+    rememberMe?: boolean;
+    callbackURL?: string;
+}
+interface UsernameSignInOptions {
+    username: string;
+    password: string;
+    rememberMe?: boolean;
+    callbackURL?: string;
+}
+interface EmailSignUpOptions {
+    email: string;
+    password: string;
+    name: string;
+    username?: string;
+    firstName?: string;
+    lastName?: string;
+    image?: string;
+    callbackURL?: string;
+    /**
+     * The accepted legal-consent version (from `PublicConfig.legal.version`). Sent
+     * in the sign-up body; when the project requires consent the server rejects a
+     * sign-up whose value is missing or below the current version. <SignUp/> sets
+     * this automatically when it renders the consent checkbox.
+     */
+    consentVersion?: number;
+}
+interface WaitlistJoinOptions {
+    email: string;
+}
+interface WaitlistJoinData {
+    accepted: true;
+}
+/** ID-token payload for non-redirect social sign-in (e.g. native Google/Apple). */
+interface SocialIdTokenOptions {
+    token: string;
+    nonce?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    expiresAt?: number;
+}
+/** Options for the social sign-in action (mirror of the underlying client's). */
+interface SocialSignInOptions {
+    provider: string;
+    callbackURL?: string;
+    errorCallbackURL?: string;
+    newUserCallbackURL?: string;
+    disableRedirect?: boolean;
+    scopes?: string[];
+    loginHint?: string;
+    requestSignUp?: boolean;
+    /** Sign in with a provider ID token instead of the redirect flow. */
+    idToken?: SocialIdTokenOptions;
+}
+/**
+ * Options for enterprise SSO sign-in - a SAFE SUBSET of the server's
+ * `signInSSOBodySchema` (the client posts the body wholesale, so no client-only
+ * fields leak onto the wire). It deliberately omits `scopes` and `providerType`,
+ * which stay server-resolved: the app injects `scopes` from the stored connection
+ * rather than trusting the caller, since user-supplied scopes would be a
+ * scope-escalation surface. Supply at least one of `email` / `providerId` /
+ * `domain` / `organizationSlug` so the server can resolve the connection; the
+ * drop-in resolves the IdP from the user's email domain. `callbackURL` is
+ * REQUIRED by the server - where the browser lands after the IdP round-trip.
+ */
+interface SsoSignInOptions {
+    /** The user's email; its domain identifies the SSO connection to use. */
+    email?: string;
+    /** Resolve the connection by its provider id directly (instead of by email domain). */
+    providerId?: string;
+    /** Resolve the connection by verified email domain directly. */
+    domain?: string;
+    /** Resolve the connection by the organization slug it is bound to. */
+    organizationSlug?: string;
+    /** Where the browser lands after the IdP round-trip. Required by the server. */
+    callbackURL: string;
+    /** Where to send the browser if the SSO flow fails. */
+    errorCallbackURL?: string;
+    /** Where to land when SSO provisions a new account (if the connection allows it). */
+    newUserCallbackURL?: string;
+    /** `login_hint` forwarded to the identity provider when it supports one. */
+    loginHint?: string;
+    /** Explicitly request sign-up when the connection has implicit sign-up disabled. */
+    requestSignUp?: boolean;
+}
+/** Options for passwordless magic-link sign-in (a link is emailed to the user). */
+interface MagicLinkSignInOptions {
+    email: string;
+    /** Where to land after the emailed link is followed. */
+    callbackURL?: string;
+    /** Where to send the browser if the link is invalid or expired. */
+    errorCallbackURL?: string;
+    /** Where to land when the link creates a new account (if the server allows it). */
+    newUserCallbackURL?: string;
+}
+/**
+ * Success payload of the magic-link request. No session is issued here - the
+ * link is emailed and the session is created when the user follows it.
+ */
+interface MagicLinkData {
+    status: boolean;
+}
+/** Purpose of an email one-time code. Sign-in is the SDK's passwordless flow. */
+type EmailOtpType = 'sign-in' | 'email-verification' | 'forget-password';
+/** Options to request an email one-time code. */
+interface SendVerificationOtpOptions {
+    email: string;
+    type: EmailOtpType;
+}
+/** Success payload of the send-OTP request (no session yet). */
+interface SendOtpData {
+    success: boolean;
+}
+/** Options to complete email-OTP sign-in with the emailed code. */
+interface EmailOtpSignInOptions {
+    email: string;
+    otp: string;
+}
+/** Options to complete required email ownership verification with a code. */
+interface VerifyEmailOtpOptions {
+    email: string;
+    otp: string;
+}
+interface VerifyEmailOtpData {
+    status: boolean;
+    user: AuthUser;
+}
+/** Start an Egyptian phone OTP sign-in. Reuse idempotencyKey after an ambiguous retry. */
+interface PhoneOtpStartOptions {
+    phoneNumber: string;
+    turnstileToken: string;
+    idempotencyKey?: string;
+}
+interface PhoneOtpStartData {
+    status: 'pending';
+}
+/** Verify the SMS code and create or resume the phone user's session. */
+interface PhoneOtpVerifyOptions {
+    phoneNumber: string;
+    code: string;
+    consentVersion?: number;
+}
+interface PhoneAuthUser {
+    id: string;
+    name?: string | null;
+    phoneNumber: string;
+    phoneNumberVerified: boolean;
+    createdAt?: Date;
+    updatedAt?: Date;
+}
+interface PhoneOtpVerifyData {
+    status: true;
+    sessionCreated: true;
+    user: PhoneAuthUser;
+}
+/** Options to request a password-reset email. */
+interface RequestPasswordResetOptions {
+    email: string;
+    /**
+     * Where the emailed reset link lands - the page hosting your reset form. The
+     * link validates the token server-side then redirects here with `?token=`. Its
+     * origin must be one of the project's allowed origins.
+     */
+    redirectTo?: string;
+}
+/** Options to set a new password with a reset token. */
+interface ResetPasswordOptions {
+    newPassword: string;
+    /** The token from the `?token=` query param the reset link redirected to. */
+    token: string;
+}
+/** Success payload of the request-reset / reset-password actions (no session). */
+interface PasswordResetData {
+    status: boolean;
+}
+/** Options to (re)send the email-verification link. */
+interface SendVerificationEmailOptions {
+    email: string;
+    /**
+     * Where the verification link lands after it confirms the address - the page
+     * hosting <VerifyEmail/>. Its origin must be one of the project's allowed
+     * origins. Defaults to "/" server-side when omitted.
+     */
+    callbackURL?: string;
+}
+/** Success payload of the send-verification-email action (no session). */
+interface VerificationEmailData {
+    status: boolean;
+}
+/** Options for passkey (WebAuthn) sign-in. */
+interface PasskeySignInOptions {
+    /**
+     * Use conditional mediation (browser autofill) instead of a modal. The caller
+     * must have an input with an `autocomplete` value containing `webauthn` on the
+     * page for the browser to surface passkeys; the promise resolves when the user
+     * picks one. Defaults to a modal prompt.
+     */
+    autoFill?: boolean;
+}
+/** Success payload of passkey sign-in. */
+interface PasskeyAuthData {
+    session: AuthSession;
+    user: AuthUser;
+}
+/**
+ * A registered passkey credential projected from the engine's row. Only `id`,
+ * `name`, `deviceType`, and `createdAt` are needed to render a management list;
+ * the rest are surfaced for completeness.
+ */
+interface AuthPasskey {
+    id: string;
+    name?: string | null;
+    publicKey: string;
+    userId: string;
+    credentialID: string;
+    counter: number;
+    /** WebAuthn credential device type. */
+    deviceType: 'singleDevice' | 'multiDevice';
+    backedUp: boolean;
+    transports?: string | null;
+    createdAt: Date;
+    aaguid?: string | null;
+}
+/** Options to register a new passkey for the signed-in user. */
+interface AddPasskeyOptions {
+    /** Human label shown in the passkey list (defaults to a browser-chosen name). */
+    name?: string;
+    /** Prefer a platform (device) or cross-platform (security key) authenticator. */
+    authenticatorAttachment?: 'platform' | 'cross-platform';
+}
+/** Options to rename an existing passkey. */
+interface UpdatePasskeyOptions {
+    id: string;
+    name: string;
+}
+/** Options to remove an existing passkey. */
+interface DeletePasskeyOptions {
+    id: string;
+}
+/** Success payload of the delete-passkey action. */
+interface DeletePasskeyData {
+    status: true;
+}
+/**
+ * Success payload of the update-passkey action. The engine returns the updated
+ * row wrapped as `{ passkey }` (not a bare passkey), so consumers read
+ * `res.data.passkey`.
+ */
+interface UpdatePasskeyData {
+    passkey: AuthPasskey;
+}
+/** Options to begin TOTP two-factor enrolment (password-gated). */
+interface EnableTwoFactorOptions {
+    password: string;
+    /** Overrides the issuer label shown in the authenticator app (defaults server-side). */
+    issuer?: string;
+}
+/**
+ * Enrolment payload: the `otpauth://` URI to render as a QR (and its embedded
+ * secret for manual entry) plus the one-time backup codes, shown ONCE. The factor
+ * is not active until a live TOTP is verified.
+ */
+interface TwoFactorEnableData {
+    totpURI: string;
+    backupCodes: string[];
+}
+/** Options to disable two-factor for the signed-in user (password-gated). */
+interface DisableTwoFactorOptions {
+    password: string;
+}
+/** Options to (re)generate the backup codes (password-gated), invalidating the old set. */
+interface GenerateBackupCodesOptions {
+    password: string;
+}
+/** Payload carrying a freshly-generated set of backup codes (shown once). */
+interface TwoFactorBackupCodesData {
+    backupCodes: string[];
+}
+/** Verify a TOTP code - to activate a new factor, or to clear a sign-in challenge. */
+interface VerifyTotpOptions {
+    code: string;
+    /** Skip the challenge on this device for ~30 days (sets a trusted-device cookie). */
+    trustDevice?: boolean;
+}
+/** Verify a single-use backup code to clear a sign-in challenge. */
+interface VerifyBackupCodeOptions {
+    code: string;
+    trustDevice?: boolean;
+}
+/** Request the emailed fallback code for a pending 2FA challenge (B.5d). */
+interface SendTwoFactorOtpOptions {
+    /**
+     * Inert here - the engine's send endpoint accepts this field but ignores it;
+     * device trust is granted only when you verify. Pass `trustDevice` to
+     * `verifyOtp` instead.
+     */
+    trustDevice?: boolean;
+}
+/** Success payload of the fallback-code send (the code goes to the user's email). */
+interface SendTwoFactorOtpData {
+    status: boolean;
+}
+/** Verify the emailed fallback code to clear a sign-in challenge. */
+interface VerifyTwoFactorOtpOptions {
+    code: string;
+    trustDevice?: boolean;
+}
+/**
+ * Result of clearing a 2FA challenge. The browser session is issued only via
+ * Set-Cookie; its durable token is never projected into JavaScript state.
+ */
+interface TwoFactorVerifyData {
+    status: true;
+}
+/** Success payload of enable/disable (the engine returns a bare status flag). */
+interface TwoFactorStatusData {
+    status: boolean;
+}
+/**
+ * Per-call fetch options every action accepts as an optional second argument -
+ * lifecycle callbacks and extra headers, matching the underlying client. The
+ * callback context is intentionally `unknown`: narrow it at the call site.
+ */
+interface ActionFetchOptions {
+    headers?: Record<string, string>;
+    /**
+     * Single-use Cloudflare Turnstile token for a protected public-auth action.
+     * The SDK transports it in `x-authowl-turnstile-token`; it is never serialized
+     * into the action JSON body. Obtain the token with the exact action name
+     * documented for the endpoint.
+     */
+    authChallengeToken?: string;
+    signal?: AbortSignal;
+    /**
+     * Retry safe GET network failures and 5xx responses, capped at three retries.
+     * POST and PATCH actions are never replayed by the generic client.
+     */
+    retry?: number;
+    onRequest?: (context: AuthRequestContext) => unknown;
+    onResponse?: (context: AuthResponseContext) => unknown;
+    onSuccess?: (context: AuthResponseContext) => unknown;
+    onError?: (context: AuthErrorContext) => unknown;
+}
+interface AuthOwlClient {
+    /** Framework-neutral session state. React consumers use `@authowl/react`'s `useSession()`. */
+    sessionStore: SessionStore;
+    /** Signed-in account profile, credential, session, provider, and deletion actions. */
+    account: AccountClient;
+    /** Signed-in organization, membership, role, and invitation actions. */
+    organization: OrganizationClient;
+    signIn: {
+        /**
+         * Email + password sign-in. For a two-factor-enrolled user the result is a
+         * {@link TwoFactorRedirectData} (no session) - branch on `twoFactorRedirect`
+         * before treating the sign-in as complete.
+         */
+        email(params: EmailSignInOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<EmailAuthData | TwoFactorRedirectData>>;
+        /** Username + password sign-in, when enabled by project policy. */
+        username(params: UsernameSignInOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<EmailAuthData | TwoFactorRedirectData>>;
+        social(params: SocialSignInOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<SocialAuthData>>;
+        /**
+         * Enterprise SSO (OIDC/SAML): resolve the tenant's identity provider (by the
+         * email domain, or an explicit `providerId`/`domain`/`organizationSlug`) and
+         * redirect the browser to it. Always a redirect flow - no session is issued
+         * here; it is minted when the provider callback lands on a fresh page.
+         */
+        sso(params: SsoSignInOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<SsoAuthData>>;
+        /** Passwordless: email a one-time sign-in link. */
+        magicLink(params: MagicLinkSignInOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<MagicLinkData>>;
+        /** Passwordless: complete sign-in with an emailed one-time code. */
+        emailOtp(params: EmailOtpSignInOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<EmailOtpAuthData>>;
+        /** Passwordless: sign in with a registered passkey (WebAuthn). */
+        passkey(params?: PasskeySignInOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<PasskeyAuthData>>;
+    };
+    signUp: {
+        email(params: EmailSignUpOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<EmailSignUpData>>;
+    };
+    /** Public email-only waitlist enrollment for this environment. */
+    waitlist: {
+        join(params: WaitlistJoinOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<WaitlistJoinData>>;
+    };
+    /** Email one-time-code actions (request side; completion is `signIn.emailOtp`). */
+    emailOtp: {
+        sendVerificationOtp(params: SendVerificationOtpOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<SendOtpData>>;
+        /** Complete a required email verification ceremony with an emailed code. */
+        verifyEmail(params: VerifyEmailOtpOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<VerifyEmailOtpData>>;
+    };
+    /** Managed Egyptian phone OTP. Start sends the code; verify establishes the session. */
+    phoneOtp: {
+        start(params: PhoneOtpStartOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<PhoneOtpStartData>>;
+        verify(params: PhoneOtpVerifyOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<PhoneOtpVerifyData>>;
+    };
+    /** Email a password-reset link to the user (no session issued). */
+    requestPasswordReset(params: RequestPasswordResetOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<PasswordResetData>>;
+    /** Set a new password using the token from a reset link. */
+    resetPassword(params: ResetPasswordOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<PasswordResetData>>;
+    /** (Re)send the email-verification link. No session required. */
+    sendVerificationEmail(params: SendVerificationEmailOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<VerificationEmailData>>;
+    /** Passkey management for the signed-in user. */
+    passkey: {
+        addPasskey(params?: AddPasskeyOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<AuthPasskey>>;
+        /**
+         * List the signed-in user's passkeys. Takes no argument: this is a GET
+         * endpoint and the underlying client would send a first argument as a POST
+         * body (flipping the method), so fetch options are intentionally not exposed.
+         */
+        listUserPasskeys(): Promise<AuthActionResult<AuthPasskey[]>>;
+        updatePasskey(params: UpdatePasskeyOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<UpdatePasskeyData>>;
+        deletePasskey(params: DeletePasskeyOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<DeletePasskeyData>>;
+    };
+    /**
+     * TOTP two-factor for the signed-in user (enrolment) and the sign-in challenge
+     * (verify). Enrolment is password-gated; a factor only becomes active once a live
+     * TOTP is verified. Drives {@link useMFA}/<MFAEnrollment/>/<MFAChallenge/>.
+     */
+    twoFactor: {
+        /** Begin enrolment: returns the TOTP URI + one-time backup codes (factor stays inactive until verified). */
+        enable(params: EnableTwoFactorOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<TwoFactorEnableData>>;
+        /** Turn two-factor off for the user (password-gated). */
+        disable(params: DisableTwoFactorOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<TwoFactorStatusData>>;
+        /** Verify a TOTP code: activates a pending factor, or clears a sign-in challenge. */
+        verifyTotp(params: VerifyTotpOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<TwoFactorVerifyData>>;
+        /** Clear a sign-in challenge with a single-use backup code. */
+        verifyBackupCode(params: VerifyBackupCodeOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<TwoFactorVerifyData>>;
+        /**
+         * Email a fallback second-factor code for the pending challenge (B.5d -
+         * the lost-authenticator path; only live during a challenge).
+         */
+        sendOtp(params?: SendTwoFactorOtpOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<SendTwoFactorOtpData>>;
+        /** Clear a sign-in challenge with the emailed fallback code. */
+        verifyOtp(params: VerifyTwoFactorOtpOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<TwoFactorVerifyData>>;
+        /** Regenerate the backup codes (password-gated), invalidating the previous set. */
+        generateBackupCodes(params: GenerateBackupCodesOptions, fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<TwoFactorBackupCodesData>>;
+    };
+    signOut(fetchOptions?: ActionFetchOptions): Promise<AuthActionResult<SignOutData>>;
+    /**
+     * One-shot session fetch (the reactive form is `sessionStore`). `query.
+     * disableCookieCache: true` forces a database read - required before acting
+     * on `pendingMfaEnrollment` (its cookie-cached value can be stale-true for
+     * up to 5 minutes; CONTRACTS §5).
+     */
+    getSession(options?: {
+        query?: {
+            disableCookieCache?: boolean;
+        };
+    }): Promise<AuthActionResult<{
+        session: AuthSession;
+        user: AuthUser;
+    } | null>>;
+    /**
+     * Mint a short-lived JWT for third-party backends (Convex/Supabase/Hasura;
+     * requires the project's JWT issuer to be enabled). Cached in memory and
+     * refreshed ahead of expiry. `{ template: 'convex' }` selects a named
+     * environment template and `{ forceRefresh: true }` bypasses only that
+     * template's cache entry.
+     * Resolves `null` when nobody is signed in; throws on other failures.
+     */
+    getToken: GetToken;
+    /**
+     * Legal-consent status for the signed-in user. Drives the re-consent gate: when
+     * the operator bumps the terms version, `needsConsent` flips true until the user
+     * accepts. `{ required: false }` when the project has no gate or nobody's signed in.
+     */
+    getConsentStatus(): Promise<ConsentStatus>;
+    /**
+     * Record the signed-in user's acceptance of the terms `version` they were shown
+     * (echo `getConsentStatus().version`). A 409 (the operator bumped the version
+     * meanwhile) surfaces as a thrown error; re-fetch the status and re-prompt.
+     */
+    acceptConsent(version: number): Promise<ConsentAcceptResult>;
+}
+/**
+ * Build the underlying auth client pointed at the project's per-project endpoint.
+ * Every request is sent with credentials so the HttpOnly session cookie flows
+ * cross-origin (server must set SameSite=None + Secure for this to work).
+ * The publishable key travels in X-Publishable-Key on every request.
+ */
+declare function createAuthOwlClient(config: ResolvedAuthConfig): AuthOwlClient;
+
+export { type ListOrganizationTeamsOptions as $, AUTH_CHALLENGE_HEADER as A, type EmailOtpAuthData as B, type ChangeEmailOptions as C, type DeleteAccountData as D, type EmailAuthData as E, type EmailOtpSignInOptions as F, type EmailOtpType as G, type EmailSignInOptions as H, type EmailSignUpData as I, type EmailSignUpOptions as J, type EnableTwoFactorOptions as K, type EnvironmentType as L, type GenerateBackupCodesOptions as M, type GetOrganizationInvitationOptions as N, type GetOrganizationOptions as O, type GetToken as P, type GetTokenOptions as Q, type InviteOrganizationMemberOptions as R, type JsonObject as S, type JsonPrimitive as T, type JsonValue as U, type LeaveOrganizationOptions as V, type LinkSocialData as W, type LinkSocialOptions as X, type ListOrganizationInvitationsOptions as Y, type ListOrganizationMembersOptions as Z, type ListOrganizationRolesOptions as _, type AcceptOrganizationInvitationData as a, type VerifyEmailOtpData as a$, type MagicLinkData as a0, type MagicLinkSignInOptions as a1, type Organization as a2, type OrganizationClient as a3, type OrganizationDetails as a4, type OrganizationFilterOperator as a5, type OrganizationInvitation as a6, type OrganizationInvitationActionOptions as a7, type OrganizationInvitationDetails as a8, type OrganizationInvitationStatus as a9, type SendTwoFactorOtpOptions as aA, type SendVerificationOtpOptions as aB, type SessionState as aC, type SessionStore as aD, type SetActiveOrganizationOptions as aE, type SetActiveTeamOptions as aF, type SignOutData as aG, type SocialAccount as aH, type SocialAuthData as aI, type SocialIdTokenOptions as aJ, type SocialSignInOptions as aK, type TokenClient as aL, type TwoFactorBackupCodesData as aM, type TwoFactorEnableData as aN, type TwoFactorRedirectData as aO, type TwoFactorStatusData as aP, type TwoFactorVerifyData as aQ, type UnlinkSocialOptions as aR, type UpdateOrganizationMemberRoleOptions as aS, type UpdateOrganizationOptions as aT, type UpdatePasskeyData as aU, type UpdatePasskeyOptions as aV, type UpdateProfileOptions as aW, type UpdateUnsafeMetadataOptions as aX, type UserMetadata as aY, type UsernameSignInOptions as aZ, type VerifyBackupCodeOptions as a_, type OrganizationMember as aa, type OrganizationMemberUser as ab, type OrganizationMemberWithUser as ac, type OrganizationMembersData as ad, type OrganizationRoleSummary as ae, type OrganizationSelector as af, type OrganizationTeam as ag, type OrganizationUserInvitation as ah, type PasskeyAuthData as ai, type PasskeySignInOptions as aj, type PasswordResetData as ak, type PhoneAuthUser as al, type PhoneOtpStartData as am, type PhoneOtpStartOptions as an, type PhoneOtpVerifyData as ao, type PhoneOtpVerifyOptions as ap, type ProjectCapabilities as aq, type PublicConfig as ar, type RejectOrganizationInvitationData as as, type RemoveOrganizationMemberData as at, type RemoveOrganizationMemberOptions as au, type RequestPasswordResetOptions as av, type ResetPasswordOptions as aw, type RevokeSessionOptions as ax, type SendOtpData as ay, type SendTwoFactorOtpData as az, type AccountClient as b, type VerifyEmailOtpOptions as b0, type VerifyTotpOptions as b1, type VerifyTwoFactorOtpOptions as b2, type WaitlistJoinData as b3, type WaitlistJoinOptions as b4, acceptConsent as b5, createAuthOwlClient as b6, createTokenClient as b7, getConsentStatus as b8, getPublicConfig as b9, resolveProjectCapabilities as ba, createAuthHttpClient as bb, type AuthHttpClient as bc, type AccountSession as c, type AccountStatusData as d, type ActionFetchOptions as e, type AddPasskeyOptions as f, type AuthActionResult as g, type AuthClientError as h, type AuthErrorContext as i, type AuthOwlClient as j, type AuthOwlErrorCode as k, type AuthPasskey as l, type AuthRequestContext as m, type AuthResponseContext as n, type AuthSession as o, type AuthUser as p, type ChangePasswordData as q, type ChangePasswordOptions as r, type ConsentAcceptResult as s, type ConsentStatus as t, type CreateOrganizationOptions as u, type DeleteAccountOptions as v, type DeleteOrganizationOptions as w, type DeletePasskeyData as x, type DeletePasskeyOptions as y, type DisableTwoFactorOptions as z };