@authsome/ui-core 0.1.9 → 1.0.0

package/dist/index.d.ts

@@ -1,825 +1,1294 @@
-import { A as AuthErrorType, a as AuthError, V as ValidationError, C as CookieData, b as AuthContext, c as AuthProvider, S as SignInRequest, d as SignUpRequest, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, r as Organization, s as OrganizationMembership, t as User, u as Session } from './provider-DWklI8Wr.js';
-export { Q as AuthResponse, v as AuthState, a3 as Device, F as DeviceAuthorizeRequest, B as DeviceCodeVerifyRequest, E as DeviceCodeVerifyResponse, D as DeviceFlowInitiateRequest, z as DeviceFlowInitiateResponse, G as DeviceTokenPollRequest, I as DeviceTokenPollResponse, H as DeviceTokenPollStatus, $ as EnrollMFAFactorRequest, L as FieldDefinition, K as FieldType, J as FieldValidation, a5 as ListSessionsOptions, a6 as ListSessionsResponse, a1 as MFAChallengeRequest, a2 as MFAChallengeResponse, _ as MFAFactor, x as OAuthConfig, R as ProviderConfig, W as RequestContext, Z as ResendVerificationRequest, X as SendVerificationEmailRequest, w as SessionData, a4 as SessionInfo, N as SignupFieldsResponse, y as TwoFactorConfig, Y as VerifyEmailRequest, a0 as VerifyMFAFactorRequest } from './provider-DWklI8Wr.js';
-import { Storage, Observable, Unsubscribe } from './types/index.js';
-export { Listener, LocalStorageAdapter, MemoryStorageAdapter, SessionStorageAdapter } from './types/index.js';
-export { BaseAuthProvider } from './adapters/index.js';
+interface ACSRequest {
+    Provider: string;
+    RelayState: string;
+    SAMLResponse: string;
+}
+interface AdminDeleteUserRequest {
+    UserID: string;
+}
+interface AdminImpersonateRequest {
+    UserID: string;
+}
+interface AdminStatsResponse {
+    total_organizations: number;
+    total_users: number;
+}
+interface AdminStopImpersonationRequest {
+}
+interface AdminUnbanUserRequest {
+    UserID: string;
+}
+interface AdminUserListResponse {
+    next_cursor?: string;
+    total: number;
+    users: User[];
+}
+interface AuthResponse {
+    expires_at: string;
+    refresh_token: string;
+    session_token: string;
+    user: User;
+}
+interface CallbackRequest {
+    Provider: string;
+    code: string;
+    error?: string;
+    state: string;
+}
+interface CallbackResponse {
+    expires_at: string;
+    is_new_user: boolean;
+    provider: string;
+    refresh_token: string;
+    session_token: string;
+    user: User;
+}
+interface ChallengeRequest {
+    code: string;
+}
+interface ChallengeResponse {
+    challenge_passed: boolean;
+    method: string;
+}
+interface CreateKeyRequest {
+    app_id: string;
+    name: string;
+    scopes?: string[];
+    user_id: string;
+}
+interface CreateKeyResponse {
+    created_at: string;
+    expires_at?: string;
+    id: string;
+    key: string;
+    key_prefix: string;
+    name: string;
+    scopes?: string[];
+}
+interface CredentialInfo {
+    created_at: string;
+    display_name: string;
+    id: string;
+    transport: string[];
+}
+interface DeleteAccountRequest {
+}
+interface DeleteDeviceRequest {
+    DeviceID: string;
+}
+interface DeleteOrgRequest {
+    OrgID: string;
+}
+interface DeleteRequest {
+    CredentialID: string;
+}
+interface DeleteResponse {
+    status: string;
+}
+interface DeleteRoleRequest {
+    RoleID: string;
+}
+interface DeleteTeamRequest {
+    OrgID: string;
+    TeamID: string;
+}
+interface DeleteWebhookRequest {
+    WebhookID: string;
+}
+interface Device {
+    app_id: ID;
+    browser?: string;
+    created_at: string;
+    fingerprint?: string;
+    id: ID;
+    ip_address?: string;
+    last_seen_at: string;
+    name?: string;
+    os?: string;
+    trusted: boolean;
+    type?: string;
+    updated_at: string;
+    user_id: ID;
+}
+interface DeviceListResponse {
+    devices: Device[];
+}
+interface DisableRequest {
+}
+interface DisableResponse {
+    status: string;
+}
+interface EnrollRequest {
+    method?: string;
+    phone?: string;
+}
+interface EnrollResponse {
+    id: string;
+    method: string;
+    otpauth_url: string;
+    secret: string;
+}
+interface ForgotPasswordResponse {
+    status: string;
+}
+interface HealthResponse {
+    error?: string;
+    status: string;
+}
+interface ID {
+}
+interface Invitation {
+    created_at: string;
+    email: string;
+    expires_at: string;
+    id: ID;
+    inviter_id: ID;
+    org_id: ID;
+    role: string;
+    status: string;
+}
+interface InvitationListResponse {
+    invitations: Invitation[];
+}
+interface KeyListItem {
+    created_at: string;
+    expires_at?: string;
+    id: string;
+    key_prefix: string;
+    last_used_at?: string;
+    name: string;
+    revoked: boolean;
+    scopes?: string[];
+}
+interface ListKeysResponse {
+    keys: KeyListItem[];
+    total: number;
+}
+interface ListResponse$1 {
+    credentials: CredentialInfo[];
+}
+interface LoginBeginRequest {
+    email?: string;
+}
+interface LoginBeginResponse {
+    options: Record<string, unknown>;
+}
+interface LoginFinishRequest {
+}
+interface LoginFinishResponse {
+    status: string;
+    user_id: string;
+}
+interface LoginRequest {
+    Provider: string;
+}
+interface LoginResponse {
+    login_url: string;
+    state: string;
+}
+interface Member {
+    created_at: string;
+    id: ID;
+    org_id: ID;
+    role: string;
+    updated_at: string;
+    user_id: ID;
+}
+interface MemberListResponse {
+    members: Member[];
+}
+interface OrgListResponse {
+    organizations: Organization[];
+}
+interface Organization {
+    app_id: ID;
+    created_at: string;
+    created_by: ID;
+    id: ID;
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    slug: string;
+    updated_at: string;
+}
+interface Permission {
+    action: string;
+    id: string;
+    resource: string;
+    role_id: string;
+}
+interface PermissionListResponse {
+    permissions: Permission[];
+}
+interface RecoveryRegenerateRequest {
+}
+interface RecoveryRegenerateResponse {
+    codes: string[];
+}
+interface RecoveryVerifyRequest {
+    code: string;
+}
+interface RecoveryVerifyResponse {
+    challenge_passed: boolean;
+    codes_remaining: number;
+}
+interface RegisterBeginRequest {
+    display_name?: string;
+}
+interface RegisterBeginResponse {
+    options: Record<string, unknown>;
+}
+interface RegisterFinishRequest {
+}
+interface RegisterFinishResponse {
+    display_name: string;
+    id: string;
+    status: string;
+}
+interface RemoveMemberRequest {
+    MemberID: string;
+    OrgID: string;
+}
+interface RemovePermissionRequest {
+    PermissionID: string;
+    RoleID: string;
+}
+interface RevokeKeyRequest {
+    KeyID: string;
+}
+interface RevokeSessionRequest {
+    SessionID: string;
+}
+interface Role {
+    app_id: string;
+    created_at: string;
+    description?: string;
+    id: string;
+    name: string;
+    parent_id?: string;
+    slug: string;
+    updated_at: string;
+}
+interface RoleListResponse {
+    roles: Role[];
+}
+interface SMSSendRequest {
+    phone?: string;
+}
+interface SMSSendResponse {
+    expires_in_seconds: number;
+    phone_masked: string;
+    sent: boolean;
+}
+interface SMSVerifyRequest {
+    code: string;
+}
+interface SMSVerifyResponse {
+    method: string;
+    verified: boolean;
+}
+interface SendRequest {
+    app_id?: string;
+    email: string;
+}
+interface SendResponse {
+    status: string;
+}
+interface SessionListResponse {
+    sessions: Record<string, unknown>[];
+}
+interface SignOutRequest {
+}
+interface SlugAvailableResponse {
+    available: boolean;
+}
+interface StartRequest {
+    Provider: string;
+}
+interface StartResponse {
+    auth_url: string;
+}
+interface StatusResponse {
+    status: string;
+}
+interface Team {
+    created_at: string;
+    id: ID;
+    name: string;
+    org_id: ID;
+    slug: string;
+    updated_at: string;
+}
+interface TeamListResponse {
+    teams: Team[];
+}
+interface TokenResponse {
+    expires_at: string;
+    refresh_token: string;
+    session_token: string;
+}
+interface TrustDeviceRequest {
+    DeviceID: string;
+}
+interface User {
+    app_id: ID;
+    ban_expires?: string;
+    ban_reason?: string;
+    banned: boolean;
+    created_at: string;
+    deleted_at?: string;
+    display_username?: string;
+    email: string;
+    email_verified: boolean;
+    id: ID;
+    image?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    phone?: string;
+    phone_verified: boolean;
+    updated_at: string;
+    username?: string;
+}
+interface UserRoleListResponse {
+    roles: Role[];
+}
+interface VerifyMFARequest {
+    code: string;
+}
+interface VerifyMFAResponse {
+    method: string;
+    recovery_codes?: string[];
+    verified: boolean;
+}
+interface VerifyRequest {
+    app_id?: string;
+    token: string;
+}
+interface VerifyResponse {
+    expires_at: string;
+    refresh_token: string;
+    session_token: string;
+    user: User;
+}
+interface Webhook {
+    active: boolean;
+    app_id: ID;
+    created_at: string;
+    events: string[];
+    id: ID;
+    updated_at: string;
+    url: string;
+}
+interface WebhookListResponse {
+    webhooks: Webhook[];
+}
+type AdminBanUserRequest = {
+    expires_at?: string;
+    reason?: string;
+};
+type ChangePasswordRequest = {
+    current_password: string;
+    new_password: string;
+};
+type ForgotPasswordRequest = {
+    app_id?: string;
+    email: string;
+};
+type CreateAPIKeyRequest = CreateKeyRequest;
+type RevokeAPIKeyRequest = RevokeKeyRequest;
+type SendMagicLinkRequest = SendRequest;
+type VerifyMagicLinkRequest = VerifyRequest;
+type UpdateMeRequest = {
+    image?: string;
+    name?: string;
+    username?: string;
+};
+type DeleteMeRequest = DeleteAccountRequest;
+type ChallengeMFARequest = ChallengeRequest;
+type EnrollMFARequest = EnrollRequest;
+type DisableMFARequest = DisableRequest;
+type RegenerateMFARecoveryCodesRequest = RecoveryRegenerateRequest;
+type VerifyRecoveryCodeRequest = RecoveryVerifyRequest;
+type SendSMSCodeRequest = SMSSendRequest;
+type VerifySMSCodeRequest = SMSVerifyRequest;
+type CreateOrganizationRequest = {
+    app_id?: string;
+    logo?: string;
+    name: string;
+    slug: string;
+};
+type AcceptInvitationRequest = {
+    token: string;
+};
+type DeclineInvitationRequest = {
+    token: string;
+};
+type UpdateOrganizationRequest = {
+    logo?: string;
+    name?: string;
+};
+type DeleteOrganizationRequest = DeleteOrgRequest;
+type CreateInvitationRequest = {
+    email: string;
+    role?: string;
+};
+type AddMemberRequest = {
+    role?: string;
+    user_id: string;
+};
+type UpdateMemberRequest = {
+    role: string;
+};
+type CreateTeamRequest = {
+    name: string;
+    slug: string;
+};
+type UpdateTeamRequest = {
+    name?: string;
+    slug?: string;
+};
+type PasskeyLoginBeginRequest = LoginBeginRequest;
+type PasskeyLoginFinishRequest = LoginFinishRequest;
+type PasskeyRegisterBeginRequest = RegisterBeginRequest;
+type PasskeyRegisterFinishRequest = RegisterFinishRequest;
+type DeletePasskeyRequest = DeleteRequest;
+type RefreshRequest = {
+    refresh_token: string;
+};
+type ResetPasswordRequest = {
+    new_password: string;
+    token: string;
+};
+type CreateRoleRequest = {
+    app_id?: string;
+    description?: string;
+    name: string;
+    parent_id?: string;
+    slug: string;
+};
+type UpdateRoleRequest = {
+    description?: string;
+    name?: string;
+    parent_id?: string;
+};
+type AssignRoleRequest = {
+    org_id?: string;
+    user_id: string;
+};
+type AddPermissionRequest = {
+    action: string;
+    resource: string;
+};
+type UnassignRoleRequest = {
+    user_id: string;
+};
+type SignInRequest = {
+    app_id?: string;
+    email?: string;
+    password: string;
+    username?: string;
+};
+type SignUpRequest = {
+    app_id?: string;
+    email: string;
+    name?: string;
+    password: string;
+    username?: string;
+};
+type StartOAuthRequest = StartRequest;
+type SsoACSRequest = ACSRequest;
+type SsoCallbackRequest = CallbackRequest;
+type StartSSOLoginRequest = LoginRequest;
+type VerifyEmailRequest = {
+    token: string;
+};
+type CreateWebhookRequest = {
+    app_id?: string;
+    events: string[];
+    url: string;
+};
+type UpdateWebhookRequest = {
+    active?: boolean;
+    events?: string[];
+    url?: string;
+};
 
-/**
- * Error handling utilities
- */
+/** Core type definitions for AuthSome UI Kit. */
 
+interface Session {
+    session_token: string;
+    refresh_token: string;
+    expires_at: string;
+}
+/** API error response. */
+interface APIError {
+    error: string;
+    code?: number;
+}
+/** Authentication state. */
+type AuthState = {
+    status: "idle";
+} | {
+    status: "loading";
+} | {
+    status: "authenticated";
+    user: User;
+    session: Session;
+} | {
+    status: "unauthenticated";
+} | {
+    status: "mfa_required";
+    session: Session;
+} | {
+    status: "error";
+    error: string;
+};
+/** Configuration for the AuthSome client. */
+interface AuthConfig {
+    /** Base URL of the AuthSome API (e.g., "https://api.example.com"). */
+    baseURL: string;
+    /** Publishable key for auto-discovering enabled auth methods. */
+    publishableKey?: string;
+    /** Pre-fetched client config (useful for SSR). */
+    initialClientConfig?: ClientConfig;
+    /** Custom fetch implementation (defaults to global fetch). */
+    fetch?: typeof fetch;
+    /** Storage implementation for persisting tokens (defaults to localStorage). */
+    storage?: TokenStorage;
+    /** Callback invoked when the auth state changes. */
+    onStateChange?: (state: AuthState) => void;
+    /** Callback invoked on authentication error. */
+    onError?: (error: APIError) => void;
+}
+/** Social provider info from the backend. */
+interface SocialProviderConfig {
+    id: string;
+    name: string;
+}
+/** SSO connection info from the backend. */
+interface SSOConnectionConfig {
+    id: string;
+    name: string;
+}
 /**
- * Create an auth error
+ * Client configuration returned by the backend.
  *
- * @deprecated Use `new AuthError()` directly instead
- */
-declare function createAuthError(type: AuthErrorType, message: string, details?: Record<string, unknown>, code?: string | number): AuthError;
-/**
- * Check if an error is an auth error
- */
-declare function isAuthError(error: unknown): error is AuthError;
-/**
- * Convert unknown error to auth error
- */
-declare function toAuthError(error: unknown): AuthError;
-/**
- * Check if error is a network error
+ * Describes which auth methods are enabled so SDK components
+ * can auto-configure their UI without manual props.
  */
-declare function isNetworkError(error: unknown): boolean;
-/**
- * Check if error indicates authentication is required
- */
-declare function isUnauthenticatedError(error: unknown): boolean;
-/**
- * Check if error requires MFA
- */
-declare function isMFARequiredError(error: unknown): boolean;
-
-/**
- * Internationalization (i18n) types and interfaces
- */
-/**
- * Complete locale interface for all auth-related text
- */
-interface AuthLocale {
-    common: {
-        loading: string;
-        submit: string;
-        cancel: string;
-        continue: string;
-        back: string;
-        or: string;
-        optional: string;
-    };
-    auth: {
-        signIn: string;
-        signUp: string;
-        signOut: string;
-        email: string;
-        password: string;
-        confirmPassword: string;
-        username: string;
-        phone: string;
-        rememberMe: string;
-        forgotPassword: string;
-        continueWith: string;
-        orContinueWith: string;
-    };
-    oauth: {
-        google: string;
-        github: string;
-        microsoft: string;
-        facebook: string;
-        apple: string;
-        discord: string;
-        twitter: string;
-        linkedin: string;
-        chooseProvider: string;
-        signInPreferred: string;
-    };
-    magicLink: {
-        sendLink: string;
-        checkEmail: string;
-        linkSent: string;
-        enterEmail: string;
-    };
-    phone: {
-        enterPhone: string;
-        sendCode: string;
-        enterCode: string;
-        verifyPhone: string;
-        codeLabel: string;
+interface ClientConfig {
+    version?: string;
+    app_id?: string;
+    branding?: {
+        app_name?: string;
+        logo_url?: string;
     };
-    mfa: {
-        required: string;
-        selectMethod: string;
-        verify: string;
-        enterCode: string;
-        sms: string;
-        authenticator: string;
-        email: string;
+    password?: {
+        enabled: boolean;
     };
-    passkey: {
-        signInWith: string;
-        register: string;
-        usePasskey: string;
+    social?: {
+        enabled: boolean;
+        providers: SocialProviderConfig[];
     };
-    deviceFlow: {
-        title: string;
-        subtitle: string;
-        enterCode: string;
-        enterCodeDescription: string;
-        codeLabel: string;
-        codePlaceholder: string;
-        codeHint: string;
-        verify: string;
-        verifyCode: string;
-        invalidCode: string;
-        noCode: string;
-        getCodeHelp: string;
-        authorizationTitle: string;
-        authorizationSubtitle: string;
-        authorizeTitle: string;
-        authorizeDescription: string;
-        requestingAccess: string;
-        codeConfirm: string;
-        requestedPermissions: string;
-        securityWarning: string;
-        scopes: string;
-        approve: string;
-        deny: string;
-        authorizedTitle: string;
-        authorizedMessage: string;
-        authorizedDescription: string;
-        authorizedHint: string;
-        returnToCli: string;
-        deniedTitle: string;
-        deniedMessage: string;
-        deniedDescription: string;
-        deniedHint: string;
+    passkey?: {
+        enabled: boolean;
     };
-    signUp: {
-        title: string;
-        subtitle: string;
-        haveAccount: string;
-        signInLink: string;
-        agreeToTerms: string;
-        terms: string;
+    mfa?: {
+        enabled: boolean;
+        methods: string[];
     };
-    signIn: {
-        title: string;
-        subtitle: string;
-        noAccount: string;
-        signUpLink: string;
-        enterEmail: string;
+    magiclink?: {
+        enabled: boolean;
     };
-    validation: {
-        emailRequired: string;
-        emailInvalid: string;
-        passwordRequired: string;
-        passwordTooShort: string;
-        passwordRequireUppercase: string;
-        passwordRequireLowercase: string;
-        passwordRequireNumber: string;
-        passwordRequireSpecial: string;
-        passwordMismatch: string;
-        usernameRequired: string;
-        usernameInvalid: string;
-        phoneRequired: string;
-        phoneInvalid: string;
-        codeRequired: string;
-        codeInvalid: string;
-        fieldRequired: string;
-        termsRequired: string;
-    };
-    errors: {
-        invalidCredentials: string;
-        userNotFound: string;
-        userExists: string;
-        invalidToken: string;
-        tokenExpired: string;
-        networkError: string;
-        mfaRequired: string;
-        emailNotVerified: string;
-        phoneNotVerified: string;
-        rateLimitExceeded: string;
-        unknownError: string;
-        generic: string;
-    };
-    success: {
-        signedIn: string;
-        signedUp: string;
-        signedOut: string;
-        linkSent: string;
-        codeSent: string;
-        verified: string;
-        welcome: string;
-    };
-    placeholders: {
-        email: string;
-        password: string;
-        confirmPassword: string;
-        username: string;
-        phone: string;
-        code: string;
-        fullName: string;
+    sso?: {
+        enabled: boolean;
+        connections: SSOConnectionConfig[];
     };
+    /** List of server-side plugin names that are installed and active. */
+    supported_plugins?: string[];
+}
+/** Interface for persisting tokens across sessions. */
+interface TokenStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
 }
-/**
- * Deep partial type for locale overrides
- */
-type DeepPartial<T> = {
-    [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P];
-};
-
-/**
- * Validation utilities
- */
-
-/**
- * Validate email address
- */
-declare function validateEmail(email: string, locale?: AuthLocale): ValidationError | null;
-/**
- * Validate password
- */
-declare function validatePassword(password: string, options?: {
-    minLength?: number;
-    requireUppercase?: boolean;
-    requireLowercase?: boolean;
-    requireNumber?: boolean;
-    requireSpecial?: boolean;
-    locale?: AuthLocale;
-}): ValidationError | null;
-/**
- * Validate phone number
- */
-declare function validatePhone(phone: string, locale?: AuthLocale): ValidationError | null;
-/**
- * Validate username
- */
-declare function validateUsername(username: string, locale?: AuthLocale): ValidationError | null;
-/**
- * Validate 2FA code
- */
-declare function validate2FACode(code: string, locale?: AuthLocale): ValidationError | null;
-/**
- * Validate required field
- */
-declare function validateRequired(value: unknown, fieldName: string, locale?: AuthLocale): ValidationError | null;
-
-/**
- * Token management utilities
- */
 
-/**
- * Token manager class
- */
-declare class TokenManager {
-    private storage;
-    constructor(storage?: Storage);
+interface AuthClientConfig {
+    /** Base URL of the AuthSome API (e.g., "https://api.example.com") */
+    baseURL: string;
+    /** Optional custom fetch implementation */
+    fetch?: typeof globalThis.fetch;
+}
+declare class AuthClient$1 {
+    private baseURL;
+    private fetchFn;
+    constructor(config: AuthClientConfig | Pick<{
+        baseURL: string;
+        fetch?: typeof globalThis.fetch;
+    }, 'baseURL' | 'fetch'>);
     /**
-     * Get access token
+     * Get AuthSome manifest
+     * GET /.well-known/authsome/manifest
      */
-    getToken(): Promise<string | null>;
+    getManifest(): Promise<Record<string, unknown>>;
     /**
-     * Set access token
+     * Get OpenAPI specification
+     * GET /.well-known/authsome/openapi
      */
-    setToken(token: string): Promise<void>;
+    getOpenAPI(): Promise<Record<string, unknown>>;
     /**
-     * Remove access token
+     * Stop impersonation (admin)
+     * POST /v1/auth/admin/impersonate/stop
      */
-    removeToken(): Promise<void>;
+    adminStopImpersonation(body: AdminStopImpersonationRequest, token: string): Promise<StatusResponse>;
     /**
-     * Get refresh token
+     * Impersonate user (admin)
+     * POST /v1/auth/admin/impersonate/{userId}
      */
-    getRefreshToken(): Promise<string | null>;
+    adminImpersonate(userId: string, body: AdminImpersonateRequest, token: string): Promise<AuthResponse>;
     /**
-     * Set refresh token
+     * List organizations (admin)
+     * GET /v1/auth/admin/orgs
      */
-    setRefreshToken(token: string): Promise<void>;
+    adminListOrgs(token: string): Promise<OrgListResponse>;
     /**
-     * Remove refresh token
+     * Get stats (admin)
+     * GET /v1/auth/admin/stats
      */
-    removeRefreshToken(): Promise<void>;
+    adminGetStats(token: string): Promise<AdminStatsResponse>;
     /**
-     * Clear all tokens
+     * List users (admin)
+     * GET /v1/auth/admin/users
      */
-    clearTokens(): Promise<void>;
+    adminListUsers(token: string): Promise<AdminUserListResponse>;
     /**
-     * Check if token is expired
+     * Get user (admin)
+     * GET /v1/auth/admin/users/{userId}
      */
-    isTokenExpired(token: string): boolean;
+    adminGetUser(userId: string, token: string): Promise<User>;
     /**
-     * Decode JWT token (without verification)
+     * Delete user (admin)
+     * DELETE /v1/auth/admin/users/{userId}
      */
-    private decodeToken;
-}
-
-/**
- * Cookie utility functions
- * Framework-agnostic helpers for cookie parsing and serialization
- */
-
-/**
- * Parse Set-Cookie header value into CookieData
- * @param setCookieHeader - The Set-Cookie header value
- * @returns Parsed cookie data
- */
-declare function parseCookie(setCookieHeader: string): CookieData | null;
-/**
- * Extract multiple cookies from Set-Cookie headers
- * @param setCookieHeaders - Array of Set-Cookie header values or single string
- * @returns Array of parsed cookies
- */
-declare function extractCookiesFromHeaders(setCookieHeaders: string | string[]): CookieData[];
-/**
- * Serialize a CookieData object into a Set-Cookie header value
- * @param cookie - The cookie data to serialize
- * @returns Set-Cookie header value
- */
-declare function serializeCookie(cookie: CookieData): string;
-/**
- * Parse Cookie header value into key-value pairs
- * @param cookieHeader - The Cookie header value
- * @returns Object with cookie name-value pairs
- */
-declare function parseCookieOptions(cookieHeader: string): Record<string, string>;
-/**
- * Convert cookie object to Cookie header string
- * @param cookies - Object with cookie name-value pairs
- * @returns Cookie header value
- */
-declare function serializeCookies(cookies: Record<string, string>): string;
-
-/**
- * Locale utility functions
- */
-
-/**
- * Default locale (English)
- */
-declare const defaultLocale: AuthLocale;
-/**
- * Create a complete locale by merging overrides with the default English locale
- *
- * @param overrides - Partial locale object with custom translations
- * @returns Complete locale object with all required keys
- *
- * @example
- * ```typescript
- * const spanishLocale = createLocale({
- *   auth: {
- *     signIn: 'Iniciar sesión',
- *     signUp: 'Registrarse',
- *   }
- * });
- * ```
- */
-declare function createLocale(overrides?: DeepPartial<AuthLocale>): AuthLocale;
-/**
- * Interpolate template string with values
- *
- * Replaces {key} placeholders with corresponding values from the provided object.
- *
- * @param template - Template string with {key} placeholders
- * @param values - Object with key-value pairs for interpolation
- * @returns Interpolated string
- *
- * @example
- * ```typescript
- * interpolate('Hello, {name}!', { name: 'John' })
- * // Returns: "Hello, John!"
- *
- * interpolate('Password must be at least {min} characters', { min: '8' })
- * // Returns: "Password must be at least 8 characters"
- * ```
- */
-declare function interpolate(template: string, values: Record<string, string | number>): string;
-
-/**
- * Auth client configuration
- */
-interface AuthClientConfig {
-    provider: AuthProvider;
-    autoRefresh?: boolean;
-    refreshInterval?: number;
-}
-/**
- * Auth client class
- */
-declare class AuthClient {
-    private provider;
-    private autoRefresh;
-    private refreshInterval;
-    private refreshTimer?;
-    readonly state: Observable<AuthContext>;
-    get adapter(): AuthProvider;
-    constructor(config: AuthClientConfig);
+    adminDeleteUser(userId: string, body: AdminDeleteUserRequest, token: string): Promise<StatusResponse>;
     /**
-     * Initialize the auth client
+     * Ban user (admin)
+     * POST /v1/auth/admin/users/{userId}/ban
      */
-    initialize(): Promise<void>;
+    adminBanUser(userId: string, body: AdminBanUserRequest, token: string): Promise<StatusResponse>;
     /**
-     * Sign in with credentials
+     * Unban user (admin)
+     * POST /v1/auth/admin/users/{userId}/unban
      */
-    signIn(request: SignInRequest): Promise<void>;
+    adminUnbanUser(userId: string, body: AdminUnbanUserRequest, token: string): Promise<StatusResponse>;
     /**
-     * Sign up with credentials
+     * Change password
+     * POST /v1/auth/change-password
      */
-    signUp(request: SignUpRequest): Promise<void>;
+    changePassword(body: ChangePasswordRequest, token: string): Promise<StatusResponse>;
     /**
-     * Sign out
+     * List devices
+     * GET /v1/auth/devices
      */
-    signOut(): Promise<void>;
+    listDevices(token: string): Promise<DeviceListResponse>;
     /**
-     * Update user profile
+     * Get device
+     * GET /v1/auth/devices/{deviceId}
      */
-    updateUser(request: UpdateUserRequest): Promise<void>;
+    getDevice(deviceId: string, token: string): Promise<Device>;
     /**
-     * Change password
+     * Delete device
+     * DELETE /v1/auth/devices/{deviceId}
+     */
+    deleteDevice(deviceId: string, body: DeleteDeviceRequest, token: string): Promise<StatusResponse>;
+    /**
+     * Trust device
+     * PATCH /v1/auth/devices/{deviceId}/trust
      */
-    changePassword(request: PasswordChangeRequest): Promise<void>;
+    trustDevice(deviceId: string, body: TrustDeviceRequest, token: string): Promise<Device>;
     /**
-     * Request password reset
+     * Forgot password
+     * POST /v1/auth/forgot-password
      */
-    requestPasswordReset(request: PasswordResetRequest): Promise<void>;
+    forgotPassword(body: ForgotPasswordRequest): Promise<ForgotPasswordResponse>;
     /**
-     * Confirm password reset
+     * Health check
+     * GET /v1/auth/health
      */
-    confirmPasswordReset(request: PasswordResetConfirmRequest): Promise<void>;
+    getHealth(): Promise<HealthResponse>;
     /**
-     * Get OAuth sign in URL
+     * List API keys
+     * GET /v1/auth/keys
      */
-    getOAuthUrl(request: OAuthSignInRequest): Promise<string>;
+    listAPIKeys(token: string): Promise<ListKeysResponse>;
     /**
-     * Handle OAuth callback
+     * Create API key
+     * POST /v1/auth/keys
      */
-    handleOAuthCallback(request: OAuthCallbackRequest): Promise<void>;
+    createAPIKey(body: CreateAPIKeyRequest, token: string): Promise<CreateKeyResponse>;
     /**
-     * Get available OAuth providers
+     * Revoke API key
+     * DELETE /v1/auth/keys/{keyId}
      */
-    getOAuthProviders(): Promise<OAuthProvider[]>;
+    revokeAPIKey(keyId: string, body: RevokeAPIKeyRequest, token: string): Promise<void>;
     /**
      * Send magic link
+     * POST /v1/auth/magic-link/send
      */
-    sendMagicLink(request: MagicLinkRequest): Promise<void>;
+    sendMagicLink(body: SendMagicLinkRequest): Promise<SendResponse>;
     /**
      * Verify magic link
+     * POST /v1/auth/magic-link/verify
+     */
+    verifyMagicLink(body: VerifyMagicLinkRequest): Promise<VerifyResponse>;
+    /**
+     * Get current user
+     * GET /v1/auth/me
+     */
+    getMe(token: string): Promise<User>;
+    /**
+     * Update current user
+     * PATCH /v1/auth/me
+     */
+    updateMe(body: UpdateMeRequest, token: string): Promise<User>;
+    /**
+     * Delete account
+     * DELETE /v1/auth/me
+     */
+    deleteMe(body: DeleteMeRequest, token: string): Promise<StatusResponse>;
+    /**
+     * Export user data
+     * GET /v1/auth/me/export
      */
-    verifyMagicLink(request: MagicLinkVerifyRequest): Promise<void>;
+    exportMyData(token: string): Promise<Record<string, unknown>>;
     /**
-     * Send phone verification code
+     * MFA challenge
+     * POST /v1/auth/mfa/challenge
      */
-    sendPhoneCode(request: PhoneAuthRequest): Promise<void>;
+    challengeMFA(body: ChallengeMFARequest): Promise<ChallengeResponse>;
     /**
-     * Verify phone code
+     * Enroll in MFA
+     * POST /v1/auth/mfa/enroll
      */
-    verifyPhoneCode(request: PhoneVerifyRequest): Promise<void>;
+    enrollMFA(body: EnrollMFARequest, token: string): Promise<EnrollResponse>;
     /**
-     * Setup 2FA
+     * Disable MFA
+     * DELETE /v1/auth/mfa/enrollment
      */
-    setupTwoFactor(request: TwoFactorSetupRequest): Promise<TwoFactorSetupResponse>;
+    disableMFA(body: DisableMFARequest, token: string): Promise<DisableResponse>;
     /**
-     * Verify 2FA code
+     * Regenerate MFA recovery codes
+     * POST /v1/auth/mfa/recovery/regenerate
      */
-    verifyTwoFactor(request: TwoFactorVerifyRequest): Promise<void>;
+    regenerateMFARecoveryCodes(body: RegenerateMFARecoveryCodesRequest, token: string): Promise<RecoveryRegenerateResponse>;
     /**
-     * Disable 2FA
+     * Verify MFA recovery code
+     * POST /v1/auth/mfa/recovery/verify
      */
-    disableTwoFactor(): Promise<void>;
+    verifyRecoveryCode(body: VerifyRecoveryCodeRequest): Promise<RecoveryVerifyResponse>;
     /**
-     * Get 2FA status
+     * Send SMS verification code
+     * POST /v1/auth/mfa/sms/send
      */
-    getTwoFactorStatus(): Promise<TwoFactorMethod[]>;
+    sendSMSCode(body: SendSMSCodeRequest, token: string): Promise<SMSSendResponse>;
     /**
-     * Register passkey
+     * Verify SMS code
+     * POST /v1/auth/mfa/sms/verify
      */
-    registerPasskey(request: PasskeyRegisterRequest): Promise<PasskeyCredential>;
+    verifySMSCode(body: VerifySMSCodeRequest, token: string): Promise<SMSVerifyResponse>;
     /**
-     * Authenticate with passkey
+     * Verify MFA code
+     * POST /v1/auth/mfa/verify
      */
-    authenticatePasskey(request: PasskeyAuthRequest): Promise<void>;
+    verifyMFA(body: VerifyMFARequest): Promise<VerifyMFAResponse>;
+    /**
+     * List organizations
+     * GET /v1/auth/orgs
+     */
+    listOrganizations(token: string): Promise<OrgListResponse>;
+    /**
+     * Create organization
+     * POST /v1/auth/orgs
+     */
+    createOrganization(body: CreateOrganizationRequest, token: string): Promise<Organization>;
+    /**
+     * Check slug availability
+     * GET /v1/auth/orgs/check-slug
+     */
+    checkOrgSlug(token: string): Promise<SlugAvailableResponse>;
+    /**
+     * Accept invitation
+     * POST /v1/auth/orgs/invitations/accept
+     */
+    acceptInvitation(body: AcceptInvitationRequest, token: string): Promise<Member>;
+    /**
+     * Decline invitation
+     * POST /v1/auth/orgs/invitations/decline
+     */
+    declineInvitation(body: DeclineInvitationRequest, token: string): Promise<StatusResponse>;
+    /**
+     * Get organization
+     * GET /v1/auth/orgs/{orgId}
+     */
+    getOrganization(orgId: string, token: string): Promise<Organization>;
+    /**
+     * Update organization
+     * PATCH /v1/auth/orgs/{orgId}
+     */
+    updateOrganization(orgId: string, body: UpdateOrganizationRequest, token: string): Promise<Organization>;
+    /**
+     * Delete organization
+     * DELETE /v1/auth/orgs/{orgId}
+     */
+    deleteOrganization(orgId: string, body: DeleteOrganizationRequest, token: string): Promise<StatusResponse>;
+    /**
+     * List invitations
+     * GET /v1/auth/orgs/{orgId}/invitations
+     */
+    listInvitations(orgId: string, token: string): Promise<InvitationListResponse>;
+    /**
+     * Create invitation
+     * POST /v1/auth/orgs/{orgId}/invitations
+     */
+    createInvitation(orgId: string, body: CreateInvitationRequest, token: string): Promise<Invitation>;
+    /**
+     * List members
+     * GET /v1/auth/orgs/{orgId}/members
+     */
+    listMembers(orgId: string, token: string): Promise<MemberListResponse>;
+    /**
+     * Add member
+     * POST /v1/auth/orgs/{orgId}/members
+     */
+    addMember(orgId: string, body: AddMemberRequest, token: string): Promise<Member>;
+    /**
+     * Update member role
+     * PATCH /v1/auth/orgs/{orgId}/members/{memberId}
+     */
+    updateMember(orgId: string, memberId: string, body: UpdateMemberRequest, token: string): Promise<Member>;
+    /**
+     * Remove member
+     * DELETE /v1/auth/orgs/{orgId}/members/{memberId}
+     */
+    removeMember(orgId: string, memberId: string, body: RemoveMemberRequest, token: string): Promise<StatusResponse>;
+    /**
+     * List teams
+     * GET /v1/auth/orgs/{orgId}/teams
+     */
+    listTeams(orgId: string, token: string): Promise<TeamListResponse>;
+    /**
+     * Create team
+     * POST /v1/auth/orgs/{orgId}/teams
+     */
+    createTeam(orgId: string, body: CreateTeamRequest, token: string): Promise<Team>;
+    /**
+     * Get team
+     * GET /v1/auth/orgs/{orgId}/teams/{teamId}
+     */
+    getTeam(orgId: string, teamId: string, token: string): Promise<Team>;
+    /**
+     * Update team
+     * PATCH /v1/auth/orgs/{orgId}/teams/{teamId}
+     */
+    updateTeam(orgId: string, teamId: string, body: UpdateTeamRequest, token: string): Promise<Team>;
+    /**
+     * Delete team
+     * DELETE /v1/auth/orgs/{orgId}/teams/{teamId}
+     */
+    deleteTeam(orgId: string, teamId: string, body: DeleteTeamRequest, token: string): Promise<StatusResponse>;
     /**
      * List passkeys
+     * GET /v1/auth/passkeys/
      */
-    listPasskeys(): Promise<PasskeyCredential[]>;
+    listPasskeys(token: string): Promise<ListResponse$1>;
+    /**
+     * Begin passkey login
+     * POST /v1/auth/passkeys/login/begin
+     */
+    passkeyLoginBegin(body: PasskeyLoginBeginRequest): Promise<LoginBeginResponse>;
+    /**
+     * Complete passkey login
+     * POST /v1/auth/passkeys/login/finish
+     */
+    passkeyLoginFinish(body: PasskeyLoginFinishRequest): Promise<LoginFinishResponse>;
+    /**
+     * Begin passkey registration
+     * POST /v1/auth/passkeys/register/begin
+     */
+    passkeyRegisterBegin(body: PasskeyRegisterBeginRequest, token: string): Promise<RegisterBeginResponse>;
+    /**
+     * Complete passkey registration
+     * POST /v1/auth/passkeys/register/finish
+     */
+    passkeyRegisterFinish(body: PasskeyRegisterFinishRequest, token: string): Promise<RegisterFinishResponse>;
     /**
      * Delete passkey
+     * DELETE /v1/auth/passkeys/{credentialId}
      */
-    deletePasskey(credentialId: string): Promise<void>;
+    deletePasskey(credentialId: string, body: DeletePasskeyRequest, token: string): Promise<DeleteResponse>;
     /**
-     * Get all organizations the user belongs to
-     * Only available if the provider supports organizations
+     * Refresh tokens
+     * POST /v1/auth/refresh
      */
-    getOrganizations(): Promise<Organization[]>;
+    refresh(body: RefreshRequest): Promise<TokenResponse>;
     /**
-     * Get the currently active organization
-     * Only available if the provider supports organizations
+     * Reset password
+     * POST /v1/auth/reset-password
      */
-    getActiveOrganization(): Promise<Organization | null>;
+    resetPassword(body: ResetPasswordRequest): Promise<StatusResponse>;
     /**
-     * Set the active organization and refresh user state
-     * Only available if the provider supports organizations
+     * List roles
+     * GET /v1/auth/roles
      */
-    setActiveOrganization(organizationId: string): Promise<void>;
+    listRoles(token: string): Promise<RoleListResponse>;
     /**
-     * Get organization memberships with roles and permissions
-     * Only available if the provider supports organizations
+     * Create role
+     * POST /v1/auth/roles
      */
-    getOrganizationMemberships(): Promise<OrganizationMembership[]>;
+    createRole(body: CreateRoleRequest, token: string): Promise<Role>;
     /**
-     * Check if the provider supports organizations
+     * Get role
+     * GET /v1/auth/roles/{roleId}
      */
-    supportsOrganizations(): boolean;
+    getRole(roleId: string, token: string): Promise<Role>;
     /**
-     * Refresh session
+     * Update role
+     * PATCH /v1/auth/roles/{roleId}
      */
-    refreshSession(): Promise<void>;
+    updateRole(roleId: string, body: UpdateRoleRequest, token: string): Promise<Role>;
     /**
-     * Get current user
+     * Delete role
+     * DELETE /v1/auth/roles/{roleId}
      */
-    getUser(): User | null;
+    deleteRole(roleId: string, body: DeleteRoleRequest, token: string): Promise<StatusResponse>;
     /**
-     * Get current session
+     * Assign role to user
+     * POST /v1/auth/roles/{roleId}/assign
      */
-    getSession(): Session | null;
+    assignRole(roleId: string, body: AssignRoleRequest, token: string): Promise<StatusResponse>;
     /**
-     * Check if authenticated
+     * List role permissions
+     * GET /v1/auth/roles/{roleId}/permissions
      */
-    isAuthenticated(): boolean;
+    listRolePermissions(roleId: string, token: string): Promise<PermissionListResponse>;
     /**
-     * Get current error
+     * Add permission to role
+     * POST /v1/auth/roles/{roleId}/permissions
      */
-    getError(): AuthError | null;
+    addPermission(roleId: string, body: AddPermissionRequest, token: string): Promise<Permission>;
     /**
-     * Clear error
+     * Remove permission from role
+     * DELETE /v1/auth/roles/{roleId}/permissions/{permissionId}
      */
-    clearError(): void;
+    removePermission(roleId: string, permissionId: string, body: RemovePermissionRequest, token: string): Promise<StatusResponse>;
     /**
-     * Subscribe to auth state changes
+     * Unassign role from user
+     * POST /v1/auth/roles/{roleId}/unassign
      */
-    subscribe(listener: (context: AuthContext) => void): Unsubscribe;
+    unassignRole(roleId: string, body: UnassignRoleRequest, token: string): Promise<StatusResponse>;
     /**
-     * Cleanup resources
+     * List sessions
+     * GET /v1/auth/sessions
      */
-    destroy(): void;
-    private updateState;
-    private setLoading;
-    private handleError;
-    private startAutoRefresh;
-    private stopAutoRefresh;
-    private createUnsupportedError;
-}
-
-/**
- * Authentication flow types and state machine
- */
-
-/**
- * Available authentication flow steps
- */
-declare enum FlowStep {
-    SIGN_IN = "sign_in",
-    SIGN_UP = "sign_up",
-    EMAIL_PASSWORD_SIGN_IN = "email_password_sign_in",
-    EMAIL_PASSWORD_SIGN_UP = "email_password_sign_up",
-    OAUTH_SELECT = "oauth_select",
-    OAUTH_CALLBACK = "oauth_callback",
-    MAGIC_LINK_REQUEST = "magic_link_request",
-    MAGIC_LINK_VERIFY = "magic_link_verify",
-    MAGIC_LINK_SENT = "magic_link_sent",
-    PHONE_REQUEST = "phone_request",
-    PHONE_VERIFY = "phone_verify",
-    USERNAME_SIGN_IN = "username_sign_in",
-    USERNAME_SIGN_UP = "username_sign_up",
-    PASSKEY_REGISTER = "passkey_register",
-    PASSKEY_AUTHENTICATE = "passkey_authenticate",
-    MFA_REQUIRED = "mfa_required",
-    MFA_SETUP = "mfa_setup",
-    MFA_VERIFY = "mfa_verify",
-    MFA_SELECT_METHOD = "mfa_select_method",
-    EMAIL_VERIFICATION_REQUIRED = "email_verification_required",
-    EMAIL_VERIFICATION_SENT = "email_verification_sent",
-    PHONE_VERIFICATION_REQUIRED = "phone_verification_required",
-    PASSWORD_RESET_REQUEST = "password_reset_request",
-    PASSWORD_RESET_SENT = "password_reset_sent",
-    PASSWORD_RESET_CONFIRM = "password_reset_confirm",
-    PASSWORD_CHANGE = "password_change",
-    PROFILE_UPDATE = "profile_update",
-    PROFILE_COMPLETE = "profile_complete",
-    DEVICE_FLOW_INITIATE = "device_flow_initiate",
-    DEVICE_CODE_ENTRY = "device_code_entry",
-    DEVICE_CODE_VERIFY = "device_code_verify",
-    DEVICE_AUTHORIZE = "device_authorize",
-    DEVICE_POLLING = "device_polling",
-    DEVICE_AUTHORIZED = "device_authorized",
-    DEVICE_DENIED = "device_denied",
-    SUCCESS = "success",
-    ERROR = "error",
-    CANCELLED = "cancelled"
-}
-/**
- * Flow state data that can be passed between steps
- */
-interface FlowState {
-    currentStep: FlowStep;
-    previousStep?: FlowStep;
-    user?: User;
-    session?: Session;
-    email?: string;
-    phone?: string;
-    username?: string;
-    token?: string;
-    mfaRequired?: boolean;
-    mfaMethods?: TwoFactorMethod[];
-    mfaToken?: string;
-    oauthProvider?: OAuthProvider;
-    oauthRedirectUrl?: string;
-    verificationRequired?: boolean;
-    verificationToken?: string;
-    verificationSent?: boolean;
-    deviceCode?: string;
-    userCode?: string;
-    verificationUri?: string;
-    verificationUriComplete?: string;
-    deviceCodeExpiresIn?: number;
-    devicePollingInterval?: number;
-    deviceClientId?: string;
-    deviceScopes?: string[];
-    deviceAuthorized?: boolean;
-    error?: AuthError;
-    metadata?: Record<string, unknown>;
-}
-/**
- * Flow transition result
- */
-interface FlowTransition {
-    nextStep: FlowStep;
-    state: Partial<FlowState>;
-}
-/**
- * Flow configuration for a specific authentication journey
- */
-interface FlowConfig {
-    name: string;
-    description?: string;
-    initialStep: FlowStep;
-    allowedSteps: FlowStep[];
-    transitions: {
-        [key in FlowStep]?: {
-            onSuccess?: FlowStep;
-            onError?: FlowStep;
-            onCancel?: FlowStep;
-            onBack?: FlowStep;
-            conditions?: Array<{
-                when: (state: FlowState) => boolean;
-                then: FlowStep;
-            }>;
-        };
-    };
-    onStepChange?: (step: FlowStep, state: FlowState) => void;
-    onComplete?: (user: User, session: Session) => void;
-    onError?: (error: AuthError, state: FlowState) => void;
-    onCancel?: (state: FlowState) => void;
-}
-/**
- * Predefined flow configurations
- */
-declare enum FlowConfigType {
-    SIMPLE_SIGN_IN = "simple_sign_in",
-    SIMPLE_SIGN_UP = "simple_sign_up",
-    SIGN_UP_WITH_EMAIL_VERIFICATION = "sign_up_with_email_verification",
-    SIGN_IN_WITH_MFA = "sign_in_with_mfa",
-    OAUTH_SIGN_IN = "oauth_sign_in",
-    MAGIC_LINK_FLOW = "magic_link_flow",
-    PHONE_AUTH_FLOW = "phone_auth_flow",
-    COMPLETE_SIGN_UP_FLOW = "complete_sign_up_flow",// signup → verify email → complete profile
-    SECURE_SIGN_IN_FLOW = "secure_sign_in_flow",// signin → MFA → success
-    PASSWORD_RESET_FLOW = "password_reset_flow",
-    EMAIL_VERIFICATION_FLOW = "email_verification_flow",
-    DEVICE_FLOW = "device_flow",
-    CUSTOM = "custom"
-}
-/**
- * Flow action types
- */
-declare enum FlowAction {
-    START = "start",
-    NEXT = "next",
-    BACK = "back",
-    CANCEL = "cancel",
-    ERROR = "error",
-    RESET = "reset"
-}
-/**
- * Flow event for state machine
- */
-interface FlowEvent {
-    action: FlowAction;
-    data?: Partial<FlowState>;
-    error?: AuthError;
-}
-
-/**
- * Authentication flow state machine engine
- */
-
-/**
- * Flow engine that manages authentication flow state transitions
- */
-declare class FlowEngine {
-    private config;
-    private state;
-    private history;
-    constructor(config: FlowConfig, initialState?: Partial<FlowState>);
+    listSessions(token: string): Promise<SessionListResponse>;
+    /**
+     * Revoke session
+     * DELETE /v1/auth/sessions/{sessionId}
+     */
+    revokeSession(sessionId: string, body: RevokeSessionRequest, token: string): Promise<StatusResponse>;
     /**
-     * Get current flow state
+     * Sign in
+     * POST /v1/auth/signin
      */
-    getState(): FlowState;
+    signIn(body: SignInRequest): Promise<AuthResponse>;
     /**
-     * Get current step
+     * Sign out
+     * POST /v1/auth/signout
      */
-    getCurrentStep(): FlowStep;
+    signOut(body: SignOutRequest, token: string): Promise<StatusResponse>;
     /**
-     * Check if step is allowed in this flow
+     * Sign up
+     * POST /v1/auth/signup
      */
-    isStepAllowed(step: FlowStep): boolean;
+    signUp(body: SignUpRequest): Promise<AuthResponse>;
     /**
-     * Transition to next step based on action
+     * Start OAuth flow
+     * POST /v1/auth/social/{provider}
      */
-    transition(event: FlowEvent): Promise<FlowState>;
+    startOAuth(provider: string, body: StartOAuthRequest): Promise<StartResponse>;
     /**
-     * Start or restart the flow
+     * OAuth callback
+     * GET /v1/auth/social/{provider}/callback
      */
-    private handleStart;
+    oauthCallback(provider: string): Promise<CallbackResponse>;
     /**
-     * Move to next step
+     * SSO SAML ACS endpoint
+     * POST /v1/auth/sso/{provider}/acs
      */
-    private handleNext;
+    ssoACS(provider: string, body: SsoACSRequest): Promise<CallbackResponse>;
     /**
-     * Go back to previous step
+     * SSO callback (OIDC)
+     * POST /v1/auth/sso/{provider}/callback
      */
-    private handleBack;
+    ssoCallback(provider: string, body: SsoCallbackRequest): Promise<CallbackResponse>;
     /**
-     * Cancel the flow
+     * Start SSO login flow
+     * POST /v1/auth/sso/{provider}/login
      */
-    private handleCancel;
+    startSSOLogin(provider: string, body: StartSSOLoginRequest): Promise<LoginResponse>;
     /**
-     * Handle error in flow
+     * List user roles
+     * GET /v1/auth/users/{userId}/roles
      */
-    private handleError;
+    listUserRoles(userId: string, token: string): Promise<UserRoleListResponse>;
     /**
-     * Reset flow to initial state
+     * Verify email
+     * POST /v1/auth/verify-email
      */
-    private handleReset;
+    verifyEmail(body: VerifyEmailRequest): Promise<StatusResponse>;
     /**
-     * Move to a specific step
+     * List webhooks
+     * GET /v1/auth/webhooks
      */
-    private moveToStep;
+    listWebhooks(token: string): Promise<WebhookListResponse>;
     /**
-     * Get flow history
+     * Create webhook
+     * POST /v1/auth/webhooks
      */
-    getHistory(): FlowStep[];
+    createWebhook(body: CreateWebhookRequest, token: string): Promise<Webhook>;
     /**
-     * Check if can go back
+     * Get webhook
+     * GET /v1/auth/webhooks/{webhookId}
      */
-    canGoBack(): boolean;
+    getWebhook(webhookId: string, token: string): Promise<Webhook>;
+    /**
+     * Update webhook
+     * PATCH /v1/auth/webhooks/{webhookId}
+     */
+    updateWebhook(webhookId: string, body: UpdateWebhookRequest, token: string): Promise<Webhook>;
+    /**
+     * Delete webhook
+     * DELETE /v1/auth/webhooks/{webhookId}
+     */
+    deleteWebhook(webhookId: string, body: DeleteWebhookRequest, token: string): Promise<StatusResponse>;
+    private request;
+}
+declare class AuthClientError extends Error {
+    code?: number;
+    constructor(message: string, code?: number);
 }
 
 /**
- * Predefined flow configurations
+ * AuthClient adapter — thin wrapper over the auto-generated API client.
+ *
+ * The generated client lives in ./generated/api-client.ts and covers all
+ * core + plugin endpoints.  This file extends it with a few convenience
+ * overrides so that auth.ts (and downstream consumers) keep working
+ * without changes.
  */
 
+/** Options for paginated list endpoints. */
+interface ListOptions {
+    limit?: number;
+    offset?: number;
+}
+/** Paginated list response. */
+interface ListResponse<T> {
+    items: T[];
+    total: number;
+}
 /**
- * Simple sign-in flow (email/password only)
- */
-declare const simpleSignInFlow: FlowConfig;
-/**
- * Sign-in with MFA support
- */
-declare const signInWithMFAFlow: FlowConfig;
-/**
- * Complete sign-up flow with email verification
- */
-declare const completeSignUpFlow: FlowConfig;
-/**
- * Magic link authentication flow
+ * AuthClient extends the auto-generated client with backward-compatible
+ * convenience methods that auth.ts depends on.
+ *
+ * All 80+ generated endpoints are inherited as-is.  Only two methods
+ * are overridden to preserve the simpler call-site signatures used by
+ * the auth state machine.
  */
-declare const magicLinkFlow: FlowConfig;
+declare class AuthClient extends AuthClient$1 {
+    /**
+     * Refresh session tokens.
+     *
+     * Accepts a raw refresh-token string (used by auth.ts) or the full
+     * RefreshRequest body.
+     */
+    refresh(body: {
+        refresh_token: string;
+    } | string): Promise<any>;
+    /**
+     * Sign out.
+     *
+     * Accepts a raw token string (used by auth.ts) or the full
+     * (body, token) pair from the generated client.
+     */
+    signOut(bodyOrToken: unknown, token?: string): Promise<any>;
+    /**
+     * MFA challenge — bridge for auth.ts.
+     *
+     * auth.ts calls `mfaChallenge({ enrollment_id, code })` and expects
+     * an AuthResponse back.  The generated client uses `challengeMFA`.
+     */
+    mfaChallenge(body: {
+        enrollment_id?: string;
+        code: string;
+    }): Promise<any>;
+    /**
+     * Verify an MFA recovery code.
+     *
+     * Accepts a raw code string (used by auth.ts) or the full request body.
+     */
+    verifyRecoveryCode(body: {
+        code: string;
+    } | string): Promise<any>;
+    /**
+     * Send an SMS code for MFA — bridge for auth.ts.
+     *
+     * Simplifies the call-site by accepting just the session token.
+     */
+    sendSMSCodeForMFA(token: string): Promise<any>;
+    /**
+     * Verify an SMS code for MFA — bridge for auth.ts.
+     *
+     * Simplifies the call-site by accepting code + token directly.
+     */
+    verifySMSCodeForMFA(code: string, token: string): Promise<any>;
+    /**
+     * Fetch the client configuration from the backend.
+     *
+     * The config describes which auth methods are enabled so SDK
+     * components can auto-configure without manual props.
+     */
+    fetchClientConfig(publishableKey?: string): Promise<ClientConfig>;
+}
+
 /**
- * Phone authentication flow
+ * Framework-agnostic authentication state machine.
+ *
+ * Manages sign-in/sign-up flows, token persistence, automatic refresh,
+ * and MFA challenges. Framework adapters (React, Vue, etc.) wrap this
+ * class and expose reactive state.
  */
-declare const phoneAuthFlow: FlowConfig;
+
 /**
- * OAuth sign-in flow
+ * AuthManager is the core state machine that drives authentication.
+ *
+ * Usage:
+ * ```ts
+ * const auth = new AuthManager({ baseURL: "https://api.example.com" });
+ * auth.subscribe((state) => console.log(state));
+ * await auth.initialize(); // hydrate from storage
+ * await auth.signIn({ email, password });
+ * ```
  */
-declare const oauthSignInFlow: FlowConfig;
+declare class AuthManager {
+    private client;
+    private storage;
+    private state;
+    private listeners;
+    private refreshTimer;
+    private onError?;
+    private publishableKey?;
+    private clientConfig;
+    private configListeners;
+    private configFetchPromise;
+    constructor(config: AuthConfig);
+    /** Current auth state (snapshot). */
+    getState(): AuthState;
+    /** Subscribe to state changes. Returns an unsubscribe function. */
+    subscribe(listener: (state: AuthState) => void): () => void;
+    /** Access the underlying HTTP client. */
+    getClient(): AuthClient;
+    /**
+     * Initialize by hydrating the session from storage.
+     * When a publishableKey is set, also fetches client config in parallel.
+     * Call this once on app start.
+     */
+    initialize(): Promise<void>;
+    /** Sign in with email & password. */
+    signIn(credentials: SignInRequest): Promise<void>;
+    /** Sign up with email & password. */
+    signUp(data: SignUpRequest): Promise<void>;
+    /** Sign out and clear the session. */
+    signOut(): Promise<void>;
+    /** Submit an MFA challenge code. */
+    submitMFACode(enrollmentId: string, code: string): Promise<void>;
+    /** Submit an MFA recovery code. */
+    submitRecoveryCode(code: string): Promise<void>;
+    /** Send an SMS code for MFA verification. Returns masked phone + expiry info. */
+    sendSMSCode(): Promise<{
+        sent: boolean;
+        phone_masked: string;
+        expires_in_seconds: number;
+    }>;
+    /** Submit an SMS verification code during MFA challenge. */
+    submitSMSCode(code: string): Promise<void>;
+    /** Refresh the current session manually. */
+    refreshNow(): Promise<void>;
+    /** Get the current session token (if authenticated). */
+    getSessionToken(): string | null;
+    /** Get the current user (if authenticated). */
+    getUser(): User | null;
+    /** Get the cached client config (or null if not yet fetched). */
+    getClientConfig(): ClientConfig | null;
+    /** Subscribe to client config changes. Returns an unsubscribe function. */
+    subscribeConfig(listener: (config: ClientConfig | null) => void): () => void;
+    /**
+     * Fetch client config from the backend.
+     * Deduplicates concurrent calls and caches the result with a TTL.
+     */
+    fetchClientConfig(): Promise<ClientConfig>;
+    /** Tear down: clear timers and listeners. */
+    destroy(): void;
+    private handleAuthResponse;
+    private refreshSession;
+    private scheduleRefresh;
+    private clearRefreshTimer;
+    private persistSession;
+    private clearSession;
+    private setClientConfig;
+    private setState;
+    private handleError;
+}
+
 /**
- * Password reset flow
+ * WebAuthn encoding helpers.
+ *
+ * The go-webauthn backend serialises binary fields (challenge, user.id,
+ * credential IDs, …) as **base64url strings** in JSON.  The browser
+ * WebAuthn API requires those same fields as ArrayBuffer / Uint8Array.
+ *
+ * These helpers bridge the gap in both directions:
+ *   begin response  → browser API  (base64url string → ArrayBuffer)
+ *   browser API     → finish POST  (ArrayBuffer → base64url string)
  */
-declare const passwordResetFlow: FlowConfig;
+/** Decode a base64url-encoded string into a Uint8Array. */
+declare function base64urlToBuffer(base64url: string): Uint8Array;
+/** Encode an ArrayBuffer (or Uint8Array) to a base64url string (no padding). */
+declare function bufferToBase64url(buffer: ArrayBuffer | Uint8Array): string;
 /**
- * Email verification flow
+ * Prepare the options object returned by `/passkeys/register/begin`
+ * for `navigator.credentials.create({ publicKey })`.
+ *
+ * Converts base64url strings → Uint8Array for:
+ *   challenge, user.id, excludeCredentials[].id
  */
-declare const emailVerificationFlow: FlowConfig;
+declare function prepareCreationOptions(options: Record<string, unknown>): PublicKeyCredentialCreationOptions;
 /**
- * Get predefined flow configuration by type
+ * Prepare the options object returned by `/passkeys/login/begin`
+ * for `navigator.credentials.get({ publicKey })`.
+ *
+ * Converts base64url strings → Uint8Array for:
+ *   challenge, allowCredentials[].id
  */
-declare function getFlowConfig(type: FlowConfigType): FlowConfig;
+declare function prepareRequestOptions(options: Record<string, unknown>): PublicKeyCredentialRequestOptions;
 /**
- * Export all predefined flows
+ * Serialize a PublicKeyCredential returned by navigator.credentials
+ * into a plain object suitable for POSTing to the `/finish` endpoint.
+ *
+ * Converts ArrayBuffer fields → base64url strings so they survive
+ * JSON.stringify and match what go-webauthn expects.
  */
-declare const predefinedFlows: {
-    simple_sign_in: FlowConfig;
-    sign_in_with_mfa: FlowConfig;
-    complete_sign_up_flow: FlowConfig;
-    magic_link_flow: FlowConfig;
-    phone_auth_flow: FlowConfig;
-    oauth_sign_in: FlowConfig;
-    password_reset_flow: FlowConfig;
-    email_verification_flow: FlowConfig;
-    device_flow: FlowConfig;
-};
+declare function serializeCredential(credential: Credential): Record<string, unknown>;
 
-export { AuthClient, type AuthClientConfig, AuthContext, AuthError, AuthErrorType, type AuthLocale, AuthProvider, CookieData, type DeepPartial, FlowAction, type FlowConfig, FlowConfigType, FlowEngine, type FlowEvent, type FlowState, FlowStep, type FlowTransition, MagicLinkRequest, MagicLinkVerifyRequest, OAuthCallbackRequest, OAuthProvider, OAuthSignInRequest, Observable, Organization, OrganizationMembership, PasskeyAuthRequest, PasskeyCredential, PasskeyRegisterRequest, PasswordChangeRequest, PasswordResetConfirmRequest, PasswordResetRequest, PhoneAuthRequest, PhoneVerifyRequest, Session, SignInRequest, SignUpRequest, Storage, TokenManager, TwoFactorMethod, TwoFactorSetupRequest, TwoFactorSetupResponse, TwoFactorVerifyRequest, Unsubscribe, UpdateUserRequest, User, ValidationError, completeSignUpFlow, createAuthError, createLocale, defaultLocale, emailVerificationFlow, extractCookiesFromHeaders, getFlowConfig, interpolate, isAuthError, isMFARequiredError, isNetworkError, isUnauthenticatedError, magicLinkFlow, oauthSignInFlow, parseCookie, parseCookieOptions, passwordResetFlow, phoneAuthFlow, predefinedFlows, serializeCookie, serializeCookies, signInWithMFAFlow, simpleSignInFlow, toAuthError, validate2FACode, validateEmail, validatePassword, validatePhone, validateRequired, validateUsername };
+export { type APIError, type KeyListItem as APIKey, type AddMemberRequest, type AdminBanUserRequest, AuthClient, type AuthClientConfig, AuthClientError, type AuthConfig, AuthManager, type AuthResponse, type AuthState, type ChallengeMFARequest, type ChangePasswordRequest, type ClientConfig, type CreateAPIKeyRequest, type CreateInvitationRequest, type CreateOrganizationRequest as CreateOrgRequest, type CreateOrganizationRequest, type Device, type EnrollMFARequest, type EnrollResponse, type ForgotPasswordRequest, type Invitation, type KeyListItem, type ListOptions, type ListResponse, type EnrollResponse as MFAEnrollment, type SendMagicLinkRequest as MagicLinkSendRequest, type VerifyMagicLinkRequest as MagicLinkVerifyRequest, type Member, type ChallengeMFARequest as MfaChallengeRequest, type EnrollMFARequest as MfaEnrollRequest, type SendSMSCodeRequest as MfaSMSSendRequest, type VerifySMSCodeRequest as MfaSMSVerifyRequest, type VerifyMFARequest as MfaVerifyRequest, type Organization, type RefreshRequest, type ResetPasswordRequest, type SSOConnectionConfig, type SendMagicLinkRequest, type SendSMSCodeRequest, type Session, type SignInRequest, type SignUpRequest, type SocialProviderConfig, type SsoACSRequest, type SsoCallbackRequest, type TokenResponse, type TokenStorage, type UpdateMeRequest, type UpdateOrganizationRequest as UpdateOrgRequest, type UpdateOrganizationRequest, type User, type VerifyEmailRequest, type VerifyMFARequest, type VerifyMagicLinkRequest, type VerifyRecoveryCodeRequest, type VerifySMSCodeRequest, base64urlToBuffer, bufferToBase64url, prepareCreationOptions, prepareRequestOptions, serializeCredential };