@authsome/ui-core 0.1.9 → 1.1.0

package/dist/index.d.ts

@@ -1,825 +1,1808 @@
-import { A as AuthErrorType, a as AuthError, V as ValidationError, C as CookieData, b as AuthContext, c as AuthProvider, S as SignInRequest, d as SignUpRequest, U as UpdateUserRequest, P as PasswordChangeRequest, e as PasswordResetRequest, f as PasswordResetConfirmRequest, O as OAuthSignInRequest, g as OAuthCallbackRequest, h as OAuthProvider, M as MagicLinkRequest, i as MagicLinkVerifyRequest, j as PhoneAuthRequest, k as PhoneVerifyRequest, T as TwoFactorSetupRequest, l as TwoFactorSetupResponse, m as TwoFactorVerifyRequest, n as TwoFactorMethod, o as PasskeyRegisterRequest, p as PasskeyCredential, q as PasskeyAuthRequest, r as Organization, s as OrganizationMembership, t as User, u as Session } from './provider-DWklI8Wr.js';
-export { Q as AuthResponse, v as AuthState, a3 as Device, F as DeviceAuthorizeRequest, B as DeviceCodeVerifyRequest, E as DeviceCodeVerifyResponse, D as DeviceFlowInitiateRequest, z as DeviceFlowInitiateResponse, G as DeviceTokenPollRequest, I as DeviceTokenPollResponse, H as DeviceTokenPollStatus, $ as EnrollMFAFactorRequest, L as FieldDefinition, K as FieldType, J as FieldValidation, a5 as ListSessionsOptions, a6 as ListSessionsResponse, a1 as MFAChallengeRequest, a2 as MFAChallengeResponse, _ as MFAFactor, x as OAuthConfig, R as ProviderConfig, W as RequestContext, Z as ResendVerificationRequest, X as SendVerificationEmailRequest, w as SessionData, a4 as SessionInfo, N as SignupFieldsResponse, y as TwoFactorConfig, Y as VerifyEmailRequest, a0 as VerifyMFAFactorRequest } from './provider-DWklI8Wr.js';
-import { Storage, Observable, Unsubscribe } from './types/index.js';
-export { Listener, LocalStorageAdapter, MemoryStorageAdapter, SessionStorageAdapter } from './types/index.js';
-export { BaseAuthProvider } from './adapters/index.js';
+interface ACSRequest {
+    Provider: string;
+    RelayState: string;
+    SAMLResponse: string;
+}
+interface AdminDeleteUserRequest {
+    UserID: string;
+}
+interface AdminImpersonateRequest {
+    UserID: string;
+}
+interface AdminStatsResponse {
+    total_users: number;
+}
+interface AdminStopImpersonationRequest {
+}
+interface AdminUnbanUserRequest {
+    UserID: string;
+}
+interface AdminUserListResponse {
+    next_cursor?: string;
+    total: number;
+    users: User[];
+}
+interface AuthMethod {
+    label: string;
+    linked_at?: string;
+    provider: string;
+    type: string;
+}
+interface AuthResponse {
+    expires_at: string;
+    refresh_token: string;
+    session_token: string;
+    user: User;
+}
+interface BulkError {
+    email?: string;
+    error: string;
+    index: number;
+}
+interface BulkImportResult {
+    created: number;
+    errors?: BulkError[];
+    skipped: number;
+}
+interface BulkRevokeSessionsRequest {
+    UserID: string;
+}
+interface BulkRevokeSessionsResponse {
+    revoked: number;
+    user_id: string;
+}
+interface CallbackRequest {
+    Provider: string;
+    code: string;
+    error?: string;
+    state: string;
+}
+interface CallbackResponse {
+    expires_at: string;
+    is_new_user: boolean;
+    provider: string;
+    refresh_token: string;
+    session_token: string;
+    user: User;
+}
+interface ChallengeRequest {
+    code: string;
+}
+interface ChallengeResponse {
+    challenge_passed: boolean;
+    method: string;
+}
+interface ClientConfigBranding {
+    app_name?: string;
+    logo_url?: string;
+}
+interface ClientConfigFieldValidation {
+    max?: number;
+    max_len?: number;
+    min?: number;
+    min_len?: number;
+    pattern?: string;
+    required?: boolean;
+}
+interface ClientConfigMFA {
+    enabled: boolean;
+    methods: string[];
+}
+interface ClientConfigResponse {
+    app_id: string;
+    branding?: ClientConfigBranding;
+    magiclink?: ClientConfigToggle;
+    mfa?: ClientConfigMFA;
+    passkey?: ClientConfigToggle;
+    password?: ClientConfigToggle;
+    signup_fields?: ClientConfigSignupField[];
+    social?: ClientConfigSocial;
+    sso?: ClientConfigSSO;
+    supported_plugins: string[];
+    version: string;
+}
+interface ClientConfigSSO {
+    connections: ClientConfigSSOConnection[];
+    enabled: boolean;
+}
+interface ClientConfigSSOConnection {
+    id: string;
+    name: string;
+}
+interface ClientConfigSelectOption {
+    label: string;
+    value: string;
+}
+interface ClientConfigSignupField {
+    default?: string;
+    description?: string;
+    key: string;
+    label: string;
+    options?: ClientConfigSelectOption[];
+    order: number;
+    placeholder?: string;
+    type: string;
+    validation?: ClientConfigFieldValidation;
+}
+interface ClientConfigSocial {
+    enabled: boolean;
+    providers: ClientConfigSocialProvider[];
+}
+interface ClientConfigSocialProvider {
+    id: string;
+    name: string;
+}
+interface ClientConfigToggle {
+    enabled: boolean;
+}
+interface CloneEnvironmentResponse {
+    environment: unknown;
+    permissions_cloned: number;
+    role_id_map: Record<string, unknown>;
+    roles_cloned: number;
+    webhooks_cloned: number;
+}
+interface Config {
+    app_id: string;
+    app_name?: string;
+    created_at: string;
+    id: string;
+    logo_url?: string;
+    magic_link_enabled?: boolean;
+    mfa_enabled?: boolean;
+    mfa_methods?: string[];
+    passkey_enabled?: boolean;
+    password_enabled?: boolean;
+    social_enabled?: boolean;
+    social_providers?: string[];
+    sso_enabled?: boolean;
+    updated_at: string;
+}
+interface CreateKeyRequest {
+    app_id: string;
+    name: string;
+    scopes?: string[];
+    user_id: string;
+}
+interface CreateKeyResponse {
+    created_at: string;
+    expires_at?: string;
+    id: string;
+    key: string;
+    key_prefix: string;
+    name: string;
+    public_key: string;
+    public_key_prefix: string;
+    scopes?: string[];
+}
+interface CredentialInfo {
+    created_at: string;
+    display_name: string;
+    id: string;
+    transport: string[];
+}
+interface Definition {
+    category: string;
+    default: string;
+    description: string;
+    display_name: string;
+    enforceable: boolean;
+    key: string;
+    namespace: string;
+    scopes: string[];
+    sensitive: boolean;
+    type: string;
+    ui?: UIMetadata;
+}
+interface DefinitionGroup {
+    category: string;
+    definitions: Definition[];
+    namespace: string;
+}
+interface DeleteAccountRequest {
+}
+interface DeleteAppClientConfigRequest {
+    AppID: string;
+}
+interface DeleteAppSessionConfigRequest {
+    AppID: string;
+}
+interface DeleteDeviceRequest {
+    DeviceID: string;
+}
+interface DeleteOrgRequest {
+    OrgID: string;
+}
+interface DeleteRequest {
+    CredentialID: string;
+}
+interface DeleteResponse {
+    status: string;
+}
+interface DeleteSettingRequest {
+    Key: string;
+    Scope: string;
+    ScopeID: string;
+}
+interface DeleteTeamRequest {
+    OrgID: string;
+    TeamID: string;
+}
+interface DeleteWebhookRequest {
+    WebhookID: string;
+}
+interface Device {
+    app_id: string;
+    browser?: string;
+    created_at: string;
+    env_id: string;
+    fingerprint?: string;
+    id: string;
+    ip_address?: string;
+    last_seen_at: string;
+    name?: string;
+    os?: string;
+    trusted: boolean;
+    trusted_until?: string;
+    type?: string;
+    updated_at: string;
+    user_id: string;
+}
+interface DeviceListResponse {
+    devices: Device[];
+}
+interface DisableRequest {
+}
+interface DisableResponse {
+    status: string;
+}
+interface EnrollRequest {
+    method?: string;
+    phone?: string;
+}
+interface EnrollResponse {
+    id: string;
+    method: string;
+    otpauth_url: string;
+    secret: string;
+}
+interface Environment {
+    app_id: string;
+    cloned_from?: string;
+    color?: string;
+    created_at: string;
+    description?: string;
+    id: string;
+    is_default: boolean;
+    metadata?: Record<string, unknown>;
+    name: string;
+    settings?: Settings;
+    slug: string;
+    type: string;
+    updated_at: string;
+}
+interface EnvironmentListResponse {
+    environments: unknown;
+    total: number;
+}
+interface EnvironmentSettingsResponse {
+    overrides?: Settings;
+    settings?: Settings;
+    type_defaults?: Settings;
+}
+interface ForgotPasswordResponse {
+    status: string;
+}
+interface HealthResponse {
+    error?: string;
+    status: string;
+}
+interface Invitation {
+    created_at: string;
+    email: string;
+    expires_at: string;
+    id: string;
+    inviter_id: string;
+    org_id: string;
+    role: string;
+    status: string;
+}
+interface InvitationListResponse {
+    invitations: Invitation[];
+}
+interface KeyListItem {
+    created_at: string;
+    expires_at?: string;
+    id: string;
+    key_prefix: string;
+    last_used_at?: string;
+    name: string;
+    public_key_prefix?: string;
+    revoked: boolean;
+    scopes?: string[];
+}
+interface ListAuthMethodsResponse {
+    methods: AuthMethod[];
+}
+interface ListDefinitionsResponse {
+    groups: DefinitionGroup[];
+    total: number;
+}
+interface ListKeysResponse {
+    keys: KeyListItem[];
+    total: number;
+}
+interface ListResponse$1 {
+    credentials: CredentialInfo[];
+}
+interface LoginBeginRequest {
+    email?: string;
+}
+interface LoginBeginResponse {
+    options: Record<string, unknown>;
+}
+interface LoginFinishRequest {
+}
+interface LoginFinishResponse {
+    status: string;
+    user_id: string;
+}
+interface LoginRequest {
+    Provider: string;
+}
+interface LoginResponse {
+    login_url: string;
+    state: string;
+}
+interface Member {
+    created_at: string;
+    id: string;
+    org_id: string;
+    role: string;
+    updated_at: string;
+    user_id: string;
+}
+interface MemberListResponse {
+    members: Member[];
+}
+interface ObjectFieldDef {
+    display_name: string;
+    help_text?: string;
+    input_type: string;
+    key: string;
+    options?: SelectOption[];
+    placeholder?: string;
+    required?: boolean;
+    sensitive?: boolean;
+}
+interface OrgListResponse {
+    organizations: Organization[];
+}
+interface Organization {
+    app_id: string;
+    created_at: string;
+    created_by: string;
+    env_id: string;
+    id: string;
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    slug: string;
+    updated_at: string;
+}
+interface Permission {
+    action: string;
+    id: string;
+    resource: string;
+    role_id: string;
+}
+interface PermissionListResponse {
+    permissions: Permission[];
+}
+interface RecoveryRegenerateRequest {
+}
+interface RecoveryRegenerateResponse {
+    codes: string[];
+}
+interface RecoveryVerifyRequest {
+    code: string;
+}
+interface RecoveryVerifyResponse {
+    challenge_passed: boolean;
+    codes_remaining: number;
+}
+interface RegisterBeginRequest {
+    display_name?: string;
+}
+interface RegisterBeginResponse {
+    options: Record<string, unknown>;
+}
+interface RegisterFinishRequest {
+}
+interface RegisterFinishResponse {
+    display_name: string;
+    id: string;
+    status: string;
+}
+interface RemoveMemberRequest {
+    MemberID: string;
+    OrgID: string;
+}
+interface ResolvedSetting {
+    can_override: boolean;
+    definition?: Definition;
+    effective_value: string;
+    enforced_at?: string;
+    scope_values: ScopeValue[];
+}
+interface ResolvedSettingResponse {
+    setting?: ResolvedSetting;
+}
+interface ResolvedSettingsResponse {
+    settings: ResolvedSetting[];
+}
+interface RevokeKeyRequest {
+    KeyID: string;
+}
+interface RevokeSessionRequest {
+    SessionID: string;
+}
+interface Role {
+    app_id: string;
+    created_at: string;
+    description?: string;
+    env_id: string;
+    id: string;
+    name: string;
+    parent_id?: string;
+    slug: string;
+    updated_at: string;
+}
+interface RoleListResponse {
+    roles: Role[];
+}
+interface SMSSendRequest {
+    phone?: string;
+}
+interface SMSSendResponse {
+    expires_in_seconds: number;
+    phone_masked: string;
+    sent: boolean;
+}
+interface SMSVerifyRequest {
+    code: string;
+}
+interface SMSVerifyResponse {
+    method: string;
+    verified: boolean;
+}
+interface ScopeValue {
+    enforced: boolean;
+    scope: string;
+    scope_id?: string;
+    updated_at?: string;
+    updated_by?: string;
+    value: string;
+    version?: number;
+}
+interface SelectOption {
+    label: string;
+    value: string;
+}
+interface SendRequest {
+    app_id?: string;
+    email: string;
+}
+interface SendResponse {
+    status: string;
+}
+interface SessionListResponse {
+    sessions: Record<string, unknown>[];
+}
+interface SettingValueResponse {
+    key: string;
+    scope: string;
+    scope_id?: string;
+    status: string;
+    value: string;
+}
+interface Settings {
+    allow_test_credentials?: boolean;
+    check_breached?: boolean;
+    lockout_enabled?: boolean;
+    lockout_max_attempts?: number;
+    oauth_overrides?: Record<string, unknown>;
+    password_min_length?: number;
+    rate_limit_enabled?: boolean;
+    rate_limit_window_seconds?: number;
+    refresh_token_ttl_seconds?: number;
+    signin_rate_limit?: number;
+    signup_rate_limit?: number;
+    skip_email_verification?: boolean;
+    token_ttl_seconds?: number;
+    webhook_url_override?: string;
+}
+interface SignOutRequest {
+}
+interface SlugAvailableResponse {
+    available: boolean;
+}
+interface StartRequest {
+    Provider: string;
+}
+interface StartResponse {
+    auth_url: string;
+}
+interface StatusResponse {
+    status: string;
+}
+interface Team {
+    created_at: string;
+    id: string;
+    name: string;
+    org_id: string;
+    slug: string;
+    updated_at: string;
+}
+interface TeamListResponse {
+    teams: Team[];
+}
+interface TokenResponse {
+    expires_at: string;
+    refresh_token: string;
+    session_token: string;
+}
+interface TrustDeviceRequest {
+    DeviceID: string;
+}
+interface UIMetadata {
+    condition?: VisibilityCondition;
+    help_text?: string;
+    input_type: string;
+    object_fields?: ObjectFieldDef[];
+    options?: SelectOption[];
+    order: number;
+    placeholder?: string;
+    read_only?: boolean;
+    section?: string;
+    validation?: Validation;
+}
+interface UnenforceSettingRequest {
+    Key: string;
+    Scope: string;
+    ScopeID: string;
+}
+interface UnlinkAuthMethodRequest {
+    Provider: string;
+}
+interface UnlinkAuthMethodResponse {
+    status: string;
+}
+interface User {
+    app_id: string;
+    ban_expires?: string;
+    ban_reason?: string;
+    banned: boolean;
+    created_at: string;
+    deleted_at?: string;
+    display_username?: string;
+    email: string;
+    email_verified: boolean;
+    env_id: string;
+    first_name: string;
+    id: string;
+    image?: string;
+    last_name: string;
+    metadata?: Record<string, unknown>;
+    password_changed_at?: string;
+    phone?: string;
+    phone_verified: boolean;
+    updated_at: string;
+    username?: string;
+}
+interface UserRoleListResponse {
+    roles: Role[];
+}
+interface Validation {
+    max?: number;
+    max_len?: number;
+    min?: number;
+    min_len?: number;
+    pattern?: string;
+    required?: boolean;
+}
+interface VerifyMFARequest {
+    code: string;
+}
+interface VerifyMFAResponse {
+    method: string;
+    recovery_codes?: string[];
+    verified: boolean;
+}
+interface VerifyRequest {
+    app_id?: string;
+    token: string;
+}
+interface VerifyResponse {
+    expires_at: string;
+    refresh_token: string;
+    session_token: string;
+    user: User;
+}
+interface VisibilityCondition {
+    key: string;
+    operator?: string;
+    value: string;
+}
+interface Webhook {
+    active: boolean;
+    app_id: string;
+    created_at: string;
+    env_id: string;
+    events: string[];
+    id: string;
+    updated_at: string;
+    url: string;
+}
+interface WebhookListResponse {
+    webhooks: Webhook[];
+}
+type SetAppClientConfigRequest = {
+    app_name?: string;
+    logo_url?: string;
+    magic_link_enabled?: boolean;
+    mfa_enabled?: boolean;
+    mfa_methods?: string[];
+    passkey_enabled?: boolean;
+    password_enabled?: boolean;
+    social_enabled?: boolean;
+    social_providers?: string[];
+    sso_enabled?: boolean;
+};
+type SetAppSessionConfigRequest = {
+    bind_to_device?: boolean;
+    bind_to_ip?: boolean;
+    max_active_sessions?: number;
+    refresh_token_ttl_seconds?: number;
+    rotate_refresh_token?: boolean;
+    token_format?: string;
+    token_ttl_seconds?: number;
+};
+type AdminBulkRevokeSessionsRequest = BulkRevokeSessionsRequest;
+type AdminBulkImportUsersRequest = {
+    app_id?: string;
+    users: Record<string, unknown>[];
+};
+type EnforceSettingRequest = {
+    app_id?: string;
+    org_id?: string;
+    scope: string;
+    scope_id?: string;
+    value: string;
+};
+type SetSettingRequest = {
+    app_id?: string;
+    org_id?: string;
+    scope: string;
+    scope_id?: string;
+    value: string;
+};
+type AdminBanUserRequest = {
+    expires_at?: string;
+    reason?: string;
+};
+type ChangePasswordRequest = {
+    current_password: string;
+    new_password: string;
+};
+type CreateEnvironmentRequest = {
+    app_id?: string;
+    color?: string;
+    description?: string;
+    name: string;
+    settings?: Record<string, unknown>;
+    slug: string;
+    type: string;
+};
+type UpdateEnvironmentRequest = {
+    color?: string;
+    description?: string;
+    name?: string;
+};
+type CloneEnvironmentRequest = {
+    description?: string;
+    name: string;
+    settings?: Record<string, unknown>;
+    slug: string;
+    type: string;
+    webhook_url_override?: string;
+};
+type UpdateEnvironmentSettingsRequest = {
+    allow_test_credentials?: boolean;
+    check_breached?: boolean;
+    lockout_enabled?: boolean;
+    lockout_max_attempts?: number;
+    oauth_overrides?: Record<string, unknown>;
+    password_min_length?: number;
+    rate_limit_enabled?: boolean;
+    rate_limit_window_seconds?: number;
+    refresh_token_ttl_seconds?: number;
+    signin_rate_limit?: number;
+    signup_rate_limit?: number;
+    skip_email_verification?: boolean;
+    token_ttl_seconds?: number;
+    webhook_url_override?: string;
+};
+type ForgotPasswordRequest = {
+    app_id?: string;
+    email: string;
+};
+type CreateAPIKeyRequest = CreateKeyRequest;
+type RevokeAPIKeyRequest = RevokeKeyRequest;
+type SendMagicLinkRequest = SendRequest;
+type VerifyMagicLinkRequest = VerifyRequest;
+type UpdateMeRequest = {
+    first_name?: string;
+    image?: string;
+    last_name?: string;
+    username?: string;
+};
+type DeleteMeRequest = DeleteAccountRequest;
+type ChallengeMFARequest = ChallengeRequest;
+type EnrollMFARequest = EnrollRequest;
+type DisableMFARequest = DisableRequest;
+type RegenerateMFARecoveryCodesRequest = RecoveryRegenerateRequest;
+type VerifyRecoveryCodeRequest = RecoveryVerifyRequest;
+type SendSMSCodeRequest = SMSSendRequest;
+type VerifySMSCodeRequest = SMSVerifyRequest;
+type CreateOrganizationRequest = {
+    app_id?: string;
+    logo?: string;
+    name: string;
+    slug: string;
+};
+type AcceptInvitationRequest = {
+    token: string;
+};
+type DeclineInvitationRequest = {
+    token: string;
+};
+type UpdateOrganizationRequest = {
+    logo?: string;
+    name?: string;
+};
+type DeleteOrganizationRequest = DeleteOrgRequest;
+type CreateInvitationRequest = {
+    email: string;
+    role?: string;
+};
+type AddMemberRequest = {
+    role?: string;
+    user_id: string;
+};
+type UpdateMemberRequest = {
+    role: string;
+};
+type CreateTeamRequest = {
+    name: string;
+    slug: string;
+};
+type UpdateTeamRequest = {
+    name?: string;
+    slug?: string;
+};
+type PasskeyLoginBeginRequest = LoginBeginRequest;
+type PasskeyLoginFinishRequest = LoginFinishRequest;
+type PasskeyRegisterBeginRequest = RegisterBeginRequest;
+type PasskeyRegisterFinishRequest = RegisterFinishRequest;
+type DeletePasskeyRequest = DeleteRequest;
+type RefreshRequest = {
+    refresh_token: string;
+};
+type ResetPasswordRequest = {
+    new_password: string;
+    token: string;
+};
+type AuthsomeCreateRoleRequest = {
+    app_id?: string;
+    description?: string;
+    name: string;
+    parent_id?: string;
+    slug: string;
+};
+type AuthsomeUpdateRoleRequest = {
+    description?: string;
+    name?: string;
+    parent_id?: string;
+};
+type AuthsomeAssignRoleRequest = {
+    org_id?: string;
+    user_id: string;
+};
+type AuthsomeAddPermissionRequest = {
+    action: string;
+    resource: string;
+};
+type AuthsomeUnassignRoleRequest = {
+    user_id: string;
+};
+type SignInRequest = {
+    app_id?: string;
+    email?: string;
+    password: string;
+    username?: string;
+};
+type SignUpRequest = {
+    app_id?: string;
+    email: string;
+    first_name?: string;
+    last_name?: string;
+    metadata?: Record<string, unknown>;
+    password: string;
+    username?: string;
+};
+type StartOAuthRequest = StartRequest;
+type SsoACSRequest = ACSRequest;
+type SsoCallbackRequest = CallbackRequest;
+type StartSSOLoginRequest = LoginRequest;
+type VerifyEmailRequest = {
+    token: string;
+};
+type CreateWebhookRequest = {
+    app_id?: string;
+    events: string[];
+    url: string;
+};
+type UpdateWebhookRequest = {
+    active?: boolean;
+    events?: string[];
+    url?: string;
+};
 
-/**
- * Error handling utilities
- */
+/** Core type definitions for AuthSome UI Kit. */
 
+interface Session {
+    session_token: string;
+    refresh_token: string;
+    expires_at: string;
+}
+/** API error response. */
+interface APIError {
+    error: string;
+    code?: number;
+}
+/** Authentication state. */
+type AuthState = {
+    status: "idle";
+} | {
+    status: "loading";
+} | {
+    status: "authenticated";
+    user: User;
+    session: Session;
+} | {
+    status: "unauthenticated";
+} | {
+    status: "mfa_required";
+    session: Session;
+} | {
+    status: "error";
+    error: string;
+};
+/** Configuration for the AuthSome client. */
+interface AuthConfig {
+    /** Base URL of the AuthSome API (e.g., "https://api.example.com"). */
+    baseURL: string;
+    /** Publishable key for auto-discovering enabled auth methods. */
+    publishableKey?: string;
+    /** Pre-fetched client config (useful for SSR). */
+    initialClientConfig?: ClientConfig;
+    /** Custom fetch implementation (defaults to global fetch). */
+    fetch?: typeof fetch;
+    /** Storage implementation for persisting tokens (defaults to localStorage). */
+    storage?: TokenStorage;
+    /** Callback invoked when the auth state changes. */
+    onStateChange?: (state: AuthState) => void;
+    /** Callback invoked on authentication error. */
+    onError?: (error: APIError) => void;
+}
+/** Social provider info from the backend. */
+interface SocialProviderConfig {
+    id: string;
+    name: string;
+}
+/** SSO connection info from the backend. */
+interface SSOConnectionConfig {
+    id: string;
+    name: string;
+}
+/** A single option for select/radio/checkbox signup fields. */
+interface SignupFieldOption {
+    label: string;
+    value: string;
+}
+/** Validation rules for a signup field. */
+interface SignupFieldValidation {
+    required?: boolean;
+    min_len?: number;
+    max_len?: number;
+    pattern?: string;
+    min?: number;
+    max?: number;
+}
+/** A custom signup form field from the backend. */
+interface SignupFieldConfig {
+    key: string;
+    label: string;
+    type: string;
+    placeholder?: string;
+    description?: string;
+    options?: SignupFieldOption[];
+    default?: string;
+    validation?: SignupFieldValidation;
+    order: number;
+}
 /**
- * Create an auth error
+ * Client configuration returned by the backend.
  *
- * @deprecated Use `new AuthError()` directly instead
- */
-declare function createAuthError(type: AuthErrorType, message: string, details?: Record<string, unknown>, code?: string | number): AuthError;
-/**
- * Check if an error is an auth error
- */
-declare function isAuthError(error: unknown): error is AuthError;
-/**
- * Convert unknown error to auth error
- */
-declare function toAuthError(error: unknown): AuthError;
-/**
- * Check if error is a network error
+ * Describes which auth methods are enabled so SDK components
+ * can auto-configure their UI without manual props.
  */
-declare function isNetworkError(error: unknown): boolean;
-/**
- * Check if error indicates authentication is required
- */
-declare function isUnauthenticatedError(error: unknown): boolean;
-/**
- * Check if error requires MFA
- */
-declare function isMFARequiredError(error: unknown): boolean;
-
-/**
- * Internationalization (i18n) types and interfaces
- */
-/**
- * Complete locale interface for all auth-related text
- */
-interface AuthLocale {
-    common: {
-        loading: string;
-        submit: string;
-        cancel: string;
-        continue: string;
-        back: string;
-        or: string;
-        optional: string;
-    };
-    auth: {
-        signIn: string;
-        signUp: string;
-        signOut: string;
-        email: string;
-        password: string;
-        confirmPassword: string;
-        username: string;
-        phone: string;
-        rememberMe: string;
-        forgotPassword: string;
-        continueWith: string;
-        orContinueWith: string;
-    };
-    oauth: {
-        google: string;
-        github: string;
-        microsoft: string;
-        facebook: string;
-        apple: string;
-        discord: string;
-        twitter: string;
-        linkedin: string;
-        chooseProvider: string;
-        signInPreferred: string;
-    };
-    magicLink: {
-        sendLink: string;
-        checkEmail: string;
-        linkSent: string;
-        enterEmail: string;
-    };
-    phone: {
-        enterPhone: string;
-        sendCode: string;
-        enterCode: string;
-        verifyPhone: string;
-        codeLabel: string;
-    };
-    mfa: {
-        required: string;
-        selectMethod: string;
-        verify: string;
-        enterCode: string;
-        sms: string;
-        authenticator: string;
-        email: string;
-    };
-    passkey: {
-        signInWith: string;
-        register: string;
-        usePasskey: string;
-    };
-    deviceFlow: {
-        title: string;
-        subtitle: string;
-        enterCode: string;
-        enterCodeDescription: string;
-        codeLabel: string;
-        codePlaceholder: string;
-        codeHint: string;
-        verify: string;
-        verifyCode: string;
-        invalidCode: string;
-        noCode: string;
-        getCodeHelp: string;
-        authorizationTitle: string;
-        authorizationSubtitle: string;
-        authorizeTitle: string;
-        authorizeDescription: string;
-        requestingAccess: string;
-        codeConfirm: string;
-        requestedPermissions: string;
-        securityWarning: string;
-        scopes: string;
-        approve: string;
-        deny: string;
-        authorizedTitle: string;
-        authorizedMessage: string;
-        authorizedDescription: string;
-        authorizedHint: string;
-        returnToCli: string;
-        deniedTitle: string;
-        deniedMessage: string;
-        deniedDescription: string;
-        deniedHint: string;
+interface ClientConfig {
+    version?: string;
+    app_id?: string;
+    branding?: {
+        app_name?: string;
+        logo_url?: string;
     };
-    signUp: {
-        title: string;
-        subtitle: string;
-        haveAccount: string;
-        signInLink: string;
-        agreeToTerms: string;
-        terms: string;
+    password?: {
+        enabled: boolean;
     };
-    signIn: {
-        title: string;
-        subtitle: string;
-        noAccount: string;
-        signUpLink: string;
-        enterEmail: string;
+    social?: {
+        enabled: boolean;
+        providers: SocialProviderConfig[];
     };
-    validation: {
-        emailRequired: string;
-        emailInvalid: string;
-        passwordRequired: string;
-        passwordTooShort: string;
-        passwordRequireUppercase: string;
-        passwordRequireLowercase: string;
-        passwordRequireNumber: string;
-        passwordRequireSpecial: string;
-        passwordMismatch: string;
-        usernameRequired: string;
-        usernameInvalid: string;
-        phoneRequired: string;
-        phoneInvalid: string;
-        codeRequired: string;
-        codeInvalid: string;
-        fieldRequired: string;
-        termsRequired: string;
+    passkey?: {
+        enabled: boolean;
     };
-    errors: {
-        invalidCredentials: string;
-        userNotFound: string;
-        userExists: string;
-        invalidToken: string;
-        tokenExpired: string;
-        networkError: string;
-        mfaRequired: string;
-        emailNotVerified: string;
-        phoneNotVerified: string;
-        rateLimitExceeded: string;
-        unknownError: string;
-        generic: string;
+    mfa?: {
+        enabled: boolean;
+        methods: string[];
     };
-    success: {
-        signedIn: string;
-        signedUp: string;
-        signedOut: string;
-        linkSent: string;
-        codeSent: string;
-        verified: string;
-        welcome: string;
+    magiclink?: {
+        enabled: boolean;
     };
-    placeholders: {
-        email: string;
-        password: string;
-        confirmPassword: string;
-        username: string;
-        phone: string;
-        code: string;
-        fullName: string;
+    sso?: {
+        enabled: boolean;
+        connections: SSOConnectionConfig[];
     };
+    /** List of server-side plugin names that are installed and active. */
+    supported_plugins?: string[];
+    /** Custom signup form fields configured for this app. */
+    signup_fields?: SignupFieldConfig[];
+}
+/** Interface for persisting tokens across sessions. */
+interface TokenStorage {
+    getItem(key: string): string | null | Promise<string | null>;
+    setItem(key: string, value: string): void | Promise<void>;
+    removeItem(key: string): void | Promise<void>;
 }
-/**
- * Deep partial type for locale overrides
- */
-type DeepPartial<T> = {
-    [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P];
-};
-
-/**
- * Validation utilities
- */
-
-/**
- * Validate email address
- */
-declare function validateEmail(email: string, locale?: AuthLocale): ValidationError | null;
-/**
- * Validate password
- */
-declare function validatePassword(password: string, options?: {
-    minLength?: number;
-    requireUppercase?: boolean;
-    requireLowercase?: boolean;
-    requireNumber?: boolean;
-    requireSpecial?: boolean;
-    locale?: AuthLocale;
-}): ValidationError | null;
-/**
- * Validate phone number
- */
-declare function validatePhone(phone: string, locale?: AuthLocale): ValidationError | null;
-/**
- * Validate username
- */
-declare function validateUsername(username: string, locale?: AuthLocale): ValidationError | null;
-/**
- * Validate 2FA code
- */
-declare function validate2FACode(code: string, locale?: AuthLocale): ValidationError | null;
-/**
- * Validate required field
- */
-declare function validateRequired(value: unknown, fieldName: string, locale?: AuthLocale): ValidationError | null;
-
-/**
- * Token management utilities
- */
 
-/**
- * Token manager class
- */
-declare class TokenManager {
-    private storage;
-    constructor(storage?: Storage);
+interface AuthClientConfig {
+    /** Base URL of the AuthSome API (e.g., "https://api.example.com") */
+    baseURL: string;
+    /** Optional custom fetch implementation */
+    fetch?: typeof globalThis.fetch;
+}
+declare class AuthClient$1 {
+    private baseURL;
+    private fetchFn;
+    constructor(config: AuthClientConfig | Pick<{
+        baseURL: string;
+        fetch?: typeof globalThis.fetch;
+    }, 'baseURL' | 'fetch'>);
+    /**
+     * Get AuthSome manifest
+     * GET /.well-known/authsome/manifest
+     */
+    getManifest(): Promise<Record<string, unknown>>;
+    /**
+     * Get OpenAPI specification
+     * GET /.well-known/authsome/openapi
+     */
+    getOpenAPI(): Promise<Record<string, unknown>>;
     /**
-     * Get access token
+     * Get per-app client config overrides
+     * GET /v1/admin/apps/{appId}/client-config
      */
-    getToken(): Promise<string | null>;
+    getAppClientConfig(appId: string, token: string): Promise<Config>;
     /**
-     * Set access token
+     * Set per-app client config overrides
+     * PUT /v1/admin/apps/{appId}/client-config
      */
-    setToken(token: string): Promise<void>;
+    setAppClientConfig(appId: string, body: SetAppClientConfigRequest, token: string): Promise<Config>;
     /**
-     * Remove access token
+     * Delete per-app client config overrides
+     * DELETE /v1/admin/apps/{appId}/client-config
      */
-    removeToken(): Promise<void>;
+    deleteAppClientConfig(appId: string, body: DeleteAppClientConfigRequest, token: string): Promise<StatusResponse>;
     /**
-     * Get refresh token
+     * Get per-app session config
+     * GET /v1/admin/apps/{appId}/session-config
      */
-    getRefreshToken(): Promise<string | null>;
+    getAppSessionConfig(appId: string, token: string): Promise<Config>;
     /**
-     * Set refresh token
+     * Set per-app session config
+     * PUT /v1/admin/apps/{appId}/session-config
      */
-    setRefreshToken(token: string): Promise<void>;
+    setAppSessionConfig(appId: string, body: SetAppSessionConfigRequest, token: string): Promise<Config>;
     /**
-     * Remove refresh token
+     * Delete per-app session config
+     * DELETE /v1/admin/apps/{appId}/session-config
      */
-    removeRefreshToken(): Promise<void>;
+    deleteAppSessionConfig(appId: string, body: DeleteAppSessionConfigRequest, token: string): Promise<StatusResponse>;
     /**
-     * Clear all tokens
+     * Bulk revoke sessions (admin)
+     * DELETE /v1/admin/bulk/sessions
      */
-    clearTokens(): Promise<void>;
+    adminBulkRevokeSessions(body: AdminBulkRevokeSessionsRequest, token: string): Promise<BulkRevokeSessionsResponse>;
     /**
-     * Check if token is expired
+     * Bulk import users (admin)
+     * POST /v1/admin/bulk/users/import
      */
-    isTokenExpired(token: string): boolean;
+    adminBulkImportUsers(body: AdminBulkImportUsersRequest, token: string): Promise<BulkImportResult>;
     /**
-     * Decode JWT token (without verification)
+     * Stop impersonation (admin)
+     * POST /v1/admin/impersonate/stop
      */
-    private decodeToken;
-}
-
-/**
- * Cookie utility functions
- * Framework-agnostic helpers for cookie parsing and serialization
- */
-
-/**
- * Parse Set-Cookie header value into CookieData
- * @param setCookieHeader - The Set-Cookie header value
- * @returns Parsed cookie data
- */
-declare function parseCookie(setCookieHeader: string): CookieData | null;
-/**
- * Extract multiple cookies from Set-Cookie headers
- * @param setCookieHeaders - Array of Set-Cookie header values or single string
- * @returns Array of parsed cookies
- */
-declare function extractCookiesFromHeaders(setCookieHeaders: string | string[]): CookieData[];
-/**
- * Serialize a CookieData object into a Set-Cookie header value
- * @param cookie - The cookie data to serialize
- * @returns Set-Cookie header value
- */
-declare function serializeCookie(cookie: CookieData): string;
-/**
- * Parse Cookie header value into key-value pairs
- * @param cookieHeader - The Cookie header value
- * @returns Object with cookie name-value pairs
- */
-declare function parseCookieOptions(cookieHeader: string): Record<string, string>;
-/**
- * Convert cookie object to Cookie header string
- * @param cookies - Object with cookie name-value pairs
- * @returns Cookie header value
- */
-declare function serializeCookies(cookies: Record<string, string>): string;
-
-/**
- * Locale utility functions
- */
-
-/**
- * Default locale (English)
- */
-declare const defaultLocale: AuthLocale;
-/**
- * Create a complete locale by merging overrides with the default English locale
- *
- * @param overrides - Partial locale object with custom translations
- * @returns Complete locale object with all required keys
- *
- * @example
- * ```typescript
- * const spanishLocale = createLocale({
- *   auth: {
- *     signIn: 'Iniciar sesión',
- *     signUp: 'Registrarse',
- *   }
- * });
- * ```
- */
-declare function createLocale(overrides?: DeepPartial<AuthLocale>): AuthLocale;
-/**
- * Interpolate template string with values
- *
- * Replaces {key} placeholders with corresponding values from the provided object.
- *
- * @param template - Template string with {key} placeholders
- * @param values - Object with key-value pairs for interpolation
- * @returns Interpolated string
- *
- * @example
- * ```typescript
- * interpolate('Hello, {name}!', { name: 'John' })
- * // Returns: "Hello, John!"
- *
- * interpolate('Password must be at least {min} characters', { min: '8' })
- * // Returns: "Password must be at least 8 characters"
- * ```
- */
-declare function interpolate(template: string, values: Record<string, string | number>): string;
-
-/**
- * Auth client configuration
- */
-interface AuthClientConfig {
-    provider: AuthProvider;
-    autoRefresh?: boolean;
-    refreshInterval?: number;
-}
-/**
- * Auth client class
- */
-declare class AuthClient {
-    private provider;
-    private autoRefresh;
-    private refreshInterval;
-    private refreshTimer?;
-    readonly state: Observable<AuthContext>;
-    get adapter(): AuthProvider;
-    constructor(config: AuthClientConfig);
+    adminStopImpersonation(body: AdminStopImpersonationRequest, token: string): Promise<StatusResponse>;
     /**
-     * Initialize the auth client
+     * Impersonate user (admin)
+     * POST /v1/admin/impersonate/{userId}
      */
-    initialize(): Promise<void>;
+    adminImpersonate(userId: string, body: AdminImpersonateRequest, token: string): Promise<AuthResponse>;
     /**
-     * Sign in with credentials
+     * List organizations (admin)
+     * GET /v1/admin/orgs
      */
-    signIn(request: SignInRequest): Promise<void>;
+    adminListOrgs(token: string): Promise<OrgListResponse>;
     /**
-     * Sign up with credentials
+     * List all setting definitions
+     * GET /v1/admin/settings/definitions
      */
-    signUp(request: SignUpRequest): Promise<void>;
+    listSettingsDefinitions(token: string): Promise<ListDefinitionsResponse>;
     /**
-     * Sign out
+     * List definitions for a namespace
+     * GET /v1/admin/settings/definitions/{namespace}
      */
-    signOut(): Promise<void>;
+    listNamespaceSettingsDefinitions(namespace: string, token: string): Promise<ListDefinitionsResponse>;
+    /**
+     * Enforce a setting value at a scope
+     * PUT /v1/admin/settings/enforce/{key}
+     */
+    enforceSetting(key: string, body: EnforceSettingRequest, token: string): Promise<SettingValueResponse>;
+    /**
+     * Remove enforcement from a setting
+     * DELETE /v1/admin/settings/enforce/{key}
+     */
+    unenforceSetting(key: string, body: UnenforceSettingRequest, token: string): Promise<StatusResponse>;
+    /**
+     * Resolve all settings at a scope
+     * GET /v1/admin/settings/resolve
+     */
+    resolveSettings(token: string): Promise<ResolvedSettingsResponse>;
+    /**
+     * Resolve one setting with cascade details
+     * GET /v1/admin/settings/resolve/{key}
+     */
+    resolveSetting(key: string, token: string): Promise<ResolvedSettingResponse>;
+    /**
+     * Set a setting value at a scope
+     * PUT /v1/admin/settings/values/{key}
+     */
+    setSetting(key: string, body: SetSettingRequest, token: string): Promise<SettingValueResponse>;
+    /**
+     * Delete a setting override at a scope
+     * DELETE /v1/admin/settings/values/{key}
+     */
+    deleteSetting(key: string, body: DeleteSettingRequest, token: string): Promise<StatusResponse>;
+    /**
+     * Get stats (admin)
+     * GET /v1/admin/stats
+     */
+    adminGetStats(token: string): Promise<AdminStatsResponse>;
+    /**
+     * List users (admin)
+     * GET /v1/admin/users
+     */
+    adminListUsers(token: string): Promise<AdminUserListResponse>;
+    /**
+     * Get user (admin)
+     * GET /v1/admin/users/{userId}
+     */
+    adminGetUser(userId: string, token: string): Promise<User>;
+    /**
+     * Delete user (admin)
+     * DELETE /v1/admin/users/{userId}
+     */
+    adminDeleteUser(userId: string, body: AdminDeleteUserRequest, token: string): Promise<StatusResponse>;
+    /**
+     * Ban user (admin)
+     * POST /v1/admin/users/{userId}/ban
+     */
+    adminBanUser(userId: string, body: AdminBanUserRequest, token: string): Promise<StatusResponse>;
     /**
-     * Update user profile
+     * Unban user (admin)
+     * POST /v1/admin/users/{userId}/unban
      */
-    updateUser(request: UpdateUserRequest): Promise<void>;
+    adminUnbanUser(userId: string, body: AdminUnbanUserRequest, token: string): Promise<StatusResponse>;
     /**
      * Change password
+     * POST /v1/change-password
+     */
+    changePassword(body: ChangePasswordRequest, token: string): Promise<StatusResponse>;
+    /**
+     * Get client configuration
+     * GET /v1/client-config
+     */
+    getClientConfig(token: string): Promise<ClientConfigResponse>;
+    /**
+     * List devices
+     * GET /v1/devices
+     */
+    listDevices(token: string): Promise<DeviceListResponse>;
+    /**
+     * Get device
+     * GET /v1/devices/{deviceId}
+     */
+    getDevice(deviceId: string, token: string): Promise<Device>;
+    /**
+     * Delete device
+     * DELETE /v1/devices/{deviceId}
+     */
+    deleteDevice(deviceId: string, body: DeleteDeviceRequest, token: string): Promise<StatusResponse>;
+    /**
+     * Trust device
+     * PATCH /v1/devices/{deviceId}/trust
+     */
+    trustDevice(deviceId: string, body: TrustDeviceRequest, token: string): Promise<Device>;
+    /**
+     * List environments
+     * GET /v1/environments
+     */
+    listEnvironments(token: string): Promise<EnvironmentListResponse>;
+    /**
+     * Create environment
+     * POST /v1/environments
+     */
+    createEnvironment(body: CreateEnvironmentRequest, token: string): Promise<Environment>;
+    /**
+     * Get environment
+     * GET /v1/environments/{envId}
+     */
+    getEnvironment(envId: string, token: string): Promise<Environment>;
+    /**
+     * Update environment
+     * PATCH /v1/environments/{envId}
+     */
+    updateEnvironment(envId: string, body: UpdateEnvironmentRequest, token: string): Promise<Environment>;
+    /**
+     * Delete environment
+     * DELETE /v1/environments/{envId}
+     */
+    deleteEnvironment(envId: string, token: string): Promise<StatusResponse>;
+    /**
+     * Clone environment
+     * POST /v1/environments/{envId}/clone
+     */
+    cloneEnvironment(envId: string, body: CloneEnvironmentRequest, token: string): Promise<CloneEnvironmentResponse>;
+    /**
+     * Set default environment
+     * POST /v1/environments/{envId}/set-default
+     */
+    setDefaultEnvironment(envId: string, token: string): Promise<StatusResponse>;
+    /**
+     * Get environment settings
+     * GET /v1/environments/{envId}/settings
+     */
+    getEnvironmentSettings(envId: string, token: string): Promise<EnvironmentSettingsResponse>;
+    /**
+     * Update environment settings
+     * PATCH /v1/environments/{envId}/settings
      */
-    changePassword(request: PasswordChangeRequest): Promise<void>;
+    updateEnvironmentSettings(envId: string, body: UpdateEnvironmentSettingsRequest, token: string): Promise<Environment>;
     /**
-     * Request password reset
+     * Forgot password
+     * POST /v1/forgot-password
      */
-    requestPasswordReset(request: PasswordResetRequest): Promise<void>;
+    forgotPassword(body: ForgotPasswordRequest): Promise<ForgotPasswordResponse>;
     /**
-     * Confirm password reset
+     * Health check
+     * GET /v1/health
      */
-    confirmPasswordReset(request: PasswordResetConfirmRequest): Promise<void>;
+    getHealth(): Promise<HealthResponse>;
     /**
-     * Get OAuth sign in URL
+     * List API keys
+     * GET /v1/keys
      */
-    getOAuthUrl(request: OAuthSignInRequest): Promise<string>;
+    listAPIKeys(token: string): Promise<ListKeysResponse>;
     /**
-     * Handle OAuth callback
+     * Create API key
+     * POST /v1/keys
      */
-    handleOAuthCallback(request: OAuthCallbackRequest): Promise<void>;
+    createAPIKey(body: CreateAPIKeyRequest, token: string): Promise<CreateKeyResponse>;
     /**
-     * Get available OAuth providers
+     * Revoke API key
+     * DELETE /v1/keys/{keyId}
      */
-    getOAuthProviders(): Promise<OAuthProvider[]>;
+    revokeAPIKey(keyId: string, body: RevokeAPIKeyRequest, token: string): Promise<void>;
     /**
      * Send magic link
+     * POST /v1/magic-link/send
      */
-    sendMagicLink(request: MagicLinkRequest): Promise<void>;
+    sendMagicLink(body: SendMagicLinkRequest): Promise<SendResponse>;
     /**
      * Verify magic link
+     * POST /v1/magic-link/verify
+     */
+    verifyMagicLink(body: VerifyMagicLinkRequest): Promise<VerifyResponse>;
+    /**
+     * Get current user
+     * GET /v1/me
+     */
+    getMe(token: string): Promise<User>;
+    /**
+     * Update current user
+     * PATCH /v1/me
+     */
+    updateMe(body: UpdateMeRequest, token: string): Promise<User>;
+    /**
+     * Delete account
+     * DELETE /v1/me
+     */
+    deleteMe(body: DeleteMeRequest, token: string): Promise<StatusResponse>;
+    /**
+     * List linked auth methods
+     * GET /v1/me/auth-methods
+     */
+    listAuthMethods(token: string): Promise<ListAuthMethodsResponse>;
+    /**
+     * Unlink an auth method
+     * DELETE /v1/me/auth-methods/{provider}
+     */
+    unlinkAuthMethod(provider: string, body: UnlinkAuthMethodRequest, token: string): Promise<UnlinkAuthMethodResponse>;
+    /**
+     * Export user data
+     * GET /v1/me/export
+     */
+    exportMyData(token: string): Promise<Record<string, unknown>>;
+    /**
+     * MFA challenge
+     * POST /v1/mfa/challenge
+     */
+    challengeMFA(body: ChallengeMFARequest): Promise<ChallengeResponse>;
+    /**
+     * Enroll in MFA
+     * POST /v1/mfa/enroll
+     */
+    enrollMFA(body: EnrollMFARequest, token: string): Promise<EnrollResponse>;
+    /**
+     * Disable MFA
+     * DELETE /v1/mfa/enrollment
+     */
+    disableMFA(body: DisableMFARequest, token: string): Promise<DisableResponse>;
+    /**
+     * Regenerate MFA recovery codes
+     * POST /v1/mfa/recovery/regenerate
+     */
+    regenerateMFARecoveryCodes(body: RegenerateMFARecoveryCodesRequest, token: string): Promise<RecoveryRegenerateResponse>;
+    /**
+     * Verify MFA recovery code
+     * POST /v1/mfa/recovery/verify
+     */
+    verifyRecoveryCode(body: VerifyRecoveryCodeRequest): Promise<RecoveryVerifyResponse>;
+    /**
+     * Send SMS verification code
+     * POST /v1/mfa/sms/send
+     */
+    sendSMSCode(body: SendSMSCodeRequest, token: string): Promise<SMSSendResponse>;
+    /**
+     * Verify SMS code
+     * POST /v1/mfa/sms/verify
+     */
+    verifySMSCode(body: VerifySMSCodeRequest, token: string): Promise<SMSVerifyResponse>;
+    /**
+     * Verify MFA code
+     * POST /v1/mfa/verify
+     */
+    verifyMFA(body: VerifyMFARequest): Promise<VerifyMFAResponse>;
+    /**
+     * List organizations
+     * GET /v1/orgs
+     */
+    listOrganizations(token: string): Promise<OrgListResponse>;
+    /**
+     * Create organization
+     * POST /v1/orgs
+     */
+    createOrganization(body: CreateOrganizationRequest, token: string): Promise<Organization>;
+    /**
+     * Check slug availability
+     * GET /v1/orgs/check-slug
      */
-    verifyMagicLink(request: MagicLinkVerifyRequest): Promise<void>;
+    checkOrgSlug(token: string): Promise<SlugAvailableResponse>;
     /**
-     * Send phone verification code
+     * Accept invitation
+     * POST /v1/orgs/invitations/accept
      */
-    sendPhoneCode(request: PhoneAuthRequest): Promise<void>;
+    acceptInvitation(body: AcceptInvitationRequest, token: string): Promise<Member>;
     /**
-     * Verify phone code
+     * Decline invitation
+     * POST /v1/orgs/invitations/decline
      */
-    verifyPhoneCode(request: PhoneVerifyRequest): Promise<void>;
+    declineInvitation(body: DeclineInvitationRequest, token: string): Promise<StatusResponse>;
     /**
-     * Setup 2FA
+     * Get organization
+     * GET /v1/orgs/{orgId}
      */
-    setupTwoFactor(request: TwoFactorSetupRequest): Promise<TwoFactorSetupResponse>;
+    getOrganization(orgId: string, token: string): Promise<Organization>;
     /**
-     * Verify 2FA code
+     * Update organization
+     * PATCH /v1/orgs/{orgId}
      */
-    verifyTwoFactor(request: TwoFactorVerifyRequest): Promise<void>;
+    updateOrganization(orgId: string, body: UpdateOrganizationRequest, token: string): Promise<Organization>;
     /**
-     * Disable 2FA
+     * Delete organization
+     * DELETE /v1/orgs/{orgId}
      */
-    disableTwoFactor(): Promise<void>;
+    deleteOrganization(orgId: string, body: DeleteOrganizationRequest, token: string): Promise<StatusResponse>;
     /**
-     * Get 2FA status
+     * List invitations
+     * GET /v1/orgs/{orgId}/invitations
      */
-    getTwoFactorStatus(): Promise<TwoFactorMethod[]>;
+    listInvitations(orgId: string, token: string): Promise<InvitationListResponse>;
     /**
-     * Register passkey
+     * Create invitation
+     * POST /v1/orgs/{orgId}/invitations
      */
-    registerPasskey(request: PasskeyRegisterRequest): Promise<PasskeyCredential>;
+    createInvitation(orgId: string, body: CreateInvitationRequest, token: string): Promise<Invitation>;
     /**
-     * Authenticate with passkey
+     * List members
+     * GET /v1/orgs/{orgId}/members
      */
-    authenticatePasskey(request: PasskeyAuthRequest): Promise<void>;
+    listMembers(orgId: string, token: string): Promise<MemberListResponse>;
+    /**
+     * Add member
+     * POST /v1/orgs/{orgId}/members
+     */
+    addMember(orgId: string, body: AddMemberRequest, token: string): Promise<Member>;
+    /**
+     * Update member role
+     * PATCH /v1/orgs/{orgId}/members/{memberId}
+     */
+    updateMember(orgId: string, memberId: string, body: UpdateMemberRequest, token: string): Promise<Member>;
+    /**
+     * Remove member
+     * DELETE /v1/orgs/{orgId}/members/{memberId}
+     */
+    removeMember(orgId: string, memberId: string, body: RemoveMemberRequest, token: string): Promise<StatusResponse>;
+    /**
+     * List teams
+     * GET /v1/orgs/{orgId}/teams
+     */
+    listTeams(orgId: string, token: string): Promise<TeamListResponse>;
+    /**
+     * Create team
+     * POST /v1/orgs/{orgId}/teams
+     */
+    createTeam(orgId: string, body: CreateTeamRequest, token: string): Promise<Team>;
+    /**
+     * Get team
+     * GET /v1/orgs/{orgId}/teams/{teamId}
+     */
+    getTeam(orgId: string, teamId: string, token: string): Promise<Team>;
+    /**
+     * Update team
+     * PATCH /v1/orgs/{orgId}/teams/{teamId}
+     */
+    updateTeam(orgId: string, teamId: string, body: UpdateTeamRequest, token: string): Promise<Team>;
+    /**
+     * Delete team
+     * DELETE /v1/orgs/{orgId}/teams/{teamId}
+     */
+    deleteTeam(orgId: string, teamId: string, body: DeleteTeamRequest, token: string): Promise<StatusResponse>;
     /**
      * List passkeys
+     * GET /v1/passkeys/
      */
-    listPasskeys(): Promise<PasskeyCredential[]>;
+    listPasskeys(token: string): Promise<ListResponse$1>;
+    /**
+     * Begin passkey login
+     * POST /v1/passkeys/login/begin
+     */
+    passkeyLoginBegin(body: PasskeyLoginBeginRequest): Promise<LoginBeginResponse>;
+    /**
+     * Complete passkey login
+     * POST /v1/passkeys/login/finish
+     */
+    passkeyLoginFinish(body: PasskeyLoginFinishRequest): Promise<LoginFinishResponse>;
+    /**
+     * Begin passkey registration
+     * POST /v1/passkeys/register/begin
+     */
+    passkeyRegisterBegin(body: PasskeyRegisterBeginRequest, token: string): Promise<RegisterBeginResponse>;
+    /**
+     * Complete passkey registration
+     * POST /v1/passkeys/register/finish
+     */
+    passkeyRegisterFinish(body: PasskeyRegisterFinishRequest, token: string): Promise<RegisterFinishResponse>;
     /**
      * Delete passkey
+     * DELETE /v1/passkeys/{credentialId}
      */
-    deletePasskey(credentialId: string): Promise<void>;
+    deletePasskey(credentialId: string, body: DeletePasskeyRequest, token: string): Promise<DeleteResponse>;
     /**
-     * Get all organizations the user belongs to
-     * Only available if the provider supports organizations
+     * Refresh tokens
+     * POST /v1/refresh
      */
-    getOrganizations(): Promise<Organization[]>;
+    refresh(body: RefreshRequest): Promise<TokenResponse>;
     /**
-     * Get the currently active organization
-     * Only available if the provider supports organizations
+     * Reset password
+     * POST /v1/reset-password
      */
-    getActiveOrganization(): Promise<Organization | null>;
+    resetPassword(body: ResetPasswordRequest): Promise<StatusResponse>;
     /**
-     * Set the active organization and refresh user state
-     * Only available if the provider supports organizations
+     * List roles
+     * GET /v1/roles
      */
-    setActiveOrganization(organizationId: string): Promise<void>;
+    authsomeListRoles(token: string): Promise<RoleListResponse>;
     /**
-     * Get organization memberships with roles and permissions
-     * Only available if the provider supports organizations
+     * Create role
+     * POST /v1/roles
      */
-    getOrganizationMemberships(): Promise<OrganizationMembership[]>;
+    authsomeCreateRole(body: AuthsomeCreateRoleRequest, token: string): Promise<Role>;
     /**
-     * Check if the provider supports organizations
+     * Get role
+     * GET /v1/roles/{roleId}
      */
-    supportsOrganizations(): boolean;
+    authsomeGetRole(roleId: string, token: string): Promise<Role>;
     /**
-     * Refresh session
+     * Update role
+     * PATCH /v1/roles/{roleId}
      */
-    refreshSession(): Promise<void>;
+    authsomeUpdateRole(roleId: string, body: AuthsomeUpdateRoleRequest, token: string): Promise<Role>;
     /**
-     * Get current user
+     * Delete role
+     * DELETE /v1/roles/{roleId}
      */
-    getUser(): User | null;
+    authsomeDeleteRole(roleId: string, token: string): Promise<StatusResponse>;
     /**
-     * Get current session
+     * Assign role to user
+     * POST /v1/roles/{roleId}/assign
      */
-    getSession(): Session | null;
+    authsomeAssignRole(roleId: string, body: AuthsomeAssignRoleRequest, token: string): Promise<StatusResponse>;
     /**
-     * Check if authenticated
+     * List role permissions
+     * GET /v1/roles/{roleId}/permissions
      */
-    isAuthenticated(): boolean;
+    authsomeListRolePermissions(roleId: string, token: string): Promise<PermissionListResponse>;
     /**
-     * Get current error
+     * Add permission to role
+     * POST /v1/roles/{roleId}/permissions
      */
-    getError(): AuthError | null;
+    authsomeAddPermission(roleId: string, body: AuthsomeAddPermissionRequest, token: string): Promise<Permission>;
     /**
-     * Clear error
+     * Remove permission from role
+     * DELETE /v1/roles/{roleId}/permissions/{permissionId}
      */
-    clearError(): void;
+    authsomeRemovePermission(roleId: string, permissionId: string, token: string): Promise<StatusResponse>;
     /**
-     * Subscribe to auth state changes
+     * Unassign role from user
+     * POST /v1/roles/{roleId}/unassign
      */
-    subscribe(listener: (context: AuthContext) => void): Unsubscribe;
+    authsomeUnassignRole(roleId: string, body: AuthsomeUnassignRoleRequest, token: string): Promise<StatusResponse>;
     /**
-     * Cleanup resources
+     * List sessions
+     * GET /v1/sessions
      */
-    destroy(): void;
-    private updateState;
-    private setLoading;
-    private handleError;
-    private startAutoRefresh;
-    private stopAutoRefresh;
-    private createUnsupportedError;
-}
-
-/**
- * Authentication flow types and state machine
- */
-
-/**
- * Available authentication flow steps
- */
-declare enum FlowStep {
-    SIGN_IN = "sign_in",
-    SIGN_UP = "sign_up",
-    EMAIL_PASSWORD_SIGN_IN = "email_password_sign_in",
-    EMAIL_PASSWORD_SIGN_UP = "email_password_sign_up",
-    OAUTH_SELECT = "oauth_select",
-    OAUTH_CALLBACK = "oauth_callback",
-    MAGIC_LINK_REQUEST = "magic_link_request",
-    MAGIC_LINK_VERIFY = "magic_link_verify",
-    MAGIC_LINK_SENT = "magic_link_sent",
-    PHONE_REQUEST = "phone_request",
-    PHONE_VERIFY = "phone_verify",
-    USERNAME_SIGN_IN = "username_sign_in",
-    USERNAME_SIGN_UP = "username_sign_up",
-    PASSKEY_REGISTER = "passkey_register",
-    PASSKEY_AUTHENTICATE = "passkey_authenticate",
-    MFA_REQUIRED = "mfa_required",
-    MFA_SETUP = "mfa_setup",
-    MFA_VERIFY = "mfa_verify",
-    MFA_SELECT_METHOD = "mfa_select_method",
-    EMAIL_VERIFICATION_REQUIRED = "email_verification_required",
-    EMAIL_VERIFICATION_SENT = "email_verification_sent",
-    PHONE_VERIFICATION_REQUIRED = "phone_verification_required",
-    PASSWORD_RESET_REQUEST = "password_reset_request",
-    PASSWORD_RESET_SENT = "password_reset_sent",
-    PASSWORD_RESET_CONFIRM = "password_reset_confirm",
-    PASSWORD_CHANGE = "password_change",
-    PROFILE_UPDATE = "profile_update",
-    PROFILE_COMPLETE = "profile_complete",
-    DEVICE_FLOW_INITIATE = "device_flow_initiate",
-    DEVICE_CODE_ENTRY = "device_code_entry",
-    DEVICE_CODE_VERIFY = "device_code_verify",
-    DEVICE_AUTHORIZE = "device_authorize",
-    DEVICE_POLLING = "device_polling",
-    DEVICE_AUTHORIZED = "device_authorized",
-    DEVICE_DENIED = "device_denied",
-    SUCCESS = "success",
-    ERROR = "error",
-    CANCELLED = "cancelled"
-}
-/**
- * Flow state data that can be passed between steps
- */
-interface FlowState {
-    currentStep: FlowStep;
-    previousStep?: FlowStep;
-    user?: User;
-    session?: Session;
-    email?: string;
-    phone?: string;
-    username?: string;
-    token?: string;
-    mfaRequired?: boolean;
-    mfaMethods?: TwoFactorMethod[];
-    mfaToken?: string;
-    oauthProvider?: OAuthProvider;
-    oauthRedirectUrl?: string;
-    verificationRequired?: boolean;
-    verificationToken?: string;
-    verificationSent?: boolean;
-    deviceCode?: string;
-    userCode?: string;
-    verificationUri?: string;
-    verificationUriComplete?: string;
-    deviceCodeExpiresIn?: number;
-    devicePollingInterval?: number;
-    deviceClientId?: string;
-    deviceScopes?: string[];
-    deviceAuthorized?: boolean;
-    error?: AuthError;
-    metadata?: Record<string, unknown>;
-}
-/**
- * Flow transition result
- */
-interface FlowTransition {
-    nextStep: FlowStep;
-    state: Partial<FlowState>;
-}
-/**
- * Flow configuration for a specific authentication journey
- */
-interface FlowConfig {
-    name: string;
-    description?: string;
-    initialStep: FlowStep;
-    allowedSteps: FlowStep[];
-    transitions: {
-        [key in FlowStep]?: {
-            onSuccess?: FlowStep;
-            onError?: FlowStep;
-            onCancel?: FlowStep;
-            onBack?: FlowStep;
-            conditions?: Array<{
-                when: (state: FlowState) => boolean;
-                then: FlowStep;
-            }>;
-        };
-    };
-    onStepChange?: (step: FlowStep, state: FlowState) => void;
-    onComplete?: (user: User, session: Session) => void;
-    onError?: (error: AuthError, state: FlowState) => void;
-    onCancel?: (state: FlowState) => void;
-}
-/**
- * Predefined flow configurations
- */
-declare enum FlowConfigType {
-    SIMPLE_SIGN_IN = "simple_sign_in",
-    SIMPLE_SIGN_UP = "simple_sign_up",
-    SIGN_UP_WITH_EMAIL_VERIFICATION = "sign_up_with_email_verification",
-    SIGN_IN_WITH_MFA = "sign_in_with_mfa",
-    OAUTH_SIGN_IN = "oauth_sign_in",
-    MAGIC_LINK_FLOW = "magic_link_flow",
-    PHONE_AUTH_FLOW = "phone_auth_flow",
-    COMPLETE_SIGN_UP_FLOW = "complete_sign_up_flow",// signup → verify email → complete profile
-    SECURE_SIGN_IN_FLOW = "secure_sign_in_flow",// signin → MFA → success
-    PASSWORD_RESET_FLOW = "password_reset_flow",
-    EMAIL_VERIFICATION_FLOW = "email_verification_flow",
-    DEVICE_FLOW = "device_flow",
-    CUSTOM = "custom"
-}
-/**
- * Flow action types
- */
-declare enum FlowAction {
-    START = "start",
-    NEXT = "next",
-    BACK = "back",
-    CANCEL = "cancel",
-    ERROR = "error",
-    RESET = "reset"
-}
-/**
- * Flow event for state machine
- */
-interface FlowEvent {
-    action: FlowAction;
-    data?: Partial<FlowState>;
-    error?: AuthError;
-}
-
-/**
- * Authentication flow state machine engine
- */
-
-/**
- * Flow engine that manages authentication flow state transitions
- */
-declare class FlowEngine {
-    private config;
-    private state;
-    private history;
-    constructor(config: FlowConfig, initialState?: Partial<FlowState>);
+    listSessions(token: string): Promise<SessionListResponse>;
     /**
-     * Get current flow state
+     * Revoke session
+     * DELETE /v1/sessions/{sessionId}
      */
-    getState(): FlowState;
+    revokeSession(sessionId: string, body: RevokeSessionRequest, token: string): Promise<StatusResponse>;
     /**
-     * Get current step
+     * Sign in
+     * POST /v1/signin
      */
-    getCurrentStep(): FlowStep;
+    signIn(body: SignInRequest): Promise<AuthResponse>;
     /**
-     * Check if step is allowed in this flow
+     * Sign out
+     * POST /v1/signout
      */
-    isStepAllowed(step: FlowStep): boolean;
+    signOut(body: SignOutRequest, token: string): Promise<StatusResponse>;
     /**
-     * Transition to next step based on action
+     * Sign up
+     * POST /v1/signup
      */
-    transition(event: FlowEvent): Promise<FlowState>;
+    signUp(body: SignUpRequest): Promise<AuthResponse>;
     /**
-     * Start or restart the flow
+     * Start OAuth flow
+     * POST /v1/social/{provider}
      */
-    private handleStart;
+    startOAuth(provider: string, body: StartOAuthRequest): Promise<StartResponse>;
     /**
-     * Move to next step
+     * OAuth callback
+     * GET /v1/social/{provider}/callback
      */
-    private handleNext;
+    oauthCallback(provider: string): Promise<CallbackResponse>;
     /**
-     * Go back to previous step
+     * SSO SAML ACS endpoint
+     * POST /v1/sso/{provider}/acs
      */
-    private handleBack;
+    ssoACS(provider: string, body: SsoACSRequest): Promise<CallbackResponse>;
     /**
-     * Cancel the flow
+     * SSO callback (OIDC)
+     * POST /v1/sso/{provider}/callback
      */
-    private handleCancel;
+    ssoCallback(provider: string, body: SsoCallbackRequest): Promise<CallbackResponse>;
     /**
-     * Handle error in flow
+     * Start SSO login flow
+     * POST /v1/sso/{provider}/login
      */
-    private handleError;
+    startSSOLogin(provider: string, body: StartSSOLoginRequest): Promise<LoginResponse>;
+    /**
+     * List user roles
+     * GET /v1/users/{userId}/roles
+     */
+    authsomeListUserRoles(userId: string, token: string): Promise<UserRoleListResponse>;
     /**
-     * Reset flow to initial state
+     * Verify email
+     * POST /v1/verify-email
      */
-    private handleReset;
+    verifyEmail(body: VerifyEmailRequest): Promise<StatusResponse>;
     /**
-     * Move to a specific step
+     * List webhooks
+     * GET /v1/webhooks
      */
-    private moveToStep;
+    listWebhooks(token: string): Promise<WebhookListResponse>;
     /**
-     * Get flow history
+     * Create webhook
+     * POST /v1/webhooks
      */
-    getHistory(): FlowStep[];
+    createWebhook(body: CreateWebhookRequest, token: string): Promise<Webhook>;
     /**
-     * Check if can go back
+     * Get webhook
+     * GET /v1/webhooks/{webhookId}
      */
-    canGoBack(): boolean;
+    getWebhook(webhookId: string, token: string): Promise<Webhook>;
+    /**
+     * Update webhook
+     * PATCH /v1/webhooks/{webhookId}
+     */
+    updateWebhook(webhookId: string, body: UpdateWebhookRequest, token: string): Promise<Webhook>;
+    /**
+     * Delete webhook
+     * DELETE /v1/webhooks/{webhookId}
+     */
+    deleteWebhook(webhookId: string, body: DeleteWebhookRequest, token: string): Promise<StatusResponse>;
+    private request;
+}
+declare class AuthClientError extends Error {
+    code?: number;
+    constructor(message: string, code?: number);
 }
 
 /**
- * Predefined flow configurations
+ * AuthClient adapter — thin wrapper over the auto-generated API client.
+ *
+ * The generated client lives in ./generated/api-client.ts and covers all
+ * core + plugin endpoints.  This file extends it with a few convenience
+ * overrides so that auth.ts (and downstream consumers) keep working
+ * without changes.
  */
 
+/** Options for paginated list endpoints. */
+interface ListOptions {
+    limit?: number;
+    offset?: number;
+}
+/** Paginated list response. */
+interface ListResponse<T> {
+    items: T[];
+    total: number;
+}
 /**
- * Simple sign-in flow (email/password only)
- */
-declare const simpleSignInFlow: FlowConfig;
-/**
- * Sign-in with MFA support
- */
-declare const signInWithMFAFlow: FlowConfig;
-/**
- * Complete sign-up flow with email verification
- */
-declare const completeSignUpFlow: FlowConfig;
-/**
- * Magic link authentication flow
+ * AuthClient extends the auto-generated client with backward-compatible
+ * convenience methods that auth.ts depends on.
+ *
+ * All 80+ generated endpoints are inherited as-is.  Only two methods
+ * are overridden to preserve the simpler call-site signatures used by
+ * the auth state machine.
  */
-declare const magicLinkFlow: FlowConfig;
+declare class AuthClient extends AuthClient$1 {
+    /**
+     * Refresh session tokens.
+     *
+     * Accepts a raw refresh-token string (used by auth.ts) or the full
+     * RefreshRequest body.
+     */
+    refresh(body: {
+        refresh_token: string;
+    } | string): Promise<any>;
+    /**
+     * Sign out.
+     *
+     * Accepts a raw token string (used by auth.ts) or the full
+     * (body, token) pair from the generated client.
+     */
+    signOut(bodyOrToken: unknown, token?: string): Promise<any>;
+    /**
+     * MFA challenge — bridge for auth.ts.
+     *
+     * auth.ts calls `mfaChallenge({ enrollment_id, code })` and expects
+     * an AuthResponse back.  The generated client uses `challengeMFA`.
+     */
+    mfaChallenge(body: {
+        enrollment_id?: string;
+        code: string;
+    }): Promise<any>;
+    /**
+     * Verify an MFA recovery code.
+     *
+     * Accepts a raw code string (used by auth.ts) or the full request body.
+     */
+    verifyRecoveryCode(body: {
+        code: string;
+    } | string): Promise<any>;
+    /**
+     * Send an SMS code for MFA — bridge for auth.ts.
+     *
+     * Simplifies the call-site by accepting just the session token.
+     */
+    sendSMSCodeForMFA(token: string): Promise<any>;
+    /**
+     * Verify an SMS code for MFA — bridge for auth.ts.
+     *
+     * Simplifies the call-site by accepting code + token directly.
+     */
+    verifySMSCodeForMFA(code: string, token: string): Promise<any>;
+    /**
+     * Fetch the client configuration from the backend.
+     *
+     * The config describes which auth methods are enabled so SDK
+     * components can auto-configure without manual props.
+     */
+    fetchClientConfig(publishableKey?: string): Promise<ClientConfig>;
+}
+
 /**
- * Phone authentication flow
+ * Framework-agnostic authentication state machine.
+ *
+ * Manages sign-in/sign-up flows, token persistence, automatic refresh,
+ * and MFA challenges. Framework adapters (React, Vue, etc.) wrap this
+ * class and expose reactive state.
  */
-declare const phoneAuthFlow: FlowConfig;
+
 /**
- * OAuth sign-in flow
+ * AuthManager is the core state machine that drives authentication.
+ *
+ * Usage:
+ * ```ts
+ * const auth = new AuthManager({ baseURL: "https://api.example.com" });
+ * auth.subscribe((state) => console.log(state));
+ * await auth.initialize(); // hydrate from storage
+ * await auth.signIn({ email, password });
+ * ```
  */
-declare const oauthSignInFlow: FlowConfig;
+declare class AuthManager {
+    private client;
+    private storage;
+    private state;
+    private listeners;
+    private refreshTimer;
+    private onError?;
+    private publishableKey?;
+    private clientConfig;
+    private configListeners;
+    private configFetchPromise;
+    constructor(config: AuthConfig);
+    /** Current auth state (snapshot). */
+    getState(): AuthState;
+    /** Subscribe to state changes. Returns an unsubscribe function. */
+    subscribe(listener: (state: AuthState) => void): () => void;
+    /** Access the underlying HTTP client. */
+    getClient(): AuthClient;
+    /**
+     * Initialize by hydrating the session from storage.
+     * When a publishableKey is set, also fetches client config in parallel.
+     * Call this once on app start.
+     */
+    initialize(): Promise<void>;
+    /** Sign in with email & password. */
+    signIn(credentials: SignInRequest): Promise<void>;
+    /** Sign up with email & password. */
+    signUp(data: SignUpRequest): Promise<void>;
+    /** Sign out and clear the session. */
+    signOut(): Promise<void>;
+    /** Submit an MFA challenge code. */
+    submitMFACode(enrollmentId: string, code: string): Promise<void>;
+    /** Submit an MFA recovery code. */
+    submitRecoveryCode(code: string): Promise<void>;
+    /** Send an SMS code for MFA verification. Returns masked phone + expiry info. */
+    sendSMSCode(): Promise<{
+        sent: boolean;
+        phone_masked: string;
+        expires_in_seconds: number;
+    }>;
+    /** Submit an SMS verification code during MFA challenge. */
+    submitSMSCode(code: string): Promise<void>;
+    /** Refresh the current session manually. */
+    refreshNow(): Promise<void>;
+    /** Get the current session token (if authenticated). */
+    getSessionToken(): string | null;
+    /** Get the current user (if authenticated). */
+    getUser(): User | null;
+    /** Get the cached client config (or null if not yet fetched). */
+    getClientConfig(): ClientConfig | null;
+    /** Subscribe to client config changes. Returns an unsubscribe function. */
+    subscribeConfig(listener: (config: ClientConfig | null) => void): () => void;
+    /**
+     * Fetch client config from the backend.
+     * Deduplicates concurrent calls and caches the result with a TTL.
+     */
+    fetchClientConfig(): Promise<ClientConfig>;
+    /** Tear down: clear timers and listeners. */
+    destroy(): void;
+    private handleAuthResponse;
+    private refreshSession;
+    private scheduleRefresh;
+    private clearRefreshTimer;
+    private persistSession;
+    private clearSession;
+    private setClientConfig;
+    private setState;
+    private handleError;
+}
+
 /**
- * Password reset flow
+ * WebAuthn encoding helpers.
+ *
+ * The go-webauthn backend serialises binary fields (challenge, user.id,
+ * credential IDs, …) as **base64url strings** in JSON.  The browser
+ * WebAuthn API requires those same fields as ArrayBuffer / Uint8Array.
+ *
+ * These helpers bridge the gap in both directions:
+ *   begin response  → browser API  (base64url string → ArrayBuffer)
+ *   browser API     → finish POST  (ArrayBuffer → base64url string)
  */
-declare const passwordResetFlow: FlowConfig;
+/** Decode a base64url-encoded string into a Uint8Array. */
+declare function base64urlToBuffer(base64url: string): Uint8Array;
+/** Encode an ArrayBuffer (or Uint8Array) to a base64url string (no padding). */
+declare function bufferToBase64url(buffer: ArrayBuffer | Uint8Array): string;
 /**
- * Email verification flow
+ * Prepare the options object returned by `/passkeys/register/begin`
+ * for `navigator.credentials.create({ publicKey })`.
+ *
+ * Converts base64url strings → Uint8Array for:
+ *   challenge, user.id, excludeCredentials[].id
  */
-declare const emailVerificationFlow: FlowConfig;
+declare function prepareCreationOptions(options: Record<string, unknown>): PublicKeyCredentialCreationOptions;
 /**
- * Get predefined flow configuration by type
+ * Prepare the options object returned by `/passkeys/login/begin`
+ * for `navigator.credentials.get({ publicKey })`.
+ *
+ * Converts base64url strings → Uint8Array for:
+ *   challenge, allowCredentials[].id
  */
-declare function getFlowConfig(type: FlowConfigType): FlowConfig;
+declare function prepareRequestOptions(options: Record<string, unknown>): PublicKeyCredentialRequestOptions;
 /**
- * Export all predefined flows
+ * Serialize a PublicKeyCredential returned by navigator.credentials
+ * into a plain object suitable for POSTing to the `/finish` endpoint.
+ *
+ * Converts ArrayBuffer fields → base64url strings so they survive
+ * JSON.stringify and match what go-webauthn expects.
  */
-declare const predefinedFlows: {
-    simple_sign_in: FlowConfig;
-    sign_in_with_mfa: FlowConfig;
-    complete_sign_up_flow: FlowConfig;
-    magic_link_flow: FlowConfig;
-    phone_auth_flow: FlowConfig;
-    oauth_sign_in: FlowConfig;
-    password_reset_flow: FlowConfig;
-    email_verification_flow: FlowConfig;
-    device_flow: FlowConfig;
-};
+declare function serializeCredential(credential: Credential): Record<string, unknown>;
 
-export { AuthClient, type AuthClientConfig, AuthContext, AuthError, AuthErrorType, type AuthLocale, AuthProvider, CookieData, type DeepPartial, FlowAction, type FlowConfig, FlowConfigType, FlowEngine, type FlowEvent, type FlowState, FlowStep, type FlowTransition, MagicLinkRequest, MagicLinkVerifyRequest, OAuthCallbackRequest, OAuthProvider, OAuthSignInRequest, Observable, Organization, OrganizationMembership, PasskeyAuthRequest, PasskeyCredential, PasskeyRegisterRequest, PasswordChangeRequest, PasswordResetConfirmRequest, PasswordResetRequest, PhoneAuthRequest, PhoneVerifyRequest, Session, SignInRequest, SignUpRequest, Storage, TokenManager, TwoFactorMethod, TwoFactorSetupRequest, TwoFactorSetupResponse, TwoFactorVerifyRequest, Unsubscribe, UpdateUserRequest, User, ValidationError, completeSignUpFlow, createAuthError, createLocale, defaultLocale, emailVerificationFlow, extractCookiesFromHeaders, getFlowConfig, interpolate, isAuthError, isMFARequiredError, isNetworkError, isUnauthenticatedError, magicLinkFlow, oauthSignInFlow, parseCookie, parseCookieOptions, passwordResetFlow, phoneAuthFlow, predefinedFlows, serializeCookie, serializeCookies, signInWithMFAFlow, simpleSignInFlow, toAuthError, validate2FACode, validateEmail, validatePassword, validatePhone, validateRequired, validateUsername };
+export { type APIError, type KeyListItem as APIKey, type AddMemberRequest, type AdminBanUserRequest, AuthClient, type AuthClientConfig, AuthClientError, type AuthConfig, AuthManager, type AuthResponse, type AuthState, type ChallengeMFARequest, type ChangePasswordRequest, type ClientConfig, type CreateAPIKeyRequest, type CreateInvitationRequest, type CreateOrganizationRequest as CreateOrgRequest, type CreateOrganizationRequest, type Device, type EnrollMFARequest, type EnrollResponse, type ForgotPasswordRequest, type Invitation, type KeyListItem, type ListOptions, type ListResponse, type EnrollResponse as MFAEnrollment, type SendMagicLinkRequest as MagicLinkSendRequest, type VerifyMagicLinkRequest as MagicLinkVerifyRequest, type Member, type ChallengeMFARequest as MfaChallengeRequest, type EnrollMFARequest as MfaEnrollRequest, type SendSMSCodeRequest as MfaSMSSendRequest, type VerifySMSCodeRequest as MfaSMSVerifyRequest, type VerifyMFARequest as MfaVerifyRequest, type Organization, type RefreshRequest, type ResetPasswordRequest, type SSOConnectionConfig, type SendMagicLinkRequest, type SendSMSCodeRequest, type Session, type SignInRequest, type SignUpRequest, type SignupFieldConfig, type SignupFieldOption, type SignupFieldValidation, type SocialProviderConfig, type SsoACSRequest, type SsoCallbackRequest, type TokenResponse, type TokenStorage, type UpdateMeRequest, type UpdateOrganizationRequest as UpdateOrgRequest, type UpdateOrganizationRequest, type User, type VerifyEmailRequest, type VerifyMFARequest, type VerifyMagicLinkRequest, type VerifyRecoveryCodeRequest, type VerifySMSCodeRequest, base64urlToBuffer, bufferToBase64url, prepareCreationOptions, prepareRequestOptions, serializeCredential };