@authsome/ui-core 1.3.1 → 1.4.2

package/dist/index.d.ts

@@ -3,12 +3,99 @@ interface ACSRequest {
     RelayState: string;
     SAMLResponse: string;
 }
+interface AdminAppResponse {
+    id: string;
+    is_platform: boolean;
+    logo?: string;
+    name: string;
+    publishable_key?: string;
+    slug: string;
+}
+interface AdminCatalogProvider {
+    id: string;
+    name: string;
+}
+interface AdminCatalogResponse {
+    providers: AdminCatalogProvider[];
+}
+interface AdminCreateConnectionResponse {
+    active: boolean;
+    app_id: string;
+    domain: string;
+    id: string;
+    protocol: string;
+    provider: string;
+}
+interface AdminDeleteAppRequest {
+    AppID: string;
+}
+interface AdminDeleteConnectionResponse {
+    status: string;
+}
+interface AdminDeleteProviderResponse {
+    status: string;
+}
+interface AdminDeleteServiceAccountRequest {
+    ServiceAccountID: string;
+}
 interface AdminDeleteUserRequest {
     UserID: string;
 }
 interface AdminImpersonateRequest {
     UserID: string;
 }
+interface AdminListConnectionsResponse {
+    connections: Connection[];
+}
+interface AdminListProvidersResponse {
+    providers: AdminProvider[];
+}
+interface AdminPlatformOwnerResponse {
+    role_id: string;
+    status: string;
+    user_id: string;
+}
+interface AdminProvider {
+    client_id: string;
+    client_secret?: string;
+    enabled: boolean;
+    has_secret: boolean;
+    name: string;
+    redirect_url?: string;
+    scopes?: string[];
+}
+interface AdminProviderResponse {
+    provider: AdminProvider;
+}
+interface AdminRevokePlatformOwnerRequest {
+    UserID: string;
+}
+interface AdminServiceAccountAPIKeyResponse {
+    created_at: string;
+    expires_at?: string;
+    id: string;
+    key: string;
+    key_prefix: string;
+    name: string;
+    public_key?: string;
+    public_key_prefix?: string;
+    scopes?: string[];
+}
+interface AdminServiceAccountListResponse {
+    next_cursor?: string;
+    service_accounts: AdminServiceAccountResponse[];
+    total: number;
+}
+interface AdminServiceAccountResponse {
+    active: boolean;
+    app_id: string;
+    created_at: string;
+    description?: string;
+    id: string;
+    name: string;
+    scopes?: string[];
+    updated_at: string;
+}
 interface AdminStatsResponse {
     total_users: number;
 }
@@ -65,17 +152,37 @@ interface CallbackResponse {
     session_token: string;
     user: User;
 }
+interface CancelSubscriptionRequest {
+    SubID: string;
+    immediately: boolean;
+}
 interface ChallengeRequest {
     code: string;
+    mfa_ticket: string;
 }
 interface ChallengeResponse {
-    challenge_passed: boolean;
-    method: string;
+    expires_at: string;
+    refresh_token: string;
+    session_token: string;
+    user: unknown;
+}
+interface ChangePlanRequest {
+    SubID: string;
+    new_plan_id: string;
 }
 interface ClientConfigBranding {
     app_name?: string;
     logo_url?: string;
 }
+interface ClientConfigCaptcha {
+    provider?: string;
+    required: boolean;
+    site_key?: string;
+}
+interface ClientConfigEmailVerification {
+    enabled: boolean;
+    required: boolean;
+}
 interface ClientConfigFieldValidation {
     max?: number;
     max_len?: number;
@@ -87,19 +194,25 @@ interface ClientConfigFieldValidation {
 interface ClientConfigMFA {
     enabled: boolean;
     methods: string[];
+    required: boolean;
 }
 interface ClientConfigResponse {
     app_id: string;
     branding?: ClientConfigBranding;
+    captcha?: ClientConfigCaptcha;
+    device_authorization?: ClientConfigToggle;
+    email_verification?: ClientConfigEmailVerification;
     magiclink?: ClientConfigToggle;
     mfa?: ClientConfigMFA;
     passkey?: ClientConfigToggle;
     password?: ClientConfigToggle;
+    signup_enabled: boolean;
     signup_fields?: ClientConfigSignupField[];
     social?: ClientConfigSocial;
     sso?: ClientConfigSSO;
     supported_plugins: string[];
     version: string;
+    waitlist?: ClientConfigToggle;
 }
 interface ClientConfigSSO {
     connections: ClientConfigSSOConnection[];
@@ -151,12 +264,79 @@ interface Config {
     magic_link_enabled?: boolean;
     mfa_enabled?: boolean;
     mfa_methods?: string[];
+    mfa_required?: boolean;
     passkey_enabled?: boolean;
     password_enabled?: boolean;
+    require_email_verification?: boolean;
+    signup_enabled?: boolean;
     social_enabled?: boolean;
     social_providers?: string[];
     sso_enabled?: boolean;
     updated_at: string;
+    waitlist_enabled?: boolean;
+}
+interface Connection {
+    active: boolean;
+    app_id: string;
+    client_id?: string;
+    created_at: string;
+    domain: string;
+    id: string;
+    issuer?: string;
+    metadata_url?: string;
+    org_id?: string;
+    protocol: string;
+    provider: string;
+    updated_at: string;
+}
+interface Consent {
+    app_id: string;
+    created_at: string;
+    granted: boolean;
+    granted_at: string;
+    id: string;
+    ip_address: string;
+    purpose: string;
+    revoked_at?: string;
+    updated_at: string;
+    user_id: string;
+    version: string;
+}
+interface CouponResponse {
+    amount?: string;
+    app_id: string;
+    code: string;
+    currency: string;
+    id: string;
+    max_redemptions: number;
+    name: string;
+    percentage?: number;
+    times_redeemed: number;
+    type: string;
+    valid_from?: string;
+    valid_until?: string;
+}
+interface CreateClientResponse {
+    client_id: string;
+    client_secret?: string;
+    grant_types: string[];
+    id: string;
+    name: string;
+    public: boolean;
+    redirect_uris: string[];
+    scopes: string[];
+}
+interface CreateCouponRequest {
+    amount: number;
+    app_id: string;
+    code: string;
+    currency: string;
+    max_redemptions: number;
+    name: string;
+    percentage: number;
+    type: string;
+    valid_from?: string;
+    valid_until?: string;
 }
 interface CreateKeyRequest {
     app_id: string;
@@ -175,11 +355,23 @@ interface CreateKeyResponse {
     public_key_prefix: string;
     scopes?: string[];
 }
-interface CredentialInfo {
-    created_at: string;
-    display_name: string;
-    id: string;
-    transport: string[];
+interface CreatePlanRequest {
+    app_id: string;
+    base_amount: number;
+    currency: string;
+    description: string;
+    features?: FeatureInput[];
+    is_addon: boolean;
+    metadata?: Record<string, unknown>;
+    name: string;
+    period: string;
+    slug: string;
+    trial_days: number;
+}
+interface CreateSubscriptionRequest {
+    app_id: string;
+    plan_id: string;
+    tenant_id: string;
 }
 interface Definition {
     category: string;
@@ -207,6 +399,12 @@ interface DeleteAppClientConfigRequest {
 interface DeleteAppSessionConfigRequest {
     AppID: string;
 }
+interface DeleteClientRequest {
+    ClientID: string;
+}
+interface DeleteCouponRequest {
+    CouponID: string;
+}
 interface DeleteDeviceRequest {
     DeviceID: string;
 }
@@ -248,6 +446,25 @@ interface Device {
     updated_at: string;
     user_id: string;
 }
+interface DeviceAuthRequest {
+    client_id: string;
+    scope?: string;
+}
+interface DeviceAuthResponse {
+    device_code: string;
+    expires_in: number;
+    interval: number;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+}
+interface DeviceCompleteRequest {
+    action: string;
+    user_code: string;
+}
+interface DeviceCompleteResponse {
+    status: string;
+}
 interface DeviceListResponse {
     devices: Device[];
 }
@@ -256,6 +473,27 @@ interface DisableRequest {
 interface DisableResponse {
     status: string;
 }
+interface DiscoveryResponse {
+    authorization_endpoint: string;
+    code_challenge_methods_supported: string[];
+    device_authorization_endpoint: string;
+    grant_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+    issuer: string;
+    jwks_uri: string;
+    response_types_supported: string[];
+    revocation_endpoint: string;
+    scopes_supported: string[];
+    subject_types_supported: string[];
+    token_endpoint: string;
+    token_endpoint_auth_methods_supported: string[];
+    userinfo_endpoint: string;
+}
+interface Email {
+    primary: boolean;
+    type?: string;
+    value: string;
+}
 interface EnrollRequest {
     method?: string;
     phone?: string;
@@ -266,6 +504,14 @@ interface EnrollResponse {
     otpauth_url: string;
     secret: string;
 }
+interface EntitlementResponse {
+    allowed: boolean;
+    feature: string;
+    limit: number;
+    reason?: string;
+    remaining: number;
+    used: number;
+}
 interface Environment {
     app_id: string;
     cloned_from?: string;
@@ -290,13 +536,51 @@ interface EnvironmentSettingsResponse {
     settings?: Settings;
     type_defaults?: Settings;
 }
+interface FeatureInput {
+    key: string;
+    limit: number;
+    name: string;
+    period: string;
+    soft_limit: boolean;
+    type: string;
+}
 interface ForgotPasswordResponse {
     status: string;
 }
+interface GroupRef {
+    $ref?: string;
+    display?: string;
+    value: string;
+}
+interface GroupResource {
+    displayName: string;
+    externalId?: string;
+    id?: string;
+    members?: MemberRef[];
+    meta?: Meta;
+    schemas: string[];
+}
 interface HealthResponse {
     error?: string;
     status: string;
 }
+interface IntrospectResponse {
+    active: boolean;
+    app_id?: string;
+    env_id?: string;
+    expires_at?: string;
+    org_id?: string;
+    session_id?: string;
+    user?: IntrospectUser;
+    user_id?: string;
+}
+interface IntrospectUser {
+    email: string;
+    first_name?: string;
+    id: string;
+    last_name?: string;
+    username?: string;
+}
 interface Invitation {
     created_at: string;
     email: string;
@@ -310,6 +594,16 @@ interface Invitation {
 interface InvitationListResponse {
     invitations: Invitation[];
 }
+interface InvoiceResponse {
+    currency: string;
+    id: string;
+    period_end: string;
+    period_start: string;
+    status: string;
+    subscription_id: string;
+    tenant_id: string;
+    total: string;
+}
 interface KeyListItem {
     created_at: string;
     expires_at?: string;
@@ -324,16 +618,36 @@ interface KeyListItem {
 interface ListAuthMethodsResponse {
     methods: AuthMethod[];
 }
+interface ListClientsResponse {
+    clients: OAuth2Client[];
+}
+interface ListCouponsResponse {
+    coupons: CouponResponse[];
+    total: number;
+}
 interface ListDefinitionsResponse {
     groups: DefinitionGroup[];
     total: number;
 }
+interface ListInvoicesResponse {
+    invoices: InvoiceResponse[];
+    total: number;
+}
 interface ListKeysResponse {
     keys: KeyListItem[];
     total: number;
 }
+interface ListPlansResponse {
+    plans: PlanResponse[];
+    total: number;
+}
 interface ListResponse$1 {
-    credentials: CredentialInfo[];
+    consents: Consent[];
+    next_cursor?: string;
+}
+interface ListSubscriptionsResponse {
+    subscriptions: Response[];
+    total: number;
 }
 interface LoginBeginRequest {
     email?: string;
@@ -354,6 +668,10 @@ interface LoginResponse {
     login_url: string;
     state: string;
 }
+interface MarkInvoicePaidRequest {
+    InvoiceID: string;
+    payment_ref: string;
+}
 interface Member {
     created_at: string;
     id: string;
@@ -365,6 +683,36 @@ interface Member {
 interface MemberListResponse {
     members: Member[];
 }
+interface MemberRef {
+    $ref?: string;
+    display?: string;
+    value: string;
+}
+interface Meta {
+    created?: string;
+    lastModified?: string;
+    location?: string;
+    resourceType: string;
+}
+interface Name {
+    familyName: string;
+    formatted?: string;
+    givenName: string;
+}
+interface OAuth2Client {
+    app_id: string;
+    client_id: string;
+    created_at: string;
+    grant_types: string[];
+    id: string;
+    name: string;
+    public: boolean;
+    redirect_uris: string[];
+    scopes: string[];
+    updated_at: string;
+}
+interface Object$1 {
+}
 interface ObjectFieldDef {
     display_name: string;
     help_text?: string;
@@ -399,6 +747,24 @@ interface Permission {
 interface PermissionListResponse {
     permissions: Permission[];
 }
+interface PlanIDRequest {
+    PlanID: string;
+}
+interface PlanResponse {
+    app_id: string;
+    base_amount?: string;
+    billing_period?: string;
+    currency: string;
+    description: string;
+    features_count: number;
+    id: string;
+    is_addon: boolean;
+    metadata?: Record<string, unknown>;
+    name: string;
+    slug: string;
+    status: string;
+    trial_days: number;
+}
 interface RecoveryRegenerateRequest {
 }
 interface RecoveryRegenerateResponse {
@@ -441,9 +807,25 @@ interface ResolvedSettingResponse {
 interface ResolvedSettingsResponse {
     settings: ResolvedSetting[];
 }
+interface Response {
+    app_id: string;
+    canceled_at?: string;
+    current_period_end: string;
+    current_period_start: string;
+    id: string;
+    plan_id: string;
+    status: string;
+    tenant_id: string;
+    trial_end?: string;
+    trial_start?: string;
+}
 interface RevokeKeyRequest {
     KeyID: string;
 }
+interface RevokeRequest {
+    token: string;
+    token_type_hint?: string;
+}
 interface RevokeSessionRequest {
     SessionID: string;
 }
@@ -528,14 +910,23 @@ interface SlugAvailableResponse {
     available: boolean;
 }
 interface StartRequest {
-    Provider: string;
+    app_id?: string;
+    phone: string;
 }
 interface StartResponse {
-    auth_url: string;
+    expires_in: number;
+    status: string;
 }
 interface StatusResponse {
     status: string;
 }
+interface SubIDRequest {
+    SubID: string;
+}
+interface SwitchOrgResponse {
+    org_id?: string;
+    session_id: string;
+}
 interface Team {
     created_at: string;
     id: string;
@@ -547,10 +938,21 @@ interface Team {
 interface TeamListResponse {
     teams: Team[];
 }
+interface TokenRequest {
+    client_id?: string;
+    client_secret?: string;
+    code?: string;
+    code_verifier?: string;
+    device_code?: string;
+    grant_type: string;
+    redirect_uri?: string;
+}
 interface TokenResponse {
-    expires_at: string;
-    refresh_token: string;
-    session_token: string;
+    access_token: string;
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+    token_type: string;
 }
 interface TrustDeviceRequest {
     DeviceID: string;
@@ -578,6 +980,18 @@ interface UnlinkAuthMethodRequest {
 interface UnlinkAuthMethodResponse {
     status: string;
 }
+interface UsageItemResponse {
+    feature_key: string;
+    feature_name: string;
+    feature_type: string;
+    limit: number;
+    period: string;
+    remaining: number;
+    used: number;
+}
+interface UsageSummaryResponse {
+    usage: UsageItemResponse[];
+}
 interface User {
     app_id: string;
     ban_expires?: string;
@@ -600,6 +1014,24 @@ interface User {
     updated_at: string;
     username?: string;
 }
+interface UserInfo {
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    phone_number?: string;
+    sub: string;
+}
+interface UserResource {
+    active: boolean;
+    emails?: Email[];
+    externalId?: string;
+    groups?: GroupRef[];
+    id?: string;
+    meta?: Meta;
+    name: Name;
+    schemas: string[];
+    userName: string;
+}
 interface UserRoleListResponse {
     roles: Role[];
 }
@@ -621,19 +1053,25 @@ interface VerifyMFAResponse {
 }
 interface VerifyRequest {
     app_id?: string;
-    token: string;
+    code: string;
+    phone: string;
 }
 interface VerifyResponse {
     expires_at: string;
+    new_user: boolean;
     refresh_token: string;
     session_token: string;
-    user: User;
+    user?: User;
 }
 interface VisibilityCondition {
     key: string;
     operator?: string;
     value: string;
 }
+interface VoidInvoiceRequest {
+    InvoiceID: string;
+    reason: string;
+}
 interface Webhook {
     active: boolean;
     app_id: string;
@@ -647,17 +1085,40 @@ interface Webhook {
 interface WebhookListResponse {
     webhooks: Webhook[];
 }
+interface scimGroupPathParam {
+    GroupID: string;
+}
+interface scimUserPathParam {
+    UserID: string;
+}
+type ScimCreateGroupRequest = Object$1;
+type ScimReplaceGroupRequest = scimGroupPathParam;
+type ScimPatchGroupRequest = scimGroupPathParam;
+type ScimDeleteGroupRequest = scimGroupPathParam;
+type ScimCreateUserRequest = Object$1;
+type ScimReplaceUserRequest = scimUserPathParam;
+type ScimPatchUserRequest = scimUserPathParam;
+type ScimDeleteUserRequest = scimUserPathParam;
+type AdminCreateAppRequest = {
+    logo?: string;
+    name: string;
+    slug: string;
+};
 type SetAppClientConfigRequest = {
     app_name?: string;
     logo_url?: string;
     magic_link_enabled?: boolean;
     mfa_enabled?: boolean;
     mfa_methods?: string[];
+    mfa_required?: boolean;
     passkey_enabled?: boolean;
     password_enabled?: boolean;
+    require_email_verification?: boolean;
+    signup_enabled?: boolean;
     social_enabled?: boolean;
     social_providers?: string[];
     sso_enabled?: boolean;
+    waitlist_enabled?: boolean;
 };
 type SetAppSessionConfigRequest = {
     bind_to_device?: boolean;
@@ -673,6 +1134,30 @@ type AdminBulkImportUsersRequest = {
     app_id?: string;
     users: Record<string, unknown>[];
 };
+type CreateOAuth2ClientRequest = {
+    app_id: string;
+    grant_types?: string[];
+    name: string;
+    public?: boolean;
+    redirect_uris: string[];
+    scopes?: string[];
+};
+type DeleteOAuth2ClientRequest = DeleteClientRequest;
+type AdminGrantPlatformOwnerRequest = {
+    email?: string;
+    user_id?: string;
+};
+type AdminCreateServiceAccountRequest = {
+    app_id?: string;
+    description?: string;
+    name: string;
+    scopes?: string[];
+};
+type AdminCreateServiceAccountAPIKeyRequest = {
+    expires_at?: string;
+    name: string;
+    scopes?: string[];
+};
 type EnforceSettingRequest = {
     app_id?: string;
     org_id?: string;
@@ -687,14 +1172,70 @@ type SetSettingRequest = {
     scope_id?: string;
     value: string;
 };
+type SocialAdminUpsertProviderRequest = {
+    client_id: string;
+    client_secret: string;
+    enabled?: boolean;
+    redirect_url?: string;
+    scopes?: string[];
+};
+type SsoAdminCreateConnectionRequest = {
+    app_id: string;
+    client_id?: string;
+    client_secret?: string;
+    domain: string;
+    issuer?: string;
+    metadata_url?: string;
+    org_id?: string;
+    protocol: string;
+    provider: string;
+};
+type SsoAdminUpdateConnectionRequest = {
+    active?: boolean;
+    client_id?: string;
+    client_secret?: string;
+    domain?: string;
+    issuer?: string;
+    metadata_url?: string;
+    provider?: string;
+};
+type AdminCreateUserRequest = {
+    app_id?: string;
+    email: string;
+    first_name?: string;
+    last_name?: string;
+    password: string;
+    username?: string;
+};
+type AdminUpdateUserRequest = {
+    email_verified?: boolean;
+    first_name?: string;
+    last_name?: string;
+    username?: string;
+};
 type AdminBanUserRequest = {
     expires_at?: string;
     reason?: string;
 };
+type CreateBillingPlanRequest = CreatePlanRequest;
+type ActivateBillingPlanRequest = PlanIDRequest;
+type ArchiveBillingPlanRequest = PlanIDRequest;
+type ChangeSubscriptionPlanRequest = ChangePlanRequest;
+type PauseSubscriptionRequest = SubIDRequest;
+type ResumeSubscriptionRequest = SubIDRequest;
 type ChangePasswordRequest = {
     current_password: string;
     new_password: string;
 };
+type GrantConsentRequest = {
+    app_id?: string;
+    purpose: string;
+    version?: string;
+};
+type RevokeConsentRequest = {
+    app_id?: string;
+    purpose: string;
+};
 type CreateEnvironmentRequest = {
     app_id?: string;
     color?: string;
@@ -737,6 +1278,9 @@ type ForgotPasswordRequest = {
     app_id?: string;
     email: string;
 };
+type IntrospectTokenRequest = {
+    token: string;
+};
 type CreateAPIKeyRequest = CreateKeyRequest;
 type RevokeAPIKeyRequest = RevokeKeyRequest;
 type SendMagicLinkRequest = SendRequest;
@@ -748,6 +1292,9 @@ type UpdateMeRequest = {
     username?: string;
 };
 type DeleteMeRequest = DeleteAccountRequest;
+type SwitchOrgRequest = {
+    org_id: string;
+};
 type ChallengeMFARequest = ChallengeRequest;
 type EnrollMFARequest = EnrollRequest;
 type DisableMFARequest = DisableRequest;
@@ -755,6 +1302,10 @@ type RegenerateMFARecoveryCodesRequest = RecoveryRegenerateRequest;
 type VerifyRecoveryCodeRequest = RecoveryVerifyRequest;
 type SendSMSCodeRequest = SMSSendRequest;
 type VerifySMSCodeRequest = SMSVerifyRequest;
+type Oauth2DeviceAuthorizeRequest = DeviceAuthRequest;
+type Oauth2DeviceCompleteRequest = DeviceCompleteRequest;
+type Oauth2RevokeRequest = RevokeRequest;
+type Oauth2TokenRequest = TokenRequest;
 type CreateOrganizationRequest = {
     app_id?: string;
     logo?: string;
@@ -796,6 +1347,8 @@ type PasskeyLoginFinishRequest = LoginFinishRequest;
 type PasskeyRegisterBeginRequest = RegisterBeginRequest;
 type PasskeyRegisterFinishRequest = RegisterFinishRequest;
 type DeletePasskeyRequest = DeleteRequest;
+type PhoneAuthStartRequest = StartRequest;
+type PhoneAuthVerifyRequest = VerifyRequest;
 type RefreshRequest = {
     refresh_token: string;
 };
@@ -828,12 +1381,14 @@ type AuthsomeUnassignRoleRequest = {
 };
 type SignInRequest = {
     app_id?: string;
+    captcha_token?: string;
     email?: string;
     password: string;
     username?: string;
 };
 type SignUpRequest = {
     app_id?: string;
+    captcha_token?: string;
     email: string;
     first_name?: string;
     last_name?: string;
@@ -848,6 +1403,10 @@ type StartSSOLoginRequest = LoginRequest;
 type VerifyEmailRequest = {
     token: string;
 };
+type ResendEmailVerificationRequest = {
+    app_id?: string;
+    email: string;
+};
 type CreateWebhookRequest = {
     app_id?: string;
     events: string[];
@@ -870,6 +1429,12 @@ interface Session {
 interface APIError {
     error: string;
     code?: number;
+    /**
+     * Machine-readable error type set by the backend (e.g. "email_not_verified").
+     * Currently not part of the OpenAPI spec, so it's parsed manually from the
+     * error response body in the generated client's request helper.
+     */
+    type?: string;
 }
 /** Authentication state. */
 type AuthState = {
@@ -882,9 +1447,43 @@ type AuthState = {
     session: Session;
 } | {
     status: "unauthenticated";
-} | {
+}
+/**
+ * Sign-in returned the MFA gate (HTTP 403 with type:"mfa_required").
+ * The user must complete the second factor against the same ticket
+ * via AuthManager.submitMFAChallenge(code) — the ticket is single-
+ * use after a correct code and expires after 5 minutes server-side.
+ *
+ * `email` is preserved so the form can show "complete sign-in for
+ * <email>" and so AuthManager.signIn(...) can be retried fully.
+ *
+ * `availableMethods` is what the backend reports as enrolled and
+ * ready to validate — typically ["totp"] today.
+ */
+ | {
     status: "mfa_required";
-    session: Session;
+    email: string;
+    mfaTicket: string;
+    availableMethods: string[];
+}
+/**
+ * Returned when a sign-in attempt is rejected because the user's email
+ * has not yet been verified, or when sign-up succeeded with email
+ * verification required. The `email` is preserved so a "resend" CTA can
+ * target the same account.
+ */
+ | {
+    status: "email_not_verified";
+    email: string;
+}
+/**
+ * Sign-up succeeded but the account requires email verification before
+ * sign-in works. The session token returned by the API in this state is
+ * non-functional and is intentionally discarded.
+ */
+ | {
+    status: "verification_pending";
+    email: string;
 } | {
     status: "error";
     error: string;
@@ -993,6 +1592,12 @@ interface ClientConfig {
     device_authorization?: {
         enabled: boolean;
     };
+    /** Captcha challenge (e.g. Cloudflare Turnstile). */
+    captcha?: {
+        required: boolean;
+        provider?: string;
+        site_key?: string;
+    };
 }
 /** Interface for persisting tokens across sessions. */
 interface TokenStorage {
@@ -1004,16 +1609,31 @@ interface TokenStorage {
 interface AuthClientConfig {
     /** Base URL of the AuthSome API (e.g., "https://api.example.com") */
     baseURL: string;
+    /**
+     * Publishable key (`pk_live_*` / `pk_test_*` / `pk_stg_*`) sent on every
+     * request as the X-Publishable-Key header. The server resolves this to
+     * the owning App on the public-auth path (signup, signin, forgot-
+     * password, resend-verification), so frontends never need to know — or
+     * send — the App's UUID. Without it, those endpoints reject with 400
+     * "app context required".
+     */
+    publishableKey?: string;
     /** Optional custom fetch implementation */
     fetch?: typeof globalThis.fetch;
 }
 declare class AuthClient$1 {
     private baseURL;
+    private publishableKey;
     private fetchFn;
     constructor(config: AuthClientConfig | Pick<{
         baseURL: string;
+        publishableKey?: string;
         fetch?: typeof globalThis.fetch;
-    }, 'baseURL' | 'fetch'>);
+    }, 'baseURL' | 'publishableKey' | 'fetch'>);
+    /** Set the publishable key sent on every request as X-Publishable-Key. */
+    setPublishableKey(key: string | undefined): void;
+    /** Get the current publishable key. */
+    getPublishableKey(): string | undefined;
     /**
      * Get AuthSome manifest
      * GET /.well-known/authsome/manifest
@@ -1024,6 +1644,96 @@ declare class AuthClient$1 {
      * GET /.well-known/authsome/openapi
      */
     getOpenAPI(): Promise<Record<string, unknown>>;
+    /**
+     * OpenID Connect Discovery
+     * GET /.well-known/openid-configuration
+     */
+    oidcDiscovery(token: string): Promise<DiscoveryResponse>;
+    /**
+     * List SCIM Groups
+     * GET /scim/v2/Groups
+     */
+    scimListGroups(token: string): Promise<ListResponse$1>;
+    /**
+     * Create SCIM Group
+     * POST /scim/v2/Groups
+     */
+    scimCreateGroup(body: ScimCreateGroupRequest, token: string): Promise<GroupResource>;
+    /**
+     * Get SCIM Group
+     * GET /scim/v2/Groups/{groupId}
+     */
+    scimGetGroup(groupId: string, token: string): Promise<GroupResource>;
+    /**
+     * Replace SCIM Group
+     * PUT /scim/v2/Groups/{groupId}
+     */
+    scimReplaceGroup(groupId: string, body: ScimReplaceGroupRequest, token: string): Promise<GroupResource>;
+    /**
+     * Patch SCIM Group
+     * PATCH /scim/v2/Groups/{groupId}
+     */
+    scimPatchGroup(groupId: string, body: ScimPatchGroupRequest, token: string): Promise<GroupResource>;
+    /**
+     * Delete SCIM Group
+     * DELETE /scim/v2/Groups/{groupId}
+     */
+    scimDeleteGroup(groupId: string, body: ScimDeleteGroupRequest, token: string): Promise<Object$1>;
+    /**
+     * SCIM Resource Types
+     * GET /scim/v2/ResourceTypes
+     */
+    scimResourceTypes(token: string): Promise<Object$1>;
+    /**
+     * SCIM Schemas
+     * GET /scim/v2/Schemas
+     */
+    scimSchemas(token: string): Promise<Object$1>;
+    /**
+     * SCIM Service Provider Configuration
+     * GET /scim/v2/ServiceProviderConfig
+     */
+    scimServiceProviderConfig(token: string): Promise<Object$1>;
+    /**
+     * List SCIM Users
+     * GET /scim/v2/Users
+     */
+    scimListUsers(token: string): Promise<ListResponse$1>;
+    /**
+     * Create SCIM User
+     * POST /scim/v2/Users
+     */
+    scimCreateUser(body: ScimCreateUserRequest, token: string): Promise<UserResource>;
+    /**
+     * Get SCIM User
+     * GET /scim/v2/Users/{userId}
+     */
+    scimGetUser(userId: string, token: string): Promise<UserResource>;
+    /**
+     * Replace SCIM User
+     * PUT /scim/v2/Users/{userId}
+     */
+    scimReplaceUser(userId: string, body: ScimReplaceUserRequest, token: string): Promise<UserResource>;
+    /**
+     * Patch SCIM User
+     * PATCH /scim/v2/Users/{userId}
+     */
+    scimPatchUser(userId: string, body: ScimPatchUserRequest, token: string): Promise<UserResource>;
+    /**
+     * Delete SCIM User
+     * DELETE /scim/v2/Users/{userId}
+     */
+    scimDeleteUser(userId: string, body: ScimDeleteUserRequest, token: string): Promise<Object$1>;
+    /**
+     * Create application (admin)
+     * POST /v1/admin/apps
+     */
+    adminCreateApp(body: AdminCreateAppRequest, token: string): Promise<AdminAppResponse>;
+    /**
+     * Delete application (admin)
+     * DELETE /v1/admin/apps/{appId}
+     */
+    adminDeleteApp(appId: string, body: AdminDeleteAppRequest, token: string): Promise<StatusResponse>;
     /**
      * Get per-app client config overrides
      * GET /v1/admin/apps/{appId}/client-config
@@ -1074,11 +1784,61 @@ declare class AuthClient$1 {
      * POST /v1/admin/impersonate/{userId}
      */
     adminImpersonate(userId: string, body: AdminImpersonateRequest, token: string): Promise<AuthResponse>;
+    /**
+     * List OAuth2 clients
+     * GET /v1/admin/oauth/clients
+     */
+    listOAuth2Clients(token: string): Promise<ListClientsResponse>;
+    /**
+     * Create OAuth2 client
+     * POST /v1/admin/oauth/clients
+     */
+    createOAuth2Client(body: CreateOAuth2ClientRequest, token: string): Promise<CreateClientResponse>;
+    /**
+     * Delete OAuth2 client
+     * DELETE /v1/admin/oauth/clients/{clientId}
+     */
+    deleteOAuth2Client(clientId: string, body: DeleteOAuth2ClientRequest, token: string): Promise<void>;
     /**
      * List organizations (admin)
      * GET /v1/admin/orgs
      */
-    adminListOrgs(token: string): Promise<OrgListResponse>;
+    adminListOrgs(): Promise<OrgListResponse>;
+    /**
+     * Grant platform-owner role (admin)
+     * POST /v1/admin/platform/owners
+     */
+    adminGrantPlatformOwner(body: AdminGrantPlatformOwnerRequest, token: string): Promise<AdminPlatformOwnerResponse>;
+    /**
+     * Revoke platform-owner role (admin)
+     * DELETE /v1/admin/platform/owners/{userID}
+     */
+    adminRevokePlatformOwner(userID: string, body: AdminRevokePlatformOwnerRequest, token: string): Promise<AdminPlatformOwnerResponse>;
+    /**
+     * List service accounts (admin)
+     * GET /v1/admin/service-accounts
+     */
+    adminListServiceAccounts(token: string): Promise<AdminServiceAccountListResponse>;
+    /**
+     * Create service account (admin)
+     * POST /v1/admin/service-accounts
+     */
+    adminCreateServiceAccount(body: AdminCreateServiceAccountRequest, token: string): Promise<AdminServiceAccountResponse>;
+    /**
+     * Get service account (admin)
+     * GET /v1/admin/service-accounts/{serviceAccountId}
+     */
+    adminGetServiceAccount(serviceAccountId: string, token: string): Promise<AdminServiceAccountResponse>;
+    /**
+     * Delete service account (admin)
+     * DELETE /v1/admin/service-accounts/{serviceAccountId}
+     */
+    adminDeleteServiceAccount(serviceAccountId: string, body: AdminDeleteServiceAccountRequest, token: string): Promise<StatusResponse>;
+    /**
+     * Create service account API key (admin)
+     * POST /v1/admin/service-accounts/{serviceAccountId}/api-keys
+     */
+    adminCreateServiceAccountAPIKey(serviceAccountId: string, body: AdminCreateServiceAccountAPIKeyRequest, token: string): Promise<AdminServiceAccountAPIKeyResponse>;
     /**
      * List all setting definitions
      * GET /v1/admin/settings/definitions
@@ -1119,6 +1879,51 @@ declare class AuthClient$1 {
      * DELETE /v1/admin/settings/values/{key}
      */
     deleteSetting(key: string, body: DeleteSettingRequest, token: string): Promise<StatusResponse>;
+    /**
+     * List social providers (admin)
+     * GET /v1/admin/social/providers
+     */
+    socialAdminListProviders(app_id: string, token: string): Promise<AdminListProvidersResponse>;
+    /**
+     * List supported social providers
+     * GET /v1/admin/social/providers/catalog
+     */
+    socialAdminCatalog(token: string): Promise<AdminCatalogResponse>;
+    /**
+     * Configure a social provider (admin)
+     * PUT /v1/admin/social/providers/{provider}
+     */
+    socialAdminUpsertProvider(provider: string, body: SocialAdminUpsertProviderRequest, app_id: string, token: string): Promise<AdminProviderResponse>;
+    /**
+     * Delete a social provider (admin)
+     * DELETE /v1/admin/social/providers/{provider}
+     */
+    socialAdminDeleteProvider(provider: string, app_id: string, token: string): Promise<AdminDeleteProviderResponse>;
+    /**
+     * List SSO connections for an app (admin)
+     * GET /v1/admin/sso/connections
+     */
+    ssoAdminListConnections(app_id: string, token: string): Promise<AdminListConnectionsResponse>;
+    /**
+     * Create SSO connection (admin)
+     * POST /v1/admin/sso/connections
+     */
+    ssoAdminCreateConnection(body: SsoAdminCreateConnectionRequest, token: string): Promise<AdminCreateConnectionResponse>;
+    /**
+     * Get SSO connection (admin)
+     * GET /v1/admin/sso/connections/{connectionId}
+     */
+    ssoAdminGetConnection(connectionId: string, token: string): Promise<Connection>;
+    /**
+     * Update SSO connection (admin)
+     * PUT /v1/admin/sso/connections/{connectionId}
+     */
+    ssoAdminUpdateConnection(connectionId: string, body: SsoAdminUpdateConnectionRequest, token: string): Promise<Connection>;
+    /**
+     * Delete SSO connection (admin)
+     * DELETE /v1/admin/sso/connections/{connectionId}
+     */
+    ssoAdminDeleteConnection(connectionId: string, token: string): Promise<AdminDeleteConnectionResponse>;
     /**
      * Get stats (admin)
      * GET /v1/admin/stats
@@ -1129,11 +1934,21 @@ declare class AuthClient$1 {
      * GET /v1/admin/users
      */
     adminListUsers(token: string): Promise<AdminUserListResponse>;
+    /**
+     * Create user (admin)
+     * POST /v1/admin/users/create
+     */
+    adminCreateUser(body: AdminCreateUserRequest, token: string): Promise<User>;
     /**
      * Get user (admin)
      * GET /v1/admin/users/{userId}
      */
     adminGetUser(userId: string, token: string): Promise<User>;
+    /**
+     * Update user (admin)
+     * PATCH /v1/admin/users/{userId}
+     */
+    adminUpdateUser(userId: string, body: AdminUpdateUserRequest, token: string): Promise<User>;
     /**
      * Delete user (admin)
      * DELETE /v1/admin/users/{userId}
@@ -1149,6 +1964,111 @@ declare class AuthClient$1 {
      * POST /v1/admin/users/{userId}/unban
      */
     adminUnbanUser(userId: string, body: AdminUnbanUserRequest, token: string): Promise<StatusResponse>;
+    /**
+     * List coupons
+     * GET /v1/billing/coupons
+     */
+    listCoupons(token: string): Promise<ListCouponsResponse>;
+    /**
+     * Create coupon
+     * POST /v1/billing/coupons
+     */
+    createCoupon(body: CreateCouponRequest, token: string): Promise<CouponResponse>;
+    /**
+     * Delete coupon
+     * DELETE /v1/billing/coupons/{couponId}
+     */
+    deleteCoupon(couponId: string, body: DeleteCouponRequest, token: string): Promise<void>;
+    /**
+     * Check feature entitlement
+     * GET /v1/billing/entitlements/{featureKey}
+     */
+    checkEntitlement(featureKey: string, token: string): Promise<EntitlementResponse>;
+    /**
+     * List invoices
+     * GET /v1/billing/invoices
+     */
+    listInvoices(token: string): Promise<ListInvoicesResponse>;
+    /**
+     * Get invoice
+     * GET /v1/billing/invoices/{invoiceId}
+     */
+    getInvoice(invoiceId: string, token: string): Promise<InvoiceResponse>;
+    /**
+     * Mark invoice as paid
+     * POST /v1/billing/invoices/{invoiceId}/pay
+     */
+    markInvoicePaid(invoiceId: string, body: MarkInvoicePaidRequest, token: string): Promise<void>;
+    /**
+     * Void an invoice
+     * POST /v1/billing/invoices/{invoiceId}/void
+     */
+    voidInvoice(invoiceId: string, body: VoidInvoiceRequest, token: string): Promise<void>;
+    /**
+     * List billing plans
+     * GET /v1/billing/plans
+     */
+    listBillingPlans(token: string): Promise<ListPlansResponse>;
+    /**
+     * Create billing plan
+     * POST /v1/billing/plans
+     */
+    createBillingPlan(body: CreateBillingPlanRequest, token: string): Promise<PlanResponse>;
+    /**
+     * Get billing plan
+     * GET /v1/billing/plans/{planId}
+     */
+    getBillingPlan(planId: string, token: string): Promise<PlanResponse>;
+    /**
+     * Activate a billing plan
+     * POST /v1/billing/plans/{planId}/activate
+     */
+    activateBillingPlan(planId: string, body: ActivateBillingPlanRequest, token: string): Promise<void>;
+    /**
+     * Archive a billing plan
+     * POST /v1/billing/plans/{planId}/archive
+     */
+    archiveBillingPlan(planId: string, body: ArchiveBillingPlanRequest, token: string): Promise<void>;
+    /**
+     * List subscriptions
+     * GET /v1/billing/subscriptions
+     */
+    listSubscriptions(token: string): Promise<ListSubscriptionsResponse>;
+    /**
+     * Create subscription
+     * POST /v1/billing/subscriptions
+     */
+    createSubscription(body: CreateSubscriptionRequest, token: string): Promise<Response>;
+    /**
+     * Get active subscription
+     * GET /v1/billing/subscriptions/active
+     */
+    getActiveSubscription(token: string): Promise<Response>;
+    /**
+     * Cancel subscription
+     * POST /v1/billing/subscriptions/{subId}/cancel
+     */
+    cancelSubscription(subId: string, body: CancelSubscriptionRequest, token: string): Promise<void>;
+    /**
+     * Change subscription plan
+     * POST /v1/billing/subscriptions/{subId}/change-plan
+     */
+    changeSubscriptionPlan(subId: string, body: ChangeSubscriptionPlanRequest, token: string): Promise<void>;
+    /**
+     * Pause subscription
+     * POST /v1/billing/subscriptions/{subId}/pause
+     */
+    pauseSubscription(subId: string, body: PauseSubscriptionRequest, token: string): Promise<void>;
+    /**
+     * Resume subscription
+     * POST /v1/billing/subscriptions/{subId}/resume
+     */
+    resumeSubscription(subId: string, body: ResumeSubscriptionRequest, token: string): Promise<void>;
+    /**
+     * Get usage summary
+     * GET /v1/billing/usage
+     */
+    getUsageSummary(token: string): Promise<UsageSummaryResponse>;
     /**
      * Change password
      * POST /v1/change-password
@@ -1159,6 +2079,21 @@ declare class AuthClient$1 {
      * GET /v1/client-config
      */
     getClientConfig(token: string): Promise<ClientConfigResponse>;
+    /**
+     * List consents
+     * GET /v1/consent
+     */
+    listConsents(): Promise<ListResponse$1>;
+    /**
+     * Grant consent
+     * POST /v1/consent/grant
+     */
+    grantConsent(body: GrantConsentRequest): Promise<Consent>;
+    /**
+     * Revoke consent
+     * POST /v1/consent/revoke
+     */
+    revokeConsent(body: RevokeConsentRequest): Promise<StatusResponse>;
     /**
      * List devices
      * GET /v1/devices
@@ -1234,6 +2169,11 @@ declare class AuthClient$1 {
      * GET /v1/health
      */
     getHealth(): Promise<HealthResponse>;
+    /**
+     * Introspect token
+     * POST /v1/introspect
+     */
+    introspectToken(body: IntrospectTokenRequest): Promise<IntrospectResponse>;
     /**
      * List API keys
      * GET /v1/keys
@@ -1289,6 +2229,11 @@ declare class AuthClient$1 {
      * GET /v1/me/export
      */
     exportMyData(token: string): Promise<Record<string, unknown>>;
+    /**
+     * Switch active organization
+     * POST /v1/me/switch-org
+     */
+    switchOrg(body: SwitchOrgRequest, token: string): Promise<SwitchOrgResponse>;
     /**
      * MFA challenge
      * POST /v1/mfa/challenge
@@ -1329,6 +2274,36 @@ declare class AuthClient$1 {
      * POST /v1/mfa/verify
      */
     verifyMFA(body: VerifyMFARequest): Promise<VerifyMFAResponse>;
+    /**
+     * OAuth2 Authorization
+     * GET /v1/oauth/authorize
+     */
+    oauth2Authorize(): Promise<void>;
+    /**
+     * Device Authorization
+     * POST /v1/oauth/device/authorize
+     */
+    oauth2DeviceAuthorize(body: Oauth2DeviceAuthorizeRequest): Promise<DeviceAuthResponse>;
+    /**
+     * Complete device authorization
+     * POST /v1/oauth/device/complete
+     */
+    oauth2DeviceComplete(body: Oauth2DeviceCompleteRequest): Promise<DeviceCompleteResponse>;
+    /**
+     * Revoke token
+     * POST /v1/oauth/revoke
+     */
+    oauth2Revoke(body: Oauth2RevokeRequest, token: string): Promise<void>;
+    /**
+     * OAuth2 Token
+     * POST /v1/oauth/token
+     */
+    oauth2Token(body: Oauth2TokenRequest): Promise<TokenResponse>;
+    /**
+     * OIDC UserInfo
+     * GET /v1/oauth/userinfo
+     */
+    oauth2UserInfo(token: string): Promise<UserInfo>;
     /**
      * List organizations
      * GET /v1/orgs
@@ -1426,7 +2401,7 @@ declare class AuthClient$1 {
     deleteTeam(orgId: string, teamId: string, body: DeleteTeamRequest, token: string): Promise<StatusResponse>;
     /**
      * List passkeys
-     * GET /v1/passkeys/
+     * GET /v1/passkeys
      */
     listPasskeys(token: string): Promise<ListResponse$1>;
     /**
@@ -1454,6 +2429,16 @@ declare class AuthClient$1 {
      * DELETE /v1/passkeys/{credentialId}
      */
     deletePasskey(credentialId: string, body: DeletePasskeyRequest, token: string): Promise<DeleteResponse>;
+    /**
+     * Start phone authentication
+     * POST /v1/phone/start
+     */
+    phoneAuthStart(body: PhoneAuthStartRequest): Promise<StartResponse>;
+    /**
+     * Verify phone OTP
+     * POST /v1/phone/verify
+     */
+    phoneAuthVerify(body: PhoneAuthVerifyRequest): Promise<VerifyResponse>;
     /**
      * Refresh tokens
      * POST /v1/refresh
@@ -1574,6 +2559,11 @@ declare class AuthClient$1 {
      * POST /v1/verify-email
      */
     verifyEmail(body: VerifyEmailRequest): Promise<StatusResponse>;
+    /**
+     * Resend email verification
+     * POST /v1/verify-email/resend
+     */
+    resendEmailVerification(body: ResendEmailVerificationRequest): Promise<StatusResponse>;
     /**
      * List webhooks
      * GET /v1/webhooks
@@ -1603,7 +2593,9 @@ declare class AuthClient$1 {
 }
 declare class AuthClientError extends Error {
     code?: number;
-    constructor(message: string, code?: number);
+    type?: string;
+    details?: Record<string, unknown>;
+    constructor(message: string, code?: number, type?: string, details?: Record<string, unknown>);
 }
 
 /**
@@ -1680,11 +2672,26 @@ declare class AuthClient extends AuthClient$1 {
      * Simplifies the call-site by accepting code + token directly.
      */
     verifySMSCodeForMFA(code: string, token: string): Promise<any>;
+    /**
+     * Complete a device authorization (RFC 8628).
+     *
+     * Approves or denies a device code. Requires an authenticated session —
+     * pass the session token so the backend can identify the user.
+     */
+    completeDeviceAuthorization(userCode: string, action: "approve" | "deny", token?: string): Promise<{
+        status: string;
+    }>;
     /**
      * Fetch the client configuration from the backend.
      *
      * The config describes which auth methods are enabled so SDK
      * components can auto-configure without manual props.
+     *
+     * Reads `baseURL` and `fetchFn` directly off the generated parent
+     * class — earlier generator templates kept a `this.config` ref but
+     * the current embedded template stores fields individually, so the
+     * old `(this as any).config.baseURL` shape produced `undefined` and
+     * the URL constructor threw.
      */
     fetchClientConfig(publishableKey?: string): Promise<ClientConfig>;
 }
@@ -1736,10 +2743,36 @@ declare class AuthManager {
     signIn(credentials: SignInRequest): Promise<void>;
     /** Sign up with email & password. */
     signUp(data: SignUpRequest): Promise<void>;
+    /**
+     * Resend the verification email for an unverified account.
+     *
+     * Always resolves; the backend returns 200 regardless of whether the
+     * email is registered, unregistered, or already verified — that's the
+     * enumeration-resistance contract. UI callers should disable the
+     * button + show a generic "if your email is registered, we sent a new
+     * link" confirmation rather than branching on the response.
+     */
+    resendVerification(email: string): Promise<void>;
     /** Sign out and clear the session. */
     signOut(): Promise<void>;
-    /** Submit an MFA challenge code. */
-    submitMFACode(enrollmentId: string, code: string): Promise<void>;
+    /**
+     * Submit the MFA challenge code against the ticket from the
+     * mfa_required state. On success: real session minted, state →
+     * "authenticated". On bad code: state stays "mfa_required" so
+     * the form can show the error inline; the ticket remains valid
+     * for the 5-minute server-side TTL.
+     *
+     * Throws if called outside the mfa_required state — the caller
+     * has nowhere to send the code.
+     */
+    submitMFAChallenge(code: string): Promise<void>;
+    /**
+     * @deprecated Use submitMFAChallenge(code). The old enrollment-id
+     * + partial-session shape was removed in the MFA consolidation;
+     * this thin shim only exists so older callers don't break their
+     * build, but the enrollmentId argument is now ignored.
+     */
+    submitMFACode(_enrollmentId: string, code: string): Promise<void>;
     /** Submit an MFA recovery code. */
     submitRecoveryCode(code: string): Promise<void>;
     /** Send an SMS code for MFA verification. Returns masked phone + expiry info. */
@@ -1752,8 +2785,19 @@ declare class AuthManager {
     submitSMSCode(code: string): Promise<void>;
     /** Refresh the current session manually. */
     refreshNow(): Promise<void>;
-    /** Get the current session token (if authenticated). */
+    /**
+     * Get the current session token (if authenticated). Returns null
+     * during the MFA challenge — there is no real session yet, only a
+     * ticket the challenge handler validates internally.
+     */
     getSessionToken(): string | null;
+    /**
+     * Get the active MFA ticket (only set during the mfa_required
+     * state). Form components driving the challenge UI read this to
+     * confirm they have a partial-auth credential before letting the
+     * user submit a code.
+     */
+    getMFATicket(): string | null;
     /** Get the current user (if authenticated). */
     getUser(): User | null;
     /** Get the cached client config (or null if not yet fetched). */