@authyon/auth 0.1.3

package/README.md

@@ -0,0 +1,158 @@
+# @authyon/auth
+
+SDK JS/TS para o [Authyon](https://authyon.com) — autenticação, sessões, multi-tenant e 2FA, com armazenamento e refresh de tokens transparentes.
+
+Cobre todos os endpoints públicos documentados em [authyon.com/docs](https://authyon.com/docs), usando a **publishable key** (`pk_...`) — segura para expor no navegador.
+
+Para gestão de organização/membros (secret key) e verificação de token no backend, veja [`@authyon/server`](../server).
+
+## Instalação
+
+```bash
+npm install @authyon/auth
+```
+
+## Uso rápido
+
+```ts
+import { createClient } from "@authyon/auth";
+
+const authyon = createClient({ envKey: "pk_live_..." });
+
+// Login (com suporte a 2FA)
+const result = await authyon.login({
+  email: "alice@acme.com",
+  password: "...",
+  organizationSlug: "acme", // opcional
+});
+
+if (result.twoFactorRequired) {
+  const code = prompt(`Código 2FA (${result.methods.join(", ")})`);
+  await authyon.verifyTwoFactor({
+    challengeToken: result.challengeToken,
+    method: "authenticator",
+    code: code!,
+  });
+}
+
+// Usuário atual — o access token é renovado automaticamente quando necessário
+const user = await authyon.user.me();
+```
+
+## Sessão e tokens
+
+- Tokens persistem em `localStorage` por padrão (`memoryStorage()` ou um `TokenStorage` próprio via opção `storage`).
+- `getAccessToken()` renova o token automaticamente antes de expirar (refresh token é single-use e rotacionado, com single-flight para evitar corridas).
+- Chamadas autenticadas que retornam 401 fazem um refresh e uma retentativa automática.
+
+```ts
+const token = await authyon.getAccessToken(); // sempre válido, ou null se deslogado
+
+const unsubscribe = authyon.onAuthStateChange((event) => {
+  // "signed_in" | "refreshed" | "signed_out"
+  console.log(event.type);
+});
+```
+
+## API
+
+Métodos de sessão/auth ficam soltos no client; os que giram em torno de um recurso específico ficam agrupados em namespaces (`user`, `organization`, `twoFactor`, `webauthn`, `sso`).
+
+| Método                                                                   | Endpoint                |
+| ------------------------------------------------------------------------ | ----------------------- |
+| `register({ email, username, password })`                                | `POST /auth/register`   |
+| `login({ email \| username, password, organizationSlug? })`              | `POST /auth/login`      |
+| `verifyTwoFactor({ challengeToken, method, code?, webAuthnAssertion? })` | `POST /auth/2fa/verify` |
+| `refresh()`                                                              | `POST /auth/refresh`    |
+| `logout({ everywhere? })`                                                | `POST /auth/logout`     |
+| `introspect(token?)`                                                     | `POST /auth/introspect` |
+| `validate(token?)`                                                       | `POST /auth/validate`   |
+
+### `authyon.user`
+
+| Método                                          | Endpoint                            |
+| ----------------------------------------------- | ----------------------------------- |
+| `user.me()`                                     | `GET /auth/me`                      |
+| `user.sessions()`                               | `GET /auth/sessions`                |
+| `user.revokeSession(sessionId)`                 | `DELETE /auth/sessions/{id}`        |
+| `user.activities(params?)`                      | `GET /auth/me/activities`           |
+| `user.requestPasswordReset(email)`              | `POST /auth/password-reset/request` |
+| `user.confirmPasswordReset(token, newPassword)` | `POST /auth/password-reset/confirm` |
+
+### `authyon.organization`
+
+| Método                                                | Endpoint                                       |
+| ----------------------------------------------------- | ---------------------------------------------- |
+| `organization.list()`                                 | `GET /auth/tenants`                            |
+| `organization.create(params?)`                        | `POST /auth/tenants`                           |
+| `organization.get(organizationId)`                    | `GET /auth/tenants/{id}`                       |
+| `organization.rename(organizationId, name)`           | `PATCH /auth/tenants/{id}`                     |
+| `organization.switch(slug)`                           | `POST /auth/switch-tenant`                     |
+| `organization.current()`                              | — (lê `activeOrganization` da sessão em cache) |
+| `organization.members.list(organizationId, params?)`  | `GET /auth/tenants/{id}/members`               |
+| `organization.members.invite(organizationId, params)` | `POST /auth/tenants/{id}/members`              |
+| `organization.members.remove(organizationId, userId)` | `DELETE /auth/tenants/{id}/members/{userId}`   |
+| `organization.roles.list(organizationId)`             | `GET /auth/tenants/{id}/roles`                 |
+
+### `authyon.twoFactor`
+
+| Método                                               | Endpoint                                     |
+| ---------------------------------------------------- | -------------------------------------------- |
+| `twoFactor.status()`                                 | `GET /auth/2fa/status`                       |
+| `twoFactor.resendEmail(challengeToken)`              | `POST /auth/2fa/resend-email`                |
+| `twoFactor.setupAuthenticator()`                     | `POST /auth/2fa/authenticator/setup`         |
+| `twoFactor.confirmAuthenticator(code)`               | `POST /auth/2fa/authenticator/confirm`       |
+| `twoFactor.enableEmail(code?)`                       | `POST /auth/2fa/email/enable`                |
+| `twoFactor.disable(method, currentPassword)`         | `POST /auth/2fa/disable`                     |
+| `twoFactor.regenerateRecoveryCodes(currentPassword)` | `POST /auth/2fa/recovery-codes/regenerate`   |
+| `twoFactor.webauthn.registerStart()`                 | `POST /auth/2fa/webauthn/register/start`     |
+| `twoFactor.webauthn.registerFinish(...)`             | `POST /auth/2fa/webauthn/register/finish`    |
+| `twoFactor.webauthn.credentials()`                   | `GET /auth/2fa/webauthn/credentials`         |
+| `twoFactor.webauthn.renameCredential(id, nickname)`  | `PATCH /auth/2fa/webauthn/credentials/{id}`  |
+| `twoFactor.webauthn.removeCredential(id, pwd)`       | `DELETE /auth/2fa/webauthn/credentials/{id}` |
+| `twoFactor.webauthn.assertionStart(challengeToken)`  | `POST /auth/2fa/webauthn/assertion/start`    |
+
+### `authyon.webauthn` (login sem senha)
+
+| Método                            | Endpoint                           |
+| --------------------------------- | ---------------------------------- |
+| `webauthn.loginStart(email?)`     | `POST /auth/webauthn/login/start`  |
+| `webauthn.loginFinish(assertion)` | `POST /auth/webauthn/login/finish` |
+
+### `authyon.sso` (login social)
+
+| Método                           | Endpoint                                                                              |
+| -------------------------------- | ------------------------------------------------------------------------------------- |
+| `sso.providers()`                | `GET /auth/sso/providers`                                                             |
+| `sso.startUrl(provider, params)` | monta a URL de `GET /auth/sso/{provider}/start` (não faz a chamada — navegue até ela) |
+| `sso.exchange(code)`             | `POST /auth/sso/exchange`                                                             |
+
+## Invalidação de token
+
+- **Sessão atual**: `logout()` revoga o refresh token atual; `logout({ everywhere: true })` revoga todos os refresh tokens do usuário.
+- **Uma sessão específica**: `user.revokeSession(sessionId)`, usando o `id` retornado por `user.sessions()` — derruba um dispositivo sem afetar a sessão atual.
+- **Access token**: por ser um JWT stateless, o access token continua "válido" até expirar (`expiresIn`, tipicamente 30 min) mesmo após revogar o refresh token. Para checar revogação em tempo real no seu backend, use `validate()` (cross-checa o estado no banco) em vez de `introspect()`.
+
+## Erros
+
+Toda resposta não-2xx vira um `AuthyonError` (problem+json). Compare pelo `code` legível por máquina, nunca pelo `title`:
+
+```ts
+import { AuthyonError, ErrorCodes } from "@authyon/auth";
+
+try {
+  await authyon.register({ email, password });
+} catch (err) {
+  if (err instanceof AuthyonError && err.is(ErrorCodes.EmailTaken)) {
+    // e-mail já cadastrado
+  }
+}
+```
+
+## Build
+
+```bash
+npm install
+npm run build      # dist/ (ESM + CJS + .d.ts via tsup)
+npm run typecheck
+```

package/dist/index.cjs

@@ -0,0 +1,501 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AuthyonClient: () => AuthyonClient,
+  AuthyonError: () => AuthyonError,
+  ErrorCodes: () => ErrorCodes,
+  createClient: () => createClient,
+  defaultStorage: () => defaultStorage,
+  localStorageAdapter: () => localStorageAdapter,
+  memoryStorage: () => memoryStorage
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var AuthyonError = class extends Error {
+  constructor(status, body) {
+    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    this.name = "AuthyonError";
+    this.status = status;
+    this.code = body.code ?? "unknown";
+    this.title = body.title ?? "Error";
+    this.detail = body.detail;
+  }
+  is(code) {
+    return this.code === code;
+  }
+};
+var ErrorCodes = {
+  EmailTaken: "user.email_taken",
+  PasswordWeak: "user.password_weak",
+  PasswordPwned: "user.password_pwned"
+};
+
+// src/storage.ts
+var STORAGE_KEY = "authyon.session";
+function memoryStorage() {
+  let session = null;
+  return {
+    get: () => session,
+    set: (s) => {
+      session = s;
+    },
+    clear: () => {
+      session = null;
+    }
+  };
+}
+function localStorageAdapter(key = STORAGE_KEY) {
+  return {
+    get() {
+      try {
+        const raw = window.localStorage.getItem(key);
+        return raw ? JSON.parse(raw) : null;
+      } catch {
+        return null;
+      }
+    },
+    set(session) {
+      try {
+        window.localStorage.setItem(key, JSON.stringify(session));
+      } catch {
+      }
+    },
+    clear() {
+      try {
+        window.localStorage.removeItem(key);
+      } catch {
+      }
+    }
+  };
+}
+function defaultStorage() {
+  if (typeof window !== "undefined" && typeof window.localStorage !== "undefined") {
+    return localStorageAdapter();
+  }
+  return memoryStorage();
+}
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.authyon.com";
+var EXPIRY_SKEW_MS = 3e4;
+var AuthyonClient = class {
+  constructor(options) {
+    this.listeners = /* @__PURE__ */ new Set();
+    this.refreshInFlight = null;
+    // ── Passwordless (passkey) login ─────────────────────────────────────────
+    this.webauthn = {
+      /** POST /auth/webauthn/login/start — begins a passkey sign-in. */
+      loginStart: (email) => this.request("/auth/webauthn/login/start", { method: "POST", body: { email } }),
+      /**
+       * POST /auth/webauthn/login/finish — completes the passkey ceremony and
+       * stores the session.
+       */
+      loginFinish: (assertion) => this.request("/auth/webauthn/login/finish", {
+        method: "POST",
+        body: assertion
+      }).then((data) => this.setSession(data, "signed_in"))
+    };
+    // ── Social sign-in (SSO) ─────────────────────────────────────────────────
+    this.sso = {
+      /** GET /auth/sso/providers — providers enabled for this environment. */
+      providers: () => this.request("/auth/sso/providers"),
+      /**
+       * Builds the URL to redirect the browser to in order to start a
+       * provider's sign-in flow (`GET /auth/sso/{provider}/start`). Navigate
+       * to it directly — e.g. `window.location.href = client.sso.startUrl(...)`.
+       */
+      startUrl: (provider, params) => {
+        const query = new URLSearchParams({ redirect_uri: params.redirectUri });
+        if (params.state) query.set("state", params.state);
+        if (params.mode) query.set("mode", params.mode);
+        return `${this.baseUrl}/auth/sso/${encodeURIComponent(provider)}/start?${query}`;
+      },
+      /**
+       * POST /auth/sso/exchange — swaps the one-time code from the provider
+       * callback for tokens and stores the session.
+       */
+      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then(
+        (data) => this.setSession(data, "signed_in")
+      )
+    };
+    // ── User ─────────────────────────────────────────────────────────────────
+    this.user = {
+      /** GET /auth/me — fresh profile of the current user. */
+      me: () => this.request("/auth/me", { bearer: true }).then(normalizeUser),
+      /** GET /auth/sessions — active refresh-token sessions with device/IP data. */
+      sessions: () => this.request("/auth/sessions", { bearer: true }),
+      /** GET /auth/me/activities — recent account activity for the current user. */
+      activities: (params = {}) => this.request(`/auth/me/activities?${toQuery(params)}`, { bearer: true }),
+      /**
+       * Revokes a single session by id (e.g. one entry from `sessions()`),
+       * signing that device out without affecting the current one.
+       *
+       * ⚠️ Not directly confirmed against the published API reference at the
+       * time this SDK was written — `DELETE /auth/sessions/{id}` follows the
+       * REST convention the rest of the documented API uses, but verify it
+       * against the Authyon dashboard/API reference before relying on it. If
+       * the endpoint differs, override via a raw call to your own backend.
+       */
+      revokeSession: (sessionId) => this.request(`/auth/sessions/${encodeURIComponent(sessionId)}`, {
+        method: "DELETE",
+        bearer: true
+      }),
+      /** POST /auth/password-reset/request — always resolves (no account enumeration). */
+      requestPasswordReset: (email) => this.request("/auth/password-reset/request", { method: "POST", body: { email } }),
+      /** POST /auth/password-reset/confirm — sets a new password and revokes all refresh tokens. */
+      confirmPasswordReset: (token, newPassword) => this.request("/auth/password-reset/confirm", {
+        method: "POST",
+        body: { token, newPassword }
+      })
+    };
+    // ── Organization ─────────────────────────────────────────────────────────
+    this.organization = {
+      /** GET /auth/tenants — all organization memberships. */
+      list: () => this.request("/auth/tenants", { bearer: true }),
+      /**
+       * POST /auth/tenants — creates an organization owned by the signed-in
+       * user (only available when self-service organization creation is
+       * enabled for the environment).
+       */
+      create: (params = {}) => this.request("/auth/tenants", { method: "POST", bearer: true, body: params }),
+      /** GET /auth/tenants/{organizationId} — fetch one of the user's organizations by id. */
+      get: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}`, { bearer: true }),
+      /**
+       * PATCH /auth/tenants/{organizationId} — renames the organization.
+       * Requires the `tenants:manage` custom permission on it.
+       */
+      rename: (organizationId, name) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}`, {
+        method: "PATCH",
+        bearer: true,
+        body: { name }
+      }),
+      /** POST /auth/switch-tenant — issues a fresh token scoped to the new organization. */
+      switch: (organizationSlug) => this.request("/auth/switch-tenant", {
+        method: "POST",
+        bearer: true,
+        body: { tenantSlug: organizationSlug }
+      }).then((data) => this.setSession(data, "refreshed")),
+      /** The organization the current session is scoped to, from the cached session — no network call. */
+      current: () => this.getSession()?.user?.activeOrganization ?? null,
+      members: {
+        /** GET /auth/tenants/{organizationId}/members — list an organization's members. */
+        list: (organizationId, params = {}) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/members?${toQuery(params)}`,
+          { bearer: true }
+        ),
+        /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+        invite: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, {
+          method: "POST",
+          bearer: true,
+          body: params
+        }),
+        /** DELETE /auth/tenants/{organizationId}/members/{userId} — remove a member. */
+        remove: (organizationId, userId) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/members/${encodeURIComponent(userId)}`,
+          { method: "DELETE", bearer: true }
+        )
+      },
+      roles: {
+        /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
+        list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/roles`, {
+          bearer: true
+        })
+      }
+    };
+    // ── Two-factor management (authenticated) ────────────────────────────────
+    this.twoFactor = {
+      /** GET /auth/2fa/status — enrolled methods and recovery code count. */
+      status: () => this.request("/auth/2fa/status", { bearer: true }),
+      /** POST /auth/2fa/resend-email — resends the code for an in-flight login challenge. */
+      resendEmail: (challengeToken) => this.request("/auth/2fa/resend-email", { method: "POST", body: { challengeToken } }),
+      /** POST /auth/2fa/authenticator/setup — returns secret, QR SVG and otpauth URI. */
+      setupAuthenticator: () => this.request("/auth/2fa/authenticator/setup", { method: "POST", bearer: true }),
+      /** POST /auth/2fa/authenticator/confirm — returns 10 single-use recovery codes. */
+      confirmAuthenticator: (code) => this.request("/auth/2fa/authenticator/confirm", {
+        method: "POST",
+        bearer: true,
+        body: { code }
+      }),
+      /**
+       * POST /auth/2fa/email/enable — two-step opt-in for email-based OTP.
+       * Call without `code` to receive one by e-mail, then call again with
+       * that code to confirm enrolment.
+       */
+      enableEmail: (code) => this.request("/auth/2fa/email/enable", { method: "POST", bearer: true, body: { code } }),
+      /** POST /auth/2fa/disable — turns off a specific 2FA method (requires current password). */
+      disable: (method, currentPassword) => this.request("/auth/2fa/disable", {
+        method: "POST",
+        bearer: true,
+        body: { method, currentPassword }
+      }),
+      /**
+       * POST /auth/2fa/recovery-codes/regenerate — rotates the 10 single-use
+       * recovery codes (requires current password).
+       */
+      regenerateRecoveryCodes: (currentPassword) => this.request("/auth/2fa/recovery-codes/regenerate", {
+        method: "POST",
+        bearer: true,
+        body: { currentPassword }
+      }),
+      webauthn: {
+        /** POST /auth/2fa/webauthn/register/start — begins passkey enrolment for 2FA. */
+        registerStart: () => this.request("/auth/2fa/webauthn/register/start", { method: "POST", bearer: true }),
+        /** POST /auth/2fa/webauthn/register/finish — finishes passkey enrolment. */
+        registerFinish: (ceremonyToken, attestationJson, nickname) => this.request("/auth/2fa/webauthn/register/finish", {
+          method: "POST",
+          bearer: true,
+          body: { ceremonyToken, attestationJson, nickname }
+        }),
+        /** GET /auth/2fa/webauthn/credentials — the caller's registered passkeys. */
+        credentials: () => this.request("/auth/2fa/webauthn/credentials", { bearer: true }),
+        /** PATCH /auth/2fa/webauthn/credentials/{id} — renames a passkey. */
+        renameCredential: (id, nickname) => this.request(`/auth/2fa/webauthn/credentials/${encodeURIComponent(id)}`, {
+          method: "PATCH",
+          bearer: true,
+          body: { nickname }
+        }),
+        /** DELETE /auth/2fa/webauthn/credentials/{id} — removes a passkey (requires current password). */
+        removeCredential: (id, currentPassword) => this.request(`/auth/2fa/webauthn/credentials/${encodeURIComponent(id)}`, {
+          method: "DELETE",
+          bearer: true,
+          body: { currentPassword }
+        }),
+        /**
+         * POST /auth/2fa/webauthn/assertion/start — fetches WebAuthn assertion
+         * options for an in-flight login challenge (2FA method `"webauthn"`).
+         */
+        assertionStart: (challengeToken) => this.request("/auth/2fa/webauthn/assertion/start", {
+          method: "POST",
+          body: { challengeToken }
+        })
+      }
+    };
+    if (!options.envKey)
+      throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
+    this.envKey = options.envKey;
+    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.storage = options.storage ?? defaultStorage();
+    this.autoRefresh = options.autoRefresh ?? true;
+    this.fetchImpl = options.fetch ?? fetch.bind(globalThis);
+  }
+  // ── Session state ────────────────────────────────────────────────────────
+  /** Current persisted session, or null when signed out. */
+  getSession() {
+    return this.storage.get();
+  }
+  isAuthenticated() {
+    return this.getSession() !== null;
+  }
+  /**
+   * Returns a valid access token, refreshing it transparently when it is
+   * expired or about to expire. Returns null when signed out.
+   */
+  async getAccessToken() {
+    const session = this.getSession();
+    if (!session) return null;
+    if (this.autoRefresh && Date.now() >= session.expiresAt - EXPIRY_SKEW_MS) {
+      try {
+        return (await this.refresh()).accessToken;
+      } catch {
+        return null;
+      }
+    }
+    return session.accessToken;
+  }
+  /** Subscribe to sign-in / refresh / sign-out events. Returns an unsubscribe fn. */
+  onAuthStateChange(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  emit(event) {
+    for (const listener of this.listeners) listener(event);
+  }
+  setSession(raw, event) {
+    const session = {
+      ...raw,
+      user: raw.user ? normalizeUser(raw.user) : void 0,
+      expiresAt: Date.now() + raw.expiresIn * 1e3
+    };
+    this.storage.set(session);
+    this.emit(event === "signed_out" ? { type: "signed_out" } : { type: event, session });
+    return session;
+  }
+  clearSession() {
+    this.storage.clear();
+    this.emit({ type: "signed_out" });
+  }
+  // ── HTTP core ────────────────────────────────────────────────────────────
+  async request(path, options = {}, isRetry = false) {
+    const headers = {
+      "X-Authyon-Environment": this.envKey,
+      ...options.headers
+    };
+    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    if (options.bearer) {
+      const token = await this.getAccessToken();
+      if (!token)
+        throw new AuthyonError(401, { code: "auth.not_authenticated", title: "Not authenticated" });
+      headers.Authorization = `Bearer ${token}`;
+    }
+    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+      method: options.method ?? "GET",
+      headers,
+      body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+    });
+    if (response.status === 401 && options.bearer && this.autoRefresh && !isRetry && this.getSession()) {
+      try {
+        await this.refresh();
+      } catch {
+        this.clearSession();
+        throw await this.toError(response);
+      }
+      return this.request(path, options, true);
+    }
+    if (!response.ok) throw await this.toError(response);
+    if (response.status === 204) return void 0;
+    return await response.json();
+  }
+  async toError(response) {
+    let body = {};
+    try {
+      body = await response.json();
+    } catch {
+    }
+    return new AuthyonError(response.status, body);
+  }
+  // ── Auth flows ───────────────────────────────────────────────────────────
+  /** POST /auth/register — creates a new user (rate-limited to 20/hour per IP). */
+  async register(params) {
+    return this.request("/auth/register", { method: "POST", body: params });
+  }
+  /**
+   * POST /auth/login — authenticates and stores the session, or returns a
+   * 2FA challenge to complete via `verifyTwoFactor()`.
+   */
+  async login(params) {
+    const { organizationSlug, ...rest } = params;
+    const body = organizationSlug ? { ...rest, tenantSlug: organizationSlug } : rest;
+    const data = await this.request("/auth/login", {
+      method: "POST",
+      body
+    });
+    if (data.twoFactorRequired) {
+      return data;
+    }
+    const session = this.setSession(data, "signed_in");
+    return { twoFactorRequired: false, session };
+  }
+  /** POST /auth/2fa/verify — redeems a 2FA challenge from `login()` and stores the session. */
+  async verifyTwoFactor(params) {
+    const data = await this.request("/auth/2fa/verify", { method: "POST", body: params });
+    return this.setSession(data, "signed_in");
+  }
+  /** POST /auth/refresh — rotates the single-use refresh token (single-flight). */
+  async refresh() {
+    if (this.refreshInFlight) return this.refreshInFlight;
+    const current = this.getSession();
+    if (!current)
+      throw new AuthyonError(401, { code: "auth.not_authenticated", title: "Not authenticated" });
+    this.refreshInFlight = this.request("/auth/refresh", {
+      method: "POST",
+      body: { refreshToken: current.refreshToken }
+    }).then(
+      (data) => this.setSession({ user: current.user, ...data }, "refreshed")
+    ).catch((error) => {
+      if (error instanceof AuthyonError && (error.status === 401 || error.status === 403)) {
+        this.clearSession();
+      }
+      throw error;
+    }).finally(() => {
+      this.refreshInFlight = null;
+    });
+    return this.refreshInFlight;
+  }
+  /**
+   * POST /auth/logout — revokes the current refresh token and clears local
+   * state. Pass `{ everywhere: true }` to revoke every session for the user.
+   */
+  async logout(options = {}) {
+    const session = this.getSession();
+    if (session) {
+      try {
+        if (options.everywhere) {
+          await this.request("/auth/logout", { method: "POST", bearer: true });
+        } else {
+          await this.request("/auth/logout", {
+            method: "POST",
+            body: { refreshToken: session.refreshToken }
+          });
+        }
+      } catch {
+      }
+    }
+    this.clearSession();
+  }
+  // ── Token verification ───────────────────────────────────────────────────
+  /** POST /auth/introspect — lightweight token introspection. */
+  async introspect(token) {
+    const accessToken = token ?? await this.getAccessToken();
+    return this.request("/auth/introspect", { method: "POST", body: { token: accessToken } });
+  }
+  /** POST /auth/validate — recommended: cross-checks DB state, returns user + organization. */
+  async validate(token) {
+    const accessToken = token ?? await this.getAccessToken();
+    const raw = await this.request("/auth/validate", {
+      method: "POST",
+      headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : void 0
+    });
+    return {
+      user: normalizeUser(raw.user),
+      organization: raw.organization ?? raw.tenant ?? null
+    };
+  }
+};
+function normalizeUser(raw) {
+  const { tenants, activeTenant, ...rest } = raw;
+  return {
+    ...rest,
+    organizations: raw.organizations ?? tenants,
+    activeOrganization: raw.activeOrganization ?? activeTenant ?? null
+  };
+}
+function createClient(options) {
+  return new AuthyonClient(options);
+}
+function toQuery(params) {
+  const query = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0) query.set(key, String(value));
+  }
+  return query.toString();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthyonClient,
+  AuthyonError,
+  ErrorCodes,
+  createClient,
+  defaultStorage,
+  localStorageAdapter,
+  memoryStorage
+});