@authyon/auth 0.2.0-beta.0 → 0.2.0-beta.2

package/dist/ability-g6nBpOQM.d.cts

@@ -0,0 +1,617 @@
+interface HttpAdapterRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body?: BodyInit | null;
+    signal: AbortSignal;
+}
+/** Transport contract accepted by both Authyon clients. */
+interface HttpAdapter {
+    request(request: HttpAdapterRequest): Promise<Response>;
+}
+type HttpLogEvent = {
+    type: "request";
+    method: string;
+    url: string;
+    timestamp: number;
+} | {
+    type: "response";
+    method: string;
+    url: string;
+    status: number;
+    durationMs: number;
+    requestId?: string;
+    timestamp: number;
+} | {
+    type: "error";
+    method: string;
+    url: string;
+    errorName: string;
+    durationMs: number;
+    timestamp: number;
+};
+/** Receives sanitized HTTP lifecycle events. Headers, bodies and query values are never exposed. */
+type HttpLogger = (event: HttpLogEvent) => void;
+/**
+ * Mutable logging configuration. Change `enabled` at runtime to enable or disable logging
+ * without recreating the Authyon client.
+ */
+interface HttpLoggerOptions {
+    enabled: boolean;
+    logger?: HttpLogger;
+}
+/** Default adapter backed by the platform's Fetch API. */
+declare class FetchHttpAdapter implements HttpAdapter {
+    private readonly fetchImpl;
+    constructor(fetchImpl?: typeof fetch);
+    request(request: HttpAdapterRequest): Promise<Response>;
+}
+/** Adds safe, configurable lifecycle logging to any HTTP adapter. */
+declare class LoggingHttpAdapter implements HttpAdapter {
+    private readonly adapter;
+    private readonly options;
+    constructor(adapter: HttpAdapter, options: HttpLoggerOptions);
+    request(request: HttpAdapterRequest): Promise<Response>;
+    private log;
+}
+
+interface PaginationOptions {
+    skip?: number;
+    take?: number;
+}
+interface Paged<T> {
+    data: T[];
+    perPage?: number;
+    pageSize: number;
+    total: number;
+    pages: number;
+    hasNext: boolean;
+    hasPrev: boolean;
+}
+interface IntrospectResult {
+    active: boolean;
+    sub?: string;
+    username?: string | null;
+    email?: string | null;
+    roles?: string[] | null;
+    permissions?: string[];
+    client_id?: string;
+    scope?: string;
+    exp?: number;
+    iat?: number;
+    jti?: string;
+    token_type?: string;
+}
+
+/**
+ * Organization membership (the Authyon API calls this a "tenant" on the
+ * wire — the SDK exposes it as "organization").
+ */
+interface Organization {
+    id: string;
+    slug: string;
+    name?: string;
+    description?: string;
+    roles?: string[];
+}
+/** POST /auth/tenants — creates an organization owned by the signed-in user. */
+interface CreateOrganizationInput {
+    name?: string;
+    slug?: string;
+    description?: string;
+}
+/** GET /auth/tenants/{organizationId}/members — confirmed against the live API. */
+interface OrganizationMember {
+    userId: string;
+    email?: string;
+    username?: string;
+    roles?: string[];
+    createdAt?: string;
+    lastLoginAt?: string | null;
+}
+/** POST /auth/tenants/{tenantId}/members — invites a member by e-mail. */
+interface InviteMemberInput {
+    email: string;
+    roles: string[];
+}
+/** Authenticated user profile. */
+interface User {
+    id: string;
+    email: string;
+    username?: string;
+    emailConfirmed?: boolean;
+    firstName?: string | null;
+    lastName?: string | null;
+    roles?: string[];
+    permissions?: string[];
+    createdAt?: string;
+    lastLoginAt?: string;
+    organizations?: Organization[];
+    activeOrganization?: Organization | null;
+    /** Actions the user must complete before continuing (e.g. confirm e-mail). */
+    pendencies?: string[];
+}
+/** Token pair issued by login / refresh / tenant switch. */
+interface Session {
+    accessToken: string;
+    refreshToken: string;
+    /** Access-token lifetime in seconds (typically 1800). */
+    expiresIn: number;
+    /** Epoch ms when the access token expires (computed client-side). */
+    expiresAt: number;
+    user?: User;
+}
+type TwoFactorMethod = "authenticator" | "email" | "webauthn" | string;
+/** Returned by `login()` when the account has 2FA enabled. */
+interface TwoFactorChallenge {
+    twoFactorRequired: true;
+    challengeToken: string;
+    methods: TwoFactorMethod[];
+    emailHint?: string;
+}
+type LoginResult = {
+    twoFactorRequired: false;
+    session: Session;
+} | TwoFactorChallenge;
+interface RegisterInput {
+    email: string;
+    username?: string;
+    password: string;
+}
+interface LoginInput {
+    /** Provide `email` or `username`. */
+    email?: string;
+    username?: string;
+    password: string;
+    /** Optional organization to scope the session to (sent as `tenantSlug`). */
+    organizationSlug?: string;
+}
+/** A completed WebAuthn ceremony, handed back to the server to finish login/registration. */
+interface WebAuthnAssertion {
+    ceremonyToken: string;
+    /** JSON-serialized `PublicKeyCredential` returned by `navigator.credentials.get()`. */
+    assertionJson: string;
+}
+/** POST /auth/2fa/verify — redeems a challenge from `login()`. */
+interface VerifyTwoFactorInput {
+    challengeToken: string;
+    method: TwoFactorMethod;
+    /** TOTP / email / recovery code. Omit when `method` is `"webauthn"`. */
+    code?: string;
+    /** Required when `method` is `"webauthn"`. */
+    webAuthnAssertion?: WebAuthnAssertion;
+}
+/** GET /auth/2fa/status — per-method enrolment flags, confirmed against the live API. */
+interface TwoFactorStatus {
+    authenticatorEnabled: boolean;
+    authenticatorConfirmedAt?: string | null;
+    emailEnabled: boolean;
+    emailEnabledAt?: string | null;
+    /** Partially redacted (e.g. `"n**********@h***.com"`). */
+    emailHint?: string | null;
+    webAuthnEnabled: boolean;
+    webAuthnCredentialCount: number;
+    webAuthnCredentials: WebAuthnCredential[];
+    remainingRecoveryCodes: number;
+}
+interface AuthenticatorSetup {
+    secret: string;
+    qrSvg: string;
+    otpauthUri: string;
+}
+/**
+ * Options handed back by a WebAuthn "start" endpoint: a ceremony token to
+ * correlate the "finish" call, plus the WebAuthn options object to pass into
+ * `navigator.credentials.get()` / `.create()` (after `JSON.parse`, per the
+ * WebAuthn spec — challenge/user.id are base64url strings on the wire).
+ *
+ * ⚠️ The exact shape of `options` is not published in the OpenAPI schema (no
+ * response bodies are documented for any endpoint at the time this SDK was
+ * written) — treat it as opaque input to the WebAuthn API.
+ */
+interface WebAuthnCeremonyStart {
+    ceremonyToken: string;
+    options: unknown;
+}
+interface WebAuthnCredential {
+    id: string;
+    nickname?: string;
+    createdAt?: string;
+}
+interface SsoProvider {
+    name: string;
+    slug: string;
+    /** URL to redirect the browser to in order to start this provider's flow. */
+    startUrl: string;
+}
+/** GET /auth/me/activities — one audit-trail entry, confirmed against the live API. */
+interface Activity {
+    id: string;
+    eventType: string;
+    occurredAt: string;
+    environmentId?: string;
+    ip?: string;
+    userAgent?: string;
+    /** JSON-encoded string — `JSON.parse` it for the event-specific payload. */
+    payloadJson?: string;
+}
+/** A role available within an organization (tenant). */
+interface Role {
+    id: string;
+    name: string;
+    description?: string;
+    permissions?: string[];
+}
+/** GET /auth/sessions — confirmed against the live API. */
+interface SessionInfo {
+    id: string;
+    createdAt: string;
+    expiresAt: string;
+    revokedAt?: string | null;
+    createdFromIp?: string;
+    isActive: boolean;
+    userAgent?: string;
+    lastUsedAt?: string | null;
+    lastUsedFromIp?: string | null;
+}
+/**
+ * POST /auth/validate — confirmed against the live API. The wire shape is
+ * `{ valid, reason, profile }`, not `{ user, organization }` as the
+ * OpenAPI schema (which didn't document response bodies) suggested.
+ * `profile` is `null` for machine tokens (there's no user behind them) and
+ * for tokens that fail validation.
+ */
+interface ValidateResult {
+    valid: boolean;
+    reason?: string | null;
+    user: User | null;
+}
+type AuthEvent = {
+    type: "signed_in";
+    session: Session;
+} | {
+    type: "refreshed";
+    session: Session;
+} | {
+    type: "session_validated";
+    session: Session;
+} | {
+    type: "signed_out";
+};
+type AuthStateListener = (event: AuthEvent) => void;
+/** Pluggable persistence for the token pair. */
+interface TokenStorage {
+    get(): Session | null;
+    set(session: Session): void;
+    clear(): void;
+}
+type AuthState = "signed_out" | "authenticated" | "expired";
+interface AuthyonClientOptions {
+    /** Publishable environment key (`pk_live_...` / `pk_test_...`). */
+    envKey: string;
+    /** API origin. Defaults to `https://api.authyon.com`; HTTPS is required outside loopback. */
+    baseUrl?: string;
+    /** Allow an HTTP `baseUrl`. Intended only for explicitly trusted local development. */
+    allowInsecureHttp?: boolean;
+    /** Where tokens are persisted. Defaults to memory; persistent storage is explicit opt-in. */
+    storage?: TokenStorage;
+    /**
+     * Automatically refresh the access token shortly before it expires and
+     * retry once on 401. Defaults to `true`.
+     */
+    autoRefresh?: boolean;
+    /** Maximum duration of each HTTP request. Defaults to 15 seconds; set to `0` to disable. */
+    timeoutMs?: number;
+    /** Custom HTTP adapter for tracing, mocks or an alternative HTTP stack. */
+    httpAdapter?: HttpAdapter;
+    /** Safe HTTP lifecycle logging. Disabled unless this option is provided with `enabled: true`. */
+    httpLogger?: HttpLoggerOptions;
+    /** @deprecated Prefer `httpAdapter: new FetchHttpAdapter(customFetch)`. */
+    fetch?: typeof fetch;
+}
+
+declare class AuthyonClient {
+    private readonly envKey;
+    private readonly baseUrl;
+    private readonly storage;
+    private readonly autoRefresh;
+    private readonly transport;
+    private readonly http;
+    private readonly listeners;
+    private refreshInFlight;
+    constructor(options: AuthyonClientOptions);
+    /** Current persisted session, or null when signed out. */
+    getSession(): Session | null;
+    isAuthenticated(): boolean;
+    /** Synchronous snapshot of the locally available authentication state. */
+    getAuthState(): "signed_out" | "authenticated" | "expired";
+    /**
+     * Returns a valid access token, refreshing it transparently when it is
+     * expired or about to expire. Returns null when signed out.
+     */
+    getAccessToken(): Promise<string | null>;
+    /**
+     * Refreshes when needed, validates the server-side session through `GET /auth/me`,
+     * and stores the fresh user profile. Returns null when the session is no longer valid.
+     */
+    validateSession(): Promise<Session | null>;
+    /** Subscribe to sign-in / refresh / sign-out events. Returns an unsubscribe fn. */
+    onAuthStateChange(listener: AuthStateListener): () => void;
+    private emit;
+    private setSession;
+    private clearSession;
+    /**
+     * `/auth/login` and the other endpoints that mint a session don't return
+     * a `user` object on the wire — only `tokens` (plus `twoFactor`, when a
+     * challenge is required). Fetch the profile right after so callers get a
+     * fully-populated `session.user` without an extra manual round trip.
+     * Best-effort: keeps the session usable even if this fetch fails.
+     */
+    private hydrateUser;
+    private request;
+    /** POST /auth/register — creates a new user (rate-limited to 20/hour per IP). */
+    register(params: RegisterInput): Promise<{
+        id: string;
+    }>;
+    /**
+     * POST /auth/login — authenticates and stores the session, or returns a
+     * 2FA challenge to complete via `verifyTwoFactor()`.
+     */
+    login(params: LoginInput): Promise<LoginResult>;
+    /** POST /auth/2fa/verify — redeems a 2FA challenge from `login()` and stores the session. */
+    verifyTwoFactor(params: VerifyTwoFactorInput): Promise<Session>;
+    /** POST /auth/refresh — rotates the single-use refresh token (single-flight). */
+    refresh(): Promise<Session>;
+    /**
+     * POST /auth/logout — revokes the current refresh token and clears local
+     * state. Pass `{ everywhere: true }` to revoke every session for the user.
+     */
+    logout(options?: {
+        everywhere?: boolean;
+    }): Promise<void>;
+    readonly webauthn: {
+        /** POST /auth/webauthn/login/start — begins a passkey sign-in. */
+        loginStart: (email?: string) => Promise<WebAuthnCeremonyStart>;
+        /**
+         * POST /auth/webauthn/login/finish — completes the passkey ceremony and
+         * stores the session.
+         */
+        loginFinish: (assertion: WebAuthnAssertion) => Promise<Session>;
+    };
+    readonly sso: {
+        /** GET /auth/sso/providers — providers enabled for this environment. */
+        providers: () => Promise<SsoProvider[]>;
+        /**
+         * Builds the URL to redirect the browser to in order to start a
+         * provider's sign-in flow (`GET /auth/sso/{provider}/start`). Navigate
+         * to it directly — e.g. `window.location.href = client.sso.startUrl(...)`.
+         */
+        startUrl: (provider: string, params: {
+            redirectUri: string;
+            state?: string;
+            mode?: string;
+        }) => string;
+        /**
+         * POST /auth/sso/exchange — swaps the one-time code from the provider
+         * callback for tokens and stores the session.
+         */
+        exchange: (code: string) => Promise<Session>;
+    };
+    readonly user: {
+        /** GET /auth/me — fresh profile of the current user. */
+        me: () => Promise<User>;
+        /** GET /auth/sessions — active refresh-token sessions with device/IP data. */
+        sessions: () => Promise<SessionInfo[]>;
+        /** GET /auth/me/activities — paginated recent account activity for the current user. */
+        activities: (params?: PaginationOptions) => Promise<Paged<Activity>>;
+        /**
+         * Revokes a single session by id (e.g. one entry from `sessions()`),
+         * signing that device out without affecting the current one.
+         *
+         * ⚠️ Not directly confirmed against the published API reference at the
+         * time this SDK was written — `DELETE /auth/sessions/{id}` follows the
+         * REST convention the rest of the documented API uses, but verify it
+         * against the Authyon dashboard/API reference before relying on it. If
+         * the endpoint differs, override via a raw call to your own backend.
+         */
+        revokeSession: (sessionId: string) => Promise<void>;
+        /** POST /auth/password-reset/request — always resolves (no account enumeration). */
+        requestPasswordReset: (email: string) => Promise<void>;
+        /** POST /auth/password-reset/confirm — sets a new password and revokes all refresh tokens. */
+        confirmPasswordReset: (token: string, newPassword: string) => Promise<void>;
+    };
+    readonly organization: {
+        /** GET /auth/tenants — all organization memberships. */
+        list: () => Promise<Organization[]>;
+        /**
+         * POST /auth/tenants — creates an organization owned by the signed-in
+         * user (only available when self-service organization creation is
+         * enabled for the environment).
+         */
+        create: (params?: CreateOrganizationInput) => Promise<Organization>;
+        /** GET /auth/tenants/{organizationId} — fetch one of the user's organizations by id. */
+        get: (organizationId: string) => Promise<Organization>;
+        /**
+         * PATCH /auth/tenants/{organizationId} — renames the organization.
+         * Requires the `tenants:manage` custom permission on it.
+         */
+        rename: (organizationId: string, name: string) => Promise<Organization>;
+        /** POST /auth/switch-tenant — issues a fresh token scoped to the new organization. */
+        switch: (organizationSlug: string) => Promise<Session>;
+        /** The organization the current session is scoped to, from the cached session — no network call. */
+        current: () => Organization | null;
+        members: {
+            /**
+             * GET /auth/tenants/{organizationId}/members — paginated list of an
+             * organization's members. Consistent with the confirmed-live
+             * `Paged<T>` envelope every other `skip`/`take` endpoint returns
+             * (`user.activities()`, `@authyon/server`'s `environment.users.list()`).
+             */
+            list: (organizationId: string, params?: PaginationOptions) => Promise<Paged<OrganizationMember>>;
+            /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+            invite: (organizationId: string, params: InviteMemberInput) => Promise<void>;
+            /** DELETE /auth/tenants/{organizationId}/members/{userId} — remove a member. */
+            remove: (organizationId: string, userId: string) => Promise<void>;
+        };
+        roles: {
+            /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
+            list: (organizationId: string) => Promise<Role[]>;
+        };
+    };
+    readonly twoFactor: {
+        /** GET /auth/2fa/status — enrolled methods and recovery code count. */
+        status: () => Promise<TwoFactorStatus>;
+        /** POST /auth/2fa/resend-email — resends the code for an in-flight login challenge. */
+        resendEmail: (challengeToken: string) => Promise<void>;
+        /** POST /auth/2fa/authenticator/setup — returns secret, QR SVG and otpauth URI. */
+        setupAuthenticator: () => Promise<AuthenticatorSetup>;
+        /** POST /auth/2fa/authenticator/confirm — returns 10 single-use recovery codes. */
+        confirmAuthenticator: (code: string) => Promise<{
+            recoveryCodes: string[];
+        }>;
+        /**
+         * POST /auth/2fa/email/enable — two-step opt-in for email-based OTP.
+         * Call without `code` to receive one by e-mail, then call again with
+         * that code to confirm enrolment.
+         */
+        enableEmail: (code?: string) => Promise<void>;
+        /** POST /auth/2fa/disable — turns off a specific 2FA method (requires current password). */
+        disable: (method: TwoFactorMethod, currentPassword: string) => Promise<void>;
+        /**
+         * POST /auth/2fa/recovery-codes/regenerate — rotates the 10 single-use
+         * recovery codes (requires current password).
+         */
+        regenerateRecoveryCodes: (currentPassword: string) => Promise<{
+            recoveryCodes: string[];
+        }>;
+        webauthn: {
+            /** POST /auth/2fa/webauthn/register/start — begins passkey enrolment for 2FA. */
+            registerStart: () => Promise<WebAuthnCeremonyStart>;
+            /** POST /auth/2fa/webauthn/register/finish — finishes passkey enrolment. */
+            registerFinish: (ceremonyToken: string, attestationJson: string, nickname?: string) => Promise<WebAuthnCredential>;
+            /** GET /auth/2fa/webauthn/credentials — the caller's registered passkeys. */
+            credentials: () => Promise<WebAuthnCredential[]>;
+            /** PATCH /auth/2fa/webauthn/credentials/{id} — renames a passkey. */
+            renameCredential: (id: string, nickname: string) => Promise<WebAuthnCredential>;
+            /** DELETE /auth/2fa/webauthn/credentials/{id} — removes a passkey (requires current password). */
+            removeCredential: (id: string, currentPassword: string) => Promise<void>;
+            /**
+             * POST /auth/2fa/webauthn/assertion/start — fetches WebAuthn assertion
+             * options for an in-flight login challenge (2FA method `"webauthn"`).
+             */
+            assertionStart: (challengeToken: string) => Promise<WebAuthnCeremonyStart>;
+        };
+    };
+    /**
+     * POST /auth/introspect — lightweight token introspection (RFC 7662).
+     *
+     * ⚠️ Confirmed live: this endpoint requires the CALLER to also
+     * authenticate, with an environment or tenant client-credentials bearer
+     * token — the end user's own access token doesn't satisfy that (401).
+     * A browser app has no client secret to present, so this will fail from
+     * `@authyon/auth` in practice; call it from your backend via
+     * `@authyon/server` instead.
+     *
+     * @deprecated Use `@authyon/server.introspect()` from a trusted backend.
+     */
+    introspect(token?: string): Promise<IntrospectResult>;
+    /**
+     * POST /auth/validate — recommended: cross-checks DB state, catches
+     * revocation immediately. Same caller-authentication requirement (and
+     * the same practical limitation from the browser) as `introspect()`.
+     *
+     * @deprecated Use `@authyon/server.validate()` from a trusted backend.
+     */
+    validate(token?: string): Promise<ValidateResult>;
+}
+/** Convenience factory: `const authyon = createClient({ envKey: "pk_live_..." })`. */
+declare function createClient(options: AuthyonClientOptions): AuthyonClient;
+
+type SessionStatus = "validating" | "authenticated" | "unauthenticated" | "error";
+interface SessionSnapshot {
+    status: SessionStatus;
+    session: Session | null;
+    user: User | null;
+    error: unknown | null;
+}
+interface SessionControllerOptions {
+    /** Refresh before expiration. Defaults to 30 seconds. */
+    refreshAheadMs?: number;
+}
+type SessionSnapshotListener = () => void;
+/** Framework-agnostic session lifecycle used by the React/Next.js integration. */
+declare class AuthyonSessionController {
+    readonly client: AuthyonClient;
+    private snapshot;
+    private readonly listeners;
+    private unsubscribeAuth?;
+    private refreshTimer?;
+    private validation?;
+    private readonly refreshAheadMs;
+    constructor(client: AuthyonClient, options?: SessionControllerOptions);
+    getSnapshot: () => SessionSnapshot;
+    getServerSnapshot: () => SessionSnapshot;
+    subscribe: (listener: SessionSnapshotListener) => (() => void);
+    start(): () => void;
+    stop(): void;
+    validate(): Promise<SessionSnapshot>;
+    refreshNow(): Promise<SessionSnapshot>;
+    private acceptSession;
+    private scheduleRefresh;
+    private cancelRefresh;
+    private setSnapshot;
+}
+
+type AbilitySubject = string | Record<string, unknown>;
+type AbilityConditions = Record<string, unknown>;
+interface AbilityRule {
+    action: string | string[];
+    subject: string | string[];
+    inverted?: boolean;
+    conditions?: AbilityConditions;
+    fields?: string[];
+    reason?: string;
+}
+interface AuthyonPermissionSource {
+    permissions?: readonly string[] | null;
+    roles?: readonly string[] | null;
+    /** OAuth scopes are also accepted and interpreted as Authyon permissions. */
+    scope?: string | null;
+}
+interface AuthyonAbilityOptions {
+    rules?: readonly AbilityRule[];
+    /** Rules added when the source contains a matching Authyon role. */
+    roleRules?: Readonly<Record<string, readonly AbilityRule[]>>;
+    roles?: readonly string[] | null;
+    detectSubjectType?: (subject: Record<string, unknown>) => string;
+}
+type AbilityEvent = "updated";
+type AbilityListener = (rules: readonly AbilityRule[]) => void;
+/** Isomorphic, deny-by-default authorization engine backed by Authyon permissions. */
+declare class AuthyonAbility {
+    private readonly detectSubjectType;
+    private currentRules;
+    private readonly listeners;
+    constructor(rules?: readonly AbilityRule[], detectSubjectType?: (subject: Record<string, unknown>) => string);
+    get rules(): readonly AbilityRule[];
+    can(action: string, subject: AbilitySubject, field?: string): boolean;
+    cannot(action: string, subject: AbilitySubject, field?: string): boolean;
+    rulesFor(action: string, subject: string): readonly AbilityRule[];
+    update(rules: readonly AbilityRule[]): void;
+    on(event: AbilityEvent, listener: AbilityListener): () => void;
+}
+/** Fluent rule builder with CASL-like `can` and `cannot` methods. */
+declare class AuthyonAbilityBuilder {
+    readonly rules: AbilityRule[];
+    can(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[]): this;
+    cannot(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[], reason?: string): this;
+    build(options?: Pick<AuthyonAbilityOptions, "detectSubjectType">): AuthyonAbility;
+}
+/** Creates an ability from Authyon permissions, OAuth scope and optional role rules. */
+declare function createAuthyonAbility(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AuthyonAbility;
+/** Checks an Authyon permission string using the same wildcard rules as an ability. */
+declare function hasPermission(source: AuthyonPermissionSource | readonly string[], requiredPermission: string): boolean;
+/** Converts Authyon's `subject:action` permission strings to authorization rules. */
+declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
+
+export { createAuthyonRules as $, AuthyonClient as A, type SessionControllerOptions as B, type CreateOrganizationInput as C, type SessionInfo as D, type SessionSnapshot as E, FetchHttpAdapter as F, type SessionSnapshotListener as G, type HttpAdapter as H, type IntrospectResult as I, type SessionStatus as J, type SsoProvider as K, LoggingHttpAdapter as L, type TwoFactorChallenge as M, type TwoFactorMethod as N, type Organization as O, type Paged as P, type TwoFactorStatus as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type User as U, type ValidateResult as V, type VerifyTwoFactorInput as W, type WebAuthnAssertion as X, type WebAuthnCeremonyStart as Y, type WebAuthnCredential as Z, createAuthyonAbility as _, type HttpLoggerOptions as a, createClient as a0, hasPermission as a1, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type HttpAdapterRequest as r, type HttpLogEvent as s, type HttpLogger as t, type InviteMemberInput as u, type LoginInput as v, type LoginResult as w, type OrganizationMember as x, type PaginationOptions as y, type Role as z };