@authyon/auth 0.2.0-beta.14 → 0.2.0-beta.15

package/README.md

@@ -273,26 +273,28 @@ Métodos de sessão/auth ficam soltos no client; os que giram em torno de um rec
 | `sso.startUrl(provider, params)` | monta a URL de `GET /auth/sso/{provider}/start` (não faz a chamada — navegue até ela) |
 | `sso.exchange(code)`             | `POST /auth/sso/exchange`                                                             |
 
-### `authyon.financialAuthorizations` (confirmação de transações)
+### `authyon.security` (aprovação com OTP/passkey)
 
-O cliente aprova uma transação criada pelo seu backend com o código do app autenticador
-ou a passkey. Guia completo: [`docs/financialStepUp.md`](../../docs/financialStepUp.md).
+`security.approvals`: o cliente aprova o que o seu backend pediu
+(`@authyon/server` → `security.approvals.create`, com um `payload` livre) usando o código
+do app autenticador ou a passkey. Para só validar um código, use `security.otp.check` no
+`@authyon/server`. Guia completo: [`docs/security-otp-approvals.md`](../../docs/security-otp-approvals.md).
 
 ```ts
-const pending = await authyon.financialAuthorizations.get(authorizationId);
-// mostre pending.amount, pending.currency e pending.beneficiary ao cliente
-await authyon.financialAuthorizations.confirm(authorizationId, {
+const pending = await authyon.security.approvals.get(approvalId);
+// mostre pending.payload ao cliente
+await authyon.security.approvals.confirm(approvalId, {
   method: "authenticator",
   code: "123456",
 });
 ```
 
-| Método                                        | Endpoint                                          |
-| --------------------------------------------- | ------------------------------------------------- |
-| `financialAuthorizations.get(id)`             | `GET /auth/authorizations/{id}`                   |
-| `financialAuthorizations.webauthnOptions(id)` | `POST /auth/authorizations/{id}/webauthn/options` |
-| `financialAuthorizations.confirm(id, input?)` | `POST /auth/authorizations/{id}/confirm`          |
-| `financialAuthorizations.reject(id)`          | `POST /auth/authorizations/{id}/reject`           |
+| Método                                   | Endpoint                                          |
+| ---------------------------------------- | ------------------------------------------------- |
+| `security.approvals.get(id)`             | `GET /auth/authorizations/{id}`                   |
+| `security.approvals.webauthnOptions(id)` | `POST /auth/authorizations/{id}/webauthn/options` |
+| `security.approvals.confirm(id, input?)` | `POST /auth/authorizations/{id}/confirm`          |
+| `security.approvals.reject(id)`          | `POST /auth/authorizations/{id}/reject`           |
 
 ## Invalidação de token
 

package/dist/{ability-DbnbsQEX.d.cts → ability-5_xXXbDF.d.cts}

@@ -1,24 +1,13 @@
-/** Lifecycle of a transaction-bound financial authorization. */
-type FinancialAuthorizationStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
 /**
- * The transaction the customer approves. The API hashes a canonical form of
- * these fields; `consume()` must resend exactly the same values (amount is
- * normalized to four decimal places, metadata keys are sorted).
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
  */
-interface FinancialTransaction {
-    /** Business action, e.g. `"pix.transfer"`. Max 100 characters. */
-    action: string;
-    /** Positive amount, up to 15 integer digits and 4 decimal places. */
-    amount: number;
-    /** ISO 4217 currency code, e.g. `"BRL"`. */
-    currency: string;
-    /** Human-readable beneficiary shown to the customer. Max 256 characters. */
-    beneficiary: string;
-    /** Optional JSON object bound into the hash (max 16 KiB). */
-    metadata?: Record<string, unknown>;
-}
+type ApprovalPayload = Record<string, unknown>;
 /** Evidence of how the customer proved their identity when approving. */
-interface FinancialAssurance {
+interface ApprovalAssurance {
     /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
     acr: string;
     /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
@@ -26,28 +15,25 @@ interface FinancialAssurance {
     /** When the second factor was verified (ISO 8601). */
     authTime: string;
 }
-interface FinancialAuthorization {
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
     id: string;
-    status: FinancialAuthorizationStatus;
+    status: ApprovalStatus;
     subjectId: string;
     tenantId?: string | null;
-    action: string;
-    amount: number;
-    currency: string;
-    beneficiary: string;
-    /** SHA-256 (hex) of the canonical transaction. */
-    transactionHash: string;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
     createdAt: string;
     expiresAt: string;
     decidedAt?: string | null;
     consumedAt?: string | null;
-    /** Full canonical transaction — returned only to the customer (subject) view. */
-    transaction?: FinancialTransaction | null;
     /** Present once approved. */
-    assurance?: FinancialAssurance | null;
+    assurance?: ApprovalAssurance | null;
 }
-/** Inline second factor sent with `confirm()`. */
-type ConfirmFinancialAuthorizationInput = {
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
     method: "authenticator";
     /** Six-digit code from the customer's authenticator app. */
     code: string;
@@ -60,15 +46,13 @@ type ConfirmFinancialAuthorizationInput = {
         assertionJson: string;
     };
 };
-/** Passkey assertion options for approving one authorization. */
-interface FinancialWebAuthnOptions {
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
     ceremonyToken: string;
     /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
     optionsJson: string;
 }
 
-type QueryParams = object;
-
 interface HttpAdapterRequest {
     url: string;
     method: string;
@@ -126,35 +110,29 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
-type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-interface JsonRequestOptions {
-    method?: HttpMethod;
-    body?: unknown;
-    query?: QueryParams;
-    headers?: Record<string, string>;
-}
-
-/** Sends a request already authenticated as the customer (end-user bearer). */
-type SubjectRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
-/** Customer-side operations on a financial authorization (`/auth/authorizations`). */
-declare function subjectFinancialAuthorizations(request: SubjectRequest): {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id: string) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id: string) => Promise<FinancialWebAuthnOptions>;
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
     /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     * POST /auth/authorizations/{id}/confirm — approves it.
      *
      * Pass the authenticator code or passkey assertion to verify the second
      * factor inline (recommended). Without `input`, the session itself must
      * have used a passkey or authenticator code within the last 5 minutes,
      * otherwise the API answers `step_up_required`.
      */
-    confirm: (id: string, input?: ConfirmFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id: string) => Promise<FinancialAuthorization>;
-};
-type SubjectFinancialAuthorizations = ReturnType<typeof subjectFinancialAuthorizations>;
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
+}
 
 interface PaginationOptions {
     skip?: number;
@@ -620,12 +598,12 @@ declare class AuthyonClient {
         };
     };
     /**
-     * Transaction-bound approvals created by your backend
-     * (`@authyon/server` → `environment.financialAuthorizations.create`).
-     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
      * authenticator code or passkey, or `reject()`.
      */
-    readonly financialAuthorizations: SubjectFinancialAuthorizations;
+    readonly security: SubjectSecurity;
     /**
      * POST /auth/introspect — lightweight token introspection (RFC 7662).
      *
@@ -750,4 +728,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { type User as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmFinancialAuthorizationInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type TwoFactorChallenge as Y, type TwoFactorMethod as Z, type TwoFactorStatus as _, type HttpLoggerOptions as a, type ValidateResult as a0, type VerifyTwoFactorInput as a1, type WebAuthnAssertion as a2, type WebAuthnCeremonyStart as a3, type WebAuthnCredential as a4, createAuthyonAbility as a5, createAuthyonRules as a6, createClient as a7, hasPermission as a8, hasPermissionGroup as a9, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type CreateOrganizationInput as r, type FinancialAssurance as s, type FinancialAuthorization as t, type FinancialAuthorizationStatus as u, type FinancialTransaction as v, type FinancialWebAuthnOptions as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };
+export { type TwoFactorMethod as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmApprovalInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type SubjectApprovals as Y, type SubjectSecurity as Z, type TwoFactorChallenge as _, type HttpLoggerOptions as a, type TwoFactorStatus as a0, type User as a1, type ValidateResult as a2, type VerifyTwoFactorInput as a3, type WebAuthnAssertion as a4, type WebAuthnCeremonyStart as a5, type WebAuthnCredential as a6, createAuthyonAbility as a7, createAuthyonRules as a8, createClient as a9, hasPermission as aa, hasPermissionGroup as ab, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type Approval as h, type ApprovalAssurance as i, type ApprovalPayload as j, type ApprovalStatus as k, type ApprovalWebAuthnOptions as l, type AuthEvent as m, type AuthState as n, type AuthStateListener as o, type AuthenticatorSetup as p, AuthyonAbility as q, AuthyonAbilityBuilder as r, type AuthyonAbilityOptions as s, type AuthyonClientOptions as t, type AuthyonPermissionSource as u, AuthyonSessionController as v, type CreateOrganizationInput as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };

package/dist/{ability-DbnbsQEX.d.ts → ability-5_xXXbDF.d.ts}

@@ -1,24 +1,13 @@
-/** Lifecycle of a transaction-bound financial authorization. */
-type FinancialAuthorizationStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
 /**
- * The transaction the customer approves. The API hashes a canonical form of
- * these fields; `consume()` must resend exactly the same values (amount is
- * normalized to four decimal places, metadata keys are sorted).
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
  */
-interface FinancialTransaction {
-    /** Business action, e.g. `"pix.transfer"`. Max 100 characters. */
-    action: string;
-    /** Positive amount, up to 15 integer digits and 4 decimal places. */
-    amount: number;
-    /** ISO 4217 currency code, e.g. `"BRL"`. */
-    currency: string;
-    /** Human-readable beneficiary shown to the customer. Max 256 characters. */
-    beneficiary: string;
-    /** Optional JSON object bound into the hash (max 16 KiB). */
-    metadata?: Record<string, unknown>;
-}
+type ApprovalPayload = Record<string, unknown>;
 /** Evidence of how the customer proved their identity when approving. */
-interface FinancialAssurance {
+interface ApprovalAssurance {
     /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
     acr: string;
     /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
@@ -26,28 +15,25 @@ interface FinancialAssurance {
     /** When the second factor was verified (ISO 8601). */
     authTime: string;
 }
-interface FinancialAuthorization {
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
     id: string;
-    status: FinancialAuthorizationStatus;
+    status: ApprovalStatus;
     subjectId: string;
     tenantId?: string | null;
-    action: string;
-    amount: number;
-    currency: string;
-    beneficiary: string;
-    /** SHA-256 (hex) of the canonical transaction. */
-    transactionHash: string;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
     createdAt: string;
     expiresAt: string;
     decidedAt?: string | null;
     consumedAt?: string | null;
-    /** Full canonical transaction — returned only to the customer (subject) view. */
-    transaction?: FinancialTransaction | null;
     /** Present once approved. */
-    assurance?: FinancialAssurance | null;
+    assurance?: ApprovalAssurance | null;
 }
-/** Inline second factor sent with `confirm()`. */
-type ConfirmFinancialAuthorizationInput = {
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
     method: "authenticator";
     /** Six-digit code from the customer's authenticator app. */
     code: string;
@@ -60,15 +46,13 @@ type ConfirmFinancialAuthorizationInput = {
         assertionJson: string;
     };
 };
-/** Passkey assertion options for approving one authorization. */
-interface FinancialWebAuthnOptions {
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
     ceremonyToken: string;
     /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
     optionsJson: string;
 }
 
-type QueryParams = object;
-
 interface HttpAdapterRequest {
     url: string;
     method: string;
@@ -126,35 +110,29 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
-type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-interface JsonRequestOptions {
-    method?: HttpMethod;
-    body?: unknown;
-    query?: QueryParams;
-    headers?: Record<string, string>;
-}
-
-/** Sends a request already authenticated as the customer (end-user bearer). */
-type SubjectRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
-/** Customer-side operations on a financial authorization (`/auth/authorizations`). */
-declare function subjectFinancialAuthorizations(request: SubjectRequest): {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id: string) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id: string) => Promise<FinancialWebAuthnOptions>;
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
     /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     * POST /auth/authorizations/{id}/confirm — approves it.
      *
      * Pass the authenticator code or passkey assertion to verify the second
      * factor inline (recommended). Without `input`, the session itself must
      * have used a passkey or authenticator code within the last 5 minutes,
      * otherwise the API answers `step_up_required`.
      */
-    confirm: (id: string, input?: ConfirmFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id: string) => Promise<FinancialAuthorization>;
-};
-type SubjectFinancialAuthorizations = ReturnType<typeof subjectFinancialAuthorizations>;
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
+}
 
 interface PaginationOptions {
     skip?: number;
@@ -620,12 +598,12 @@ declare class AuthyonClient {
         };
     };
     /**
-     * Transaction-bound approvals created by your backend
-     * (`@authyon/server` → `environment.financialAuthorizations.create`).
-     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
      * authenticator code or passkey, or `reject()`.
      */
-    readonly financialAuthorizations: SubjectFinancialAuthorizations;
+    readonly security: SubjectSecurity;
     /**
      * POST /auth/introspect — lightweight token introspection (RFC 7662).
      *
@@ -750,4 +728,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { type User as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmFinancialAuthorizationInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type TwoFactorChallenge as Y, type TwoFactorMethod as Z, type TwoFactorStatus as _, type HttpLoggerOptions as a, type ValidateResult as a0, type VerifyTwoFactorInput as a1, type WebAuthnAssertion as a2, type WebAuthnCeremonyStart as a3, type WebAuthnCredential as a4, createAuthyonAbility as a5, createAuthyonRules as a6, createClient as a7, hasPermission as a8, hasPermissionGroup as a9, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type CreateOrganizationInput as r, type FinancialAssurance as s, type FinancialAuthorization as t, type FinancialAuthorizationStatus as u, type FinancialTransaction as v, type FinancialWebAuthnOptions as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };
+export { type TwoFactorMethod as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmApprovalInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type SubjectApprovals as Y, type SubjectSecurity as Z, type TwoFactorChallenge as _, type HttpLoggerOptions as a, type TwoFactorStatus as a0, type User as a1, type ValidateResult as a2, type VerifyTwoFactorInput as a3, type WebAuthnAssertion as a4, type WebAuthnCeremonyStart as a5, type WebAuthnCredential as a6, createAuthyonAbility as a7, createAuthyonRules as a8, createClient as a9, hasPermission as aa, hasPermissionGroup as ab, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type Approval as h, type ApprovalAssurance as i, type ApprovalPayload as j, type ApprovalStatus as k, type ApprovalWebAuthnOptions as l, type AuthEvent as m, type AuthState as n, type AuthStateListener as o, type AuthenticatorSetup as p, AuthyonAbility as q, AuthyonAbilityBuilder as r, type AuthyonAbilityOptions as s, type AuthyonClientOptions as t, type AuthyonPermissionSource as u, AuthyonSessionController as v, type CreateOrganizationInput as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };

package/dist/index.cjs

@@ -40,29 +40,20 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
-// ../../internal/core/financial/subjectFinancialAuthorizations.ts
+// ../../internal/core/security/approvals.ts
 function path(id, suffix = "") {
   if (typeof id !== "string" || !id.trim())
-    throw new TypeError("Authyon: a financial authorization id is required.");
+    throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
-function subjectFinancialAuthorizations(request) {
+function subjectSecurity(request) {
   return {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id) => request(path(id)),
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
-    /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
-     *
-     * Pass the authenticator code or passkey assertion to verify the second
-     * factor inline (recommended). Without `input`, the session itself must
-     * have used a passkey or authenticator code within the last 5 minutes,
-     * otherwise the API answers `step_up_required`.
-     */
-    confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
   };
 }
 
@@ -83,10 +74,17 @@ var ErrorCodes = {
   InvalidSecondFactorCode: "invalid_code",
   VerificationAttemptsExhausted: "verification_attempts_exhausted",
   MethodNotEnrolled: "method_not_enrolled",
-  InvalidAuthorizationState: "invalid_authorization_state",
-  TransactionMismatch: "transaction_mismatch",
-  AuthorizationNotConsumable: "authorization_not_consumable",
-  IdempotencyConflict: "idempotency_conflict"
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
 var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
   "type",
@@ -687,14 +685,14 @@ var AuthyonClient = class {
         })
       }
     };
-    // ── Financial step-up (customer side) ────────────────────────────────────
+    // ── Security (customer side) ─────────────────────────────────────────────
     /**
-     * Transaction-bound approvals created by your backend
-     * (`@authyon/server` → `environment.financialAuthorizations.create`).
-     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
      * authenticator code or passkey, or `reject()`.
      */
-    this.financialAuthorizations = subjectFinancialAuthorizations(
+    this.security = subjectSecurity(
       (path2, options) => this.request(path2, { ...options, bearer: true })
     );
     if (!options.envKey)

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-DbnbsQEX.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as ConfirmFinancialAuthorizationInput, r as CreateOrganizationInput, F as FetchHttpAdapter, s as FinancialAssurance, t as FinancialAuthorization, u as FinancialAuthorizationStatus, v as FinancialTransaction, w as FinancialWebAuthnOptions, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as TwoFactorChallenge, Z as TwoFactorMethod, _ as TwoFactorStatus, $ as User, a0 as ValidateResult, a1 as VerifyTwoFactorInput, a2 as WebAuthnAssertion, a3 as WebAuthnCeremonyStart, a4 as WebAuthnCredential, a5 as createAuthyonAbility, a6 as createAuthyonRules, a7 as createClient, a8 as hasPermission, a9 as hasPermissionGroup } from './ability-DbnbsQEX.cjs';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-5_xXXbDF.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as Approval, i as ApprovalAssurance, j as ApprovalPayload, k as ApprovalStatus, l as ApprovalWebAuthnOptions, m as AuthEvent, n as AuthState, o as AuthStateListener, p as AuthenticatorSetup, q as AuthyonAbility, r as AuthyonAbilityBuilder, s as AuthyonAbilityOptions, t as AuthyonClientOptions, u as AuthyonPermissionSource, v as AuthyonSessionController, C as ConfirmApprovalInput, w as CreateOrganizationInput, F as FetchHttpAdapter, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as SubjectApprovals, Z as SubjectSecurity, _ as TwoFactorChallenge, $ as TwoFactorMethod, a0 as TwoFactorStatus, a1 as User, a2 as ValidateResult, a3 as VerifyTwoFactorInput, a4 as WebAuthnAssertion, a5 as WebAuthnCeremonyStart, a6 as WebAuthnCredential, a7 as createAuthyonAbility, a8 as createAuthyonRules, a9 as createClient, aa as hasPermission, ab as hasPermissionGroup } from './ability-5_xXXbDF.cjs';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -17,10 +17,17 @@ declare const ErrorCodes: {
     readonly InvalidSecondFactorCode: "invalid_code";
     readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
     readonly MethodNotEnrolled: "method_not_enrolled";
-    readonly InvalidAuthorizationState: "invalid_authorization_state";
-    readonly TransactionMismatch: "transaction_mismatch";
-    readonly AuthorizationNotConsumable: "authorization_not_consumable";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
     readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-DbnbsQEX.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as ConfirmFinancialAuthorizationInput, r as CreateOrganizationInput, F as FetchHttpAdapter, s as FinancialAssurance, t as FinancialAuthorization, u as FinancialAuthorizationStatus, v as FinancialTransaction, w as FinancialWebAuthnOptions, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as TwoFactorChallenge, Z as TwoFactorMethod, _ as TwoFactorStatus, $ as User, a0 as ValidateResult, a1 as VerifyTwoFactorInput, a2 as WebAuthnAssertion, a3 as WebAuthnCeremonyStart, a4 as WebAuthnCredential, a5 as createAuthyonAbility, a6 as createAuthyonRules, a7 as createClient, a8 as hasPermission, a9 as hasPermissionGroup } from './ability-DbnbsQEX.js';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-5_xXXbDF.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as Approval, i as ApprovalAssurance, j as ApprovalPayload, k as ApprovalStatus, l as ApprovalWebAuthnOptions, m as AuthEvent, n as AuthState, o as AuthStateListener, p as AuthenticatorSetup, q as AuthyonAbility, r as AuthyonAbilityBuilder, s as AuthyonAbilityOptions, t as AuthyonClientOptions, u as AuthyonPermissionSource, v as AuthyonSessionController, C as ConfirmApprovalInput, w as CreateOrganizationInput, F as FetchHttpAdapter, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as SubjectApprovals, Z as SubjectSecurity, _ as TwoFactorChallenge, $ as TwoFactorMethod, a0 as TwoFactorStatus, a1 as User, a2 as ValidateResult, a3 as VerifyTwoFactorInput, a4 as WebAuthnAssertion, a5 as WebAuthnCeremonyStart, a6 as WebAuthnCredential, a7 as createAuthyonAbility, a8 as createAuthyonRules, a9 as createClient, aa as hasPermission, ab as hasPermissionGroup } from './ability-5_xXXbDF.js';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -17,10 +17,17 @@ declare const ErrorCodes: {
     readonly InvalidSecondFactorCode: "invalid_code";
     readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
     readonly MethodNotEnrolled: "method_not_enrolled";
-    readonly InvalidAuthorizationState: "invalid_authorization_state";
-    readonly TransactionMismatch: "transaction_mismatch";
-    readonly AuthorizationNotConsumable: "authorization_not_consumable";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
     readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";

package/dist/index.js

@@ -8,29 +8,20 @@ import {
   hasPermissionGroup
 } from "./chunk-3XJY6BCI.js";
 
-// ../../internal/core/financial/subjectFinancialAuthorizations.ts
+// ../../internal/core/security/approvals.ts
 function path(id, suffix = "") {
   if (typeof id !== "string" || !id.trim())
-    throw new TypeError("Authyon: a financial authorization id is required.");
+    throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
-function subjectFinancialAuthorizations(request) {
+function subjectSecurity(request) {
   return {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id) => request(path(id)),
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
-    /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
-     *
-     * Pass the authenticator code or passkey assertion to verify the second
-     * factor inline (recommended). Without `input`, the session itself must
-     * have used a passkey or authenticator code within the last 5 minutes,
-     * otherwise the API answers `step_up_required`.
-     */
-    confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
   };
 }
 
@@ -51,10 +42,17 @@ var ErrorCodes = {
   InvalidSecondFactorCode: "invalid_code",
   VerificationAttemptsExhausted: "verification_attempts_exhausted",
   MethodNotEnrolled: "method_not_enrolled",
-  InvalidAuthorizationState: "invalid_authorization_state",
-  TransactionMismatch: "transaction_mismatch",
-  AuthorizationNotConsumable: "authorization_not_consumable",
-  IdempotencyConflict: "idempotency_conflict"
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
 var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
   "type",
@@ -655,14 +653,14 @@ var AuthyonClient = class {
         })
       }
     };
-    // ── Financial step-up (customer side) ────────────────────────────────────
+    // ── Security (customer side) ─────────────────────────────────────────────
     /**
-     * Transaction-bound approvals created by your backend
-     * (`@authyon/server` → `environment.financialAuthorizations.create`).
-     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
      * authenticator code or passkey, or `reject()`.
      */
-    this.financialAuthorizations = subjectFinancialAuthorizations(
+    this.security = subjectSecurity(
       (path2, options) => this.request(path2, { ...options, bearer: true })
     );
     if (!options.envKey)

package/dist/react/index.d.cts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { $ as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-DbnbsQEX.cjs';
-export { q as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-DbnbsQEX.cjs';
+import { a1 as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, s as AuthyonAbilityOptions, q as AuthyonAbility } from '../ability-5_xXXbDF.cjs';
+export { v as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-5_xXXbDF.cjs';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { $ as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-DbnbsQEX.js';
-export { q as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-DbnbsQEX.js';
+import { a1 as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, s as AuthyonAbilityOptions, q as AuthyonAbility } from '../ability-5_xXXbDF.js';
+export { v as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-5_xXXbDF.js';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.2.0-beta.14",
+  "version": "0.2.0-beta.15",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",