@authyon/auth 0.2.0-beta.14 → 0.2.0-beta.16

package/README.md

@@ -227,18 +227,34 @@ Métodos de sessão/auth ficam soltos no client; os que giram em torno de um rec
 
 ### `authyon.organization`
 
-| Método                                                | Endpoint                                       |
-| ----------------------------------------------------- | ---------------------------------------------- |
-| `organization.list({ search?, skip?, take? })`        | `GET /auth/tenants`                            |
-| `organization.create(params?)`                        | `POST /auth/tenants`                           |
-| `organization.get(organizationId)`                    | `GET /auth/tenants/{id}`                       |
-| `organization.rename(organizationId, name)`           | `PATCH /auth/tenants/{id}`                     |
-| `organization.switch(slug)`                           | `POST /auth/switch-tenant`                     |
-| `organization.current()`                              | — (lê `activeOrganization` da sessão em cache) |
-| `organization.members.list(organizationId, params?)`  | `GET /auth/tenants/{id}/members`               |
-| `organization.members.invite(organizationId, params)` | `POST /auth/tenants/{id}/members`              |
-| `organization.members.remove(organizationId, userId)` | `DELETE /auth/tenants/{id}/members/{userId}`   |
-| `organization.roles.list(organizationId)`             | `GET /auth/tenants/{id}/roles`                 |
+| Método                                                           | Endpoint                                            |
+| ---------------------------------------------------------------- | --------------------------------------------------- |
+| `organization.list({ search?, skip?, take? })`                   | `GET /auth/tenants`                                 |
+| `organization.create(params?)`                                   | `POST /auth/tenants`                                |
+| `organization.get(organizationId)`                               | `GET /auth/tenants/{id}`                            |
+| `organization.rename(organizationId, name)`                      | `PATCH /auth/tenants/{id}`                          |
+| `organization.switch(slug)`                                      | `POST /auth/switch-tenant`                          |
+| `organization.current()`                                         | — (lê `activeOrganization` da sessão em cache)      |
+| `organization.members.list(organizationId, params?)`             | `GET /auth/tenants/{id}/members`                    |
+| `organization.members.invite(organizationId, params)`            | `POST /auth/tenants/{id}/members`                   |
+| `organization.members.remove(organizationId, userId)`            | `DELETE /auth/tenants/{id}/members/{userId}`        |
+| `organization.roles.list(organizationId)`                        | `GET /auth/tenants/{id}/roles`                      |
+| `organization.invites.list(organizationId)`                      | `GET /auth/tenants/{id}/invites`                    |
+| `organization.invites.create(organizationId, params)`            | `POST /auth/tenants/{id}/invites`                   |
+| `organization.invites.resend(organizationId, inviteId, params?)` | `POST /auth/tenants/{id}/invites/{inviteId}/resend` |
+| `organization.invites.revoke(organizationId, inviteId)`          | `DELETE /auth/tenants/{id}/invites/{inviteId}`      |
+| `organization.invites.preview(token)`                            | `POST /auth/tenant-invites/preview` (público)       |
+| `organization.invites.accept(params)`                            | `POST /auth/tenant-invites/accept` (público)        |
+
+`organization.members.invite` adiciona um usuário que já existe no ambiente. Para convidar
+um e-mail que talvez ainda não tenha conta, use `organization.invites.create`: a resposta
+sempre traz o `acceptUrl` completo e `sendEmail: false` só gera o link, sem enviar e-mail.
+O link vale 7 dias, uma única vez, e não pode ser lido de novo depois. Na página de aceite,
+leia o `token` da URL, chame `preview(token)` e, se `accountExists` for falso, peça senha
+(e usuário quando `usernameRequired`) antes de `accept`. Aceitar não faz login.
+Passe `redirectUri` no `create` para indicar para onde mandar a pessoa depois do aceite: ele
+precisa estar cadastrado (match exato) nos redirect URIs do ambiente e volta em `preview` e
+`accept` — a página hospedada da Authyon redireciona sozinha; numa página própria, é com você.
 
 ### `authyon.twoFactor`
 
@@ -273,26 +289,29 @@ Métodos de sessão/auth ficam soltos no client; os que giram em torno de um rec
 | `sso.startUrl(provider, params)` | monta a URL de `GET /auth/sso/{provider}/start` (não faz a chamada — navegue até ela) |
 | `sso.exchange(code)`             | `POST /auth/sso/exchange`                                                             |
 
-### `authyon.financialAuthorizations` (confirmação de transações)
+### `authyon.security` (aprovação com OTP/passkey)
 
-O cliente aprova uma transação criada pelo seu backend com o código do app autenticador
-ou a passkey. Guia completo: [`docs/financialStepUp.md`](../../docs/financialStepUp.md).
+`security.approvals`: o cliente aprova o que o seu backend pediu
+(`@authyon/server` → `security.approvals.create`, com um `payload` livre) usando o código
+do app autenticador ou a passkey. Para só validar um código, use `security.otp.check` no
+`@authyon/server`. Guia completo: [`docs/security-otp-approvals.md`](../../docs/security-otp-approvals.md).
 
 ```ts
-const pending = await authyon.financialAuthorizations.get(authorizationId);
-// mostre pending.amount, pending.currency e pending.beneficiary ao cliente
-await authyon.financialAuthorizations.confirm(authorizationId, {
+const pending = await authyon.security.approvals.get(approvalId);
+// mostre pending.payload ao cliente
+await authyon.security.approvals.confirm(approvalId, {
   method: "authenticator",
   code: "123456",
 });
 ```
 
-| Método                                        | Endpoint                                          |
-| --------------------------------------------- | ------------------------------------------------- |
-| `financialAuthorizations.get(id)`             | `GET /auth/authorizations/{id}`                   |
-| `financialAuthorizations.webauthnOptions(id)` | `POST /auth/authorizations/{id}/webauthn/options` |
-| `financialAuthorizations.confirm(id, input?)` | `POST /auth/authorizations/{id}/confirm`          |
-| `financialAuthorizations.reject(id)`          | `POST /auth/authorizations/{id}/reject`           |
+| Método                                   | Endpoint                                          |
+| ---------------------------------------- | ------------------------------------------------- |
+| `security.methods()`                     | `GET /auth/me` (campo `security`)                 |
+| `security.approvals.get(id)`             | `GET /auth/authorizations/{id}`                   |
+| `security.approvals.webauthnOptions(id)` | `POST /auth/authorizations/{id}/webauthn/options` |
+| `security.approvals.confirm(id, input?)` | `POST /auth/authorizations/{id}/confirm`          |
+| `security.approvals.reject(id)`          | `POST /auth/authorizations/{id}/reject`           |
 
 ## Invalidação de token
 

package/dist/{ability-DbnbsQEX.d.cts → ability-Cp8ir5Gr.d.cts}

@@ -1,24 +1,34 @@
-/** Lifecycle of a transaction-bound financial authorization. */
-type FinancialAuthorizationStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
 /**
- * The transaction the customer approves. The API hashes a canonical form of
- * these fields; `consume()` must resend exactly the same values (amount is
- * normalized to four decimal places, metadata keys are sorted).
+ * Security methods active on the user's account, as returned in the
+ * `security` field of `GET /auth/me` and `POST /auth/validate`.
  */
-interface FinancialTransaction {
-    /** Business action, e.g. `"pix.transfer"`. Max 100 characters. */
-    action: string;
-    /** Positive amount, up to 15 integer digits and 4 decimal places. */
-    amount: number;
-    /** ISO 4217 currency code, e.g. `"BRL"`. */
-    currency: string;
-    /** Human-readable beneficiary shown to the customer. Max 256 characters. */
-    beneficiary: string;
-    /** Optional JSON object bound into the hash (max 16 KiB). */
-    metadata?: Record<string, unknown>;
-}
+interface SecurityMethods {
+    /** A password is set (false for accounts created only through SSO or magic link). */
+    password: boolean;
+    /** Authenticator app (TOTP one-time codes). */
+    authenticator: boolean;
+    /** One-time codes sent by email. */
+    emailCode: boolean;
+    /** At least one passkey registered. */
+    passkey: boolean;
+    passkeyCount: number;
+    /** Unused recovery codes left. */
+    recoveryCodes: number;
+    /** SSO providers linked to the account, e.g. `["google", "github"]`. */
+    sso: string[];
+    /** Any second factor is active (authenticator, email code or passkey). */
+    twoFactor: boolean;
+}
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
+ */
+type ApprovalPayload = Record<string, unknown>;
 /** Evidence of how the customer proved their identity when approving. */
-interface FinancialAssurance {
+interface ApprovalAssurance {
     /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
     acr: string;
     /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
@@ -26,28 +36,25 @@ interface FinancialAssurance {
     /** When the second factor was verified (ISO 8601). */
     authTime: string;
 }
-interface FinancialAuthorization {
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
     id: string;
-    status: FinancialAuthorizationStatus;
+    status: ApprovalStatus;
     subjectId: string;
     tenantId?: string | null;
-    action: string;
-    amount: number;
-    currency: string;
-    beneficiary: string;
-    /** SHA-256 (hex) of the canonical transaction. */
-    transactionHash: string;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
     createdAt: string;
     expiresAt: string;
     decidedAt?: string | null;
     consumedAt?: string | null;
-    /** Full canonical transaction — returned only to the customer (subject) view. */
-    transaction?: FinancialTransaction | null;
     /** Present once approved. */
-    assurance?: FinancialAssurance | null;
+    assurance?: ApprovalAssurance | null;
 }
-/** Inline second factor sent with `confirm()`. */
-type ConfirmFinancialAuthorizationInput = {
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
     method: "authenticator";
     /** Six-digit code from the customer's authenticator app. */
     code: string;
@@ -60,15 +67,13 @@ type ConfirmFinancialAuthorizationInput = {
         assertionJson: string;
     };
 };
-/** Passkey assertion options for approving one authorization. */
-interface FinancialWebAuthnOptions {
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
     ceremonyToken: string;
     /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
     optionsJson: string;
 }
 
-type QueryParams = object;
-
 interface HttpAdapterRequest {
     url: string;
     method: string;
@@ -126,35 +131,34 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
-type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-interface JsonRequestOptions {
-    method?: HttpMethod;
-    body?: unknown;
-    query?: QueryParams;
-    headers?: Record<string, string>;
-}
-
-/** Sends a request already authenticated as the customer (end-user bearer). */
-type SubjectRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
-/** Customer-side operations on a financial authorization (`/auth/authorizations`). */
-declare function subjectFinancialAuthorizations(request: SubjectRequest): {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id: string) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id: string) => Promise<FinancialWebAuthnOptions>;
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
     /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     * POST /auth/authorizations/{id}/confirm — approves it.
      *
      * Pass the authenticator code or passkey assertion to verify the second
      * factor inline (recommended). Without `input`, the session itself must
      * have used a passkey or authenticator code within the last 5 minutes,
      * otherwise the API answers `step_up_required`.
      */
-    confirm: (id: string, input?: ConfirmFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id: string) => Promise<FinancialAuthorization>;
-};
-type SubjectFinancialAuthorizations = ReturnType<typeof subjectFinancialAuthorizations>;
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /**
+     * GET /auth/me — which security methods the signed-in user has active
+     * (password, authenticator, email code, passkeys, recovery codes, SSO).
+     */
+    methods(): Promise<SecurityMethods>;
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
+}
 
 interface PaginationOptions {
     skip?: number;
@@ -220,6 +224,86 @@ interface InviteMemberInput {
     email: string;
     roles: string[];
 }
+/**
+ * POST /auth/tenants/{organizationId}/invites — invite an address that may not
+ * have an account yet; accepting creates it. `sendEmail` defaults to `true`;
+ * `false` only returns the link, for delivery through your own channel.
+ */
+interface OrganizationInviteInput {
+    email: string;
+    roles?: string[];
+    sendEmail?: boolean;
+    /**
+     * Where to send the invitee after they accept. Must be registered exactly in
+     * the environment's redirect URIs (the same list SSO and magic link use);
+     * otherwise the API rejects the invite. Comes back on `preview` and `accept`.
+     */
+    redirectUri?: string;
+}
+/** Returned when an invite is created or re-issued. `acceptUrl` is only ever
+ *  readable here — the API keeps a hash of the token, not the token. */
+interface OrganizationInviteIssued {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    acceptUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+type OrganizationInviteStatus = "pending" | "accepted" | "revoked" | "expired";
+interface OrganizationInvite {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    status: OrganizationInviteStatus;
+    createdAt: string;
+    expiresAt: string;
+    emailSentAt: string | null;
+    acceptedAt: string | null;
+    acceptedByUserId: string | null;
+    revokedAt: string | null;
+    invitedByUserId: string | null;
+    redirectUri: string | null;
+}
+/** POST /auth/tenant-invites/preview — what an accept page shows before the invitee commits. */
+interface OrganizationInvitePreview {
+    tenantId: string;
+    tenantName: string;
+    email: string;
+    roles: string[];
+    expiresAt: string;
+    /** True: accepting only needs the token. False: send a password (and a username when `usernameRequired`). */
+    accountExists: boolean;
+    usernameRequired: boolean;
+    /** Where the issuer asked to send the invitee after accepting, or `null`. */
+    redirectUri: string | null;
+}
+/** POST /auth/tenant-invites/accept — everything but `token` is ignored when the address already has an account. */
+interface AcceptOrganizationInviteInput {
+    token: string;
+    username?: string;
+    password?: string;
+    firstName?: string;
+    lastName?: string;
+    /**
+     * @deprecated Use `publicMetadata` / `privateMetadata` through
+     * `@authyon/server` (`environment.tenants.invites.accept`), which runs on
+     * your backend with the environment credential. Still accepted for now.
+     */
+    customFields?: Record<string, unknown>;
+}
+interface OrganizationInviteAccepted {
+    tenantId: string;
+    tenantName: string;
+    userId: string;
+    /** True when accepting created the account (email already confirmed). The invitee still signs in normally. */
+    accountCreated: boolean;
+    /** Where the issuer asked to send the invitee, or `null`. Redirecting is up to the accept page. */
+    redirectUri: string | null;
+}
 /** Authenticated user profile. */
 interface User {
     id: string;
@@ -236,6 +320,8 @@ interface User {
     activeOrganization?: Organization | null;
     /** Actions the user must complete before continuing (e.g. confirm e-mail). */
     pendencies?: string[];
+    /** Security methods active on the account (authenticator, email code, passkey, SSO…). */
+    security?: SecurityMethods;
 }
 /** Token pair issued by login / refresh / tenant switch. */
 interface Session {
@@ -565,11 +651,53 @@ declare class AuthyonClient {
              * (`user.activities()`, `@authyon/server`'s `environment.users.list()`).
              */
             list: (organizationId: string, params?: PaginationOptions) => Promise<Paged<OrganizationMember>>;
-            /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+            /**
+             * POST /auth/tenants/{organizationId}/members — add an existing
+             * environment user by e-mail (no e-mail is sent). To invite an address
+             * that may not have an account yet, use `organization.invites.create`.
+             */
             invite: (organizationId: string, params: InviteMemberInput) => Promise<void>;
             /** DELETE /auth/tenants/{organizationId}/members/{userId} — remove a member. */
             remove: (organizationId: string, userId: string) => Promise<void>;
         };
+        /**
+         * Invites by e-mail or by link. Managing them requires the
+         * `tenants:members:invite` permission on the organization; `preview` and
+         * `accept` are public — the token in the link is the credential.
+         */
+        invites: {
+            /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+            list: (organizationId: string) => Promise<OrganizationInvite[]>;
+            /**
+             * POST /auth/tenants/{organizationId}/invites — invite an address.
+             * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+             * mail it and you deliver the link yourself. The link is valid for 7
+             * days, once, and can't be read again later.
+             */
+            create: (organizationId: string, params: OrganizationInviteInput) => Promise<OrganizationInviteIssued>;
+            /**
+             * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+             * a new link (the previous one stops working), mailing it unless
+             * `sendEmail` is `false`.
+             */
+            resend: (organizationId: string, inviteId: string, params?: {
+                sendEmail?: boolean;
+            }) => Promise<OrganizationInviteIssued>;
+            /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+            revoke: (organizationId: string, inviteId: string) => Promise<void>;
+            /**
+             * POST /auth/tenant-invites/preview — public. Read the `token` query
+             * parameter of the invite link and pick the form: one click when
+             * `accountExists`, sign-up otherwise.
+             */
+            preview: (token: string) => Promise<OrganizationInvitePreview>;
+            /**
+             * POST /auth/tenant-invites/accept — public. Joins the organization; for
+             * an address with no account, also creates it (password required) with
+             * the e-mail already confirmed. Does not sign the user in.
+             */
+            accept: (params: AcceptOrganizationInviteInput) => Promise<OrganizationInviteAccepted>;
+        };
         roles: {
             /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
             list: (organizationId: string) => Promise<Role[]>;
@@ -620,12 +748,12 @@ declare class AuthyonClient {
         };
     };
     /**
-     * Transaction-bound approvals created by your backend
-     * (`@authyon/server` → `environment.financialAuthorizations.create`).
-     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
      * authenticator code or passkey, or `reject()`.
      */
-    readonly financialAuthorizations: SubjectFinancialAuthorizations;
+    readonly security: SubjectSecurity;
     /**
      * POST /auth/introspect — lightweight token introspection (RFC 7662).
      *
@@ -750,4 +878,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { type User as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmFinancialAuthorizationInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type TwoFactorChallenge as Y, type TwoFactorMethod as Z, type TwoFactorStatus as _, type HttpLoggerOptions as a, type ValidateResult as a0, type VerifyTwoFactorInput as a1, type WebAuthnAssertion as a2, type WebAuthnCeremonyStart as a3, type WebAuthnCredential as a4, createAuthyonAbility as a5, createAuthyonRules as a6, createClient as a7, hasPermission as a8, hasPermissionGroup as a9, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type CreateOrganizationInput as r, type FinancialAssurance as s, type FinancialAuthorization as t, type FinancialAuthorizationStatus as u, type FinancialTransaction as v, type FinancialWebAuthnOptions as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };
+export { type SessionInfo as $, AuthyonClient as A, type HttpLogger as B, type ConfirmApprovalInput as C, type InviteMemberInput as D, type LoginInput as E, FetchHttpAdapter as F, type LoginResult as G, type HttpAdapter as H, type IntrospectResult as I, type OrganizationInvite as J, type OrganizationInviteAccepted as K, LoggingHttpAdapter as L, type OrganizationInviteInput as M, type OrganizationInviteIssued as N, type Organization as O, type OrganizationInvitePreview as P, type OrganizationInviteStatus as Q, type OrganizationMember as R, type Paged as S, type TokenStorage as T, type PaginationOptions as U, type PermissionGroup as V, type RegisterInput as W, type Role as X, type SecurityMethods as Y, type Session as Z, type SessionControllerOptions as _, type HttpLoggerOptions as a, type SessionSnapshot as a0, type SessionSnapshotListener as a1, type SessionStatus as a2, type SsoProvider as a3, type SubjectApprovals as a4, type SubjectSecurity as a5, type TwoFactorChallenge as a6, type TwoFactorMethod as a7, type TwoFactorStatus as a8, type User as a9, type ValidateResult as aa, type VerifyTwoFactorInput as ab, type WebAuthnAssertion as ac, type WebAuthnCeremonyStart as ad, type WebAuthnCredential as ae, createAuthyonAbility as af, createAuthyonRules as ag, createClient as ah, hasPermission as ai, hasPermissionGroup as aj, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type AcceptOrganizationInviteInput as g, type Activity as h, type Approval as i, type ApprovalAssurance as j, type ApprovalPayload as k, type ApprovalStatus as l, type ApprovalWebAuthnOptions as m, type AuthEvent as n, type AuthState as o, type AuthStateListener as p, type AuthenticatorSetup as q, AuthyonAbility as r, AuthyonAbilityBuilder as s, type AuthyonAbilityOptions as t, type AuthyonClientOptions as u, type AuthyonPermissionSource as v, AuthyonSessionController as w, type CreateOrganizationInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };

package/dist/{ability-DbnbsQEX.d.ts → ability-Cp8ir5Gr.d.ts}

@@ -1,24 +1,34 @@
-/** Lifecycle of a transaction-bound financial authorization. */
-type FinancialAuthorizationStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
 /**
- * The transaction the customer approves. The API hashes a canonical form of
- * these fields; `consume()` must resend exactly the same values (amount is
- * normalized to four decimal places, metadata keys are sorted).
+ * Security methods active on the user's account, as returned in the
+ * `security` field of `GET /auth/me` and `POST /auth/validate`.
  */
-interface FinancialTransaction {
-    /** Business action, e.g. `"pix.transfer"`. Max 100 characters. */
-    action: string;
-    /** Positive amount, up to 15 integer digits and 4 decimal places. */
-    amount: number;
-    /** ISO 4217 currency code, e.g. `"BRL"`. */
-    currency: string;
-    /** Human-readable beneficiary shown to the customer. Max 256 characters. */
-    beneficiary: string;
-    /** Optional JSON object bound into the hash (max 16 KiB). */
-    metadata?: Record<string, unknown>;
-}
+interface SecurityMethods {
+    /** A password is set (false for accounts created only through SSO or magic link). */
+    password: boolean;
+    /** Authenticator app (TOTP one-time codes). */
+    authenticator: boolean;
+    /** One-time codes sent by email. */
+    emailCode: boolean;
+    /** At least one passkey registered. */
+    passkey: boolean;
+    passkeyCount: number;
+    /** Unused recovery codes left. */
+    recoveryCodes: number;
+    /** SSO providers linked to the account, e.g. `["google", "github"]`. */
+    sso: string[];
+    /** Any second factor is active (authenticator, email code or passkey). */
+    twoFactor: boolean;
+}
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
+ */
+type ApprovalPayload = Record<string, unknown>;
 /** Evidence of how the customer proved their identity when approving. */
-interface FinancialAssurance {
+interface ApprovalAssurance {
     /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
     acr: string;
     /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
@@ -26,28 +36,25 @@ interface FinancialAssurance {
     /** When the second factor was verified (ISO 8601). */
     authTime: string;
 }
-interface FinancialAuthorization {
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
     id: string;
-    status: FinancialAuthorizationStatus;
+    status: ApprovalStatus;
     subjectId: string;
     tenantId?: string | null;
-    action: string;
-    amount: number;
-    currency: string;
-    beneficiary: string;
-    /** SHA-256 (hex) of the canonical transaction. */
-    transactionHash: string;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
     createdAt: string;
     expiresAt: string;
     decidedAt?: string | null;
     consumedAt?: string | null;
-    /** Full canonical transaction — returned only to the customer (subject) view. */
-    transaction?: FinancialTransaction | null;
     /** Present once approved. */
-    assurance?: FinancialAssurance | null;
+    assurance?: ApprovalAssurance | null;
 }
-/** Inline second factor sent with `confirm()`. */
-type ConfirmFinancialAuthorizationInput = {
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
     method: "authenticator";
     /** Six-digit code from the customer's authenticator app. */
     code: string;
@@ -60,15 +67,13 @@ type ConfirmFinancialAuthorizationInput = {
         assertionJson: string;
     };
 };
-/** Passkey assertion options for approving one authorization. */
-interface FinancialWebAuthnOptions {
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
     ceremonyToken: string;
     /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
     optionsJson: string;
 }
 
-type QueryParams = object;
-
 interface HttpAdapterRequest {
     url: string;
     method: string;
@@ -126,35 +131,34 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
-type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-interface JsonRequestOptions {
-    method?: HttpMethod;
-    body?: unknown;
-    query?: QueryParams;
-    headers?: Record<string, string>;
-}
-
-/** Sends a request already authenticated as the customer (end-user bearer). */
-type SubjectRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
-/** Customer-side operations on a financial authorization (`/auth/authorizations`). */
-declare function subjectFinancialAuthorizations(request: SubjectRequest): {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id: string) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id: string) => Promise<FinancialWebAuthnOptions>;
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
     /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     * POST /auth/authorizations/{id}/confirm — approves it.
      *
      * Pass the authenticator code or passkey assertion to verify the second
      * factor inline (recommended). Without `input`, the session itself must
      * have used a passkey or authenticator code within the last 5 minutes,
      * otherwise the API answers `step_up_required`.
      */
-    confirm: (id: string, input?: ConfirmFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id: string) => Promise<FinancialAuthorization>;
-};
-type SubjectFinancialAuthorizations = ReturnType<typeof subjectFinancialAuthorizations>;
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /**
+     * GET /auth/me — which security methods the signed-in user has active
+     * (password, authenticator, email code, passkeys, recovery codes, SSO).
+     */
+    methods(): Promise<SecurityMethods>;
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
+}
 
 interface PaginationOptions {
     skip?: number;
@@ -220,6 +224,86 @@ interface InviteMemberInput {
     email: string;
     roles: string[];
 }
+/**
+ * POST /auth/tenants/{organizationId}/invites — invite an address that may not
+ * have an account yet; accepting creates it. `sendEmail` defaults to `true`;
+ * `false` only returns the link, for delivery through your own channel.
+ */
+interface OrganizationInviteInput {
+    email: string;
+    roles?: string[];
+    sendEmail?: boolean;
+    /**
+     * Where to send the invitee after they accept. Must be registered exactly in
+     * the environment's redirect URIs (the same list SSO and magic link use);
+     * otherwise the API rejects the invite. Comes back on `preview` and `accept`.
+     */
+    redirectUri?: string;
+}
+/** Returned when an invite is created or re-issued. `acceptUrl` is only ever
+ *  readable here — the API keeps a hash of the token, not the token. */
+interface OrganizationInviteIssued {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    acceptUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+type OrganizationInviteStatus = "pending" | "accepted" | "revoked" | "expired";
+interface OrganizationInvite {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    status: OrganizationInviteStatus;
+    createdAt: string;
+    expiresAt: string;
+    emailSentAt: string | null;
+    acceptedAt: string | null;
+    acceptedByUserId: string | null;
+    revokedAt: string | null;
+    invitedByUserId: string | null;
+    redirectUri: string | null;
+}
+/** POST /auth/tenant-invites/preview — what an accept page shows before the invitee commits. */
+interface OrganizationInvitePreview {
+    tenantId: string;
+    tenantName: string;
+    email: string;
+    roles: string[];
+    expiresAt: string;
+    /** True: accepting only needs the token. False: send a password (and a username when `usernameRequired`). */
+    accountExists: boolean;
+    usernameRequired: boolean;
+    /** Where the issuer asked to send the invitee after accepting, or `null`. */
+    redirectUri: string | null;
+}
+/** POST /auth/tenant-invites/accept — everything but `token` is ignored when the address already has an account. */
+interface AcceptOrganizationInviteInput {
+    token: string;
+    username?: string;
+    password?: string;
+    firstName?: string;
+    lastName?: string;
+    /**
+     * @deprecated Use `publicMetadata` / `privateMetadata` through
+     * `@authyon/server` (`environment.tenants.invites.accept`), which runs on
+     * your backend with the environment credential. Still accepted for now.
+     */
+    customFields?: Record<string, unknown>;
+}
+interface OrganizationInviteAccepted {
+    tenantId: string;
+    tenantName: string;
+    userId: string;
+    /** True when accepting created the account (email already confirmed). The invitee still signs in normally. */
+    accountCreated: boolean;
+    /** Where the issuer asked to send the invitee, or `null`. Redirecting is up to the accept page. */
+    redirectUri: string | null;
+}
 /** Authenticated user profile. */
 interface User {
     id: string;
@@ -236,6 +320,8 @@ interface User {
     activeOrganization?: Organization | null;
     /** Actions the user must complete before continuing (e.g. confirm e-mail). */
     pendencies?: string[];
+    /** Security methods active on the account (authenticator, email code, passkey, SSO…). */
+    security?: SecurityMethods;
 }
 /** Token pair issued by login / refresh / tenant switch. */
 interface Session {
@@ -565,11 +651,53 @@ declare class AuthyonClient {
              * (`user.activities()`, `@authyon/server`'s `environment.users.list()`).
              */
             list: (organizationId: string, params?: PaginationOptions) => Promise<Paged<OrganizationMember>>;
-            /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+            /**
+             * POST /auth/tenants/{organizationId}/members — add an existing
+             * environment user by e-mail (no e-mail is sent). To invite an address
+             * that may not have an account yet, use `organization.invites.create`.
+             */
             invite: (organizationId: string, params: InviteMemberInput) => Promise<void>;
             /** DELETE /auth/tenants/{organizationId}/members/{userId} — remove a member. */
             remove: (organizationId: string, userId: string) => Promise<void>;
         };
+        /**
+         * Invites by e-mail or by link. Managing them requires the
+         * `tenants:members:invite` permission on the organization; `preview` and
+         * `accept` are public — the token in the link is the credential.
+         */
+        invites: {
+            /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+            list: (organizationId: string) => Promise<OrganizationInvite[]>;
+            /**
+             * POST /auth/tenants/{organizationId}/invites — invite an address.
+             * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+             * mail it and you deliver the link yourself. The link is valid for 7
+             * days, once, and can't be read again later.
+             */
+            create: (organizationId: string, params: OrganizationInviteInput) => Promise<OrganizationInviteIssued>;
+            /**
+             * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+             * a new link (the previous one stops working), mailing it unless
+             * `sendEmail` is `false`.
+             */
+            resend: (organizationId: string, inviteId: string, params?: {
+                sendEmail?: boolean;
+            }) => Promise<OrganizationInviteIssued>;
+            /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+            revoke: (organizationId: string, inviteId: string) => Promise<void>;
+            /**
+             * POST /auth/tenant-invites/preview — public. Read the `token` query
+             * parameter of the invite link and pick the form: one click when
+             * `accountExists`, sign-up otherwise.
+             */
+            preview: (token: string) => Promise<OrganizationInvitePreview>;
+            /**
+             * POST /auth/tenant-invites/accept — public. Joins the organization; for
+             * an address with no account, also creates it (password required) with
+             * the e-mail already confirmed. Does not sign the user in.
+             */
+            accept: (params: AcceptOrganizationInviteInput) => Promise<OrganizationInviteAccepted>;
+        };
         roles: {
             /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
             list: (organizationId: string) => Promise<Role[]>;
@@ -620,12 +748,12 @@ declare class AuthyonClient {
         };
     };
     /**
-     * Transaction-bound approvals created by your backend
-     * (`@authyon/server` → `environment.financialAuthorizations.create`).
-     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
      * authenticator code or passkey, or `reject()`.
      */
-    readonly financialAuthorizations: SubjectFinancialAuthorizations;
+    readonly security: SubjectSecurity;
     /**
      * POST /auth/introspect — lightweight token introspection (RFC 7662).
      *
@@ -750,4 +878,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { type User as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmFinancialAuthorizationInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type TwoFactorChallenge as Y, type TwoFactorMethod as Z, type TwoFactorStatus as _, type HttpLoggerOptions as a, type ValidateResult as a0, type VerifyTwoFactorInput as a1, type WebAuthnAssertion as a2, type WebAuthnCeremonyStart as a3, type WebAuthnCredential as a4, createAuthyonAbility as a5, createAuthyonRules as a6, createClient as a7, hasPermission as a8, hasPermissionGroup as a9, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type AuthEvent as h, type AuthState as i, type AuthStateListener as j, type AuthenticatorSetup as k, AuthyonAbility as l, AuthyonAbilityBuilder as m, type AuthyonAbilityOptions as n, type AuthyonClientOptions as o, type AuthyonPermissionSource as p, AuthyonSessionController as q, type CreateOrganizationInput as r, type FinancialAssurance as s, type FinancialAuthorization as t, type FinancialAuthorizationStatus as u, type FinancialTransaction as v, type FinancialWebAuthnOptions as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };
+export { type SessionInfo as $, AuthyonClient as A, type HttpLogger as B, type ConfirmApprovalInput as C, type InviteMemberInput as D, type LoginInput as E, FetchHttpAdapter as F, type LoginResult as G, type HttpAdapter as H, type IntrospectResult as I, type OrganizationInvite as J, type OrganizationInviteAccepted as K, LoggingHttpAdapter as L, type OrganizationInviteInput as M, type OrganizationInviteIssued as N, type Organization as O, type OrganizationInvitePreview as P, type OrganizationInviteStatus as Q, type OrganizationMember as R, type Paged as S, type TokenStorage as T, type PaginationOptions as U, type PermissionGroup as V, type RegisterInput as W, type Role as X, type SecurityMethods as Y, type Session as Z, type SessionControllerOptions as _, type HttpLoggerOptions as a, type SessionSnapshot as a0, type SessionSnapshotListener as a1, type SessionStatus as a2, type SsoProvider as a3, type SubjectApprovals as a4, type SubjectSecurity as a5, type TwoFactorChallenge as a6, type TwoFactorMethod as a7, type TwoFactorStatus as a8, type User as a9, type ValidateResult as aa, type VerifyTwoFactorInput as ab, type WebAuthnAssertion as ac, type WebAuthnCeremonyStart as ad, type WebAuthnCredential as ae, createAuthyonAbility as af, createAuthyonRules as ag, createClient as ah, hasPermission as ai, hasPermissionGroup as aj, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type AcceptOrganizationInviteInput as g, type Activity as h, type Approval as i, type ApprovalAssurance as j, type ApprovalPayload as k, type ApprovalStatus as l, type ApprovalWebAuthnOptions as m, type AuthEvent as n, type AuthState as o, type AuthStateListener as p, type AuthenticatorSetup as q, AuthyonAbility as r, AuthyonAbilityBuilder as s, type AuthyonAbilityOptions as t, type AuthyonClientOptions as u, type AuthyonPermissionSource as v, AuthyonSessionController as w, type CreateOrganizationInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };

package/dist/index.cjs

@@ -40,29 +40,34 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
-// ../../internal/core/financial/subjectFinancialAuthorizations.ts
+// ../../internal/core/security/approvals.ts
 function path(id, suffix = "") {
   if (typeof id !== "string" || !id.trim())
-    throw new TypeError("Authyon: a financial authorization id is required.");
+    throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
-function subjectFinancialAuthorizations(request) {
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
+function subjectSecurity(request) {
   return {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id) => request(path(id)),
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
-    /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
-     *
-     * Pass the authenticator code or passkey assertion to verify the second
-     * factor inline (recommended). Without `input`, the session itself must
-     * have used a passkey or authenticator code within the last 5 minutes,
-     * otherwise the API answers `step_up_required`.
-     */
-    confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
   };
 }
 
@@ -83,10 +88,18 @@ var ErrorCodes = {
   InvalidSecondFactorCode: "invalid_code",
   VerificationAttemptsExhausted: "verification_attempts_exhausted",
   MethodNotEnrolled: "method_not_enrolled",
-  InvalidAuthorizationState: "invalid_authorization_state",
-  TransactionMismatch: "transaction_mismatch",
-  AuthorizationNotConsumable: "authorization_not_consumable",
-  IdempotencyConflict: "idempotency_conflict"
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
 var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
   "type",
@@ -600,7 +613,11 @@ var AuthyonClient = class {
           appendQuery(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, params),
           { bearer: true }
         ),
-        /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+        /**
+         * POST /auth/tenants/{organizationId}/members — add an existing
+         * environment user by e-mail (no e-mail is sent). To invite an address
+         * that may not have an account yet, use `organization.invites.create`.
+         */
         invite: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, {
           method: "POST",
           bearer: true,
@@ -612,6 +629,59 @@ var AuthyonClient = class {
           { method: "DELETE", bearer: true }
         )
       },
+      /**
+       * Invites by e-mail or by link. Managing them requires the
+       * `tenants:members:invite` permission on the organization; `preview` and
+       * `accept` are public — the token in the link is the credential.
+       */
+      invites: {
+        /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+        list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          bearer: true
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites — invite an address.
+         * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+         * mail it and you deliver the link yourself. The link is valid for 7
+         * days, once, and can't be read again later.
+         */
+        create: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          method: "POST",
+          bearer: true,
+          body: {
+            email: params.email,
+            roles: params.roles,
+            sendEmail: params.sendEmail ?? true,
+            redirectUri: params.redirectUri
+          }
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+         * a new link (the previous one stops working), mailing it unless
+         * `sendEmail` is `false`.
+         */
+        resend: (organizationId, inviteId, params = {}) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+          { method: "POST", bearer: true, body: { sendEmail: params.sendEmail ?? true } }
+        ),
+        /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+        revoke: (organizationId, inviteId) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}`,
+          { method: "DELETE", bearer: true }
+        ),
+        /**
+         * POST /auth/tenant-invites/preview — public. Read the `token` query
+         * parameter of the invite link and pick the form: one click when
+         * `accountExists`, sign-up otherwise.
+         */
+        preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+        /**
+         * POST /auth/tenant-invites/accept — public. Joins the organization; for
+         * an address with no account, also creates it (password required) with
+         * the e-mail already confirmed. Does not sign the user in.
+         */
+        accept: (params) => this.request("/auth/tenant-invites/accept", { method: "POST", body: params })
+      },
       roles: {
         /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
         list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/roles`, {
@@ -687,14 +757,14 @@ var AuthyonClient = class {
         })
       }
     };
-    // ── Financial step-up (customer side) ────────────────────────────────────
+    // ── Security (customer side) ─────────────────────────────────────────────
     /**
-     * Transaction-bound approvals created by your backend
-     * (`@authyon/server` → `environment.financialAuthorizations.create`).
-     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
      * authenticator code or passkey, or `reject()`.
      */
-    this.financialAuthorizations = subjectFinancialAuthorizations(
+    this.security = subjectSecurity(
       (path2, options) => this.request(path2, { ...options, bearer: true })
     );
     if (!options.envKey)

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-DbnbsQEX.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as ConfirmFinancialAuthorizationInput, r as CreateOrganizationInput, F as FetchHttpAdapter, s as FinancialAssurance, t as FinancialAuthorization, u as FinancialAuthorizationStatus, v as FinancialTransaction, w as FinancialWebAuthnOptions, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as TwoFactorChallenge, Z as TwoFactorMethod, _ as TwoFactorStatus, $ as User, a0 as ValidateResult, a1 as VerifyTwoFactorInput, a2 as WebAuthnAssertion, a3 as WebAuthnCeremonyStart, a4 as WebAuthnCredential, a5 as createAuthyonAbility, a6 as createAuthyonRules, a7 as createClient, a8 as hasPermission, a9 as hasPermissionGroup } from './ability-DbnbsQEX.cjs';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-Cp8ir5Gr.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PermissionGroup, W as RegisterInput, X as Role, Y as SecurityMethods, Z as Session, _ as SessionControllerOptions, $ as SessionInfo, a0 as SessionSnapshot, a1 as SessionSnapshotListener, a2 as SessionStatus, a3 as SsoProvider, a4 as SubjectApprovals, a5 as SubjectSecurity, a6 as TwoFactorChallenge, a7 as TwoFactorMethod, a8 as TwoFactorStatus, a9 as User, aa as ValidateResult, ab as VerifyTwoFactorInput, ac as WebAuthnAssertion, ad as WebAuthnCeremonyStart, ae as WebAuthnCredential, af as createAuthyonAbility, ag as createAuthyonRules, ah as createClient, ai as hasPermission, aj as hasPermissionGroup } from './ability-Cp8ir5Gr.cjs';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -17,10 +17,18 @@ declare const ErrorCodes: {
     readonly InvalidSecondFactorCode: "invalid_code";
     readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
     readonly MethodNotEnrolled: "method_not_enrolled";
-    readonly InvalidAuthorizationState: "invalid_authorization_state";
-    readonly TransactionMismatch: "transaction_mismatch";
-    readonly AuthorizationNotConsumable: "authorization_not_consumable";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
     readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly CredentialThrottled: "credential_throttled";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-DbnbsQEX.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as ConfirmFinancialAuthorizationInput, r as CreateOrganizationInput, F as FetchHttpAdapter, s as FinancialAssurance, t as FinancialAuthorization, u as FinancialAuthorizationStatus, v as FinancialTransaction, w as FinancialWebAuthnOptions, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as TwoFactorChallenge, Z as TwoFactorMethod, _ as TwoFactorStatus, $ as User, a0 as ValidateResult, a1 as VerifyTwoFactorInput, a2 as WebAuthnAssertion, a3 as WebAuthnCeremonyStart, a4 as WebAuthnCredential, a5 as createAuthyonAbility, a6 as createAuthyonRules, a7 as createClient, a8 as hasPermission, a9 as hasPermissionGroup } from './ability-DbnbsQEX.js';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-Cp8ir5Gr.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PermissionGroup, W as RegisterInput, X as Role, Y as SecurityMethods, Z as Session, _ as SessionControllerOptions, $ as SessionInfo, a0 as SessionSnapshot, a1 as SessionSnapshotListener, a2 as SessionStatus, a3 as SsoProvider, a4 as SubjectApprovals, a5 as SubjectSecurity, a6 as TwoFactorChallenge, a7 as TwoFactorMethod, a8 as TwoFactorStatus, a9 as User, aa as ValidateResult, ab as VerifyTwoFactorInput, ac as WebAuthnAssertion, ad as WebAuthnCeremonyStart, ae as WebAuthnCredential, af as createAuthyonAbility, ag as createAuthyonRules, ah as createClient, ai as hasPermission, aj as hasPermissionGroup } from './ability-Cp8ir5Gr.js';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -17,10 +17,18 @@ declare const ErrorCodes: {
     readonly InvalidSecondFactorCode: "invalid_code";
     readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
     readonly MethodNotEnrolled: "method_not_enrolled";
-    readonly InvalidAuthorizationState: "invalid_authorization_state";
-    readonly TransactionMismatch: "transaction_mismatch";
-    readonly AuthorizationNotConsumable: "authorization_not_consumable";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
     readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly CredentialThrottled: "credential_throttled";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";

package/dist/index.js

@@ -8,29 +8,34 @@ import {
   hasPermissionGroup
 } from "./chunk-3XJY6BCI.js";
 
-// ../../internal/core/financial/subjectFinancialAuthorizations.ts
+// ../../internal/core/security/approvals.ts
 function path(id, suffix = "") {
   if (typeof id !== "string" || !id.trim())
-    throw new TypeError("Authyon: a financial authorization id is required.");
+    throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
-function subjectFinancialAuthorizations(request) {
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
+function subjectSecurity(request) {
   return {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id) => request(path(id)),
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
-    /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
-     *
-     * Pass the authenticator code or passkey assertion to verify the second
-     * factor inline (recommended). Without `input`, the session itself must
-     * have used a passkey or authenticator code within the last 5 minutes,
-     * otherwise the API answers `step_up_required`.
-     */
-    confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
   };
 }
 
@@ -51,10 +56,18 @@ var ErrorCodes = {
   InvalidSecondFactorCode: "invalid_code",
   VerificationAttemptsExhausted: "verification_attempts_exhausted",
   MethodNotEnrolled: "method_not_enrolled",
-  InvalidAuthorizationState: "invalid_authorization_state",
-  TransactionMismatch: "transaction_mismatch",
-  AuthorizationNotConsumable: "authorization_not_consumable",
-  IdempotencyConflict: "idempotency_conflict"
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
 var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
   "type",
@@ -568,7 +581,11 @@ var AuthyonClient = class {
           appendQuery(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, params),
           { bearer: true }
         ),
-        /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+        /**
+         * POST /auth/tenants/{organizationId}/members — add an existing
+         * environment user by e-mail (no e-mail is sent). To invite an address
+         * that may not have an account yet, use `organization.invites.create`.
+         */
         invite: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, {
           method: "POST",
           bearer: true,
@@ -580,6 +597,59 @@ var AuthyonClient = class {
           { method: "DELETE", bearer: true }
         )
       },
+      /**
+       * Invites by e-mail or by link. Managing them requires the
+       * `tenants:members:invite` permission on the organization; `preview` and
+       * `accept` are public — the token in the link is the credential.
+       */
+      invites: {
+        /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+        list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          bearer: true
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites — invite an address.
+         * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+         * mail it and you deliver the link yourself. The link is valid for 7
+         * days, once, and can't be read again later.
+         */
+        create: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          method: "POST",
+          bearer: true,
+          body: {
+            email: params.email,
+            roles: params.roles,
+            sendEmail: params.sendEmail ?? true,
+            redirectUri: params.redirectUri
+          }
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+         * a new link (the previous one stops working), mailing it unless
+         * `sendEmail` is `false`.
+         */
+        resend: (organizationId, inviteId, params = {}) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+          { method: "POST", bearer: true, body: { sendEmail: params.sendEmail ?? true } }
+        ),
+        /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+        revoke: (organizationId, inviteId) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}`,
+          { method: "DELETE", bearer: true }
+        ),
+        /**
+         * POST /auth/tenant-invites/preview — public. Read the `token` query
+         * parameter of the invite link and pick the form: one click when
+         * `accountExists`, sign-up otherwise.
+         */
+        preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+        /**
+         * POST /auth/tenant-invites/accept — public. Joins the organization; for
+         * an address with no account, also creates it (password required) with
+         * the e-mail already confirmed. Does not sign the user in.
+         */
+        accept: (params) => this.request("/auth/tenant-invites/accept", { method: "POST", body: params })
+      },
       roles: {
         /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
         list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/roles`, {
@@ -655,14 +725,14 @@ var AuthyonClient = class {
         })
       }
     };
-    // ── Financial step-up (customer side) ────────────────────────────────────
+    // ── Security (customer side) ─────────────────────────────────────────────
     /**
-     * Transaction-bound approvals created by your backend
-     * (`@authyon/server` → `environment.financialAuthorizations.create`).
-     * Show the transaction with `get()`, then `confirm()` with the customer's
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
      * authenticator code or passkey, or `reject()`.
      */
-    this.financialAuthorizations = subjectFinancialAuthorizations(
+    this.security = subjectSecurity(
       (path2, options) => this.request(path2, { ...options, bearer: true })
     );
     if (!options.envKey)

package/dist/react/index.d.cts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { $ as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-DbnbsQEX.cjs';
-export { q as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-DbnbsQEX.cjs';
+import { a9 as User, _ as SessionControllerOptions, A as AuthyonClient, a0 as SessionSnapshot, Z as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-Cp8ir5Gr.cjs';
+export { w as AuthyonSessionController, a1 as SessionSnapshotListener, a2 as SessionStatus } from '../ability-Cp8ir5Gr.cjs';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { $ as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-DbnbsQEX.js';
-export { q as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-DbnbsQEX.js';
+import { a9 as User, _ as SessionControllerOptions, A as AuthyonClient, a0 as SessionSnapshot, Z as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-Cp8ir5Gr.js';
+export { w as AuthyonSessionController, a1 as SessionSnapshotListener, a2 as SessionStatus } from '../ability-Cp8ir5Gr.js';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.2.0-beta.14",
+  "version": "0.2.0-beta.16",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",