@authyon/auth 0.2.0-beta.15 → 0.2.0-beta.17

package/README.md

@@ -227,18 +227,34 @@ Métodos de sessão/auth ficam soltos no client; os que giram em torno de um rec
 
 ### `authyon.organization`
 
-| Método                                                | Endpoint                                       |
-| ----------------------------------------------------- | ---------------------------------------------- |
-| `organization.list({ search?, skip?, take? })`        | `GET /auth/tenants`                            |
-| `organization.create(params?)`                        | `POST /auth/tenants`                           |
-| `organization.get(organizationId)`                    | `GET /auth/tenants/{id}`                       |
-| `organization.rename(organizationId, name)`           | `PATCH /auth/tenants/{id}`                     |
-| `organization.switch(slug)`                           | `POST /auth/switch-tenant`                     |
-| `organization.current()`                              | — (lê `activeOrganization` da sessão em cache) |
-| `organization.members.list(organizationId, params?)`  | `GET /auth/tenants/{id}/members`               |
-| `organization.members.invite(organizationId, params)` | `POST /auth/tenants/{id}/members`              |
-| `organization.members.remove(organizationId, userId)` | `DELETE /auth/tenants/{id}/members/{userId}`   |
-| `organization.roles.list(organizationId)`             | `GET /auth/tenants/{id}/roles`                 |
+| Método                                                           | Endpoint                                            |
+| ---------------------------------------------------------------- | --------------------------------------------------- |
+| `organization.list({ search?, skip?, take? })`                   | `GET /auth/tenants`                                 |
+| `organization.create(params?)`                                   | `POST /auth/tenants`                                |
+| `organization.get(organizationId)`                               | `GET /auth/tenants/{id}`                            |
+| `organization.rename(organizationId, name)`                      | `PATCH /auth/tenants/{id}`                          |
+| `organization.switch(slug)`                                      | `POST /auth/switch-tenant`                          |
+| `organization.current()`                                         | — (lê `activeOrganization` da sessão em cache)      |
+| `organization.members.list(organizationId, params?)`             | `GET /auth/tenants/{id}/members`                    |
+| `organization.members.invite(organizationId, params)`            | `POST /auth/tenants/{id}/members`                   |
+| `organization.members.remove(organizationId, userId)`            | `DELETE /auth/tenants/{id}/members/{userId}`        |
+| `organization.roles.list(organizationId)`                        | `GET /auth/tenants/{id}/roles`                      |
+| `organization.invites.list(organizationId)`                      | `GET /auth/tenants/{id}/invites`                    |
+| `organization.invites.create(organizationId, params)`            | `POST /auth/tenants/{id}/invites`                   |
+| `organization.invites.resend(organizationId, inviteId, params?)` | `POST /auth/tenants/{id}/invites/{inviteId}/resend` |
+| `organization.invites.revoke(organizationId, inviteId)`          | `DELETE /auth/tenants/{id}/invites/{inviteId}`      |
+| `organization.invites.preview(token)`                            | `POST /auth/tenant-invites/preview` (público)       |
+| `organization.invites.accept(params)`                            | `POST /auth/tenant-invites/accept` (público)        |
+
+`organization.members.invite` adiciona um usuário que já existe no ambiente. Para convidar
+um e-mail que talvez ainda não tenha conta, use `organization.invites.create`: a resposta
+sempre traz o `acceptUrl` completo e `sendEmail: false` só gera o link, sem enviar e-mail.
+O link vale 7 dias, uma única vez, e não pode ser lido de novo depois. Na página de aceite,
+leia o `token` da URL, chame `preview(token)` e, se `accountExists` for falso, peça senha
+(e usuário quando `usernameRequired`) antes de `accept`. Aceitar não faz login.
+Passe `redirectUri` no `create` para indicar para onde mandar a pessoa depois do aceite: ele
+precisa estar cadastrado (match exato) nos redirect URIs do ambiente e volta em `preview` e
+`accept` — a página hospedada da Authyon redireciona sozinha; numa página própria, é com você.
 
 ### `authyon.twoFactor`
 
@@ -291,6 +307,7 @@ await authyon.security.approvals.confirm(approvalId, {
 
 | Método                                   | Endpoint                                          |
 | ---------------------------------------- | ------------------------------------------------- |
+| `security.methods()`                     | `GET /auth/me` (campo `security`)                 |
 | `security.approvals.get(id)`             | `GET /auth/authorizations/{id}`                   |
 | `security.approvals.webauthnOptions(id)` | `POST /auth/authorizations/{id}/webauthn/options` |
 | `security.approvals.confirm(id, input?)` | `POST /auth/authorizations/{id}/confirm`          |

package/dist/{ability-5_xXXbDF.d.cts → ability-Cp8ir5Gr.d.cts}

@@ -1,3 +1,24 @@
+/**
+ * Security methods active on the user's account, as returned in the
+ * `security` field of `GET /auth/me` and `POST /auth/validate`.
+ */
+interface SecurityMethods {
+    /** A password is set (false for accounts created only through SSO or magic link). */
+    password: boolean;
+    /** Authenticator app (TOTP one-time codes). */
+    authenticator: boolean;
+    /** One-time codes sent by email. */
+    emailCode: boolean;
+    /** At least one passkey registered. */
+    passkey: boolean;
+    passkeyCount: number;
+    /** Unused recovery codes left. */
+    recoveryCodes: number;
+    /** SSO providers linked to the account, e.g. `["google", "github"]`. */
+    sso: string[];
+    /** Any second factor is active (authenticator, email code or passkey). */
+    twoFactor: boolean;
+}
 /** Lifecycle of an approval. */
 type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
 /**
@@ -130,6 +151,11 @@ interface SubjectApprovals {
 }
 /** The `security` namespace an end-user client exposes. */
 interface SubjectSecurity {
+    /**
+     * GET /auth/me — which security methods the signed-in user has active
+     * (password, authenticator, email code, passkeys, recovery codes, SSO).
+     */
+    methods(): Promise<SecurityMethods>;
     /** Approve or reject what your backend asked the customer to confirm. */
     readonly approvals: SubjectApprovals;
 }
@@ -198,6 +224,86 @@ interface InviteMemberInput {
     email: string;
     roles: string[];
 }
+/**
+ * POST /auth/tenants/{organizationId}/invites — invite an address that may not
+ * have an account yet; accepting creates it. `sendEmail` defaults to `true`;
+ * `false` only returns the link, for delivery through your own channel.
+ */
+interface OrganizationInviteInput {
+    email: string;
+    roles?: string[];
+    sendEmail?: boolean;
+    /**
+     * Where to send the invitee after they accept. Must be registered exactly in
+     * the environment's redirect URIs (the same list SSO and magic link use);
+     * otherwise the API rejects the invite. Comes back on `preview` and `accept`.
+     */
+    redirectUri?: string;
+}
+/** Returned when an invite is created or re-issued. `acceptUrl` is only ever
+ *  readable here — the API keeps a hash of the token, not the token. */
+interface OrganizationInviteIssued {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    acceptUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+type OrganizationInviteStatus = "pending" | "accepted" | "revoked" | "expired";
+interface OrganizationInvite {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    status: OrganizationInviteStatus;
+    createdAt: string;
+    expiresAt: string;
+    emailSentAt: string | null;
+    acceptedAt: string | null;
+    acceptedByUserId: string | null;
+    revokedAt: string | null;
+    invitedByUserId: string | null;
+    redirectUri: string | null;
+}
+/** POST /auth/tenant-invites/preview — what an accept page shows before the invitee commits. */
+interface OrganizationInvitePreview {
+    tenantId: string;
+    tenantName: string;
+    email: string;
+    roles: string[];
+    expiresAt: string;
+    /** True: accepting only needs the token. False: send a password (and a username when `usernameRequired`). */
+    accountExists: boolean;
+    usernameRequired: boolean;
+    /** Where the issuer asked to send the invitee after accepting, or `null`. */
+    redirectUri: string | null;
+}
+/** POST /auth/tenant-invites/accept — everything but `token` is ignored when the address already has an account. */
+interface AcceptOrganizationInviteInput {
+    token: string;
+    username?: string;
+    password?: string;
+    firstName?: string;
+    lastName?: string;
+    /**
+     * @deprecated Use `publicMetadata` / `privateMetadata` through
+     * `@authyon/server` (`environment.tenants.invites.accept`), which runs on
+     * your backend with the environment credential. Still accepted for now.
+     */
+    customFields?: Record<string, unknown>;
+}
+interface OrganizationInviteAccepted {
+    tenantId: string;
+    tenantName: string;
+    userId: string;
+    /** True when accepting created the account (email already confirmed). The invitee still signs in normally. */
+    accountCreated: boolean;
+    /** Where the issuer asked to send the invitee, or `null`. Redirecting is up to the accept page. */
+    redirectUri: string | null;
+}
 /** Authenticated user profile. */
 interface User {
     id: string;
@@ -214,6 +320,8 @@ interface User {
     activeOrganization?: Organization | null;
     /** Actions the user must complete before continuing (e.g. confirm e-mail). */
     pendencies?: string[];
+    /** Security methods active on the account (authenticator, email code, passkey, SSO…). */
+    security?: SecurityMethods;
 }
 /** Token pair issued by login / refresh / tenant switch. */
 interface Session {
@@ -543,11 +651,53 @@ declare class AuthyonClient {
              * (`user.activities()`, `@authyon/server`'s `environment.users.list()`).
              */
             list: (organizationId: string, params?: PaginationOptions) => Promise<Paged<OrganizationMember>>;
-            /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+            /**
+             * POST /auth/tenants/{organizationId}/members — add an existing
+             * environment user by e-mail (no e-mail is sent). To invite an address
+             * that may not have an account yet, use `organization.invites.create`.
+             */
             invite: (organizationId: string, params: InviteMemberInput) => Promise<void>;
             /** DELETE /auth/tenants/{organizationId}/members/{userId} — remove a member. */
             remove: (organizationId: string, userId: string) => Promise<void>;
         };
+        /**
+         * Invites by e-mail or by link. Managing them requires the
+         * `tenants:members:invite` permission on the organization; `preview` and
+         * `accept` are public — the token in the link is the credential.
+         */
+        invites: {
+            /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+            list: (organizationId: string) => Promise<OrganizationInvite[]>;
+            /**
+             * POST /auth/tenants/{organizationId}/invites — invite an address.
+             * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+             * mail it and you deliver the link yourself. The link is valid for 7
+             * days, once, and can't be read again later.
+             */
+            create: (organizationId: string, params: OrganizationInviteInput) => Promise<OrganizationInviteIssued>;
+            /**
+             * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+             * a new link (the previous one stops working), mailing it unless
+             * `sendEmail` is `false`.
+             */
+            resend: (organizationId: string, inviteId: string, params?: {
+                sendEmail?: boolean;
+            }) => Promise<OrganizationInviteIssued>;
+            /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+            revoke: (organizationId: string, inviteId: string) => Promise<void>;
+            /**
+             * POST /auth/tenant-invites/preview — public. Read the `token` query
+             * parameter of the invite link and pick the form: one click when
+             * `accountExists`, sign-up otherwise.
+             */
+            preview: (token: string) => Promise<OrganizationInvitePreview>;
+            /**
+             * POST /auth/tenant-invites/accept — public. Joins the organization; for
+             * an address with no account, also creates it (password required) with
+             * the e-mail already confirmed. Does not sign the user in.
+             */
+            accept: (params: AcceptOrganizationInviteInput) => Promise<OrganizationInviteAccepted>;
+        };
         roles: {
             /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
             list: (organizationId: string) => Promise<Role[]>;
@@ -728,4 +878,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { type TwoFactorMethod as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmApprovalInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type SubjectApprovals as Y, type SubjectSecurity as Z, type TwoFactorChallenge as _, type HttpLoggerOptions as a, type TwoFactorStatus as a0, type User as a1, type ValidateResult as a2, type VerifyTwoFactorInput as a3, type WebAuthnAssertion as a4, type WebAuthnCeremonyStart as a5, type WebAuthnCredential as a6, createAuthyonAbility as a7, createAuthyonRules as a8, createClient as a9, hasPermission as aa, hasPermissionGroup as ab, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type Approval as h, type ApprovalAssurance as i, type ApprovalPayload as j, type ApprovalStatus as k, type ApprovalWebAuthnOptions as l, type AuthEvent as m, type AuthState as n, type AuthStateListener as o, type AuthenticatorSetup as p, AuthyonAbility as q, AuthyonAbilityBuilder as r, type AuthyonAbilityOptions as s, type AuthyonClientOptions as t, type AuthyonPermissionSource as u, AuthyonSessionController as v, type CreateOrganizationInput as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };
+export { type SessionInfo as $, AuthyonClient as A, type HttpLogger as B, type ConfirmApprovalInput as C, type InviteMemberInput as D, type LoginInput as E, FetchHttpAdapter as F, type LoginResult as G, type HttpAdapter as H, type IntrospectResult as I, type OrganizationInvite as J, type OrganizationInviteAccepted as K, LoggingHttpAdapter as L, type OrganizationInviteInput as M, type OrganizationInviteIssued as N, type Organization as O, type OrganizationInvitePreview as P, type OrganizationInviteStatus as Q, type OrganizationMember as R, type Paged as S, type TokenStorage as T, type PaginationOptions as U, type PermissionGroup as V, type RegisterInput as W, type Role as X, type SecurityMethods as Y, type Session as Z, type SessionControllerOptions as _, type HttpLoggerOptions as a, type SessionSnapshot as a0, type SessionSnapshotListener as a1, type SessionStatus as a2, type SsoProvider as a3, type SubjectApprovals as a4, type SubjectSecurity as a5, type TwoFactorChallenge as a6, type TwoFactorMethod as a7, type TwoFactorStatus as a8, type User as a9, type ValidateResult as aa, type VerifyTwoFactorInput as ab, type WebAuthnAssertion as ac, type WebAuthnCeremonyStart as ad, type WebAuthnCredential as ae, createAuthyonAbility as af, createAuthyonRules as ag, createClient as ah, hasPermission as ai, hasPermissionGroup as aj, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type AcceptOrganizationInviteInput as g, type Activity as h, type Approval as i, type ApprovalAssurance as j, type ApprovalPayload as k, type ApprovalStatus as l, type ApprovalWebAuthnOptions as m, type AuthEvent as n, type AuthState as o, type AuthStateListener as p, type AuthenticatorSetup as q, AuthyonAbility as r, AuthyonAbilityBuilder as s, type AuthyonAbilityOptions as t, type AuthyonClientOptions as u, type AuthyonPermissionSource as v, AuthyonSessionController as w, type CreateOrganizationInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };

package/dist/{ability-5_xXXbDF.d.ts → ability-Cp8ir5Gr.d.ts}

@@ -1,3 +1,24 @@
+/**
+ * Security methods active on the user's account, as returned in the
+ * `security` field of `GET /auth/me` and `POST /auth/validate`.
+ */
+interface SecurityMethods {
+    /** A password is set (false for accounts created only through SSO or magic link). */
+    password: boolean;
+    /** Authenticator app (TOTP one-time codes). */
+    authenticator: boolean;
+    /** One-time codes sent by email. */
+    emailCode: boolean;
+    /** At least one passkey registered. */
+    passkey: boolean;
+    passkeyCount: number;
+    /** Unused recovery codes left. */
+    recoveryCodes: number;
+    /** SSO providers linked to the account, e.g. `["google", "github"]`. */
+    sso: string[];
+    /** Any second factor is active (authenticator, email code or passkey). */
+    twoFactor: boolean;
+}
 /** Lifecycle of an approval. */
 type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
 /**
@@ -130,6 +151,11 @@ interface SubjectApprovals {
 }
 /** The `security` namespace an end-user client exposes. */
 interface SubjectSecurity {
+    /**
+     * GET /auth/me — which security methods the signed-in user has active
+     * (password, authenticator, email code, passkeys, recovery codes, SSO).
+     */
+    methods(): Promise<SecurityMethods>;
     /** Approve or reject what your backend asked the customer to confirm. */
     readonly approvals: SubjectApprovals;
 }
@@ -198,6 +224,86 @@ interface InviteMemberInput {
     email: string;
     roles: string[];
 }
+/**
+ * POST /auth/tenants/{organizationId}/invites — invite an address that may not
+ * have an account yet; accepting creates it. `sendEmail` defaults to `true`;
+ * `false` only returns the link, for delivery through your own channel.
+ */
+interface OrganizationInviteInput {
+    email: string;
+    roles?: string[];
+    sendEmail?: boolean;
+    /**
+     * Where to send the invitee after they accept. Must be registered exactly in
+     * the environment's redirect URIs (the same list SSO and magic link use);
+     * otherwise the API rejects the invite. Comes back on `preview` and `accept`.
+     */
+    redirectUri?: string;
+}
+/** Returned when an invite is created or re-issued. `acceptUrl` is only ever
+ *  readable here — the API keeps a hash of the token, not the token. */
+interface OrganizationInviteIssued {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    acceptUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+type OrganizationInviteStatus = "pending" | "accepted" | "revoked" | "expired";
+interface OrganizationInvite {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    status: OrganizationInviteStatus;
+    createdAt: string;
+    expiresAt: string;
+    emailSentAt: string | null;
+    acceptedAt: string | null;
+    acceptedByUserId: string | null;
+    revokedAt: string | null;
+    invitedByUserId: string | null;
+    redirectUri: string | null;
+}
+/** POST /auth/tenant-invites/preview — what an accept page shows before the invitee commits. */
+interface OrganizationInvitePreview {
+    tenantId: string;
+    tenantName: string;
+    email: string;
+    roles: string[];
+    expiresAt: string;
+    /** True: accepting only needs the token. False: send a password (and a username when `usernameRequired`). */
+    accountExists: boolean;
+    usernameRequired: boolean;
+    /** Where the issuer asked to send the invitee after accepting, or `null`. */
+    redirectUri: string | null;
+}
+/** POST /auth/tenant-invites/accept — everything but `token` is ignored when the address already has an account. */
+interface AcceptOrganizationInviteInput {
+    token: string;
+    username?: string;
+    password?: string;
+    firstName?: string;
+    lastName?: string;
+    /**
+     * @deprecated Use `publicMetadata` / `privateMetadata` through
+     * `@authyon/server` (`environment.tenants.invites.accept`), which runs on
+     * your backend with the environment credential. Still accepted for now.
+     */
+    customFields?: Record<string, unknown>;
+}
+interface OrganizationInviteAccepted {
+    tenantId: string;
+    tenantName: string;
+    userId: string;
+    /** True when accepting created the account (email already confirmed). The invitee still signs in normally. */
+    accountCreated: boolean;
+    /** Where the issuer asked to send the invitee, or `null`. Redirecting is up to the accept page. */
+    redirectUri: string | null;
+}
 /** Authenticated user profile. */
 interface User {
     id: string;
@@ -214,6 +320,8 @@ interface User {
     activeOrganization?: Organization | null;
     /** Actions the user must complete before continuing (e.g. confirm e-mail). */
     pendencies?: string[];
+    /** Security methods active on the account (authenticator, email code, passkey, SSO…). */
+    security?: SecurityMethods;
 }
 /** Token pair issued by login / refresh / tenant switch. */
 interface Session {
@@ -543,11 +651,53 @@ declare class AuthyonClient {
              * (`user.activities()`, `@authyon/server`'s `environment.users.list()`).
              */
             list: (organizationId: string, params?: PaginationOptions) => Promise<Paged<OrganizationMember>>;
-            /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+            /**
+             * POST /auth/tenants/{organizationId}/members — add an existing
+             * environment user by e-mail (no e-mail is sent). To invite an address
+             * that may not have an account yet, use `organization.invites.create`.
+             */
             invite: (organizationId: string, params: InviteMemberInput) => Promise<void>;
             /** DELETE /auth/tenants/{organizationId}/members/{userId} — remove a member. */
             remove: (organizationId: string, userId: string) => Promise<void>;
         };
+        /**
+         * Invites by e-mail or by link. Managing them requires the
+         * `tenants:members:invite` permission on the organization; `preview` and
+         * `accept` are public — the token in the link is the credential.
+         */
+        invites: {
+            /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+            list: (organizationId: string) => Promise<OrganizationInvite[]>;
+            /**
+             * POST /auth/tenants/{organizationId}/invites — invite an address.
+             * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+             * mail it and you deliver the link yourself. The link is valid for 7
+             * days, once, and can't be read again later.
+             */
+            create: (organizationId: string, params: OrganizationInviteInput) => Promise<OrganizationInviteIssued>;
+            /**
+             * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+             * a new link (the previous one stops working), mailing it unless
+             * `sendEmail` is `false`.
+             */
+            resend: (organizationId: string, inviteId: string, params?: {
+                sendEmail?: boolean;
+            }) => Promise<OrganizationInviteIssued>;
+            /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+            revoke: (organizationId: string, inviteId: string) => Promise<void>;
+            /**
+             * POST /auth/tenant-invites/preview — public. Read the `token` query
+             * parameter of the invite link and pick the form: one click when
+             * `accountExists`, sign-up otherwise.
+             */
+            preview: (token: string) => Promise<OrganizationInvitePreview>;
+            /**
+             * POST /auth/tenant-invites/accept — public. Joins the organization; for
+             * an address with no account, also creates it (password required) with
+             * the e-mail already confirmed. Does not sign the user in.
+             */
+            accept: (params: AcceptOrganizationInviteInput) => Promise<OrganizationInviteAccepted>;
+        };
         roles: {
             /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
             list: (organizationId: string) => Promise<Role[]>;
@@ -728,4 +878,4 @@ declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly s
 /** Converts Authyon's `subject:action` permission strings to authorization rules. */
 declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
 
-export { type TwoFactorMethod as $, AuthyonClient as A, type InviteMemberInput as B, type ConfirmApprovalInput as C, type LoginInput as D, type LoginResult as E, FetchHttpAdapter as F, type OrganizationMember as G, type HttpAdapter as H, type IntrospectResult as I, type PaginationOptions as J, type PermissionGroup as K, LoggingHttpAdapter as L, type Role as M, type SessionControllerOptions as N, type Organization as O, type Paged as P, type SessionInfo as Q, type RegisterInput as R, type Session as S, type TokenStorage as T, type SessionSnapshot as U, type SessionSnapshotListener as V, type SessionStatus as W, type SsoProvider as X, type SubjectApprovals as Y, type SubjectSecurity as Z, type TwoFactorChallenge as _, type HttpLoggerOptions as a, type TwoFactorStatus as a0, type User as a1, type ValidateResult as a2, type VerifyTwoFactorInput as a3, type WebAuthnAssertion as a4, type WebAuthnCeremonyStart as a5, type WebAuthnCredential as a6, createAuthyonAbility as a7, createAuthyonRules as a8, createClient as a9, hasPermission as aa, hasPermissionGroup as ab, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type Activity as g, type Approval as h, type ApprovalAssurance as i, type ApprovalPayload as j, type ApprovalStatus as k, type ApprovalWebAuthnOptions as l, type AuthEvent as m, type AuthState as n, type AuthStateListener as o, type AuthenticatorSetup as p, AuthyonAbility as q, AuthyonAbilityBuilder as r, type AuthyonAbilityOptions as s, type AuthyonClientOptions as t, type AuthyonPermissionSource as u, AuthyonSessionController as v, type CreateOrganizationInput as w, type HttpAdapterRequest as x, type HttpLogEvent as y, type HttpLogger as z };
+export { type SessionInfo as $, AuthyonClient as A, type HttpLogger as B, type ConfirmApprovalInput as C, type InviteMemberInput as D, type LoginInput as E, FetchHttpAdapter as F, type LoginResult as G, type HttpAdapter as H, type IntrospectResult as I, type OrganizationInvite as J, type OrganizationInviteAccepted as K, LoggingHttpAdapter as L, type OrganizationInviteInput as M, type OrganizationInviteIssued as N, type Organization as O, type OrganizationInvitePreview as P, type OrganizationInviteStatus as Q, type OrganizationMember as R, type Paged as S, type TokenStorage as T, type PaginationOptions as U, type PermissionGroup as V, type RegisterInput as W, type Role as X, type SecurityMethods as Y, type Session as Z, type SessionControllerOptions as _, type HttpLoggerOptions as a, type SessionSnapshot as a0, type SessionSnapshotListener as a1, type SessionStatus as a2, type SsoProvider as a3, type SubjectApprovals as a4, type SubjectSecurity as a5, type TwoFactorChallenge as a6, type TwoFactorMethod as a7, type TwoFactorStatus as a8, type User as a9, type ValidateResult as aa, type VerifyTwoFactorInput as ab, type WebAuthnAssertion as ac, type WebAuthnCeremonyStart as ad, type WebAuthnCredential as ae, createAuthyonAbility as af, createAuthyonRules as ag, createClient as ah, hasPermission as ai, hasPermissionGroup as aj, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRule as e, type AbilitySubject as f, type AcceptOrganizationInviteInput as g, type Activity as h, type Approval as i, type ApprovalAssurance as j, type ApprovalPayload as k, type ApprovalStatus as l, type ApprovalWebAuthnOptions as m, type AuthEvent as n, type AuthState as o, type AuthStateListener as p, type AuthenticatorSetup as q, AuthyonAbility as r, AuthyonAbilityBuilder as s, type AuthyonAbilityOptions as t, type AuthyonClientOptions as u, type AuthyonPermissionSource as v, AuthyonSessionController as w, type CreateOrganizationInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };

package/dist/index.cjs

@@ -46,8 +46,22 @@ function path(id, suffix = "") {
     throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
 function subjectSecurity(request) {
   return {
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
     approvals: {
       get: (id) => request(path(id)),
       webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
@@ -82,6 +96,7 @@ var ErrorCodes = {
   UserNotFound: "user_not_found",
   TemporarilyUnavailable: "temporarily_unavailable",
   InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
   ApprovalNotFound: "authorization_not_found",
   SessionRevoked: "session_revoked",
   TwoFactorTooManyFailures: "user.2fa.too_many_failures"
@@ -598,7 +613,11 @@ var AuthyonClient = class {
           appendQuery(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, params),
           { bearer: true }
         ),
-        /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+        /**
+         * POST /auth/tenants/{organizationId}/members — add an existing
+         * environment user by e-mail (no e-mail is sent). To invite an address
+         * that may not have an account yet, use `organization.invites.create`.
+         */
         invite: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, {
           method: "POST",
           bearer: true,
@@ -610,6 +629,59 @@ var AuthyonClient = class {
           { method: "DELETE", bearer: true }
         )
       },
+      /**
+       * Invites by e-mail or by link. Managing them requires the
+       * `tenants:members:invite` permission on the organization; `preview` and
+       * `accept` are public — the token in the link is the credential.
+       */
+      invites: {
+        /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+        list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          bearer: true
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites — invite an address.
+         * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+         * mail it and you deliver the link yourself. The link is valid for 7
+         * days, once, and can't be read again later.
+         */
+        create: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          method: "POST",
+          bearer: true,
+          body: {
+            email: params.email,
+            roles: params.roles,
+            sendEmail: params.sendEmail ?? true,
+            redirectUri: params.redirectUri
+          }
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+         * a new link (the previous one stops working), mailing it unless
+         * `sendEmail` is `false`.
+         */
+        resend: (organizationId, inviteId, params = {}) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+          { method: "POST", bearer: true, body: { sendEmail: params.sendEmail ?? true } }
+        ),
+        /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+        revoke: (organizationId, inviteId) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}`,
+          { method: "DELETE", bearer: true }
+        ),
+        /**
+         * POST /auth/tenant-invites/preview — public. Read the `token` query
+         * parameter of the invite link and pick the form: one click when
+         * `accountExists`, sign-up otherwise.
+         */
+        preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+        /**
+         * POST /auth/tenant-invites/accept — public. Joins the organization; for
+         * an address with no account, also creates it (password required) with
+         * the e-mail already confirmed. Does not sign the user in.
+         */
+        accept: (params) => this.request("/auth/tenant-invites/accept", { method: "POST", body: params })
+      },
       roles: {
         /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
         list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/roles`, {

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-5_xXXbDF.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as Approval, i as ApprovalAssurance, j as ApprovalPayload, k as ApprovalStatus, l as ApprovalWebAuthnOptions, m as AuthEvent, n as AuthState, o as AuthStateListener, p as AuthenticatorSetup, q as AuthyonAbility, r as AuthyonAbilityBuilder, s as AuthyonAbilityOptions, t as AuthyonClientOptions, u as AuthyonPermissionSource, v as AuthyonSessionController, C as ConfirmApprovalInput, w as CreateOrganizationInput, F as FetchHttpAdapter, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as SubjectApprovals, Z as SubjectSecurity, _ as TwoFactorChallenge, $ as TwoFactorMethod, a0 as TwoFactorStatus, a1 as User, a2 as ValidateResult, a3 as VerifyTwoFactorInput, a4 as WebAuthnAssertion, a5 as WebAuthnCeremonyStart, a6 as WebAuthnCredential, a7 as createAuthyonAbility, a8 as createAuthyonRules, a9 as createClient, aa as hasPermission, ab as hasPermissionGroup } from './ability-5_xXXbDF.cjs';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-Cp8ir5Gr.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PermissionGroup, W as RegisterInput, X as Role, Y as SecurityMethods, Z as Session, _ as SessionControllerOptions, $ as SessionInfo, a0 as SessionSnapshot, a1 as SessionSnapshotListener, a2 as SessionStatus, a3 as SsoProvider, a4 as SubjectApprovals, a5 as SubjectSecurity, a6 as TwoFactorChallenge, a7 as TwoFactorMethod, a8 as TwoFactorStatus, a9 as User, aa as ValidateResult, ab as VerifyTwoFactorInput, ac as WebAuthnAssertion, ad as WebAuthnCeremonyStart, ae as WebAuthnCredential, af as createAuthyonAbility, ag as createAuthyonRules, ah as createClient, ai as hasPermission, aj as hasPermissionGroup } from './ability-Cp8ir5Gr.cjs';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -25,6 +25,7 @@ declare const ErrorCodes: {
     readonly UserNotFound: "user_not_found";
     readonly TemporarilyUnavailable: "temporarily_unavailable";
     readonly InsufficientScope: "insufficient_scope";
+    readonly CredentialThrottled: "credential_throttled";
     readonly ApprovalNotFound: "authorization_not_found";
     readonly SessionRevoked: "session_revoked";
     readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-5_xXXbDF.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as Approval, i as ApprovalAssurance, j as ApprovalPayload, k as ApprovalStatus, l as ApprovalWebAuthnOptions, m as AuthEvent, n as AuthState, o as AuthStateListener, p as AuthenticatorSetup, q as AuthyonAbility, r as AuthyonAbilityBuilder, s as AuthyonAbilityOptions, t as AuthyonClientOptions, u as AuthyonPermissionSource, v as AuthyonSessionController, C as ConfirmApprovalInput, w as CreateOrganizationInput, F as FetchHttpAdapter, x as HttpAdapterRequest, y as HttpLogEvent, z as HttpLogger, I as IntrospectResult, B as InviteMemberInput, L as LoggingHttpAdapter, D as LoginInput, E as LoginResult, O as Organization, G as OrganizationMember, P as Paged, J as PaginationOptions, K as PermissionGroup, R as RegisterInput, M as Role, S as Session, N as SessionControllerOptions, Q as SessionInfo, U as SessionSnapshot, V as SessionSnapshotListener, W as SessionStatus, X as SsoProvider, Y as SubjectApprovals, Z as SubjectSecurity, _ as TwoFactorChallenge, $ as TwoFactorMethod, a0 as TwoFactorStatus, a1 as User, a2 as ValidateResult, a3 as VerifyTwoFactorInput, a4 as WebAuthnAssertion, a5 as WebAuthnCeremonyStart, a6 as WebAuthnCredential, a7 as createAuthyonAbility, a8 as createAuthyonRules, a9 as createClient, aa as hasPermission, ab as hasPermissionGroup } from './ability-5_xXXbDF.js';
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-Cp8ir5Gr.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PermissionGroup, W as RegisterInput, X as Role, Y as SecurityMethods, Z as Session, _ as SessionControllerOptions, $ as SessionInfo, a0 as SessionSnapshot, a1 as SessionSnapshotListener, a2 as SessionStatus, a3 as SsoProvider, a4 as SubjectApprovals, a5 as SubjectSecurity, a6 as TwoFactorChallenge, a7 as TwoFactorMethod, a8 as TwoFactorStatus, a9 as User, aa as ValidateResult, ab as VerifyTwoFactorInput, ac as WebAuthnAssertion, ad as WebAuthnCeremonyStart, ae as WebAuthnCredential, af as createAuthyonAbility, ag as createAuthyonRules, ah as createClient, ai as hasPermission, aj as hasPermissionGroup } from './ability-Cp8ir5Gr.js';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -25,6 +25,7 @@ declare const ErrorCodes: {
     readonly UserNotFound: "user_not_found";
     readonly TemporarilyUnavailable: "temporarily_unavailable";
     readonly InsufficientScope: "insufficient_scope";
+    readonly CredentialThrottled: "credential_throttled";
     readonly ApprovalNotFound: "authorization_not_found";
     readonly SessionRevoked: "session_revoked";
     readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";

package/dist/index.js

@@ -14,8 +14,22 @@ function path(id, suffix = "") {
     throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
 function subjectSecurity(request) {
   return {
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
     approvals: {
       get: (id) => request(path(id)),
       webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
@@ -50,6 +64,7 @@ var ErrorCodes = {
   UserNotFound: "user_not_found",
   TemporarilyUnavailable: "temporarily_unavailable",
   InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
   ApprovalNotFound: "authorization_not_found",
   SessionRevoked: "session_revoked",
   TwoFactorTooManyFailures: "user.2fa.too_many_failures"
@@ -566,7 +581,11 @@ var AuthyonClient = class {
           appendQuery(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, params),
           { bearer: true }
         ),
-        /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+        /**
+         * POST /auth/tenants/{organizationId}/members — add an existing
+         * environment user by e-mail (no e-mail is sent). To invite an address
+         * that may not have an account yet, use `organization.invites.create`.
+         */
         invite: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, {
           method: "POST",
           bearer: true,
@@ -578,6 +597,59 @@ var AuthyonClient = class {
           { method: "DELETE", bearer: true }
         )
       },
+      /**
+       * Invites by e-mail or by link. Managing them requires the
+       * `tenants:members:invite` permission on the organization; `preview` and
+       * `accept` are public — the token in the link is the credential.
+       */
+      invites: {
+        /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+        list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          bearer: true
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites — invite an address.
+         * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+         * mail it and you deliver the link yourself. The link is valid for 7
+         * days, once, and can't be read again later.
+         */
+        create: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          method: "POST",
+          bearer: true,
+          body: {
+            email: params.email,
+            roles: params.roles,
+            sendEmail: params.sendEmail ?? true,
+            redirectUri: params.redirectUri
+          }
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+         * a new link (the previous one stops working), mailing it unless
+         * `sendEmail` is `false`.
+         */
+        resend: (organizationId, inviteId, params = {}) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+          { method: "POST", bearer: true, body: { sendEmail: params.sendEmail ?? true } }
+        ),
+        /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+        revoke: (organizationId, inviteId) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}`,
+          { method: "DELETE", bearer: true }
+        ),
+        /**
+         * POST /auth/tenant-invites/preview — public. Read the `token` query
+         * parameter of the invite link and pick the form: one click when
+         * `accountExists`, sign-up otherwise.
+         */
+        preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+        /**
+         * POST /auth/tenant-invites/accept — public. Joins the organization; for
+         * an address with no account, also creates it (password required) with
+         * the e-mail already confirmed. Does not sign the user in.
+         */
+        accept: (params) => this.request("/auth/tenant-invites/accept", { method: "POST", body: params })
+      },
       roles: {
         /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
         list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/roles`, {

package/dist/react/index.d.cts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { a1 as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, s as AuthyonAbilityOptions, q as AuthyonAbility } from '../ability-5_xXXbDF.cjs';
-export { v as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-5_xXXbDF.cjs';
+import { a9 as User, _ as SessionControllerOptions, A as AuthyonClient, a0 as SessionSnapshot, Z as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-Cp8ir5Gr.cjs';
+export { w as AuthyonSessionController, a1 as SessionSnapshotListener, a2 as SessionStatus } from '../ability-Cp8ir5Gr.cjs';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { a1 as User, N as SessionControllerOptions, A as AuthyonClient, U as SessionSnapshot, S as Session, f as AbilitySubject, s as AuthyonAbilityOptions, q as AuthyonAbility } from '../ability-5_xXXbDF.js';
-export { v as AuthyonSessionController, V as SessionSnapshotListener, W as SessionStatus } from '../ability-5_xXXbDF.js';
+import { a9 as User, _ as SessionControllerOptions, A as AuthyonClient, a0 as SessionSnapshot, Z as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-Cp8ir5Gr.js';
+export { w as AuthyonSessionController, a1 as SessionSnapshotListener, a2 as SessionStatus } from '../ability-Cp8ir5Gr.js';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.2.0-beta.15",
+  "version": "0.2.0-beta.17",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",