@authyon/auth 0.2.0-beta.2 → 0.2.0-beta.21

package/dist/index.cjs

@@ -35,10 +35,42 @@ __export(index_exports, {
   createDefaultStorage: () => createDefaultStorage,
   createLocalStorage: () => createLocalStorage,
   createMemoryStorage: () => createMemoryStorage,
-  hasPermission: () => hasPermission
+  hasPermission: () => hasPermission,
+  hasPermissionGroup: () => hasPermissionGroup
 });
 module.exports = __toCommonJS(index_exports);
 
+// ../../internal/core/security/approvals.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: an approval id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
+function subjectSecurity(request) {
+  return {
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
+  };
+}
+
 // ../../internal/core/errors/authyonError.ts
 var ErrorCodes = {
   Unknown: "unknown",
@@ -51,16 +83,45 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -110,6 +171,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -203,14 +265,21 @@ var DEFAULT_BASE_URL = "https://api.authyon.com";
 var DEFAULT_EXPIRY_SKEW_MS = 3e4;
 
 // ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
+function appendQuery(path2, params) {
+  if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
-    if (value2 !== void 0) query.set(key, String(value2));
+    if (value2 === void 0) continue;
+    if (Array.isArray(value2)) {
+      for (const item of value2) {
+        if (item !== void 0) query.append(key, String(item));
+      }
+      continue;
+    }
+    query.set(key, String(value2));
   }
   const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+  return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
 }
 
 // ../../internal/core/http/httpAdapter.ts
@@ -223,7 +292,8 @@ var FetchHttpAdapter = class {
       method: request.method,
       headers: request.headers,
       body: request.body,
-      signal: request.signal
+      signal: request.signal,
+      redirect: "error"
     });
   }
 };
@@ -275,6 +345,9 @@ function defaultHttpLogger(event) {
 }
 function sanitizeUrl(value) {
   const url = new URL(value);
+  url.username = "";
+  url.password = "";
+  url.hash = "";
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -304,12 +377,12 @@ function createSharedTransport(options) {
   const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
   return {
     baseUrl,
-    async request(path, init) {
+    async request(path2, init) {
       const controller = new AbortController();
       const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
       try {
         return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
+          url: `${baseUrl}${path2}`,
           method: init.method ?? "GET",
           headers: normalizeHeaders(init.headers),
           body: init.body,
@@ -367,11 +440,11 @@ var JsonHttpClient = class {
   constructor(transport) {
     this.transport = transport;
   }
-  async send(path, options = {}) {
+  async send(path2, options = {}) {
     const headers = { ...options.headers };
     if (options.body !== void 0) headers["Content-Type"] = "application/json";
     try {
-      return await this.transport.request(appendQuery(path, options.query), {
+      return await this.transport.request(appendQuery(path2, options.query), {
         method: options.method ?? "GET",
         headers,
         body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
@@ -385,7 +458,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));
@@ -393,11 +468,33 @@ var JsonHttpClient = class {
     if (response.status === 204) return void 0;
     return await response.json();
   }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
+  async request(path2, options = {}) {
+    return this.parse(await this.send(path2, options));
   }
 };
 
+// ../../internal/core/http/clientIp.ts
+function clientIpHeaders(context) {
+  if (!context?.clientIp) return {};
+  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
+}
+function normalizeClientIp(value) {
+  let ip = value.trim();
+  if (ip.startsWith("[") && ip.endsWith("]")) ip = ip.slice(1, -1);
+  if (!ip || ip.length > 45 || ip.includes(",") || /[\r\n\s]/.test(ip) || !/^[0-9a-f:.]+$/i.test(ip) || !ip.includes(".") && !ip.includes(":")) {
+    throw invalidClientIp();
+  }
+  try {
+    new URL(ip.includes(":") ? `http://[${ip}]` : `http://${ip}`);
+  } catch {
+    throw invalidClientIp();
+  }
+  return ip;
+}
+function invalidClientIp() {
+  return new Error("Authyon: `clientIp` must be a single valid IPv4 or IPv6 address");
+}
+
 // src/client/authyonClient.ts
 var FALLBACK_EXPIRES_IN = 1800;
 function readTokens(raw) {
@@ -475,18 +572,41 @@ var AuthyonClient = class {
         method: "DELETE",
         bearer: true
       }),
-      /** POST /auth/password-reset/request — always resolves (no account enumeration). */
-      requestPasswordReset: (email) => this.request("/auth/password-reset/request", { method: "POST", body: { email } }),
-      /** POST /auth/password-reset/confirm — sets a new password and revokes all refresh tokens. */
-      confirmPasswordReset: (token, newPassword) => this.request("/auth/password-reset/confirm", {
+      /**
+       * POST /auth/password-reset/request — resolves whether or not the address
+       * has an account (no account enumeration). `redirectUri` is where the
+       * person lands after changing the password; it must be one of the
+       * environment's registered redirect URIs, or the call rejects with
+       * `user.password_reset.redirect_uri.not_allowed`.
+       */
+      requestPasswordReset: (email, options = {}) => this.request("/auth/password-reset/request", {
         method: "POST",
-        body: { token, newPassword }
-      })
+        body: { email, ...options }
+      }),
+      /**
+       * POST /auth/password-reset/validate — checks a reset token without
+       * spending it, so the reset page can refuse a dead link before asking for
+       * a password. Rejects with `user.password_reset.invalid` (401) when the
+       * token is unknown, used or expired.
+       */
+      validatePasswordReset: (token) => this.request("/auth/password-reset/validate", { method: "POST", body: { token } }),
+      /**
+       * POST /auth/password-reset/confirm — sets a new password and revokes all
+       * refresh tokens. Resolves with the `redirectUri` the reset was requested
+       * with (`null` when there was none); following it is up to the caller.
+       */
+      confirmPasswordReset: async (token, newPassword) => {
+        const done = await this.request(
+          "/auth/password-reset/confirm",
+          { method: "POST", body: { token, newPassword } }
+        );
+        return { redirectUri: done?.redirectUri ?? null };
+      }
     };
     // ── Organization ─────────────────────────────────────────────────────────
     this.organization = {
-      /** GET /auth/tenants — all organization memberships. */
-      list: () => this.request("/auth/tenants", { bearer: true }),
+      /** GET /auth/tenants — filterable list of organization memberships. */
+      list: (params = {}) => this.request(appendQuery("/auth/tenants", params), { bearer: true }),
       /**
        * POST /auth/tenants — creates an organization owned by the signed-in
        * user (only available when self-service organization creation is
@@ -523,7 +643,11 @@ var AuthyonClient = class {
           appendQuery(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, params),
           { bearer: true }
         ),
-        /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+        /**
+         * POST /auth/tenants/{organizationId}/members — add an existing
+         * environment user by e-mail (no e-mail is sent). To invite an address
+         * that may not have an account yet, use `organization.invites.create`.
+         */
         invite: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, {
           method: "POST",
           bearer: true,
@@ -535,6 +659,59 @@ var AuthyonClient = class {
           { method: "DELETE", bearer: true }
         )
       },
+      /**
+       * Invites by e-mail or by link. Managing them requires the
+       * `tenants:members:invite` permission on the organization; `preview` and
+       * `accept` are public — the token in the link is the credential.
+       */
+      invites: {
+        /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+        list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          bearer: true
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites — invite an address.
+         * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+         * mail it and you deliver the link yourself. The link is valid for 7
+         * days, once, and can't be read again later.
+         */
+        create: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          method: "POST",
+          bearer: true,
+          body: {
+            email: params.email,
+            roles: params.roles,
+            sendEmail: params.sendEmail ?? true,
+            redirectUri: params.redirectUri
+          }
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+         * a new link (the previous one stops working), mailing it unless
+         * `sendEmail` is `false`.
+         */
+        resend: (organizationId, inviteId, params = {}) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+          { method: "POST", bearer: true, body: { sendEmail: params.sendEmail ?? true } }
+        ),
+        /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+        revoke: (organizationId, inviteId) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}`,
+          { method: "DELETE", bearer: true }
+        ),
+        /**
+         * POST /auth/tenant-invites/preview — public. Read the `token` query
+         * parameter of the invite link and pick the form: one click when
+         * `accountExists`, sign-up otherwise.
+         */
+        preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+        /**
+         * POST /auth/tenant-invites/accept — public. Joins the organization; for
+         * an address with no account, also creates it (password required) with
+         * the e-mail already confirmed. Does not sign the user in.
+         */
+        accept: (params) => this.request("/auth/tenant-invites/accept", { method: "POST", body: params })
+      },
       roles: {
         /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
         list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/roles`, {
@@ -610,9 +787,20 @@ var AuthyonClient = class {
         })
       }
     };
+    // ── Security (customer side) ─────────────────────────────────────────────
+    /**
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    this.security = subjectSecurity(
+      (path2, options) => this.request(path2, { ...options, bearer: true })
+    );
     if (!options.envKey)
       throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
     this.envKey = options.envKey;
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -722,9 +910,10 @@ var AuthyonClient = class {
     }
   }
   // ── HTTP core ────────────────────────────────────────────────────────────
-  async request(path, options = {}, isRetry = false) {
+  async request(path2, options = {}, isRetry = false) {
     const headers = {
       "X-Authyon-Environment": this.envKey,
+      ...clientIpHeaders({ clientIp: this.clientIp }),
       ...options.headers
     };
     if (options.bearer) {
@@ -736,7 +925,7 @@ var AuthyonClient = class {
         });
       headers.Authorization = `Bearer ${token}`;
     }
-    const response = await this.http.send(path, { ...options, headers });
+    const response = await this.http.send(path2, { ...options, headers });
     if (response.status === 401 && options.bearer && this.autoRefresh && !isRetry && this.getSession()) {
       try {
         await this.refresh();
@@ -744,7 +933,7 @@ var AuthyonClient = class {
         this.clearSession();
         return this.http.parse(response);
       }
-      return this.request(path, options, true);
+      return this.request(path2, options, true);
     }
     return this.http.parse(response);
   }
@@ -889,6 +1078,10 @@ var AuthyonClientBuilder = class {
     this.options.autoRefresh = enabled;
     return this;
   }
+  withClientIp(clientIp) {
+    this.options.clientIp = clientIp;
+    return this;
+  }
   withTimeout(timeoutMs) {
     this.options.timeoutMs = timeoutMs;
     return this;
@@ -1109,6 +1302,11 @@ function hasPermission(source, requiredPermission) {
   const permissionSource = isPermissionList(source) ? { permissions: source } : source;
   return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
 }
+function hasPermissionGroup(source, group) {
+  const hasAll = (group.allOf ?? []).every((permission) => hasPermission(source, permission));
+  const hasAny = !group.anyOf?.length || group.anyOf.some((permission) => hasPermission(source, permission));
+  return hasAll && hasAny;
+}
 function isPermissionList(source) {
   return Array.isArray(source);
 }
@@ -1154,18 +1352,18 @@ function matchesField(pattern, field) {
   return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
 }
 function matchesConditions(subject, conditions) {
-  return Object.entries(conditions).every(([path, expected]) => {
-    if (path === "$and" && Array.isArray(expected)) {
+  return Object.entries(conditions).every(([path2, expected]) => {
+    if (path2 === "$and" && Array.isArray(expected)) {
       return expected.every(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    if (path === "$or" && Array.isArray(expected)) {
+    if (path2 === "$or" && Array.isArray(expected)) {
       return expected.some(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    return matchesValue(readPath(subject, path), expected);
+    return matchesValue(readPath(subject, path2), expected);
   });
 }
 function matchesValue(actual, expected) {
@@ -1197,8 +1395,8 @@ function matchesValue(actual, expected) {
     }
   });
 }
-function readPath(value, path) {
-  return path.split(".").reduce((current, part) => isRecord(current) ? current[part] : void 0, value);
+function readPath(value, path2) {
+  return path2.split(".").reduce((current, part) => isRecord(current) ? current[part] : void 0, value);
 }
 function defaultSubjectType(subject) {
   const explicit = subject.__type ?? subject.type ?? subject.kind;
@@ -1237,5 +1435,6 @@ function isAbilityRule(value) {
   createDefaultStorage,
   createLocalStorage,
   createMemoryStorage,
-  hasPermission
+  hasPermission,
+  hasPermissionGroup
 });

package/dist/index.d.cts

@@ -1,18 +1,5 @@
-import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-g6nBpOQM.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as Activity, h as AuthEvent, i as AuthState, j as AuthStateListener, k as AuthenticatorSetup, l as AuthyonAbility, m as AuthyonAbilityBuilder, n as AuthyonAbilityOptions, o as AuthyonClientOptions, p as AuthyonPermissionSource, q as AuthyonSessionController, C as CreateOrganizationInput, F as FetchHttpAdapter, r as HttpAdapterRequest, s as HttpLogEvent, t as HttpLogger, I as IntrospectResult, u as InviteMemberInput, L as LoggingHttpAdapter, v as LoginInput, w as LoginResult, O as Organization, x as OrganizationMember, P as Paged, y as PaginationOptions, R as RegisterInput, z as Role, S as Session, B as SessionControllerOptions, D as SessionInfo, E as SessionSnapshot, G as SessionSnapshotListener, J as SessionStatus, K as SsoProvider, M as TwoFactorChallenge, N as TwoFactorMethod, Q as TwoFactorStatus, U as User, V as ValidateResult, W as VerifyTwoFactorInput, X as WebAuthnAssertion, Y as WebAuthnCeremonyStart, Z as WebAuthnCredential, _ as createAuthyonAbility, $ as createAuthyonRules, a0 as createClient, a1 as hasPermission } from './ability-g6nBpOQM.cjs';
-
-/** Builds an Authyon browser client through explicit, progressive configuration. */
-declare class AuthyonClientBuilder {
-    private readonly options;
-    constructor(envKey: string);
-    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
-    withStorage(storage: TokenStorage): this;
-    withAutomaticRefresh(enabled?: boolean): this;
-    withTimeout(timeoutMs: number): this;
-    withHttpAdapter(httpAdapter: HttpAdapter): this;
-    withHttpLogger(httpLogger: HttpLoggerOptions): this;
-    build(): AuthyonClient;
-}
+import { T as TokenStorage, H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonClient } from './ability-BTcayvkM.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRule, f as AbilitySubject, g as AcceptOrganizationInviteInput, h as Activity, i as Approval, j as ApprovalAssurance, k as ApprovalPayload, l as ApprovalStatus, m as ApprovalWebAuthnOptions, n as AuthEvent, o as AuthState, p as AuthStateListener, q as AuthenticatorSetup, r as AuthyonAbility, s as AuthyonAbilityBuilder, t as AuthyonAbilityOptions, u as AuthyonClientOptions, v as AuthyonPermissionSource, w as AuthyonSessionController, C as ConfirmApprovalInput, x as CreateOrganizationInput, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteMemberInput, L as LoggingHttpAdapter, E as LoginInput, G as LoginResult, O as Organization, J as OrganizationInvite, K as OrganizationInviteAccepted, M as OrganizationInviteInput, N as OrganizationInviteIssued, P as OrganizationInvitePreview, Q as OrganizationInviteStatus, R as OrganizationMember, S as Paged, U as PaginationOptions, V as PasswordResetCompleted, W as PasswordResetPreview, X as PasswordResetRequestOptions, Y as PermissionGroup, Z as RegisterInput, _ as Role, $ as SecurityMethods, a0 as Session, a1 as SessionControllerOptions, a2 as SessionInfo, a3 as SessionSnapshot, a4 as SessionSnapshotListener, a5 as SessionStatus, a6 as SsoProvider, a7 as SubjectApprovals, a8 as SubjectSecurity, a9 as TwoFactorChallenge, aa as TwoFactorMethod, ab as TwoFactorStatus, ac as User, ad as ValidateResult, ae as VerifyTwoFactorInput, af as WebAuthnAssertion, ag as WebAuthnCeremonyStart, ah as WebAuthnCredential, ai as createAuthyonAbility, aj as createAuthyonRules, ak as createClient, al as hasPermission, am as hasPermissionGroup } from './ability-BTcayvkM.cjs';
 
 declare const ErrorCodes: {
     readonly Unknown: "unknown";
@@ -26,6 +13,22 @@ declare const ErrorCodes: {
     readonly PasswordWeak: "user.password_weak";
     readonly PasswordPwned: "user.password_pwned";
     readonly RateLimited: "rate_limited";
+    readonly StepUpRequired: "step_up_required";
+    readonly InvalidSecondFactorCode: "invalid_code";
+    readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
+    readonly MethodNotEnrolled: "method_not_enrolled";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
+    readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly CredentialThrottled: "credential_throttled";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";
@@ -37,6 +40,14 @@ interface AuthyonErrorInterpretation {
     retryAfter?: number;
     requestId?: string;
 }
+/** Error body as sent by the API: RFC 7807, or OAuth-style `error`/`error_description`. */
+type AuthyonErrorBody = Partial<{
+    title: string;
+    detail: string;
+    code: string;
+    error: string;
+    error_description: string;
+}> & Record<string, unknown>;
 /** Shared RFC 7807 error implementation used by both public SDKs. */
 declare class AuthyonError extends Error {
     readonly status: number;
@@ -46,11 +57,13 @@ declare class AuthyonError extends Error {
     readonly requestId?: string;
     readonly retryAfter?: number;
     readonly cause?: unknown;
-    constructor(status: number, body: Partial<{
-        title: string;
-        detail: string;
-        code: string;
-    }>, options?: {
+    /**
+     * Extra fields from the error body beyond code/title/detail — e.g.
+     * `attemptsRemaining` on `invalid_code` or `requiredMethods` on
+     * `step_up_required`. Not included in {@link toJSON}.
+     */
+    readonly extensions: Readonly<Record<string, unknown>>;
+    constructor(status: number, body: AuthyonErrorBody, options?: {
         requestId?: string;
         retryAfter?: number;
         cause?: unknown;
@@ -66,10 +79,24 @@ declare class AuthyonError extends Error {
     toJSON(): Record<string, unknown>;
 }
 
+/** Builds an Authyon browser client through explicit, progressive configuration. */
+declare class AuthyonClientBuilder {
+    private readonly options;
+    constructor(envKey: string);
+    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
+    withStorage(storage: TokenStorage): this;
+    withAutomaticRefresh(enabled?: boolean): this;
+    withClientIp(clientIp: string): this;
+    withTimeout(timeoutMs: number): this;
+    withHttpAdapter(httpAdapter: HttpAdapter): this;
+    withHttpLogger(httpLogger: HttpLoggerOptions): this;
+    build(): AuthyonClient;
+}
+
 /** Keeps the session in memory only (lost on page reload). */
 declare function createMemoryStorage(): TokenStorage;
 /** Persists the session in `localStorage` under a namespaced key. */
 declare function createLocalStorage(key?: string): TokenStorage;
 declare function createDefaultStorage(): TokenStorage;
 
-export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };
+export { AuthyonClient, AuthyonClientBuilder, AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode, TokenStorage, createDefaultStorage, createLocalStorage, createMemoryStorage };