@authyon/server 0.2.0-beta.0 → 0.2.0-beta.11

package/dist/index.d.ts

@@ -1,519 +1,71 @@
-/** GET/POST /env/tenants — confirmed against the live API. */
-interface Organization {
-    id: string;
-    slug: string;
-    name?: string;
-    description?: string | null;
-    environmentId?: string;
-    workspaceId?: string;
-    isDisabled?: boolean;
-    memberCount?: number;
-    createdAt?: string;
-    updatedAt?: string;
-}
-/** One of a user's tenant memberships, as embedded in `EnvironmentUser.tenantMemberships`. */
-interface TenantMembership {
-    tenantId: string;
-    tenantSlug: string;
-    tenantName: string;
-    tenantDisabled: boolean;
-    roles: string[];
-}
-/** Lightweight user shape returned by `introspect()`/`validate()`. */
-interface User {
-    id: string;
-    email: string;
-    username?: string;
-    permissions?: string[];
-}
-interface RoleGrant {
-    role: string;
-    expiresAt?: string | null;
-}
-/**
- * Full user record from the EnvironmentManagement plane
- * (`environment.users.get()` / `.list()`), confirmed against the live API.
- * `get()` returns every field below; `list()` returns a subset (no
- * `failedLoginAttempts`, `lockedOutUntil`, `roleGrants`,
- * `directPermissions`, `effectivePermissions`, `refreshTokens`,
- * `tenantMemberships`, `totpConfirmedAt`, `emailOtpEnabledAt`,
- * `remainingRecoveryCodes`, `disableReason`, `suspension`, `deleteReason`,
- * `customFields` — and `suspendedUntil` instead of `suspension`).
- */
-interface EnvironmentUser {
-    id: string;
-    email: string;
-    username?: string;
-    firstName?: string | null;
-    lastName?: string | null;
-    emailConfirmed: boolean;
-    isDisabled: boolean;
-    createdAt: string;
-    lastLoginAt?: string | null;
-    failedLoginAttempts?: number;
-    lockedOutUntil?: string | null;
-    roles: string[];
-    roleGrants?: RoleGrant[];
-    directPermissions?: string[];
-    effectivePermissions?: string[];
-    /** Confirmed shape unknown — empty in every response seen so far. */
-    refreshTokens?: unknown[];
-    tenantIds: string[];
-    tenantMemberships?: TenantMembership[];
-    /** Flattened role names across all tenant memberships (list() only). */
-    tenantRoles?: string[];
-    twoFactorMethods: string[];
-    totpConfirmedAt?: string | null;
-    emailOtpEnabledAt?: string | null;
-    remainingRecoveryCodes?: number;
-    disableReason?: string | null;
-    suspension?: unknown | null;
-    suspendedUntil?: string | null;
-    deletedAt?: string | null;
-    deleteReason?: string | null;
-    /** JSON-encoded string. */
-    customFields?: string;
-}
-/** POST /auth/introspect (RFC 7662) — confirmed against the live API. */
-interface IntrospectResult {
-    active: boolean;
-    sub?: string;
-    username?: string | null;
-    email?: string | null;
-    roles?: string[] | null;
-    permissions?: string[];
-    client_id?: string;
-    scope?: string;
-    exp?: number;
-    iat?: number;
-    jti?: string;
-    token_type?: string;
-}
-/**
- * POST /auth/validate — confirmed against the live API. The wire shape is
- * `{ valid, reason, profile }`, not `{ user, organization }` as the
- * OpenAPI schema (which didn't document response bodies) suggested.
- * `profile` is `null` for machine tokens (there's no user behind them) and
- * for tokens that fail validation.
- */
-interface ValidateResult {
-    valid: boolean;
-    reason?: string | null;
-    user: User | null;
-}
-/**
- * A role available within an environment or one of its tenants. Confirmed
- * live: system roles carry no `id`/`description` (only `name` +
- * `permissions`) — both are only populated for custom roles you create.
- */
-interface Role {
-    id?: string | null;
-    name: string;
-    description?: string | null;
-    permissions: string[];
-}
-interface RoleInput {
-    name: string;
-    description?: string;
-    permissions?: string[];
-}
-/**
- * GET /env/roles and GET /tenant/roles group results by origin instead of
- * returning a flat array — confirmed live for the environment endpoint.
- */
-interface RoleList {
-    custom: Role[];
-    system: Role[];
-}
-/** A permission entry as it appears nested under a role in `PermissionsByRole`. */
-interface Permission {
-    value: string;
-    description?: string | null;
-    /** Confirmed live: `null` for the built-in catalog: no separate id per entry. */
-    catalogId?: string | null;
-}
-/** A role entry as returned by GET /env/permissions, with its permissions nested. */
-interface RolePermissions {
-    roleId: string | null;
-    name: string;
-    description?: string | null;
-    isSystem: boolean;
-    permissions: Permission[];
-}
-/** GET /env/permissions — confirmed live: grouped by role, plus any orphaned entries. */
-interface PermissionsByRole {
-    roles: RolePermissions[];
-    orphans: Permission[];
-}
-/** GET /permissions/reserved — confirmed live: wrapped, not a bare string array. */
-interface ReservedPermissions {
-    namespace: string;
-    items: string[];
-}
-interface CreatePermissionInput {
-    value: string;
-    description?: string;
-    /** Attach the new permission to this role immediately. */
-    attachToRoleId?: string;
-}
-interface CreateOrganizationInput {
-    name: string;
-    slug: string;
-    description?: string;
-}
-interface UpdateOrganizationInput {
-    name: string;
-    description?: string;
-}
-interface CreateUserInput {
-    email: string;
-    username: string;
-    password: string;
-    emailConfirmed?: boolean;
-    roles?: string[];
-    /** Tenants (organizations) to add the user to on creation. */
-    tenantIds?: string[];
-}
-/** GET /env/audit — one audit-trail entry, confirmed against the live API. */
-interface AuditEvent {
-    id: string;
-    occurredAt: string;
-    eventType: string;
-    /** JSON-encoded string — `JSON.parse` it for the event-specific payload. */
-    payloadJson?: string;
-    workspaceId?: string;
-    environmentId?: string;
-    actorUserId?: string | null;
-    actorType?: string;
-    actorIp?: string;
-    userAgent?: string;
-    tenantId?: string | null;
-}
-/**
- * GET /env/audit/login-activity. Not confirmed with a populated example
- * live (the test environment had none) — assumed to share `AuditEvent`'s
- * shape, since login activity is the same underlying audit-event stream
- * filtered to sign-in events.
- */
-type LoginActivity = AuditEvent;
-/**
- * Envelope every `skip`/`take`-paginated list endpoint returns, confirmed
- * live for `/env/users`, `/env/audit` and `/env/audit/login-activity`.
- * Endpoints without `skip`/`take` params (e.g. `/env/tenants`) return a
- * bare array instead.
- */
-interface Page<T> {
-    data: T[];
-    /** Item count actually returned for this page. */
-    perPage?: number;
-    pageSize: number;
-    total: number;
-    pages: number;
-    hasNext: boolean;
-    hasPrev: boolean;
-}
-/** Pagination options accepted by list endpoints. */
-interface PageParams {
-    skip?: number;
-    take?: number;
-}
-/** OAuth 2.0 client-credentials pair minted in the Authyon console. */
-interface ClientCredentials {
-    clientId: string;
-    clientSecret: string;
-}
-/** Standard OAuth 2.0 client-credentials token response. */
-interface TokenResult {
-    access_token: string;
-    token_type: string;
-    expires_in: number;
-    scope?: string;
-}
-interface JsonWebKeySet {
-    keys: Record<string, unknown>[];
-}
-interface OpenIdConfiguration {
-    issuer: string;
-    jwks_uri: string;
-    authorization_endpoint?: string;
-    token_endpoint?: string;
-    [key: string]: unknown;
-}
-interface AuthyonServerClientOptions {
-    /**
-     * Publishable environment key (`pk_live_...` / `pk_test_...`), sent as
-     * `X-Authyon-Environment`. Required on **every** call — it selects the
-     * environment (Test / Live) that a request applies to, independently of
-     * whichever bearer token authenticates it.
-     */
-    envKey?: string;
-    /**
-     * Environment-level OAuth client credentials (`ec_...` / secret), minted
-     * in the console. Required for everything under `environment.*` and
-     * `permissions.*` — the SDK exchanges them for a short-lived access token
-     * via `POST /env/oauth/token` and refreshes it transparently.
-     */
-    clientId?: string;
-    clientSecret?: string;
-    /** API origin. Defaults to `https://api.authyon.com`. */
-    baseUrl?: string;
-    /** Custom fetch implementation (useful for tests / edge runtimes). */
-    fetch?: typeof fetch;
-}
-
-interface RequestOptions {
-    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-    body?: unknown;
-    query?: object;
-    headers?: Record<string, string>;
-    /** Attach the cached environment access token, minting one first if needed. */
-    envBearer?: boolean;
-}
-/**
- * Server-side Authyon client: environment/tenant administration (OAuth
- * client-credentials) plus access-token verification (publishable key).
- * Never import this in browser code — client secrets must stay on your
- * server.
- */
-declare class AuthyonServerClient {
-    private readonly envKey?;
-    private readonly clientId?;
-    private readonly clientSecret?;
-    private readonly baseUrl;
-    private readonly fetchImpl;
-    private environmentToken;
-    private environmentTokenInFlight;
-    constructor(options?: AuthyonServerClientOptions);
-    private request;
-    /** Mints (and caches) an environment access token from `clientId`/`clientSecret`. */
-    private getEnvironmentAccessToken;
-    readonly discovery: {
-        /** GET /.well-known/jwks.json — the environment's public signing keys. */
-        jwks: (publishableKey?: string) => Promise<JsonWebKeySet>;
-        /** GET /.well-known/openid-configuration — OIDC discovery document. */
-        openidConfiguration: (publishableKey?: string) => Promise<OpenIdConfiguration>;
-    };
-    /** POST /auth/introspect — lightweight token introspection (RFC 7662). */
-    introspect(token: string): Promise<IntrospectResult>;
-    /** POST /auth/validate — recommended: cross-checks DB state, catches revocation immediately. */
-    validate(token: string): Promise<ValidateResult>;
-    readonly environmentAuth: {
-        /** POST /env/oauth/token — exchanges environment client credentials for an access token. */
-        token: (credentials: ClientCredentials) => Promise<TokenResult>;
-    };
-    readonly tenantAuth: {
-        /** POST /tenant/oauth/token — exchanges a tenant's client credentials for a scoped access token. */
-        token: (credentials: ClientCredentials) => Promise<TokenResult>;
-    };
-    /**
-     * Scopes a client to a single tenant's OAuth credentials — mints and
-     * caches its access token independently of the environment plane. Use
-     * this for the `TenantManagement` endpoints (`/tenant/...`), which act on
-     * "the token's tenant" rather than one you pass by id.
-     */
-    tenant(credentials: ClientCredentials): TenantScopedClient;
-    readonly environment: {
-        users: {
-            /** GET /env/users — paginated list of users in the environment. */
-            list: (params?: {
-                search?: string;
-            } & PageParams) => Promise<Page<EnvironmentUser>>;
-            /** POST /env/users — create a user in the environment; returns only the new id. */
-            create: (input: CreateUserInput) => Promise<{
-                id: string;
-            }>;
-            /** GET /env/users/{userId} — fetch an environment user by id. */
-            get: (userId: string) => Promise<EnvironmentUser>;
-            /** POST /env/users/{userId}/roles — grant a role to an environment user. */
-            assignRole: (userId: string, role: string) => Promise<void>;
-            /** DELETE /env/users/{userId}/roles/{role} — revoke a role from an environment user. */
-            removeRole: (userId: string, role: string) => Promise<void>;
-            /** POST /env/users/{userId}/permissions — grant a direct permission to an environment user. */
-            grantPermission: (userId: string, permission: string) => Promise<void>;
-            /** DELETE /env/users/{userId}/permissions/{permission} — revoke a direct permission. */
-            revokePermission: (userId: string, permission: string) => Promise<void>;
-            /** POST /env/users/{userId}/unlock — clears an environment user's lockout. */
-            unlock: (userId: string, reason?: string) => Promise<void>;
-            /** POST /env/users/{userId}/password — sets a new password for the user. */
-            setPassword: (userId: string, newPassword: string, reason?: string) => Promise<void>;
-            /** POST /env/users/{userId}/sessions/revoke-all — revokes every session the user has. */
-            revokeSessions: (userId: string, reason?: string) => Promise<void>;
-            /** DELETE /env/users/{userId}/sessions/{sessionId} — revokes a single session. */
-            revokeSession: (userId: string, sessionId: string, reason?: string) => Promise<void>;
-            /** POST /env/users/{userId}/disable — bans the user indefinitely; revokes live sessions. */
-            disable: (userId: string, reason?: string) => Promise<void>;
-            /** POST /env/users/{userId}/enable — lifts a ban. */
-            enable: (userId: string, reason?: string) => Promise<void>;
-            /** POST /env/users/{userId}/suspend — blocks the user temporarily; clears itself after `durationMinutes`. */
-            suspend: (userId: string, durationMinutes: number, reason?: string) => Promise<void>;
-            /** POST /env/users/{userId}/unsuspend — lifts a suspension early. */
-            unsuspend: (userId: string, reason?: string) => Promise<void>;
-            /** POST /env/users/{userId}/tenants — adds an environment user to a tenant. */
-            assignTenant: (userId: string, tenantId: string, roles?: string[]) => Promise<void>;
-            /** DELETE /env/users/{userId}/tenants/{tenantId} — removes an environment user from a tenant. */
-            removeTenant: (userId: string, tenantId: string) => Promise<void>;
-        };
-        tenants: {
-            /** GET /env/tenants — list tenants in the environment. */
-            list: () => Promise<Organization[]>;
-            /** POST /env/tenants — create a tenant in the environment. */
-            create: (input: CreateOrganizationInput) => Promise<Organization>;
-            /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
-            get: (tenantId: string) => Promise<Organization>;
-            /** PUT /env/tenants/{tenantId} — update a tenant. */
-            update: (tenantId: string, input: UpdateOrganizationInput) => Promise<Organization>;
-            /** DELETE /env/tenants/{tenantId} — delete a tenant. */
-            delete: (tenantId: string) => Promise<void>;
-            members: {
-                /**
-                 * GET /env/tenants/{tenantId}/members — a tenant's members as full
-                 * user records. Confirmed live: a bare array (unlike
-                 * `environment.users.list()`, this one does NOT paginate despite
-                 * accepting `skip`/`take`), with the same shape
-                 * `environment.users.list()` items have.
-                 */
-                list: (tenantId: string, params?: PageParams) => Promise<EnvironmentUser[]>;
-                /** POST /env/tenants/{tenantId}/members — add a member to a tenant. */
-                add: (tenantId: string, userId: string, roles?: string[]) => Promise<void>;
-                /** DELETE /env/tenants/{tenantId}/members/{userId} — remove a member from a tenant. */
-                remove: (tenantId: string, userId: string) => Promise<void>;
-                /** POST /env/tenants/{tenantId}/members/{userId}/roles — grant a tenant role to a member. */
-                assignRole: (tenantId: string, userId: string, role: string) => Promise<void>;
-                /** DELETE .../members/{userId}/roles/{role} — revoke a tenant role from a member. */
-                removeRole: (tenantId: string, userId: string, role: string) => Promise<void>;
-                /** POST .../members/{userId}/permissions — grant a permission to a tenant member. */
-                grantPermission: (tenantId: string, userId: string, permission: string) => Promise<void>;
-                /** DELETE .../members/{userId}/permissions/{permission} — revoke a permission from a tenant member. */
-                revokePermission: (tenantId: string, userId: string, permission: string) => Promise<void>;
-            };
-            roles: {
-                /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
-                list: (tenantId: string) => Promise<Role[]>;
-                /** POST /env/tenants/{tenantId}/roles — create a tenant role. */
-                create: (tenantId: string, input: RoleInput) => Promise<Role>;
-                /** GET /env/tenants/{tenantId}/roles/{roleId} — fetch a tenant role by id. */
-                get: (tenantId: string, roleId: string) => Promise<Role>;
-                /** PUT /env/tenants/{tenantId}/roles/{roleId} — update a tenant role. */
-                update: (tenantId: string, roleId: string, input: RoleInput) => Promise<Role>;
-                /** DELETE /env/tenants/{tenantId}/roles/{roleId} — delete a tenant role. */
-                delete: (tenantId: string, roleId: string) => Promise<void>;
-            };
-        };
-        roles: {
-            /** GET /env/roles — environment-level roles, grouped into custom and system-defined. */
-            list: () => Promise<RoleList>;
-            /** POST /env/roles — create an environment-level role. */
-            create: (input: RoleInput) => Promise<Role>;
-            /** PUT /env/roles/{roleId} — update an environment-level role. */
-            update: (roleId: string, input: RoleInput) => Promise<Role>;
-            /** DELETE /env/roles/{roleId} — delete an environment-level role. */
-            delete: (roleId: string) => Promise<void>;
-        };
-        permissions: {
-            /** GET /env/permissions — environment-level permissions, grouped by the role they're attached to. */
-            list: () => Promise<PermissionsByRole>;
-            /** POST /env/permissions — create an environment-level permission. */
-            create: (input: CreatePermissionInput) => Promise<Permission>;
-            /** PUT /env/permissions/{permissionId} — update an environment-level permission. */
-            update: (permissionId: string, description?: string) => Promise<Permission>;
-            /** DELETE /env/permissions/{permissionId} — delete an environment-level permission. */
-            delete: (permissionId: string) => Promise<void>;
-            /** GET /permissions/reserved — reserved permission names you can't redefine. */
-            reserved: () => Promise<ReservedPermissions>;
-        };
-        audit: {
-            /** GET /env/audit — paginated list of the environment's audit events. */
-            list: (params?: PageParams) => Promise<Page<AuditEvent>>;
-            /** GET /env/audit/login-activity — paginated login activity in the environment. */
-            loginActivity: (params?: PageParams) => Promise<Page<LoginActivity>>;
-        };
-    };
-    readonly permissions: {
-        /** POST /users/{userId}/permissions — grant a permission directly to a user. */
-        grant: (userId: string, permission: string) => Promise<void>;
-        /** DELETE /users/{userId}/permissions/{permission} — revoke a permission from a user. */
-        revoke: (userId: string, permission: string) => Promise<void>;
-    };
-    /** @internal used by {@link TenantScopedClient} to share the base URL/fetch/error handling. */
-    _requestAsTenant<T>(accessToken: string, path: string, options?: RequestOptions): Promise<T>;
-}
-/**
- * Client scoped to a single tenant's OAuth credentials — every call acts on
- * "the token's tenant" (`TenantManagement` endpoints), so there's no
- * `tenantId` parameter to pass.
- */
-declare class TenantScopedClient {
-    private readonly server;
-    private readonly credentials;
-    private token;
-    private tokenInFlight;
-    constructor(server: AuthyonServerClient, credentials: ClientCredentials);
-    private getAccessToken;
-    private request;
-    readonly members: {
-        /**
-         * GET /tenant/members — members of the token's tenant.
-         *
-         * ⚠️ Inferred, not confirmed live (no tenant client credentials
-         * available to exchange for a scoped token) — assumed to share
-         * `/env/tenants/{id}/members`'s confirmed shape (bare array of full
-         * user records), since both are the "admin" member listing as opposed
-         * to `/auth/tenants/{id}/members`'s paginated, lightweight one.
-         */
-        list: (params?: PageParams) => Promise<EnvironmentUser[]>;
-        /** POST /tenant/members — add a member to the token's tenant. */
-        add: (userId: string, roles?: string[]) => Promise<void>;
-        /** DELETE /tenant/members/{userId} — remove a member from the token's tenant. */
-        remove: (userId: string) => Promise<void>;
-        /** POST /tenant/members/{userId}/roles — grant a role to a member of the tenant. */
-        assignRole: (userId: string, role: string) => Promise<void>;
-        /** DELETE /tenant/members/{userId}/roles/{role} — revoke a role from a member of the tenant. */
-        removeRole: (userId: string, role: string) => Promise<void>;
-        /** POST /tenant/members/{userId}/permissions — grant a permission to a member of the tenant. */
-        grantPermission: (userId: string, permission: string) => Promise<void>;
-        /** DELETE .../permissions/{permission} — revoke a permission from a member of the tenant. */
-        revokePermission: (userId: string, permission: string) => Promise<void>;
-    };
-    readonly roles: {
-        /**
-         * GET /tenant/roles — roles in the token's tenant, grouped into custom
-         * and system-defined.
-         *
-         * ⚠️ Inferred, not confirmed live (the test environment had no tenants
-         * to exchange a scoped token for) — assumed to share `/env/roles`'
-         * grouped shape, since both operate on the same underlying role model.
-         */
-        list: () => Promise<RoleList>;
-        /** POST /tenant/roles — create a role in the tenant. */
-        create: (input: RoleInput) => Promise<Role>;
-        /** GET /tenant/roles/{roleId} — fetch a tenant role by id. */
-        get: (roleId: string) => Promise<Role>;
-        /** PUT /tenant/roles/{roleId} — update a role in the tenant. */
-        update: (roleId: string, input: RoleInput) => Promise<Role>;
-        /** DELETE /tenant/roles/{roleId} — delete a role in the tenant. */
-        delete: (roleId: string) => Promise<void>;
-    };
-}
-/** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
-declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-D-DxoL30.js';
+export { b as AcceptWorkspaceInviteInput, c as AccessTokenSource, d as AuditEvent, e as AuthyonJwksDiscoveryOptions, f as AuthyonJwtClaims, g as AuthyonServerClientOptions, C as ClientCredentials, h as ClientRequestContext, i as CreateCredentialInput, j as CreateOrganizationInput, k as CreatePermissionInput, l as CreateTenantCredentialInput, m as CreateUserInput, n as CredentialCreator, o as CredentialDetail, p as CredentialListOptions, q as CredentialPermissionsInput, r as CredentialScope, E as EnvironmentUser, F as FetchHttpAdapter, s as HttpAdapterRequest, t as HttpLogEvent, u as HttpLogger, I as IntrospectResult, v as InviteTenantMemberInput, w as InviteWorkspaceMemberInput, J as JsonWebKeySet, x as JwksTokenVerifier, y as JwksTokenVerifierOptions, L as LoggingHttpAdapter, z as LoginActivity, O as OpenIdConfiguration, B as Organization, P as Paged, D as PaginationOptions, G as Permission, K as PermissionsByRole, M as PlatformScopedClient, R as ReservedPermissions, N as Role, Q as RoleGrant, S as RoleInput, T as RoleList, U as RolePermissions, V as SafeJwtAlgorithm, W as TenantClientValidationResult, X as TenantCredentialIssued, Y as TenantCredentialSummary, Z as TenantManagementScope, _ as TenantMember, $ as TenantMemberPage, a0 as TenantMembership, a1 as TenantScopedClient, a2 as TokenResult, a3 as TokenVerificationError, a4 as TokenVerificationErrorCode, a5 as UpdateOrganizationInput, a6 as User, a7 as UserScopedClient, a8 as ValidateResult, a9 as VerifiedAccessToken, aa as WorkspaceInvite, ab as WorkspaceInviteAccepted, ac as WorkspaceInviteIssued, ad as WorkspaceInvitePreview, ae as WorkspaceInvitesClient, af as WorkspaceMember, ag as WorkspaceRole, ah as WorkspaceTeam, ai as createClient, aj as normalizeClientIp } from './authyonServerClient-D-DxoL30.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-D_A6L9Ie.js';
+import 'jose';
 
-/**
- * Error thrown for any non-2xx Authyon API response.
- *
- * The API uses RFC 7807 problem+json: `{ title, status, detail, code }`.
- * Match on the machine-readable `code` (e.g. `user.email_taken`), never on `title`.
- */
+declare const ErrorCodes: {
+    readonly Unknown: "unknown";
+    readonly NetworkError: "request.network_error";
+    readonly Timeout: "request.timeout";
+    readonly SessionMalformed: "session.malformed";
+    readonly NotAuthenticated: "auth.not_authenticated";
+    readonly InvalidToken: "auth.invalid_token";
+    readonly MissingToken: "auth.missing_token";
+    readonly EmailTaken: "user.email_taken";
+    readonly PasswordWeak: "user.password_weak";
+    readonly PasswordPwned: "user.password_pwned";
+    readonly RateLimited: "rate_limited";
+};
+type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
+type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";
+type AuthyonErrorAction = "retry" | "reauthenticate" | "request_access" | "fix_input" | "not_found" | "resolve_conflict" | "contact_support";
+interface AuthyonErrorInterpretation {
+    category: AuthyonErrorCategory;
+    action: AuthyonErrorAction;
+    retryable: boolean;
+    retryAfter?: number;
+    requestId?: string;
+}
+/** Shared RFC 7807 error implementation used by both public SDKs. */
 declare class AuthyonError extends Error {
     readonly status: number;
     readonly code: string;
     readonly title: string;
     readonly detail?: string;
+    readonly requestId?: string;
+    readonly retryAfter?: number;
+    readonly cause?: unknown;
     constructor(status: number, body: Partial<{
         title: string;
         detail: string;
         code: string;
-    }>);
+    }>, options?: {
+        requestId?: string;
+        retryAfter?: number;
+        cause?: unknown;
+    });
     is(code: string): boolean;
+    isAny(...codes: readonly string[]): boolean;
+    hasPrefix(prefix: string): boolean;
+    isStatus(...statuses: readonly number[]): boolean;
+    /** Stable interpretation for UI decisions, retries, telemetry and support flows. */
+    interpret(): AuthyonErrorInterpretation;
+    get category(): AuthyonErrorCategory;
+    get retryable(): boolean;
+    toJSON(): Record<string, unknown>;
+}
+
+/** Builds a server client while keeping environment credentials grouped. */
+declare class AuthyonServerClientBuilder {
+    #private;
+    withEnvironmentKey(envKey: string): this;
+    withEnvironmentCredentials(clientId: string, clientSecret: string): this;
+    withClientIp(clientIp: string): this;
+    withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
+    withTimeout(timeoutMs: number): this;
+    withHttpAdapter(httpAdapter: HttpAdapter): this;
+    withHttpLogger(httpLogger: HttpLoggerOptions): this;
+    build(): AuthyonServerClient;
 }
 
-export { type AuditEvent, AuthyonError, AuthyonServerClient, type AuthyonServerClientOptions, type ClientCredentials, type CreateOrganizationInput, type CreatePermissionInput, type CreateUserInput, type EnvironmentUser, type IntrospectResult, type JsonWebKeySet, type LoginActivity, type OpenIdConfiguration, type Organization, type Page, type PageParams, type Permission, type PermissionsByRole, type ReservedPermissions, type Role, type RoleGrant, type RoleInput, type RoleList, type RolePermissions, type TenantMembership, TenantScopedClient, type TokenResult, type UpdateOrganizationInput, type User, type ValidateResult, createClient };
+export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode };