@authyon/server 0.2.0-beta.1 → 0.2.0-beta.11

package/dist/authyonServerClient-D-DxoL30.d.cts

@@ -0,0 +1,898 @@
+import { JSONWebKeySet, JWTPayload, JWSHeaderParameters } from 'jose';
+
+interface HttpAdapterRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body?: BodyInit | null;
+    signal: AbortSignal;
+}
+/** Transport contract accepted by both Authyon clients. */
+interface HttpAdapter {
+    request(request: HttpAdapterRequest): Promise<Response>;
+}
+type HttpLogEvent = {
+    type: "request";
+    method: string;
+    url: string;
+    timestamp: number;
+} | {
+    type: "response";
+    method: string;
+    url: string;
+    status: number;
+    durationMs: number;
+    requestId?: string;
+    timestamp: number;
+} | {
+    type: "error";
+    method: string;
+    url: string;
+    errorName: string;
+    durationMs: number;
+    timestamp: number;
+};
+/** Receives sanitized HTTP lifecycle events. Headers, bodies and query values are never exposed. */
+type HttpLogger = (event: HttpLogEvent) => void;
+/**
+ * Mutable logging configuration. Change `enabled` at runtime to enable or disable logging
+ * without recreating the Authyon client.
+ */
+interface HttpLoggerOptions {
+    enabled: boolean;
+    logger?: HttpLogger;
+}
+/** Default adapter backed by the platform's Fetch API. */
+declare class FetchHttpAdapter implements HttpAdapter {
+    private readonly fetchImpl;
+    constructor(fetchImpl?: typeof fetch);
+    request(request: HttpAdapterRequest): Promise<Response>;
+}
+/** Adds safe, configurable lifecycle logging to any HTTP adapter. */
+declare class LoggingHttpAdapter implements HttpAdapter {
+    private readonly adapter;
+    private readonly options;
+    constructor(adapter: HttpAdapter, options: HttpLoggerOptions);
+    request(request: HttpAdapterRequest): Promise<Response>;
+    private log;
+}
+
+interface PaginationOptions {
+    skip?: number;
+    take?: number;
+}
+interface Paged<T> {
+    data: T[];
+    perPage?: number;
+    pageSize: number;
+    total: number;
+    pages: number;
+    hasNext: boolean;
+    hasPrev: boolean;
+}
+interface IntrospectResult {
+    active: boolean;
+    sub?: string;
+    username?: string | null;
+    email?: string | null;
+    roles?: string[] | null;
+    permissions?: string[];
+    client_id?: string;
+    scope?: string;
+    exp?: number;
+    iat?: number;
+    jti?: string;
+    token_type?: string;
+}
+
+/** GET/POST /env/tenants — confirmed against the live API. */
+interface Organization {
+    id: string;
+    slug: string;
+    name?: string;
+    description?: string | null;
+    environmentId?: string;
+    workspaceId?: string;
+    isDisabled?: boolean;
+    memberCount?: number;
+    createdAt?: string;
+    updatedAt?: string;
+    /** JSON-encoded values for the tenant's configured custom fields. */
+    customFields?: string;
+    /** JSON-encoded metadata that may be exposed to tenant members. */
+    publicMetadata?: string;
+    /** JSON-encoded metadata available only through administrative APIs. */
+    privateMetadata?: string;
+}
+/** One of a user's tenant memberships, as embedded in `EnvironmentUser.tenantMemberships`. */
+interface TenantMembership {
+    tenantId: string;
+    tenantSlug: string;
+    tenantName: string;
+    tenantDisabled: boolean;
+    roles: string[];
+}
+/** Lightweight user shape returned by `introspect()`/`validate()`. */
+interface User {
+    id: string;
+    email: string;
+    username?: string;
+    /** Environment-level roles from the database-validated user profile. */
+    roles?: string[];
+    permissions?: string[];
+}
+interface RoleGrant {
+    role: string;
+    expiresAt?: string | null;
+}
+/**
+ * Full user record from the EnvironmentManagement plane
+ * (`environment.users.get()` / `.list()`), confirmed against the live API.
+ * `get()` returns every field below; `list()` returns a subset (no
+ * `failedLoginAttempts`, `lockedOutUntil`, `roleGrants`,
+ * `directPermissions`, `effectivePermissions`, `refreshTokens`,
+ * `tenantMemberships`, `totpConfirmedAt`, `emailOtpEnabledAt`,
+ * `remainingRecoveryCodes`, `disableReason`, `suspension`, `deleteReason`,
+ * `customFields` — and `suspendedUntil` instead of `suspension`).
+ */
+interface EnvironmentUser {
+    id: string;
+    email: string;
+    username?: string;
+    firstName?: string | null;
+    lastName?: string | null;
+    emailConfirmed: boolean;
+    isDisabled: boolean;
+    createdAt: string;
+    lastLoginAt?: string | null;
+    failedLoginAttempts?: number;
+    lockedOutUntil?: string | null;
+    roles: string[];
+    roleGrants?: RoleGrant[];
+    directPermissions?: string[];
+    effectivePermissions?: string[];
+    /** Confirmed shape unknown — empty in every response seen so far. */
+    refreshTokens?: unknown[];
+    tenantIds: string[];
+    tenantMemberships?: TenantMembership[];
+    /** Flattened role names across all tenant memberships (list() only). */
+    tenantRoles?: string[];
+    twoFactorMethods: string[];
+    totpConfirmedAt?: string | null;
+    emailOtpEnabledAt?: string | null;
+    remainingRecoveryCodes?: number;
+    disableReason?: string | null;
+    suspension?: unknown | null;
+    suspendedUntil?: string | null;
+    deletedAt?: string | null;
+    deleteReason?: string | null;
+    /** JSON-encoded string. */
+    customFields?: string;
+}
+/**
+ * POST /auth/validate — confirmed against the live API. The wire shape is
+ * `{ valid, reason, profile }`, not `{ user, organization }` as the
+ * OpenAPI schema (which didn't document response bodies) suggested.
+ * `profile` is `null` for machine tokens (there's no user behind them) and
+ * for tokens that fail validation.
+ */
+interface ValidateResult {
+    valid: boolean;
+    reason?: string | null;
+    user: User | null;
+}
+/**
+ * A role available within an environment or one of its tenants. Confirmed
+ * live: system roles carry no `id`/`description` (only `name` +
+ * `permissions`) — both are only populated for custom roles you create.
+ */
+interface Role {
+    id?: string | null;
+    name: string;
+    description?: string | null;
+    permissions: string[];
+}
+interface RoleInput {
+    name: string;
+    description?: string;
+    permissions?: string[];
+}
+/**
+ * GET /env/roles and GET /tenant/roles group results by origin instead of
+ * returning a flat array — confirmed live for the environment endpoint.
+ */
+interface RoleList {
+    custom: Role[];
+    system: Role[];
+}
+/** A permission entry as it appears nested under a role in `PermissionsByRole`. */
+interface Permission {
+    value: string;
+    description?: string | null;
+    /** Confirmed live: `null` for the built-in catalog: no separate id per entry. */
+    catalogId?: string | null;
+}
+/** A role entry as returned by GET /env/permissions, with its permissions nested. */
+interface RolePermissions {
+    roleId: string | null;
+    name: string;
+    description?: string | null;
+    isSystem: boolean;
+    permissions: Permission[];
+}
+/** GET /env/permissions — confirmed live: grouped by role, plus any orphaned entries. */
+interface PermissionsByRole {
+    roles: RolePermissions[];
+    orphans: Permission[];
+}
+/** GET /permissions/reserved — confirmed live: wrapped, not a bare string array. */
+interface ReservedPermissions {
+    namespace: string;
+    items: string[];
+}
+interface CreatePermissionInput {
+    value: string;
+    description?: string;
+    /** Attach the new permission to this role immediately. */
+    attachToRoleId?: string;
+}
+interface CreateOrganizationInput {
+    name: string;
+    slug: string;
+    description?: string;
+    customFields?: Record<string, unknown>;
+    publicMetadata?: Record<string, unknown>;
+    privateMetadata?: Record<string, unknown>;
+}
+interface UpdateOrganizationInput {
+    name: string;
+    description?: string;
+    customFields?: Record<string, unknown>;
+}
+interface CreateUserInput {
+    email: string;
+    username: string;
+    password: string;
+    emailConfirmed?: boolean;
+    roles?: string[];
+    /** Tenants (organizations) to add the user to on creation. */
+    tenantIds?: string[];
+}
+/** GET /env/audit — one audit-trail entry, confirmed against the live API. */
+interface AuditEvent {
+    id: string;
+    occurredAt: string;
+    eventType: string;
+    /** JSON-encoded string — `JSON.parse` it for the event-specific payload. */
+    payloadJson?: string;
+    workspaceId?: string;
+    environmentId?: string;
+    actorUserId?: string | null;
+    actorType?: string;
+    actorIp?: string;
+    userAgent?: string;
+    tenantId?: string | null;
+}
+/**
+ * GET /env/audit/login-activity. Not confirmed with a populated example
+ * live (the test environment had none) — assumed to share `AuditEvent`'s
+ * shape, since login activity is the same underlying audit-event stream
+ * filtered to sign-in events.
+ */
+type LoginActivity = AuditEvent;
+/**
+ * Envelope every `skip`/`take`-paginated list endpoint returns, confirmed
+ * live for `/env/users`, `/env/audit` and `/env/audit/login-activity`.
+ * Endpoints without `skip`/`take` params return a bare array instead.
+ */
+/** Tenant credential metadata. Listing never returns the secret. */
+interface TenantCredentialSummary {
+    id: string;
+    clientId: string;
+    description: string | null;
+    createdAt: string;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+    expiresAt: string | null;
+    isActive: boolean;
+    permissions: string[];
+}
+/** Input for a tenant machine credential. Requires at least one explicit permission. */
+interface CreateTenantCredentialInput {
+    description: string;
+    /** Number of days until the tenant credential expires. Omit for no automatic expiration. */
+    lifetimeDays?: number | null;
+    permissions: string[];
+}
+/** The plaintext secret is returned only when the credential is issued. */
+interface TenantCredentialIssued {
+    credentialId: string;
+    clientId: string;
+    clientSecret: string;
+    createdAt: string;
+    expiresAt: string | null;
+    permissions: string[];
+}
+/** OAuth 2.0 client-credentials pair minted in the Authyon console. */
+interface ClientCredentials {
+    clientId: string;
+    clientSecret: string;
+}
+/** Standard OAuth 2.0 client-credentials token response. */
+interface TokenResult {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    scope?: string;
+}
+/** POST /tenant/auth/validate — validates the current tenant-client bearer. */
+interface TenantClientValidationResult {
+    valid: boolean;
+    reason?: string | null;
+    tenantId: string;
+    workspaceId: string;
+    environmentId: string;
+    credentialId: string;
+    clientId: string;
+    permissions: string[];
+}
+interface JsonWebKeySet {
+    keys: Record<string, unknown>[];
+}
+interface OpenIdConfiguration {
+    issuer: string;
+    jwks_uri: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    [key: string]: unknown;
+}
+interface AuthyonServerClientOptions {
+    /**
+     * Publishable environment key (`pk_live_...` / `pk_test_...`), sent as
+     * `X-Authyon-Environment`. Required on **every** call — it selects the
+     * environment (Test / Live) that a request applies to, independently of
+     * whichever bearer token authenticates it.
+     */
+    envKey?: string;
+    /**
+     * Environment-level OAuth client credentials (`ec_...` / secret), minted
+     * in the console. Required for everything under `environment.*` and
+     * `permissions.*` — the SDK exchanges them for a short-lived access token
+     * via `POST /env/oauth/token` and refreshes it transparently.
+     */
+    clientId?: string;
+    clientSecret?: string;
+    /**
+     * Originating end-user IP to forward on every API call as `X-Forwarded-For`.
+     * Only set this from infrastructure you trust; the SDK rejects comma-separated
+     * or whitespace-containing values to avoid forwarded-header injection.
+     */
+    clientIp?: string;
+    /** API origin. Defaults to `https://api.authyon.com`. */
+    baseUrl?: string;
+    /** Allow an HTTP `baseUrl`. Intended only for explicitly trusted local development. */
+    allowInsecureHttp?: boolean;
+    /** Maximum duration of each HTTP request. Defaults to 15 seconds; set to `0` to disable. */
+    timeoutMs?: number;
+    /** Custom HTTP adapter for tracing, mocks or an alternative HTTP stack. */
+    httpAdapter?: HttpAdapter;
+    /** Safe HTTP lifecycle logging. Disabled unless this option is provided with `enabled: true`. */
+    httpLogger?: HttpLoggerOptions;
+    /** @deprecated Prefer `httpAdapter: new FetchHttpAdapter(customFetch)`. */
+    fetch?: typeof fetch;
+}
+
+/** A token of the requested authentication plane, or a provider called for each request. */
+type AccessTokenSource = string | (() => string | Promise<string>);
+interface CredentialListOptions extends PaginationOptions {
+    search?: string;
+}
+/** scopes is an alias for permissions. Always supply an explicit, nonempty set. */
+type CredentialPermissionsInput = {
+    permissions: readonly string[];
+    scopes?: never;
+} | {
+    scopes: readonly string[];
+    permissions?: never;
+};
+type CreateCredentialInput = CredentialPermissionsInput & {
+    description?: string;
+    lifetimeDays?: number | null;
+};
+interface CredentialScope {
+    workspaceId: string;
+    environmentId: string;
+    tenantId?: string;
+}
+interface TenantManagementScope extends CredentialScope {
+    tenantId: string;
+}
+interface CredentialCreator {
+    id: string | null;
+    type: string;
+    displayName: string | null;
+}
+interface CredentialDetail extends TenantCredentialSummary {
+    createdBy: CredentialCreator | null;
+    updatedAt: string | null;
+    secretRotatedAt: string | null;
+    expiresAt: string | null;
+    ageSeconds: number;
+    /** Null while active; elapsed lifetime at revocation otherwise. */
+    lifetimeSeconds: number | null;
+    accessTokenLifetimeSeconds: number;
+}
+type WorkspaceRole = "admin" | "auditor";
+interface WorkspaceMember {
+    memberId: string | null;
+    userId: string;
+    email: string;
+    name: string;
+    role: string;
+    isOwner: boolean;
+    isSelf: boolean;
+    invitedByName: string | null;
+    joinedAt: string;
+    lastLoginAt: string | null;
+}
+interface WorkspaceInvite {
+    id: string;
+    email: string;
+    role: string;
+    invitedByName: string | null;
+    createdAt: string;
+    expiresAt: string;
+}
+interface WorkspaceTeam {
+    workspaceId: string;
+    workspaceName: string;
+    callerRole: string;
+    canManage: boolean;
+    members: WorkspaceMember[];
+    pendingInvites: WorkspaceInvite[];
+}
+interface InviteWorkspaceMemberInput {
+    email: string;
+    role: WorkspaceRole;
+}
+interface WorkspaceInviteIssued {
+    inviteId: string;
+    email: string;
+    role: string;
+    /** Sensitive bearer link returned at issuance. Do not log or persist in public storage. */
+    acceptUrl: string;
+    expiresAt: string;
+}
+interface WorkspaceInvitePreview {
+    workspaceName: string;
+    email: string;
+    role: string;
+    expiresAt: string;
+    requiresRegistration: boolean;
+}
+interface WorkspaceInviteAccepted {
+    workspaceId: string;
+    workspaceName: string;
+    role: string;
+    accountCreated: boolean;
+}
+interface AcceptWorkspaceInviteInput {
+    name?: string;
+    password?: string;
+}
+interface InviteTenantMemberInput {
+    email: string;
+    roles?: string[];
+}
+interface TenantMember {
+    userId: string;
+    email: string;
+    username: string;
+    roles: string[];
+    createdAt: string;
+    lastLoginAt: string | null;
+}
+type TenantMemberPage = Paged<TenantMember>;
+
+type QueryParams = object;
+
+type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+interface JsonRequestOptions {
+    method?: HttpMethod;
+    body?: unknown;
+    query?: QueryParams;
+    headers?: Record<string, string>;
+}
+
+type ManagementRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
+
+/** Platform user administration. Never falls back to an environment machine token. */
+declare class PlatformScopedClient {
+    #private;
+    /** @hidden */
+    constructor(request: ManagementRequest, token: AccessTokenSource);
+    readonly credentials: {
+        list: (scope: CredentialScope, options?: CredentialListOptions) => Promise<Paged<TenantCredentialSummary>>;
+        get: (scope: CredentialScope, credentialId: string) => Promise<CredentialDetail>;
+        create: (scope: CredentialScope, input: CreateCredentialInput) => Promise<TenantCredentialIssued>;
+        updatePermissions: (scope: CredentialScope, credentialId: string, input: CredentialPermissionsInput) => Promise<void>;
+        updateScopes: (scope: CredentialScope, credentialId: string, scopes: readonly string[]) => Promise<void>;
+        /** Returns a new secret once. API may require an explicit step-up first. */
+        rotate: (scope: CredentialScope, credentialId: string) => Promise<TenantCredentialIssued>;
+        revoke: (scope: CredentialScope, credentialId: string) => Promise<void>;
+    };
+    readonly workspaces: {
+        team: (workspaceId: string) => Promise<WorkspaceTeam>;
+        members: {
+            invite: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
+            /** memberId comes from team.members; it is not the platform userId. */
+            remove: (workspaceId: string, memberId: string) => Promise<void>;
+            changeRole: (workspaceId: string, memberId: string, role: WorkspaceRole) => Promise<void>;
+        };
+        invites: {
+            create: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
+            revoke: (workspaceId: string, inviteId: string) => Promise<void>;
+        };
+    };
+    readonly tenants: {
+        members: {
+            list: (scope: TenantManagementScope, options?: PaginationOptions) => Promise<EnvironmentUser[]>;
+            add: (scope: TenantManagementScope, userId: string, roles?: string[]) => Promise<void>;
+            remove: (scope: TenantManagementScope, userId: string) => Promise<void>;
+        };
+    };
+    readonly auth: {
+        /** Explicitly confirms the current platform session; passwords are not retained. */
+        stepUp: (currentPassword: string) => Promise<void>;
+    };
+}
+/** End-user operations require a user token and the environment publishable key. */
+declare class UserScopedClient {
+    #private;
+    /** @hidden */
+    constructor(request: ManagementRequest, token: AccessTokenSource);
+    readonly tenants: {
+        members: {
+            list: (tenantId: string, options?: PaginationOptions) => Promise<TenantMemberPage>;
+            /** Adds an existing environment user by email; does not send an invitation email. */
+            invite: (tenantId: string, input: InviteTenantMemberInput) => Promise<TenantMember>;
+            remove: (tenantId: string, userId: string) => Promise<void>;
+        };
+    };
+}
+/** Anonymous invite endpoints: the invitation token itself authorizes these requests. */
+declare class WorkspaceInvitesClient {
+    #private;
+    /** @hidden */
+    constructor(request: ManagementRequest);
+    preview(token: string): Promise<WorkspaceInvitePreview>;
+    accept(token: string, input?: AcceptWorkspaceInviteInput): Promise<WorkspaceInviteAccepted>;
+}
+
+interface ClientRequestContext {
+    /** Real end-user IP, resolved only from infrastructure trusted by the application. */
+    clientIp?: string;
+}
+/** Rejects header injection and values that are not a single IPv4 or IPv6 address. */
+declare function normalizeClientIp(value: string): string;
+
+type SafeJwtAlgorithm = "RS256" | "PS256" | "ES256" | "EdDSA";
+interface AuthyonJwtClaims extends JWTPayload {
+    sub: string;
+    iss: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    email?: string;
+    username?: string;
+    roles?: string[];
+    permissions?: string[];
+    scope?: string;
+}
+interface VerifiedAccessToken {
+    claims: AuthyonJwtClaims;
+    protectedHeader: JWSHeaderParameters;
+}
+interface JwksTokenVerifierOptions {
+    /** Exact trusted issuer from Authyon OpenID discovery. */
+    issuer: string;
+    /** Audience assigned to the API consuming this token. */
+    audience: string | string[];
+    /** Trusted HTTPS JWKS endpoint. Never derive this value from the token header. */
+    jwksUri?: string;
+    /** Static trusted keys for pinned or offline verification. */
+    jwks?: JSONWebKeySet;
+    algorithms?: readonly SafeJwtAlgorithm[];
+    acceptedTokenTypes?: readonly string[];
+    clockToleranceSeconds?: number;
+    maxTokenAgeSeconds?: number;
+    jwksTimeoutMs?: number;
+    jwksCacheMs?: number;
+    jwksCooldownMs?: number;
+}
+interface AuthyonJwksDiscoveryOptions extends Omit<JwksTokenVerifierOptions, "issuer" | "jwksUri" | "jwks"> {
+    /** Optional pin; discovery fails if Authyon advertises a different issuer. */
+    issuer?: string;
+    /** Override the client environment key used by the discovery endpoint. */
+    publishableKey?: string;
+}
+type TokenVerificationErrorCode = "token.invalid" | "token.expired" | "token.not_active" | "token.invalid_claims" | "token.invalid_signature" | "token.key_unavailable";
+declare class TokenVerificationError extends Error {
+    readonly code: TokenVerificationErrorCode;
+    constructor(code: TokenVerificationErrorCode, options?: {
+        cause?: unknown;
+    });
+}
+/** Secure, cached JWT signature and claims verifier backed by a trusted remote JWKS. */
+declare class JwksTokenVerifier {
+    private readonly options;
+    private readonly verifyKey;
+    private readonly algorithms;
+    private readonly acceptedTokenTypes;
+    constructor(options: JwksTokenVerifierOptions);
+    verifyAccessToken(token: string): Promise<VerifiedAccessToken>;
+}
+
+/**
+ * Server-side Authyon client: environment/tenant administration (OAuth
+ * client-credentials) plus access-token verification (publishable key).
+ * Never import this in browser code — client secrets must stay on your
+ * server.
+ */
+declare class AuthyonServerClient {
+    #private;
+    private readonly envKey?;
+    private readonly clientId?;
+    private readonly clientIp?;
+    private readonly transport;
+    private readonly http;
+    private readonly environmentTokenProvider;
+    constructor(options?: AuthyonServerClientOptions);
+    private request;
+    /** Mints (and caches) an environment access token from `clientId`/`clientSecret`. */
+    private getEnvironmentAccessToken;
+    readonly discovery: {
+        /** GET /.well-known/jwks.json — the environment's public signing keys. */
+        jwks: (publishableKey?: string) => Promise<JsonWebKeySet>;
+        /** GET /.well-known/openid-configuration — OIDC discovery document. */
+        openidConfiguration: (publishableKey?: string) => Promise<OpenIdConfiguration>;
+    };
+    /** Discovers Authyon's trusted issuer/JWKS and creates a cached local access-token verifier. */
+    createJwksTokenVerifier(options: AuthyonJwksDiscoveryOptions): Promise<JwksTokenVerifier>;
+    /** POST /auth/introspect — lightweight token introspection (RFC 7662). */
+    introspect(token: string, context?: ClientRequestContext): Promise<IntrospectResult>;
+    /** POST /auth/validate — recommended: cross-checks DB state, catches revocation immediately. */
+    validate(token: string, context?: ClientRequestContext): Promise<ValidateResult>;
+    readonly environmentAuth: {
+        /** POST /env/oauth/token — exchanges environment client credentials for an access token. */
+        token: (credentials: ClientCredentials) => Promise<TokenResult>;
+    };
+    readonly tenantAuth: {
+        /** POST /tenant/oauth/token — exchanges a tenant's client credentials for a scoped access token. */
+        token: (credentials: ClientCredentials) => Promise<TokenResult>;
+        /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+        validate: (accessToken: string, context?: ClientRequestContext) => Promise<TenantClientValidationResult>;
+    };
+    /**
+     * Scopes a client to a single tenant's OAuth credentials — mints and
+     * caches its access token independently of the environment plane. Use
+     * this for the `TenantManagement` endpoints (`/tenant/...`), which act on
+     * "the token's tenant" rather than one you pass by id.
+     */
+    tenant(credentials: ClientCredentials): TenantScopedClient;
+    /** Uses only the supplied platform-user access token. */
+    platform(token: AccessTokenSource): PlatformScopedClient;
+    /** Uses an end-user token; the configured environment key selects the environment. */
+    user(token: AccessTokenSource): UserScopedClient;
+    readonly workspaceInvites: WorkspaceInvitesClient;
+    readonly environment: {
+        users: {
+            /** GET /env/users — paginated list of users in the environment. */
+            list: (params?: {
+                search?: string;
+            } & PaginationOptions) => Promise<Paged<EnvironmentUser>>;
+            /** POST /env/users — create a user in the environment; returns only the new id. */
+            create: (input: CreateUserInput) => Promise<{
+                id: string;
+            }>;
+            /** GET /env/users/{userId} — fetch an environment user by id. */
+            get: (userId: string) => Promise<EnvironmentUser>;
+            /** POST /env/users/{userId}/roles — grant a role to an environment user. */
+            assignRole: (userId: string, role: string) => Promise<void>;
+            /** DELETE /env/users/{userId}/roles/{role} — revoke a role from an environment user. */
+            removeRole: (userId: string, role: string) => Promise<void>;
+            /** POST /env/users/{userId}/permissions — grant a direct permission to an environment user. */
+            grantPermission: (userId: string, permission: string) => Promise<void>;
+            /** DELETE /env/users/{userId}/permissions/{permission} — revoke a direct permission. */
+            revokePermission: (userId: string, permission: string) => Promise<void>;
+            /** POST /env/users/{userId}/unlock — clears an environment user's lockout. */
+            unlock: (userId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/password — sets a new password for the user. */
+            setPassword: (userId: string, newPassword: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/sessions/revoke-all — revokes every session the user has. */
+            revokeSessions: (userId: string, reason?: string) => Promise<void>;
+            /** DELETE /env/users/{userId}/sessions/{sessionId} — revokes a single session. */
+            revokeSession: (userId: string, sessionId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/disable — bans the user indefinitely; revokes live sessions. */
+            disable: (userId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/enable — lifts a ban. */
+            enable: (userId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/suspend — blocks the user temporarily; clears itself after `durationMinutes`. */
+            suspend: (userId: string, durationMinutes: number, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/unsuspend — lifts a suspension early. */
+            unsuspend: (userId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/tenants — adds an environment user to a tenant. */
+            assignTenant: (userId: string, tenantId: string, roles?: string[]) => Promise<void>;
+            /** DELETE /env/users/{userId}/tenants/{tenantId} — removes an environment user from a tenant. */
+            removeTenant: (userId: string, tenantId: string) => Promise<void>;
+        };
+        tenants: {
+            credentials: {
+                /** GET /env/tenants/{tenantId}/credentials. Returns metadata only, including revoked credentials. */
+                list: (tenantId: string) => Promise<TenantCredentialSummary[]>;
+                /** Paginated searchable listing. Prefer this over loading every credential. */
+                listPage: (tenantId: string, options?: CredentialListOptions) => Promise<Paged<TenantCredentialSummary>>;
+                get: (tenantId: string, credentialId: string) => Promise<CredentialDetail>;
+                /** Explicit scopes/permissions; only issuance returns the client secret. */
+                create: (tenantId: string, input: CreateTenantCredentialInput | CreateCredentialInput) => Promise<TenantCredentialIssued>;
+                /** Returns a new secret once while keeping the same client id. */
+                rotate: (tenantId: string, credentialId: string) => Promise<TenantCredentialIssued>;
+                updatePermissions: (tenantId: string, credentialId: string, input: CredentialPermissionsInput) => Promise<void>;
+                updateScopes: (tenantId: string, credentialId: string, scopes: readonly string[]) => Promise<void>;
+                revoke: (tenantId: string, credentialId: string) => Promise<void>;
+            };
+            /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+            list: (params?: {
+                search?: string;
+            } & PaginationOptions) => Promise<Paged<Organization>>;
+            /** POST /env/tenants — create a tenant in the environment. */
+            create: (input: CreateOrganizationInput) => Promise<Organization>;
+            /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
+            get: (tenantId: string) => Promise<Organization>;
+            /** PUT /env/tenants/{tenantId} — update a tenant. */
+            update: (tenantId: string, input: UpdateOrganizationInput) => Promise<Organization>;
+            /** PUT /env/tenants/{tenantId}/metadata - replace public and private metadata. */
+            updateMetadata: (tenantId: string, input: Pick<CreateOrganizationInput, "publicMetadata" | "privateMetadata">) => Promise<void>;
+            /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+            disable: (tenantId: string) => Promise<void>;
+            /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
+            delete: (tenantId: string) => Promise<void>;
+            members: {
+                /**
+                 * GET /env/tenants/{tenantId}/members — a tenant's members as full
+                 * user records. Confirmed live: a bare array (unlike
+                 * `environment.users.list()`, this one does NOT paginate despite
+                 * accepting `skip`/`take`), with the same shape
+                 * `environment.users.list()` items have.
+                 */
+                list: (tenantId: string, params?: PaginationOptions) => Promise<EnvironmentUser[]>;
+                /** POST /env/tenants/{tenantId}/members — add a member to a tenant. */
+                add: (tenantId: string, userId: string, roles?: string[]) => Promise<void>;
+                /** DELETE /env/tenants/{tenantId}/members/{userId} — remove a member from a tenant. */
+                remove: (tenantId: string, userId: string) => Promise<void>;
+                /** POST /env/tenants/{tenantId}/members/{userId}/roles — grant a tenant role to a member. */
+                assignRole: (tenantId: string, userId: string, role: string) => Promise<void>;
+                /** DELETE .../members/{userId}/roles/{role} — revoke a tenant role from a member. */
+                removeRole: (tenantId: string, userId: string, role: string) => Promise<void>;
+                /** POST .../members/{userId}/permissions — grant a permission to a tenant member. */
+                grantPermission: (tenantId: string, userId: string, permission: string) => Promise<void>;
+                /** DELETE .../members/{userId}/permissions/{permission} — revoke a permission from a tenant member. */
+                revokePermission: (tenantId: string, userId: string, permission: string) => Promise<void>;
+            };
+            roles: {
+                /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
+                list: (tenantId: string) => Promise<Role[]>;
+                /** POST /env/tenants/{tenantId}/roles — create a tenant role. */
+                create: (tenantId: string, input: RoleInput) => Promise<Role>;
+                /** GET /env/tenants/{tenantId}/roles/{roleId} — fetch a tenant role by id. */
+                get: (tenantId: string, roleId: string) => Promise<Role>;
+                /** PUT /env/tenants/{tenantId}/roles/{roleId} — update a tenant role. */
+                update: (tenantId: string, roleId: string, input: RoleInput) => Promise<Role>;
+                /** DELETE /env/tenants/{tenantId}/roles/{roleId} — delete a tenant role. */
+                delete: (tenantId: string, roleId: string) => Promise<void>;
+            };
+        };
+        roles: {
+            /** GET /env/roles — environment-level roles, grouped into custom and system-defined. */
+            list: () => Promise<RoleList>;
+            /** POST /env/roles — create an environment-level role. */
+            create: (input: RoleInput) => Promise<Role>;
+            /** PUT /env/roles/{roleId} — update an environment-level role. */
+            update: (roleId: string, input: RoleInput) => Promise<Role>;
+            /** DELETE /env/roles/{roleId} — delete an environment-level role. */
+            delete: (roleId: string) => Promise<void>;
+        };
+        permissions: {
+            /** GET /env/permissions — environment-level permissions, grouped by the role they're attached to. */
+            list: () => Promise<PermissionsByRole>;
+            /** POST /env/permissions — create an environment-level permission. */
+            create: (input: CreatePermissionInput) => Promise<Permission>;
+            /** PUT /env/permissions/{permissionId} — update an environment-level permission. */
+            update: (permissionId: string, description?: string) => Promise<Permission>;
+            /** DELETE /env/permissions/{permissionId} — delete an environment-level permission. */
+            delete: (permissionId: string) => Promise<void>;
+            /** GET /permissions/reserved — reserved permission names you can't redefine. */
+            reserved: () => Promise<ReservedPermissions>;
+        };
+        audit: {
+            /** GET /env/audit — paginated list of the environment's audit events. */
+            list: (params?: PaginationOptions) => Promise<Paged<AuditEvent>>;
+            /** GET /env/audit/login-activity — paginated login activity in the environment. */
+            loginActivity: (params?: PaginationOptions) => Promise<Paged<LoginActivity>>;
+        };
+    };
+    readonly permissions: {
+        /** POST /users/{userId}/permissions — grant a permission directly to a user. */
+        grant: (userId: string, permission: string) => Promise<void>;
+        /** DELETE /users/{userId}/permissions/{permission} — revoke a permission from a user. */
+        revoke: (userId: string, permission: string) => Promise<void>;
+    };
+    /** @internal used by {@link TenantScopedClient} to share the base URL/fetch/error handling. */
+    _requestAsTenant<T>(accessToken: string, path: string, options?: {
+        method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+        body?: unknown;
+        query?: object;
+        headers?: Record<string, string>;
+    }): Promise<T>;
+}
+/**
+ * Client scoped to a single tenant's OAuth credentials — every call acts on
+ * "the token's tenant" (`TenantManagement` endpoints), so there's no
+ * `tenantId` parameter to pass.
+ */
+declare class TenantScopedClient {
+    private readonly server;
+    private readonly tokenProvider;
+    constructor(server: AuthyonServerClient, credentials: ClientCredentials);
+    private getAccessToken;
+    private request;
+    /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
+    validate(context?: ClientRequestContext): Promise<TenantClientValidationResult>;
+    readonly members: {
+        /**
+         * GET /tenant/members — members of the token's tenant.
+         *
+         * ⚠️ Inferred, not confirmed live (no tenant client credentials
+         * available to exchange for a scoped token) — assumed to share
+         * `/env/tenants/{id}/members`'s confirmed shape (bare array of full
+         * user records), since both are the "admin" member listing as opposed
+         * to `/auth/tenants/{id}/members`'s paginated, lightweight one.
+         */
+        list: (params?: PaginationOptions) => Promise<EnvironmentUser[]>;
+        /** POST /tenant/members — add a member to the token's tenant. */
+        add: (userId: string, roles?: string[]) => Promise<void>;
+        /** DELETE /tenant/members/{userId} — remove a member from the token's tenant. */
+        remove: (userId: string) => Promise<void>;
+        /** POST /tenant/members/{userId}/roles — grant a role to a member of the tenant. */
+        assignRole: (userId: string, role: string) => Promise<void>;
+        /** DELETE /tenant/members/{userId}/roles/{role} — revoke a role from a member of the tenant. */
+        removeRole: (userId: string, role: string) => Promise<void>;
+        /** POST /tenant/members/{userId}/permissions — grant a permission to a member of the tenant. */
+        grantPermission: (userId: string, permission: string) => Promise<void>;
+        /** DELETE .../permissions/{permission} — revoke a permission from a member of the tenant. */
+        revokePermission: (userId: string, permission: string) => Promise<void>;
+    };
+    readonly roles: {
+        /**
+         * GET /tenant/roles — roles in the token's tenant, grouped into custom
+         * and system-defined.
+         *
+         * ⚠️ Inferred, not confirmed live (the test environment had no tenants
+         * to exchange a scoped token for) — assumed to share `/env/roles`'
+         * grouped shape, since both operate on the same underlying role model.
+         */
+        list: () => Promise<RoleList>;
+        /** POST /tenant/roles — create a role in the tenant. */
+        create: (input: RoleInput) => Promise<Role>;
+        /** GET /tenant/roles/{roleId} — fetch a tenant role by id. */
+        get: (roleId: string) => Promise<Role>;
+        /** PUT /tenant/roles/{roleId} — update a role in the tenant. */
+        update: (roleId: string, input: RoleInput) => Promise<Role>;
+        /** DELETE /tenant/roles/{roleId} — delete a role in the tenant. */
+        delete: (roleId: string) => Promise<void>;
+    };
+}
+/** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
+declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
+
+export { type TenantMemberPage as $, AuthyonServerClient as A, type Organization as B, type ClientCredentials as C, type PaginationOptions as D, type EnvironmentUser as E, FetchHttpAdapter as F, type Permission as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type PermissionsByRole as K, LoggingHttpAdapter as L, PlatformScopedClient as M, type Role as N, type OpenIdConfiguration as O, type Paged as P, type RoleGrant as Q, type ReservedPermissions as R, type RoleInput as S, type RoleList as T, type RolePermissions as U, type SafeJwtAlgorithm as V, type TenantClientValidationResult as W, type TenantCredentialIssued as X, type TenantCredentialSummary as Y, type TenantManagementScope as Z, type TenantMember as _, type HttpLoggerOptions as a, type TenantMembership as a0, TenantScopedClient as a1, type TokenResult as a2, TokenVerificationError as a3, type TokenVerificationErrorCode as a4, type UpdateOrganizationInput as a5, type User as a6, UserScopedClient as a7, type ValidateResult as a8, type VerifiedAccessToken as a9, type WorkspaceInvite as aa, type WorkspaceInviteAccepted as ab, type WorkspaceInviteIssued as ac, type WorkspaceInvitePreview as ad, WorkspaceInvitesClient as ae, type WorkspaceMember as af, type WorkspaceRole as ag, type WorkspaceTeam as ah, createClient as ai, normalizeClientIp as aj, type AcceptWorkspaceInviteInput as b, type AccessTokenSource as c, type AuditEvent as d, type AuthyonJwksDiscoveryOptions as e, type AuthyonJwtClaims as f, type AuthyonServerClientOptions as g, type ClientRequestContext as h, type CreateCredentialInput as i, type CreateOrganizationInput as j, type CreatePermissionInput as k, type CreateTenantCredentialInput as l, type CreateUserInput as m, type CredentialCreator as n, type CredentialDetail as o, type CredentialListOptions as p, type CredentialPermissionsInput as q, type CredentialScope as r, type HttpAdapterRequest as s, type HttpLogEvent as t, type HttpLogger as u, type InviteTenantMemberInput as v, type InviteWorkspaceMemberInput as w, JwksTokenVerifier as x, type JwksTokenVerifierOptions as y, type LoginActivity as z };