@authyon/server 0.2.0-beta.1 → 0.2.0-beta.12

package/dist/index.js

@@ -1,501 +1,314 @@
-// ../../internal/core/config/defaults.ts
-var DEFAULT_BASE_URL = "https://api.authyon.com";
-var DEFAULT_EXPIRY_SKEW_MS = 3e4;
+import {
+  AuthyonError,
+  DEFAULT_BASE_URL,
+  DEFAULT_EXPIRY_SKEW_MS,
+  ErrorCodes,
+  FetchHttpAdapter,
+  JsonHttpClient,
+  LoggingHttpAdapter,
+  createSharedTransport
+} from "./chunk-56H66KLG.js";
+import {
+  AuthorizationError,
+  AuthyonAbility,
+  AuthyonAbilityBuilder,
+  JwksTokenVerifier,
+  TokenVerificationError,
+  authorizeRequest,
+  authorizeToken,
+  clientIpHeaders,
+  createAuthorizationErrorResponse,
+  createAuthyonAbility,
+  createAuthyonRules,
+  createExpressAuthorizationMiddleware,
+  hasPermission,
+  hasPermissionGroup,
+  normalizeClientIp
+} from "./chunk-NKWQMYB3.js";
+import {
+  __privateAdd,
+  __privateGet,
+  __privateSet
+} from "./chunk-77J4NURK.js";
 
-// ../../internal/core/auth/expiringTokenProvider.ts
-var ExpiringTokenProvider = class {
-  constructor(acquire, expirySkewMs = DEFAULT_EXPIRY_SKEW_MS) {
-    this.acquire = acquire;
-    this.expirySkewMs = expirySkewMs;
-    this.token = null;
-    this.inFlight = null;
-  }
-  async getAccessToken() {
-    if (this.token && Date.now() < this.token.expiresAt - this.expirySkewMs) {
-      return this.token.accessToken;
+// src/client/credentialManagement.ts
+function segment(value) {
+  if (typeof value !== "string" || !value.trim() || value === "." || value === ".." || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
+    throw new TypeError("Authyon: invalid route identifier.");
+  }
+  return encodeURIComponent(value);
+}
+function permissionsBody(input) {
+  if (input.permissions !== void 0 && input.scopes !== void 0) {
+    throw new TypeError("Authyon: supply permissions or scopes, not both.");
+  }
+  const values = input.permissions ?? input.scopes;
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new TypeError("Authyon: explicit credential permissions are required.");
+  }
+  const permissions = values.map((value) => {
+    if (typeof value !== "string") throw new TypeError("Authyon: invalid permission.");
+    const normalized = value.trim().toLowerCase();
+    if (!/^(?:\*|[a-z][a-z0-9_-]*):(?:\*|[a-z][a-z0-9_-]*):(?:\*|[a-z][a-z0-9_-]*)$/u.test(normalized)) {
+      throw new TypeError("Authyon: permissions must have namespace:resource:action format.");
     }
-    if (this.inFlight) return this.inFlight;
-    this.inFlight = this.acquire().then((token) => {
-      this.token = token;
-      return token.accessToken;
-    }).finally(() => {
-      this.inFlight = null;
-    });
-    return this.inFlight;
-  }
-  clear() {
-    this.token = null;
-  }
-};
-
-// ../../internal/core/errors/authyonError.ts
-var ErrorCodes = {
-  Unknown: "unknown",
-  NetworkError: "request.network_error",
-  Timeout: "request.timeout",
-  SessionMalformed: "session.malformed",
-  NotAuthenticated: "auth.not_authenticated",
-  InvalidToken: "auth.invalid_token",
-  MissingToken: "auth.missing_token",
-  EmailTaken: "user.email_taken",
-  PasswordWeak: "user.password_weak",
-  PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
-};
-var AuthyonError = class extends Error {
-  constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
-    this.name = "AuthyonError";
-    this.status = status;
-    this.code = body.code ?? "unknown";
-    this.title = body.title ?? "Error";
-    this.detail = body.detail;
-    this.requestId = options.requestId;
-    this.retryAfter = options.retryAfter;
-    this.cause = options.cause;
-  }
-  is(code) {
-    return this.code === code;
-  }
-  isAny(...codes) {
-    return codes.includes(this.code);
-  }
-  hasPrefix(prefix) {
-    return this.code.startsWith(prefix);
-  }
-  isStatus(...statuses) {
-    return statuses.includes(this.status);
-  }
-  /** Stable interpretation for UI decisions, retries, telemetry and support flows. */
-  interpret() {
-    const category = classifyError(this.status, this.code);
-    return {
-      category,
-      action: actionFor(category),
-      retryable: isRetryable(category),
-      ...this.retryAfter !== void 0 ? { retryAfter: this.retryAfter } : {},
-      ...this.requestId !== void 0 ? { requestId: this.requestId } : {}
-    };
-  }
-  get category() {
-    return this.interpret().category;
-  }
-  get retryable() {
-    return this.interpret().retryable;
-  }
-  toJSON() {
-    return {
-      name: this.name,
-      message: this.message,
-      status: this.status,
-      code: this.code,
-      title: this.title,
-      detail: this.detail,
-      requestId: this.requestId,
-      retryAfter: this.retryAfter,
-      ...this.interpret()
-    };
-  }
-};
-function classifyError(status, code) {
-  if (code === ErrorCodes.NetworkError) return "network";
-  if (code === ErrorCodes.Timeout || status === 408) return "timeout";
-  if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
-  if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
-  if (code === ErrorCodes.PasswordWeak || code === ErrorCodes.PasswordPwned) return "validation";
-  if (code === ErrorCodes.SessionMalformed) return "server";
-  if (code.startsWith("auth.") || status === 401) return "authentication";
-  if (status === 403) return "authorization";
-  if (status === 404) return "not_found";
-  if (status === 400 || status === 422) return "validation";
-  if (status >= 500) return "server";
-  return "unknown";
-}
-function actionFor(category) {
-  switch (category) {
-    case "network":
-    case "timeout":
-    case "rate_limit":
-    case "server":
-      return "retry";
-    case "authentication":
-      return "reauthenticate";
-    case "authorization":
-      return "request_access";
-    case "validation":
-      return "fix_input";
-    case "not_found":
-      return "not_found";
-    case "conflict":
-      return "resolve_conflict";
-    case "unknown":
-      return "contact_support";
-  }
+    return normalized;
+  });
+  return { permissions: [...new Set(permissions)] };
+}
+function lifetimeBody(input) {
+  if (input.lifetimeDays === void 0 || input.lifetimeDays === null) return {};
+  if (!Number.isInteger(input.lifetimeDays) || input.lifetimeDays < 1 || input.lifetimeDays > 3650) {
+    throw new RangeError("Authyon: lifetimeDays must be between 1 and 3650.");
+  }
+  return { lifetimeDays: input.lifetimeDays };
+}
+function credentialQuery(options = {}) {
+  const { skip, take, search } = options;
+  if (skip !== void 0 && (!Number.isInteger(skip) || skip < 0 || skip > 2147483647))
+    throw new RangeError("Authyon: invalid skip.");
+  if (take !== void 0 && (!Number.isInteger(take) || take < 1 || take > 100))
+    throw new RangeError("Authyon: take must be between 1 and 100.");
+  if (search !== void 0 && (typeof search !== "string" || search.trim().length > 200))
+    throw new RangeError("Authyon: search must contain at most 200 characters.");
+  return { search: search?.trim() || void 0, skip, take };
+}
+function credentialSummary(value) {
+  return {
+    id: value.id,
+    clientId: value.clientId,
+    description: value.description,
+    createdAt: value.createdAt,
+    lastUsedAt: value.lastUsedAt,
+    revokedAt: value.revokedAt,
+    expiresAt: value.expiresAt ?? null,
+    isActive: value.isActive,
+    permissions: [...value.permissions]
+  };
 }
-function isRetryable(category) {
-  return category === "network" || category === "timeout" || category === "rate_limit" || category === "server";
+function credentialDetail(value) {
+  return {
+    ...credentialSummary(value),
+    createdBy: value.createdBy == null ? null : {
+      id: value.createdBy.id,
+      type: value.createdBy.type,
+      displayName: value.createdBy.displayName
+    },
+    updatedAt: value.updatedAt,
+    secretRotatedAt: value.secretRotatedAt,
+    expiresAt: value.expiresAt ?? null,
+    ageSeconds: value.ageSeconds,
+    lifetimeSeconds: value.lifetimeSeconds,
+    accessTokenLifetimeSeconds: value.accessTokenLifetimeSeconds
+  };
 }
-
-// ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
-  const query = new URLSearchParams();
-  for (const [key, value2] of Object.entries(params)) {
-    if (value2 !== void 0) query.set(key, String(value2));
-  }
-  const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+async function credentialPage(request, path, options = {}) {
+  const query = credentialQuery(options);
+  const page = await request(path, { query });
+  if (!page || !Array.isArray(page.data))
+    throw new TypeError("Authyon: expected a paginated credential response.");
+  return {
+    data: page.data.map(credentialSummary),
+    ...page.perPage === void 0 ? {} : { perPage: page.perPage },
+    pageSize: page.pageSize,
+    total: page.total,
+    pages: page.pages,
+    hasNext: page.hasNext,
+    hasPrev: page.hasPrev
+  };
 }
-
-// ../../internal/core/http/httpAdapter.ts
-var FetchHttpAdapter = class {
-  constructor(fetchImpl = fetch.bind(globalThis)) {
-    this.fetchImpl = fetchImpl;
-  }
-  request(request) {
-    return this.fetchImpl(request.url, {
-      method: request.method,
-      headers: request.headers,
-      body: request.body,
-      signal: request.signal
-    });
-  }
-};
-var LoggingHttpAdapter = class {
-  constructor(adapter, options) {
-    this.adapter = adapter;
-    this.options = options;
-  }
-  async request(request) {
-    const startedAt = Date.now();
-    const eventBase = {
-      method: request.method,
-      url: sanitizeUrl(request.url)
-    };
-    this.log({ type: "request", ...eventBase, timestamp: startedAt });
-    try {
-      const response = await this.adapter.request(request);
-      this.log({
-        type: "response",
-        ...eventBase,
-        status: response.status,
-        durationMs: Date.now() - startedAt,
-        requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
-        timestamp: Date.now()
-      });
-      return response;
-    } catch (error) {
-      this.log({
-        type: "error",
-        ...eventBase,
-        errorName: error instanceof Error ? error.name : "UnknownError",
-        durationMs: Date.now() - startedAt,
-        timestamp: Date.now()
-      });
-      throw error;
+async function allCredentials(request, path) {
+  const result = [];
+  const seen = /* @__PURE__ */ new Set();
+  let skip = 0;
+  for (let iteration = 0; iteration < 1e3; iteration++) {
+    const page = await request(
+      path,
+      iteration === 0 ? {} : { query: { skip, take: 100 } }
+    );
+    if (Array.isArray(page)) {
+      if (iteration !== 0)
+        throw new Error("Authyon: credential pagination changed during listing.");
+      return page.map(credentialSummary);
     }
-  }
-  log(event) {
-    if (!this.options.enabled) return;
-    const logger = this.options.logger ?? defaultHttpLogger;
-    try {
-      logger(event);
-    } catch {
+    if (!page || !Array.isArray(page.data))
+      throw new TypeError("Authyon: invalid credential page.");
+    for (const row of page.data) {
+      if (seen.has(row.id))
+        throw new Error("Authyon: credential pages overlapped; retry the listing.");
+      seen.add(row.id);
+      result.push(credentialSummary(row));
     }
+    if (!page.hasNext) return result;
+    if (page.data.length === 0) throw new Error("Authyon: credential pagination made no progress.");
+    skip += page.data.length;
   }
-};
-function defaultHttpLogger(event) {
-  console.debug("[Authyon HTTP]", event);
-}
-function sanitizeUrl(value) {
-  const url = new URL(value);
-  const queryKeys = /* @__PURE__ */ new Set();
-  url.searchParams.forEach((_value, key) => queryKeys.add(key));
-  url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
-  return url.toString();
+  throw new Error("Authyon: use listPage for more than 1000 credential pages.");
 }
 
-// ../../internal/core/http/transport.ts
-var DEFAULT_TIMEOUT_MS = 15e3;
-var SharedTransportError = class extends Error {
-  constructor(code, cause) {
-    super(code === "request.timeout" ? "Request timed out" : "Network request failed");
-    this.name = "SharedTransportError";
-    this.code = code;
-    this.cause = cause;
-  }
-};
-function createSharedTransport(options) {
-  const baseUrl = normalizeBaseUrl(options.baseUrl, options.allowInsecureHttp ?? false);
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
-    throw new Error("Authyon: `timeoutMs` must be a non-negative finite number");
-  }
-  if (options.httpAdapter && options.fetch) {
-    throw new Error("Authyon: use either `httpAdapter` or `fetch`, not both");
-  }
-  const baseAdapter = options.httpAdapter ?? new FetchHttpAdapter(options.fetch);
-  const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
-  return {
-    baseUrl,
-    async request(path, init) {
-      const controller = new AbortController();
-      const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
-      try {
-        return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
-          method: init.method ?? "GET",
-          headers: normalizeHeaders(init.headers),
-          body: init.body,
-          signal: controller.signal
-        });
-      } catch (cause) {
-        throw new SharedTransportError(
-          controller.signal.aborted ? ErrorCodes.Timeout : ErrorCodes.NetworkError,
-          cause
-        );
-      } finally {
-        if (timeout !== void 0) clearTimeout(timeout);
-      }
-    }
+// src/client/scopedManagementClient.ts
+function scopedRequest(request, source) {
+  return async (path, options = {}) => {
+    const token = typeof source === "function" ? await source() : source;
+    if (typeof token !== "string" || !token.trim() || /\s/u.test(token))
+      throw new TypeError("Authyon: a valid access token is required.");
+    return request(path, {
+      ...options,
+      headers: { ...options.headers, Authorization: `Bearer ${token}` }
+    });
   };
 }
-function normalizeHeaders(headers) {
-  const normalized = {};
-  new Headers(headers).forEach((value, key) => {
-    normalized[key] = value;
-  });
-  return normalized;
+function environmentPath(scope) {
+  return `/platform/workspaces/${segment(scope.workspaceId)}/environments/${segment(scope.environmentId)}`;
 }
-function responseMetadata(response) {
-  const retryAfterHeader = response.headers.get("retry-after");
-  const retryAfter = retryAfterHeader ? Number(retryAfterHeader) : void 0;
-  return {
-    requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
-    retryAfter: Number.isFinite(retryAfter) ? retryAfter : void 0
-  };
+function tenantPath(scope) {
+  return `${environmentPath(scope)}/tenants/${segment(scope.tenantId)}`;
 }
-function normalizeBaseUrl(value, allowInsecureHttp) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error("Authyon: `baseUrl` must be an absolute URL");
-  }
-  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && (loopback || allowInsecureHttp))) {
-    throw new Error(
-      "Authyon: `baseUrl` must use HTTPS (HTTP is allowed only for loopback or with `allowInsecureHttp`)"
-    );
-  }
-  if (url.username || url.password || url.search || url.hash) {
-    throw new Error(
-      "Authyon: `baseUrl` cannot contain credentials, query parameters, or fragments"
-    );
-  }
-  return url.toString().replace(/\/+$/, "");
+function credentialPath(scope) {
+  return `${scope.tenantId === void 0 ? environmentPath(scope) : tenantPath(scope)}/credentials`;
 }
-
-// ../../internal/core/http/jsonHttpClient.ts
-var JsonHttpClient = class {
-  constructor(transport) {
-    this.transport = transport;
-  }
-  async send(path, options = {}) {
-    const headers = { ...options.headers };
-    if (options.body !== void 0) headers["Content-Type"] = "application/json";
-    try {
-      return await this.transport.request(appendQuery(path, options.query), {
-        method: options.method ?? "GET",
-        headers,
-        body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
-      });
-    } catch (cause) {
-      if (!(cause instanceof SharedTransportError)) throw cause;
-      throw new AuthyonError(0, { code: cause.code, title: cause.message }, { cause: cause.cause });
-    }
-  }
-  async parse(response) {
-    if (!response.ok) {
-      let body = {};
-      try {
-        body = await response.json();
-      } catch {
+function workspacePath(id) {
+  return `/platform/workspaces/${segment(id)}`;
+}
+function workspaceRole(role) {
+  if (role !== "admin" && role !== "auditor")
+    throw new TypeError("Authyon: workspace role must be admin or auditor.");
+  return role;
+}
+var _request;
+var PlatformScopedClient = class {
+  /** @hidden */
+  constructor(request, token) {
+    __privateAdd(this, _request);
+    this.credentials = {
+      list: (scope, options = {}) => credentialPage(__privateGet(this, _request), credentialPath(scope), options),
+      get: async (scope, credentialId) => credentialDetail(await __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`)),
+      create: (scope, input) => __privateGet(this, _request).call(this, credentialPath(scope), {
+        method: "POST",
+        body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
+      }),
+      updatePermissions: (scope, credentialId, input) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/permissions`, {
+        method: "PUT",
+        body: permissionsBody(input)
+      }),
+      updateScopes: (scope, credentialId, scopes) => this.credentials.updatePermissions(scope, credentialId, { scopes }),
+      /** Returns a new secret once. API may require an explicit step-up first. */
+      rotate: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/rotate`, { method: "POST" }),
+      revoke: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`, { method: "DELETE" })
+    };
+    this.workspaces = {
+      team: (workspaceId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/team`),
+      members: {
+        invite: (workspaceId, input) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites`, {
+          method: "POST",
+          body: { email: input.email, role: workspaceRole(input.role) }
+        }),
+        /** memberId comes from team.members; it is not the platform userId. */
+        remove: (workspaceId, memberId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
+          method: "DELETE"
+        }),
+        changeRole: (workspaceId, memberId, role) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
+          method: "PATCH",
+          body: { role: workspaceRole(role) }
+        })
+      },
+      invites: {
+        create: (workspaceId, input) => this.workspaces.members.invite(workspaceId, input),
+        revoke: (workspaceId, inviteId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites/${segment(inviteId)}`, {
+          method: "DELETE"
+        })
       }
-      throw new AuthyonError(response.status, body, responseMetadata(response));
-    }
-    if (response.status === 204) return void 0;
-    return await response.json();
-  }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
+    };
+    this.tenants = {
+      members: {
+        list: (scope, options = {}) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { query: options }),
+        add: (scope, userId, roles) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { method: "POST", body: { userId, roles } }),
+        remove: (scope, userId) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members/${segment(userId)}`, { method: "DELETE" })
+      }
+    };
+    this.auth = {
+      /** Explicitly confirms the current platform session; passwords are not retained. */
+      stepUp: (currentPassword) => __privateGet(this, _request).call(this, "/platform/auth/step-up", { method: "POST", body: { currentPassword } })
+    };
+    __privateSet(this, _request, scopedRequest(request, token));
   }
 };
-
-// ../../internal/core/http/clientIp.ts
-function clientIpHeaders(context) {
-  if (!context?.clientIp) return {};
-  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
-}
-function normalizeClientIp(value) {
-  let ip = value.trim();
-  if (ip.startsWith("[") && ip.endsWith("]")) ip = ip.slice(1, -1);
-  if (!ip || ip.length > 45 || ip.includes(",") || /[\r\n\s]/.test(ip) || !/^[0-9a-f:.]+$/i.test(ip) || !ip.includes(".") && !ip.includes(":")) {
-    throw invalidClientIp();
-  }
-  try {
-    new URL(ip.includes(":") ? `http://[${ip}]` : `http://${ip}`);
-  } catch {
-    throw invalidClientIp();
-  }
-  return ip;
-}
-function invalidClientIp() {
-  return new Error("Authyon: `clientIp` must be a single valid IPv4 or IPv6 address");
-}
-
-// src/security/jwksTokenVerifier.ts
-import {
-  createLocalJWKSet,
-  createRemoteJWKSet,
-  jwtVerify
-} from "jose";
-var SAFE_ASYMMETRIC_ALGORITHMS = [
-  "RS256",
-  "PS256",
-  "ES256",
-  "EdDSA"
-];
-var TokenVerificationError = class extends Error {
-  constructor(code, options = {}) {
-    super(messageForCode(code));
-    this.code = code;
-    this.name = "TokenVerificationError";
-    if (options.cause !== void 0) Object.defineProperty(this, "cause", { value: options.cause });
+_request = new WeakMap();
+var _request2;
+var UserScopedClient = class {
+  /** @hidden */
+  constructor(request, token) {
+    __privateAdd(this, _request2);
+    this.tenants = {
+      members: {
+        list: (tenantId, options = {}) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, { query: options }),
+        /** Adds an existing environment user by email; does not send an invitation email. */
+        invite: (tenantId, input) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, {
+          method: "POST",
+          body: { email: input.email, roles: input.roles }
+        }),
+        remove: (tenantId, userId) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
+          method: "DELETE"
+        })
+      }
+    };
+    __privateSet(this, _request2, scopedRequest(request, token));
   }
 };
-var JwksTokenVerifier = class {
-  constructor(options) {
-    this.options = options;
-    validateOptions(options);
-    this.algorithms = [...options.algorithms ?? ["RS256"]];
-    this.acceptedTokenTypes = new Set(options.acceptedTokenTypes ?? ["JWT", "at+jwt"]);
-    this.verifyKey = options.jwks ? createLocalJWKSet(options.jwks) : createRemoteJWKSet(new URL(options.jwksUri), {
-      timeoutDuration: options.jwksTimeoutMs ?? 5e3,
-      cacheMaxAge: options.jwksCacheMs ?? 6e5,
-      cooldownDuration: options.jwksCooldownMs ?? 3e4
+_request2 = new WeakMap();
+var _request3;
+var WorkspaceInvitesClient = class {
+  /** @hidden */
+  constructor(request) {
+    __privateAdd(this, _request3);
+    __privateSet(this, _request3, request);
+  }
+  preview(token) {
+    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}`);
+  }
+  accept(token, input = {}) {
+    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}/accept`, {
+      method: "POST",
+      body: { name: input.name, password: input.password }
     });
   }
-  async verifyAccessToken(token) {
-    if (!token || token.length > 16384) {
-      throw new TokenVerificationError("token.invalid");
-    }
-    try {
-      const result = await jwtVerify(token, this.verifyKey, {
-        algorithms: this.algorithms,
-        issuer: this.options.issuer,
-        audience: this.options.audience,
-        clockTolerance: this.options.clockToleranceSeconds ?? 5,
-        maxTokenAge: this.options.maxTokenAgeSeconds ?? 3600,
-        requiredClaims: ["iss", "aud", "sub", "exp", "iat"]
-      });
-      validateTokenType(result, this.acceptedTokenTypes);
-      validateClaims(result.payload);
-      return { claims: result.payload, protectedHeader: result.protectedHeader };
-    } catch (cause) {
-      if (cause instanceof TokenVerificationError) throw cause;
-      throw new TokenVerificationError(errorCode(cause), { cause });
-    }
-  }
 };
-function validateTokenType(result, acceptedTokenTypes) {
-  const type = result.protectedHeader.typ;
-  if (!type || !acceptedTokenTypes.has(type)) {
-    throw new TokenVerificationError("token.invalid_claims");
-  }
-}
-function validateClaims(claims) {
-  if (typeof claims.sub !== "string" || !claims.sub) invalidClaims();
-  if (claims.permissions !== void 0 && !isStringArray(claims.permissions)) invalidClaims();
-  if (claims.roles !== void 0 && !isStringArray(claims.roles)) invalidClaims();
-  if (claims.scope !== void 0 && typeof claims.scope !== "string") invalidClaims();
-}
-function validateOptions(options) {
-  const issuer = secureUrl(options.issuer, "issuer");
-  if (Boolean(options.jwksUri) === Boolean(options.jwks)) {
-    throw new Error("Authyon: configure exactly one of `jwksUri` or `jwks`");
-  }
-  const jwks = options.jwksUri ? secureUrl(options.jwksUri, "jwksUri") : void 0;
-  if (!options.audience || Array.isArray(options.audience) && options.audience.length === 0) {
-    throw new Error("Authyon: JWT `audience` is required");
-  }
-  if (jwks && issuer.origin !== jwks.origin) {
-    throw new Error("Authyon: `issuer` and `jwksUri` must use the same trusted origin");
-  }
-  const algorithms = options.algorithms ?? ["RS256"];
-  if (algorithms.length === 0 || algorithms.some((algorithm) => !SAFE_ASYMMETRIC_ALGORITHMS.includes(algorithm))) {
-    throw new Error("Authyon: only approved asymmetric JWT algorithms are accepted");
-  }
-  if (options.acceptedTokenTypes?.length === 0 || options.acceptedTokenTypes?.some((type) => !type.trim())) {
-    throw new Error("Authyon: `acceptedTokenTypes` must contain non-empty values");
+_request3 = new WeakMap();
+
+// ../../internal/core/auth/expiringTokenProvider.ts
+var _token, _inFlight;
+var ExpiringTokenProvider = class {
+  constructor(acquire, expirySkewMs = DEFAULT_EXPIRY_SKEW_MS) {
+    this.acquire = acquire;
+    this.expirySkewMs = expirySkewMs;
+    __privateAdd(this, _token, null);
+    __privateAdd(this, _inFlight, null);
   }
-  for (const [name, value] of [
-    ["clockToleranceSeconds", options.clockToleranceSeconds],
-    ["maxTokenAgeSeconds", options.maxTokenAgeSeconds],
-    ["jwksTimeoutMs", options.jwksTimeoutMs],
-    ["jwksCacheMs", options.jwksCacheMs],
-    ["jwksCooldownMs", options.jwksCooldownMs]
-  ]) {
-    if (value !== void 0 && (!Number.isFinite(value) || value < 0)) {
-      throw new Error(`Authyon: \`${name}\` must be a non-negative finite number`);
+  async getAccessToken() {
+    if (__privateGet(this, _token) && Date.now() < __privateGet(this, _token).expiresAt - this.expirySkewMs) {
+      return __privateGet(this, _token).accessToken;
     }
+    if (__privateGet(this, _inFlight)) return __privateGet(this, _inFlight);
+    __privateSet(this, _inFlight, this.acquire().then((token) => {
+      __privateSet(this, _token, token);
+      return token.accessToken;
+    }).finally(() => {
+      __privateSet(this, _inFlight, null);
+    }));
+    return __privateGet(this, _inFlight);
   }
-}
-function secureUrl(value, name) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error(`Authyon: JWT \`${name}\` must be an absolute URL`);
-  }
-  if (url.protocol !== "https:" || url.username || url.password || url.hash) {
-    throw new Error(`Authyon: JWT \`${name}\` must be a credential-free HTTPS URL`);
-  }
-  return url;
-}
-function errorCode(error) {
-  const code = isRecord(error) && typeof error.code === "string" ? error.code : "";
-  if (code === "ERR_JWT_EXPIRED") return "token.expired";
-  if (code === "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") return "token.invalid_signature";
-  if (code === "ERR_JWKS_TIMEOUT") {
-    return "token.key_unavailable";
-  }
-  if (code === "ERR_JWKS_NO_MATCHING_KEY") return "token.invalid_signature";
-  if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED") {
-    const claim = isRecord(error) && typeof error.claim === "string" ? error.claim : "";
-    return claim === "nbf" ? "token.not_active" : "token.invalid_claims";
+  clear() {
+    __privateSet(this, _token, null);
   }
-  return "token.invalid";
-}
-function messageForCode(code) {
-  if (code === "token.key_unavailable") return "Token verification key is unavailable";
-  if (code === "token.expired") return "Token has expired";
-  if (code === "token.not_active") return "Token is not active yet";
-  return "Token verification failed";
-}
-function invalidClaims() {
-  throw new TokenVerificationError("token.invalid_claims");
-}
-function isStringArray(value) {
-  return Array.isArray(value) && value.every((item) => typeof item === "string");
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
+};
+_token = new WeakMap();
+_inFlight = new WeakMap();
 
 // src/client/authyonServerClient.ts
+var _clientSecret;
 var AuthyonServerClient = class {
   constructor(options = {}) {
+    __privateAdd(this, _clientSecret);
     // ── Discovery ──────────────────────────────────────────────────────────────
     this.discovery = {
       /** GET /.well-known/jwks.json — the environment's public signing keys. */
@@ -529,8 +342,19 @@ var AuthyonServerClient = class {
           client_id: credentials.clientId,
           client_secret: credentials.clientSecret
         }
+      }),
+      /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+      validate: (accessToken, context) => this.request("/tenant/auth/validate", {
+        method: "POST",
+        headers: {
+          ...clientIpHeaders(context),
+          Authorization: `Bearer ${accessToken}`
+        }
       })
     };
+    this.workspaceInvites = new WorkspaceInvitesClient(
+      (path, options) => this.http.request(path, options)
+    );
     // ── Environment management (users, tenants, roles, permissions, audit) ───
     this.environment = {
       users: {
@@ -622,8 +446,53 @@ var AuthyonServerClient = class {
         )
       },
       tenants: {
-        /** GET /env/tenants — list tenants in the environment. */
-        list: () => this.request("/env/tenants", { envBearer: true }),
+        credentials: {
+          /** GET /env/tenants/{tenantId}/credentials. Returns metadata only, including revoked credentials. */
+          list: (tenantId) => allCredentials(
+            (path, options) => this.request(path, { ...options, envBearer: true }),
+            `/env/tenants/${segment(tenantId)}/credentials`
+          ),
+          /** Paginated searchable listing. Prefer this over loading every credential. */
+          listPage: (tenantId, options = {}) => credentialPage(
+            (path, requestOptions) => this.request(path, { ...requestOptions, envBearer: true }),
+            `/env/tenants/${segment(tenantId)}/credentials`,
+            options
+          ),
+          get: async (tenantId, credentialId) => credentialDetail(
+            await this.request(
+              `/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}`,
+              { envBearer: true }
+            )
+          ),
+          /** Explicit scopes/permissions; only issuance returns the client secret. */
+          create: (tenantId, input) => this.request(`/env/tenants/${segment(tenantId)}/credentials`, {
+            method: "POST",
+            envBearer: true,
+            body: {
+              description: input.description,
+              ...lifetimeBody(input),
+              ...permissionsBody(input)
+            }
+          }),
+          /** Returns a new secret once while keeping the same client id. */
+          rotate: (tenantId, credentialId) => this.request(
+            `/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}/rotate`,
+            { method: "POST", envBearer: true }
+          ),
+          updatePermissions: (tenantId, credentialId, input) => this.request(
+            `/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}/permissions`,
+            { method: "PUT", envBearer: true, body: permissionsBody(input) }
+          ),
+          updateScopes: (tenantId, credentialId, scopes) => this.environment.tenants.credentials.updatePermissions(tenantId, credentialId, {
+            scopes
+          }),
+          revoke: (tenantId, credentialId) => this.request(`/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}`, {
+            method: "DELETE",
+            envBearer: true
+          })
+        },
+        /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+        list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
         /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
         /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
@@ -634,7 +503,18 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: input
         }),
-        /** DELETE /env/tenants/{tenantId} — delete a tenant. */
+        /** PUT /env/tenants/{tenantId}/metadata - replace public and private metadata. */
+        updateMetadata: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/metadata`, {
+          method: "PUT",
+          envBearer: true,
+          body: input
+        }),
+        /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+        disable: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/disable`, {
+          method: "POST",
+          envBearer: true
+        }),
+        /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
         delete: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
           method: "DELETE",
           envBearer: true
@@ -768,7 +648,8 @@ var AuthyonServerClient = class {
     };
     this.envKey = options.envKey;
     this.clientId = options.clientId;
-    this.clientSecret = options.clientSecret;
+    __privateSet(this, _clientSecret, options.clientSecret);
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -779,14 +660,14 @@ var AuthyonServerClient = class {
     });
     this.http = new JsonHttpClient(this.transport);
     this.environmentTokenProvider = new ExpiringTokenProvider(async () => {
-      if (!this.clientId || !this.clientSecret) {
+      if (!this.clientId || !__privateGet(this, _clientSecret)) {
         throw new Error(
           "Authyon: `clientId`/`clientSecret` are required for environment management calls (mint a pair in the console, under the environment's OAuth clients)."
         );
       }
       const token = await this.environmentAuth.token({
         clientId: this.clientId,
-        clientSecret: this.clientSecret
+        clientSecret: __privateGet(this, _clientSecret)
       });
       return {
         accessToken: token.access_token,
@@ -795,7 +676,10 @@ var AuthyonServerClient = class {
     });
   }
   async request(path, options = {}) {
-    const headers = { ...options.headers };
+    const headers = {
+      ...clientIpHeaders({ clientIp: this.clientIp }),
+      ...options.headers
+    };
     if (options.envBearer) {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
@@ -855,6 +739,14 @@ var AuthyonServerClient = class {
   tenant(credentials) {
     return new TenantScopedClient(this, credentials);
   }
+  /** Uses only the supplied platform-user access token. */
+  platform(token) {
+    return new PlatformScopedClient((path, options) => this.http.request(path, options), token);
+  }
+  /** Uses an end-user token; the configured environment key selects the environment. */
+  user(token) {
+    return new UserScopedClient((path, options) => this.request(path, options), token);
+  }
   /** @internal used by {@link TenantScopedClient} to share the base URL/fetch/error handling. */
   _requestAsTenant(accessToken, path, options = {}) {
     return this.request(path, {
@@ -864,6 +756,7 @@ var AuthyonServerClient = class {
     });
   }
 };
+_clientSecret = new WeakMap();
 var TenantScopedClient = class {
   constructor(server, credentials) {
     this.members = {
@@ -936,332 +829,56 @@ var TenantScopedClient = class {
   async request(path, options = {}) {
     return this.server._requestAsTenant(await this.getAccessToken(), path, options);
   }
+  /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
+  async validate(context) {
+    return this.server.tenantAuth.validate(await this.getAccessToken(), context);
+  }
 };
 function createClient(options = {}) {
   return new AuthyonServerClient(options);
 }
 
 // src/client/authyonServerClientBuilder.ts
+var _options;
 var AuthyonServerClientBuilder = class {
   constructor() {
-    this.options = {};
+    __privateAdd(this, _options, {});
   }
   withEnvironmentKey(envKey) {
-    this.options.envKey = envKey;
+    __privateGet(this, _options).envKey = envKey;
     return this;
   }
   withEnvironmentCredentials(clientId, clientSecret) {
-    this.options.clientId = clientId;
-    this.options.clientSecret = clientSecret;
+    __privateGet(this, _options).clientId = clientId;
+    __privateGet(this, _options).clientSecret = clientSecret;
+    return this;
+  }
+  withClientIp(clientIp) {
+    __privateGet(this, _options).clientIp = clientIp;
     return this;
   }
   withBaseUrl(baseUrl, allowInsecureHttp = false) {
-    this.options.baseUrl = baseUrl;
-    this.options.allowInsecureHttp = allowInsecureHttp;
+    __privateGet(this, _options).baseUrl = baseUrl;
+    __privateGet(this, _options).allowInsecureHttp = allowInsecureHttp;
     return this;
   }
   withTimeout(timeoutMs) {
-    this.options.timeoutMs = timeoutMs;
+    __privateGet(this, _options).timeoutMs = timeoutMs;
     return this;
   }
   withHttpAdapter(httpAdapter) {
-    this.options.httpAdapter = httpAdapter;
+    __privateGet(this, _options).httpAdapter = httpAdapter;
     return this;
   }
   withHttpLogger(httpLogger) {
-    this.options.httpLogger = httpLogger;
+    __privateGet(this, _options).httpLogger = httpLogger;
     return this;
   }
   build() {
-    return new AuthyonServerClient({ ...this.options });
-  }
-};
-
-// ../../internal/core/authorization/ability.ts
-var AuthyonAbility = class {
-  constructor(rules = [], detectSubjectType = defaultSubjectType) {
-    this.detectSubjectType = detectSubjectType;
-    this.listeners = /* @__PURE__ */ new Set();
-    this.currentRules = rules.map(cloneRule);
-  }
-  get rules() {
-    return this.currentRules;
-  }
-  can(action, subject, field) {
-    const subjectType = typeof subject === "string" ? subject : this.detectSubjectType(subject);
-    for (let index = this.currentRules.length - 1; index >= 0; index -= 1) {
-      const rule = this.currentRules[index];
-      if (!matchesToken(rule.action, action, "manage")) continue;
-      if (!matchesToken(rule.subject, subjectType, "all")) continue;
-      if (field && rule.fields && !rule.fields.some((value) => matchesField(value, field)))
-        continue;
-      if (rule.conditions) {
-        if (typeof subject === "string" || !matchesConditions(subject, rule.conditions)) continue;
-      }
-      return !rule.inverted;
-    }
-    return false;
-  }
-  cannot(action, subject, field) {
-    return !this.can(action, subject, field);
-  }
-  rulesFor(action, subject) {
-    return this.currentRules.filter(
-      (rule) => matchesToken(rule.action, action, "manage") && matchesToken(rule.subject, subject, "all")
-    );
-  }
-  update(rules) {
-    this.currentRules = rules.map(cloneRule);
-    for (const listener of this.listeners) listener(this.rules);
-  }
-  on(event, listener) {
-    if (event !== "updated") return () => void 0;
-    this.listeners.add(listener);
-    return () => this.listeners.delete(listener);
-  }
-};
-var AuthyonAbilityBuilder = class {
-  constructor() {
-    this.rules = [];
-  }
-  can(action, subject, conditions, fields) {
-    this.rules.push({ action, subject, conditions, fields });
-    return this;
-  }
-  cannot(action, subject, conditions, fields, reason) {
-    this.rules.push({ action, subject, conditions, fields, reason, inverted: true });
-    return this;
-  }
-  build(options = {}) {
-    return new AuthyonAbility(this.rules, options.detectSubjectType);
+    return new AuthyonServerClient({ ...__privateGet(this, _options) });
   }
 };
-function createAuthyonAbility(source = {}, options = {}) {
-  return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
-}
-function createAuthyonRules(source = {}, options = {}) {
-  const permissions = /* @__PURE__ */ new Set([
-    ...source.permissions ?? [],
-    ...source.scope?.split(/\s+/).filter(Boolean) ?? []
-  ]);
-  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
-  for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
-    rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
-  }
-  rules.push(...(options.rules ?? []).map(cloneRule));
-  return rules;
-}
-function permissionToRule(permission) {
-  const normalized = permission.trim();
-  if (!normalized) return null;
-  if (normalized === "*" || normalized === "*:*" || normalized === "all:manage") {
-    return { action: "manage", subject: "all" };
-  }
-  const separator = normalized.lastIndexOf(":");
-  if (separator <= 0 || separator === normalized.length - 1) return null;
-  const subject = normalized.slice(0, separator);
-  const action = normalized.slice(separator + 1);
-  return {
-    action: action === "*" ? "manage" : action,
-    subject: subject === "*" ? "all" : subject
-  };
-}
-function matchesToken(value, expected, wildcard) {
-  return (Array.isArray(value) ? value : [value]).some(
-    (candidate) => candidate === expected || candidate === wildcard || candidate === "*"
-  );
-}
-function matchesField(pattern, field) {
-  if (pattern === "*" || pattern === field) return true;
-  return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
-}
-function matchesConditions(subject, conditions) {
-  return Object.entries(conditions).every(([path, expected]) => {
-    if (path === "$and" && Array.isArray(expected)) {
-      return expected.every(
-        (condition) => matchesConditions(subject, condition)
-      );
-    }
-    if (path === "$or" && Array.isArray(expected)) {
-      return expected.some(
-        (condition) => matchesConditions(subject, condition)
-      );
-    }
-    return matchesValue(readPath(subject, path), expected);
-  });
-}
-function matchesValue(actual, expected) {
-  if (!isRecord2(expected) || !Object.keys(expected).some((key) => key.startsWith("$"))) {
-    return isRecord2(expected) && isRecord2(actual) ? matchesConditions(actual, expected) : Object.is(actual, expected);
-  }
-  return Object.entries(expected).every(([operator, operand]) => {
-    switch (operator) {
-      case "$eq":
-        return Object.is(actual, operand);
-      case "$ne":
-        return !Object.is(actual, operand);
-      case "$in":
-        return Array.isArray(operand) && operand.some((value) => Object.is(actual, value));
-      case "$nin":
-        return Array.isArray(operand) && !operand.some((value) => Object.is(actual, value));
-      case "$gt":
-        return typeof actual === "number" && typeof operand === "number" && actual > operand;
-      case "$gte":
-        return typeof actual === "number" && typeof operand === "number" && actual >= operand;
-      case "$lt":
-        return typeof actual === "number" && typeof operand === "number" && actual < operand;
-      case "$lte":
-        return typeof actual === "number" && typeof operand === "number" && actual <= operand;
-      case "$exists":
-        return operand ? actual !== void 0 : actual === void 0;
-      default:
-        return false;
-    }
-  });
-}
-function readPath(value, path) {
-  return path.split(".").reduce((current, part) => isRecord2(current) ? current[part] : void 0, value);
-}
-function defaultSubjectType(subject) {
-  const explicit = subject.__type ?? subject.type ?? subject.kind;
-  if (typeof explicit === "string") return explicit;
-  const constructorName = subject.constructor?.name;
-  return typeof constructorName === "string" ? constructorName : "Object";
-}
-function cloneRule(rule) {
-  return {
-    ...rule,
-    action: Array.isArray(rule.action) ? [...rule.action] : rule.action,
-    subject: Array.isArray(rule.subject) ? [...rule.subject] : rule.subject,
-    fields: rule.fields ? [...rule.fields] : void 0
-  };
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isAbilityRule(value) {
-  return value !== null;
-}
-
-// src/integrations/authorization.ts
-var AuthorizationError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.name = "AuthorizationError";
-  }
-};
-async function authorizeToken(client, token, options = {}) {
-  if (!token) throw unauthenticated();
-  let userId;
-  let permissions = [];
-  let roles = [];
-  let scope;
-  if (options.verification === "jwks") {
-    if (!options.jwksVerifier) {
-      throw new Error("Authyon: `jwksVerifier` is required for JWKS verification");
-    }
-    let verified;
-    try {
-      verified = await options.jwksVerifier.verifyAccessToken(token);
-    } catch (error) {
-      if (!(error instanceof TokenVerificationError)) throw error;
-      if (error.code === "token.key_unavailable") {
-        throw new AuthorizationError(
-          503,
-          "authorization.unavailable",
-          "Token verification is temporarily unavailable"
-        );
-      }
-      throw unauthenticated();
-    }
-    const { claims } = verified;
-    userId = claims.sub;
-    permissions = claims.permissions ?? [];
-    roles = claims.roles ?? [];
-    scope = claims.scope;
-  } else if (options.verification === "introspect") {
-    const identity = await client.introspect(token, { clientIp: options.clientIp });
-    if (!identity.active) throw unauthenticated();
-    userId = identity.sub;
-    permissions = identity.permissions ?? [];
-    roles = identity.roles ?? [];
-    scope = identity.scope;
-  } else {
-    const identity = await client.validate(token, { clientIp: options.clientIp });
-    if (!identity.valid || !identity.user) throw unauthenticated();
-    userId = identity.user.id;
-    permissions = identity.user.permissions ?? [];
-  }
-  const ability = createAuthyonAbility(
-    { permissions, roles, scope },
-    {
-      rules: options.rules,
-      roleRules: options.roleRules,
-      roles: options.roles,
-      detectSubjectType: options.detectSubjectType
-    }
-  );
-  if (options.requirement && !canAccess(ability, options.requirement)) {
-    throw new AuthorizationError(403, "authorization.forbidden", "Permission denied");
-  }
-  return { token, userId, ability, permissions, roles };
-}
-function authorizeRequest(client, request, options = {}) {
-  const clientIp = options.resolveClientIp?.(request) ?? options.clientIp;
-  return authorizeToken(client, bearerToken(request.headers.get("authorization")), {
-    ...options,
-    clientIp
-  });
-}
-function createExpressAuthorizationMiddleware(client, options = {}) {
-  return async (request, response, next) => {
-    try {
-      const header = request.headers.authorization;
-      const clientIp = resolveExpressClientIp(request, options);
-      const context = await authorizeToken(
-        client,
-        bearerToken(Array.isArray(header) ? header[0] : header),
-        { ...options, clientIp }
-      );
-      request[options.requestProperty ?? "authyon"] = context;
-      next();
-    } catch (error) {
-      if (options.passErrorsToNext || !(error instanceof AuthorizationError)) {
-        next(error);
-        return;
-      }
-      response.status(error.status).json({ code: error.code, message: error.message });
-    }
-  };
-}
-function resolveExpressClientIp(request, options) {
-  const resolved = options.resolveClientIp?.(request) ?? (options.trustProxy ? request.ip : request.socket?.remoteAddress);
-  return resolved ? normalizeClientIp(stripIpv4Prefix(resolved)) : void 0;
-}
-function stripIpv4Prefix(value) {
-  return value.startsWith("::ffff:") ? value.slice(7) : value;
-}
-function createAuthorizationErrorResponse(error) {
-  if (!(error instanceof AuthorizationError)) throw error;
-  return Response.json({ code: error.code, message: error.message }, { status: error.status });
-}
-function canAccess(ability, requirement) {
-  return ability.can(requirement.action, requirement.subject, requirement.field);
-}
-function bearerToken(header) {
-  const match = header?.match(/^Bearer\s+(.+)$/i);
-  if (!match?.[1]) throw unauthenticated();
-  return match[1].trim();
-}
-function unauthenticated() {
-  return new AuthorizationError(
-    401,
-    "authorization.unauthenticated",
-    "A valid bearer token is required"
-  );
-}
+_options = new WeakMap();
 export {
   AuthorizationError,
   AuthyonAbility,
@@ -1273,8 +890,11 @@ export {
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
+  PlatformScopedClient,
   TenantScopedClient,
   TokenVerificationError,
+  UserScopedClient,
+  WorkspaceInvitesClient,
   authorizeRequest,
   authorizeToken,
   createAuthorizationErrorResponse,
@@ -1282,5 +902,7 @@ export {
   createAuthyonRules,
   createClient,
   createExpressAuthorizationMiddleware,
+  hasPermission,
+  hasPermissionGroup,
   normalizeClientIp
 };