@authyon/server 0.2.0-beta.11 → 0.2.0-beta.14

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   JsonHttpClient,
   LoggingHttpAdapter,
   createSharedTransport
-} from "./chunk-56H66KLG.js";
+} from "./chunk-TWUVXZOT.js";
 import {
   AuthorizationError,
   AuthyonAbility,
@@ -102,9 +102,9 @@ function credentialDetail(value) {
     accessTokenLifetimeSeconds: value.accessTokenLifetimeSeconds
   };
 }
-async function credentialPage(request, path, options = {}) {
+async function credentialPage(request, path2, options = {}) {
   const query = credentialQuery(options);
-  const page = await request(path, { query });
+  const page = await request(path2, { query });
   if (!page || !Array.isArray(page.data))
     throw new TypeError("Authyon: expected a paginated credential response.");
   return {
@@ -117,13 +117,13 @@ async function credentialPage(request, path, options = {}) {
     hasPrev: page.hasPrev
   };
 }
-async function allCredentials(request, path) {
+async function allCredentials(request, path2) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
   let skip = 0;
   for (let iteration = 0; iteration < 1e3; iteration++) {
     const page = await request(
-      path,
+      path2,
       iteration === 0 ? {} : { query: { skip, take: 100 } }
     );
     if (Array.isArray(page)) {
@@ -146,134 +146,67 @@ async function allCredentials(request, path) {
   throw new Error("Authyon: use listPage for more than 1000 credential pages.");
 }
 
+// ../../internal/core/financial/subjectFinancialAuthorizations.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: a financial authorization id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+function subjectFinancialAuthorizations(request) {
+  return {
+    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
+    get: (id) => request(path(id)),
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
+    webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
+    reject: (id) => request(path(id, "/reject"), { method: "POST" })
+  };
+}
+
 // src/client/scopedManagementClient.ts
 function scopedRequest(request, source) {
-  return async (path, options = {}) => {
+  return async (path2, options = {}) => {
     const token = typeof source === "function" ? await source() : source;
     if (typeof token !== "string" || !token.trim() || /\s/u.test(token))
       throw new TypeError("Authyon: a valid access token is required.");
-    return request(path, {
+    return request(path2, {
       ...options,
       headers: { ...options.headers, Authorization: `Bearer ${token}` }
     });
   };
 }
-function environmentPath(scope) {
-  return `/platform/workspaces/${segment(scope.workspaceId)}/environments/${segment(scope.environmentId)}`;
-}
-function tenantPath(scope) {
-  return `${environmentPath(scope)}/tenants/${segment(scope.tenantId)}`;
-}
-function credentialPath(scope) {
-  return `${scope.tenantId === void 0 ? environmentPath(scope) : tenantPath(scope)}/credentials`;
-}
-function workspacePath(id) {
-  return `/platform/workspaces/${segment(id)}`;
-}
-function workspaceRole(role) {
-  if (role !== "admin" && role !== "auditor")
-    throw new TypeError("Authyon: workspace role must be admin or auditor.");
-  return role;
-}
 var _request;
-var PlatformScopedClient = class {
-  /** @hidden */
-  constructor(request, token) {
-    __privateAdd(this, _request);
-    this.credentials = {
-      list: (scope, options = {}) => credentialPage(__privateGet(this, _request), credentialPath(scope), options),
-      get: async (scope, credentialId) => credentialDetail(await __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`)),
-      create: (scope, input) => __privateGet(this, _request).call(this, credentialPath(scope), {
-        method: "POST",
-        body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
-      }),
-      updatePermissions: (scope, credentialId, input) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/permissions`, {
-        method: "PUT",
-        body: permissionsBody(input)
-      }),
-      updateScopes: (scope, credentialId, scopes) => this.credentials.updatePermissions(scope, credentialId, { scopes }),
-      /** Returns a new secret once. API may require an explicit step-up first. */
-      rotate: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/rotate`, { method: "POST" }),
-      revoke: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`, { method: "DELETE" })
-    };
-    this.workspaces = {
-      team: (workspaceId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/team`),
-      members: {
-        invite: (workspaceId, input) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites`, {
-          method: "POST",
-          body: { email: input.email, role: workspaceRole(input.role) }
-        }),
-        /** memberId comes from team.members; it is not the platform userId. */
-        remove: (workspaceId, memberId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
-          method: "DELETE"
-        }),
-        changeRole: (workspaceId, memberId, role) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
-          method: "PATCH",
-          body: { role: workspaceRole(role) }
-        })
-      },
-      invites: {
-        create: (workspaceId, input) => this.workspaces.members.invite(workspaceId, input),
-        revoke: (workspaceId, inviteId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites/${segment(inviteId)}`, {
-          method: "DELETE"
-        })
-      }
-    };
-    this.tenants = {
-      members: {
-        list: (scope, options = {}) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { query: options }),
-        add: (scope, userId, roles) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { method: "POST", body: { userId, roles } }),
-        remove: (scope, userId) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members/${segment(userId)}`, { method: "DELETE" })
-      }
-    };
-    this.auth = {
-      /** Explicitly confirms the current platform session; passwords are not retained. */
-      stepUp: (currentPassword) => __privateGet(this, _request).call(this, "/platform/auth/step-up", { method: "POST", body: { currentPassword } })
-    };
-    __privateSet(this, _request, scopedRequest(request, token));
-  }
-};
-_request = new WeakMap();
-var _request2;
 var UserScopedClient = class {
   /** @hidden */
   constructor(request, token) {
-    __privateAdd(this, _request2);
+    __privateAdd(this, _request);
     this.tenants = {
       members: {
-        list: (tenantId, options = {}) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, { query: options }),
+        list: (tenantId, options = {}) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members`, { query: options }),
         /** Adds an existing environment user by email; does not send an invitation email. */
-        invite: (tenantId, input) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, {
+        invite: (tenantId, input) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members`, {
           method: "POST",
           body: { email: input.email, roles: input.roles }
         }),
-        remove: (tenantId, userId) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
+        remove: (tenantId, userId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
           method: "DELETE"
         })
       }
     };
-    __privateSet(this, _request2, scopedRequest(request, token));
-  }
-};
-_request2 = new WeakMap();
-var _request3;
-var WorkspaceInvitesClient = class {
-  /** @hidden */
-  constructor(request) {
-    __privateAdd(this, _request3);
-    __privateSet(this, _request3, request);
-  }
-  preview(token) {
-    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}`);
-  }
-  accept(token, input = {}) {
-    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}/accept`, {
-      method: "POST",
-      body: { name: input.name, password: input.password }
-    });
+    __privateSet(this, _request, scopedRequest(request, token));
+    this.financialAuthorizations = subjectFinancialAuthorizations(__privateGet(this, _request));
   }
 };
-_request3 = new WeakMap();
+_request = new WeakMap();
 
 // ../../internal/core/auth/expiringTokenProvider.ts
 var _token, _inFlight;
@@ -352,9 +285,6 @@ var AuthyonServerClient = class {
         }
       })
     };
-    this.workspaceInvites = new WorkspaceInvitesClient(
-      (path, options) => this.http.request(path, options)
-    );
     // ── Environment management (users, tenants, roles, permissions, audit) ───
     this.environment = {
       users: {
@@ -449,12 +379,12 @@ var AuthyonServerClient = class {
         credentials: {
           /** GET /env/tenants/{tenantId}/credentials. Returns metadata only, including revoked credentials. */
           list: (tenantId) => allCredentials(
-            (path, options) => this.request(path, { ...options, envBearer: true }),
+            (path2, options) => this.request(path2, { ...options, envBearer: true }),
             `/env/tenants/${segment(tenantId)}/credentials`
           ),
           /** Paginated searchable listing. Prefer this over loading every credential. */
           listPage: (tenantId, options = {}) => credentialPage(
-            (path, requestOptions) => this.request(path, { ...requestOptions, envBearer: true }),
+            (path2, requestOptions) => this.request(path2, { ...requestOptions, envBearer: true }),
             `/env/tenants/${segment(tenantId)}/credentials`,
             options
           ),
@@ -625,6 +555,41 @@ var AuthyonServerClient = class {
         /** GET /permissions/reserved — reserved permission names you can't redefine. */
         reserved: () => this.request("/permissions/reserved", { envBearer: true })
       },
+      /**
+       * Transaction-bound step-up for financial operations. The environment
+       * credential needs the `authyon:financial:authorize` scope.
+       *
+       * 1. `create()` the authorization for the transaction and the customer.
+       * 2. The customer approves it with their authenticator code or passkey
+       *    (`@authyon/auth` → `financialAuthorizations.confirm`).
+       * 3. `consume()` it with the same transaction right before executing it.
+       */
+      financialAuthorizations: {
+        /** POST /env/authorizations — registers a transaction awaiting the customer's approval. */
+        create: (input) => {
+          const { idempotencyKey, ...body } = input;
+          if (typeof idempotencyKey !== "string" || !idempotencyKey.trim())
+            throw new TypeError("Authyon: `idempotencyKey` is required.");
+          return this.request("/env/authorizations", {
+            method: "POST",
+            envBearer: true,
+            headers: { "Idempotency-Key": idempotencyKey },
+            body
+          });
+        },
+        /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
+        get: (id) => this.request(`/env/authorizations/${segment(id)}`, { envBearer: true }),
+        /**
+         * POST /env/authorizations/{id}/consume — redeems an approved
+         * authorization exactly once. Resend the same transaction given to
+         * `create()`; any difference fails with `transaction_mismatch`.
+         */
+        consume: (id, transaction) => this.request(`/env/authorizations/${segment(id)}/consume`, {
+          method: "POST",
+          envBearer: true,
+          body: transaction
+        })
+      },
       audit: {
         /** GET /env/audit — paginated list of the environment's audit events. */
         list: (params = {}) => this.request("/env/audit", { envBearer: true, query: params }),
@@ -675,7 +640,7 @@ var AuthyonServerClient = class {
       };
     });
   }
-  async request(path, options = {}) {
+  async request(path2, options = {}) {
     const headers = {
       ...clientIpHeaders({ clientIp: this.clientIp }),
       ...options.headers
@@ -684,7 +649,7 @@ var AuthyonServerClient = class {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
     if (this.envKey) headers["X-Authyon-Environment"] = this.envKey;
-    return this.http.request(path, { ...options, headers });
+    return this.http.request(path2, { ...options, headers });
   }
   /** Mints (and caches) an environment access token from `clientId`/`clientSecret`. */
   async getEnvironmentAccessToken() {
@@ -739,17 +704,13 @@ var AuthyonServerClient = class {
   tenant(credentials) {
     return new TenantScopedClient(this, credentials);
   }
-  /** Uses only the supplied platform-user access token. */
-  platform(token) {
-    return new PlatformScopedClient((path, options) => this.http.request(path, options), token);
-  }
   /** Uses an end-user token; the configured environment key selects the environment. */
   user(token) {
-    return new UserScopedClient((path, options) => this.request(path, options), token);
+    return new UserScopedClient((path2, options) => this.request(path2, options), token);
   }
   /** @internal used by {@link TenantScopedClient} to share the base URL/fetch/error handling. */
-  _requestAsTenant(accessToken, path, options = {}) {
-    return this.request(path, {
+  _requestAsTenant(accessToken, path2, options = {}) {
+    return this.request(path2, {
       ...options,
       headers: { ...options.headers, Authorization: `Bearer ${accessToken}` },
       envBearer: false
@@ -826,8 +787,8 @@ var TenantScopedClient = class {
   async getAccessToken() {
     return this.tokenProvider.getAccessToken();
   }
-  async request(path, options = {}) {
-    return this.server._requestAsTenant(await this.getAccessToken(), path, options);
+  async request(path2, options = {}) {
+    return this.server._requestAsTenant(await this.getAccessToken(), path2, options);
   }
   /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
   async validate(context) {
@@ -890,11 +851,9 @@ export {
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
-  PlatformScopedClient,
   TenantScopedClient,
   TokenVerificationError,
   UserScopedClient,
-  WorkspaceInvitesClient,
   authorizeRequest,
   authorizeToken,
   createAuthorizationErrorResponse,

package/dist/next.d.cts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-CeP_GqT7.cjs';
-import { A as AuthyonServerClient } from './authyonServerClient-D-DxoL30.cjs';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-B7ynKAud.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-D_A6L9Ie.js';
-import { A as AuthyonServerClient } from './authyonServerClient-D-DxoL30.js';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-BF015NDJ.js';
+import { A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.11",
+  "version": "0.2.0-beta.14",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",