@authyon/server 0.2.0-beta.12 → 0.2.0-beta.14

package/README.md

@@ -120,7 +120,7 @@ await authyon.environment.audit.list({ take: 50 });
 
 Veja [`examples/organizationMembership.ts`](./examples/organizationMembership.ts) para o fluxo completo, incluindo as rotas de backend que o `@authyon/auth` chamaria.
 
-Namespaces disponíveis: `environment.users`, `environment.tenants` (com `.members` e `.roles` aninhados), `environment.roles`, `environment.permissions`, `environment.audit`.
+Namespaces disponíveis: `environment.users`, `environment.tenants` (com `.members` e `.roles` aninhados), `environment.roles`, `environment.permissions`, `environment.audit`, `environment.financialAuthorizations`.
 
 ## Autorização local
 
@@ -191,6 +191,35 @@ Chamadas server-side propagam `clientIp` em `X-Forwarded-For`. O middleware Expr
 await authyon.validate(token, { clientIp: "203.0.113.10" });
 ```
 
+## Confirmação de transações financeiras
+
+Exige uma credencial de ambiente com o escopo `authyon:financial:authorize`. Guia
+completo, incluindo o lado do cliente: [`docs/financialStepUp.md`](../../docs/financialStepUp.md).
+
+```ts
+const transaction = {
+  action: "pix.transfer",
+  amount: 150.5,
+  currency: "BRL",
+  beneficiary: "Maria Silva",
+};
+
+// 1. Antes de executar, peça a aprovação do cliente.
+const { id } = await authyon.environment.financialAuthorizations.create({
+  ...transaction,
+  subjectId: customerId,
+  idempotencyKey: orderId,
+});
+
+// 2. O cliente confirma com o código (@authyon/auth → financialAuthorizations.confirm).
+
+// 3. Consuma com a mesma transação e só então execute.
+const { assurance } = await authyon.environment.financialAuthorizations.consume(id, transaction);
+```
+
+Se o seu servidor guarda o token do cliente (BFF), o lado do cliente também está em
+`authyon.user(accessToken).financialAuthorizations`.
+
 ## Administração por tenant (`tenant()`)
 
 As credenciais de um tenant são próprias dele — use `authyon.tenant(credentials)` para obter um cliente escopado, que minta e cacheia seu próprio token via `POST /tenant/oauth/token`:
@@ -298,73 +327,34 @@ const issued = await authyon.environment.tenants.credentials.create(tenantId, {
 });
 // Armazene issued.clientSecret no gerenciador de segredos. Não registre a resposta.
 
-// Token de um usuário da plataforma. Pode ser um callback assíncrono que
-// consulta a sessão atual a cada operação, sem compartilhar tokens entre usuários.
-const platform = authyon.platform(() => getCurrentPlatformAccessToken());
-const scope = { workspaceId, environmentId, tenantId };
-await platform.credentials.list(scope, { search: "ERP", skip: 0, take: 25 });
-await platform.credentials.get(scope, credentialId);
-await platform.credentials.create(scope, {
+await authyon.environment.tenants.credentials.listPage(tenantId, {
+  search: "ERP",
+  skip: 0,
+  take: 25,
+});
+await authyon.environment.tenants.credentials.get(tenantId, credentialId);
+await authyon.environment.tenants.credentials.create(tenantId, {
   description: "Leitura",
   permissions: ["monkeypay:transactions:read"],
 });
-await platform.credentials.updateScopes(scope, credentialId, ["monkeypay:transactions:read"]);
-await platform.credentials.updatePermissions(scope, credentialId, {
+await authyon.environment.tenants.credentials.updateScopes(tenantId, credentialId, [
+  "monkeypay:transactions:read",
+]);
+await authyon.environment.tenants.credentials.updatePermissions(tenantId, credentialId, {
   permissions: ["monkeypay:transactions:read"],
 });
-const rotated = await platform.credentials.rotate(scope, credentialId);
-await platform.credentials.revoke(scope, credentialId);
+const rotated = await authyon.environment.tenants.credentials.rotate(tenantId, credentialId);
+await authyon.environment.tenants.credentials.revoke(tenantId, credentialId);
 ```
 
-Omita `tenantId` de `scope` para gerenciar credenciais do ambiente. Criação e
-rotação retornam o segredo uma única vez. Alterar permissões substitui a lista
+Criação e rotação retornam o segredo uma única vez. Alterar permissões substitui a lista
 completa. A concessão OAuth continua recebendo apenas `clientId`/`clientSecret`;
 `scopes` não é um parâmetro de redução de acesso na troca de token.
 
-Os endpoints `/env` oferecem criação, listagem e detalhe de credenciais do
-tenant. Atualização, rotação e revogação usam os endpoints `/platform` com
-**token de usuário da plataforma**, sem fallback para credenciais de máquina.
-Se a API exigir `auth.step_up_required`, solicite confirmação de senha na sua
-aplicação e chame explicitamente `platform.auth.stepUp(currentPassword)` antes
-de tentar a operação novamente. O SDK não repete mutações automaticamente.
-
-## Convites e remoção de acesso
-
-### Workspace
-
-```ts
-const team = await platform.workspaces.team(workspaceId);
-const invite = await platform.workspaces.members.invite(workspaceId, {
-  email: "pessoa@example.com",
-  role: "auditor", // ou "admin", sempre explícito
-});
-// invite.acceptUrl é sensível: entregue somente à pessoa convidada.
-await platform.workspaces.invites.revoke(workspaceId, invite.inviteId);
-await platform.workspaces.members.changeRole(workspaceId, memberId, "auditor");
-await platform.workspaces.members.remove(workspaceId, memberId);
-```
-
-`memberId` vem de `team.members`, e não é `userId`. O proprietário tem
-`memberId: null`; a API protege proprietário, acesso próprio e permissões de
-administração. `workspaces.invites.create` é um alias para `members.invite`.
-Convites pendentes ficam em `team.pendingInvites`; revogar o convite invalida o
-link. Para retirar acesso após aceite, remova o membro.
-
-A pessoa convidada pode consultar/aceitar o convite por uma rota server-side:
-
-```ts
-const preview = await authyon.workspaceInvites.preview(invitationToken);
-await authyon.workspaceInvites.accept(invitationToken, {
-  name: "Pessoa",
-  password: registrationPassword,
-});
-```
-
-Esses métodos não enviam token de usuário nem credenciais de ambiente. Nome e
-senha são necessários quando `preview.requiresRegistration` for verdadeiro;
-para uma conta existente, use `accept(invitationToken)`.
+Todas as operações usam os endpoints externos `/env` com a credencial de
+ambiente configurada no cliente. O SDK não repete mutações automaticamente.
 
-### Tenant
+## Membros do tenant
 
 ```ts
 const user = authyon.user(() => getCurrentUserAccessToken());
@@ -379,9 +369,6 @@ await user.tenants.members.remove(tenantId, userId);
 await authyon.environment.tenants.members.add(tenantId, userId, ["reader"]);
 await authyon.environment.tenants.members.remove(tenantId, userId);
 // Os métodos tenant(credentials).members.add/remove existentes continuam disponíveis.
-// Administração com sessão da plataforma:
-await platform.tenants.members.add(scope, userId, ["reader"]);
-await platform.tenants.members.remove(scope, userId);
 ```
 
 Configure `envKey` para `user()`. O convite de tenant associa um usuário já
@@ -392,8 +379,8 @@ atendendo esse fluxo. Nunca importe `@authyon/server` no browser.
 
 ## Compatibilidade e segurança do transporte
 
-Os métodos anteriores permanecem disponíveis. As novas chamadas exigem os
-endpoints atuais da API e a migração `ClientCredentialMetadata` para metadados
+As chamadas exigem os endpoints externos atuais da API e a migração
+`ClientCredentialMetadata` para metadados
 persistidos. O SDK não altera o banco nem publica uma versão automaticamente.
 
 O adaptador Fetch agora rejeita redirects para evitar reenviar tokens/segredos;

package/dist/{authorization-DWlLfYQJ.d.cts → authorization-B7ynKAud.d.cts}

@@ -1,4 +1,4 @@
-import { x as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.cjs';
+import { G as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.cjs';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authorization-wrZ5ull7.d.ts → authorization-BF015NDJ.d.ts}

@@ -1,4 +1,4 @@
-import { x as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.js';
+import { G as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.js';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authyonServerClient-t82mwTws.d.cts → authyonServerClient-DmNnjw4z.d.cts}

@@ -401,14 +401,6 @@ type CreateCredentialInput = CredentialPermissionsInput & {
     description?: string;
     lifetimeDays?: number | null;
 };
-interface CredentialScope {
-    workspaceId: string;
-    environmentId: string;
-    tenantId?: string;
-}
-interface TenantManagementScope extends CredentialScope {
-    tenantId: string;
-}
 interface CredentialCreator {
     id: string | null;
     type: string;
@@ -424,64 +416,6 @@ interface CredentialDetail extends TenantCredentialSummary {
     lifetimeSeconds: number | null;
     accessTokenLifetimeSeconds: number;
 }
-type WorkspaceRole = "admin" | "auditor";
-interface WorkspaceMember {
-    memberId: string | null;
-    userId: string;
-    email: string;
-    name: string;
-    role: string;
-    isOwner: boolean;
-    isSelf: boolean;
-    invitedByName: string | null;
-    joinedAt: string;
-    lastLoginAt: string | null;
-}
-interface WorkspaceInvite {
-    id: string;
-    email: string;
-    role: string;
-    invitedByName: string | null;
-    createdAt: string;
-    expiresAt: string;
-}
-interface WorkspaceTeam {
-    workspaceId: string;
-    workspaceName: string;
-    callerRole: string;
-    canManage: boolean;
-    members: WorkspaceMember[];
-    pendingInvites: WorkspaceInvite[];
-}
-interface InviteWorkspaceMemberInput {
-    email: string;
-    role: WorkspaceRole;
-}
-interface WorkspaceInviteIssued {
-    inviteId: string;
-    email: string;
-    role: string;
-    /** Sensitive bearer link returned at issuance. Do not log or persist in public storage. */
-    acceptUrl: string;
-    expiresAt: string;
-}
-interface WorkspaceInvitePreview {
-    workspaceName: string;
-    email: string;
-    role: string;
-    expiresAt: string;
-    requiresRegistration: boolean;
-}
-interface WorkspaceInviteAccepted {
-    workspaceId: string;
-    workspaceName: string;
-    role: string;
-    accountCreated: boolean;
-}
-interface AcceptWorkspaceInviteInput {
-    name?: string;
-    password?: string;
-}
 interface InviteTenantMemberInput {
     email: string;
     roles?: string[];
@@ -508,51 +442,107 @@ interface JsonRequestOptions {
 
 type ManagementRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
 
-/** Platform user administration. Never falls back to an environment machine token. */
-declare class PlatformScopedClient {
-    #private;
-    /** @hidden */
-    constructor(request: ManagementRequest, token: AccessTokenSource);
-    readonly credentials: {
-        list: (scope: CredentialScope, options?: CredentialListOptions) => Promise<Paged<TenantCredentialSummary>>;
-        get: (scope: CredentialScope, credentialId: string) => Promise<CredentialDetail>;
-        create: (scope: CredentialScope, input: CreateCredentialInput) => Promise<TenantCredentialIssued>;
-        updatePermissions: (scope: CredentialScope, credentialId: string, input: CredentialPermissionsInput) => Promise<void>;
-        updateScopes: (scope: CredentialScope, credentialId: string, scopes: readonly string[]) => Promise<void>;
-        /** Returns a new secret once. API may require an explicit step-up first. */
-        rotate: (scope: CredentialScope, credentialId: string) => Promise<TenantCredentialIssued>;
-        revoke: (scope: CredentialScope, credentialId: string) => Promise<void>;
-    };
-    readonly workspaces: {
-        team: (workspaceId: string) => Promise<WorkspaceTeam>;
-        members: {
-            invite: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
-            /** memberId comes from team.members; it is not the platform userId. */
-            remove: (workspaceId: string, memberId: string) => Promise<void>;
-            changeRole: (workspaceId: string, memberId: string, role: WorkspaceRole) => Promise<void>;
-        };
-        invites: {
-            create: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
-            revoke: (workspaceId: string, inviteId: string) => Promise<void>;
-        };
-    };
-    readonly tenants: {
-        members: {
-            list: (scope: TenantManagementScope, options?: PaginationOptions) => Promise<EnvironmentUser[]>;
-            add: (scope: TenantManagementScope, userId: string, roles?: string[]) => Promise<void>;
-            remove: (scope: TenantManagementScope, userId: string) => Promise<void>;
-        };
-    };
-    readonly auth: {
-        /** Explicitly confirms the current platform session; passwords are not retained. */
-        stepUp: (currentPassword: string) => Promise<void>;
+/** Lifecycle of a transaction-bound financial authorization. */
+type FinancialAuthorizationStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * The transaction the customer approves. The API hashes a canonical form of
+ * these fields; `consume()` must resend exactly the same values (amount is
+ * normalized to four decimal places, metadata keys are sorted).
+ */
+interface FinancialTransaction {
+    /** Business action, e.g. `"pix.transfer"`. Max 100 characters. */
+    action: string;
+    /** Positive amount, up to 15 integer digits and 4 decimal places. */
+    amount: number;
+    /** ISO 4217 currency code, e.g. `"BRL"`. */
+    currency: string;
+    /** Human-readable beneficiary shown to the customer. Max 256 characters. */
+    beneficiary: string;
+    /** Optional JSON object bound into the hash (max 16 KiB). */
+    metadata?: Record<string, unknown>;
+}
+/** Evidence of how the customer proved their identity when approving. */
+interface FinancialAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+interface FinancialAuthorization {
+    id: string;
+    status: FinancialAuthorizationStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    action: string;
+    amount: number;
+    currency: string;
+    beneficiary: string;
+    /** SHA-256 (hex) of the canonical transaction. */
+    transactionHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Full canonical transaction — returned only to the customer (subject) view. */
+    transaction?: FinancialTransaction | null;
+    /** Present once approved. */
+    assurance?: FinancialAssurance | null;
+}
+/** Inline second factor sent with `confirm()`. */
+type ConfirmFinancialAuthorizationInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
     };
+};
+/** Passkey assertion options for approving one authorization. */
+interface FinancialWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
 }
+
+/** Sends a request already authenticated as the customer (end-user bearer). */
+type SubjectRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
+/** Customer-side operations on a financial authorization (`/auth/authorizations`). */
+declare function subjectFinancialAuthorizations(request: SubjectRequest): {
+    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
+    get: (id: string) => Promise<FinancialAuthorization>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
+    webauthnOptions: (id: string) => Promise<FinancialWebAuthnOptions>;
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm: (id: string, input?: ConfirmFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
+    reject: (id: string) => Promise<FinancialAuthorization>;
+};
+
 /** End-user operations require a user token and the environment publishable key. */
 declare class UserScopedClient {
     #private;
     /** @hidden */
     constructor(request: ManagementRequest, token: AccessTokenSource);
+    /**
+     * Customer-side approval of a financial authorization, for backends (BFF)
+     * that hold the customer's access token: `get`, `webauthnOptions`,
+     * `confirm`, `reject`.
+     */
+    readonly financialAuthorizations: ReturnType<typeof subjectFinancialAuthorizations>;
     readonly tenants: {
         members: {
             list: (tenantId: string, options?: PaginationOptions) => Promise<TenantMemberPage>;
@@ -562,13 +552,29 @@ declare class UserScopedClient {
         };
     };
 }
-/** Anonymous invite endpoints: the invitation token itself authorizes these requests. */
-declare class WorkspaceInvitesClient {
-    #private;
-    /** @hidden */
-    constructor(request: ManagementRequest);
-    preview(token: string): Promise<WorkspaceInvitePreview>;
-    accept(token: string, input?: AcceptWorkspaceInviteInput): Promise<WorkspaceInviteAccepted>;
+
+/** POST /env/authorizations — a transaction awaiting the customer's approval. */
+interface CreateFinancialAuthorizationInput extends FinancialTransaction {
+    /** Environment user who must approve. */
+    subjectId: string;
+    /** Restrict approval to a session in this tenant. */
+    tenantId?: string;
+    /** Lifetime in seconds, clamped to 60–600. Default 300. */
+    expiresInSeconds?: number;
+    /**
+     * Sent as the `Idempotency-Key` header (max 128 chars). Retrying with the
+     * same key and transaction returns the same authorization; the same key
+     * with a different transaction fails with `idempotency_conflict`.
+     */
+    idempotencyKey: string;
+}
+/** POST /env/authorizations/{id}/consume — single-use redemption result. */
+interface ConsumedFinancialAuthorization {
+    id: string;
+    status: "consumed";
+    consumedAt: string;
+    transactionHash: string;
+    assurance: FinancialAssurance | null;
 }
 
 interface ClientRequestContext {
@@ -682,11 +688,8 @@ declare class AuthyonServerClient {
      * "the token's tenant" rather than one you pass by id.
      */
     tenant(credentials: ClientCredentials): TenantScopedClient;
-    /** Uses only the supplied platform-user access token. */
-    platform(token: AccessTokenSource): PlatformScopedClient;
     /** Uses an end-user token; the configured environment key selects the environment. */
     user(token: AccessTokenSource): UserScopedClient;
-    readonly workspaceInvites: WorkspaceInvitesClient;
     readonly environment: {
         users: {
             /** GET /env/users — paginated list of users in the environment. */
@@ -816,6 +819,27 @@ declare class AuthyonServerClient {
             /** GET /permissions/reserved — reserved permission names you can't redefine. */
             reserved: () => Promise<ReservedPermissions>;
         };
+        /**
+         * Transaction-bound step-up for financial operations. The environment
+         * credential needs the `authyon:financial:authorize` scope.
+         *
+         * 1. `create()` the authorization for the transaction and the customer.
+         * 2. The customer approves it with their authenticator code or passkey
+         *    (`@authyon/auth` → `financialAuthorizations.confirm`).
+         * 3. `consume()` it with the same transaction right before executing it.
+         */
+        financialAuthorizations: {
+            /** POST /env/authorizations — registers a transaction awaiting the customer's approval. */
+            create: (input: CreateFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
+            /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
+            get: (id: string) => Promise<FinancialAuthorization>;
+            /**
+             * POST /env/authorizations/{id}/consume — redeems an approved
+             * authorization exactly once. Resend the same transaction given to
+             * `create()`; any difference fails with `transaction_mismatch`.
+             */
+            consume: (id: string, transaction: FinancialTransaction) => Promise<ConsumedFinancialAuthorization>;
+        };
         audit: {
             /** GET /env/audit — paginated list of the environment's audit events. */
             list: (params?: PaginationOptions) => Promise<Paged<AuditEvent>>;
@@ -897,4 +921,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type TenantMemberPage as $, AuthyonServerClient as A, type Organization as B, type ClientCredentials as C, type PaginationOptions as D, type EnvironmentUser as E, FetchHttpAdapter as F, type Permission as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type PermissionsByRole as K, LoggingHttpAdapter as L, PlatformScopedClient as M, type Role as N, type OpenIdConfiguration as O, type Paged as P, type RoleGrant as Q, type ReservedPermissions as R, type RoleInput as S, type RoleList as T, type RolePermissions as U, type SafeJwtAlgorithm as V, type TenantClientValidationResult as W, type TenantCredentialIssued as X, type TenantCredentialSummary as Y, type TenantManagementScope as Z, type TenantMember as _, type HttpLoggerOptions as a, type TenantMembership as a0, TenantScopedClient as a1, type TokenResult as a2, TokenVerificationError as a3, type TokenVerificationErrorCode as a4, type UpdateOrganizationInput as a5, type User as a6, UserScopedClient as a7, type ValidateResult as a8, type VerifiedAccessToken as a9, type WorkspaceInvite as aa, type WorkspaceInviteAccepted as ab, type WorkspaceInviteIssued as ac, type WorkspaceInvitePreview as ad, WorkspaceInvitesClient as ae, type WorkspaceMember as af, type WorkspaceRole as ag, type WorkspaceTeam as ah, createClient as ai, normalizeClientIp as aj, type AcceptWorkspaceInviteInput as b, type AccessTokenSource as c, type AuditEvent as d, type AuthyonJwksDiscoveryOptions as e, type AuthyonJwtClaims as f, type AuthyonServerClientOptions as g, type ClientRequestContext as h, type CreateCredentialInput as i, type CreateOrganizationInput as j, type CreatePermissionInput as k, type CreateTenantCredentialInput as l, type CreateUserInput as m, type CredentialCreator as n, type CredentialDetail as o, type CredentialListOptions as p, type CredentialPermissionsInput as q, type CredentialScope as r, type HttpAdapterRequest as s, type HttpLogEvent as t, type HttpLogger as u, type InviteTenantMemberInput as v, type InviteWorkspaceMemberInput as w, JwksTokenVerifier as x, type JwksTokenVerifierOptions as y, type LoginActivity as z };
+export { type TenantCredentialIssued as $, AuthyonServerClient as A, type HttpLogger as B, type ClientCredentials as C, type InviteTenantMemberInput as D, type EnvironmentUser as E, FetchHttpAdapter as F, JwksTokenVerifier as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type JwksTokenVerifierOptions as K, LoggingHttpAdapter as L, type LoginActivity as M, type Organization as N, type OpenIdConfiguration as O, type Paged as P, type PaginationOptions as Q, type Permission as R, type PermissionsByRole as S, type ReservedPermissions as T, type Role as U, type RoleGrant as V, type RoleInput as W, type RoleList as X, type RolePermissions as Y, type SafeJwtAlgorithm as Z, type TenantClientValidationResult as _, type HttpLoggerOptions as a, type TenantCredentialSummary as a0, type TenantMember as a1, type TenantMemberPage as a2, type TenantMembership as a3, TenantScopedClient as a4, type TokenResult as a5, TokenVerificationError as a6, type TokenVerificationErrorCode as a7, type UpdateOrganizationInput as a8, type User as a9, UserScopedClient as aa, type ValidateResult as ab, type VerifiedAccessToken as ac, createClient as ad, normalizeClientIp as ae, type AccessTokenSource as b, type AuditEvent as c, type AuthyonJwksDiscoveryOptions as d, type AuthyonJwtClaims as e, type AuthyonServerClientOptions as f, type ClientRequestContext as g, type ConfirmFinancialAuthorizationInput as h, type ConsumedFinancialAuthorization as i, type CreateCredentialInput as j, type CreateFinancialAuthorizationInput as k, type CreateOrganizationInput as l, type CreatePermissionInput as m, type CreateTenantCredentialInput as n, type CreateUserInput as o, type CredentialCreator as p, type CredentialDetail as q, type CredentialListOptions as r, type CredentialPermissionsInput as s, type FinancialAssurance as t, type FinancialAuthorization as u, type FinancialAuthorizationStatus as v, type FinancialTransaction as w, type FinancialWebAuthnOptions as x, type HttpAdapterRequest as y, type HttpLogEvent as z };