@authyon/server 0.2.0-beta.12 → 0.2.0-beta.15

package/README.md

@@ -120,7 +120,7 @@ await authyon.environment.audit.list({ take: 50 });
 
 Veja [`examples/organizationMembership.ts`](./examples/organizationMembership.ts) para o fluxo completo, incluindo as rotas de backend que o `@authyon/auth` chamaria.
 
-Namespaces disponíveis: `environment.users`, `environment.tenants` (com `.members` e `.roles` aninhados), `environment.roles`, `environment.permissions`, `environment.audit`.
+Namespaces disponíveis: `environment.users`, `environment.tenants` (com `.members` e `.roles` aninhados), `environment.roles`, `environment.permissions`, `environment.audit`. OTP e aprovações ficam em `security` (veja abaixo).
 
 ## Autorização local
 
@@ -191,6 +191,37 @@ Chamadas server-side propagam `clientIp` em `X-Forwarded-For`. O middleware Expr
 await authyon.validate(token, { clientIp: "203.0.113.10" });
 ```
 
+## Segurança (`security.*`)
+
+OTP e aprovações ficam agrupados em `authyon.security`. Exige uma credencial de ambiente
+com o escopo `authyon:financial:authorize`. Guia completo:
+[`docs/security-otp-approvals.md`](../../docs/security-otp-approvals.md).
+
+```ts
+// security.otp — só validar o código do app autenticador
+const result = await authyon.security.otp.check(customerId, code);
+if (!result.valid) console.log(result.attemptsRemaining, result.sessionsRevoked);
+
+// security.approvals — aprovação presa a um payload livre e de uso único
+const { id } = await authyon.security.approvals.create({
+  subjectId: customerId,
+  payload: { type: "pix", amount: 150.5, to: "maria@example.com" },
+});
+// ...cliente confirma com @authyon/auth → security.approvals.confirm
+const { payload } = await authyon.security.approvals.consume(id);
+```
+
+| Método                               | Endpoint                                |
+| ------------------------------------ | --------------------------------------- |
+| `security.otp.check(userId, code)`   | `POST /env/users/{userId}/otp/verify`   |
+| `security.approvals.create(input)`   | `POST /env/authorizations`              |
+| `security.approvals.get(id)`         | `GET /env/authorizations/{id}`          |
+| `security.approvals.consume(id, p?)` | `POST /env/authorizations/{id}/consume` |
+
+Cada código vale uma vez; 3 erros seguidos deslogam o usuário de todos os dispositivos e
+5 bloqueiam a verificação por 15 minutos. Se o seu servidor guarda o token do cliente
+(BFF), o lado do cliente está em `authyon.user(accessToken).security.approvals`.
+
 ## Administração por tenant (`tenant()`)
 
 As credenciais de um tenant são próprias dele — use `authyon.tenant(credentials)` para obter um cliente escopado, que minta e cacheia seu próprio token via `POST /tenant/oauth/token`:
@@ -298,73 +329,34 @@ const issued = await authyon.environment.tenants.credentials.create(tenantId, {
 });
 // Armazene issued.clientSecret no gerenciador de segredos. Não registre a resposta.
 
-// Token de um usuário da plataforma. Pode ser um callback assíncrono que
-// consulta a sessão atual a cada operação, sem compartilhar tokens entre usuários.
-const platform = authyon.platform(() => getCurrentPlatformAccessToken());
-const scope = { workspaceId, environmentId, tenantId };
-await platform.credentials.list(scope, { search: "ERP", skip: 0, take: 25 });
-await platform.credentials.get(scope, credentialId);
-await platform.credentials.create(scope, {
+await authyon.environment.tenants.credentials.listPage(tenantId, {
+  search: "ERP",
+  skip: 0,
+  take: 25,
+});
+await authyon.environment.tenants.credentials.get(tenantId, credentialId);
+await authyon.environment.tenants.credentials.create(tenantId, {
   description: "Leitura",
   permissions: ["monkeypay:transactions:read"],
 });
-await platform.credentials.updateScopes(scope, credentialId, ["monkeypay:transactions:read"]);
-await platform.credentials.updatePermissions(scope, credentialId, {
+await authyon.environment.tenants.credentials.updateScopes(tenantId, credentialId, [
+  "monkeypay:transactions:read",
+]);
+await authyon.environment.tenants.credentials.updatePermissions(tenantId, credentialId, {
   permissions: ["monkeypay:transactions:read"],
 });
-const rotated = await platform.credentials.rotate(scope, credentialId);
-await platform.credentials.revoke(scope, credentialId);
+const rotated = await authyon.environment.tenants.credentials.rotate(tenantId, credentialId);
+await authyon.environment.tenants.credentials.revoke(tenantId, credentialId);
 ```
 
-Omita `tenantId` de `scope` para gerenciar credenciais do ambiente. Criação e
-rotação retornam o segredo uma única vez. Alterar permissões substitui a lista
+Criação e rotação retornam o segredo uma única vez. Alterar permissões substitui a lista
 completa. A concessão OAuth continua recebendo apenas `clientId`/`clientSecret`;
 `scopes` não é um parâmetro de redução de acesso na troca de token.
 
-Os endpoints `/env` oferecem criação, listagem e detalhe de credenciais do
-tenant. Atualização, rotação e revogação usam os endpoints `/platform` com
-**token de usuário da plataforma**, sem fallback para credenciais de máquina.
-Se a API exigir `auth.step_up_required`, solicite confirmação de senha na sua
-aplicação e chame explicitamente `platform.auth.stepUp(currentPassword)` antes
-de tentar a operação novamente. O SDK não repete mutações automaticamente.
-
-## Convites e remoção de acesso
-
-### Workspace
-
-```ts
-const team = await platform.workspaces.team(workspaceId);
-const invite = await platform.workspaces.members.invite(workspaceId, {
-  email: "pessoa@example.com",
-  role: "auditor", // ou "admin", sempre explícito
-});
-// invite.acceptUrl é sensível: entregue somente à pessoa convidada.
-await platform.workspaces.invites.revoke(workspaceId, invite.inviteId);
-await platform.workspaces.members.changeRole(workspaceId, memberId, "auditor");
-await platform.workspaces.members.remove(workspaceId, memberId);
-```
-
-`memberId` vem de `team.members`, e não é `userId`. O proprietário tem
-`memberId: null`; a API protege proprietário, acesso próprio e permissões de
-administração. `workspaces.invites.create` é um alias para `members.invite`.
-Convites pendentes ficam em `team.pendingInvites`; revogar o convite invalida o
-link. Para retirar acesso após aceite, remova o membro.
-
-A pessoa convidada pode consultar/aceitar o convite por uma rota server-side:
-
-```ts
-const preview = await authyon.workspaceInvites.preview(invitationToken);
-await authyon.workspaceInvites.accept(invitationToken, {
-  name: "Pessoa",
-  password: registrationPassword,
-});
-```
-
-Esses métodos não enviam token de usuário nem credenciais de ambiente. Nome e
-senha são necessários quando `preview.requiresRegistration` for verdadeiro;
-para uma conta existente, use `accept(invitationToken)`.
+Todas as operações usam os endpoints externos `/env` com a credencial de
+ambiente configurada no cliente. O SDK não repete mutações automaticamente.
 
-### Tenant
+## Membros do tenant
 
 ```ts
 const user = authyon.user(() => getCurrentUserAccessToken());
@@ -379,9 +371,6 @@ await user.tenants.members.remove(tenantId, userId);
 await authyon.environment.tenants.members.add(tenantId, userId, ["reader"]);
 await authyon.environment.tenants.members.remove(tenantId, userId);
 // Os métodos tenant(credentials).members.add/remove existentes continuam disponíveis.
-// Administração com sessão da plataforma:
-await platform.tenants.members.add(scope, userId, ["reader"]);
-await platform.tenants.members.remove(scope, userId);
 ```
 
 Configure `envKey` para `user()`. O convite de tenant associa um usuário já
@@ -392,8 +381,8 @@ atendendo esse fluxo. Nunca importe `@authyon/server` no browser.
 
 ## Compatibilidade e segurança do transporte
 
-Os métodos anteriores permanecem disponíveis. As novas chamadas exigem os
-endpoints atuais da API e a migração `ClientCredentialMetadata` para metadados
+As chamadas exigem os endpoints externos atuais da API e a migração
+`ClientCredentialMetadata` para metadados
 persistidos. O SDK não altera o banco nem publica uma versão automaticamente.
 
 O adaptador Fetch agora rejeita redirects para evitar reenviar tokens/segredos;

package/dist/{authorization-DWlLfYQJ.d.cts → authorization-B82XXf3B.d.cts}

@@ -1,4 +1,4 @@
-import { x as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.cjs';
+import { G as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.cjs';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authorization-wrZ5ull7.d.ts → authorization-WlwcTBwG.d.ts}

@@ -1,4 +1,4 @@
-import { x as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.js';
+import { G as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.js';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authyonServerClient-t82mwTws.d.cts → authyonServerClient-DQzhfaja.d.cts}

@@ -401,14 +401,6 @@ type CreateCredentialInput = CredentialPermissionsInput & {
     description?: string;
     lifetimeDays?: number | null;
 };
-interface CredentialScope {
-    workspaceId: string;
-    environmentId: string;
-    tenantId?: string;
-}
-interface TenantManagementScope extends CredentialScope {
-    tenantId: string;
-}
 interface CredentialCreator {
     id: string | null;
     type: string;
@@ -424,64 +416,6 @@ interface CredentialDetail extends TenantCredentialSummary {
     lifetimeSeconds: number | null;
     accessTokenLifetimeSeconds: number;
 }
-type WorkspaceRole = "admin" | "auditor";
-interface WorkspaceMember {
-    memberId: string | null;
-    userId: string;
-    email: string;
-    name: string;
-    role: string;
-    isOwner: boolean;
-    isSelf: boolean;
-    invitedByName: string | null;
-    joinedAt: string;
-    lastLoginAt: string | null;
-}
-interface WorkspaceInvite {
-    id: string;
-    email: string;
-    role: string;
-    invitedByName: string | null;
-    createdAt: string;
-    expiresAt: string;
-}
-interface WorkspaceTeam {
-    workspaceId: string;
-    workspaceName: string;
-    callerRole: string;
-    canManage: boolean;
-    members: WorkspaceMember[];
-    pendingInvites: WorkspaceInvite[];
-}
-interface InviteWorkspaceMemberInput {
-    email: string;
-    role: WorkspaceRole;
-}
-interface WorkspaceInviteIssued {
-    inviteId: string;
-    email: string;
-    role: string;
-    /** Sensitive bearer link returned at issuance. Do not log or persist in public storage. */
-    acceptUrl: string;
-    expiresAt: string;
-}
-interface WorkspaceInvitePreview {
-    workspaceName: string;
-    email: string;
-    role: string;
-    expiresAt: string;
-    requiresRegistration: boolean;
-}
-interface WorkspaceInviteAccepted {
-    workspaceId: string;
-    workspaceName: string;
-    role: string;
-    accountCreated: boolean;
-}
-interface AcceptWorkspaceInviteInput {
-    name?: string;
-    password?: string;
-}
 interface InviteTenantMemberInput {
     email: string;
     roles?: string[];
@@ -508,51 +442,95 @@ interface JsonRequestOptions {
 
 type ManagementRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
 
-/** Platform user administration. Never falls back to an environment machine token. */
-declare class PlatformScopedClient {
-    #private;
-    /** @hidden */
-    constructor(request: ManagementRequest, token: AccessTokenSource);
-    readonly credentials: {
-        list: (scope: CredentialScope, options?: CredentialListOptions) => Promise<Paged<TenantCredentialSummary>>;
-        get: (scope: CredentialScope, credentialId: string) => Promise<CredentialDetail>;
-        create: (scope: CredentialScope, input: CreateCredentialInput) => Promise<TenantCredentialIssued>;
-        updatePermissions: (scope: CredentialScope, credentialId: string, input: CredentialPermissionsInput) => Promise<void>;
-        updateScopes: (scope: CredentialScope, credentialId: string, scopes: readonly string[]) => Promise<void>;
-        /** Returns a new secret once. API may require an explicit step-up first. */
-        rotate: (scope: CredentialScope, credentialId: string) => Promise<TenantCredentialIssued>;
-        revoke: (scope: CredentialScope, credentialId: string) => Promise<void>;
-    };
-    readonly workspaces: {
-        team: (workspaceId: string) => Promise<WorkspaceTeam>;
-        members: {
-            invite: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
-            /** memberId comes from team.members; it is not the platform userId. */
-            remove: (workspaceId: string, memberId: string) => Promise<void>;
-            changeRole: (workspaceId: string, memberId: string, role: WorkspaceRole) => Promise<void>;
-        };
-        invites: {
-            create: (workspaceId: string, input: InviteWorkspaceMemberInput) => Promise<WorkspaceInviteIssued>;
-            revoke: (workspaceId: string, inviteId: string) => Promise<void>;
-        };
-    };
-    readonly tenants: {
-        members: {
-            list: (scope: TenantManagementScope, options?: PaginationOptions) => Promise<EnvironmentUser[]>;
-            add: (scope: TenantManagementScope, userId: string, roles?: string[]) => Promise<void>;
-            remove: (scope: TenantManagementScope, userId: string) => Promise<void>;
-        };
-    };
-    readonly auth: {
-        /** Explicitly confirms the current platform session; passwords are not retained. */
-        stepUp: (currentPassword: string) => Promise<void>;
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
+ */
+type ApprovalPayload = Record<string, unknown>;
+/** Evidence of how the customer proved their identity when approving. */
+interface ApprovalAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
+    id: string;
+    status: ApprovalStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Present once approved. */
+    assurance?: ApprovalAssurance | null;
+}
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
     };
+};
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
+}
+
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves it.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
 }
+
 /** End-user operations require a user token and the environment publishable key. */
 declare class UserScopedClient {
     #private;
     /** @hidden */
     constructor(request: ManagementRequest, token: AccessTokenSource);
+    /**
+     * The customer's side of `security.approvals`, for backends (BFF) that hold
+     * the customer's access token: `get`, `webauthnOptions`, `confirm`, `reject`.
+     */
+    readonly security: SubjectSecurity;
     readonly tenants: {
         members: {
             list: (tenantId: string, options?: PaginationOptions) => Promise<TenantMemberPage>;
@@ -562,14 +540,55 @@ declare class UserScopedClient {
         };
     };
 }
-/** Anonymous invite endpoints: the invitation token itself authorizes these requests. */
-declare class WorkspaceInvitesClient {
-    #private;
-    /** @hidden */
-    constructor(request: ManagementRequest);
-    preview(token: string): Promise<WorkspaceInvitePreview>;
-    accept(token: string, input?: AcceptWorkspaceInviteInput): Promise<WorkspaceInviteAccepted>;
+
+/** `security.approvals.create()` — something awaiting the customer's approval. */
+interface CreateApprovalInput {
+    /** Environment user who must approve. */
+    subjectId: string;
+    /** Any JSON object (up to 16 KiB) describing what is being approved. Default `{}`. */
+    payload?: ApprovalPayload;
+    /** Restrict approval to a session in this tenant. */
+    tenantId?: string;
+    /** Lifetime in seconds, clamped to 60–600. Default 300. */
+    expiresInSeconds?: number;
+    /**
+     * Optional. Sent as the `Idempotency-Key` header (max 128 chars): retrying
+     * with the same key and payload returns the same approval; the same key
+     * with a different payload fails with `idempotency_conflict`.
+     */
+    idempotencyKey?: string;
 }
+/** `security.approvals.consume()` — single-use redemption result. */
+interface ConsumedApproval {
+    id: string;
+    status: "consumed";
+    consumedAt: string;
+    /** The approved payload — execute exactly this. */
+    payload: ApprovalPayload;
+    payloadHash: string;
+    assurance: ApprovalAssurance | null;
+}
+/** `security.otp.check()` result. */
+type OtpCheckResult = {
+    valid: true;
+    userId: string;
+    /** Always `"otp"` (authenticator app). */
+    method: string;
+    verifiedAt: string;
+} | {
+    valid: false;
+    /**
+     * Wrong codes left before the first consequence: the sign-out (3 in a
+     * row) or the 15-minute lock (5). `0` when the user was just signed out.
+     */
+    attemptsRemaining: number;
+    /**
+     * True when this was the 3rd wrong code in a row (counted across login
+     * 2FA, `security.otp.check` and `security.approvals.confirm`): every
+     * session of the user was ended and they must sign in again.
+     */
+    sessionsRevoked?: boolean;
+};
 
 interface ClientRequestContext {
     /** Real end-user IP, resolved only from infrastructure trusted by the application. */
@@ -682,11 +701,8 @@ declare class AuthyonServerClient {
      * "the token's tenant" rather than one you pass by id.
      */
     tenant(credentials: ClientCredentials): TenantScopedClient;
-    /** Uses only the supplied platform-user access token. */
-    platform(token: AccessTokenSource): PlatformScopedClient;
     /** Uses an end-user token; the configured environment key selects the environment. */
     user(token: AccessTokenSource): UserScopedClient;
-    readonly workspaceInvites: WorkspaceInvitesClient;
     readonly environment: {
         users: {
             /** GET /env/users — paginated list of users in the environment. */
@@ -823,6 +839,38 @@ declare class AuthyonServerClient {
             loginActivity: (params?: PaginationOptions) => Promise<Paged<LoginActivity>>;
         };
     };
+    readonly security: {
+        otp: {
+            /**
+             * POST /env/users/{userId}/otp/verify — checks the user's authenticator
+             * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
+             * throwing. Each code is accepted once; 3 wrong codes in a row sign the
+             * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
+             * minutes (`rate_limited`).
+             */
+            check: (userId: string, code: string) => Promise<OtpCheckResult>;
+        };
+        /**
+         * The customer approves a payload with their authenticator code or
+         * passkey, once.
+         *
+         * 1. `create()` the approval with the payload and the customer.
+         * 2. The customer confirms it (`@authyon/auth` → `security.approvals.confirm`).
+         * 3. `consume()` it right before executing, and execute the returned payload.
+         */
+        approvals: {
+            /** POST /env/authorizations — registers a payload awaiting the customer's approval. */
+            create: (input: CreateApprovalInput) => Promise<Approval>;
+            /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
+            get: (id: string) => Promise<Approval>;
+            /**
+             * POST /env/authorizations/{id}/consume — redeems an approved approval
+             * exactly once and returns the approved payload. Pass `payload` to have
+             * the API check it matches (`payload_mismatch` otherwise).
+             */
+            consume: (id: string, payload?: ApprovalPayload) => Promise<ConsumedApproval>;
+        };
+    };
     readonly permissions: {
         /** POST /users/{userId}/permissions — grant a permission directly to a user. */
         grant: (userId: string, permission: string) => Promise<void>;
@@ -897,4 +945,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type TenantMemberPage as $, AuthyonServerClient as A, type Organization as B, type ClientCredentials as C, type PaginationOptions as D, type EnvironmentUser as E, FetchHttpAdapter as F, type Permission as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type PermissionsByRole as K, LoggingHttpAdapter as L, PlatformScopedClient as M, type Role as N, type OpenIdConfiguration as O, type Paged as P, type RoleGrant as Q, type ReservedPermissions as R, type RoleInput as S, type RoleList as T, type RolePermissions as U, type SafeJwtAlgorithm as V, type TenantClientValidationResult as W, type TenantCredentialIssued as X, type TenantCredentialSummary as Y, type TenantManagementScope as Z, type TenantMember as _, type HttpLoggerOptions as a, type TenantMembership as a0, TenantScopedClient as a1, type TokenResult as a2, TokenVerificationError as a3, type TokenVerificationErrorCode as a4, type UpdateOrganizationInput as a5, type User as a6, UserScopedClient as a7, type ValidateResult as a8, type VerifiedAccessToken as a9, type WorkspaceInvite as aa, type WorkspaceInviteAccepted as ab, type WorkspaceInviteIssued as ac, type WorkspaceInvitePreview as ad, WorkspaceInvitesClient as ae, type WorkspaceMember as af, type WorkspaceRole as ag, type WorkspaceTeam as ah, createClient as ai, normalizeClientIp as aj, type AcceptWorkspaceInviteInput as b, type AccessTokenSource as c, type AuditEvent as d, type AuthyonJwksDiscoveryOptions as e, type AuthyonJwtClaims as f, type AuthyonServerClientOptions as g, type ClientRequestContext as h, type CreateCredentialInput as i, type CreateOrganizationInput as j, type CreatePermissionInput as k, type CreateTenantCredentialInput as l, type CreateUserInput as m, type CredentialCreator as n, type CredentialDetail as o, type CredentialListOptions as p, type CredentialPermissionsInput as q, type CredentialScope as r, type HttpAdapterRequest as s, type HttpLogEvent as t, type HttpLogger as u, type InviteTenantMemberInput as v, type InviteWorkspaceMemberInput as w, JwksTokenVerifier as x, type JwksTokenVerifierOptions as y, type LoginActivity as z };
+export { type SubjectApprovals as $, AuthyonServerClient as A, type HttpLogger as B, type ClientCredentials as C, type InviteTenantMemberInput as D, type EnvironmentUser as E, FetchHttpAdapter as F, JwksTokenVerifier as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type JwksTokenVerifierOptions as K, LoggingHttpAdapter as L, type LoginActivity as M, type Organization as N, type OpenIdConfiguration as O, type OtpCheckResult as P, type Paged as Q, type PaginationOptions as R, type Permission as S, type PermissionsByRole as T, type ReservedPermissions as U, type Role as V, type RoleGrant as W, type RoleInput as X, type RoleList as Y, type RolePermissions as Z, type SafeJwtAlgorithm as _, type HttpLoggerOptions as a, type SubjectSecurity as a0, type TenantClientValidationResult as a1, type TenantCredentialIssued as a2, type TenantCredentialSummary as a3, type TenantMember as a4, type TenantMemberPage as a5, type TenantMembership as a6, TenantScopedClient as a7, type TokenResult as a8, TokenVerificationError as a9, type TokenVerificationErrorCode as aa, type UpdateOrganizationInput as ab, type User as ac, UserScopedClient as ad, type ValidateResult as ae, type VerifiedAccessToken as af, createClient as ag, normalizeClientIp as ah, type AccessTokenSource as b, type Approval as c, type ApprovalAssurance as d, type ApprovalPayload as e, type ApprovalStatus as f, type ApprovalWebAuthnOptions as g, type AuditEvent as h, type AuthyonJwksDiscoveryOptions as i, type AuthyonJwtClaims as j, type AuthyonServerClientOptions as k, type ClientRequestContext as l, type ConfirmApprovalInput as m, type ConsumedApproval as n, type CreateApprovalInput as o, type CreateCredentialInput as p, type CreateOrganizationInput as q, type CreatePermissionInput as r, type CreateTenantCredentialInput as s, type CreateUserInput as t, type CredentialCreator as u, type CredentialDetail as v, type CredentialListOptions as w, type CredentialPermissionsInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };