@authyon/server 0.2.0-beta.12 → 0.2.0-beta.15

package/dist/index.cjs

@@ -37,11 +37,9 @@ __export(index_exports, {
   FetchHttpAdapter: () => FetchHttpAdapter,
   JwksTokenVerifier: () => JwksTokenVerifier,
   LoggingHttpAdapter: () => LoggingHttpAdapter,
-  PlatformScopedClient: () => PlatformScopedClient,
   TenantScopedClient: () => TenantScopedClient,
   TokenVerificationError: () => TokenVerificationError,
   UserScopedClient: () => UserScopedClient,
-  WorkspaceInvitesClient: () => WorkspaceInvitesClient,
   authorizeRequest: () => authorizeRequest,
   authorizeToken: () => authorizeToken,
   createAuthorizationErrorResponse: () => createAuthorizationErrorResponse,
@@ -126,9 +124,9 @@ function credentialDetail(value) {
     accessTokenLifetimeSeconds: value.accessTokenLifetimeSeconds
   };
 }
-async function credentialPage(request, path, options = {}) {
+async function credentialPage(request, path2, options = {}) {
   const query = credentialQuery(options);
-  const page = await request(path, { query });
+  const page = await request(path2, { query });
   if (!page || !Array.isArray(page.data))
     throw new TypeError("Authyon: expected a paginated credential response.");
   return {
@@ -141,13 +139,13 @@ async function credentialPage(request, path, options = {}) {
     hasPrev: page.hasPrev
   };
 }
-async function allCredentials(request, path) {
+async function allCredentials(request, path2) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
   let skip = 0;
   for (let iteration = 0; iteration < 1e3; iteration++) {
     const page = await request(
-      path,
+      path2,
       iteration === 0 ? {} : { query: { skip, take: 100 } }
     );
     if (Array.isArray(page)) {
@@ -170,134 +168,58 @@ async function allCredentials(request, path) {
   throw new Error("Authyon: use listPage for more than 1000 credential pages.");
 }
 
+// ../../internal/core/security/approvals.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: an approval id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+function subjectSecurity(request) {
+  return {
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
+  };
+}
+
 // src/client/scopedManagementClient.ts
 function scopedRequest(request, source) {
-  return async (path, options = {}) => {
+  return async (path2, options = {}) => {
     const token = typeof source === "function" ? await source() : source;
     if (typeof token !== "string" || !token.trim() || /\s/u.test(token))
       throw new TypeError("Authyon: a valid access token is required.");
-    return request(path, {
+    return request(path2, {
       ...options,
       headers: { ...options.headers, Authorization: `Bearer ${token}` }
     });
   };
 }
-function environmentPath(scope) {
-  return `/platform/workspaces/${segment(scope.workspaceId)}/environments/${segment(scope.environmentId)}`;
-}
-function tenantPath(scope) {
-  return `${environmentPath(scope)}/tenants/${segment(scope.tenantId)}`;
-}
-function credentialPath(scope) {
-  return `${scope.tenantId === void 0 ? environmentPath(scope) : tenantPath(scope)}/credentials`;
-}
-function workspacePath(id) {
-  return `/platform/workspaces/${segment(id)}`;
-}
-function workspaceRole(role) {
-  if (role !== "admin" && role !== "auditor")
-    throw new TypeError("Authyon: workspace role must be admin or auditor.");
-  return role;
-}
 var _request;
-var PlatformScopedClient = class {
-  /** @hidden */
-  constructor(request, token) {
-    __privateAdd(this, _request);
-    this.credentials = {
-      list: (scope, options = {}) => credentialPage(__privateGet(this, _request), credentialPath(scope), options),
-      get: async (scope, credentialId) => credentialDetail(await __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`)),
-      create: (scope, input) => __privateGet(this, _request).call(this, credentialPath(scope), {
-        method: "POST",
-        body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
-      }),
-      updatePermissions: (scope, credentialId, input) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/permissions`, {
-        method: "PUT",
-        body: permissionsBody(input)
-      }),
-      updateScopes: (scope, credentialId, scopes) => this.credentials.updatePermissions(scope, credentialId, { scopes }),
-      /** Returns a new secret once. API may require an explicit step-up first. */
-      rotate: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/rotate`, { method: "POST" }),
-      revoke: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`, { method: "DELETE" })
-    };
-    this.workspaces = {
-      team: (workspaceId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/team`),
-      members: {
-        invite: (workspaceId, input) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites`, {
-          method: "POST",
-          body: { email: input.email, role: workspaceRole(input.role) }
-        }),
-        /** memberId comes from team.members; it is not the platform userId. */
-        remove: (workspaceId, memberId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
-          method: "DELETE"
-        }),
-        changeRole: (workspaceId, memberId, role) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
-          method: "PATCH",
-          body: { role: workspaceRole(role) }
-        })
-      },
-      invites: {
-        create: (workspaceId, input) => this.workspaces.members.invite(workspaceId, input),
-        revoke: (workspaceId, inviteId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites/${segment(inviteId)}`, {
-          method: "DELETE"
-        })
-      }
-    };
-    this.tenants = {
-      members: {
-        list: (scope, options = {}) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { query: options }),
-        add: (scope, userId, roles) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { method: "POST", body: { userId, roles } }),
-        remove: (scope, userId) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members/${segment(userId)}`, { method: "DELETE" })
-      }
-    };
-    this.auth = {
-      /** Explicitly confirms the current platform session; passwords are not retained. */
-      stepUp: (currentPassword) => __privateGet(this, _request).call(this, "/platform/auth/step-up", { method: "POST", body: { currentPassword } })
-    };
-    __privateSet(this, _request, scopedRequest(request, token));
-  }
-};
-_request = new WeakMap();
-var _request2;
 var UserScopedClient = class {
   /** @hidden */
   constructor(request, token) {
-    __privateAdd(this, _request2);
+    __privateAdd(this, _request);
     this.tenants = {
       members: {
-        list: (tenantId, options = {}) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, { query: options }),
+        list: (tenantId, options = {}) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members`, { query: options }),
         /** Adds an existing environment user by email; does not send an invitation email. */
-        invite: (tenantId, input) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, {
+        invite: (tenantId, input) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members`, {
           method: "POST",
           body: { email: input.email, roles: input.roles }
         }),
-        remove: (tenantId, userId) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
+        remove: (tenantId, userId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
           method: "DELETE"
         })
       }
     };
-    __privateSet(this, _request2, scopedRequest(request, token));
-  }
-};
-_request2 = new WeakMap();
-var _request3;
-var WorkspaceInvitesClient = class {
-  /** @hidden */
-  constructor(request) {
-    __privateAdd(this, _request3);
-    __privateSet(this, _request3, request);
-  }
-  preview(token) {
-    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}`);
-  }
-  accept(token, input = {}) {
-    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}/accept`, {
-      method: "POST",
-      body: { name: input.name, password: input.password }
-    });
+    __privateSet(this, _request, scopedRequest(request, token));
+    this.security = subjectSecurity(__privateGet(this, _request));
   }
 };
-_request3 = new WeakMap();
+_request = new WeakMap();
 
 // ../../internal/core/config/defaults.ts
 var DEFAULT_BASE_URL = "https://api.authyon.com";
@@ -344,16 +266,44 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -403,6 +353,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -441,14 +392,14 @@ function isRetryable(category) {
 }
 
 // ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
+function appendQuery(path2, params) {
+  if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
     if (value2 !== void 0) query.set(key, String(value2));
   }
   const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+  return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
 }
 
 // ../../internal/core/http/httpAdapter.ts
@@ -517,7 +468,6 @@ function sanitizeUrl(value) {
   url.username = "";
   url.password = "";
   url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -547,12 +497,12 @@ function createSharedTransport(options) {
   const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
   return {
     baseUrl,
-    async request(path, init) {
+    async request(path2, init) {
       const controller = new AbortController();
       const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
       try {
         return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
+          url: `${baseUrl}${path2}`,
           method: init.method ?? "GET",
           headers: normalizeHeaders(init.headers),
           body: init.body,
@@ -610,11 +560,11 @@ var JsonHttpClient = class {
   constructor(transport) {
     this.transport = transport;
   }
-  async send(path, options = {}) {
+  async send(path2, options = {}) {
     const headers = { ...options.headers };
     if (options.body !== void 0) headers["Content-Type"] = "application/json";
     try {
-      return await this.transport.request(appendQuery(path, options.query), {
+      return await this.transport.request(appendQuery(path2, options.query), {
         method: options.method ?? "GET",
         headers,
         body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
@@ -628,7 +578,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));
@@ -636,8 +588,8 @@ var JsonHttpClient = class {
     if (response.status === 204) return void 0;
     return await response.json();
   }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
+  async request(path2, options = {}) {
+    return this.parse(await this.send(path2, options));
   }
 };
 
@@ -846,9 +798,6 @@ var AuthyonServerClient = class {
         }
       })
     };
-    this.workspaceInvites = new WorkspaceInvitesClient(
-      (path, options) => this.http.request(path, options)
-    );
     // ── Environment management (users, tenants, roles, permissions, audit) ───
     this.environment = {
       users: {
@@ -943,12 +892,12 @@ var AuthyonServerClient = class {
         credentials: {
           /** GET /env/tenants/{tenantId}/credentials. Returns metadata only, including revoked credentials. */
           list: (tenantId) => allCredentials(
-            (path, options) => this.request(path, { ...options, envBearer: true }),
+            (path2, options) => this.request(path2, { ...options, envBearer: true }),
             `/env/tenants/${segment(tenantId)}/credentials`
           ),
           /** Paginated searchable listing. Prefer this over loading every credential. */
           listPage: (tenantId, options = {}) => credentialPage(
-            (path, requestOptions) => this.request(path, { ...requestOptions, envBearer: true }),
+            (path2, requestOptions) => this.request(path2, { ...requestOptions, envBearer: true }),
             `/env/tenants/${segment(tenantId)}/credentials`,
             options
           ),
@@ -1126,6 +1075,58 @@ var AuthyonServerClient = class {
         loginActivity: (params = {}) => this.request("/env/audit/login-activity", { envBearer: true, query: params })
       }
     };
+    // ── Security: one-time codes and approvals ───────────────────────────────
+    //
+    // Everything here runs with the environment credential, which needs the
+    // `authyon:financial:authorize` scope. Keep that credential on the server.
+    this.security = {
+      otp: {
+        /**
+         * POST /env/users/{userId}/otp/verify — checks the user's authenticator
+         * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
+         * throwing. Each code is accepted once; 3 wrong codes in a row sign the
+         * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
+         * minutes (`rate_limited`).
+         */
+        check: (userId, code) => this.request(`/env/users/${segment(userId)}/otp/verify`, {
+          method: "POST",
+          envBearer: true,
+          body: { code }
+        })
+      },
+      /**
+       * The customer approves a payload with their authenticator code or
+       * passkey, once.
+       *
+       * 1. `create()` the approval with the payload and the customer.
+       * 2. The customer confirms it (`@authyon/auth` → `security.approvals.confirm`).
+       * 3. `consume()` it right before executing, and execute the returned payload.
+       */
+      approvals: {
+        /** POST /env/authorizations — registers a payload awaiting the customer's approval. */
+        create: (input) => {
+          const { idempotencyKey, ...body } = input;
+          return this.request("/env/authorizations", {
+            method: "POST",
+            envBearer: true,
+            headers: idempotencyKey ? { "Idempotency-Key": idempotencyKey } : void 0,
+            body
+          });
+        },
+        /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
+        get: (id) => this.request(`/env/authorizations/${segment(id)}`, { envBearer: true }),
+        /**
+         * POST /env/authorizations/{id}/consume — redeems an approved approval
+         * exactly once and returns the approved payload. Pass `payload` to have
+         * the API check it matches (`payload_mismatch` otherwise).
+         */
+        consume: (id, payload) => this.request(`/env/authorizations/${segment(id)}/consume`, {
+          method: "POST",
+          envBearer: true,
+          body: payload === void 0 ? void 0 : { payload }
+        })
+      }
+    };
     // ── Generic permission grants ─────────────────────────────────────────────
     this.permissions = {
       /** POST /users/{userId}/permissions — grant a permission directly to a user. */
@@ -1169,7 +1170,7 @@ var AuthyonServerClient = class {
       };
     });
   }
-  async request(path, options = {}) {
+  async request(path2, options = {}) {
     const headers = {
       ...clientIpHeaders({ clientIp: this.clientIp }),
       ...options.headers
@@ -1178,7 +1179,7 @@ var AuthyonServerClient = class {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
     if (this.envKey) headers["X-Authyon-Environment"] = this.envKey;
-    return this.http.request(path, { ...options, headers });
+    return this.http.request(path2, { ...options, headers });
   }
   /** Mints (and caches) an environment access token from `clientId`/`clientSecret`. */
   async getEnvironmentAccessToken() {
@@ -1233,17 +1234,13 @@ var AuthyonServerClient = class {
   tenant(credentials) {
     return new TenantScopedClient(this, credentials);
   }
-  /** Uses only the supplied platform-user access token. */
-  platform(token) {
-    return new PlatformScopedClient((path, options) => this.http.request(path, options), token);
-  }
   /** Uses an end-user token; the configured environment key selects the environment. */
   user(token) {
-    return new UserScopedClient((path, options) => this.request(path, options), token);
+    return new UserScopedClient((path2, options) => this.request(path2, options), token);
   }
   /** @internal used by {@link TenantScopedClient} to share the base URL/fetch/error handling. */
-  _requestAsTenant(accessToken, path, options = {}) {
-    return this.request(path, {
+  _requestAsTenant(accessToken, path2, options = {}) {
+    return this.request(path2, {
       ...options,
       headers: { ...options.headers, Authorization: `Bearer ${accessToken}` },
       envBearer: false
@@ -1320,8 +1317,8 @@ var TenantScopedClient = class {
   async getAccessToken() {
     return this.tokenProvider.getAccessToken();
   }
-  async request(path, options = {}) {
-    return this.server._requestAsTenant(await this.getAccessToken(), path, options);
+  async request(path2, options = {}) {
+    return this.server._requestAsTenant(await this.getAccessToken(), path2, options);
   }
   /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
   async validate(context) {
@@ -1494,18 +1491,18 @@ function matchesField(pattern, field) {
   return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
 }
 function matchesConditions(subject, conditions) {
-  return Object.entries(conditions).every(([path, expected]) => {
-    if (path === "$and" && Array.isArray(expected)) {
+  return Object.entries(conditions).every(([path2, expected]) => {
+    if (path2 === "$and" && Array.isArray(expected)) {
       return expected.every(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    if (path === "$or" && Array.isArray(expected)) {
+    if (path2 === "$or" && Array.isArray(expected)) {
       return expected.some(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    return matchesValue(readPath(subject, path), expected);
+    return matchesValue(readPath(subject, path2), expected);
   });
 }
 function matchesValue(actual, expected) {
@@ -1537,8 +1534,8 @@ function matchesValue(actual, expected) {
     }
   });
 }
-function readPath(value, path) {
-  return path.split(".").reduce((current, part) => isRecord2(current) ? current[part] : void 0, value);
+function readPath(value, path2) {
+  return path2.split(".").reduce((current, part) => isRecord2(current) ? current[part] : void 0, value);
 }
 function defaultSubjectType(subject) {
   const explicit = subject.__type ?? subject.type ?? subject.kind;
@@ -1692,11 +1689,9 @@ function unauthenticated() {
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
-  PlatformScopedClient,
   TenantScopedClient,
   TokenVerificationError,
   UserScopedClient,
-  WorkspaceInvitesClient,
   authorizeRequest,
   authorizeToken,
   createAuthorizationErrorResponse,

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.cjs';
-export { b as AcceptWorkspaceInviteInput, c as AccessTokenSource, d as AuditEvent, e as AuthyonJwksDiscoveryOptions, f as AuthyonJwtClaims, g as AuthyonServerClientOptions, C as ClientCredentials, h as ClientRequestContext, i as CreateCredentialInput, j as CreateOrganizationInput, k as CreatePermissionInput, l as CreateTenantCredentialInput, m as CreateUserInput, n as CredentialCreator, o as CredentialDetail, p as CredentialListOptions, q as CredentialPermissionsInput, r as CredentialScope, E as EnvironmentUser, F as FetchHttpAdapter, s as HttpAdapterRequest, t as HttpLogEvent, u as HttpLogger, I as IntrospectResult, v as InviteTenantMemberInput, w as InviteWorkspaceMemberInput, J as JsonWebKeySet, x as JwksTokenVerifier, y as JwksTokenVerifierOptions, L as LoggingHttpAdapter, z as LoginActivity, O as OpenIdConfiguration, B as Organization, P as Paged, D as PaginationOptions, G as Permission, K as PermissionsByRole, M as PlatformScopedClient, R as ReservedPermissions, N as Role, Q as RoleGrant, S as RoleInput, T as RoleList, U as RolePermissions, V as SafeJwtAlgorithm, W as TenantClientValidationResult, X as TenantCredentialIssued, Y as TenantCredentialSummary, Z as TenantManagementScope, _ as TenantMember, $ as TenantMemberPage, a0 as TenantMembership, a1 as TenantScopedClient, a2 as TokenResult, a3 as TokenVerificationError, a4 as TokenVerificationErrorCode, a5 as UpdateOrganizationInput, a6 as User, a7 as UserScopedClient, a8 as ValidateResult, a9 as VerifiedAccessToken, aa as WorkspaceInvite, ab as WorkspaceInviteAccepted, ac as WorkspaceInviteIssued, ad as WorkspaceInvitePreview, ae as WorkspaceInvitesClient, af as WorkspaceMember, ag as WorkspaceRole, ah as WorkspaceTeam, ai as createClient, aj as normalizeClientIp } from './authyonServerClient-t82mwTws.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-DWlLfYQJ.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.cjs';
+export { b as AccessTokenSource, c as Approval, d as ApprovalAssurance, e as ApprovalPayload, f as ApprovalStatus, g as ApprovalWebAuthnOptions, h as AuditEvent, i as AuthyonJwksDiscoveryOptions, j as AuthyonJwtClaims, k as AuthyonServerClientOptions, C as ClientCredentials, l as ClientRequestContext, m as ConfirmApprovalInput, n as ConsumedApproval, o as CreateApprovalInput, p as CreateCredentialInput, q as CreateOrganizationInput, r as CreatePermissionInput, s as CreateTenantCredentialInput, t as CreateUserInput, u as CredentialCreator, v as CredentialDetail, w as CredentialListOptions, x as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteTenantMemberInput, J as JsonWebKeySet, G as JwksTokenVerifier, K as JwksTokenVerifierOptions, L as LoggingHttpAdapter, M as LoginActivity, O as OpenIdConfiguration, N as Organization, P as OtpCheckResult, Q as Paged, R as PaginationOptions, S as Permission, T as PermissionsByRole, U as ReservedPermissions, V as Role, W as RoleGrant, X as RoleInput, Y as RoleList, Z as RolePermissions, _ as SafeJwtAlgorithm, $ as SubjectApprovals, a0 as SubjectSecurity, a1 as TenantClientValidationResult, a2 as TenantCredentialIssued, a3 as TenantCredentialSummary, a4 as TenantMember, a5 as TenantMemberPage, a6 as TenantMembership, a7 as TenantScopedClient, a8 as TokenResult, a9 as TokenVerificationError, aa as TokenVerificationErrorCode, ab as UpdateOrganizationInput, ac as User, ad as UserScopedClient, ae as ValidateResult, af as VerifiedAccessToken, ag as createClient, ah as normalizeClientIp } from './authyonServerClient-DQzhfaja.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-B82XXf3B.cjs';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -15,6 +15,21 @@ declare const ErrorCodes: {
     readonly PasswordWeak: "user.password_weak";
     readonly PasswordPwned: "user.password_pwned";
     readonly RateLimited: "rate_limited";
+    readonly StepUpRequired: "step_up_required";
+    readonly InvalidSecondFactorCode: "invalid_code";
+    readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
+    readonly MethodNotEnrolled: "method_not_enrolled";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
+    readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";
@@ -26,6 +41,14 @@ interface AuthyonErrorInterpretation {
     retryAfter?: number;
     requestId?: string;
 }
+/** Error body as sent by the API: RFC 7807, or OAuth-style `error`/`error_description`. */
+type AuthyonErrorBody = Partial<{
+    title: string;
+    detail: string;
+    code: string;
+    error: string;
+    error_description: string;
+}> & Record<string, unknown>;
 /** Shared RFC 7807 error implementation used by both public SDKs. */
 declare class AuthyonError extends Error {
     readonly status: number;
@@ -35,11 +58,13 @@ declare class AuthyonError extends Error {
     readonly requestId?: string;
     readonly retryAfter?: number;
     readonly cause?: unknown;
-    constructor(status: number, body: Partial<{
-        title: string;
-        detail: string;
-        code: string;
-    }>, options?: {
+    /**
+     * Extra fields from the error body beyond code/title/detail — e.g.
+     * `attemptsRemaining` on `invalid_code` or `requiredMethods` on
+     * `step_up_required`. Not included in {@link toJSON}.
+     */
+    readonly extensions: Readonly<Record<string, unknown>>;
+    constructor(status: number, body: AuthyonErrorBody, options?: {
         requestId?: string;
         retryAfter?: number;
         cause?: unknown;
@@ -68,4 +93,4 @@ declare class AuthyonServerClientBuilder {
     build(): AuthyonServerClient;
 }
 
-export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode };
+export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode };