@authyon/server 0.2.0-beta.12 → 0.2.0-beta.15

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-t82mwTws.js';
-export { b as AcceptWorkspaceInviteInput, c as AccessTokenSource, d as AuditEvent, e as AuthyonJwksDiscoveryOptions, f as AuthyonJwtClaims, g as AuthyonServerClientOptions, C as ClientCredentials, h as ClientRequestContext, i as CreateCredentialInput, j as CreateOrganizationInput, k as CreatePermissionInput, l as CreateTenantCredentialInput, m as CreateUserInput, n as CredentialCreator, o as CredentialDetail, p as CredentialListOptions, q as CredentialPermissionsInput, r as CredentialScope, E as EnvironmentUser, F as FetchHttpAdapter, s as HttpAdapterRequest, t as HttpLogEvent, u as HttpLogger, I as IntrospectResult, v as InviteTenantMemberInput, w as InviteWorkspaceMemberInput, J as JsonWebKeySet, x as JwksTokenVerifier, y as JwksTokenVerifierOptions, L as LoggingHttpAdapter, z as LoginActivity, O as OpenIdConfiguration, B as Organization, P as Paged, D as PaginationOptions, G as Permission, K as PermissionsByRole, M as PlatformScopedClient, R as ReservedPermissions, N as Role, Q as RoleGrant, S as RoleInput, T as RoleList, U as RolePermissions, V as SafeJwtAlgorithm, W as TenantClientValidationResult, X as TenantCredentialIssued, Y as TenantCredentialSummary, Z as TenantManagementScope, _ as TenantMember, $ as TenantMemberPage, a0 as TenantMembership, a1 as TenantScopedClient, a2 as TokenResult, a3 as TokenVerificationError, a4 as TokenVerificationErrorCode, a5 as UpdateOrganizationInput, a6 as User, a7 as UserScopedClient, a8 as ValidateResult, a9 as VerifiedAccessToken, aa as WorkspaceInvite, ab as WorkspaceInviteAccepted, ac as WorkspaceInviteIssued, ad as WorkspaceInvitePreview, ae as WorkspaceInvitesClient, af as WorkspaceMember, ag as WorkspaceRole, ah as WorkspaceTeam, ai as createClient, aj as normalizeClientIp } from './authyonServerClient-t82mwTws.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-wrZ5ull7.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.js';
+export { b as AccessTokenSource, c as Approval, d as ApprovalAssurance, e as ApprovalPayload, f as ApprovalStatus, g as ApprovalWebAuthnOptions, h as AuditEvent, i as AuthyonJwksDiscoveryOptions, j as AuthyonJwtClaims, k as AuthyonServerClientOptions, C as ClientCredentials, l as ClientRequestContext, m as ConfirmApprovalInput, n as ConsumedApproval, o as CreateApprovalInput, p as CreateCredentialInput, q as CreateOrganizationInput, r as CreatePermissionInput, s as CreateTenantCredentialInput, t as CreateUserInput, u as CredentialCreator, v as CredentialDetail, w as CredentialListOptions, x as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteTenantMemberInput, J as JsonWebKeySet, G as JwksTokenVerifier, K as JwksTokenVerifierOptions, L as LoggingHttpAdapter, M as LoginActivity, O as OpenIdConfiguration, N as Organization, P as OtpCheckResult, Q as Paged, R as PaginationOptions, S as Permission, T as PermissionsByRole, U as ReservedPermissions, V as Role, W as RoleGrant, X as RoleInput, Y as RoleList, Z as RolePermissions, _ as SafeJwtAlgorithm, $ as SubjectApprovals, a0 as SubjectSecurity, a1 as TenantClientValidationResult, a2 as TenantCredentialIssued, a3 as TenantCredentialSummary, a4 as TenantMember, a5 as TenantMemberPage, a6 as TenantMembership, a7 as TenantScopedClient, a8 as TokenResult, a9 as TokenVerificationError, aa as TokenVerificationErrorCode, ab as UpdateOrganizationInput, ac as User, ad as UserScopedClient, ae as ValidateResult, af as VerifiedAccessToken, ag as createClient, ah as normalizeClientIp } from './authyonServerClient-DQzhfaja.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-WlwcTBwG.js';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -15,6 +15,21 @@ declare const ErrorCodes: {
     readonly PasswordWeak: "user.password_weak";
     readonly PasswordPwned: "user.password_pwned";
     readonly RateLimited: "rate_limited";
+    readonly StepUpRequired: "step_up_required";
+    readonly InvalidSecondFactorCode: "invalid_code";
+    readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
+    readonly MethodNotEnrolled: "method_not_enrolled";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
+    readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";
@@ -26,6 +41,14 @@ interface AuthyonErrorInterpretation {
     retryAfter?: number;
     requestId?: string;
 }
+/** Error body as sent by the API: RFC 7807, or OAuth-style `error`/`error_description`. */
+type AuthyonErrorBody = Partial<{
+    title: string;
+    detail: string;
+    code: string;
+    error: string;
+    error_description: string;
+}> & Record<string, unknown>;
 /** Shared RFC 7807 error implementation used by both public SDKs. */
 declare class AuthyonError extends Error {
     readonly status: number;
@@ -35,11 +58,13 @@ declare class AuthyonError extends Error {
     readonly requestId?: string;
     readonly retryAfter?: number;
     readonly cause?: unknown;
-    constructor(status: number, body: Partial<{
-        title: string;
-        detail: string;
-        code: string;
-    }>, options?: {
+    /**
+     * Extra fields from the error body beyond code/title/detail — e.g.
+     * `attemptsRemaining` on `invalid_code` or `requiredMethods` on
+     * `step_up_required`. Not included in {@link toJSON}.
+     */
+    readonly extensions: Readonly<Record<string, unknown>>;
+    constructor(status: number, body: AuthyonErrorBody, options?: {
         requestId?: string;
         retryAfter?: number;
         cause?: unknown;
@@ -68,4 +93,4 @@ declare class AuthyonServerClientBuilder {
     build(): AuthyonServerClient;
 }
 
-export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode };
+export { AuthyonError, type AuthyonErrorAction, type AuthyonErrorBody, type AuthyonErrorCategory, type AuthyonErrorInterpretation, AuthyonServerClient, AuthyonServerClientBuilder, ErrorCodes, HttpAdapter, HttpLoggerOptions, type KnownErrorCode };

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   JsonHttpClient,
   LoggingHttpAdapter,
   createSharedTransport
-} from "./chunk-56H66KLG.js";
+} from "./chunk-WPPEV5BA.js";
 import {
   AuthorizationError,
   AuthyonAbility,
@@ -102,9 +102,9 @@ function credentialDetail(value) {
     accessTokenLifetimeSeconds: value.accessTokenLifetimeSeconds
   };
 }
-async function credentialPage(request, path, options = {}) {
+async function credentialPage(request, path2, options = {}) {
   const query = credentialQuery(options);
-  const page = await request(path, { query });
+  const page = await request(path2, { query });
   if (!page || !Array.isArray(page.data))
     throw new TypeError("Authyon: expected a paginated credential response.");
   return {
@@ -117,13 +117,13 @@ async function credentialPage(request, path, options = {}) {
     hasPrev: page.hasPrev
   };
 }
-async function allCredentials(request, path) {
+async function allCredentials(request, path2) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
   let skip = 0;
   for (let iteration = 0; iteration < 1e3; iteration++) {
     const page = await request(
-      path,
+      path2,
       iteration === 0 ? {} : { query: { skip, take: 100 } }
     );
     if (Array.isArray(page)) {
@@ -146,134 +146,58 @@ async function allCredentials(request, path) {
   throw new Error("Authyon: use listPage for more than 1000 credential pages.");
 }
 
+// ../../internal/core/security/approvals.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: an approval id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+function subjectSecurity(request) {
+  return {
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
+  };
+}
+
 // src/client/scopedManagementClient.ts
 function scopedRequest(request, source) {
-  return async (path, options = {}) => {
+  return async (path2, options = {}) => {
     const token = typeof source === "function" ? await source() : source;
     if (typeof token !== "string" || !token.trim() || /\s/u.test(token))
       throw new TypeError("Authyon: a valid access token is required.");
-    return request(path, {
+    return request(path2, {
       ...options,
       headers: { ...options.headers, Authorization: `Bearer ${token}` }
     });
   };
 }
-function environmentPath(scope) {
-  return `/platform/workspaces/${segment(scope.workspaceId)}/environments/${segment(scope.environmentId)}`;
-}
-function tenantPath(scope) {
-  return `${environmentPath(scope)}/tenants/${segment(scope.tenantId)}`;
-}
-function credentialPath(scope) {
-  return `${scope.tenantId === void 0 ? environmentPath(scope) : tenantPath(scope)}/credentials`;
-}
-function workspacePath(id) {
-  return `/platform/workspaces/${segment(id)}`;
-}
-function workspaceRole(role) {
-  if (role !== "admin" && role !== "auditor")
-    throw new TypeError("Authyon: workspace role must be admin or auditor.");
-  return role;
-}
 var _request;
-var PlatformScopedClient = class {
-  /** @hidden */
-  constructor(request, token) {
-    __privateAdd(this, _request);
-    this.credentials = {
-      list: (scope, options = {}) => credentialPage(__privateGet(this, _request), credentialPath(scope), options),
-      get: async (scope, credentialId) => credentialDetail(await __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`)),
-      create: (scope, input) => __privateGet(this, _request).call(this, credentialPath(scope), {
-        method: "POST",
-        body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
-      }),
-      updatePermissions: (scope, credentialId, input) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/permissions`, {
-        method: "PUT",
-        body: permissionsBody(input)
-      }),
-      updateScopes: (scope, credentialId, scopes) => this.credentials.updatePermissions(scope, credentialId, { scopes }),
-      /** Returns a new secret once. API may require an explicit step-up first. */
-      rotate: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}/rotate`, { method: "POST" }),
-      revoke: (scope, credentialId) => __privateGet(this, _request).call(this, `${credentialPath(scope)}/${segment(credentialId)}`, { method: "DELETE" })
-    };
-    this.workspaces = {
-      team: (workspaceId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/team`),
-      members: {
-        invite: (workspaceId, input) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites`, {
-          method: "POST",
-          body: { email: input.email, role: workspaceRole(input.role) }
-        }),
-        /** memberId comes from team.members; it is not the platform userId. */
-        remove: (workspaceId, memberId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
-          method: "DELETE"
-        }),
-        changeRole: (workspaceId, memberId, role) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/members/${segment(memberId)}`, {
-          method: "PATCH",
-          body: { role: workspaceRole(role) }
-        })
-      },
-      invites: {
-        create: (workspaceId, input) => this.workspaces.members.invite(workspaceId, input),
-        revoke: (workspaceId, inviteId) => __privateGet(this, _request).call(this, `${workspacePath(workspaceId)}/invites/${segment(inviteId)}`, {
-          method: "DELETE"
-        })
-      }
-    };
-    this.tenants = {
-      members: {
-        list: (scope, options = {}) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { query: options }),
-        add: (scope, userId, roles) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members`, { method: "POST", body: { userId, roles } }),
-        remove: (scope, userId) => __privateGet(this, _request).call(this, `${tenantPath(scope)}/members/${segment(userId)}`, { method: "DELETE" })
-      }
-    };
-    this.auth = {
-      /** Explicitly confirms the current platform session; passwords are not retained. */
-      stepUp: (currentPassword) => __privateGet(this, _request).call(this, "/platform/auth/step-up", { method: "POST", body: { currentPassword } })
-    };
-    __privateSet(this, _request, scopedRequest(request, token));
-  }
-};
-_request = new WeakMap();
-var _request2;
 var UserScopedClient = class {
   /** @hidden */
   constructor(request, token) {
-    __privateAdd(this, _request2);
+    __privateAdd(this, _request);
     this.tenants = {
       members: {
-        list: (tenantId, options = {}) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, { query: options }),
+        list: (tenantId, options = {}) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members`, { query: options }),
         /** Adds an existing environment user by email; does not send an invitation email. */
-        invite: (tenantId, input) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members`, {
+        invite: (tenantId, input) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members`, {
           method: "POST",
           body: { email: input.email, roles: input.roles }
         }),
-        remove: (tenantId, userId) => __privateGet(this, _request2).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
+        remove: (tenantId, userId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
           method: "DELETE"
         })
       }
     };
-    __privateSet(this, _request2, scopedRequest(request, token));
-  }
-};
-_request2 = new WeakMap();
-var _request3;
-var WorkspaceInvitesClient = class {
-  /** @hidden */
-  constructor(request) {
-    __privateAdd(this, _request3);
-    __privateSet(this, _request3, request);
-  }
-  preview(token) {
-    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}`);
-  }
-  accept(token, input = {}) {
-    return __privateGet(this, _request3).call(this, `/platform/workspace-invites/${segment(token)}/accept`, {
-      method: "POST",
-      body: { name: input.name, password: input.password }
-    });
+    __privateSet(this, _request, scopedRequest(request, token));
+    this.security = subjectSecurity(__privateGet(this, _request));
   }
 };
-_request3 = new WeakMap();
+_request = new WeakMap();
 
 // ../../internal/core/auth/expiringTokenProvider.ts
 var _token, _inFlight;
@@ -352,9 +276,6 @@ var AuthyonServerClient = class {
         }
       })
     };
-    this.workspaceInvites = new WorkspaceInvitesClient(
-      (path, options) => this.http.request(path, options)
-    );
     // ── Environment management (users, tenants, roles, permissions, audit) ───
     this.environment = {
       users: {
@@ -449,12 +370,12 @@ var AuthyonServerClient = class {
         credentials: {
           /** GET /env/tenants/{tenantId}/credentials. Returns metadata only, including revoked credentials. */
           list: (tenantId) => allCredentials(
-            (path, options) => this.request(path, { ...options, envBearer: true }),
+            (path2, options) => this.request(path2, { ...options, envBearer: true }),
             `/env/tenants/${segment(tenantId)}/credentials`
           ),
           /** Paginated searchable listing. Prefer this over loading every credential. */
           listPage: (tenantId, options = {}) => credentialPage(
-            (path, requestOptions) => this.request(path, { ...requestOptions, envBearer: true }),
+            (path2, requestOptions) => this.request(path2, { ...requestOptions, envBearer: true }),
             `/env/tenants/${segment(tenantId)}/credentials`,
             options
           ),
@@ -632,6 +553,58 @@ var AuthyonServerClient = class {
         loginActivity: (params = {}) => this.request("/env/audit/login-activity", { envBearer: true, query: params })
       }
     };
+    // ── Security: one-time codes and approvals ───────────────────────────────
+    //
+    // Everything here runs with the environment credential, which needs the
+    // `authyon:financial:authorize` scope. Keep that credential on the server.
+    this.security = {
+      otp: {
+        /**
+         * POST /env/users/{userId}/otp/verify — checks the user's authenticator
+         * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
+         * throwing. Each code is accepted once; 3 wrong codes in a row sign the
+         * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
+         * minutes (`rate_limited`).
+         */
+        check: (userId, code) => this.request(`/env/users/${segment(userId)}/otp/verify`, {
+          method: "POST",
+          envBearer: true,
+          body: { code }
+        })
+      },
+      /**
+       * The customer approves a payload with their authenticator code or
+       * passkey, once.
+       *
+       * 1. `create()` the approval with the payload and the customer.
+       * 2. The customer confirms it (`@authyon/auth` → `security.approvals.confirm`).
+       * 3. `consume()` it right before executing, and execute the returned payload.
+       */
+      approvals: {
+        /** POST /env/authorizations — registers a payload awaiting the customer's approval. */
+        create: (input) => {
+          const { idempotencyKey, ...body } = input;
+          return this.request("/env/authorizations", {
+            method: "POST",
+            envBearer: true,
+            headers: idempotencyKey ? { "Idempotency-Key": idempotencyKey } : void 0,
+            body
+          });
+        },
+        /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
+        get: (id) => this.request(`/env/authorizations/${segment(id)}`, { envBearer: true }),
+        /**
+         * POST /env/authorizations/{id}/consume — redeems an approved approval
+         * exactly once and returns the approved payload. Pass `payload` to have
+         * the API check it matches (`payload_mismatch` otherwise).
+         */
+        consume: (id, payload) => this.request(`/env/authorizations/${segment(id)}/consume`, {
+          method: "POST",
+          envBearer: true,
+          body: payload === void 0 ? void 0 : { payload }
+        })
+      }
+    };
     // ── Generic permission grants ─────────────────────────────────────────────
     this.permissions = {
       /** POST /users/{userId}/permissions — grant a permission directly to a user. */
@@ -675,7 +648,7 @@ var AuthyonServerClient = class {
       };
     });
   }
-  async request(path, options = {}) {
+  async request(path2, options = {}) {
     const headers = {
       ...clientIpHeaders({ clientIp: this.clientIp }),
       ...options.headers
@@ -684,7 +657,7 @@ var AuthyonServerClient = class {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
     if (this.envKey) headers["X-Authyon-Environment"] = this.envKey;
-    return this.http.request(path, { ...options, headers });
+    return this.http.request(path2, { ...options, headers });
   }
   /** Mints (and caches) an environment access token from `clientId`/`clientSecret`. */
   async getEnvironmentAccessToken() {
@@ -739,17 +712,13 @@ var AuthyonServerClient = class {
   tenant(credentials) {
     return new TenantScopedClient(this, credentials);
   }
-  /** Uses only the supplied platform-user access token. */
-  platform(token) {
-    return new PlatformScopedClient((path, options) => this.http.request(path, options), token);
-  }
   /** Uses an end-user token; the configured environment key selects the environment. */
   user(token) {
-    return new UserScopedClient((path, options) => this.request(path, options), token);
+    return new UserScopedClient((path2, options) => this.request(path2, options), token);
   }
   /** @internal used by {@link TenantScopedClient} to share the base URL/fetch/error handling. */
-  _requestAsTenant(accessToken, path, options = {}) {
-    return this.request(path, {
+  _requestAsTenant(accessToken, path2, options = {}) {
+    return this.request(path2, {
       ...options,
       headers: { ...options.headers, Authorization: `Bearer ${accessToken}` },
       envBearer: false
@@ -826,8 +795,8 @@ var TenantScopedClient = class {
   async getAccessToken() {
     return this.tokenProvider.getAccessToken();
   }
-  async request(path, options = {}) {
-    return this.server._requestAsTenant(await this.getAccessToken(), path, options);
+  async request(path2, options = {}) {
+    return this.server._requestAsTenant(await this.getAccessToken(), path2, options);
   }
   /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
   async validate(context) {
@@ -890,11 +859,9 @@ export {
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
-  PlatformScopedClient,
   TenantScopedClient,
   TokenVerificationError,
   UserScopedClient,
-  WorkspaceInvitesClient,
   authorizeRequest,
   authorizeToken,
   createAuthorizationErrorResponse,

package/dist/next.d.cts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-DWlLfYQJ.cjs';
-import { A as AuthyonServerClient } from './authyonServerClient-t82mwTws.cjs';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-B82XXf3B.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-wrZ5ull7.js';
-import { A as AuthyonServerClient } from './authyonServerClient-t82mwTws.js';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-WlwcTBwG.js';
+import { A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.12",
+  "version": "0.2.0-beta.15",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",