@authyon/server 0.2.0-beta.14 → 0.2.0-beta.16

package/dist/{authyonServerClient-DmNnjw4z.d.ts → authyonServerClient-1_1qNRDa.d.ts}

@@ -57,6 +57,82 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
+/**
+ * Security methods active on the user's account, as returned in the
+ * `security` field of `GET /auth/me` and `POST /auth/validate`.
+ */
+interface SecurityMethods {
+    /** A password is set (false for accounts created only through SSO or magic link). */
+    password: boolean;
+    /** Authenticator app (TOTP one-time codes). */
+    authenticator: boolean;
+    /** One-time codes sent by email. */
+    emailCode: boolean;
+    /** At least one passkey registered. */
+    passkey: boolean;
+    passkeyCount: number;
+    /** Unused recovery codes left. */
+    recoveryCodes: number;
+    /** SSO providers linked to the account, e.g. `["google", "github"]`. */
+    sso: string[];
+    /** Any second factor is active (authenticator, email code or passkey). */
+    twoFactor: boolean;
+}
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
+ */
+type ApprovalPayload = Record<string, unknown>;
+/** Evidence of how the customer proved their identity when approving. */
+interface ApprovalAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
+    id: string;
+    status: ApprovalStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Present once approved. */
+    assurance?: ApprovalAssurance | null;
+}
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
+    };
+};
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
+}
+
 interface PaginationOptions {
     skip?: number;
     take?: number;
@@ -120,6 +196,8 @@ interface User {
     /** Environment-level roles from the database-validated user profile. */
     roles?: string[];
     permissions?: string[];
+    /** Security methods active on the account (authenticator, email code, passkey, SSO…). */
+    security?: SecurityMethods;
 }
 interface RoleGrant {
     role: string;
@@ -251,8 +329,15 @@ interface UpdateOrganizationInput {
 }
 interface CreateUserInput {
     email: string;
-    username: string;
+    /**
+     * Same contract as `/auth/register`: optional only when the environment's
+     * username policy is `AutoFromEmail` (derived from the email). Collisions
+     * resolve by that policy.
+     */
+    username?: string;
     password: string;
+    firstName?: string;
+    lastName?: string;
     /** Values for custom user fields configured in the environment. */
     customFields?: Record<string, unknown>;
     emailConfirmed?: boolean;
@@ -429,6 +514,96 @@ interface TenantMember {
     lastLoginAt: string | null;
 }
 type TenantMemberPage = Paged<TenantMember>;
+/**
+ * Invite an address to a tenant. The address may not have an account in the
+ * environment yet — accepting creates it. `sendEmail` defaults to `true`;
+ * `false` only returns the link, for delivery through your own channel.
+ */
+interface TenantInviteInput {
+    email: string;
+    roles?: string[];
+    sendEmail?: boolean;
+    /**
+     * Where to send the invitee after they accept. Must be registered exactly in
+     * the environment's redirect URIs (the same list SSO and magic link use);
+     * otherwise the API rejects the invite. Comes back on `preview` and `accept`.
+     */
+    redirectUri?: string;
+}
+/** Returned when an invite is created or re-issued. `acceptUrl` is only ever
+ *  readable here — the API keeps a hash of the token, not the token. */
+interface TenantInviteIssued {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    acceptUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+type TenantInviteStatus = "pending" | "accepted" | "revoked" | "expired";
+interface TenantInvite {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    status: TenantInviteStatus;
+    createdAt: string;
+    expiresAt: string;
+    emailSentAt: string | null;
+    acceptedAt: string | null;
+    acceptedByUserId: string | null;
+    revokedAt: string | null;
+    invitedByUserId: string | null;
+    redirectUri: string | null;
+}
+/** What an accept page shows before the invitee commits. */
+interface TenantInvitePreview {
+    tenantId: string;
+    tenantName: string;
+    email: string;
+    roles: string[];
+    expiresAt: string;
+    /** True: accepting only needs the token. False: send a password (and a username when `usernameRequired`). */
+    accountExists: boolean;
+    usernameRequired: boolean;
+    /** Where the issuer asked to send the invitee after accepting, or `null`. */
+    redirectUri: string | null;
+}
+/**
+ * Redeem an invite. For an address that already has an account only `token`
+ * and the metadata are used; the rest is for creating the account.
+ */
+interface AcceptTenantInviteInput {
+    token: string;
+    username?: string;
+    password?: string;
+    firstName?: string;
+    lastName?: string;
+    /**
+     * @deprecated Use `publicMetadata` / `privateMetadata`. Still sent and
+     * validated against the environment's user field schema for now.
+     */
+    customFields?: Record<string, unknown>;
+    /**
+     * Replaces the user's public metadata (readable by the user). Requires the
+     * client credentials (`clientId`/`clientSecret`) with `authyon:users:write`:
+     * when this or `privateMetadata` is set, `accept` calls
+     * `POST /env/tenant-invites/accept` instead of the public route.
+     */
+    publicMetadata?: Record<string, unknown>;
+    /** Replaces the user's private metadata (server-only). Same requirement as `publicMetadata`. */
+    privateMetadata?: Record<string, unknown>;
+}
+interface TenantInviteAccepted {
+    tenantId: string;
+    tenantName: string;
+    userId: string;
+    accountCreated: boolean;
+    /** Where the issuer asked to send the invitee, or `null`. Redirecting is up to the accept page. */
+    redirectUri: string | null;
+}
 
 type QueryParams = object;
 
@@ -442,95 +617,34 @@ interface JsonRequestOptions {
 
 type ManagementRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
 
-/** Lifecycle of a transaction-bound financial authorization. */
-type FinancialAuthorizationStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
-/**
- * The transaction the customer approves. The API hashes a canonical form of
- * these fields; `consume()` must resend exactly the same values (amount is
- * normalized to four decimal places, metadata keys are sorted).
- */
-interface FinancialTransaction {
-    /** Business action, e.g. `"pix.transfer"`. Max 100 characters. */
-    action: string;
-    /** Positive amount, up to 15 integer digits and 4 decimal places. */
-    amount: number;
-    /** ISO 4217 currency code, e.g. `"BRL"`. */
-    currency: string;
-    /** Human-readable beneficiary shown to the customer. Max 256 characters. */
-    beneficiary: string;
-    /** Optional JSON object bound into the hash (max 16 KiB). */
-    metadata?: Record<string, unknown>;
-}
-/** Evidence of how the customer proved their identity when approving. */
-interface FinancialAssurance {
-    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
-    acr: string;
-    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
-    amr: string[];
-    /** When the second factor was verified (ISO 8601). */
-    authTime: string;
-}
-interface FinancialAuthorization {
-    id: string;
-    status: FinancialAuthorizationStatus;
-    subjectId: string;
-    tenantId?: string | null;
-    action: string;
-    amount: number;
-    currency: string;
-    beneficiary: string;
-    /** SHA-256 (hex) of the canonical transaction. */
-    transactionHash: string;
-    createdAt: string;
-    expiresAt: string;
-    decidedAt?: string | null;
-    consumedAt?: string | null;
-    /** Full canonical transaction — returned only to the customer (subject) view. */
-    transaction?: FinancialTransaction | null;
-    /** Present once approved. */
-    assurance?: FinancialAssurance | null;
-}
-/** Inline second factor sent with `confirm()`. */
-type ConfirmFinancialAuthorizationInput = {
-    method: "authenticator";
-    /** Six-digit code from the customer's authenticator app. */
-    code: string;
-} | {
-    method: "webauthn";
-    /** Assertion for the options returned by `webauthnOptions()`. */
-    webAuthn: {
-        ceremonyToken: string;
-        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
-        assertionJson: string;
-    };
-};
-/** Passkey assertion options for approving one authorization. */
-interface FinancialWebAuthnOptions {
-    ceremonyToken: string;
-    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
-    optionsJson: string;
-}
-
-/** Sends a request already authenticated as the customer (end-user bearer). */
-type SubjectRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
-/** Customer-side operations on a financial authorization (`/auth/authorizations`). */
-declare function subjectFinancialAuthorizations(request: SubjectRequest): {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id: string) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id: string) => Promise<FinancialWebAuthnOptions>;
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
     /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
+     * POST /auth/authorizations/{id}/confirm — approves it.
      *
      * Pass the authenticator code or passkey assertion to verify the second
      * factor inline (recommended). Without `input`, the session itself must
      * have used a passkey or authenticator code within the last 5 minutes,
      * otherwise the API answers `step_up_required`.
      */
-    confirm: (id: string, input?: ConfirmFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id: string) => Promise<FinancialAuthorization>;
-};
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /**
+     * GET /auth/me — which security methods the signed-in user has active
+     * (password, authenticator, email code, passkeys, recovery codes, SSO).
+     */
+    methods(): Promise<SecurityMethods>;
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
+}
 
 /** End-user operations require a user token and the environment publishable key. */
 declare class UserScopedClient {
@@ -538,11 +652,10 @@ declare class UserScopedClient {
     /** @hidden */
     constructor(request: ManagementRequest, token: AccessTokenSource);
     /**
-     * Customer-side approval of a financial authorization, for backends (BFF)
-     * that hold the customer's access token: `get`, `webauthnOptions`,
-     * `confirm`, `reject`.
+     * The customer's side of `security.approvals`, for backends (BFF) that hold
+     * the customer's access token: `get`, `webauthnOptions`, `confirm`, `reject`.
      */
-    readonly financialAuthorizations: ReturnType<typeof subjectFinancialAuthorizations>;
+    readonly security: SubjectSecurity;
     readonly tenants: {
         members: {
             list: (tenantId: string, options?: PaginationOptions) => Promise<TenantMemberPage>;
@@ -550,32 +663,71 @@ declare class UserScopedClient {
             invite: (tenantId: string, input: InviteTenantMemberInput) => Promise<TenantMember>;
             remove: (tenantId: string, userId: string) => Promise<void>;
         };
+        /**
+         * Invites by e-mail or by link, acting as the user. Requires the
+         * `tenants:members:invite` permission on the tenant.
+         */
+        invites: {
+            list: (tenantId: string) => Promise<TenantInvite[]>;
+            /** Always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+            create: (tenantId: string, input: TenantInviteInput) => Promise<TenantInviteIssued>;
+            /** New link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+            resend: (tenantId: string, inviteId: string, input?: {
+                sendEmail?: boolean;
+            }) => Promise<TenantInviteIssued>;
+            revoke: (tenantId: string, inviteId: string) => Promise<void>;
+        };
     };
 }
 
-/** POST /env/authorizations — a transaction awaiting the customer's approval. */
-interface CreateFinancialAuthorizationInput extends FinancialTransaction {
+/** `security.approvals.create()` — something awaiting the customer's approval. */
+interface CreateApprovalInput {
     /** Environment user who must approve. */
     subjectId: string;
+    /** Any JSON object (up to 16 KiB) describing what is being approved. Default `{}`. */
+    payload?: ApprovalPayload;
     /** Restrict approval to a session in this tenant. */
     tenantId?: string;
     /** Lifetime in seconds, clamped to 60–600. Default 300. */
     expiresInSeconds?: number;
     /**
-     * Sent as the `Idempotency-Key` header (max 128 chars). Retrying with the
-     * same key and transaction returns the same authorization; the same key
-     * with a different transaction fails with `idempotency_conflict`.
+     * Optional. Sent as the `Idempotency-Key` header (max 128 chars): retrying
+     * with the same key and payload returns the same approval; the same key
+     * with a different payload fails with `idempotency_conflict`.
      */
-    idempotencyKey: string;
+    idempotencyKey?: string;
 }
-/** POST /env/authorizations/{id}/consume — single-use redemption result. */
-interface ConsumedFinancialAuthorization {
+/** `security.approvals.consume()` — single-use redemption result. */
+interface ConsumedApproval {
     id: string;
     status: "consumed";
     consumedAt: string;
-    transactionHash: string;
-    assurance: FinancialAssurance | null;
+    /** The approved payload — execute exactly this. */
+    payload: ApprovalPayload;
+    payloadHash: string;
+    assurance: ApprovalAssurance | null;
 }
+/** `security.otp.check()` result. */
+type OtpCheckResult = {
+    valid: true;
+    userId: string;
+    /** Always `"otp"` (authenticator app). */
+    method: string;
+    verifiedAt: string;
+} | {
+    valid: false;
+    /**
+     * Wrong codes left before the first consequence: the sign-out (3 in a
+     * row) or the 15-minute lock (5). `0` when the user was just signed out.
+     */
+    attemptsRemaining: number;
+    /**
+     * True when this was the 3rd wrong code in a row (counted across login
+     * 2FA, `security.otp.check` and `security.approvals.confirm`): every
+     * session of the user was ended and they must sign in again.
+     */
+    sessionsRevoked?: boolean;
+};
 
 interface ClientRequestContext {
     /** Real end-user IP, resolved only from infrastructure trusted by the application. */
@@ -784,6 +936,44 @@ declare class AuthyonServerClient {
                 /** DELETE .../members/{userId}/permissions/{permission} — revoke a permission from a tenant member. */
                 revokePermission: (tenantId: string, userId: string, permission: string) => Promise<void>;
             };
+            /**
+             * Invites by e-mail or by link — for addresses that may not have an
+             * account yet; accepting creates it. Managing them needs the
+             * credential's `authyon:users:write` scope (listing, `authyon:tenants:read`).
+             */
+            invites: {
+                /** GET /env/tenants/{tenantId}/invites — every invite with its status, newest first. */
+                list: (tenantId: string) => Promise<TenantInvite[]>;
+                /**
+                 * POST /env/tenants/{tenantId}/invites — invite an address. Always
+                 * returns `acceptUrl`; with `sendEmail: false` Authyon does not mail
+                 * it and you deliver the link yourself. Valid 7 days, single use, and
+                 * not readable again later.
+                 */
+                create: (tenantId: string, input: TenantInviteInput) => Promise<TenantInviteIssued>;
+                /** POST .../invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+                resend: (tenantId: string, inviteId: string, input?: {
+                    sendEmail?: boolean;
+                }) => Promise<TenantInviteIssued>;
+                /** DELETE /env/tenants/{tenantId}/invites/{inviteId} — revoke a pending invite. */
+                revoke: (tenantId: string, inviteId: string) => Promise<void>;
+                /**
+                 * POST /auth/tenant-invites/preview — for a backend hosting the accept
+                 * page. Public: needs only `envKey`, the token is the credential.
+                 */
+                preview: (token: string) => Promise<TenantInvitePreview>;
+                /**
+                 * Joins the tenant; for an address with no account, also creates it
+                 * (password required) with the e-mail already confirmed. Does not
+                 * sign the user in.
+                 *
+                 * Without metadata: POST /auth/tenant-invites/accept — public, needs
+                 * only `envKey`. With `publicMetadata`/`privateMetadata`: POST
+                 * /env/tenant-invites/accept with the environment credential
+                 * (`authyon:users:write`), since only your backend may set them.
+                 */
+                accept: (input: AcceptTenantInviteInput) => Promise<TenantInviteAccepted>;
+            };
             roles: {
                 /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
                 list: (tenantId: string) => Promise<Role[]>;
@@ -819,32 +1009,44 @@ declare class AuthyonServerClient {
             /** GET /permissions/reserved — reserved permission names you can't redefine. */
             reserved: () => Promise<ReservedPermissions>;
         };
+        audit: {
+            /** GET /env/audit — paginated list of the environment's audit events. */
+            list: (params?: PaginationOptions) => Promise<Paged<AuditEvent>>;
+            /** GET /env/audit/login-activity — paginated login activity in the environment. */
+            loginActivity: (params?: PaginationOptions) => Promise<Paged<LoginActivity>>;
+        };
+    };
+    readonly security: {
+        otp: {
+            /**
+             * POST /env/users/{userId}/otp/verify — checks the user's authenticator
+             * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
+             * throwing. Each code is accepted once; 3 wrong codes in a row sign the
+             * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
+             * minutes (`rate_limited`). More than 50 wrong codes in 10 minutes from the
+             * same credential pause it (`credential_throttled`). Needs `authyon:otp:verify`.
+             */
+            check: (userId: string, code: string) => Promise<OtpCheckResult>;
+        };
         /**
-         * Transaction-bound step-up for financial operations. The environment
-         * credential needs the `authyon:financial:authorize` scope.
+         * The customer approves a payload with their authenticator code or
+         * passkey, once.
          *
-         * 1. `create()` the authorization for the transaction and the customer.
-         * 2. The customer approves it with their authenticator code or passkey
-         *    (`@authyon/auth` → `financialAuthorizations.confirm`).
-         * 3. `consume()` it with the same transaction right before executing it.
+         * 1. `create()` the approval with the payload and the customer.
+         * 2. The customer confirms it (`@authyon/auth` → `security.approvals.confirm`).
+         * 3. `consume()` it right before executing, and execute the returned payload.
          */
-        financialAuthorizations: {
-            /** POST /env/authorizations — registers a transaction awaiting the customer's approval. */
-            create: (input: CreateFinancialAuthorizationInput) => Promise<FinancialAuthorization>;
+        approvals: {
+            /** POST /env/authorizations — registers a payload awaiting the customer's approval. */
+            create: (input: CreateApprovalInput) => Promise<Approval>;
             /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
-            get: (id: string) => Promise<FinancialAuthorization>;
+            get: (id: string) => Promise<Approval>;
             /**
-             * POST /env/authorizations/{id}/consume — redeems an approved
-             * authorization exactly once. Resend the same transaction given to
-             * `create()`; any difference fails with `transaction_mismatch`.
+             * POST /env/authorizations/{id}/consume — redeems an approved approval
+             * exactly once and returns the approved payload. Pass `payload` to have
+             * the API check it matches (`payload_mismatch` otherwise).
              */
-            consume: (id: string, transaction: FinancialTransaction) => Promise<ConsumedFinancialAuthorization>;
-        };
-        audit: {
-            /** GET /env/audit — paginated list of the environment's audit events. */
-            list: (params?: PaginationOptions) => Promise<Paged<AuditEvent>>;
-            /** GET /env/audit/login-activity — paginated login activity in the environment. */
-            loginActivity: (params?: PaginationOptions) => Promise<Paged<LoginActivity>>;
+            consume: (id: string, payload?: ApprovalPayload) => Promise<ConsumedApproval>;
         };
     };
     readonly permissions: {
@@ -874,6 +1076,19 @@ declare class TenantScopedClient {
     private request;
     /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
     validate(context?: ClientRequestContext): Promise<TenantClientValidationResult>;
+    /** Invites to the token's tenant, by e-mail or by link. */
+    readonly invites: {
+        /** GET /tenant/invites — every invite with its status, newest first. */
+        list: () => Promise<TenantInvite[]>;
+        /** POST /tenant/invites — always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+        create: (input: TenantInviteInput) => Promise<TenantInviteIssued>;
+        /** POST /tenant/invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+        resend: (inviteId: string, input?: {
+            sendEmail?: boolean;
+        }) => Promise<TenantInviteIssued>;
+        /** DELETE /tenant/invites/{inviteId} — revoke a pending invite. */
+        revoke: (inviteId: string) => Promise<void>;
+    };
     readonly members: {
         /**
          * GET /tenant/members — members of the token's tenant.
@@ -921,4 +1136,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type TenantCredentialIssued as $, AuthyonServerClient as A, type HttpLogger as B, type ClientCredentials as C, type InviteTenantMemberInput as D, type EnvironmentUser as E, FetchHttpAdapter as F, JwksTokenVerifier as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type JwksTokenVerifierOptions as K, LoggingHttpAdapter as L, type LoginActivity as M, type Organization as N, type OpenIdConfiguration as O, type Paged as P, type PaginationOptions as Q, type Permission as R, type PermissionsByRole as S, type ReservedPermissions as T, type Role as U, type RoleGrant as V, type RoleInput as W, type RoleList as X, type RolePermissions as Y, type SafeJwtAlgorithm as Z, type TenantClientValidationResult as _, type HttpLoggerOptions as a, type TenantCredentialSummary as a0, type TenantMember as a1, type TenantMemberPage as a2, type TenantMembership as a3, TenantScopedClient as a4, type TokenResult as a5, TokenVerificationError as a6, type TokenVerificationErrorCode as a7, type UpdateOrganizationInput as a8, type User as a9, UserScopedClient as aa, type ValidateResult as ab, type VerifiedAccessToken as ac, createClient as ad, normalizeClientIp as ae, type AccessTokenSource as b, type AuditEvent as c, type AuthyonJwksDiscoveryOptions as d, type AuthyonJwtClaims as e, type AuthyonServerClientOptions as f, type ClientRequestContext as g, type ConfirmFinancialAuthorizationInput as h, type ConsumedFinancialAuthorization as i, type CreateCredentialInput as j, type CreateFinancialAuthorizationInput as k, type CreateOrganizationInput as l, type CreatePermissionInput as m, type CreateTenantCredentialInput as n, type CreateUserInput as o, type CredentialCreator as p, type CredentialDetail as q, type CredentialListOptions as r, type CredentialPermissionsInput as s, type FinancialAssurance as t, type FinancialAuthorization as u, type FinancialAuthorizationStatus as v, type FinancialTransaction as w, type FinancialWebAuthnOptions as x, type HttpAdapterRequest as y, type HttpLogEvent as z };
+export { type SafeJwtAlgorithm as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, JwksTokenVerifier as K, type JwksTokenVerifierOptions as L, LoggingHttpAdapter as M, type LoginActivity as N, type OpenIdConfiguration as O, type Organization as P, type OtpCheckResult as Q, type Paged as R, type PaginationOptions as S, type Permission as T, type PermissionsByRole as U, type ReservedPermissions as V, type Role as W, type RoleGrant as X, type RoleInput as Y, type RoleList as Z, type RolePermissions as _, type HttpLoggerOptions as a, type SecurityMethods as a0, type SubjectApprovals as a1, type SubjectSecurity as a2, type TenantClientValidationResult as a3, type TenantCredentialIssued as a4, type TenantCredentialSummary as a5, type TenantInvite as a6, type TenantInviteAccepted as a7, type TenantInviteInput as a8, type TenantInviteIssued as a9, type TenantInvitePreview as aa, type TenantInviteStatus as ab, type TenantMember as ac, type TenantMemberPage as ad, type TenantMembership as ae, TenantScopedClient as af, type TokenResult as ag, TokenVerificationError as ah, type TokenVerificationErrorCode as ai, type UpdateOrganizationInput as aj, type User as ak, UserScopedClient as al, type ValidateResult as am, type VerifiedAccessToken as an, createClient as ao, normalizeClientIp as ap, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };

package/dist/bff.cjs

@@ -56,10 +56,18 @@ var ErrorCodes = {
   InvalidSecondFactorCode: "invalid_code",
   VerificationAttemptsExhausted: "verification_attempts_exhausted",
   MethodNotEnrolled: "method_not_enrolled",
-  InvalidAuthorizationState: "invalid_authorization_state",
-  TransactionMismatch: "transaction_mismatch",
-  AuthorizationNotConsumable: "authorization_not_consumable",
-  IdempotencyConflict: "idempotency_conflict"
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
 var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
   "type",

package/dist/bff.d.cts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
 import 'jose';
 
 interface BffLoginInput {

package/dist/bff.d.ts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
 import 'jose';
 
 interface BffLoginInput {

package/dist/bff.js

@@ -3,7 +3,7 @@ import {
   DEFAULT_BASE_URL,
   JsonHttpClient,
   createSharedTransport
-} from "./chunk-TWUVXZOT.js";
+} from "./chunk-TDJNBD3Z.js";
 import "./chunk-77J4NURK.js";
 
 // src/bff/contracts.ts

package/dist/{chunk-TWUVXZOT.js → chunk-TDJNBD3Z.js}

@@ -15,10 +15,18 @@ var ErrorCodes = {
   InvalidSecondFactorCode: "invalid_code",
   VerificationAttemptsExhausted: "verification_attempts_exhausted",
   MethodNotEnrolled: "method_not_enrolled",
-  InvalidAuthorizationState: "invalid_authorization_state",
-  TransactionMismatch: "transaction_mismatch",
-  AuthorizationNotConsumable: "authorization_not_consumable",
-  IdempotencyConflict: "idempotency_conflict"
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
 var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
   "type",