@authyon/server 0.2.0-beta.14 → 0.2.0-beta.16

package/dist/index.cjs

@@ -168,29 +168,34 @@ async function allCredentials(request, path2) {
   throw new Error("Authyon: use listPage for more than 1000 credential pages.");
 }
 
-// ../../internal/core/financial/subjectFinancialAuthorizations.ts
+// ../../internal/core/security/approvals.ts
 function path(id, suffix = "") {
   if (typeof id !== "string" || !id.trim())
-    throw new TypeError("Authyon: a financial authorization id is required.");
+    throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
-function subjectFinancialAuthorizations(request) {
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
+function subjectSecurity(request) {
   return {
-    /** GET /auth/authorizations/{id} — the pending transaction, to show before asking for the code. */
-    get: (id) => request(path(id)),
-    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving this authorization. */
-    webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
-    /**
-     * POST /auth/authorizations/{id}/confirm — approves the transaction.
-     *
-     * Pass the authenticator code or passkey assertion to verify the second
-     * factor inline (recommended). Without `input`, the session itself must
-     * have used a passkey or authenticator code within the last 5 minutes,
-     * otherwise the API answers `step_up_required`.
-     */
-    confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
-    /** POST /auth/authorizations/{id}/reject — the customer declines the transaction. */
-    reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
   };
 }
 
@@ -222,10 +227,35 @@ var UserScopedClient = class {
         remove: (tenantId, userId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
           method: "DELETE"
         })
+      },
+      /**
+       * Invites by e-mail or by link, acting as the user. Requires the
+       * `tenants:members:invite` permission on the tenant.
+       */
+      invites: {
+        list: (tenantId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`),
+        /** Always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+        create: (tenantId, input) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`, {
+          method: "POST",
+          body: {
+            email: input.email,
+            roles: input.roles,
+            sendEmail: input.sendEmail ?? true,
+            redirectUri: input.redirectUri
+          }
+        }),
+        /** New link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+        resend: (tenantId, inviteId, input = {}) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}/resend`, {
+          method: "POST",
+          body: { sendEmail: input.sendEmail ?? true }
+        }),
+        revoke: (tenantId, inviteId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}`, {
+          method: "DELETE"
+        })
       }
     };
     __privateSet(this, _request, scopedRequest(request, token));
-    this.financialAuthorizations = subjectFinancialAuthorizations(__privateGet(this, _request));
+    this.security = subjectSecurity(__privateGet(this, _request));
   }
 };
 _request = new WeakMap();
@@ -280,10 +310,18 @@ var ErrorCodes = {
   InvalidSecondFactorCode: "invalid_code",
   VerificationAttemptsExhausted: "verification_attempts_exhausted",
   MethodNotEnrolled: "method_not_enrolled",
-  InvalidAuthorizationState: "invalid_authorization_state",
-  TransactionMismatch: "transaction_mismatch",
-  AuthorizationNotConsumable: "authorization_not_consumable",
-  IdempotencyConflict: "idempotency_conflict"
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
 var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
   "type",
@@ -1008,6 +1046,61 @@ var AuthyonServerClient = class {
             { method: "DELETE", envBearer: true }
           )
         },
+        /**
+         * Invites by e-mail or by link — for addresses that may not have an
+         * account yet; accepting creates it. Managing them needs the
+         * credential's `authyon:users:write` scope (listing, `authyon:tenants:read`).
+         */
+        invites: {
+          /** GET /env/tenants/{tenantId}/invites — every invite with its status, newest first. */
+          list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, { envBearer: true }),
+          /**
+           * POST /env/tenants/{tenantId}/invites — invite an address. Always
+           * returns `acceptUrl`; with `sendEmail: false` Authyon does not mail
+           * it and you deliver the link yourself. Valid 7 days, single use, and
+           * not readable again later.
+           */
+          create: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, {
+            method: "POST",
+            envBearer: true,
+            body: {
+              email: input.email,
+              roles: input.roles,
+              sendEmail: input.sendEmail ?? true,
+              redirectUri: input.redirectUri
+            }
+          }),
+          /** POST .../invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+          resend: (tenantId, inviteId, input = {}) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+            { method: "POST", envBearer: true, body: { sendEmail: input.sendEmail ?? true } }
+          ),
+          /** DELETE /env/tenants/{tenantId}/invites/{inviteId} — revoke a pending invite. */
+          revoke: (tenantId, inviteId) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}`,
+            { method: "DELETE", envBearer: true }
+          ),
+          /**
+           * POST /auth/tenant-invites/preview — for a backend hosting the accept
+           * page. Public: needs only `envKey`, the token is the credential.
+           */
+          preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+          /**
+           * Joins the tenant; for an address with no account, also creates it
+           * (password required) with the e-mail already confirmed. Does not
+           * sign the user in.
+           *
+           * Without metadata: POST /auth/tenant-invites/accept — public, needs
+           * only `envKey`. With `publicMetadata`/`privateMetadata`: POST
+           * /env/tenant-invites/accept with the environment credential
+           * (`authyon:users:write`), since only your backend may set them.
+           */
+          accept: (input) => input.publicMetadata !== void 0 || input.privateMetadata !== void 0 ? this.request("/env/tenant-invites/accept", {
+            method: "POST",
+            envBearer: true,
+            body: input
+          }) : this.request("/auth/tenant-invites/accept", { method: "POST", body: input })
+        },
         roles: {
           /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
           list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/roles`, { envBearer: true }),
@@ -1070,46 +1163,65 @@ var AuthyonServerClient = class {
         /** GET /permissions/reserved — reserved permission names you can't redefine. */
         reserved: () => this.request("/permissions/reserved", { envBearer: true })
       },
+      audit: {
+        /** GET /env/audit — paginated list of the environment's audit events. */
+        list: (params = {}) => this.request("/env/audit", { envBearer: true, query: params }),
+        /** GET /env/audit/login-activity — paginated login activity in the environment. */
+        loginActivity: (params = {}) => this.request("/env/audit/login-activity", { envBearer: true, query: params })
+      }
+    };
+    // ── Security: one-time codes and approvals ───────────────────────────────
+    //
+    // Everything here runs with the environment credential: `otp` needs the
+    // `authyon:otp:verify` scope, `approvals` needs `authyon:financial:authorize`.
+    // Keep those credentials on the server.
+    this.security = {
+      otp: {
+        /**
+         * POST /env/users/{userId}/otp/verify — checks the user's authenticator
+         * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
+         * throwing. Each code is accepted once; 3 wrong codes in a row sign the
+         * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
+         * minutes (`rate_limited`). More than 50 wrong codes in 10 minutes from the
+         * same credential pause it (`credential_throttled`). Needs `authyon:otp:verify`.
+         */
+        check: (userId, code) => this.request(`/env/users/${segment(userId)}/otp/verify`, {
+          method: "POST",
+          envBearer: true,
+          body: { code }
+        })
+      },
       /**
-       * Transaction-bound step-up for financial operations. The environment
-       * credential needs the `authyon:financial:authorize` scope.
+       * The customer approves a payload with their authenticator code or
+       * passkey, once.
        *
-       * 1. `create()` the authorization for the transaction and the customer.
-       * 2. The customer approves it with their authenticator code or passkey
-       *    (`@authyon/auth` → `financialAuthorizations.confirm`).
-       * 3. `consume()` it with the same transaction right before executing it.
+       * 1. `create()` the approval with the payload and the customer.
+       * 2. The customer confirms it (`@authyon/auth` → `security.approvals.confirm`).
+       * 3. `consume()` it right before executing, and execute the returned payload.
        */
-      financialAuthorizations: {
-        /** POST /env/authorizations — registers a transaction awaiting the customer's approval. */
+      approvals: {
+        /** POST /env/authorizations — registers a payload awaiting the customer's approval. */
         create: (input) => {
           const { idempotencyKey, ...body } = input;
-          if (typeof idempotencyKey !== "string" || !idempotencyKey.trim())
-            throw new TypeError("Authyon: `idempotencyKey` is required.");
           return this.request("/env/authorizations", {
             method: "POST",
             envBearer: true,
-            headers: { "Idempotency-Key": idempotencyKey },
+            headers: idempotencyKey ? { "Idempotency-Key": idempotencyKey } : void 0,
             body
           });
         },
         /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
         get: (id) => this.request(`/env/authorizations/${segment(id)}`, { envBearer: true }),
         /**
-         * POST /env/authorizations/{id}/consume — redeems an approved
-         * authorization exactly once. Resend the same transaction given to
-         * `create()`; any difference fails with `transaction_mismatch`.
+         * POST /env/authorizations/{id}/consume — redeems an approved approval
+         * exactly once and returns the approved payload. Pass `payload` to have
+         * the API check it matches (`payload_mismatch` otherwise).
          */
-        consume: (id, transaction) => this.request(`/env/authorizations/${segment(id)}/consume`, {
+        consume: (id, payload) => this.request(`/env/authorizations/${segment(id)}/consume`, {
           method: "POST",
           envBearer: true,
-          body: transaction
+          body: payload === void 0 ? void 0 : { payload }
         })
-      },
-      audit: {
-        /** GET /env/audit — paginated list of the environment's audit events. */
-        list: (params = {}) => this.request("/env/audit", { envBearer: true, query: params }),
-        /** GET /env/audit/login-activity — paginated login activity in the environment. */
-        loginActivity: (params = {}) => this.request("/env/audit/login-activity", { envBearer: true, query: params })
       }
     };
     // ── Generic permission grants ─────────────────────────────────────────────
@@ -1235,6 +1347,28 @@ var AuthyonServerClient = class {
 _clientSecret = new WeakMap();
 var TenantScopedClient = class {
   constructor(server, credentials) {
+    /** Invites to the token's tenant, by e-mail or by link. */
+    this.invites = {
+      /** GET /tenant/invites — every invite with its status, newest first. */
+      list: () => this.request("/tenant/invites"),
+      /** POST /tenant/invites — always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+      create: (input) => this.request("/tenant/invites", {
+        method: "POST",
+        body: {
+          email: input.email,
+          roles: input.roles,
+          sendEmail: input.sendEmail ?? true,
+          redirectUri: input.redirectUri
+        }
+      }),
+      /** POST /tenant/invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+      resend: (inviteId, input = {}) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}/resend`, {
+        method: "POST",
+        body: { sendEmail: input.sendEmail ?? true }
+      }),
+      /** DELETE /tenant/invites/{inviteId} — revoke a pending invite. */
+      revoke: (inviteId) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}`, { method: "DELETE" })
+    };
     this.members = {
       /**
        * GET /tenant/members — members of the token's tenant.

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.cjs';
-export { b as AccessTokenSource, c as AuditEvent, d as AuthyonJwksDiscoveryOptions, e as AuthyonJwtClaims, f as AuthyonServerClientOptions, C as ClientCredentials, g as ClientRequestContext, h as ConfirmFinancialAuthorizationInput, i as ConsumedFinancialAuthorization, j as CreateCredentialInput, k as CreateFinancialAuthorizationInput, l as CreateOrganizationInput, m as CreatePermissionInput, n as CreateTenantCredentialInput, o as CreateUserInput, p as CredentialCreator, q as CredentialDetail, r as CredentialListOptions, s as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, t as FinancialAssurance, u as FinancialAuthorization, v as FinancialAuthorizationStatus, w as FinancialTransaction, x as FinancialWebAuthnOptions, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteTenantMemberInput, J as JsonWebKeySet, G as JwksTokenVerifier, K as JwksTokenVerifierOptions, L as LoggingHttpAdapter, M as LoginActivity, O as OpenIdConfiguration, N as Organization, P as Paged, Q as PaginationOptions, R as Permission, S as PermissionsByRole, T as ReservedPermissions, U as Role, V as RoleGrant, W as RoleInput, X as RoleList, Y as RolePermissions, Z as SafeJwtAlgorithm, _ as TenantClientValidationResult, $ as TenantCredentialIssued, a0 as TenantCredentialSummary, a1 as TenantMember, a2 as TenantMemberPage, a3 as TenantMembership, a4 as TenantScopedClient, a5 as TokenResult, a6 as TokenVerificationError, a7 as TokenVerificationErrorCode, a8 as UpdateOrganizationInput, a9 as User, aa as UserScopedClient, ab as ValidateResult, ac as VerifiedAccessToken, ad as createClient, ae as normalizeClientIp } from './authyonServerClient-DmNnjw4z.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-B7ynKAud.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as JsonWebKeySet, K as JwksTokenVerifier, L as JwksTokenVerifierOptions, M as LoggingHttpAdapter, N as LoginActivity, O as OpenIdConfiguration, P as Organization, Q as OtpCheckResult, R as Paged, S as PaginationOptions, T as Permission, U as PermissionsByRole, V as ReservedPermissions, W as Role, X as RoleGrant, Y as RoleInput, Z as RoleList, _ as RolePermissions, $ as SafeJwtAlgorithm, a0 as SecurityMethods, a1 as SubjectApprovals, a2 as SubjectSecurity, a3 as TenantClientValidationResult, a4 as TenantCredentialIssued, a5 as TenantCredentialSummary, a6 as TenantInvite, a7 as TenantInviteAccepted, a8 as TenantInviteInput, a9 as TenantInviteIssued, aa as TenantInvitePreview, ab as TenantInviteStatus, ac as TenantMember, ad as TenantMemberPage, ae as TenantMembership, af as TenantScopedClient, ag as TokenResult, ah as TokenVerificationError, ai as TokenVerificationErrorCode, aj as UpdateOrganizationInput, ak as User, al as UserScopedClient, am as ValidateResult, an as VerifiedAccessToken, ao as createClient, ap as normalizeClientIp } from './authyonServerClient-1_1qNRDa.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-C0Mg5gUv.cjs';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -19,10 +19,18 @@ declare const ErrorCodes: {
     readonly InvalidSecondFactorCode: "invalid_code";
     readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
     readonly MethodNotEnrolled: "method_not_enrolled";
-    readonly InvalidAuthorizationState: "invalid_authorization_state";
-    readonly TransactionMismatch: "transaction_mismatch";
-    readonly AuthorizationNotConsumable: "authorization_not_consumable";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
     readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly CredentialThrottled: "credential_throttled";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DmNnjw4z.js';
-export { b as AccessTokenSource, c as AuditEvent, d as AuthyonJwksDiscoveryOptions, e as AuthyonJwtClaims, f as AuthyonServerClientOptions, C as ClientCredentials, g as ClientRequestContext, h as ConfirmFinancialAuthorizationInput, i as ConsumedFinancialAuthorization, j as CreateCredentialInput, k as CreateFinancialAuthorizationInput, l as CreateOrganizationInput, m as CreatePermissionInput, n as CreateTenantCredentialInput, o as CreateUserInput, p as CredentialCreator, q as CredentialDetail, r as CredentialListOptions, s as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, t as FinancialAssurance, u as FinancialAuthorization, v as FinancialAuthorizationStatus, w as FinancialTransaction, x as FinancialWebAuthnOptions, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteTenantMemberInput, J as JsonWebKeySet, G as JwksTokenVerifier, K as JwksTokenVerifierOptions, L as LoggingHttpAdapter, M as LoginActivity, O as OpenIdConfiguration, N as Organization, P as Paged, Q as PaginationOptions, R as Permission, S as PermissionsByRole, T as ReservedPermissions, U as Role, V as RoleGrant, W as RoleInput, X as RoleList, Y as RolePermissions, Z as SafeJwtAlgorithm, _ as TenantClientValidationResult, $ as TenantCredentialIssued, a0 as TenantCredentialSummary, a1 as TenantMember, a2 as TenantMemberPage, a3 as TenantMembership, a4 as TenantScopedClient, a5 as TokenResult, a6 as TokenVerificationError, a7 as TokenVerificationErrorCode, a8 as UpdateOrganizationInput, a9 as User, aa as UserScopedClient, ab as ValidateResult, ac as VerifiedAccessToken, ad as createClient, ae as normalizeClientIp } from './authyonServerClient-DmNnjw4z.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-BF015NDJ.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as JsonWebKeySet, K as JwksTokenVerifier, L as JwksTokenVerifierOptions, M as LoggingHttpAdapter, N as LoginActivity, O as OpenIdConfiguration, P as Organization, Q as OtpCheckResult, R as Paged, S as PaginationOptions, T as Permission, U as PermissionsByRole, V as ReservedPermissions, W as Role, X as RoleGrant, Y as RoleInput, Z as RoleList, _ as RolePermissions, $ as SafeJwtAlgorithm, a0 as SecurityMethods, a1 as SubjectApprovals, a2 as SubjectSecurity, a3 as TenantClientValidationResult, a4 as TenantCredentialIssued, a5 as TenantCredentialSummary, a6 as TenantInvite, a7 as TenantInviteAccepted, a8 as TenantInviteInput, a9 as TenantInviteIssued, aa as TenantInvitePreview, ab as TenantInviteStatus, ac as TenantMember, ad as TenantMemberPage, ae as TenantMembership, af as TenantScopedClient, ag as TokenResult, ah as TokenVerificationError, ai as TokenVerificationErrorCode, aj as UpdateOrganizationInput, ak as User, al as UserScopedClient, am as ValidateResult, an as VerifiedAccessToken, ao as createClient, ap as normalizeClientIp } from './authyonServerClient-1_1qNRDa.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-BvjIWPcU.js';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -19,10 +19,18 @@ declare const ErrorCodes: {
     readonly InvalidSecondFactorCode: "invalid_code";
     readonly VerificationAttemptsExhausted: "verification_attempts_exhausted";
     readonly MethodNotEnrolled: "method_not_enrolled";
-    readonly InvalidAuthorizationState: "invalid_authorization_state";
-    readonly TransactionMismatch: "transaction_mismatch";
-    readonly AuthorizationNotConsumable: "authorization_not_consumable";
+    readonly InvalidApprovalState: "invalid_authorization_state";
+    readonly PayloadMismatch: "payload_mismatch";
+    readonly ApprovalNotConsumable: "authorization_not_consumable";
     readonly IdempotencyConflict: "idempotency_conflict";
+    readonly UserDisabled: "user_disabled";
+    readonly UserNotFound: "user_not_found";
+    readonly TemporarilyUnavailable: "temporarily_unavailable";
+    readonly InsufficientScope: "insufficient_scope";
+    readonly CredentialThrottled: "credential_throttled";
+    readonly ApprovalNotFound: "authorization_not_found";
+    readonly SessionRevoked: "session_revoked";
+    readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";
 };
 type KnownErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
 type AuthyonErrorCategory = "network" | "timeout" | "authentication" | "authorization" | "validation" | "not_found" | "conflict" | "rate_limit" | "server" | "unknown";