@authyon/server 0.2.0-beta.15 → 0.2.0-beta.17

package/README.md

@@ -194,7 +194,8 @@ await authyon.validate(token, { clientIp: "203.0.113.10" });
 ## Segurança (`security.*`)
 
 OTP e aprovações ficam agrupados em `authyon.security`. Exige uma credencial de ambiente
-com o escopo `authyon:financial:authorize`. Guia completo:
+com o escopo `authyon:otp:verify` (para `security.otp`) e/ou `authyon:financial:authorize`
+(para `security.approvals`). Guia completo:
 [`docs/security-otp-approvals.md`](../../docs/security-otp-approvals.md).
 
 ```ts
@@ -373,12 +374,58 @@ await authyon.environment.tenants.members.remove(tenantId, userId);
 // Os métodos tenant(credentials).members.add/remove existentes continuam disponíveis.
 ```
 
-Configure `envKey` para `user()`. O convite de tenant associa um usuário já
+Configure `envKey` para `user()`. `members.invite` associa um usuário já
 cadastrado no ambiente pelo e-mail; não cria conta e não envia link por e-mail.
+Para isso, use os convites abaixo.
 A API exige associação/permissões do usuário chamador. No browser, os métodos
 existentes `@authyon/auth` → `organization.members.invite/remove` continuam
 atendendo esse fluxo. Nunca importe `@authyon/server` no browser.
 
+## Convites de tenant (e-mail ou link)
+
+Convide um e-mail que talvez ainda não tenha conta — aceitar cria a conta, já com o
+e-mail confirmado. A resposta sempre traz o `acceptUrl` completo; `sendEmail: false`
+só gera o link para você enviar pelo seu canal.
+
+```ts
+// Pelo ambiente (escopo authyon:users:write; listar exige authyon:tenants:read).
+const invite = await authyon.environment.tenants.invites.create(tenantId, {
+  email: "pessoa@example.com",
+  roles: ["reader"],
+  sendEmail: false, // padrão: true
+  // Opcional: para onde mandar a pessoa depois de aceitar. Precisa estar
+  // cadastrado (match exato) nos redirect URIs do ambiente.
+  redirectUri: "https://app.example.com/bem-vindo",
+});
+invite.acceptUrl; // só aparece aqui — a API guarda apenas o hash do token
+
+await authyon.environment.tenants.invites.list(tenantId);
+await authyon.environment.tenants.invites.resend(tenantId, invite.id, { sendEmail: true });
+await authyon.environment.tenants.invites.revoke(tenantId, invite.id);
+
+// Pela credencial do tenant, ou agindo como o usuário (permissão tenants:members:invite).
+await authyon.tenant(credentials).invites.create({ email: "pessoa@example.com" });
+await authyon.user(token).tenants.invites.create(tenantId, { email: "pessoa@example.com" });
+
+// Página de aceite no seu backend: públicas, usam só o envKey.
+const preview = await authyon.environment.tenants.invites.preview(token);
+const accepted = await authyon.environment.tenants.invites.accept({
+  token,
+  password: preview.accountExists ? undefined : password,
+  // Opcional. Com metadata, a chamada vai para /env/tenant-invites/accept usando
+  // clientId/clientSecret (escopo authyon:users:write) — só o backend pode definir.
+  publicMetadata: { plano: "pro" },
+  privateMetadata: { crmId: "42" },
+  // customFields: { ... } — obsoleto, prefira os metadata acima.
+});
+if (accepted.redirectUri) redirect(accepted.redirectUri); // o redirect fica por sua conta
+```
+
+O link vale 7 dias e uma única vez. `resend` gera um link novo e invalida o anterior.
+Por padrão o link aponta para a página do Authyon; configure a _URL do convite para
+tenant_ nas configurações do ambiente para usar a sua (ela recebe `token` e `env`).
+Aceitar não faz login.
+
 ## Compatibilidade e segurança do transporte
 
 As chamadas exigem os endpoints externos atuais da API e a migração

package/dist/{authorization-WlwcTBwG.d.ts → authorization-BvjIWPcU.d.ts}

@@ -1,4 +1,4 @@
-import { G as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.js';
+import { K as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authorization-B82XXf3B.d.cts → authorization-C0Mg5gUv.d.cts}

@@ -1,4 +1,4 @@
-import { G as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.cjs';
+import { K as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authyonServerClient-DQzhfaja.d.cts → authyonServerClient-1_1qNRDa.d.cts}

@@ -57,6 +57,82 @@ declare class LoggingHttpAdapter implements HttpAdapter {
     private log;
 }
 
+/**
+ * Security methods active on the user's account, as returned in the
+ * `security` field of `GET /auth/me` and `POST /auth/validate`.
+ */
+interface SecurityMethods {
+    /** A password is set (false for accounts created only through SSO or magic link). */
+    password: boolean;
+    /** Authenticator app (TOTP one-time codes). */
+    authenticator: boolean;
+    /** One-time codes sent by email. */
+    emailCode: boolean;
+    /** At least one passkey registered. */
+    passkey: boolean;
+    passkeyCount: number;
+    /** Unused recovery codes left. */
+    recoveryCodes: number;
+    /** SSO providers linked to the account, e.g. `["google", "github"]`. */
+    sso: string[];
+    /** Any second factor is active (authenticator, email code or passkey). */
+    twoFactor: boolean;
+}
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
+ */
+type ApprovalPayload = Record<string, unknown>;
+/** Evidence of how the customer proved their identity when approving. */
+interface ApprovalAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
+    id: string;
+    status: ApprovalStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Present once approved. */
+    assurance?: ApprovalAssurance | null;
+}
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
+    };
+};
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
+}
+
 interface PaginationOptions {
     skip?: number;
     take?: number;
@@ -120,6 +196,8 @@ interface User {
     /** Environment-level roles from the database-validated user profile. */
     roles?: string[];
     permissions?: string[];
+    /** Security methods active on the account (authenticator, email code, passkey, SSO…). */
+    security?: SecurityMethods;
 }
 interface RoleGrant {
     role: string;
@@ -251,8 +329,15 @@ interface UpdateOrganizationInput {
 }
 interface CreateUserInput {
     email: string;
-    username: string;
+    /**
+     * Same contract as `/auth/register`: optional only when the environment's
+     * username policy is `AutoFromEmail` (derived from the email). Collisions
+     * resolve by that policy.
+     */
+    username?: string;
     password: string;
+    firstName?: string;
+    lastName?: string;
     /** Values for custom user fields configured in the environment. */
     customFields?: Record<string, unknown>;
     emailConfirmed?: boolean;
@@ -429,6 +514,96 @@ interface TenantMember {
     lastLoginAt: string | null;
 }
 type TenantMemberPage = Paged<TenantMember>;
+/**
+ * Invite an address to a tenant. The address may not have an account in the
+ * environment yet — accepting creates it. `sendEmail` defaults to `true`;
+ * `false` only returns the link, for delivery through your own channel.
+ */
+interface TenantInviteInput {
+    email: string;
+    roles?: string[];
+    sendEmail?: boolean;
+    /**
+     * Where to send the invitee after they accept. Must be registered exactly in
+     * the environment's redirect URIs (the same list SSO and magic link use);
+     * otherwise the API rejects the invite. Comes back on `preview` and `accept`.
+     */
+    redirectUri?: string;
+}
+/** Returned when an invite is created or re-issued. `acceptUrl` is only ever
+ *  readable here — the API keeps a hash of the token, not the token. */
+interface TenantInviteIssued {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    acceptUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+type TenantInviteStatus = "pending" | "accepted" | "revoked" | "expired";
+interface TenantInvite {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    status: TenantInviteStatus;
+    createdAt: string;
+    expiresAt: string;
+    emailSentAt: string | null;
+    acceptedAt: string | null;
+    acceptedByUserId: string | null;
+    revokedAt: string | null;
+    invitedByUserId: string | null;
+    redirectUri: string | null;
+}
+/** What an accept page shows before the invitee commits. */
+interface TenantInvitePreview {
+    tenantId: string;
+    tenantName: string;
+    email: string;
+    roles: string[];
+    expiresAt: string;
+    /** True: accepting only needs the token. False: send a password (and a username when `usernameRequired`). */
+    accountExists: boolean;
+    usernameRequired: boolean;
+    /** Where the issuer asked to send the invitee after accepting, or `null`. */
+    redirectUri: string | null;
+}
+/**
+ * Redeem an invite. For an address that already has an account only `token`
+ * and the metadata are used; the rest is for creating the account.
+ */
+interface AcceptTenantInviteInput {
+    token: string;
+    username?: string;
+    password?: string;
+    firstName?: string;
+    lastName?: string;
+    /**
+     * @deprecated Use `publicMetadata` / `privateMetadata`. Still sent and
+     * validated against the environment's user field schema for now.
+     */
+    customFields?: Record<string, unknown>;
+    /**
+     * Replaces the user's public metadata (readable by the user). Requires the
+     * client credentials (`clientId`/`clientSecret`) with `authyon:users:write`:
+     * when this or `privateMetadata` is set, `accept` calls
+     * `POST /env/tenant-invites/accept` instead of the public route.
+     */
+    publicMetadata?: Record<string, unknown>;
+    /** Replaces the user's private metadata (server-only). Same requirement as `publicMetadata`. */
+    privateMetadata?: Record<string, unknown>;
+}
+interface TenantInviteAccepted {
+    tenantId: string;
+    tenantName: string;
+    userId: string;
+    accountCreated: boolean;
+    /** Where the issuer asked to send the invitee, or `null`. Redirecting is up to the accept page. */
+    redirectUri: string | null;
+}
 
 type QueryParams = object;
 
@@ -442,61 +617,6 @@ interface JsonRequestOptions {
 
 type ManagementRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
 
-/** Lifecycle of an approval. */
-type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
-/**
- * Free-form JSON object describing what the customer approves (up to 16 KiB).
- * The API stores it, shows it back to the customer and binds its canonical
- * hash (keys sorted) to the approval.
- */
-type ApprovalPayload = Record<string, unknown>;
-/** Evidence of how the customer proved their identity when approving. */
-interface ApprovalAssurance {
-    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
-    acr: string;
-    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
-    amr: string[];
-    /** When the second factor was verified (ISO 8601). */
-    authTime: string;
-}
-/** A request for the customer to approve something with a second factor. */
-interface Approval {
-    id: string;
-    status: ApprovalStatus;
-    subjectId: string;
-    tenantId?: string | null;
-    /** The payload given to `create()`, with keys in canonical order. */
-    payload: ApprovalPayload;
-    /** SHA-256 (hex) of the canonical payload. */
-    payloadHash: string;
-    createdAt: string;
-    expiresAt: string;
-    decidedAt?: string | null;
-    consumedAt?: string | null;
-    /** Present once approved. */
-    assurance?: ApprovalAssurance | null;
-}
-/** Second factor sent with `confirm()`. */
-type ConfirmApprovalInput = {
-    method: "authenticator";
-    /** Six-digit code from the customer's authenticator app. */
-    code: string;
-} | {
-    method: "webauthn";
-    /** Assertion for the options returned by `webauthnOptions()`. */
-    webAuthn: {
-        ceremonyToken: string;
-        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
-        assertionJson: string;
-    };
-};
-/** Passkey assertion options for approving one approval. */
-interface ApprovalWebAuthnOptions {
-    ceremonyToken: string;
-    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
-    optionsJson: string;
-}
-
 /** Customer-side operations on an approval (`/auth/authorizations`). */
 interface SubjectApprovals {
     /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
@@ -517,6 +637,11 @@ interface SubjectApprovals {
 }
 /** The `security` namespace an end-user client exposes. */
 interface SubjectSecurity {
+    /**
+     * GET /auth/me — which security methods the signed-in user has active
+     * (password, authenticator, email code, passkeys, recovery codes, SSO).
+     */
+    methods(): Promise<SecurityMethods>;
     /** Approve or reject what your backend asked the customer to confirm. */
     readonly approvals: SubjectApprovals;
 }
@@ -538,6 +663,20 @@ declare class UserScopedClient {
             invite: (tenantId: string, input: InviteTenantMemberInput) => Promise<TenantMember>;
             remove: (tenantId: string, userId: string) => Promise<void>;
         };
+        /**
+         * Invites by e-mail or by link, acting as the user. Requires the
+         * `tenants:members:invite` permission on the tenant.
+         */
+        invites: {
+            list: (tenantId: string) => Promise<TenantInvite[]>;
+            /** Always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+            create: (tenantId: string, input: TenantInviteInput) => Promise<TenantInviteIssued>;
+            /** New link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+            resend: (tenantId: string, inviteId: string, input?: {
+                sendEmail?: boolean;
+            }) => Promise<TenantInviteIssued>;
+            revoke: (tenantId: string, inviteId: string) => Promise<void>;
+        };
     };
 }
 
@@ -797,6 +936,44 @@ declare class AuthyonServerClient {
                 /** DELETE .../members/{userId}/permissions/{permission} — revoke a permission from a tenant member. */
                 revokePermission: (tenantId: string, userId: string, permission: string) => Promise<void>;
             };
+            /**
+             * Invites by e-mail or by link — for addresses that may not have an
+             * account yet; accepting creates it. Managing them needs the
+             * credential's `authyon:users:write` scope (listing, `authyon:tenants:read`).
+             */
+            invites: {
+                /** GET /env/tenants/{tenantId}/invites — every invite with its status, newest first. */
+                list: (tenantId: string) => Promise<TenantInvite[]>;
+                /**
+                 * POST /env/tenants/{tenantId}/invites — invite an address. Always
+                 * returns `acceptUrl`; with `sendEmail: false` Authyon does not mail
+                 * it and you deliver the link yourself. Valid 7 days, single use, and
+                 * not readable again later.
+                 */
+                create: (tenantId: string, input: TenantInviteInput) => Promise<TenantInviteIssued>;
+                /** POST .../invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+                resend: (tenantId: string, inviteId: string, input?: {
+                    sendEmail?: boolean;
+                }) => Promise<TenantInviteIssued>;
+                /** DELETE /env/tenants/{tenantId}/invites/{inviteId} — revoke a pending invite. */
+                revoke: (tenantId: string, inviteId: string) => Promise<void>;
+                /**
+                 * POST /auth/tenant-invites/preview — for a backend hosting the accept
+                 * page. Public: needs only `envKey`, the token is the credential.
+                 */
+                preview: (token: string) => Promise<TenantInvitePreview>;
+                /**
+                 * Joins the tenant; for an address with no account, also creates it
+                 * (password required) with the e-mail already confirmed. Does not
+                 * sign the user in.
+                 *
+                 * Without metadata: POST /auth/tenant-invites/accept — public, needs
+                 * only `envKey`. With `publicMetadata`/`privateMetadata`: POST
+                 * /env/tenant-invites/accept with the environment credential
+                 * (`authyon:users:write`), since only your backend may set them.
+                 */
+                accept: (input: AcceptTenantInviteInput) => Promise<TenantInviteAccepted>;
+            };
             roles: {
                 /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
                 list: (tenantId: string) => Promise<Role[]>;
@@ -846,7 +1023,8 @@ declare class AuthyonServerClient {
              * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
              * throwing. Each code is accepted once; 3 wrong codes in a row sign the
              * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
-             * minutes (`rate_limited`).
+             * minutes (`rate_limited`). More than 50 wrong codes in 10 minutes from the
+             * same credential pause it (`credential_throttled`). Needs `authyon:otp:verify`.
              */
             check: (userId: string, code: string) => Promise<OtpCheckResult>;
         };
@@ -898,6 +1076,19 @@ declare class TenantScopedClient {
     private request;
     /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
     validate(context?: ClientRequestContext): Promise<TenantClientValidationResult>;
+    /** Invites to the token's tenant, by e-mail or by link. */
+    readonly invites: {
+        /** GET /tenant/invites — every invite with its status, newest first. */
+        list: () => Promise<TenantInvite[]>;
+        /** POST /tenant/invites — always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+        create: (input: TenantInviteInput) => Promise<TenantInviteIssued>;
+        /** POST /tenant/invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+        resend: (inviteId: string, input?: {
+            sendEmail?: boolean;
+        }) => Promise<TenantInviteIssued>;
+        /** DELETE /tenant/invites/{inviteId} — revoke a pending invite. */
+        revoke: (inviteId: string) => Promise<void>;
+    };
     readonly members: {
         /**
          * GET /tenant/members — members of the token's tenant.
@@ -945,4 +1136,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type SubjectApprovals as $, AuthyonServerClient as A, type HttpLogger as B, type ClientCredentials as C, type InviteTenantMemberInput as D, type EnvironmentUser as E, FetchHttpAdapter as F, JwksTokenVerifier as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type JwksTokenVerifierOptions as K, LoggingHttpAdapter as L, type LoginActivity as M, type Organization as N, type OpenIdConfiguration as O, type OtpCheckResult as P, type Paged as Q, type PaginationOptions as R, type Permission as S, type PermissionsByRole as T, type ReservedPermissions as U, type Role as V, type RoleGrant as W, type RoleInput as X, type RoleList as Y, type RolePermissions as Z, type SafeJwtAlgorithm as _, type HttpLoggerOptions as a, type SubjectSecurity as a0, type TenantClientValidationResult as a1, type TenantCredentialIssued as a2, type TenantCredentialSummary as a3, type TenantMember as a4, type TenantMemberPage as a5, type TenantMembership as a6, TenantScopedClient as a7, type TokenResult as a8, TokenVerificationError as a9, type TokenVerificationErrorCode as aa, type UpdateOrganizationInput as ab, type User as ac, UserScopedClient as ad, type ValidateResult as ae, type VerifiedAccessToken as af, createClient as ag, normalizeClientIp as ah, type AccessTokenSource as b, type Approval as c, type ApprovalAssurance as d, type ApprovalPayload as e, type ApprovalStatus as f, type ApprovalWebAuthnOptions as g, type AuditEvent as h, type AuthyonJwksDiscoveryOptions as i, type AuthyonJwtClaims as j, type AuthyonServerClientOptions as k, type ClientRequestContext as l, type ConfirmApprovalInput as m, type ConsumedApproval as n, type CreateApprovalInput as o, type CreateCredentialInput as p, type CreateOrganizationInput as q, type CreatePermissionInput as r, type CreateTenantCredentialInput as s, type CreateUserInput as t, type CredentialCreator as u, type CredentialDetail as v, type CredentialListOptions as w, type CredentialPermissionsInput as x, type HttpAdapterRequest as y, type HttpLogEvent as z };
+export { type SafeJwtAlgorithm as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, JwksTokenVerifier as K, type JwksTokenVerifierOptions as L, LoggingHttpAdapter as M, type LoginActivity as N, type OpenIdConfiguration as O, type Organization as P, type OtpCheckResult as Q, type Paged as R, type PaginationOptions as S, type Permission as T, type PermissionsByRole as U, type ReservedPermissions as V, type Role as W, type RoleGrant as X, type RoleInput as Y, type RoleList as Z, type RolePermissions as _, type HttpLoggerOptions as a, type SecurityMethods as a0, type SubjectApprovals as a1, type SubjectSecurity as a2, type TenantClientValidationResult as a3, type TenantCredentialIssued as a4, type TenantCredentialSummary as a5, type TenantInvite as a6, type TenantInviteAccepted as a7, type TenantInviteInput as a8, type TenantInviteIssued as a9, type TenantInvitePreview as aa, type TenantInviteStatus as ab, type TenantMember as ac, type TenantMemberPage as ad, type TenantMembership as ae, TenantScopedClient as af, type TokenResult as ag, TokenVerificationError as ah, type TokenVerificationErrorCode as ai, type UpdateOrganizationInput as aj, type User as ak, UserScopedClient as al, type ValidateResult as am, type VerifiedAccessToken as an, createClient as ao, normalizeClientIp as ap, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };