@authyon/server 0.2.0-beta.15 → 0.2.0-beta.17

package/dist/index.cjs

@@ -174,8 +174,22 @@ function path(id, suffix = "") {
     throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
 function subjectSecurity(request) {
   return {
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
     approvals: {
       get: (id) => request(path(id)),
       webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
@@ -213,6 +227,31 @@ var UserScopedClient = class {
         remove: (tenantId, userId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
           method: "DELETE"
         })
+      },
+      /**
+       * Invites by e-mail or by link, acting as the user. Requires the
+       * `tenants:members:invite` permission on the tenant.
+       */
+      invites: {
+        list: (tenantId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`),
+        /** Always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+        create: (tenantId, input) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`, {
+          method: "POST",
+          body: {
+            email: input.email,
+            roles: input.roles,
+            sendEmail: input.sendEmail ?? true,
+            redirectUri: input.redirectUri
+          }
+        }),
+        /** New link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+        resend: (tenantId, inviteId, input = {}) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}/resend`, {
+          method: "POST",
+          body: { sendEmail: input.sendEmail ?? true }
+        }),
+        revoke: (tenantId, inviteId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}`, {
+          method: "DELETE"
+        })
       }
     };
     __privateSet(this, _request, scopedRequest(request, token));
@@ -279,6 +318,7 @@ var ErrorCodes = {
   UserNotFound: "user_not_found",
   TemporarilyUnavailable: "temporarily_unavailable",
   InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
   ApprovalNotFound: "authorization_not_found",
   SessionRevoked: "session_revoked",
   TwoFactorTooManyFailures: "user.2fa.too_many_failures"
@@ -1006,6 +1046,61 @@ var AuthyonServerClient = class {
             { method: "DELETE", envBearer: true }
           )
         },
+        /**
+         * Invites by e-mail or by link — for addresses that may not have an
+         * account yet; accepting creates it. Managing them needs the
+         * credential's `authyon:users:write` scope (listing, `authyon:tenants:read`).
+         */
+        invites: {
+          /** GET /env/tenants/{tenantId}/invites — every invite with its status, newest first. */
+          list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, { envBearer: true }),
+          /**
+           * POST /env/tenants/{tenantId}/invites — invite an address. Always
+           * returns `acceptUrl`; with `sendEmail: false` Authyon does not mail
+           * it and you deliver the link yourself. Valid 7 days, single use, and
+           * not readable again later.
+           */
+          create: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, {
+            method: "POST",
+            envBearer: true,
+            body: {
+              email: input.email,
+              roles: input.roles,
+              sendEmail: input.sendEmail ?? true,
+              redirectUri: input.redirectUri
+            }
+          }),
+          /** POST .../invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+          resend: (tenantId, inviteId, input = {}) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+            { method: "POST", envBearer: true, body: { sendEmail: input.sendEmail ?? true } }
+          ),
+          /** DELETE /env/tenants/{tenantId}/invites/{inviteId} — revoke a pending invite. */
+          revoke: (tenantId, inviteId) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}`,
+            { method: "DELETE", envBearer: true }
+          ),
+          /**
+           * POST /auth/tenant-invites/preview — for a backend hosting the accept
+           * page. Public: needs only `envKey`, the token is the credential.
+           */
+          preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+          /**
+           * Joins the tenant; for an address with no account, also creates it
+           * (password required) with the e-mail already confirmed. Does not
+           * sign the user in.
+           *
+           * Without metadata: POST /auth/tenant-invites/accept — public, needs
+           * only `envKey`. With `publicMetadata`/`privateMetadata`: POST
+           * /env/tenant-invites/accept with the environment credential
+           * (`authyon:users:write`), since only your backend may set them.
+           */
+          accept: (input) => input.publicMetadata !== void 0 || input.privateMetadata !== void 0 ? this.request("/env/tenant-invites/accept", {
+            method: "POST",
+            envBearer: true,
+            body: input
+          }) : this.request("/auth/tenant-invites/accept", { method: "POST", body: input })
+        },
         roles: {
           /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
           list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/roles`, { envBearer: true }),
@@ -1077,8 +1172,9 @@ var AuthyonServerClient = class {
     };
     // ── Security: one-time codes and approvals ───────────────────────────────
     //
-    // Everything here runs with the environment credential, which needs the
-    // `authyon:financial:authorize` scope. Keep that credential on the server.
+    // Everything here runs with the environment credential: `otp` needs the
+    // `authyon:otp:verify` scope, `approvals` needs `authyon:financial:authorize`.
+    // Keep those credentials on the server.
     this.security = {
       otp: {
         /**
@@ -1086,7 +1182,8 @@ var AuthyonServerClient = class {
          * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
          * throwing. Each code is accepted once; 3 wrong codes in a row sign the
          * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
-         * minutes (`rate_limited`).
+         * minutes (`rate_limited`). More than 50 wrong codes in 10 minutes from the
+         * same credential pause it (`credential_throttled`). Needs `authyon:otp:verify`.
          */
         check: (userId, code) => this.request(`/env/users/${segment(userId)}/otp/verify`, {
           method: "POST",
@@ -1250,6 +1347,28 @@ var AuthyonServerClient = class {
 _clientSecret = new WeakMap();
 var TenantScopedClient = class {
   constructor(server, credentials) {
+    /** Invites to the token's tenant, by e-mail or by link. */
+    this.invites = {
+      /** GET /tenant/invites — every invite with its status, newest first. */
+      list: () => this.request("/tenant/invites"),
+      /** POST /tenant/invites — always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+      create: (input) => this.request("/tenant/invites", {
+        method: "POST",
+        body: {
+          email: input.email,
+          roles: input.roles,
+          sendEmail: input.sendEmail ?? true,
+          redirectUri: input.redirectUri
+        }
+      }),
+      /** POST /tenant/invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+      resend: (inviteId, input = {}) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}/resend`, {
+        method: "POST",
+        body: { sendEmail: input.sendEmail ?? true }
+      }),
+      /** DELETE /tenant/invites/{inviteId} — revoke a pending invite. */
+      revoke: (inviteId) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}`, { method: "DELETE" })
+    };
     this.members = {
       /**
        * GET /tenant/members — members of the token's tenant.

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.cjs';
-export { b as AccessTokenSource, c as Approval, d as ApprovalAssurance, e as ApprovalPayload, f as ApprovalStatus, g as ApprovalWebAuthnOptions, h as AuditEvent, i as AuthyonJwksDiscoveryOptions, j as AuthyonJwtClaims, k as AuthyonServerClientOptions, C as ClientCredentials, l as ClientRequestContext, m as ConfirmApprovalInput, n as ConsumedApproval, o as CreateApprovalInput, p as CreateCredentialInput, q as CreateOrganizationInput, r as CreatePermissionInput, s as CreateTenantCredentialInput, t as CreateUserInput, u as CredentialCreator, v as CredentialDetail, w as CredentialListOptions, x as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteTenantMemberInput, J as JsonWebKeySet, G as JwksTokenVerifier, K as JwksTokenVerifierOptions, L as LoggingHttpAdapter, M as LoginActivity, O as OpenIdConfiguration, N as Organization, P as OtpCheckResult, Q as Paged, R as PaginationOptions, S as Permission, T as PermissionsByRole, U as ReservedPermissions, V as Role, W as RoleGrant, X as RoleInput, Y as RoleList, Z as RolePermissions, _ as SafeJwtAlgorithm, $ as SubjectApprovals, a0 as SubjectSecurity, a1 as TenantClientValidationResult, a2 as TenantCredentialIssued, a3 as TenantCredentialSummary, a4 as TenantMember, a5 as TenantMemberPage, a6 as TenantMembership, a7 as TenantScopedClient, a8 as TokenResult, a9 as TokenVerificationError, aa as TokenVerificationErrorCode, ab as UpdateOrganizationInput, ac as User, ad as UserScopedClient, ae as ValidateResult, af as VerifiedAccessToken, ag as createClient, ah as normalizeClientIp } from './authyonServerClient-DQzhfaja.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-B82XXf3B.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as JsonWebKeySet, K as JwksTokenVerifier, L as JwksTokenVerifierOptions, M as LoggingHttpAdapter, N as LoginActivity, O as OpenIdConfiguration, P as Organization, Q as OtpCheckResult, R as Paged, S as PaginationOptions, T as Permission, U as PermissionsByRole, V as ReservedPermissions, W as Role, X as RoleGrant, Y as RoleInput, Z as RoleList, _ as RolePermissions, $ as SafeJwtAlgorithm, a0 as SecurityMethods, a1 as SubjectApprovals, a2 as SubjectSecurity, a3 as TenantClientValidationResult, a4 as TenantCredentialIssued, a5 as TenantCredentialSummary, a6 as TenantInvite, a7 as TenantInviteAccepted, a8 as TenantInviteInput, a9 as TenantInviteIssued, aa as TenantInvitePreview, ab as TenantInviteStatus, ac as TenantMember, ad as TenantMemberPage, ae as TenantMembership, af as TenantScopedClient, ag as TokenResult, ah as TokenVerificationError, ai as TokenVerificationErrorCode, aj as UpdateOrganizationInput, ak as User, al as UserScopedClient, am as ValidateResult, an as VerifiedAccessToken, ao as createClient, ap as normalizeClientIp } from './authyonServerClient-1_1qNRDa.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-C0Mg5gUv.cjs';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -27,6 +27,7 @@ declare const ErrorCodes: {
     readonly UserNotFound: "user_not_found";
     readonly TemporarilyUnavailable: "temporarily_unavailable";
     readonly InsufficientScope: "insufficient_scope";
+    readonly CredentialThrottled: "credential_throttled";
     readonly ApprovalNotFound: "authorization_not_found";
     readonly SessionRevoked: "session_revoked";
     readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.js';
-export { b as AccessTokenSource, c as Approval, d as ApprovalAssurance, e as ApprovalPayload, f as ApprovalStatus, g as ApprovalWebAuthnOptions, h as AuditEvent, i as AuthyonJwksDiscoveryOptions, j as AuthyonJwtClaims, k as AuthyonServerClientOptions, C as ClientCredentials, l as ClientRequestContext, m as ConfirmApprovalInput, n as ConsumedApproval, o as CreateApprovalInput, p as CreateCredentialInput, q as CreateOrganizationInput, r as CreatePermissionInput, s as CreateTenantCredentialInput, t as CreateUserInput, u as CredentialCreator, v as CredentialDetail, w as CredentialListOptions, x as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, y as HttpAdapterRequest, z as HttpLogEvent, B as HttpLogger, I as IntrospectResult, D as InviteTenantMemberInput, J as JsonWebKeySet, G as JwksTokenVerifier, K as JwksTokenVerifierOptions, L as LoggingHttpAdapter, M as LoginActivity, O as OpenIdConfiguration, N as Organization, P as OtpCheckResult, Q as Paged, R as PaginationOptions, S as Permission, T as PermissionsByRole, U as ReservedPermissions, V as Role, W as RoleGrant, X as RoleInput, Y as RoleList, Z as RolePermissions, _ as SafeJwtAlgorithm, $ as SubjectApprovals, a0 as SubjectSecurity, a1 as TenantClientValidationResult, a2 as TenantCredentialIssued, a3 as TenantCredentialSummary, a4 as TenantMember, a5 as TenantMemberPage, a6 as TenantMembership, a7 as TenantScopedClient, a8 as TokenResult, a9 as TokenVerificationError, aa as TokenVerificationErrorCode, ab as UpdateOrganizationInput, ac as User, ad as UserScopedClient, ae as ValidateResult, af as VerifiedAccessToken, ag as createClient, ah as normalizeClientIp } from './authyonServerClient-DQzhfaja.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-WlwcTBwG.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as JsonWebKeySet, K as JwksTokenVerifier, L as JwksTokenVerifierOptions, M as LoggingHttpAdapter, N as LoginActivity, O as OpenIdConfiguration, P as Organization, Q as OtpCheckResult, R as Paged, S as PaginationOptions, T as Permission, U as PermissionsByRole, V as ReservedPermissions, W as Role, X as RoleGrant, Y as RoleInput, Z as RoleList, _ as RolePermissions, $ as SafeJwtAlgorithm, a0 as SecurityMethods, a1 as SubjectApprovals, a2 as SubjectSecurity, a3 as TenantClientValidationResult, a4 as TenantCredentialIssued, a5 as TenantCredentialSummary, a6 as TenantInvite, a7 as TenantInviteAccepted, a8 as TenantInviteInput, a9 as TenantInviteIssued, aa as TenantInvitePreview, ab as TenantInviteStatus, ac as TenantMember, ad as TenantMemberPage, ae as TenantMembership, af as TenantScopedClient, ag as TokenResult, ah as TokenVerificationError, ai as TokenVerificationErrorCode, aj as UpdateOrganizationInput, ak as User, al as UserScopedClient, am as ValidateResult, an as VerifiedAccessToken, ao as createClient, ap as normalizeClientIp } from './authyonServerClient-1_1qNRDa.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-BvjIWPcU.js';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -27,6 +27,7 @@ declare const ErrorCodes: {
     readonly UserNotFound: "user_not_found";
     readonly TemporarilyUnavailable: "temporarily_unavailable";
     readonly InsufficientScope: "insufficient_scope";
+    readonly CredentialThrottled: "credential_throttled";
     readonly ApprovalNotFound: "authorization_not_found";
     readonly SessionRevoked: "session_revoked";
     readonly TwoFactorTooManyFailures: "user.2fa.too_many_failures";

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   JsonHttpClient,
   LoggingHttpAdapter,
   createSharedTransport
-} from "./chunk-WPPEV5BA.js";
+} from "./chunk-TDJNBD3Z.js";
 import {
   AuthorizationError,
   AuthyonAbility,
@@ -152,8 +152,22 @@ function path(id, suffix = "") {
     throw new TypeError("Authyon: an approval id is required.");
   return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
 }
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
 function subjectSecurity(request) {
   return {
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
     approvals: {
       get: (id) => request(path(id)),
       webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
@@ -191,6 +205,31 @@ var UserScopedClient = class {
         remove: (tenantId, userId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
           method: "DELETE"
         })
+      },
+      /**
+       * Invites by e-mail or by link, acting as the user. Requires the
+       * `tenants:members:invite` permission on the tenant.
+       */
+      invites: {
+        list: (tenantId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`),
+        /** Always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+        create: (tenantId, input) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`, {
+          method: "POST",
+          body: {
+            email: input.email,
+            roles: input.roles,
+            sendEmail: input.sendEmail ?? true,
+            redirectUri: input.redirectUri
+          }
+        }),
+        /** New link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+        resend: (tenantId, inviteId, input = {}) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}/resend`, {
+          method: "POST",
+          body: { sendEmail: input.sendEmail ?? true }
+        }),
+        revoke: (tenantId, inviteId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}`, {
+          method: "DELETE"
+        })
       }
     };
     __privateSet(this, _request, scopedRequest(request, token));
@@ -484,6 +523,61 @@ var AuthyonServerClient = class {
             { method: "DELETE", envBearer: true }
           )
         },
+        /**
+         * Invites by e-mail or by link — for addresses that may not have an
+         * account yet; accepting creates it. Managing them needs the
+         * credential's `authyon:users:write` scope (listing, `authyon:tenants:read`).
+         */
+        invites: {
+          /** GET /env/tenants/{tenantId}/invites — every invite with its status, newest first. */
+          list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, { envBearer: true }),
+          /**
+           * POST /env/tenants/{tenantId}/invites — invite an address. Always
+           * returns `acceptUrl`; with `sendEmail: false` Authyon does not mail
+           * it and you deliver the link yourself. Valid 7 days, single use, and
+           * not readable again later.
+           */
+          create: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, {
+            method: "POST",
+            envBearer: true,
+            body: {
+              email: input.email,
+              roles: input.roles,
+              sendEmail: input.sendEmail ?? true,
+              redirectUri: input.redirectUri
+            }
+          }),
+          /** POST .../invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+          resend: (tenantId, inviteId, input = {}) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+            { method: "POST", envBearer: true, body: { sendEmail: input.sendEmail ?? true } }
+          ),
+          /** DELETE /env/tenants/{tenantId}/invites/{inviteId} — revoke a pending invite. */
+          revoke: (tenantId, inviteId) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}`,
+            { method: "DELETE", envBearer: true }
+          ),
+          /**
+           * POST /auth/tenant-invites/preview — for a backend hosting the accept
+           * page. Public: needs only `envKey`, the token is the credential.
+           */
+          preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+          /**
+           * Joins the tenant; for an address with no account, also creates it
+           * (password required) with the e-mail already confirmed. Does not
+           * sign the user in.
+           *
+           * Without metadata: POST /auth/tenant-invites/accept — public, needs
+           * only `envKey`. With `publicMetadata`/`privateMetadata`: POST
+           * /env/tenant-invites/accept with the environment credential
+           * (`authyon:users:write`), since only your backend may set them.
+           */
+          accept: (input) => input.publicMetadata !== void 0 || input.privateMetadata !== void 0 ? this.request("/env/tenant-invites/accept", {
+            method: "POST",
+            envBearer: true,
+            body: input
+          }) : this.request("/auth/tenant-invites/accept", { method: "POST", body: input })
+        },
         roles: {
           /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
           list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/roles`, { envBearer: true }),
@@ -555,8 +649,9 @@ var AuthyonServerClient = class {
     };
     // ── Security: one-time codes and approvals ───────────────────────────────
     //
-    // Everything here runs with the environment credential, which needs the
-    // `authyon:financial:authorize` scope. Keep that credential on the server.
+    // Everything here runs with the environment credential: `otp` needs the
+    // `authyon:otp:verify` scope, `approvals` needs `authyon:financial:authorize`.
+    // Keep those credentials on the server.
     this.security = {
       otp: {
         /**
@@ -564,7 +659,8 @@ var AuthyonServerClient = class {
          * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
          * throwing. Each code is accepted once; 3 wrong codes in a row sign the
          * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
-         * minutes (`rate_limited`).
+         * minutes (`rate_limited`). More than 50 wrong codes in 10 minutes from the
+         * same credential pause it (`credential_throttled`). Needs `authyon:otp:verify`.
          */
         check: (userId, code) => this.request(`/env/users/${segment(userId)}/otp/verify`, {
           method: "POST",
@@ -728,6 +824,28 @@ var AuthyonServerClient = class {
 _clientSecret = new WeakMap();
 var TenantScopedClient = class {
   constructor(server, credentials) {
+    /** Invites to the token's tenant, by e-mail or by link. */
+    this.invites = {
+      /** GET /tenant/invites — every invite with its status, newest first. */
+      list: () => this.request("/tenant/invites"),
+      /** POST /tenant/invites — always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+      create: (input) => this.request("/tenant/invites", {
+        method: "POST",
+        body: {
+          email: input.email,
+          roles: input.roles,
+          sendEmail: input.sendEmail ?? true,
+          redirectUri: input.redirectUri
+        }
+      }),
+      /** POST /tenant/invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+      resend: (inviteId, input = {}) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}/resend`, {
+        method: "POST",
+        body: { sendEmail: input.sendEmail ?? true }
+      }),
+      /** DELETE /tenant/invites/{inviteId} — revoke a pending invite. */
+      revoke: (inviteId) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}`, { method: "DELETE" })
+    };
     this.members = {
       /**
        * GET /tenant/members — members of the token's tenant.

package/dist/next.d.cts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-B82XXf3B.cjs';
-import { A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.cjs';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-C0Mg5gUv.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-WlwcTBwG.js';
-import { A as AuthyonServerClient } from './authyonServerClient-DQzhfaja.js';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-BvjIWPcU.js';
+import { A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.15",
+  "version": "0.2.0-beta.17",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",