@authyon/server 0.2.0-beta.17 → 0.2.0-beta.19

package/README.md

@@ -295,8 +295,10 @@ const page = await authyon.environment.tenants.credentials.listPage(tenantId, {
 const detail = await authyon.environment.tenants.credentials.get(tenantId, credentialId);
 ```
 
-`page` contém `data`, `perPage` (número da página, começando em 1), `pageSize`,
-`total`, `pages`, `hasNext` e `hasPrev`. `take` aceita 1–100 (padrão da API: 25),
+`page` contém `data`, `page` (a página atual, começando em 1), `perPage` (o
+limite por página), `total`, `pages`, `hasNext` e `hasPrev`. Até a API de
+2026-10-21 os dois campos se chamavam `perPage` (página) e `pageSize`
+(limite), nessa ordem trocada. `take` aceita 1–100 (padrão da API: 25),
 `skip` é um deslocamento a partir de zero e `search` aceita até 200 caracteres.
 A API pesquisa clientId, descrição e permissões antes de paginar.
 
@@ -426,6 +428,34 @@ Por padrão o link aponta para a página do Authyon; configure a _URL do convite
 tenant_ nas configurações do ambiente para usar a sua (ela recebe `token` e `env`).
 Aceitar não faz login.
 
+## Redefinição de senha pelo seu próprio e-mail
+
+Para a sua aplicação disparar o e-mail de redefinição em vez do Authyon, emita o token no
+backend (escopo `authyon:users:password`) e entregue você mesmo:
+
+```ts
+const reset = await authyon.environment.users.issuePasswordReset({
+  email: "pessoa@example.com",
+  // Opcional: para onde mandar a pessoa depois de trocar a senha. Precisa estar
+  // cadastrado (match exato) nos redirect URIs do ambiente.
+  redirectUri: "https://app.example.com/login",
+  // sendEmail: true faria o Authyon enviar também; o padrão é false.
+});
+reset.token; // só aparece aqui — a API guarda apenas o hash
+reset.resetUrl; // o link que o e-mail do Authyon levaria
+reset.expiresAt; // 30 minutos
+
+// Página de redefinição no seu backend: públicas, usam só o envKey.
+const preview = await authyon.environment.users.validatePasswordReset(token); // não gasta o token
+const done = await authyon.environment.users.confirmPasswordReset(token, newPassword);
+if (done.redirectUri) redirect(done.redirectUri); // o redirect fica por sua conta
+```
+
+Quem tem o token consegue definir a senha: envie somente para o endereço da própria conta e
+não registre em log. Emitir um token novo invalida o anterior da mesma conta. Um endereço
+sem conta responde `404 user.not_found`; token desconhecido, usado ou expirado responde
+`401 user.password_reset.invalid`.
+
 ## Compatibilidade e segurança do transporte
 
 As chamadas exigem os endpoints externos atuais da API e a migração

package/dist/{authorization-BvjIWPcU.d.ts → authorization-7g-KNTTk.d.ts}

@@ -1,4 +1,4 @@
-import { K as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
+import { L as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-D1IeZFrS.js';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authorization-C0Mg5gUv.d.cts → authorization-EEV7lntD.d.cts}

@@ -1,4 +1,4 @@
-import { K as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
+import { L as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-D1IeZFrS.cjs';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authyonServerClient-1_1qNRDa.d.cts → authyonServerClient-D1IeZFrS.d.cts}

@@ -137,10 +137,20 @@ interface PaginationOptions {
     skip?: number;
     take?: number;
 }
+/**
+ * The envelope every paged endpoint answers with.
+ *
+ * `page` is the 1-based current page and `perPage` is how many items a page
+ * holds — the same sense `take` has on the way in. Up to Authyon API
+ * 2026-10-21 the two were named `perPage` (holding the page number) and
+ * `pageSize` (holding the limit), so reading them by their names gave the
+ * wrong value without failing. Clients on the older API see `page` undefined
+ * and `perPage` holding a page number.
+ */
 interface Paged<T> {
     data: T[];
-    perPage?: number;
-    pageSize: number;
+    page: number;
+    perPage: number;
     total: number;
     pages: number;
     hasNext: boolean;
@@ -233,8 +243,13 @@ interface EnvironmentUser {
     refreshTokens?: unknown[];
     tenantIds: string[];
     tenantMemberships?: TenantMembership[];
-    /** Flattened role names across all tenant memberships (list() only). */
+    /** Flattened role names across all tenant memberships (list() only).
+     *  On `tenants.members.list()` it is scoped to that one tenant. */
     tenantRoles?: string[];
+    /** Permissions granted to this member directly inside the tenant, beside
+     *  whatever their tenant roles carry. Only `tenants.members.list()` fills
+     *  it; absent on an API older than 2026-10-21. */
+    tenantPermissions?: string[];
     twoFactorMethods: string[];
     totpConfirmedAt?: string | null;
     emailOtpEnabledAt?: string | null;
@@ -530,6 +545,45 @@ interface TenantInviteInput {
      */
     redirectUri?: string;
 }
+/** POST /env/password-resets — issue a reset for an account of the environment. */
+interface IssuePasswordResetInput {
+    email: string;
+    /**
+     * Where to send the person after they change the password. Must be
+     * registered exactly in the environment's redirect URIs; otherwise the API
+     * rejects with `user.password_reset.redirect_uri.not_allowed`.
+     */
+    redirectUri?: string;
+    /**
+     * `true` has Authyon mail the link as well. Defaults to `false`: the point
+     * of this call is to deliver the token through your own e-mail.
+     */
+    sendEmail?: boolean;
+}
+/** Returned when a reset is issued. `token` is only ever readable here — the
+ *  API keeps its hash. Whoever holds it can set the password: send it only to
+ *  the account's own address and never log it. */
+interface PasswordResetIssued {
+    userId: string;
+    email: string;
+    token: string;
+    /** The link Authyon's own e-mail would carry: the environment's reset page
+     *  when it has one, the hosted page otherwise. */
+    resetUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+/** What a live reset token is for. */
+interface PasswordResetPreview {
+    email: string;
+    expiresAt: string;
+    redirectUri: string | null;
+}
+/** The password is changed. Following `redirectUri` is up to you. */
+interface PasswordResetCompleted {
+    redirectUri: string | null;
+}
 /** Returned when an invite is created or re-issued. `acceptUrl` is only ever
  *  readable here — the API keeps a hash of the token, not the token. */
 interface TenantInviteIssued {
@@ -866,6 +920,29 @@ declare class AuthyonServerClient {
             unlock: (userId: string, reason?: string) => Promise<void>;
             /** POST /env/users/{userId}/password — sets a new password for the user. */
             setPassword: (userId: string, newPassword: string, reason?: string) => Promise<void>;
+            /**
+             * POST /env/password-resets — issues a password-reset token for the
+             * account with this address and returns it, so your application can
+             * deliver it in its own e-mail instead of Authyon's. Needs the
+             * `authyon:users:password` scope. Unlike the public forgot-password
+             * request, an unknown address rejects with `user.not_found` (404).
+             * A previous live token for the same account stops working.
+             */
+            issuePasswordReset: (input: IssuePasswordResetInput) => Promise<PasswordResetIssued>;
+            /**
+             * POST /auth/password-reset/validate — for a backend hosting the reset
+             * page: checks a token without spending it. Public, needs only the
+             * `envKey`. Rejects with `user.password_reset.invalid` (401) when the
+             * token is unknown, used or expired.
+             */
+            validatePasswordReset: (token: string) => Promise<PasswordResetPreview>;
+            /**
+             * POST /auth/password-reset/confirm — redeems the token and sets the new
+             * password (every session of the account is signed out). Public, needs
+             * only the `envKey`. Resolves with the `redirectUri` the reset was issued
+             * with, or `null`.
+             */
+            confirmPasswordReset: (token: string, newPassword: string) => Promise<PasswordResetCompleted>;
             /** POST /env/users/{userId}/sessions/revoke-all — revokes every session the user has. */
             revokeSessions: (userId: string, reason?: string) => Promise<void>;
             /** DELETE /env/users/{userId}/sessions/{sessionId} — revokes a single session. */
@@ -898,7 +975,18 @@ declare class AuthyonServerClient {
                 updateScopes: (tenantId: string, credentialId: string, scopes: readonly string[]) => Promise<void>;
                 revoke: (tenantId: string, credentialId: string) => Promise<void>;
             };
-            /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+            /**
+             * GET /env/tenants — one page of the environment's tenants.
+             *
+             * `search` matches, case-insensitively and anywhere in the value, the
+             * name, the slug, the description and the raw text of both metadata
+             * documents — so a tenant filed with `{"cnpj":"00.000.000/0001-00"}`
+             * is found by the number, and `cnpj` alone finds every tenant carrying
+             * that key. `take` defaults to 25 and is capped at 100.
+             *
+             * Against an Authyon API older than 2026-10-21 this route ignored
+             * skip/take/search and answered with a bare array.
+             */
             list: (params?: {
                 search?: string;
             } & PaginationOptions) => Promise<Paged<Organization>>;
@@ -917,10 +1005,14 @@ declare class AuthyonServerClient {
             members: {
                 /**
                  * GET /env/tenants/{tenantId}/members — a tenant's members as full
-                 * user records. Confirmed live: a bare array (unlike
-                 * `environment.users.list()`, this one does NOT paginate despite
-                 * accepting `skip`/`take`), with the same shape
-                 * `environment.users.list()` items have.
+                 * user records, with the same shape `environment.users.list()` items
+                 * have, plus `tenantRoles` and `tenantPermissions` scoped to this
+                 * tenant.
+                 *
+                 * Confirmed live: the response is a bare array, with no envelope and
+                 * no total — but `skip`/`take` DO apply, and `take` defaults to 50.
+                 * A tenant with more than 50 members gives you 50 and says nothing,
+                 * so page it yourself until a short page comes back.
                  */
                 list: (tenantId: string, params?: PaginationOptions) => Promise<EnvironmentUser[]>;
                 /** POST /env/tenants/{tenantId}/members — add a member to a tenant. */
@@ -1136,4 +1228,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type SafeJwtAlgorithm as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, JwksTokenVerifier as K, type JwksTokenVerifierOptions as L, LoggingHttpAdapter as M, type LoginActivity as N, type OpenIdConfiguration as O, type Organization as P, type OtpCheckResult as Q, type Paged as R, type PaginationOptions as S, type Permission as T, type PermissionsByRole as U, type ReservedPermissions as V, type Role as W, type RoleGrant as X, type RoleInput as Y, type RoleList as Z, type RolePermissions as _, type HttpLoggerOptions as a, type SecurityMethods as a0, type SubjectApprovals as a1, type SubjectSecurity as a2, type TenantClientValidationResult as a3, type TenantCredentialIssued as a4, type TenantCredentialSummary as a5, type TenantInvite as a6, type TenantInviteAccepted as a7, type TenantInviteInput as a8, type TenantInviteIssued as a9, type TenantInvitePreview as aa, type TenantInviteStatus as ab, type TenantMember as ac, type TenantMemberPage as ad, type TenantMembership as ae, TenantScopedClient as af, type TokenResult as ag, TokenVerificationError as ah, type TokenVerificationErrorCode as ai, type UpdateOrganizationInput as aj, type User as ak, UserScopedClient as al, type ValidateResult as am, type VerifiedAccessToken as an, createClient as ao, normalizeClientIp as ap, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };
+export { type RoleGrant as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type IssuePasswordResetInput as J, type JsonWebKeySet as K, JwksTokenVerifier as L, type JwksTokenVerifierOptions as M, LoggingHttpAdapter as N, type LoginActivity as O, type OpenIdConfiguration as P, type Organization as Q, type OtpCheckResult as R, type Paged as S, type PaginationOptions as T, type PasswordResetCompleted as U, type PasswordResetIssued as V, type PasswordResetPreview as W, type Permission as X, type PermissionsByRole as Y, type ReservedPermissions as Z, type Role as _, type HttpLoggerOptions as a, type RoleInput as a0, type RoleList as a1, type RolePermissions as a2, type SafeJwtAlgorithm as a3, type SecurityMethods as a4, type SubjectApprovals as a5, type SubjectSecurity as a6, type TenantClientValidationResult as a7, type TenantCredentialIssued as a8, type TenantCredentialSummary as a9, type TenantInvite as aa, type TenantInviteAccepted as ab, type TenantInviteInput as ac, type TenantInviteIssued as ad, type TenantInvitePreview as ae, type TenantInviteStatus as af, type TenantMember as ag, type TenantMemberPage as ah, type TenantMembership as ai, TenantScopedClient as aj, type TokenResult as ak, TokenVerificationError as al, type TokenVerificationErrorCode as am, type UpdateOrganizationInput as an, type User as ao, UserScopedClient as ap, type ValidateResult as aq, type VerifiedAccessToken as ar, createClient as as, normalizeClientIp as at, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };

package/dist/{authyonServerClient-1_1qNRDa.d.ts → authyonServerClient-D1IeZFrS.d.ts}

@@ -137,10 +137,20 @@ interface PaginationOptions {
     skip?: number;
     take?: number;
 }
+/**
+ * The envelope every paged endpoint answers with.
+ *
+ * `page` is the 1-based current page and `perPage` is how many items a page
+ * holds — the same sense `take` has on the way in. Up to Authyon API
+ * 2026-10-21 the two were named `perPage` (holding the page number) and
+ * `pageSize` (holding the limit), so reading them by their names gave the
+ * wrong value without failing. Clients on the older API see `page` undefined
+ * and `perPage` holding a page number.
+ */
 interface Paged<T> {
     data: T[];
-    perPage?: number;
-    pageSize: number;
+    page: number;
+    perPage: number;
     total: number;
     pages: number;
     hasNext: boolean;
@@ -233,8 +243,13 @@ interface EnvironmentUser {
     refreshTokens?: unknown[];
     tenantIds: string[];
     tenantMemberships?: TenantMembership[];
-    /** Flattened role names across all tenant memberships (list() only). */
+    /** Flattened role names across all tenant memberships (list() only).
+     *  On `tenants.members.list()` it is scoped to that one tenant. */
     tenantRoles?: string[];
+    /** Permissions granted to this member directly inside the tenant, beside
+     *  whatever their tenant roles carry. Only `tenants.members.list()` fills
+     *  it; absent on an API older than 2026-10-21. */
+    tenantPermissions?: string[];
     twoFactorMethods: string[];
     totpConfirmedAt?: string | null;
     emailOtpEnabledAt?: string | null;
@@ -530,6 +545,45 @@ interface TenantInviteInput {
      */
     redirectUri?: string;
 }
+/** POST /env/password-resets — issue a reset for an account of the environment. */
+interface IssuePasswordResetInput {
+    email: string;
+    /**
+     * Where to send the person after they change the password. Must be
+     * registered exactly in the environment's redirect URIs; otherwise the API
+     * rejects with `user.password_reset.redirect_uri.not_allowed`.
+     */
+    redirectUri?: string;
+    /**
+     * `true` has Authyon mail the link as well. Defaults to `false`: the point
+     * of this call is to deliver the token through your own e-mail.
+     */
+    sendEmail?: boolean;
+}
+/** Returned when a reset is issued. `token` is only ever readable here — the
+ *  API keeps its hash. Whoever holds it can set the password: send it only to
+ *  the account's own address and never log it. */
+interface PasswordResetIssued {
+    userId: string;
+    email: string;
+    token: string;
+    /** The link Authyon's own e-mail would carry: the environment's reset page
+     *  when it has one, the hosted page otherwise. */
+    resetUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+/** What a live reset token is for. */
+interface PasswordResetPreview {
+    email: string;
+    expiresAt: string;
+    redirectUri: string | null;
+}
+/** The password is changed. Following `redirectUri` is up to you. */
+interface PasswordResetCompleted {
+    redirectUri: string | null;
+}
 /** Returned when an invite is created or re-issued. `acceptUrl` is only ever
  *  readable here — the API keeps a hash of the token, not the token. */
 interface TenantInviteIssued {
@@ -866,6 +920,29 @@ declare class AuthyonServerClient {
             unlock: (userId: string, reason?: string) => Promise<void>;
             /** POST /env/users/{userId}/password — sets a new password for the user. */
             setPassword: (userId: string, newPassword: string, reason?: string) => Promise<void>;
+            /**
+             * POST /env/password-resets — issues a password-reset token for the
+             * account with this address and returns it, so your application can
+             * deliver it in its own e-mail instead of Authyon's. Needs the
+             * `authyon:users:password` scope. Unlike the public forgot-password
+             * request, an unknown address rejects with `user.not_found` (404).
+             * A previous live token for the same account stops working.
+             */
+            issuePasswordReset: (input: IssuePasswordResetInput) => Promise<PasswordResetIssued>;
+            /**
+             * POST /auth/password-reset/validate — for a backend hosting the reset
+             * page: checks a token without spending it. Public, needs only the
+             * `envKey`. Rejects with `user.password_reset.invalid` (401) when the
+             * token is unknown, used or expired.
+             */
+            validatePasswordReset: (token: string) => Promise<PasswordResetPreview>;
+            /**
+             * POST /auth/password-reset/confirm — redeems the token and sets the new
+             * password (every session of the account is signed out). Public, needs
+             * only the `envKey`. Resolves with the `redirectUri` the reset was issued
+             * with, or `null`.
+             */
+            confirmPasswordReset: (token: string, newPassword: string) => Promise<PasswordResetCompleted>;
             /** POST /env/users/{userId}/sessions/revoke-all — revokes every session the user has. */
             revokeSessions: (userId: string, reason?: string) => Promise<void>;
             /** DELETE /env/users/{userId}/sessions/{sessionId} — revokes a single session. */
@@ -898,7 +975,18 @@ declare class AuthyonServerClient {
                 updateScopes: (tenantId: string, credentialId: string, scopes: readonly string[]) => Promise<void>;
                 revoke: (tenantId: string, credentialId: string) => Promise<void>;
             };
-            /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+            /**
+             * GET /env/tenants — one page of the environment's tenants.
+             *
+             * `search` matches, case-insensitively and anywhere in the value, the
+             * name, the slug, the description and the raw text of both metadata
+             * documents — so a tenant filed with `{"cnpj":"00.000.000/0001-00"}`
+             * is found by the number, and `cnpj` alone finds every tenant carrying
+             * that key. `take` defaults to 25 and is capped at 100.
+             *
+             * Against an Authyon API older than 2026-10-21 this route ignored
+             * skip/take/search and answered with a bare array.
+             */
             list: (params?: {
                 search?: string;
             } & PaginationOptions) => Promise<Paged<Organization>>;
@@ -917,10 +1005,14 @@ declare class AuthyonServerClient {
             members: {
                 /**
                  * GET /env/tenants/{tenantId}/members — a tenant's members as full
-                 * user records. Confirmed live: a bare array (unlike
-                 * `environment.users.list()`, this one does NOT paginate despite
-                 * accepting `skip`/`take`), with the same shape
-                 * `environment.users.list()` items have.
+                 * user records, with the same shape `environment.users.list()` items
+                 * have, plus `tenantRoles` and `tenantPermissions` scoped to this
+                 * tenant.
+                 *
+                 * Confirmed live: the response is a bare array, with no envelope and
+                 * no total — but `skip`/`take` DO apply, and `take` defaults to 50.
+                 * A tenant with more than 50 members gives you 50 and says nothing,
+                 * so page it yourself until a short page comes back.
                  */
                 list: (tenantId: string, params?: PaginationOptions) => Promise<EnvironmentUser[]>;
                 /** POST /env/tenants/{tenantId}/members — add a member to a tenant. */
@@ -1136,4 +1228,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type SafeJwtAlgorithm as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, JwksTokenVerifier as K, type JwksTokenVerifierOptions as L, LoggingHttpAdapter as M, type LoginActivity as N, type OpenIdConfiguration as O, type Organization as P, type OtpCheckResult as Q, type Paged as R, type PaginationOptions as S, type Permission as T, type PermissionsByRole as U, type ReservedPermissions as V, type Role as W, type RoleGrant as X, type RoleInput as Y, type RoleList as Z, type RolePermissions as _, type HttpLoggerOptions as a, type SecurityMethods as a0, type SubjectApprovals as a1, type SubjectSecurity as a2, type TenantClientValidationResult as a3, type TenantCredentialIssued as a4, type TenantCredentialSummary as a5, type TenantInvite as a6, type TenantInviteAccepted as a7, type TenantInviteInput as a8, type TenantInviteIssued as a9, type TenantInvitePreview as aa, type TenantInviteStatus as ab, type TenantMember as ac, type TenantMemberPage as ad, type TenantMembership as ae, TenantScopedClient as af, type TokenResult as ag, TokenVerificationError as ah, type TokenVerificationErrorCode as ai, type UpdateOrganizationInput as aj, type User as ak, UserScopedClient as al, type ValidateResult as am, type VerifiedAccessToken as an, createClient as ao, normalizeClientIp as ap, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };
+export { type RoleGrant as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type IssuePasswordResetInput as J, type JsonWebKeySet as K, JwksTokenVerifier as L, type JwksTokenVerifierOptions as M, LoggingHttpAdapter as N, type LoginActivity as O, type OpenIdConfiguration as P, type Organization as Q, type OtpCheckResult as R, type Paged as S, type PaginationOptions as T, type PasswordResetCompleted as U, type PasswordResetIssued as V, type PasswordResetPreview as W, type Permission as X, type PermissionsByRole as Y, type ReservedPermissions as Z, type Role as _, type HttpLoggerOptions as a, type RoleInput as a0, type RoleList as a1, type RolePermissions as a2, type SafeJwtAlgorithm as a3, type SecurityMethods as a4, type SubjectApprovals as a5, type SubjectSecurity as a6, type TenantClientValidationResult as a7, type TenantCredentialIssued as a8, type TenantCredentialSummary as a9, type TenantInvite as aa, type TenantInviteAccepted as ab, type TenantInviteInput as ac, type TenantInviteIssued as ad, type TenantInvitePreview as ae, type TenantInviteStatus as af, type TenantMember as ag, type TenantMemberPage as ah, type TenantMembership as ai, TenantScopedClient as aj, type TokenResult as ak, TokenVerificationError as al, type TokenVerificationErrorCode as am, type UpdateOrganizationInput as an, type User as ao, UserScopedClient as ap, type ValidateResult as aq, type VerifiedAccessToken as ar, createClient as as, normalizeClientIp as at, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };

package/dist/bff.d.cts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-D1IeZFrS.cjs';
 import 'jose';
 
 interface BffLoginInput {

package/dist/bff.d.ts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-D1IeZFrS.js';
 import 'jose';
 
 interface BffLoginInput {

package/dist/index.cjs

@@ -131,8 +131,8 @@ async function credentialPage(request, path2, options = {}) {
     throw new TypeError("Authyon: expected a paginated credential response.");
   return {
     data: page.data.map(credentialSummary),
-    ...page.perPage === void 0 ? {} : { perPage: page.perPage },
-    pageSize: page.pageSize,
+    page: page.page,
+    perPage: page.perPage,
     total: page.total,
     pages: page.pages,
     hasNext: page.hasNext,
@@ -881,6 +881,39 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: { newPassword, reason }
         }),
+        /**
+         * POST /env/password-resets — issues a password-reset token for the
+         * account with this address and returns it, so your application can
+         * deliver it in its own e-mail instead of Authyon's. Needs the
+         * `authyon:users:password` scope. Unlike the public forgot-password
+         * request, an unknown address rejects with `user.not_found` (404).
+         * A previous live token for the same account stops working.
+         */
+        issuePasswordReset: (input) => this.request("/env/password-resets", {
+          method: "POST",
+          envBearer: true,
+          body: { ...input, sendEmail: input.sendEmail ?? false }
+        }),
+        /**
+         * POST /auth/password-reset/validate — for a backend hosting the reset
+         * page: checks a token without spending it. Public, needs only the
+         * `envKey`. Rejects with `user.password_reset.invalid` (401) when the
+         * token is unknown, used or expired.
+         */
+        validatePasswordReset: (token) => this.request("/auth/password-reset/validate", { method: "POST", body: { token } }),
+        /**
+         * POST /auth/password-reset/confirm — redeems the token and sets the new
+         * password (every session of the account is signed out). Public, needs
+         * only the `envKey`. Resolves with the `redirectUri` the reset was issued
+         * with, or `null`.
+         */
+        confirmPasswordReset: async (token, newPassword) => {
+          const done = await this.request(
+            "/auth/password-reset/confirm",
+            { method: "POST", body: { token, newPassword } }
+          );
+          return { redirectUri: done?.redirectUri ?? null };
+        },
         /** POST /env/users/{userId}/sessions/revoke-all — revokes every session the user has. */
         revokeSessions: (userId, reason) => this.request(`/env/users/${encodeURIComponent(userId)}/sessions/revoke-all`, {
           method: "POST",
@@ -974,7 +1007,18 @@ var AuthyonServerClient = class {
             envBearer: true
           })
         },
-        /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+        /**
+         * GET /env/tenants — one page of the environment's tenants.
+         *
+         * `search` matches, case-insensitively and anywhere in the value, the
+         * name, the slug, the description and the raw text of both metadata
+         * documents — so a tenant filed with `{"cnpj":"00.000.000/0001-00"}`
+         * is found by the number, and `cnpj` alone finds every tenant carrying
+         * that key. `take` defaults to 25 and is capped at 100.
+         *
+         * Against an Authyon API older than 2026-10-21 this route ignored
+         * skip/take/search and answered with a bare array.
+         */
         list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
         /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
@@ -1005,10 +1049,14 @@ var AuthyonServerClient = class {
         members: {
           /**
            * GET /env/tenants/{tenantId}/members — a tenant's members as full
-           * user records. Confirmed live: a bare array (unlike
-           * `environment.users.list()`, this one does NOT paginate despite
-           * accepting `skip`/`take`), with the same shape
-           * `environment.users.list()` items have.
+           * user records, with the same shape `environment.users.list()` items
+           * have, plus `tenantRoles` and `tenantPermissions` scoped to this
+           * tenant.
+           *
+           * Confirmed live: the response is a bare array, with no envelope and
+           * no total — but `skip`/`take` DO apply, and `take` defaults to 50.
+           * A tenant with more than 50 members gives you 50 and says nothing,
+           * so page it yourself until a short page comes back.
            */
           list: (tenantId, params = {}) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/members`, {
             envBearer: true,

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
-export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as JsonWebKeySet, K as JwksTokenVerifier, L as JwksTokenVerifierOptions, M as LoggingHttpAdapter, N as LoginActivity, O as OpenIdConfiguration, P as Organization, Q as OtpCheckResult, R as Paged, S as PaginationOptions, T as Permission, U as PermissionsByRole, V as ReservedPermissions, W as Role, X as RoleGrant, Y as RoleInput, Z as RoleList, _ as RolePermissions, $ as SafeJwtAlgorithm, a0 as SecurityMethods, a1 as SubjectApprovals, a2 as SubjectSecurity, a3 as TenantClientValidationResult, a4 as TenantCredentialIssued, a5 as TenantCredentialSummary, a6 as TenantInvite, a7 as TenantInviteAccepted, a8 as TenantInviteInput, a9 as TenantInviteIssued, aa as TenantInvitePreview, ab as TenantInviteStatus, ac as TenantMember, ad as TenantMemberPage, ae as TenantMembership, af as TenantScopedClient, ag as TokenResult, ah as TokenVerificationError, ai as TokenVerificationErrorCode, aj as UpdateOrganizationInput, ak as User, al as UserScopedClient, am as ValidateResult, an as VerifiedAccessToken, ao as createClient, ap as normalizeClientIp } from './authyonServerClient-1_1qNRDa.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-C0Mg5gUv.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-D1IeZFrS.cjs';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TenantClientValidationResult, a8 as TenantCredentialIssued, a9 as TenantCredentialSummary, aa as TenantInvite, ab as TenantInviteAccepted, ac as TenantInviteInput, ad as TenantInviteIssued, ae as TenantInvitePreview, af as TenantInviteStatus, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as createClient, at as normalizeClientIp } from './authyonServerClient-D1IeZFrS.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-EEV7lntD.cjs';
 import 'jose';
 
 declare const ErrorCodes: {

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
-export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as JsonWebKeySet, K as JwksTokenVerifier, L as JwksTokenVerifierOptions, M as LoggingHttpAdapter, N as LoginActivity, O as OpenIdConfiguration, P as Organization, Q as OtpCheckResult, R as Paged, S as PaginationOptions, T as Permission, U as PermissionsByRole, V as ReservedPermissions, W as Role, X as RoleGrant, Y as RoleInput, Z as RoleList, _ as RolePermissions, $ as SafeJwtAlgorithm, a0 as SecurityMethods, a1 as SubjectApprovals, a2 as SubjectSecurity, a3 as TenantClientValidationResult, a4 as TenantCredentialIssued, a5 as TenantCredentialSummary, a6 as TenantInvite, a7 as TenantInviteAccepted, a8 as TenantInviteInput, a9 as TenantInviteIssued, aa as TenantInvitePreview, ab as TenantInviteStatus, ac as TenantMember, ad as TenantMemberPage, ae as TenantMembership, af as TenantScopedClient, ag as TokenResult, ah as TokenVerificationError, ai as TokenVerificationErrorCode, aj as UpdateOrganizationInput, ak as User, al as UserScopedClient, am as ValidateResult, an as VerifiedAccessToken, ao as createClient, ap as normalizeClientIp } from './authyonServerClient-1_1qNRDa.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-BvjIWPcU.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-D1IeZFrS.js';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TenantClientValidationResult, a8 as TenantCredentialIssued, a9 as TenantCredentialSummary, aa as TenantInvite, ab as TenantInviteAccepted, ac as TenantInviteInput, ad as TenantInviteIssued, ae as TenantInvitePreview, af as TenantInviteStatus, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as createClient, at as normalizeClientIp } from './authyonServerClient-D1IeZFrS.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-7g-KNTTk.js';
 import 'jose';
 
 declare const ErrorCodes: {

package/dist/index.js

@@ -109,8 +109,8 @@ async function credentialPage(request, path2, options = {}) {
     throw new TypeError("Authyon: expected a paginated credential response.");
   return {
     data: page.data.map(credentialSummary),
-    ...page.perPage === void 0 ? {} : { perPage: page.perPage },
-    pageSize: page.pageSize,
+    page: page.page,
+    perPage: page.perPage,
     total: page.total,
     pages: page.pages,
     hasNext: page.hasNext,
@@ -358,6 +358,39 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: { newPassword, reason }
         }),
+        /**
+         * POST /env/password-resets — issues a password-reset token for the
+         * account with this address and returns it, so your application can
+         * deliver it in its own e-mail instead of Authyon's. Needs the
+         * `authyon:users:password` scope. Unlike the public forgot-password
+         * request, an unknown address rejects with `user.not_found` (404).
+         * A previous live token for the same account stops working.
+         */
+        issuePasswordReset: (input) => this.request("/env/password-resets", {
+          method: "POST",
+          envBearer: true,
+          body: { ...input, sendEmail: input.sendEmail ?? false }
+        }),
+        /**
+         * POST /auth/password-reset/validate — for a backend hosting the reset
+         * page: checks a token without spending it. Public, needs only the
+         * `envKey`. Rejects with `user.password_reset.invalid` (401) when the
+         * token is unknown, used or expired.
+         */
+        validatePasswordReset: (token) => this.request("/auth/password-reset/validate", { method: "POST", body: { token } }),
+        /**
+         * POST /auth/password-reset/confirm — redeems the token and sets the new
+         * password (every session of the account is signed out). Public, needs
+         * only the `envKey`. Resolves with the `redirectUri` the reset was issued
+         * with, or `null`.
+         */
+        confirmPasswordReset: async (token, newPassword) => {
+          const done = await this.request(
+            "/auth/password-reset/confirm",
+            { method: "POST", body: { token, newPassword } }
+          );
+          return { redirectUri: done?.redirectUri ?? null };
+        },
         /** POST /env/users/{userId}/sessions/revoke-all — revokes every session the user has. */
         revokeSessions: (userId, reason) => this.request(`/env/users/${encodeURIComponent(userId)}/sessions/revoke-all`, {
           method: "POST",
@@ -451,7 +484,18 @@ var AuthyonServerClient = class {
             envBearer: true
           })
         },
-        /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+        /**
+         * GET /env/tenants — one page of the environment's tenants.
+         *
+         * `search` matches, case-insensitively and anywhere in the value, the
+         * name, the slug, the description and the raw text of both metadata
+         * documents — so a tenant filed with `{"cnpj":"00.000.000/0001-00"}`
+         * is found by the number, and `cnpj` alone finds every tenant carrying
+         * that key. `take` defaults to 25 and is capped at 100.
+         *
+         * Against an Authyon API older than 2026-10-21 this route ignored
+         * skip/take/search and answered with a bare array.
+         */
         list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
         /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
@@ -482,10 +526,14 @@ var AuthyonServerClient = class {
         members: {
           /**
            * GET /env/tenants/{tenantId}/members — a tenant's members as full
-           * user records. Confirmed live: a bare array (unlike
-           * `environment.users.list()`, this one does NOT paginate despite
-           * accepting `skip`/`take`), with the same shape
-           * `environment.users.list()` items have.
+           * user records, with the same shape `environment.users.list()` items
+           * have, plus `tenantRoles` and `tenantPermissions` scoped to this
+           * tenant.
+           *
+           * Confirmed live: the response is a bare array, with no envelope and
+           * no total — but `skip`/`take` DO apply, and `take` defaults to 50.
+           * A tenant with more than 50 members gives you 50 and says nothing,
+           * so page it yourself until a short page comes back.
            */
           list: (tenantId, params = {}) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/members`, {
             envBearer: true,

package/dist/next.d.cts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-C0Mg5gUv.cjs';
-import { A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.cjs';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-EEV7lntD.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-D1IeZFrS.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-BvjIWPcU.js';
-import { A as AuthyonServerClient } from './authyonServerClient-1_1qNRDa.js';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-7g-KNTTk.js';
+import { A as AuthyonServerClient } from './authyonServerClient-D1IeZFrS.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.17",
+  "version": "0.2.0-beta.19",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",