@authyon/server 0.2.0-beta.2 → 0.2.0-beta.20

package/dist/authyonServerClient-UA7HdjtD.d.ts

@@ -0,0 +1,1232 @@
+import { JSONWebKeySet, JWTPayload, JWSHeaderParameters } from 'jose';
+
+interface HttpAdapterRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body?: BodyInit | null;
+    signal: AbortSignal;
+}
+/** Transport contract accepted by both Authyon clients. */
+interface HttpAdapter {
+    request(request: HttpAdapterRequest): Promise<Response>;
+}
+type HttpLogEvent = {
+    type: "request";
+    method: string;
+    url: string;
+    timestamp: number;
+} | {
+    type: "response";
+    method: string;
+    url: string;
+    status: number;
+    durationMs: number;
+    requestId?: string;
+    timestamp: number;
+} | {
+    type: "error";
+    method: string;
+    url: string;
+    errorName: string;
+    durationMs: number;
+    timestamp: number;
+};
+/** Receives sanitized HTTP lifecycle events. Headers, bodies and query values are never exposed. */
+type HttpLogger = (event: HttpLogEvent) => void;
+/**
+ * Mutable logging configuration. Change `enabled` at runtime to enable or disable logging
+ * without recreating the Authyon client.
+ */
+interface HttpLoggerOptions {
+    enabled: boolean;
+    logger?: HttpLogger;
+}
+/** Default adapter backed by the platform's Fetch API. */
+declare class FetchHttpAdapter implements HttpAdapter {
+    private readonly fetchImpl;
+    constructor(fetchImpl?: typeof fetch);
+    request(request: HttpAdapterRequest): Promise<Response>;
+}
+/** Adds safe, configurable lifecycle logging to any HTTP adapter. */
+declare class LoggingHttpAdapter implements HttpAdapter {
+    private readonly adapter;
+    private readonly options;
+    constructor(adapter: HttpAdapter, options: HttpLoggerOptions);
+    request(request: HttpAdapterRequest): Promise<Response>;
+    private log;
+}
+
+/**
+ * Security methods active on the user's account, as returned in the
+ * `security` field of `GET /auth/me` and `POST /auth/validate`.
+ */
+interface SecurityMethods {
+    /** A password is set (false for accounts created only through SSO or magic link). */
+    password: boolean;
+    /** Authenticator app (TOTP one-time codes). */
+    authenticator: boolean;
+    /** One-time codes sent by email. */
+    emailCode: boolean;
+    /** At least one passkey registered. */
+    passkey: boolean;
+    passkeyCount: number;
+    /** Unused recovery codes left. */
+    recoveryCodes: number;
+    /** SSO providers linked to the account, e.g. `["google", "github"]`. */
+    sso: string[];
+    /** Any second factor is active (authenticator, email code or passkey). */
+    twoFactor: boolean;
+}
+/** Lifecycle of an approval. */
+type ApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+/**
+ * Free-form JSON object describing what the customer approves (up to 16 KiB).
+ * The API stores it, shows it back to the customer and binds its canonical
+ * hash (keys sorted) to the approval.
+ */
+type ApprovalPayload = Record<string, unknown>;
+/** Evidence of how the customer proved their identity when approving. */
+interface ApprovalAssurance {
+    /** `urn:authyon:loa:3` (passkey) or `urn:authyon:loa:2` (authenticator code). */
+    acr: string;
+    /** Authentication methods, e.g. `["pwd", "otp"]` or `["pwd", "webauthn"]`. */
+    amr: string[];
+    /** When the second factor was verified (ISO 8601). */
+    authTime: string;
+}
+/** A request for the customer to approve something with a second factor. */
+interface Approval {
+    id: string;
+    status: ApprovalStatus;
+    subjectId: string;
+    tenantId?: string | null;
+    /** The payload given to `create()`, with keys in canonical order. */
+    payload: ApprovalPayload;
+    /** SHA-256 (hex) of the canonical payload. */
+    payloadHash: string;
+    createdAt: string;
+    expiresAt: string;
+    decidedAt?: string | null;
+    consumedAt?: string | null;
+    /** Present once approved. */
+    assurance?: ApprovalAssurance | null;
+}
+/** Second factor sent with `confirm()`. */
+type ConfirmApprovalInput = {
+    method: "authenticator";
+    /** Six-digit code from the customer's authenticator app. */
+    code: string;
+} | {
+    method: "webauthn";
+    /** Assertion for the options returned by `webauthnOptions()`. */
+    webAuthn: {
+        ceremonyToken: string;
+        /** JSON-serialized `PublicKeyCredential` from `navigator.credentials.get()`. */
+        assertionJson: string;
+    };
+};
+/** Passkey assertion options for approving one approval. */
+interface ApprovalWebAuthnOptions {
+    ceremonyToken: string;
+    /** JSON `PublicKeyCredentialRequestOptions` to pass to `navigator.credentials.get()`. */
+    optionsJson: string;
+}
+
+interface PaginationOptions {
+    skip?: number;
+    take?: number;
+}
+/**
+ * The envelope every paged endpoint answers with.
+ *
+ * `page` is the 1-based current page and `perPage` is how many items a page
+ * holds — the same sense `take` has on the way in. Up to Authyon API
+ * 2026-10-21 the two were named `perPage` (holding the page number) and
+ * `pageSize` (holding the limit), so reading them by their names gave the
+ * wrong value without failing. Clients on the older API see `page` undefined
+ * and `perPage` holding a page number.
+ */
+interface Paged<T> {
+    data: T[];
+    page: number;
+    perPage: number;
+    total: number;
+    pages: number;
+    hasNext: boolean;
+    hasPrev: boolean;
+}
+interface IntrospectResult {
+    active: boolean;
+    sub?: string;
+    username?: string | null;
+    email?: string | null;
+    roles?: string[] | null;
+    permissions?: string[];
+    client_id?: string;
+    scope?: string;
+    exp?: number;
+    iat?: number;
+    jti?: string;
+    token_type?: string;
+}
+
+/** GET/POST /env/tenants — confirmed against the live API. */
+interface Organization {
+    id: string;
+    slug: string;
+    name?: string;
+    description?: string | null;
+    environmentId?: string;
+    workspaceId?: string;
+    isDisabled?: boolean;
+    memberCount?: number;
+    createdAt?: string;
+    updatedAt?: string;
+    /** JSON-encoded values for the tenant's configured custom fields. */
+    customFields?: string;
+    /** JSON-encoded metadata that may be exposed to tenant members. */
+    publicMetadata?: string;
+    /** JSON-encoded metadata available only through administrative APIs. */
+    privateMetadata?: string;
+}
+/** One of a user's tenant memberships, as embedded in `EnvironmentUser.tenantMemberships`. */
+interface TenantMembership {
+    tenantId: string;
+    tenantSlug: string;
+    tenantName: string;
+    tenantDisabled: boolean;
+    roles: string[];
+}
+/** Lightweight user shape returned by `introspect()`/`validate()`. */
+interface User {
+    id: string;
+    email: string;
+    username?: string;
+    /** Environment-level roles from the database-validated user profile. */
+    roles?: string[];
+    permissions?: string[];
+    /** Security methods active on the account (authenticator, email code, passkey, SSO…). */
+    security?: SecurityMethods;
+}
+interface RoleGrant {
+    role: string;
+    expiresAt?: string | null;
+}
+/**
+ * Full user record from the EnvironmentManagement plane
+ * (`environment.users.get()` / `.list()`), confirmed against the live API.
+ * `get()` returns every field below; `list()` returns a subset (no
+ * `failedLoginAttempts`, `lockedOutUntil`, `roleGrants`,
+ * `directPermissions`, `effectivePermissions`, `refreshTokens`,
+ * `tenantMemberships`, `totpConfirmedAt`, `emailOtpEnabledAt`,
+ * `remainingRecoveryCodes`, `disableReason`, `suspension`, `deleteReason`,
+ * `customFields` — and `suspendedUntil` instead of `suspension`).
+ */
+interface EnvironmentUser {
+    id: string;
+    email: string;
+    username?: string;
+    firstName?: string | null;
+    lastName?: string | null;
+    emailConfirmed: boolean;
+    isDisabled: boolean;
+    createdAt: string;
+    lastLoginAt?: string | null;
+    failedLoginAttempts?: number;
+    lockedOutUntil?: string | null;
+    roles: string[];
+    roleGrants?: RoleGrant[];
+    directPermissions?: string[];
+    effectivePermissions?: string[];
+    /** Confirmed shape unknown — empty in every response seen so far. */
+    refreshTokens?: unknown[];
+    tenantIds: string[];
+    tenantMemberships?: TenantMembership[];
+    /** Flattened role names across all tenant memberships (list() only).
+     *  On `tenants.members.list()` it is scoped to that one tenant. */
+    tenantRoles?: string[];
+    /** Permissions granted to this member directly inside the tenant, beside
+     *  whatever their tenant roles carry. Only `tenants.members.list()` fills
+     *  it; absent on an API older than 2026-10-21. */
+    tenantPermissions?: string[];
+    twoFactorMethods: string[];
+    totpConfirmedAt?: string | null;
+    emailOtpEnabledAt?: string | null;
+    remainingRecoveryCodes?: number;
+    disableReason?: string | null;
+    suspension?: unknown | null;
+    suspendedUntil?: string | null;
+    deletedAt?: string | null;
+    deleteReason?: string | null;
+    /** JSON-encoded string. */
+    customFields?: string;
+}
+/**
+ * POST /auth/validate — confirmed against the live API. The wire shape is
+ * `{ valid, reason, profile }`, not `{ user, organization }` as the
+ * OpenAPI schema (which didn't document response bodies) suggested.
+ * `profile` is `null` for machine tokens (there's no user behind them) and
+ * for tokens that fail validation.
+ */
+interface ValidateResult {
+    valid: boolean;
+    reason?: string | null;
+    user: User | null;
+}
+/**
+ * A role available within an environment or one of its tenants. Confirmed
+ * live: system roles carry no `id`/`description` (only `name` +
+ * `permissions`) — both are only populated for custom roles you create.
+ */
+interface Role {
+    id?: string | null;
+    name: string;
+    description?: string | null;
+    permissions: string[];
+}
+interface RoleInput {
+    name: string;
+    description?: string;
+    permissions?: string[];
+}
+/**
+ * GET /env/roles and GET /tenant/roles group results by origin instead of
+ * returning a flat array — confirmed live for the environment endpoint.
+ */
+interface RoleList {
+    custom: Role[];
+    system: Role[];
+}
+/** A permission entry as it appears nested under a role in `PermissionsByRole`. */
+interface Permission {
+    value: string;
+    description?: string | null;
+    /** Confirmed live: `null` for the built-in catalog: no separate id per entry. */
+    catalogId?: string | null;
+}
+/** A role entry as returned by GET /env/permissions, with its permissions nested. */
+interface RolePermissions {
+    roleId: string | null;
+    name: string;
+    description?: string | null;
+    isSystem: boolean;
+    permissions: Permission[];
+}
+/** GET /env/permissions — confirmed live: grouped by role, plus any orphaned entries. */
+interface PermissionsByRole {
+    roles: RolePermissions[];
+    orphans: Permission[];
+}
+/** GET /permissions/reserved — confirmed live: wrapped, not a bare string array. */
+interface ReservedPermissions {
+    namespace: string;
+    items: string[];
+}
+interface CreatePermissionInput {
+    value: string;
+    description?: string;
+    /** Attach the new permission to this role immediately. */
+    attachToRoleId?: string;
+}
+interface CreateOrganizationInput {
+    name: string;
+    slug: string;
+    description?: string;
+    customFields?: Record<string, unknown>;
+    publicMetadata?: Record<string, unknown>;
+    privateMetadata?: Record<string, unknown>;
+}
+interface UpdateOrganizationInput {
+    name: string;
+    description?: string;
+    customFields?: Record<string, unknown>;
+}
+interface CreateUserInput {
+    email: string;
+    /**
+     * Same contract as `/auth/register`: optional only when the environment's
+     * username policy is `AutoFromEmail` (derived from the email). Collisions
+     * resolve by that policy.
+     */
+    username?: string;
+    password: string;
+    firstName?: string;
+    lastName?: string;
+    /** Values for custom user fields configured in the environment. */
+    customFields?: Record<string, unknown>;
+    emailConfirmed?: boolean;
+    roles?: string[];
+    /** Tenants (organizations) to add the user to on creation. */
+    tenantIds?: string[];
+}
+/** GET /env/audit — one audit-trail entry, confirmed against the live API. */
+interface AuditEvent {
+    id: string;
+    occurredAt: string;
+    eventType: string;
+    /** JSON-encoded string — `JSON.parse` it for the event-specific payload. */
+    payloadJson?: string;
+    workspaceId?: string;
+    environmentId?: string;
+    actorUserId?: string | null;
+    actorType?: string;
+    actorIp?: string;
+    userAgent?: string;
+    tenantId?: string | null;
+}
+/**
+ * GET /env/audit/login-activity. Not confirmed with a populated example
+ * live (the test environment had none) — assumed to share `AuditEvent`'s
+ * shape, since login activity is the same underlying audit-event stream
+ * filtered to sign-in events.
+ */
+type LoginActivity = AuditEvent;
+/**
+ * Envelope every `skip`/`take`-paginated list endpoint returns, confirmed
+ * live for `/env/users`, `/env/audit` and `/env/audit/login-activity`.
+ * Endpoints without `skip`/`take` params return a bare array instead.
+ */
+/** Tenant credential metadata. Listing never returns the secret. */
+interface TenantCredentialSummary {
+    id: string;
+    clientId: string;
+    description: string | null;
+    createdAt: string;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+    expiresAt: string | null;
+    isActive: boolean;
+    permissions: string[];
+}
+/** Input for a tenant machine credential. Requires at least one explicit permission. */
+interface CreateTenantCredentialInput {
+    description: string;
+    /** Number of days until the tenant credential expires. Omit for no automatic expiration. */
+    lifetimeDays?: number | null;
+    permissions: string[];
+}
+/** The plaintext secret is returned only when the credential is issued. */
+interface TenantCredentialIssued {
+    credentialId: string;
+    clientId: string;
+    clientSecret: string;
+    createdAt: string;
+    expiresAt: string | null;
+    permissions: string[];
+}
+/** OAuth 2.0 client-credentials pair minted in the Authyon console. */
+interface ClientCredentials {
+    clientId: string;
+    clientSecret: string;
+}
+/** Standard OAuth 2.0 client-credentials token response. */
+interface TokenResult {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    scope?: string;
+}
+/** POST /tenant/auth/validate — validates the current tenant-client bearer. */
+interface TenantClientValidationResult {
+    valid: boolean;
+    reason?: string | null;
+    tenantId: string;
+    workspaceId: string;
+    environmentId: string;
+    credentialId: string;
+    clientId: string;
+    permissions: string[];
+}
+interface JsonWebKeySet {
+    keys: Record<string, unknown>[];
+}
+interface OpenIdConfiguration {
+    issuer: string;
+    jwks_uri: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    [key: string]: unknown;
+}
+interface AuthyonServerClientOptions {
+    /**
+     * Publishable environment key (`pk_live_...` / `pk_test_...`), sent as
+     * `X-Authyon-Environment`. Required on **every** call — it selects the
+     * environment (Test / Live) that a request applies to, independently of
+     * whichever bearer token authenticates it.
+     */
+    envKey?: string;
+    /**
+     * Environment-level OAuth client credentials (`ec_...` / secret), minted
+     * in the console. Required for everything under `environment.*` and
+     * `permissions.*` — the SDK exchanges them for a short-lived access token
+     * via `POST /env/oauth/token` and refreshes it transparently.
+     */
+    clientId?: string;
+    clientSecret?: string;
+    /**
+     * Originating end-user IP to forward on every API call as `X-Forwarded-For`.
+     * Only set this from infrastructure you trust; the SDK rejects comma-separated
+     * or whitespace-containing values to avoid forwarded-header injection.
+     */
+    clientIp?: string;
+    /** API origin. Defaults to `https://api.authyon.com`. */
+    baseUrl?: string;
+    /** Allow an HTTP `baseUrl`. Intended only for explicitly trusted local development. */
+    allowInsecureHttp?: boolean;
+    /** Maximum duration of each HTTP request. Defaults to 15 seconds; set to `0` to disable. */
+    timeoutMs?: number;
+    /** Custom HTTP adapter for tracing, mocks or an alternative HTTP stack. */
+    httpAdapter?: HttpAdapter;
+    /** Safe HTTP lifecycle logging. Disabled unless this option is provided with `enabled: true`. */
+    httpLogger?: HttpLoggerOptions;
+    /** @deprecated Prefer `httpAdapter: new FetchHttpAdapter(customFetch)`. */
+    fetch?: typeof fetch;
+}
+
+/** A token of the requested authentication plane, or a provider called for each request. */
+type AccessTokenSource = string | (() => string | Promise<string>);
+interface CredentialListOptions extends PaginationOptions {
+    search?: string;
+}
+/** scopes is an alias for permissions. Always supply an explicit, nonempty set. */
+type CredentialPermissionsInput = {
+    permissions: readonly string[];
+    scopes?: never;
+} | {
+    scopes: readonly string[];
+    permissions?: never;
+};
+type CreateCredentialInput = CredentialPermissionsInput & {
+    description?: string;
+    lifetimeDays?: number | null;
+};
+interface CredentialCreator {
+    id: string | null;
+    type: string;
+    displayName: string | null;
+}
+interface CredentialDetail extends TenantCredentialSummary {
+    createdBy: CredentialCreator | null;
+    updatedAt: string | null;
+    secretRotatedAt: string | null;
+    expiresAt: string | null;
+    ageSeconds: number;
+    /** Null while active; elapsed lifetime at revocation otherwise. */
+    lifetimeSeconds: number | null;
+    accessTokenLifetimeSeconds: number;
+}
+interface InviteTenantMemberInput {
+    email: string;
+    roles?: string[];
+}
+interface TenantMember {
+    userId: string;
+    email: string;
+    username: string;
+    roles: string[];
+    createdAt: string;
+    lastLoginAt: string | null;
+}
+type TenantMemberPage = Paged<TenantMember>;
+/**
+ * Invite an address to a tenant. The address may not have an account in the
+ * environment yet — accepting creates it. `sendEmail` defaults to `true`;
+ * `false` only returns the link, for delivery through your own channel.
+ */
+interface TenantInviteInput {
+    email: string;
+    roles?: string[];
+    sendEmail?: boolean;
+    /**
+     * Where to send the invitee after they accept. Must be registered exactly in
+     * the environment's redirect URIs (the same list SSO and magic link use);
+     * otherwise the API rejects the invite. Comes back on `preview` and `accept`.
+     */
+    redirectUri?: string;
+}
+/** POST /env/password-resets — issue a reset for an account of the environment. */
+interface IssuePasswordResetInput {
+    email: string;
+    /**
+     * Where to send the person after they change the password. Must be
+     * registered exactly in the environment's redirect URIs; otherwise the API
+     * rejects with `user.password_reset.redirect_uri.not_allowed`.
+     */
+    redirectUri?: string;
+    /**
+     * `true` has Authyon mail the link as well. Defaults to `false`: the point
+     * of this call is to deliver the token through your own e-mail.
+     */
+    sendEmail?: boolean;
+}
+/** Returned when a reset is issued. `token` is only ever readable here — the
+ *  API keeps its hash. Whoever holds it can set the password: send it only to
+ *  the account's own address and never log it. */
+interface PasswordResetIssued {
+    userId: string;
+    email: string;
+    token: string;
+    /** The link Authyon's own e-mail would carry: the environment's reset page
+     *  when it has one, the hosted page otherwise. */
+    resetUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+/** What a live reset token is for. */
+interface PasswordResetPreview {
+    email: string;
+    expiresAt: string;
+    redirectUri: string | null;
+}
+/** The password is changed. Following `redirectUri` is up to you. */
+interface PasswordResetCompleted {
+    redirectUri: string | null;
+}
+/** Returned when an invite is created or re-issued. `acceptUrl` is only ever
+ *  readable here — the API keeps a hash of the token, not the token. */
+interface TenantInviteIssued {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    acceptUrl: string;
+    expiresAt: string;
+    emailSent: boolean;
+    redirectUri: string | null;
+}
+type TenantInviteStatus = "pending" | "accepted" | "revoked" | "expired";
+interface TenantInvite {
+    id: string;
+    tenantId: string;
+    email: string;
+    roles: string[];
+    status: TenantInviteStatus;
+    createdAt: string;
+    expiresAt: string;
+    emailSentAt: string | null;
+    acceptedAt: string | null;
+    acceptedByUserId: string | null;
+    revokedAt: string | null;
+    invitedByUserId: string | null;
+    redirectUri: string | null;
+}
+/** What an accept page shows before the invitee commits. */
+interface TenantInvitePreview {
+    tenantId: string;
+    tenantName: string;
+    email: string;
+    roles: string[];
+    expiresAt: string;
+    /** True: accepting only needs the token. False: send a password (and a username when `usernameRequired`). */
+    accountExists: boolean;
+    usernameRequired: boolean;
+    /** Where the issuer asked to send the invitee after accepting, or `null`. */
+    redirectUri: string | null;
+}
+/**
+ * Redeem an invite. For an address that already has an account only `token`
+ * and the metadata are used; the rest is for creating the account.
+ */
+interface AcceptTenantInviteInput {
+    token: string;
+    username?: string;
+    password?: string;
+    firstName?: string;
+    lastName?: string;
+    /**
+     * @deprecated Use `publicMetadata` / `privateMetadata`. Still sent and
+     * validated against the environment's user field schema for now.
+     */
+    customFields?: Record<string, unknown>;
+    /**
+     * Replaces the user's public metadata (readable by the user). Requires the
+     * client credentials (`clientId`/`clientSecret`) with `authyon:users:write`:
+     * when this or `privateMetadata` is set, `accept` calls
+     * `POST /env/tenant-invites/accept` instead of the public route.
+     */
+    publicMetadata?: Record<string, unknown>;
+    /** Replaces the user's private metadata (server-only). Same requirement as `publicMetadata`. */
+    privateMetadata?: Record<string, unknown>;
+}
+interface TenantInviteAccepted {
+    tenantId: string;
+    tenantName: string;
+    userId: string;
+    accountCreated: boolean;
+    /** Where the issuer asked to send the invitee, or `null`. Redirecting is up to the accept page. */
+    redirectUri: string | null;
+}
+
+type QueryParams = object;
+
+type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+interface JsonRequestOptions {
+    method?: HttpMethod;
+    body?: unknown;
+    query?: QueryParams;
+    headers?: Record<string, string>;
+}
+
+type ManagementRequest = <T>(path: string, options?: JsonRequestOptions) => Promise<T>;
+
+/** Customer-side operations on an approval (`/auth/authorizations`). */
+interface SubjectApprovals {
+    /** GET /auth/authorizations/{id} — the pending payload, to show before asking for the code. */
+    get(id: string): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/webauthn/options — passkey options for approving it. */
+    webauthnOptions(id: string): Promise<ApprovalWebAuthnOptions>;
+    /**
+     * POST /auth/authorizations/{id}/confirm — approves it.
+     *
+     * Pass the authenticator code or passkey assertion to verify the second
+     * factor inline (recommended). Without `input`, the session itself must
+     * have used a passkey or authenticator code within the last 5 minutes,
+     * otherwise the API answers `step_up_required`.
+     */
+    confirm(id: string, input?: ConfirmApprovalInput): Promise<Approval>;
+    /** POST /auth/authorizations/{id}/reject — the customer declines it. */
+    reject(id: string): Promise<Approval>;
+}
+/** The `security` namespace an end-user client exposes. */
+interface SubjectSecurity {
+    /**
+     * GET /auth/me — which security methods the signed-in user has active
+     * (password, authenticator, email code, passkeys, recovery codes, SSO).
+     */
+    methods(): Promise<SecurityMethods>;
+    /** Approve or reject what your backend asked the customer to confirm. */
+    readonly approvals: SubjectApprovals;
+}
+
+/** End-user operations require a user token and the environment publishable key. */
+declare class UserScopedClient {
+    #private;
+    /** @hidden */
+    constructor(request: ManagementRequest, token: AccessTokenSource);
+    /**
+     * The customer's side of `security.approvals`, for backends (BFF) that hold
+     * the customer's access token: `get`, `webauthnOptions`, `confirm`, `reject`.
+     */
+    readonly security: SubjectSecurity;
+    readonly tenants: {
+        members: {
+            list: (tenantId: string, options?: PaginationOptions) => Promise<TenantMemberPage>;
+            /** Adds an existing environment user by email; does not send an invitation email. */
+            invite: (tenantId: string, input: InviteTenantMemberInput) => Promise<TenantMember>;
+            remove: (tenantId: string, userId: string) => Promise<void>;
+        };
+        /**
+         * Invites by e-mail or by link, acting as the user. Requires the
+         * `tenants:members:invite` permission on the tenant.
+         */
+        invites: {
+            list: (tenantId: string) => Promise<TenantInvite[]>;
+            /** Always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+            create: (tenantId: string, input: TenantInviteInput) => Promise<TenantInviteIssued>;
+            /** New link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+            resend: (tenantId: string, inviteId: string, input?: {
+                sendEmail?: boolean;
+            }) => Promise<TenantInviteIssued>;
+            revoke: (tenantId: string, inviteId: string) => Promise<void>;
+        };
+    };
+}
+
+/** `security.approvals.create()` — something awaiting the customer's approval. */
+interface CreateApprovalInput {
+    /** Environment user who must approve. */
+    subjectId: string;
+    /** Any JSON object (up to 16 KiB) describing what is being approved. Default `{}`. */
+    payload?: ApprovalPayload;
+    /** Restrict approval to a session in this tenant. */
+    tenantId?: string;
+    /** Lifetime in seconds, clamped to 60–600. Default 300. */
+    expiresInSeconds?: number;
+    /**
+     * Optional. Sent as the `Idempotency-Key` header (max 128 chars): retrying
+     * with the same key and payload returns the same approval; the same key
+     * with a different payload fails with `idempotency_conflict`.
+     */
+    idempotencyKey?: string;
+}
+/** `security.approvals.consume()` — single-use redemption result. */
+interface ConsumedApproval {
+    id: string;
+    status: "consumed";
+    consumedAt: string;
+    /** The approved payload — execute exactly this. */
+    payload: ApprovalPayload;
+    payloadHash: string;
+    assurance: ApprovalAssurance | null;
+}
+/** `security.otp.check()` result. */
+type OtpCheckResult = {
+    valid: true;
+    userId: string;
+    /** Always `"otp"` (authenticator app). */
+    method: string;
+    verifiedAt: string;
+} | {
+    valid: false;
+    /**
+     * Wrong codes left before the first consequence: the sign-out (3 in a
+     * row) or the 15-minute lock (5). `0` when the user was just signed out.
+     */
+    attemptsRemaining: number;
+    /**
+     * True when this was the 3rd wrong code in a row (counted across login
+     * 2FA, `security.otp.check` and `security.approvals.confirm`): every
+     * session of the user was ended and they must sign in again.
+     */
+    sessionsRevoked?: boolean;
+};
+
+interface ClientRequestContext {
+    /** Real end-user IP, resolved only from infrastructure trusted by the application. */
+    clientIp?: string;
+}
+/** Rejects header injection and values that are not a single IPv4 or IPv6 address. */
+declare function normalizeClientIp(value: string): string;
+
+type SafeJwtAlgorithm = "RS256" | "PS256" | "ES256" | "EdDSA";
+interface AuthyonJwtClaims extends JWTPayload {
+    sub: string;
+    iss: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    email?: string;
+    username?: string;
+    roles?: string[];
+    permissions?: string[];
+    scope?: string;
+}
+interface VerifiedAccessToken {
+    claims: AuthyonJwtClaims;
+    protectedHeader: JWSHeaderParameters;
+}
+interface JwksTokenVerifierOptions {
+    /** Exact trusted issuer from Authyon OpenID discovery. */
+    issuer: string;
+    /** Audience assigned to the API consuming this token. */
+    audience: string | string[];
+    /** Trusted HTTPS JWKS endpoint. Never derive this value from the token header. */
+    jwksUri?: string;
+    /** Static trusted keys for pinned or offline verification. */
+    jwks?: JSONWebKeySet;
+    algorithms?: readonly SafeJwtAlgorithm[];
+    acceptedTokenTypes?: readonly string[];
+    clockToleranceSeconds?: number;
+    maxTokenAgeSeconds?: number;
+    jwksTimeoutMs?: number;
+    jwksCacheMs?: number;
+    jwksCooldownMs?: number;
+}
+interface AuthyonJwksDiscoveryOptions extends Omit<JwksTokenVerifierOptions, "issuer" | "jwksUri" | "jwks"> {
+    /** Optional pin; discovery fails if Authyon advertises a different issuer. */
+    issuer?: string;
+    /** Override the client environment key used by the discovery endpoint. */
+    publishableKey?: string;
+}
+type TokenVerificationErrorCode = "token.invalid" | "token.expired" | "token.not_active" | "token.invalid_claims" | "token.invalid_signature" | "token.key_unavailable";
+declare class TokenVerificationError extends Error {
+    readonly code: TokenVerificationErrorCode;
+    constructor(code: TokenVerificationErrorCode, options?: {
+        cause?: unknown;
+    });
+}
+/** Secure, cached JWT signature and claims verifier backed by a trusted remote JWKS. */
+declare class JwksTokenVerifier {
+    private readonly options;
+    private readonly verifyKey;
+    private readonly algorithms;
+    private readonly acceptedTokenTypes;
+    constructor(options: JwksTokenVerifierOptions);
+    verifyAccessToken(token: string): Promise<VerifiedAccessToken>;
+}
+
+/**
+ * Server-side Authyon client: environment/tenant administration (OAuth
+ * client-credentials) plus access-token verification (publishable key).
+ * Never import this in browser code — client secrets must stay on your
+ * server.
+ */
+declare class AuthyonServerClient {
+    #private;
+    private readonly envKey?;
+    private readonly clientId?;
+    private readonly clientIp?;
+    private readonly transport;
+    private readonly http;
+    private readonly environmentTokenProvider;
+    constructor(options?: AuthyonServerClientOptions);
+    private request;
+    /** Mints (and caches) an environment access token from `clientId`/`clientSecret`. */
+    private getEnvironmentAccessToken;
+    readonly discovery: {
+        /** GET /.well-known/jwks.json — the environment's public signing keys. */
+        jwks: (publishableKey?: string) => Promise<JsonWebKeySet>;
+        /** GET /.well-known/openid-configuration — OIDC discovery document. */
+        openidConfiguration: (publishableKey?: string) => Promise<OpenIdConfiguration>;
+    };
+    /** Discovers Authyon's trusted issuer/JWKS and creates a cached local access-token verifier. */
+    createJwksTokenVerifier(options: AuthyonJwksDiscoveryOptions): Promise<JwksTokenVerifier>;
+    /** POST /auth/introspect — lightweight token introspection (RFC 7662). */
+    introspect(token: string, context?: ClientRequestContext): Promise<IntrospectResult>;
+    /** POST /auth/validate — recommended: cross-checks DB state, catches revocation immediately. */
+    validate(token: string, context?: ClientRequestContext): Promise<ValidateResult>;
+    readonly environmentAuth: {
+        /** POST /env/oauth/token — exchanges environment client credentials for an access token. */
+        token: (credentials: ClientCredentials) => Promise<TokenResult>;
+    };
+    readonly tenantAuth: {
+        /** POST /tenant/oauth/token — exchanges a tenant's client credentials for a scoped access token. */
+        token: (credentials: ClientCredentials) => Promise<TokenResult>;
+        /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+        validate: (accessToken: string, context?: ClientRequestContext) => Promise<TenantClientValidationResult>;
+    };
+    /**
+     * Scopes a client to a single tenant's OAuth credentials — mints and
+     * caches its access token independently of the environment plane. Use
+     * this for the `TenantManagement` endpoints (`/tenant/...`), which act on
+     * "the token's tenant" rather than one you pass by id.
+     */
+    tenant(credentials: ClientCredentials): TenantScopedClient;
+    /** Uses an end-user token; the configured environment key selects the environment. */
+    user(token: AccessTokenSource): UserScopedClient;
+    readonly environment: {
+        users: {
+            /** GET /env/users — paginated list of users in the environment. */
+            list: (params?: {
+                search?: string;
+            } & PaginationOptions) => Promise<Paged<EnvironmentUser>>;
+            /** POST /env/users — create a user in the environment; returns only the new id. */
+            create: (input: CreateUserInput) => Promise<{
+                id: string;
+            }>;
+            /** GET /env/users/{userId} — fetch an environment user by id. */
+            get: (userId: string) => Promise<EnvironmentUser>;
+            /** POST /env/users/{userId}/roles — grant a role to an environment user. */
+            assignRole: (userId: string, role: string) => Promise<void>;
+            /** DELETE /env/users/{userId}/roles/{role} — revoke a role from an environment user. */
+            removeRole: (userId: string, role: string) => Promise<void>;
+            /** POST /env/users/{userId}/permissions — grant a direct permission to an environment user. */
+            grantPermission: (userId: string, permission: string) => Promise<void>;
+            /** DELETE /env/users/{userId}/permissions/{permission} — revoke a direct permission. */
+            revokePermission: (userId: string, permission: string) => Promise<void>;
+            /** POST /env/users/{userId}/unlock — clears an environment user's lockout. */
+            unlock: (userId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/password — sets a new password for the user. */
+            setPassword: (userId: string, newPassword: string, reason?: string) => Promise<void>;
+            /**
+             * POST /env/password-resets — issues a password-reset token for the
+             * account with this address and returns it, so your application can
+             * deliver it in its own e-mail instead of Authyon's. Needs the
+             * `authyon:users:password` scope. Unlike the public forgot-password
+             * request, an unknown address rejects with `user.not_found` (404).
+             * A previous live token for the same account stops working.
+             */
+            issuePasswordReset: (input: IssuePasswordResetInput) => Promise<PasswordResetIssued>;
+            /**
+             * POST /auth/password-reset/validate — for a backend hosting the reset
+             * page: checks a token without spending it. Public, needs only the
+             * `envKey`. Rejects with `user.password_reset.invalid` (401) when the
+             * token is unknown, used or expired.
+             */
+            validatePasswordReset: (token: string) => Promise<PasswordResetPreview>;
+            /**
+             * POST /auth/password-reset/confirm — redeems the token and sets the new
+             * password (every session of the account is signed out). Public, needs
+             * only the `envKey`. Resolves with the `redirectUri` the reset was issued
+             * with, or `null`.
+             */
+            confirmPasswordReset: (token: string, newPassword: string) => Promise<PasswordResetCompleted>;
+            /** POST /env/users/{userId}/sessions/revoke-all — revokes every session the user has. */
+            revokeSessions: (userId: string, reason?: string) => Promise<void>;
+            /** DELETE /env/users/{userId}/sessions/{sessionId} — revokes a single session. */
+            revokeSession: (userId: string, sessionId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/disable — bans the user indefinitely; revokes live sessions. */
+            disable: (userId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/enable — lifts a ban. */
+            enable: (userId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/suspend — blocks the user temporarily; clears itself after `durationMinutes`. */
+            suspend: (userId: string, durationMinutes: number, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/unsuspend — lifts a suspension early. */
+            unsuspend: (userId: string, reason?: string) => Promise<void>;
+            /** POST /env/users/{userId}/tenants — adds an environment user to a tenant. */
+            assignTenant: (userId: string, tenantId: string, roles?: string[]) => Promise<void>;
+            /** DELETE /env/users/{userId}/tenants/{tenantId} — removes an environment user from a tenant. */
+            removeTenant: (userId: string, tenantId: string) => Promise<void>;
+        };
+        tenants: {
+            credentials: {
+                /** GET /env/tenants/{tenantId}/credentials. Returns metadata only, including revoked credentials. */
+                list: (tenantId: string) => Promise<TenantCredentialSummary[]>;
+                /** Paginated searchable listing. Prefer this over loading every credential. */
+                listPage: (tenantId: string, options?: CredentialListOptions) => Promise<Paged<TenantCredentialSummary>>;
+                get: (tenantId: string, credentialId: string) => Promise<CredentialDetail>;
+                /** Explicit scopes/permissions; only issuance returns the client secret. */
+                create: (tenantId: string, input: CreateTenantCredentialInput | CreateCredentialInput) => Promise<TenantCredentialIssued>;
+                /** Returns a new secret once while keeping the same client id. */
+                rotate: (tenantId: string, credentialId: string) => Promise<TenantCredentialIssued>;
+                updatePermissions: (tenantId: string, credentialId: string, input: CredentialPermissionsInput) => Promise<void>;
+                updateScopes: (tenantId: string, credentialId: string, scopes: readonly string[]) => Promise<void>;
+                revoke: (tenantId: string, credentialId: string) => Promise<void>;
+            };
+            /**
+             * GET /env/tenants — one page of the environment's tenants.
+             *
+             * `search` matches, case-insensitively and anywhere in the value, the
+             * name, the slug, the description and the raw text of both metadata
+             * documents — so a tenant filed with `{"cnpj":"00.000.000/0001-00"}`
+             * is found by the number, and `cnpj` alone finds every tenant carrying
+             * that key. `take` defaults to 25 and is capped at 100.
+             *
+             * Against an Authyon API older than 2026-10-21 this route ignored
+             * skip/take/search and answered with a bare array.
+             */
+            list: (params?: {
+                search?: string;
+            } & PaginationOptions) => Promise<Paged<Organization>>;
+            /** POST /env/tenants — create a tenant in the environment. */
+            create: (input: CreateOrganizationInput) => Promise<Organization>;
+            /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
+            get: (tenantId: string) => Promise<Organization>;
+            /** PUT /env/tenants/{tenantId} — update a tenant. */
+            update: (tenantId: string, input: UpdateOrganizationInput) => Promise<Organization>;
+            /** PUT /env/tenants/{tenantId}/metadata - replace public and private metadata. */
+            updateMetadata: (tenantId: string, input: Pick<CreateOrganizationInput, "publicMetadata" | "privateMetadata">) => Promise<void>;
+            /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+            disable: (tenantId: string) => Promise<void>;
+            /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
+            delete: (tenantId: string) => Promise<void>;
+            members: {
+                /**
+                 * GET /env/tenants/{tenantId}/members — a tenant's members as full
+                 * user records, with the same shape `environment.users.list()` items
+                 * have, plus `tenantRoles` and `tenantPermissions` scoped to this
+                 * tenant.
+                 *
+                 * Paged like every other list: the `Paged<T>` envelope carries
+                 * `total` and `hasNext`, `take` defaults to 50 and is capped at 100.
+                 * Up to the Authyon API of 2026-10-21 this one route answered with a
+                 * bare array, so a caller had to page until a short page came back;
+                 * against such an API `data` is undefined and the array is the body
+                 * itself.
+                 */
+                list: (tenantId: string, params?: PaginationOptions) => Promise<Paged<EnvironmentUser>>;
+                /** POST /env/tenants/{tenantId}/members — add a member to a tenant. */
+                add: (tenantId: string, userId: string, roles?: string[]) => Promise<void>;
+                /** DELETE /env/tenants/{tenantId}/members/{userId} — remove a member from a tenant. */
+                remove: (tenantId: string, userId: string) => Promise<void>;
+                /** POST /env/tenants/{tenantId}/members/{userId}/roles — grant a tenant role to a member. */
+                assignRole: (tenantId: string, userId: string, role: string) => Promise<void>;
+                /** DELETE .../members/{userId}/roles/{role} — revoke a tenant role from a member. */
+                removeRole: (tenantId: string, userId: string, role: string) => Promise<void>;
+                /** POST .../members/{userId}/permissions — grant a permission to a tenant member. */
+                grantPermission: (tenantId: string, userId: string, permission: string) => Promise<void>;
+                /** DELETE .../members/{userId}/permissions/{permission} — revoke a permission from a tenant member. */
+                revokePermission: (tenantId: string, userId: string, permission: string) => Promise<void>;
+            };
+            /**
+             * Invites by e-mail or by link — for addresses that may not have an
+             * account yet; accepting creates it. Managing them needs the
+             * credential's `authyon:users:write` scope (listing, `authyon:tenants:read`).
+             */
+            invites: {
+                /** GET /env/tenants/{tenantId}/invites — every invite with its status, newest first. */
+                list: (tenantId: string) => Promise<TenantInvite[]>;
+                /**
+                 * POST /env/tenants/{tenantId}/invites — invite an address. Always
+                 * returns `acceptUrl`; with `sendEmail: false` Authyon does not mail
+                 * it and you deliver the link yourself. Valid 7 days, single use, and
+                 * not readable again later.
+                 */
+                create: (tenantId: string, input: TenantInviteInput) => Promise<TenantInviteIssued>;
+                /** POST .../invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+                resend: (tenantId: string, inviteId: string, input?: {
+                    sendEmail?: boolean;
+                }) => Promise<TenantInviteIssued>;
+                /** DELETE /env/tenants/{tenantId}/invites/{inviteId} — revoke a pending invite. */
+                revoke: (tenantId: string, inviteId: string) => Promise<void>;
+                /**
+                 * POST /auth/tenant-invites/preview — for a backend hosting the accept
+                 * page. Public: needs only `envKey`, the token is the credential.
+                 */
+                preview: (token: string) => Promise<TenantInvitePreview>;
+                /**
+                 * Joins the tenant; for an address with no account, also creates it
+                 * (password required) with the e-mail already confirmed. Does not
+                 * sign the user in.
+                 *
+                 * Without metadata: POST /auth/tenant-invites/accept — public, needs
+                 * only `envKey`. With `publicMetadata`/`privateMetadata`: POST
+                 * /env/tenant-invites/accept with the environment credential
+                 * (`authyon:users:write`), since only your backend may set them.
+                 */
+                accept: (input: AcceptTenantInviteInput) => Promise<TenantInviteAccepted>;
+            };
+            roles: {
+                /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
+                list: (tenantId: string) => Promise<Role[]>;
+                /** POST /env/tenants/{tenantId}/roles — create a tenant role. */
+                create: (tenantId: string, input: RoleInput) => Promise<Role>;
+                /** GET /env/tenants/{tenantId}/roles/{roleId} — fetch a tenant role by id. */
+                get: (tenantId: string, roleId: string) => Promise<Role>;
+                /** PUT /env/tenants/{tenantId}/roles/{roleId} — update a tenant role. */
+                update: (tenantId: string, roleId: string, input: RoleInput) => Promise<Role>;
+                /** DELETE /env/tenants/{tenantId}/roles/{roleId} — delete a tenant role. */
+                delete: (tenantId: string, roleId: string) => Promise<void>;
+            };
+        };
+        roles: {
+            /** GET /env/roles — environment-level roles, grouped into custom and system-defined. */
+            list: () => Promise<RoleList>;
+            /** POST /env/roles — create an environment-level role. */
+            create: (input: RoleInput) => Promise<Role>;
+            /** PUT /env/roles/{roleId} — update an environment-level role. */
+            update: (roleId: string, input: RoleInput) => Promise<Role>;
+            /** DELETE /env/roles/{roleId} — delete an environment-level role. */
+            delete: (roleId: string) => Promise<void>;
+        };
+        permissions: {
+            /** GET /env/permissions — environment-level permissions, grouped by the role they're attached to. */
+            list: () => Promise<PermissionsByRole>;
+            /** POST /env/permissions — create an environment-level permission. */
+            create: (input: CreatePermissionInput) => Promise<Permission>;
+            /** PUT /env/permissions/{permissionId} — update an environment-level permission. */
+            update: (permissionId: string, description?: string) => Promise<Permission>;
+            /** DELETE /env/permissions/{permissionId} — delete an environment-level permission. */
+            delete: (permissionId: string) => Promise<void>;
+            /** GET /permissions/reserved — reserved permission names you can't redefine. */
+            reserved: () => Promise<ReservedPermissions>;
+        };
+        audit: {
+            /** GET /env/audit — paginated list of the environment's audit events. */
+            list: (params?: PaginationOptions) => Promise<Paged<AuditEvent>>;
+            /** GET /env/audit/login-activity — paginated login activity in the environment. */
+            loginActivity: (params?: PaginationOptions) => Promise<Paged<LoginActivity>>;
+        };
+    };
+    readonly security: {
+        otp: {
+            /**
+             * POST /env/users/{userId}/otp/verify — checks the user's authenticator
+             * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
+             * throwing. Each code is accepted once; 3 wrong codes in a row sign the
+             * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
+             * minutes (`rate_limited`). More than 50 wrong codes in 10 minutes from the
+             * same credential pause it (`credential_throttled`). Needs `authyon:otp:verify`.
+             */
+            check: (userId: string, code: string) => Promise<OtpCheckResult>;
+        };
+        /**
+         * The customer approves a payload with their authenticator code or
+         * passkey, once.
+         *
+         * 1. `create()` the approval with the payload and the customer.
+         * 2. The customer confirms it (`@authyon/auth` → `security.approvals.confirm`).
+         * 3. `consume()` it right before executing, and execute the returned payload.
+         */
+        approvals: {
+            /** POST /env/authorizations — registers a payload awaiting the customer's approval. */
+            create: (input: CreateApprovalInput) => Promise<Approval>;
+            /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
+            get: (id: string) => Promise<Approval>;
+            /**
+             * POST /env/authorizations/{id}/consume — redeems an approved approval
+             * exactly once and returns the approved payload. Pass `payload` to have
+             * the API check it matches (`payload_mismatch` otherwise).
+             */
+            consume: (id: string, payload?: ApprovalPayload) => Promise<ConsumedApproval>;
+        };
+    };
+    readonly permissions: {
+        /** POST /users/{userId}/permissions — grant a permission directly to a user. */
+        grant: (userId: string, permission: string) => Promise<void>;
+        /** DELETE /users/{userId}/permissions/{permission} — revoke a permission from a user. */
+        revoke: (userId: string, permission: string) => Promise<void>;
+    };
+    /** @internal used by {@link TenantScopedClient} to share the base URL/fetch/error handling. */
+    _requestAsTenant<T>(accessToken: string, path: string, options?: {
+        method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+        body?: unknown;
+        query?: object;
+        headers?: Record<string, string>;
+    }): Promise<T>;
+}
+/**
+ * Client scoped to a single tenant's OAuth credentials — every call acts on
+ * "the token's tenant" (`TenantManagement` endpoints), so there's no
+ * `tenantId` parameter to pass.
+ */
+declare class TenantScopedClient {
+    private readonly server;
+    private readonly tokenProvider;
+    constructor(server: AuthyonServerClient, credentials: ClientCredentials);
+    private getAccessToken;
+    private request;
+    /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
+    validate(context?: ClientRequestContext): Promise<TenantClientValidationResult>;
+    /** Invites to the token's tenant, by e-mail or by link. */
+    readonly invites: {
+        /** GET /tenant/invites — every invite with its status, newest first. */
+        list: () => Promise<TenantInvite[]>;
+        /** POST /tenant/invites — always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+        create: (input: TenantInviteInput) => Promise<TenantInviteIssued>;
+        /** POST /tenant/invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+        resend: (inviteId: string, input?: {
+            sendEmail?: boolean;
+        }) => Promise<TenantInviteIssued>;
+        /** DELETE /tenant/invites/{inviteId} — revoke a pending invite. */
+        revoke: (inviteId: string) => Promise<void>;
+    };
+    readonly members: {
+        /**
+         * GET /tenant/members — members of the token's tenant.
+         *
+         * Same handler as `/env/tenants/{id}/members` (the tenant comes from the
+         * token instead of the path), so the same `Paged<T>` envelope of full
+         * user records, `take` defaulting to 50 and capped at 100 — as opposed
+         * to `/auth/tenants/{id}/members`'s lightweight member shape.
+         */
+        list: (params?: PaginationOptions) => Promise<Paged<EnvironmentUser>>;
+        /** POST /tenant/members — add a member to the token's tenant. */
+        add: (userId: string, roles?: string[]) => Promise<void>;
+        /** DELETE /tenant/members/{userId} — remove a member from the token's tenant. */
+        remove: (userId: string) => Promise<void>;
+        /** POST /tenant/members/{userId}/roles — grant a role to a member of the tenant. */
+        assignRole: (userId: string, role: string) => Promise<void>;
+        /** DELETE /tenant/members/{userId}/roles/{role} — revoke a role from a member of the tenant. */
+        removeRole: (userId: string, role: string) => Promise<void>;
+        /** POST /tenant/members/{userId}/permissions — grant a permission to a member of the tenant. */
+        grantPermission: (userId: string, permission: string) => Promise<void>;
+        /** DELETE .../permissions/{permission} — revoke a permission from a member of the tenant. */
+        revokePermission: (userId: string, permission: string) => Promise<void>;
+    };
+    readonly roles: {
+        /**
+         * GET /tenant/roles — roles in the token's tenant, grouped into custom
+         * and system-defined.
+         *
+         * ⚠️ Inferred, not confirmed live (the test environment had no tenants
+         * to exchange a scoped token for) — assumed to share `/env/roles`'
+         * grouped shape, since both operate on the same underlying role model.
+         */
+        list: () => Promise<RoleList>;
+        /** POST /tenant/roles — create a role in the tenant. */
+        create: (input: RoleInput) => Promise<Role>;
+        /** GET /tenant/roles/{roleId} — fetch a tenant role by id. */
+        get: (roleId: string) => Promise<Role>;
+        /** PUT /tenant/roles/{roleId} — update a role in the tenant. */
+        update: (roleId: string, input: RoleInput) => Promise<Role>;
+        /** DELETE /tenant/roles/{roleId} — delete a role in the tenant. */
+        delete: (roleId: string) => Promise<void>;
+    };
+}
+/** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
+declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
+
+export { type RoleGrant as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type IssuePasswordResetInput as J, type JsonWebKeySet as K, JwksTokenVerifier as L, type JwksTokenVerifierOptions as M, LoggingHttpAdapter as N, type LoginActivity as O, type OpenIdConfiguration as P, type Organization as Q, type OtpCheckResult as R, type Paged as S, type PaginationOptions as T, type PasswordResetCompleted as U, type PasswordResetIssued as V, type PasswordResetPreview as W, type Permission as X, type PermissionsByRole as Y, type ReservedPermissions as Z, type Role as _, type HttpLoggerOptions as a, type RoleInput as a0, type RoleList as a1, type RolePermissions as a2, type SafeJwtAlgorithm as a3, type SecurityMethods as a4, type SubjectApprovals as a5, type SubjectSecurity as a6, type TenantClientValidationResult as a7, type TenantCredentialIssued as a8, type TenantCredentialSummary as a9, type TenantInvite as aa, type TenantInviteAccepted as ab, type TenantInviteInput as ac, type TenantInviteIssued as ad, type TenantInvitePreview as ae, type TenantInviteStatus as af, type TenantMember as ag, type TenantMemberPage as ah, type TenantMembership as ai, TenantScopedClient as aj, type TokenResult as ak, TokenVerificationError as al, type TokenVerificationErrorCode as am, type UpdateOrganizationInput as an, type User as ao, UserScopedClient as ap, type ValidateResult as aq, type VerifiedAccessToken as ar, createClient as as, normalizeClientIp as at, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };