@authyon/server 0.2.0-beta.2 → 0.2.0-beta.21

package/dist/index.cjs

@@ -3,6 +3,9 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -16,6 +19,10 @@ var __copyProps = (to, from, except, desc) => {
   return to;
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
 
 // src/index.ts
 var index_exports = {};
@@ -30,8 +37,12 @@ __export(index_exports, {
   FetchHttpAdapter: () => FetchHttpAdapter,
   JwksTokenVerifier: () => JwksTokenVerifier,
   LoggingHttpAdapter: () => LoggingHttpAdapter,
+  TENANT_FILTER_MAX_DEPTH: () => TENANT_FILTER_MAX_DEPTH,
+  TENANT_FILTER_MAX_VALUES: () => TENANT_FILTER_MAX_VALUES,
+  TENANT_FILTER_MAX_VALUE_LENGTH: () => TENANT_FILTER_MAX_VALUE_LENGTH,
   TenantScopedClient: () => TenantScopedClient,
   TokenVerificationError: () => TokenVerificationError,
+  UserScopedClient: () => UserScopedClient,
   authorizeRequest: () => authorizeRequest,
   authorizeToken: () => authorizeToken,
   createAuthorizationErrorResponse: () => createAuthorizationErrorResponse,
@@ -40,39 +51,251 @@ __export(index_exports, {
   createClient: () => createClient,
   createExpressAuthorizationMiddleware: () => createExpressAuthorizationMiddleware,
   hasPermission: () => hasPermission,
-  normalizeClientIp: () => normalizeClientIp
+  hasPermissionGroup: () => hasPermissionGroup,
+  normalizeClientIp: () => normalizeClientIp,
+  tenantFilter: () => tenantFilter
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/client/credentialManagement.ts
+function segment(value) {
+  if (typeof value !== "string" || !value.trim() || value === "." || value === ".." || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
+    throw new TypeError("Authyon: invalid route identifier.");
+  }
+  return encodeURIComponent(value);
+}
+function permissionsBody(input) {
+  if (input.permissions !== void 0 && input.scopes !== void 0) {
+    throw new TypeError("Authyon: supply permissions or scopes, not both.");
+  }
+  const values = input.permissions ?? input.scopes;
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new TypeError("Authyon: explicit credential permissions are required.");
+  }
+  const permissions = values.map((value) => {
+    if (typeof value !== "string") throw new TypeError("Authyon: invalid permission.");
+    const normalized = value.trim().toLowerCase();
+    if (!/^(?:\*|[a-z][a-z0-9_-]*):(?:\*|[a-z][a-z0-9_-]*):(?:\*|[a-z][a-z0-9_-]*)$/u.test(normalized)) {
+      throw new TypeError("Authyon: permissions must have namespace:resource:action format.");
+    }
+    return normalized;
+  });
+  return { permissions: [...new Set(permissions)] };
+}
+function lifetimeBody(input) {
+  if (input.lifetimeDays === void 0 || input.lifetimeDays === null) return {};
+  if (!Number.isInteger(input.lifetimeDays) || input.lifetimeDays < 1 || input.lifetimeDays > 3650) {
+    throw new RangeError("Authyon: lifetimeDays must be between 1 and 3650.");
+  }
+  return { lifetimeDays: input.lifetimeDays };
+}
+function credentialQuery(options = {}) {
+  const { skip, take, search } = options;
+  if (skip !== void 0 && (!Number.isInteger(skip) || skip < 0 || skip > 2147483647))
+    throw new RangeError("Authyon: invalid skip.");
+  if (take !== void 0 && (!Number.isInteger(take) || take < 1 || take > 100))
+    throw new RangeError("Authyon: take must be between 1 and 100.");
+  if (search !== void 0 && (typeof search !== "string" || search.trim().length > 200))
+    throw new RangeError("Authyon: search must contain at most 200 characters.");
+  return { search: search?.trim() || void 0, skip, take };
+}
+function credentialSummary(value) {
+  return {
+    id: value.id,
+    clientId: value.clientId,
+    description: value.description,
+    createdAt: value.createdAt,
+    lastUsedAt: value.lastUsedAt,
+    revokedAt: value.revokedAt,
+    expiresAt: value.expiresAt ?? null,
+    isActive: value.isActive,
+    permissions: [...value.permissions]
+  };
+}
+function credentialDetail(value) {
+  return {
+    ...credentialSummary(value),
+    createdBy: value.createdBy == null ? null : {
+      id: value.createdBy.id,
+      type: value.createdBy.type,
+      displayName: value.createdBy.displayName
+    },
+    updatedAt: value.updatedAt,
+    secretRotatedAt: value.secretRotatedAt,
+    expiresAt: value.expiresAt ?? null,
+    ageSeconds: value.ageSeconds,
+    lifetimeSeconds: value.lifetimeSeconds,
+    accessTokenLifetimeSeconds: value.accessTokenLifetimeSeconds
+  };
+}
+async function credentialPage(request, path2, options = {}) {
+  const query = credentialQuery(options);
+  const page = await request(path2, { query });
+  if (!page || !Array.isArray(page.data))
+    throw new TypeError("Authyon: expected a paginated credential response.");
+  return {
+    data: page.data.map(credentialSummary),
+    page: page.page,
+    perPage: page.perPage,
+    total: page.total,
+    pages: page.pages,
+    hasNext: page.hasNext,
+    hasPrev: page.hasPrev
+  };
+}
+async function allCredentials(request, path2) {
+  const result = [];
+  const seen = /* @__PURE__ */ new Set();
+  let skip = 0;
+  for (let iteration = 0; iteration < 1e3; iteration++) {
+    const page = await request(
+      path2,
+      iteration === 0 ? {} : { query: { skip, take: 100 } }
+    );
+    if (Array.isArray(page)) {
+      if (iteration !== 0)
+        throw new Error("Authyon: credential pagination changed during listing.");
+      return page.map(credentialSummary);
+    }
+    if (!page || !Array.isArray(page.data))
+      throw new TypeError("Authyon: invalid credential page.");
+    for (const row of page.data) {
+      if (seen.has(row.id))
+        throw new Error("Authyon: credential pages overlapped; retry the listing.");
+      seen.add(row.id);
+      result.push(credentialSummary(row));
+    }
+    if (!page.hasNext) return result;
+    if (page.data.length === 0) throw new Error("Authyon: credential pagination made no progress.");
+    skip += page.data.length;
+  }
+  throw new Error("Authyon: use listPage for more than 1000 credential pages.");
+}
+
+// ../../internal/core/security/approvals.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: an approval id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
+function subjectSecurity(request) {
+  return {
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
+  };
+}
+
+// src/client/scopedManagementClient.ts
+function scopedRequest(request, source) {
+  return async (path2, options = {}) => {
+    const token = typeof source === "function" ? await source() : source;
+    if (typeof token !== "string" || !token.trim() || /\s/u.test(token))
+      throw new TypeError("Authyon: a valid access token is required.");
+    return request(path2, {
+      ...options,
+      headers: { ...options.headers, Authorization: `Bearer ${token}` }
+    });
+  };
+}
+var _request;
+var UserScopedClient = class {
+  /** @hidden */
+  constructor(request, token) {
+    __privateAdd(this, _request);
+    this.tenants = {
+      members: {
+        list: (tenantId, options = {}) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members`, { query: options }),
+        /** Adds an existing environment user by email; does not send an invitation email. */
+        invite: (tenantId, input) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members`, {
+          method: "POST",
+          body: { email: input.email, roles: input.roles }
+        }),
+        remove: (tenantId, userId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/members/${segment(userId)}`, {
+          method: "DELETE"
+        })
+      },
+      /**
+       * Invites by e-mail or by link, acting as the user. Requires the
+       * `tenants:members:invite` permission on the tenant.
+       */
+      invites: {
+        list: (tenantId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`),
+        /** Always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+        create: (tenantId, input) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites`, {
+          method: "POST",
+          body: {
+            email: input.email,
+            roles: input.roles,
+            sendEmail: input.sendEmail ?? true,
+            redirectUri: input.redirectUri
+          }
+        }),
+        /** New link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+        resend: (tenantId, inviteId, input = {}) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}/resend`, {
+          method: "POST",
+          body: { sendEmail: input.sendEmail ?? true }
+        }),
+        revoke: (tenantId, inviteId) => __privateGet(this, _request).call(this, `/auth/tenants/${segment(tenantId)}/invites/${segment(inviteId)}`, {
+          method: "DELETE"
+        })
+      }
+    };
+    __privateSet(this, _request, scopedRequest(request, token));
+    this.security = subjectSecurity(__privateGet(this, _request));
+  }
+};
+_request = new WeakMap();
+
 // ../../internal/core/config/defaults.ts
 var DEFAULT_BASE_URL = "https://api.authyon.com";
 var DEFAULT_EXPIRY_SKEW_MS = 3e4;
 
 // ../../internal/core/auth/expiringTokenProvider.ts
+var _token, _inFlight;
 var ExpiringTokenProvider = class {
   constructor(acquire, expirySkewMs = DEFAULT_EXPIRY_SKEW_MS) {
     this.acquire = acquire;
     this.expirySkewMs = expirySkewMs;
-    this.token = null;
-    this.inFlight = null;
+    __privateAdd(this, _token, null);
+    __privateAdd(this, _inFlight, null);
   }
   async getAccessToken() {
-    if (this.token && Date.now() < this.token.expiresAt - this.expirySkewMs) {
-      return this.token.accessToken;
+    if (__privateGet(this, _token) && Date.now() < __privateGet(this, _token).expiresAt - this.expirySkewMs) {
+      return __privateGet(this, _token).accessToken;
     }
-    if (this.inFlight) return this.inFlight;
-    this.inFlight = this.acquire().then((token) => {
-      this.token = token;
+    if (__privateGet(this, _inFlight)) return __privateGet(this, _inFlight);
+    __privateSet(this, _inFlight, this.acquire().then((token) => {
+      __privateSet(this, _token, token);
       return token.accessToken;
     }).finally(() => {
-      this.inFlight = null;
-    });
-    return this.inFlight;
+      __privateSet(this, _inFlight, null);
+    }));
+    return __privateGet(this, _inFlight);
   }
   clear() {
-    this.token = null;
+    __privateSet(this, _token, null);
   }
 };
+_token = new WeakMap();
+_inFlight = new WeakMap();
 
 // ../../internal/core/errors/authyonError.ts
 var ErrorCodes = {
@@ -86,16 +309,45 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -145,6 +397,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -183,14 +436,21 @@ function isRetryable(category) {
 }
 
 // ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
+function appendQuery(path2, params) {
+  if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
-    if (value2 !== void 0) query.set(key, String(value2));
+    if (value2 === void 0) continue;
+    if (Array.isArray(value2)) {
+      for (const item of value2) {
+        if (item !== void 0) query.append(key, String(item));
+      }
+      continue;
+    }
+    query.set(key, String(value2));
   }
   const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+  return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
 }
 
 // ../../internal/core/http/httpAdapter.ts
@@ -203,7 +463,8 @@ var FetchHttpAdapter = class {
       method: request.method,
       headers: request.headers,
       body: request.body,
-      signal: request.signal
+      signal: request.signal,
+      redirect: "error"
     });
   }
 };
@@ -255,6 +516,9 @@ function defaultHttpLogger(event) {
 }
 function sanitizeUrl(value) {
   const url = new URL(value);
+  url.username = "";
+  url.password = "";
+  url.hash = "";
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -284,12 +548,12 @@ function createSharedTransport(options) {
   const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
   return {
     baseUrl,
-    async request(path, init) {
+    async request(path2, init) {
       const controller = new AbortController();
       const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
       try {
         return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
+          url: `${baseUrl}${path2}`,
           method: init.method ?? "GET",
           headers: normalizeHeaders(init.headers),
           body: init.body,
@@ -347,11 +611,11 @@ var JsonHttpClient = class {
   constructor(transport) {
     this.transport = transport;
   }
-  async send(path, options = {}) {
+  async send(path2, options = {}) {
     const headers = { ...options.headers };
     if (options.body !== void 0) headers["Content-Type"] = "application/json";
     try {
-      return await this.transport.request(appendQuery(path, options.query), {
+      return await this.transport.request(appendQuery(path2, options.query), {
         method: options.method ?? "GET",
         headers,
         body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
@@ -365,7 +629,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));
@@ -373,8 +639,8 @@ var JsonHttpClient = class {
     if (response.status === 204) return void 0;
     return await response.json();
   }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
+  async request(path2, options = {}) {
+    return this.parse(await this.send(path2, options));
   }
 };
 
@@ -536,8 +802,10 @@ function isRecord(value) {
 }
 
 // src/client/authyonServerClient.ts
+var _clientSecret;
 var AuthyonServerClient = class {
   constructor(options = {}) {
+    __privateAdd(this, _clientSecret);
     // ── Discovery ──────────────────────────────────────────────────────────────
     this.discovery = {
       /** GET /.well-known/jwks.json — the environment's public signing keys. */
@@ -571,6 +839,14 @@ var AuthyonServerClient = class {
           client_id: credentials.clientId,
           client_secret: credentials.clientSecret
         }
+      }),
+      /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+      validate: (accessToken, context) => this.request("/tenant/auth/validate", {
+        method: "POST",
+        headers: {
+          ...clientIpHeaders(context),
+          Authorization: `Bearer ${accessToken}`
+        }
       })
     };
     // ── Environment management (users, tenants, roles, permissions, audit) ───
@@ -616,6 +892,39 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: { newPassword, reason }
         }),
+        /**
+         * POST /env/password-resets — issues a password-reset token for the
+         * account with this address and returns it, so your application can
+         * deliver it in its own e-mail instead of Authyon's. Needs the
+         * `authyon:users:password` scope. Unlike the public forgot-password
+         * request, an unknown address rejects with `user.not_found` (404).
+         * A previous live token for the same account stops working.
+         */
+        issuePasswordReset: (input) => this.request("/env/password-resets", {
+          method: "POST",
+          envBearer: true,
+          body: { ...input, sendEmail: input.sendEmail ?? false }
+        }),
+        /**
+         * POST /auth/password-reset/validate — for a backend hosting the reset
+         * page: checks a token without spending it. Public, needs only the
+         * `envKey`. Rejects with `user.password_reset.invalid` (401) when the
+         * token is unknown, used or expired.
+         */
+        validatePasswordReset: (token) => this.request("/auth/password-reset/validate", { method: "POST", body: { token } }),
+        /**
+         * POST /auth/password-reset/confirm — redeems the token and sets the new
+         * password (every session of the account is signed out). Public, needs
+         * only the `envKey`. Resolves with the `redirectUri` the reset was issued
+         * with, or `null`.
+         */
+        confirmPasswordReset: async (token, newPassword) => {
+          const done = await this.request(
+            "/auth/password-reset/confirm",
+            { method: "POST", body: { token, newPassword } }
+          );
+          return { redirectUri: done?.redirectUri ?? null };
+        },
         /** POST /env/users/{userId}/sessions/revoke-all — revokes every session the user has. */
         revokeSessions: (userId, reason) => this.request(`/env/users/${encodeURIComponent(userId)}/sessions/revoke-all`, {
           method: "POST",
@@ -664,7 +973,82 @@ var AuthyonServerClient = class {
         )
       },
       tenants: {
-        /** GET /env/tenants — paginated, searchable list of tenants in the environment. */
+        credentials: {
+          /** GET /env/tenants/{tenantId}/credentials. Returns metadata only, including revoked credentials. */
+          list: (tenantId) => allCredentials(
+            (path2, options) => this.request(path2, { ...options, envBearer: true }),
+            `/env/tenants/${segment(tenantId)}/credentials`
+          ),
+          /** Paginated searchable listing. Prefer this over loading every credential. */
+          listPage: (tenantId, options = {}) => credentialPage(
+            (path2, requestOptions) => this.request(path2, { ...requestOptions, envBearer: true }),
+            `/env/tenants/${segment(tenantId)}/credentials`,
+            options
+          ),
+          get: async (tenantId, credentialId) => credentialDetail(
+            await this.request(
+              `/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}`,
+              { envBearer: true }
+            )
+          ),
+          /** Explicit scopes/permissions; only issuance returns the client secret. */
+          create: (tenantId, input) => this.request(`/env/tenants/${segment(tenantId)}/credentials`, {
+            method: "POST",
+            envBearer: true,
+            body: {
+              description: input.description,
+              ...lifetimeBody(input),
+              ...permissionsBody(input)
+            }
+          }),
+          /** Returns a new secret once while keeping the same client id. */
+          rotate: (tenantId, credentialId) => this.request(
+            `/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}/rotate`,
+            { method: "POST", envBearer: true }
+          ),
+          updatePermissions: (tenantId, credentialId, input) => this.request(
+            `/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}/permissions`,
+            { method: "PUT", envBearer: true, body: permissionsBody(input) }
+          ),
+          updateScopes: (tenantId, credentialId, scopes) => this.environment.tenants.credentials.updatePermissions(tenantId, credentialId, {
+            scopes
+          }),
+          revoke: (tenantId, credentialId) => this.request(`/env/tenants/${segment(tenantId)}/credentials/${segment(credentialId)}`, {
+            method: "DELETE",
+            envBearer: true
+          })
+        },
+        /**
+         * GET /env/tenants — one page of the environment's tenants.
+         *
+         * `search` matches, case-insensitively and anywhere in the value, the
+         * name, the slug, the description and the raw text of both metadata
+         * documents — so a tenant filed with `{"cnpj":"00.000.000/0001-00"}`
+         * is found by the number, and `cnpj` alone finds every tenant carrying
+         * that key. `take` defaults to 25 and is capped at 100.
+         *
+         * `filter` is the structured half, and the one to reach for when more
+         * than one condition has to hold: each entry is a condition on a JSON
+         * document, they are ANDed with each other and with `search`, and they
+         * run inside the statement — so the envelope keeps describing the
+         * filtered set and you can page through it. Build them with
+         * `tenantFilter`:
+         *
+         * ```ts
+         * const page = await authyon.environment.tenants.list({
+         *   filter: [
+         *     tenantFilter.in("public.kind", ["reseller", "partner"]),
+         *     tenantFilter.in("custom.cnpj", [a, b]),
+         *   ],
+         *   take: 100,
+         * });
+         * ```
+         *
+         * Against an Authyon API older than 2026-10-21 this route ignored
+         * skip/take/search and answered with a bare array; one older than
+         * 2026-10-22 ignores `filter`, which reads as a page that is too wide
+         * rather than an error.
+         */
         list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
         /** POST /env/tenants — create a tenant in the environment. */
         create: (input) => this.request("/env/tenants", { method: "POST", envBearer: true, body: input }),
@@ -676,7 +1060,18 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: input
         }),
-        /** DELETE /env/tenants/{tenantId} — delete a tenant. */
+        /** PUT /env/tenants/{tenantId}/metadata - replace public and private metadata. */
+        updateMetadata: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/metadata`, {
+          method: "PUT",
+          envBearer: true,
+          body: input
+        }),
+        /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+        disable: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/disable`, {
+          method: "POST",
+          envBearer: true
+        }),
+        /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
         delete: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
           method: "DELETE",
           envBearer: true
@@ -684,10 +1079,16 @@ var AuthyonServerClient = class {
         members: {
           /**
            * GET /env/tenants/{tenantId}/members — a tenant's members as full
-           * user records. Confirmed live: a bare array (unlike
-           * `environment.users.list()`, this one does NOT paginate despite
-           * accepting `skip`/`take`), with the same shape
-           * `environment.users.list()` items have.
+           * user records, with the same shape `environment.users.list()` items
+           * have, plus `tenantRoles` and `tenantPermissions` scoped to this
+           * tenant.
+           *
+           * Paged like every other list: the `Paged<T>` envelope carries
+           * `total` and `hasNext`, `take` defaults to 50 and is capped at 100.
+           * Up to the Authyon API of 2026-10-21 this one route answered with a
+           * bare array, so a caller had to page until a short page came back;
+           * against such an API `data` is undefined and the array is the body
+           * itself.
            */
           list: (tenantId, params = {}) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/members`, {
             envBearer: true,
@@ -725,6 +1126,61 @@ var AuthyonServerClient = class {
             { method: "DELETE", envBearer: true }
           )
         },
+        /**
+         * Invites by e-mail or by link — for addresses that may not have an
+         * account yet; accepting creates it. Managing them needs the
+         * credential's `authyon:users:write` scope (listing, `authyon:tenants:read`).
+         */
+        invites: {
+          /** GET /env/tenants/{tenantId}/invites — every invite with its status, newest first. */
+          list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, { envBearer: true }),
+          /**
+           * POST /env/tenants/{tenantId}/invites — invite an address. Always
+           * returns `acceptUrl`; with `sendEmail: false` Authyon does not mail
+           * it and you deliver the link yourself. Valid 7 days, single use, and
+           * not readable again later.
+           */
+          create: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/invites`, {
+            method: "POST",
+            envBearer: true,
+            body: {
+              email: input.email,
+              roles: input.roles,
+              sendEmail: input.sendEmail ?? true,
+              redirectUri: input.redirectUri
+            }
+          }),
+          /** POST .../invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+          resend: (tenantId, inviteId, input = {}) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+            { method: "POST", envBearer: true, body: { sendEmail: input.sendEmail ?? true } }
+          ),
+          /** DELETE /env/tenants/{tenantId}/invites/{inviteId} — revoke a pending invite. */
+          revoke: (tenantId, inviteId) => this.request(
+            `/env/tenants/${encodeURIComponent(tenantId)}/invites/${encodeURIComponent(inviteId)}`,
+            { method: "DELETE", envBearer: true }
+          ),
+          /**
+           * POST /auth/tenant-invites/preview — for a backend hosting the accept
+           * page. Public: needs only `envKey`, the token is the credential.
+           */
+          preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+          /**
+           * Joins the tenant; for an address with no account, also creates it
+           * (password required) with the e-mail already confirmed. Does not
+           * sign the user in.
+           *
+           * Without metadata: POST /auth/tenant-invites/accept — public, needs
+           * only `envKey`. With `publicMetadata`/`privateMetadata`: POST
+           * /env/tenant-invites/accept with the environment credential
+           * (`authyon:users:write`), since only your backend may set them.
+           */
+          accept: (input) => input.publicMetadata !== void 0 || input.privateMetadata !== void 0 ? this.request("/env/tenant-invites/accept", {
+            method: "POST",
+            envBearer: true,
+            body: input
+          }) : this.request("/auth/tenant-invites/accept", { method: "POST", body: input })
+        },
         roles: {
           /** GET /env/tenants/{tenantId}/roles — list a tenant's roles. */
           list: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/roles`, { envBearer: true }),
@@ -794,6 +1250,60 @@ var AuthyonServerClient = class {
         loginActivity: (params = {}) => this.request("/env/audit/login-activity", { envBearer: true, query: params })
       }
     };
+    // ── Security: one-time codes and approvals ───────────────────────────────
+    //
+    // Everything here runs with the environment credential: `otp` needs the
+    // `authyon:otp:verify` scope, `approvals` needs `authyon:financial:authorize`.
+    // Keep those credentials on the server.
+    this.security = {
+      otp: {
+        /**
+         * POST /env/users/{userId}/otp/verify — checks the user's authenticator
+         * app (TOTP) code. A wrong code returns `{ valid: false }` instead of
+         * throwing. Each code is accepted once; 3 wrong codes in a row sign the
+         * user out everywhere (`sessionsRevoked: true`); 5 lock the check for 15
+         * minutes (`rate_limited`). More than 50 wrong codes in 10 minutes from the
+         * same credential pause it (`credential_throttled`). Needs `authyon:otp:verify`.
+         */
+        check: (userId, code) => this.request(`/env/users/${segment(userId)}/otp/verify`, {
+          method: "POST",
+          envBearer: true,
+          body: { code }
+        })
+      },
+      /**
+       * The customer approves a payload with their authenticator code or
+       * passkey, once.
+       *
+       * 1. `create()` the approval with the payload and the customer.
+       * 2. The customer confirms it (`@authyon/auth` → `security.approvals.confirm`).
+       * 3. `consume()` it right before executing, and execute the returned payload.
+       */
+      approvals: {
+        /** POST /env/authorizations — registers a payload awaiting the customer's approval. */
+        create: (input) => {
+          const { idempotencyKey, ...body } = input;
+          return this.request("/env/authorizations", {
+            method: "POST",
+            envBearer: true,
+            headers: idempotencyKey ? { "Idempotency-Key": idempotencyKey } : void 0,
+            body
+          });
+        },
+        /** GET /env/authorizations/{id} — current status and, once approved, the assurance evidence. */
+        get: (id) => this.request(`/env/authorizations/${segment(id)}`, { envBearer: true }),
+        /**
+         * POST /env/authorizations/{id}/consume — redeems an approved approval
+         * exactly once and returns the approved payload. Pass `payload` to have
+         * the API check it matches (`payload_mismatch` otherwise).
+         */
+        consume: (id, payload) => this.request(`/env/authorizations/${segment(id)}/consume`, {
+          method: "POST",
+          envBearer: true,
+          body: payload === void 0 ? void 0 : { payload }
+        })
+      }
+    };
     // ── Generic permission grants ─────────────────────────────────────────────
     this.permissions = {
       /** POST /users/{userId}/permissions — grant a permission directly to a user. */
@@ -810,7 +1320,8 @@ var AuthyonServerClient = class {
     };
     this.envKey = options.envKey;
     this.clientId = options.clientId;
-    this.clientSecret = options.clientSecret;
+    __privateSet(this, _clientSecret, options.clientSecret);
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -821,14 +1332,14 @@ var AuthyonServerClient = class {
     });
     this.http = new JsonHttpClient(this.transport);
     this.environmentTokenProvider = new ExpiringTokenProvider(async () => {
-      if (!this.clientId || !this.clientSecret) {
+      if (!this.clientId || !__privateGet(this, _clientSecret)) {
         throw new Error(
           "Authyon: `clientId`/`clientSecret` are required for environment management calls (mint a pair in the console, under the environment's OAuth clients)."
         );
       }
       const token = await this.environmentAuth.token({
         clientId: this.clientId,
-        clientSecret: this.clientSecret
+        clientSecret: __privateGet(this, _clientSecret)
       });
       return {
         accessToken: token.access_token,
@@ -836,13 +1347,16 @@ var AuthyonServerClient = class {
       };
     });
   }
-  async request(path, options = {}) {
-    const headers = { ...options.headers };
+  async request(path2, options = {}) {
+    const headers = {
+      ...clientIpHeaders({ clientIp: this.clientIp }),
+      ...options.headers
+    };
     if (options.envBearer) {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
     if (this.envKey) headers["X-Authyon-Environment"] = this.envKey;
-    return this.http.request(path, { ...options, headers });
+    return this.http.request(path2, { ...options, headers });
   }
   /** Mints (and caches) an environment access token from `clientId`/`clientSecret`. */
   async getEnvironmentAccessToken() {
@@ -897,26 +1411,52 @@ var AuthyonServerClient = class {
   tenant(credentials) {
     return new TenantScopedClient(this, credentials);
   }
+  /** Uses an end-user token; the configured environment key selects the environment. */
+  user(token) {
+    return new UserScopedClient((path2, options) => this.request(path2, options), token);
+  }
   /** @internal used by {@link TenantScopedClient} to share the base URL/fetch/error handling. */
-  _requestAsTenant(accessToken, path, options = {}) {
-    return this.request(path, {
+  _requestAsTenant(accessToken, path2, options = {}) {
+    return this.request(path2, {
       ...options,
       headers: { ...options.headers, Authorization: `Bearer ${accessToken}` },
       envBearer: false
     });
   }
 };
+_clientSecret = new WeakMap();
 var TenantScopedClient = class {
   constructor(server, credentials) {
+    /** Invites to the token's tenant, by e-mail or by link. */
+    this.invites = {
+      /** GET /tenant/invites — every invite with its status, newest first. */
+      list: () => this.request("/tenant/invites"),
+      /** POST /tenant/invites — always returns `acceptUrl`; `sendEmail: false` skips the e-mail. */
+      create: (input) => this.request("/tenant/invites", {
+        method: "POST",
+        body: {
+          email: input.email,
+          roles: input.roles,
+          sendEmail: input.sendEmail ?? true,
+          redirectUri: input.redirectUri
+        }
+      }),
+      /** POST /tenant/invites/{inviteId}/resend — new link (the previous one stops working), mailed unless `sendEmail` is `false`. */
+      resend: (inviteId, input = {}) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}/resend`, {
+        method: "POST",
+        body: { sendEmail: input.sendEmail ?? true }
+      }),
+      /** DELETE /tenant/invites/{inviteId} — revoke a pending invite. */
+      revoke: (inviteId) => this.request(`/tenant/invites/${encodeURIComponent(inviteId)}`, { method: "DELETE" })
+    };
     this.members = {
       /**
        * GET /tenant/members — members of the token's tenant.
        *
-       * ⚠️ Inferred, not confirmed live (no tenant client credentials
-       * available to exchange for a scoped token) — assumed to share
-       * `/env/tenants/{id}/members`'s confirmed shape (bare array of full
-       * user records), since both are the "admin" member listing as opposed
-       * to `/auth/tenants/{id}/members`'s paginated, lightweight one.
+       * Same handler as `/env/tenants/{id}/members` (the tenant comes from the
+       * token instead of the path), so the same `Paged<T>` envelope of full
+       * user records, `take` defaulting to 50 and capped at 100 — as opposed
+       * to `/auth/tenants/{id}/members`'s lightweight member shape.
        */
       list: (params = {}) => this.request("/tenant/members", { query: params }),
       /** POST /tenant/members — add a member to the token's tenant. */
@@ -975,8 +1515,12 @@ var TenantScopedClient = class {
   async getAccessToken() {
     return this.tokenProvider.getAccessToken();
   }
-  async request(path, options = {}) {
-    return this.server._requestAsTenant(await this.getAccessToken(), path, options);
+  async request(path2, options = {}) {
+    return this.server._requestAsTenant(await this.getAccessToken(), path2, options);
+  }
+  /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
+  async validate(context) {
+    return this.server.tenantAuth.validate(await this.getAccessToken(), context);
   }
 };
 function createClient(options = {}) {
@@ -984,38 +1528,124 @@ function createClient(options = {}) {
 }
 
 // src/client/authyonServerClientBuilder.ts
+var _options;
 var AuthyonServerClientBuilder = class {
   constructor() {
-    this.options = {};
+    __privateAdd(this, _options, {});
   }
   withEnvironmentKey(envKey) {
-    this.options.envKey = envKey;
+    __privateGet(this, _options).envKey = envKey;
     return this;
   }
   withEnvironmentCredentials(clientId, clientSecret) {
-    this.options.clientId = clientId;
-    this.options.clientSecret = clientSecret;
+    __privateGet(this, _options).clientId = clientId;
+    __privateGet(this, _options).clientSecret = clientSecret;
+    return this;
+  }
+  withClientIp(clientIp) {
+    __privateGet(this, _options).clientIp = clientIp;
     return this;
   }
   withBaseUrl(baseUrl, allowInsecureHttp = false) {
-    this.options.baseUrl = baseUrl;
-    this.options.allowInsecureHttp = allowInsecureHttp;
+    __privateGet(this, _options).baseUrl = baseUrl;
+    __privateGet(this, _options).allowInsecureHttp = allowInsecureHttp;
     return this;
   }
   withTimeout(timeoutMs) {
-    this.options.timeoutMs = timeoutMs;
+    __privateGet(this, _options).timeoutMs = timeoutMs;
     return this;
   }
   withHttpAdapter(httpAdapter) {
-    this.options.httpAdapter = httpAdapter;
+    __privateGet(this, _options).httpAdapter = httpAdapter;
     return this;
   }
   withHttpLogger(httpLogger) {
-    this.options.httpLogger = httpLogger;
+    __privateGet(this, _options).httpLogger = httpLogger;
     return this;
   }
   build() {
-    return new AuthyonServerClient({ ...this.options });
+    return new AuthyonServerClient({ ...__privateGet(this, _options) });
+  }
+};
+_options = new WeakMap();
+
+// src/client/tenantFilters.ts
+var TENANT_FILTER_MAX_VALUES = 25;
+var TENANT_FILTER_MAX_VALUE_LENGTH = 200;
+var TENANT_FILTER_MAX_DEPTH = 3;
+var SCOPES = ["public", "private", "custom"];
+var KEY_SEGMENT = /^[A-Za-z0-9_-]{1,64}$/;
+function assertPath(path2) {
+  if (typeof path2 !== "string" || path2.length === 0) {
+    throw new RangeError("Authyon: a filter path is required, e.g. public.kind.");
+  }
+  const [scope, ...keys] = path2.split(".");
+  if (!SCOPES.includes(scope)) {
+    throw new RangeError(
+      `Authyon: unknown filter scope "${scope}" \u2014 use ${SCOPES.join(", ")} (e.g. public.kind).`
+    );
+  }
+  if (keys.length === 0) {
+    throw new RangeError(`Authyon: filter path "${path2}" needs a key after the scope.`);
+  }
+  if (keys.length > TENANT_FILTER_MAX_DEPTH) {
+    throw new RangeError(
+      `Authyon: filter path "${path2}" goes deeper than ${TENANT_FILTER_MAX_DEPTH} levels.`
+    );
+  }
+  for (const key of keys) {
+    if (!KEY_SEGMENT.test(key)) {
+      throw new RangeError(
+        `Authyon: invalid filter key "${key}" \u2014 letters, digits, "_" and "-", up to 64 characters.`
+      );
+    }
+  }
+  return path2;
+}
+function assertValue(value, forIn) {
+  if (value === void 0 || value === null) {
+    throw new RangeError("Authyon: a filter value is required.");
+  }
+  const text = String(value);
+  if (text.length === 0) {
+    throw new RangeError("Authyon: a filter value may not be empty.");
+  }
+  if (text.length > TENANT_FILTER_MAX_VALUE_LENGTH) {
+    throw new RangeError(
+      `Authyon: a filter value may hold at most ${TENANT_FILTER_MAX_VALUE_LENGTH} characters.`
+    );
+  }
+  if (text.includes(",")) {
+    throw new RangeError(
+      forIn ? "Authyon: an `in` value may not contain a comma \u2014 pass separate values instead." : "Authyon: a filter value may not contain a comma."
+    );
+  }
+  return text;
+}
+var tenantFilter = {
+  /** `public.kind:eq:reseller` — the key equals this value. */
+  eq(path2, value) {
+    return `${assertPath(path2)}:eq:${assertValue(value, false)}`;
+  },
+  /** `public.kind:in:reseller,partner` — the key equals any of these (SQL IN). */
+  in(path2, values) {
+    if (!Array.isArray(values) || values.length === 0) {
+      throw new RangeError("Authyon: `in` needs at least one value.");
+    }
+    if (values.length > TENANT_FILTER_MAX_VALUES) {
+      throw new RangeError(`Authyon: \`in\` takes at most ${TENANT_FILTER_MAX_VALUES} values.`);
+    }
+    const unique = [...new Set(values.map((value) => assertValue(value, true)))];
+    return `${assertPath(path2)}:in:${unique.join(",")}`;
+  },
+  /** `public.notes:like:nacional` — the key contains this text, case-insensitive.
+   *  The server escapes the LIKE metacharacters, so `100%` means `100%`. */
+  like(path2, text) {
+    return `${assertPath(path2)}:like:${assertValue(text, false)}`;
+  },
+  /** `custom.cnpj:exists` — the key is present, whatever its value. */
+  exists(path2) {
+    return `${assertPath(path2)}:exists`;
   }
 };
 
@@ -1089,6 +1719,11 @@ function hasPermission(source, requiredPermission) {
   const permissionSource = isPermissionList(source) ? { permissions: source } : source;
   return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
 }
+function hasPermissionGroup(source, group) {
+  const hasAll = (group.allOf ?? []).every((permission) => hasPermission(source, permission));
+  const hasAny = !group.anyOf?.length || group.anyOf.some((permission) => hasPermission(source, permission));
+  return hasAll && hasAny;
+}
 function isPermissionList(source) {
   return Array.isArray(source);
 }
@@ -1127,25 +1762,25 @@ function matchesToken(value, expected, wildcard) {
 function matchesSegments(pattern, value) {
   const patternSegments = pattern.split(":");
   const valueSegments = value.split(":");
-  return patternSegments.length === valueSegments.length && patternSegments.every((segment, index) => segment === "*" || segment === valueSegments[index]);
+  return patternSegments.length === valueSegments.length && patternSegments.every((segment2, index) => segment2 === "*" || segment2 === valueSegments[index]);
 }
 function matchesField(pattern, field) {
   if (pattern === "*" || pattern === field) return true;
   return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
 }
 function matchesConditions(subject, conditions) {
-  return Object.entries(conditions).every(([path, expected]) => {
-    if (path === "$and" && Array.isArray(expected)) {
+  return Object.entries(conditions).every(([path2, expected]) => {
+    if (path2 === "$and" && Array.isArray(expected)) {
       return expected.every(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    if (path === "$or" && Array.isArray(expected)) {
+    if (path2 === "$or" && Array.isArray(expected)) {
       return expected.some(
         (condition) => matchesConditions(subject, condition)
       );
     }
-    return matchesValue(readPath(subject, path), expected);
+    return matchesValue(readPath(subject, path2), expected);
   });
 }
 function matchesValue(actual, expected) {
@@ -1177,8 +1812,8 @@ function matchesValue(actual, expected) {
     }
   });
 }
-function readPath(value, path) {
-  return path.split(".").reduce((current, part) => isRecord2(current) ? current[part] : void 0, value);
+function readPath(value, path2) {
+  return path2.split(".").reduce((current, part) => isRecord2(current) ? current[part] : void 0, value);
 }
 function defaultSubjectType(subject) {
   const explicit = subject.__type ?? subject.type ?? subject.kind;
@@ -1332,8 +1967,12 @@ function unauthenticated() {
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
+  TENANT_FILTER_MAX_DEPTH,
+  TENANT_FILTER_MAX_VALUES,
+  TENANT_FILTER_MAX_VALUE_LENGTH,
   TenantScopedClient,
   TokenVerificationError,
+  UserScopedClient,
   authorizeRequest,
   authorizeToken,
   createAuthorizationErrorResponse,
@@ -1342,5 +1981,7 @@ function unauthenticated() {
   createClient,
   createExpressAuthorizationMiddleware,
   hasPermission,
-  normalizeClientIp
+  hasPermissionGroup,
+  normalizeClientIp,
+  tenantFilter
 });