@authyon/server 0.2.0-beta.20 → 0.2.0-beta.21

package/README.md

@@ -359,6 +359,39 @@ completa. A concessão OAuth continua recebendo apenas `clientId`/`clientSecret`
 Todas as operações usam os endpoints externos `/env` com a credencial de
 ambiente configurada no cliente. O SDK não repete mutações automaticamente.
 
+## Filtros do tenant
+
+`search` é um substring só, ORado entre nome, slug, descrição e os dois metadata.
+Quando mais de uma condição precisa valer — `kind IN (...) AND cnpj IN (...)` — use
+`filter`, que roda dentro da consulta e por isso continua paginando:
+
+```ts
+import { tenantFilter } from "@authyon/server";
+
+const page = await authyon.environment.tenants.list({
+  filter: [
+    tenantFilter.in("public.kind", ["reseller", "partner"]),
+    tenantFilter.in("custom.cnpj", ["00000000000100", "11111111000199"]),
+  ],
+  take: 100,
+});
+
+page.total; // quantos casam com o filtro, não quantos existem no ambiente
+```
+
+Cada entrada é uma condição; várias são ANDadas entre si e com o `search`, e a
+vírgula dentro de um `in` é o OR. Os escopos são `public` (publicMetadata),
+`private` (privateMetadata) e `custom` (customFields — este o `search` nunca
+cobriu). Operadores: `eq`, `in`, `like` (ILIKE, com os metacaracteres escapados)
+e `exists`. Caminho aninhado vale até três níveis: `private.billing.plan`.
+
+O construtor valida antes de sair: escopo desconhecido, chave com espaço, mais de
+25 valores num `in` ou vírgula dentro de um valor levantam `RangeError` em vez de
+virarem `400 tenant.filter.invalid`. No máximo 10 filtros por requisição.
+
+Precisa da API Authyon de 2026-10-22 ou mais nova; contra uma anterior o `filter`
+é ignorado, o que aparece como página larga demais e não como erro.
+
 ## Membros do tenant
 
 ```ts

package/dist/{authorization-DfFCoDQ6.d.ts → authorization-D8tznR96.d.ts}

@@ -1,4 +1,4 @@
-import { L as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.js';
+import { L as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.js';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authorization-DcA5oKZT.d.cts → authorization-Soblu-A5.d.cts}

@@ -1,4 +1,4 @@
-import { L as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.cjs';
+import { L as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.cjs';
 
 type AbilitySubject = string | Record<string, unknown>;
 type AbilityConditions = Record<string, unknown>;

package/dist/{authyonServerClient-UA7HdjtD.d.cts → authyonServerClient-COrfN4o_.d.cts}

@@ -171,6 +171,43 @@ interface IntrospectResult {
     token_type?: string;
 }
 
+/**
+ * Builders for the tenant list's structured filters.
+ *
+ * The wire form of one filter is `<scope>.<key>:<op>[:<value>]`, repeated once
+ * per condition: `?filter=public.kind:in:reseller,partner&filter=custom.cnpj:eq:000`.
+ * Repeating the parameter ANDs the conditions and the comma inside `in` is the
+ * OR, which is the whole reason to filter server-side — the conditions are part
+ * of the SQL statement, so `total`, `pages` and `hasNext` describe the filtered
+ * set. A filter applied to a page after it arrives cannot do that.
+ *
+ * Scopes map to the three JSON documents a tenant carries: `public` →
+ * `publicMetadata`, `private` → `privateMetadata`, `custom` → `customFields`
+ * (the one the free-text `search` never covered).
+ *
+ * The rules below mirror the server's parser, so a typo raises `RangeError`
+ * here instead of coming back as a 400 `tenant.filter.invalid`.
+ */
+/** One `filter` parameter, ready to send. */
+type TenantFilterExpression = string;
+/** Values the filters accept; numbers and booleans are compared as text, the
+ *  way `jsonb ->> key` returns them. */
+type TenantFilterValue = string | number | boolean;
+declare const TENANT_FILTER_MAX_VALUES = 25;
+declare const TENANT_FILTER_MAX_VALUE_LENGTH = 200;
+declare const TENANT_FILTER_MAX_DEPTH = 3;
+declare const tenantFilter: {
+    /** `public.kind:eq:reseller` — the key equals this value. */
+    eq(path: string, value: TenantFilterValue): TenantFilterExpression;
+    /** `public.kind:in:reseller,partner` — the key equals any of these (SQL IN). */
+    in(path: string, values: readonly TenantFilterValue[]): TenantFilterExpression;
+    /** `public.notes:like:nacional` — the key contains this text, case-insensitive.
+     *  The server escapes the LIKE metacharacters, so `100%` means `100%`. */
+    like(path: string, text: string): TenantFilterExpression;
+    /** `custom.cnpj:exists` — the key is present, whatever its value. */
+    exists(path: string): TenantFilterExpression;
+};
+
 /** GET/POST /env/tenants — confirmed against the live API. */
 interface Organization {
     id: string;
@@ -190,6 +227,16 @@ interface Organization {
     /** JSON-encoded metadata available only through administrative APIs. */
     privateMetadata?: string;
 }
+/**
+ * What `environment.tenants.list()` accepts. `search` is the free-text half
+ * (one substring, ORed across name, slug, description and both metadata
+ * documents); `filter` is the structured half, ANDed, one entry per condition
+ * — see `tenantFilter` for the builders and the wire format.
+ */
+interface TenantListOptions extends PaginationOptions {
+    search?: string;
+    filter?: TenantFilterExpression[];
+}
 /** One of a user's tenant memberships, as embedded in `EnvironmentUser.tenantMemberships`. */
 interface TenantMembership {
     tenantId: string;
@@ -984,12 +1031,29 @@ declare class AuthyonServerClient {
              * is found by the number, and `cnpj` alone finds every tenant carrying
              * that key. `take` defaults to 25 and is capped at 100.
              *
+             * `filter` is the structured half, and the one to reach for when more
+             * than one condition has to hold: each entry is a condition on a JSON
+             * document, they are ANDed with each other and with `search`, and they
+             * run inside the statement — so the envelope keeps describing the
+             * filtered set and you can page through it. Build them with
+             * `tenantFilter`:
+             *
+             * ```ts
+             * const page = await authyon.environment.tenants.list({
+             *   filter: [
+             *     tenantFilter.in("public.kind", ["reseller", "partner"]),
+             *     tenantFilter.in("custom.cnpj", [a, b]),
+             *   ],
+             *   take: 100,
+             * });
+             * ```
+             *
              * Against an Authyon API older than 2026-10-21 this route ignored
-             * skip/take/search and answered with a bare array.
+             * skip/take/search and answered with a bare array; one older than
+             * 2026-10-22 ignores `filter`, which reads as a page that is too wide
+             * rather than an error.
              */
-            list: (params?: {
-                search?: string;
-            } & PaginationOptions) => Promise<Paged<Organization>>;
+            list: (params?: TenantListOptions) => Promise<Paged<Organization>>;
             /** POST /env/tenants — create a tenant in the environment. */
             create: (input: CreateOrganizationInput) => Promise<Organization>;
             /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
@@ -1229,4 +1293,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type RoleGrant as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type IssuePasswordResetInput as J, type JsonWebKeySet as K, JwksTokenVerifier as L, type JwksTokenVerifierOptions as M, LoggingHttpAdapter as N, type LoginActivity as O, type OpenIdConfiguration as P, type Organization as Q, type OtpCheckResult as R, type Paged as S, type PaginationOptions as T, type PasswordResetCompleted as U, type PasswordResetIssued as V, type PasswordResetPreview as W, type Permission as X, type PermissionsByRole as Y, type ReservedPermissions as Z, type Role as _, type HttpLoggerOptions as a, type RoleInput as a0, type RoleList as a1, type RolePermissions as a2, type SafeJwtAlgorithm as a3, type SecurityMethods as a4, type SubjectApprovals as a5, type SubjectSecurity as a6, type TenantClientValidationResult as a7, type TenantCredentialIssued as a8, type TenantCredentialSummary as a9, type TenantInvite as aa, type TenantInviteAccepted as ab, type TenantInviteInput as ac, type TenantInviteIssued as ad, type TenantInvitePreview as ae, type TenantInviteStatus as af, type TenantMember as ag, type TenantMemberPage as ah, type TenantMembership as ai, TenantScopedClient as aj, type TokenResult as ak, TokenVerificationError as al, type TokenVerificationErrorCode as am, type UpdateOrganizationInput as an, type User as ao, UserScopedClient as ap, type ValidateResult as aq, type VerifiedAccessToken as ar, createClient as as, normalizeClientIp as at, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };
+export { type RoleGrant as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type IssuePasswordResetInput as J, type JsonWebKeySet as K, JwksTokenVerifier as L, type JwksTokenVerifierOptions as M, LoggingHttpAdapter as N, type LoginActivity as O, type OpenIdConfiguration as P, type Organization as Q, type OtpCheckResult as R, type Paged as S, type PaginationOptions as T, type PasswordResetCompleted as U, type PasswordResetIssued as V, type PasswordResetPreview as W, type Permission as X, type PermissionsByRole as Y, type ReservedPermissions as Z, type Role as _, type HttpLoggerOptions as a, type RoleInput as a0, type RoleList as a1, type RolePermissions as a2, type SafeJwtAlgorithm as a3, type SecurityMethods as a4, type SubjectApprovals as a5, type SubjectSecurity as a6, TENANT_FILTER_MAX_DEPTH as a7, TENANT_FILTER_MAX_VALUES as a8, TENANT_FILTER_MAX_VALUE_LENGTH as a9, tenantFilter as aA, type TenantClientValidationResult as aa, type TenantCredentialIssued as ab, type TenantCredentialSummary as ac, type TenantFilterExpression as ad, type TenantFilterValue as ae, type TenantInvite as af, type TenantInviteAccepted as ag, type TenantInviteInput as ah, type TenantInviteIssued as ai, type TenantInvitePreview as aj, type TenantInviteStatus as ak, type TenantListOptions as al, type TenantMember as am, type TenantMemberPage as an, type TenantMembership as ao, TenantScopedClient as ap, type TokenResult as aq, TokenVerificationError as ar, type TokenVerificationErrorCode as as, type UpdateOrganizationInput as at, type User as au, UserScopedClient as av, type ValidateResult as aw, type VerifiedAccessToken as ax, createClient as ay, normalizeClientIp as az, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };

package/dist/{authyonServerClient-UA7HdjtD.d.ts → authyonServerClient-COrfN4o_.d.ts}

@@ -171,6 +171,43 @@ interface IntrospectResult {
     token_type?: string;
 }
 
+/**
+ * Builders for the tenant list's structured filters.
+ *
+ * The wire form of one filter is `<scope>.<key>:<op>[:<value>]`, repeated once
+ * per condition: `?filter=public.kind:in:reseller,partner&filter=custom.cnpj:eq:000`.
+ * Repeating the parameter ANDs the conditions and the comma inside `in` is the
+ * OR, which is the whole reason to filter server-side — the conditions are part
+ * of the SQL statement, so `total`, `pages` and `hasNext` describe the filtered
+ * set. A filter applied to a page after it arrives cannot do that.
+ *
+ * Scopes map to the three JSON documents a tenant carries: `public` →
+ * `publicMetadata`, `private` → `privateMetadata`, `custom` → `customFields`
+ * (the one the free-text `search` never covered).
+ *
+ * The rules below mirror the server's parser, so a typo raises `RangeError`
+ * here instead of coming back as a 400 `tenant.filter.invalid`.
+ */
+/** One `filter` parameter, ready to send. */
+type TenantFilterExpression = string;
+/** Values the filters accept; numbers and booleans are compared as text, the
+ *  way `jsonb ->> key` returns them. */
+type TenantFilterValue = string | number | boolean;
+declare const TENANT_FILTER_MAX_VALUES = 25;
+declare const TENANT_FILTER_MAX_VALUE_LENGTH = 200;
+declare const TENANT_FILTER_MAX_DEPTH = 3;
+declare const tenantFilter: {
+    /** `public.kind:eq:reseller` — the key equals this value. */
+    eq(path: string, value: TenantFilterValue): TenantFilterExpression;
+    /** `public.kind:in:reseller,partner` — the key equals any of these (SQL IN). */
+    in(path: string, values: readonly TenantFilterValue[]): TenantFilterExpression;
+    /** `public.notes:like:nacional` — the key contains this text, case-insensitive.
+     *  The server escapes the LIKE metacharacters, so `100%` means `100%`. */
+    like(path: string, text: string): TenantFilterExpression;
+    /** `custom.cnpj:exists` — the key is present, whatever its value. */
+    exists(path: string): TenantFilterExpression;
+};
+
 /** GET/POST /env/tenants — confirmed against the live API. */
 interface Organization {
     id: string;
@@ -190,6 +227,16 @@ interface Organization {
     /** JSON-encoded metadata available only through administrative APIs. */
     privateMetadata?: string;
 }
+/**
+ * What `environment.tenants.list()` accepts. `search` is the free-text half
+ * (one substring, ORed across name, slug, description and both metadata
+ * documents); `filter` is the structured half, ANDed, one entry per condition
+ * — see `tenantFilter` for the builders and the wire format.
+ */
+interface TenantListOptions extends PaginationOptions {
+    search?: string;
+    filter?: TenantFilterExpression[];
+}
 /** One of a user's tenant memberships, as embedded in `EnvironmentUser.tenantMemberships`. */
 interface TenantMembership {
     tenantId: string;
@@ -984,12 +1031,29 @@ declare class AuthyonServerClient {
              * is found by the number, and `cnpj` alone finds every tenant carrying
              * that key. `take` defaults to 25 and is capped at 100.
              *
+             * `filter` is the structured half, and the one to reach for when more
+             * than one condition has to hold: each entry is a condition on a JSON
+             * document, they are ANDed with each other and with `search`, and they
+             * run inside the statement — so the envelope keeps describing the
+             * filtered set and you can page through it. Build them with
+             * `tenantFilter`:
+             *
+             * ```ts
+             * const page = await authyon.environment.tenants.list({
+             *   filter: [
+             *     tenantFilter.in("public.kind", ["reseller", "partner"]),
+             *     tenantFilter.in("custom.cnpj", [a, b]),
+             *   ],
+             *   take: 100,
+             * });
+             * ```
+             *
              * Against an Authyon API older than 2026-10-21 this route ignored
-             * skip/take/search and answered with a bare array.
+             * skip/take/search and answered with a bare array; one older than
+             * 2026-10-22 ignores `filter`, which reads as a page that is too wide
+             * rather than an error.
              */
-            list: (params?: {
-                search?: string;
-            } & PaginationOptions) => Promise<Paged<Organization>>;
+            list: (params?: TenantListOptions) => Promise<Paged<Organization>>;
             /** POST /env/tenants — create a tenant in the environment. */
             create: (input: CreateOrganizationInput) => Promise<Organization>;
             /** GET /env/tenants/{tenantId} — fetch a tenant by id. */
@@ -1229,4 +1293,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-export { type RoleGrant as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type IssuePasswordResetInput as J, type JsonWebKeySet as K, JwksTokenVerifier as L, type JwksTokenVerifierOptions as M, LoggingHttpAdapter as N, type LoginActivity as O, type OpenIdConfiguration as P, type Organization as Q, type OtpCheckResult as R, type Paged as S, type PaginationOptions as T, type PasswordResetCompleted as U, type PasswordResetIssued as V, type PasswordResetPreview as W, type Permission as X, type PermissionsByRole as Y, type ReservedPermissions as Z, type Role as _, type HttpLoggerOptions as a, type RoleInput as a0, type RoleList as a1, type RolePermissions as a2, type SafeJwtAlgorithm as a3, type SecurityMethods as a4, type SubjectApprovals as a5, type SubjectSecurity as a6, type TenantClientValidationResult as a7, type TenantCredentialIssued as a8, type TenantCredentialSummary as a9, type TenantInvite as aa, type TenantInviteAccepted as ab, type TenantInviteInput as ac, type TenantInviteIssued as ad, type TenantInvitePreview as ae, type TenantInviteStatus as af, type TenantMember as ag, type TenantMemberPage as ah, type TenantMembership as ai, TenantScopedClient as aj, type TokenResult as ak, TokenVerificationError as al, type TokenVerificationErrorCode as am, type UpdateOrganizationInput as an, type User as ao, UserScopedClient as ap, type ValidateResult as aq, type VerifiedAccessToken as ar, createClient as as, normalizeClientIp as at, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };
+export { type RoleGrant as $, AuthyonServerClient as A, type HttpLogEvent as B, type ClientCredentials as C, type HttpLogger as D, type EnvironmentUser as E, FetchHttpAdapter as F, type InviteTenantMemberInput as G, type HttpAdapter as H, type IntrospectResult as I, type IssuePasswordResetInput as J, type JsonWebKeySet as K, JwksTokenVerifier as L, type JwksTokenVerifierOptions as M, LoggingHttpAdapter as N, type LoginActivity as O, type OpenIdConfiguration as P, type Organization as Q, type OtpCheckResult as R, type Paged as S, type PaginationOptions as T, type PasswordResetCompleted as U, type PasswordResetIssued as V, type PasswordResetPreview as W, type Permission as X, type PermissionsByRole as Y, type ReservedPermissions as Z, type Role as _, type HttpLoggerOptions as a, type RoleInput as a0, type RoleList as a1, type RolePermissions as a2, type SafeJwtAlgorithm as a3, type SecurityMethods as a4, type SubjectApprovals as a5, type SubjectSecurity as a6, TENANT_FILTER_MAX_DEPTH as a7, TENANT_FILTER_MAX_VALUES as a8, TENANT_FILTER_MAX_VALUE_LENGTH as a9, tenantFilter as aA, type TenantClientValidationResult as aa, type TenantCredentialIssued as ab, type TenantCredentialSummary as ac, type TenantFilterExpression as ad, type TenantFilterValue as ae, type TenantInvite as af, type TenantInviteAccepted as ag, type TenantInviteInput as ah, type TenantInviteIssued as ai, type TenantInvitePreview as aj, type TenantInviteStatus as ak, type TenantListOptions as al, type TenantMember as am, type TenantMemberPage as an, type TenantMembership as ao, TenantScopedClient as ap, type TokenResult as aq, TokenVerificationError as ar, type TokenVerificationErrorCode as as, type UpdateOrganizationInput as at, type User as au, UserScopedClient as av, type ValidateResult as aw, type VerifiedAccessToken as ax, createClient as ay, normalizeClientIp as az, type AcceptTenantInviteInput as b, type AccessTokenSource as c, type Approval as d, type ApprovalAssurance as e, type ApprovalPayload as f, type ApprovalStatus as g, type ApprovalWebAuthnOptions as h, type AuditEvent as i, type AuthyonJwksDiscoveryOptions as j, type AuthyonJwtClaims as k, type AuthyonServerClientOptions as l, type ClientRequestContext as m, type ConfirmApprovalInput as n, type ConsumedApproval as o, type CreateApprovalInput as p, type CreateCredentialInput as q, type CreateOrganizationInput as r, type CreatePermissionInput as s, type CreateTenantCredentialInput as t, type CreateUserInput as u, type CredentialCreator as v, type CredentialDetail as w, type CredentialListOptions as x, type CredentialPermissionsInput as y, type HttpAdapterRequest as z };

package/dist/bff.cjs

@@ -746,7 +746,14 @@ function appendQuery(path, params) {
   if (!params) return path;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
-    if (value2 !== void 0) query.set(key, String(value2));
+    if (value2 === void 0) continue;
+    if (Array.isArray(value2)) {
+      for (const item of value2) {
+        if (item !== void 0) query.append(key, String(item));
+      }
+      continue;
+    }
+    query.set(key, String(value2));
   }
   const value = query.toString();
   return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;

package/dist/bff.d.cts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.cjs';
 import 'jose';
 
 interface BffLoginInput {

package/dist/bff.d.ts

@@ -1,4 +1,4 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.js';
 import 'jose';
 
 interface BffLoginInput {

package/dist/bff.js

@@ -3,7 +3,7 @@ import {
   DEFAULT_BASE_URL,
   JsonHttpClient,
   createSharedTransport
-} from "./chunk-TDJNBD3Z.js";
+} from "./chunk-SUL2HLRR.js";
 import "./chunk-77J4NURK.js";
 
 // src/bff/contracts.ts

package/dist/{chunk-TDJNBD3Z.js → chunk-SUL2HLRR.js}

@@ -298,7 +298,14 @@ function appendQuery(path, params) {
   if (!params) return path;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
-    if (value2 !== void 0) query.set(key, String(value2));
+    if (value2 === void 0) continue;
+    if (Array.isArray(value2)) {
+      for (const item of value2) {
+        if (item !== void 0) query.append(key, String(item));
+      }
+      continue;
+    }
+    query.set(key, String(value2));
   }
   const value = query.toString();
   return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;

package/dist/index.cjs

@@ -37,6 +37,9 @@ __export(index_exports, {
   FetchHttpAdapter: () => FetchHttpAdapter,
   JwksTokenVerifier: () => JwksTokenVerifier,
   LoggingHttpAdapter: () => LoggingHttpAdapter,
+  TENANT_FILTER_MAX_DEPTH: () => TENANT_FILTER_MAX_DEPTH,
+  TENANT_FILTER_MAX_VALUES: () => TENANT_FILTER_MAX_VALUES,
+  TENANT_FILTER_MAX_VALUE_LENGTH: () => TENANT_FILTER_MAX_VALUE_LENGTH,
   TenantScopedClient: () => TenantScopedClient,
   TokenVerificationError: () => TokenVerificationError,
   UserScopedClient: () => UserScopedClient,
@@ -49,7 +52,8 @@ __export(index_exports, {
   createExpressAuthorizationMiddleware: () => createExpressAuthorizationMiddleware,
   hasPermission: () => hasPermission,
   hasPermissionGroup: () => hasPermissionGroup,
-  normalizeClientIp: () => normalizeClientIp
+  normalizeClientIp: () => normalizeClientIp,
+  tenantFilter: () => tenantFilter
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -436,7 +440,14 @@ function appendQuery(path2, params) {
   if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
-    if (value2 !== void 0) query.set(key, String(value2));
+    if (value2 === void 0) continue;
+    if (Array.isArray(value2)) {
+      for (const item of value2) {
+        if (item !== void 0) query.append(key, String(item));
+      }
+      continue;
+    }
+    query.set(key, String(value2));
   }
   const value = query.toString();
   return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
@@ -1016,8 +1027,27 @@ var AuthyonServerClient = class {
          * is found by the number, and `cnpj` alone finds every tenant carrying
          * that key. `take` defaults to 25 and is capped at 100.
          *
+         * `filter` is the structured half, and the one to reach for when more
+         * than one condition has to hold: each entry is a condition on a JSON
+         * document, they are ANDed with each other and with `search`, and they
+         * run inside the statement — so the envelope keeps describing the
+         * filtered set and you can page through it. Build them with
+         * `tenantFilter`:
+         *
+         * ```ts
+         * const page = await authyon.environment.tenants.list({
+         *   filter: [
+         *     tenantFilter.in("public.kind", ["reseller", "partner"]),
+         *     tenantFilter.in("custom.cnpj", [a, b]),
+         *   ],
+         *   take: 100,
+         * });
+         * ```
+         *
          * Against an Authyon API older than 2026-10-21 this route ignored
-         * skip/take/search and answered with a bare array.
+         * skip/take/search and answered with a bare array; one older than
+         * 2026-10-22 ignores `filter`, which reads as a page that is too wide
+         * rather than an error.
          */
         list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
         /** POST /env/tenants — create a tenant in the environment. */
@@ -1539,6 +1569,86 @@ var AuthyonServerClientBuilder = class {
 };
 _options = new WeakMap();
 
+// src/client/tenantFilters.ts
+var TENANT_FILTER_MAX_VALUES = 25;
+var TENANT_FILTER_MAX_VALUE_LENGTH = 200;
+var TENANT_FILTER_MAX_DEPTH = 3;
+var SCOPES = ["public", "private", "custom"];
+var KEY_SEGMENT = /^[A-Za-z0-9_-]{1,64}$/;
+function assertPath(path2) {
+  if (typeof path2 !== "string" || path2.length === 0) {
+    throw new RangeError("Authyon: a filter path is required, e.g. public.kind.");
+  }
+  const [scope, ...keys] = path2.split(".");
+  if (!SCOPES.includes(scope)) {
+    throw new RangeError(
+      `Authyon: unknown filter scope "${scope}" \u2014 use ${SCOPES.join(", ")} (e.g. public.kind).`
+    );
+  }
+  if (keys.length === 0) {
+    throw new RangeError(`Authyon: filter path "${path2}" needs a key after the scope.`);
+  }
+  if (keys.length > TENANT_FILTER_MAX_DEPTH) {
+    throw new RangeError(
+      `Authyon: filter path "${path2}" goes deeper than ${TENANT_FILTER_MAX_DEPTH} levels.`
+    );
+  }
+  for (const key of keys) {
+    if (!KEY_SEGMENT.test(key)) {
+      throw new RangeError(
+        `Authyon: invalid filter key "${key}" \u2014 letters, digits, "_" and "-", up to 64 characters.`
+      );
+    }
+  }
+  return path2;
+}
+function assertValue(value, forIn) {
+  if (value === void 0 || value === null) {
+    throw new RangeError("Authyon: a filter value is required.");
+  }
+  const text = String(value);
+  if (text.length === 0) {
+    throw new RangeError("Authyon: a filter value may not be empty.");
+  }
+  if (text.length > TENANT_FILTER_MAX_VALUE_LENGTH) {
+    throw new RangeError(
+      `Authyon: a filter value may hold at most ${TENANT_FILTER_MAX_VALUE_LENGTH} characters.`
+    );
+  }
+  if (text.includes(",")) {
+    throw new RangeError(
+      forIn ? "Authyon: an `in` value may not contain a comma \u2014 pass separate values instead." : "Authyon: a filter value may not contain a comma."
+    );
+  }
+  return text;
+}
+var tenantFilter = {
+  /** `public.kind:eq:reseller` — the key equals this value. */
+  eq(path2, value) {
+    return `${assertPath(path2)}:eq:${assertValue(value, false)}`;
+  },
+  /** `public.kind:in:reseller,partner` — the key equals any of these (SQL IN). */
+  in(path2, values) {
+    if (!Array.isArray(values) || values.length === 0) {
+      throw new RangeError("Authyon: `in` needs at least one value.");
+    }
+    if (values.length > TENANT_FILTER_MAX_VALUES) {
+      throw new RangeError(`Authyon: \`in\` takes at most ${TENANT_FILTER_MAX_VALUES} values.`);
+    }
+    const unique = [...new Set(values.map((value) => assertValue(value, true)))];
+    return `${assertPath(path2)}:in:${unique.join(",")}`;
+  },
+  /** `public.notes:like:nacional` — the key contains this text, case-insensitive.
+   *  The server escapes the LIKE metacharacters, so `100%` means `100%`. */
+  like(path2, text) {
+    return `${assertPath(path2)}:like:${assertValue(text, false)}`;
+  },
+  /** `custom.cnpj:exists` — the key is present, whatever its value. */
+  exists(path2) {
+    return `${assertPath(path2)}:exists`;
+  }
+};
+
 // ../../internal/core/authorization/ability.ts
 var AuthyonAbility = class {
   constructor(rules = [], detectSubjectType = defaultSubjectType) {
@@ -1857,6 +1967,9 @@ function unauthenticated() {
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
+  TENANT_FILTER_MAX_DEPTH,
+  TENANT_FILTER_MAX_VALUES,
+  TENANT_FILTER_MAX_VALUE_LENGTH,
   TenantScopedClient,
   TokenVerificationError,
   UserScopedClient,
@@ -1869,5 +1982,6 @@ function unauthenticated() {
   createExpressAuthorizationMiddleware,
   hasPermission,
   hasPermissionGroup,
-  normalizeClientIp
+  normalizeClientIp,
+  tenantFilter
 });

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.cjs';
-export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TenantClientValidationResult, a8 as TenantCredentialIssued, a9 as TenantCredentialSummary, aa as TenantInvite, ab as TenantInviteAccepted, ac as TenantInviteInput, ad as TenantInviteIssued, ae as TenantInvitePreview, af as TenantInviteStatus, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as createClient, at as normalizeClientIp } from './authyonServerClient-UA7HdjtD.cjs';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-DcA5oKZT.cjs';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.cjs';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TENANT_FILTER_MAX_DEPTH, a8 as TENANT_FILTER_MAX_VALUES, a9 as TENANT_FILTER_MAX_VALUE_LENGTH, aa as TenantClientValidationResult, ab as TenantCredentialIssued, ac as TenantCredentialSummary, ad as TenantFilterExpression, ae as TenantFilterValue, af as TenantInvite, ag as TenantInviteAccepted, ah as TenantInviteInput, ai as TenantInviteIssued, aj as TenantInvitePreview, ak as TenantInviteStatus, al as TenantListOptions, am as TenantMember, an as TenantMemberPage, ao as TenantMembership, ap as TenantScopedClient, aq as TokenResult, ar as TokenVerificationError, as as TokenVerificationErrorCode, at as UpdateOrganizationInput, au as User, av as UserScopedClient, aw as ValidateResult, ax as VerifiedAccessToken, ay as createClient, az as normalizeClientIp, aA as tenantFilter } from './authyonServerClient-COrfN4o_.cjs';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-Soblu-A5.cjs';
 import 'jose';
 
 declare const ErrorCodes: {

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.js';
-export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TenantClientValidationResult, a8 as TenantCredentialIssued, a9 as TenantCredentialSummary, aa as TenantInvite, ab as TenantInviteAccepted, ac as TenantInviteInput, ad as TenantInviteIssued, ae as TenantInvitePreview, af as TenantInviteStatus, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as createClient, at as normalizeClientIp } from './authyonServerClient-UA7HdjtD.js';
-export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-DfFCoDQ6.js';
+import { H as HttpAdapter, a as HttpLoggerOptions, A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.js';
+export { b as AcceptTenantInviteInput, c as AccessTokenSource, d as Approval, e as ApprovalAssurance, f as ApprovalPayload, g as ApprovalStatus, h as ApprovalWebAuthnOptions, i as AuditEvent, j as AuthyonJwksDiscoveryOptions, k as AuthyonJwtClaims, l as AuthyonServerClientOptions, C as ClientCredentials, m as ClientRequestContext, n as ConfirmApprovalInput, o as ConsumedApproval, p as CreateApprovalInput, q as CreateCredentialInput, r as CreateOrganizationInput, s as CreatePermissionInput, t as CreateTenantCredentialInput, u as CreateUserInput, v as CredentialCreator, w as CredentialDetail, x as CredentialListOptions, y as CredentialPermissionsInput, E as EnvironmentUser, F as FetchHttpAdapter, z as HttpAdapterRequest, B as HttpLogEvent, D as HttpLogger, I as IntrospectResult, G as InviteTenantMemberInput, J as IssuePasswordResetInput, K as JsonWebKeySet, L as JwksTokenVerifier, M as JwksTokenVerifierOptions, N as LoggingHttpAdapter, O as LoginActivity, P as OpenIdConfiguration, Q as Organization, R as OtpCheckResult, S as Paged, T as PaginationOptions, U as PasswordResetCompleted, V as PasswordResetIssued, W as PasswordResetPreview, X as Permission, Y as PermissionsByRole, Z as ReservedPermissions, _ as Role, $ as RoleGrant, a0 as RoleInput, a1 as RoleList, a2 as RolePermissions, a3 as SafeJwtAlgorithm, a4 as SecurityMethods, a5 as SubjectApprovals, a6 as SubjectSecurity, a7 as TENANT_FILTER_MAX_DEPTH, a8 as TENANT_FILTER_MAX_VALUES, a9 as TENANT_FILTER_MAX_VALUE_LENGTH, aa as TenantClientValidationResult, ab as TenantCredentialIssued, ac as TenantCredentialSummary, ad as TenantFilterExpression, ae as TenantFilterValue, af as TenantInvite, ag as TenantInviteAccepted, ah as TenantInviteInput, ai as TenantInviteIssued, aj as TenantInvitePreview, ak as TenantInviteStatus, al as TenantListOptions, am as TenantMember, an as TenantMemberPage, ao as TenantMembership, ap as TenantScopedClient, aq as TokenResult, ar as TokenVerificationError, as as TokenVerificationErrorCode, at as UpdateOrganizationInput, au as User, av as UserScopedClient, aw as ValidateResult, ax as VerifiedAccessToken, ay as createClient, az as normalizeClientIp, aA as tenantFilter } from './authyonServerClient-COrfN4o_.js';
+export { b as AbilityConditions, c as AbilityEvent, d as AbilityListener, e as AbilityRequirement, f as AbilityRule, A as AbilitySubject, g as AuthorizationContext, a as AuthorizationError, h as AuthorizationOptions, i as AuthyonAbility, j as AuthyonAbilityBuilder, k as AuthyonAbilityOptions, l as AuthyonPermissionSource, E as ExpressAuthorizationMiddlewareOptions, m as ExpressNext, n as ExpressRequestLike, o as ExpressResponseLike, P as PermissionGroup, R as RequestAuthorizationOptions, p as authorizeRequest, q as authorizeToken, r as createAuthorizationErrorResponse, s as createAuthyonAbility, t as createAuthyonRules, u as createExpressAuthorizationMiddleware, v as hasPermission, w as hasPermissionGroup } from './authorization-D8tznR96.js';
 import 'jose';
 
 declare const ErrorCodes: {

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   JsonHttpClient,
   LoggingHttpAdapter,
   createSharedTransport
-} from "./chunk-TDJNBD3Z.js";
+} from "./chunk-SUL2HLRR.js";
 import {
   AuthorizationError,
   AuthyonAbility,
@@ -493,8 +493,27 @@ var AuthyonServerClient = class {
          * is found by the number, and `cnpj` alone finds every tenant carrying
          * that key. `take` defaults to 25 and is capped at 100.
          *
+         * `filter` is the structured half, and the one to reach for when more
+         * than one condition has to hold: each entry is a condition on a JSON
+         * document, they are ANDed with each other and with `search`, and they
+         * run inside the statement — so the envelope keeps describing the
+         * filtered set and you can page through it. Build them with
+         * `tenantFilter`:
+         *
+         * ```ts
+         * const page = await authyon.environment.tenants.list({
+         *   filter: [
+         *     tenantFilter.in("public.kind", ["reseller", "partner"]),
+         *     tenantFilter.in("custom.cnpj", [a, b]),
+         *   ],
+         *   take: 100,
+         * });
+         * ```
+         *
          * Against an Authyon API older than 2026-10-21 this route ignored
-         * skip/take/search and answered with a bare array.
+         * skip/take/search and answered with a bare array; one older than
+         * 2026-10-22 ignores `filter`, which reads as a page that is too wide
+         * rather than an error.
          */
         list: (params = {}) => this.request("/env/tenants", { envBearer: true, query: params }),
         /** POST /env/tenants — create a tenant in the environment. */
@@ -1015,6 +1034,86 @@ var AuthyonServerClientBuilder = class {
   }
 };
 _options = new WeakMap();
+
+// src/client/tenantFilters.ts
+var TENANT_FILTER_MAX_VALUES = 25;
+var TENANT_FILTER_MAX_VALUE_LENGTH = 200;
+var TENANT_FILTER_MAX_DEPTH = 3;
+var SCOPES = ["public", "private", "custom"];
+var KEY_SEGMENT = /^[A-Za-z0-9_-]{1,64}$/;
+function assertPath(path2) {
+  if (typeof path2 !== "string" || path2.length === 0) {
+    throw new RangeError("Authyon: a filter path is required, e.g. public.kind.");
+  }
+  const [scope, ...keys] = path2.split(".");
+  if (!SCOPES.includes(scope)) {
+    throw new RangeError(
+      `Authyon: unknown filter scope "${scope}" \u2014 use ${SCOPES.join(", ")} (e.g. public.kind).`
+    );
+  }
+  if (keys.length === 0) {
+    throw new RangeError(`Authyon: filter path "${path2}" needs a key after the scope.`);
+  }
+  if (keys.length > TENANT_FILTER_MAX_DEPTH) {
+    throw new RangeError(
+      `Authyon: filter path "${path2}" goes deeper than ${TENANT_FILTER_MAX_DEPTH} levels.`
+    );
+  }
+  for (const key of keys) {
+    if (!KEY_SEGMENT.test(key)) {
+      throw new RangeError(
+        `Authyon: invalid filter key "${key}" \u2014 letters, digits, "_" and "-", up to 64 characters.`
+      );
+    }
+  }
+  return path2;
+}
+function assertValue(value, forIn) {
+  if (value === void 0 || value === null) {
+    throw new RangeError("Authyon: a filter value is required.");
+  }
+  const text = String(value);
+  if (text.length === 0) {
+    throw new RangeError("Authyon: a filter value may not be empty.");
+  }
+  if (text.length > TENANT_FILTER_MAX_VALUE_LENGTH) {
+    throw new RangeError(
+      `Authyon: a filter value may hold at most ${TENANT_FILTER_MAX_VALUE_LENGTH} characters.`
+    );
+  }
+  if (text.includes(",")) {
+    throw new RangeError(
+      forIn ? "Authyon: an `in` value may not contain a comma \u2014 pass separate values instead." : "Authyon: a filter value may not contain a comma."
+    );
+  }
+  return text;
+}
+var tenantFilter = {
+  /** `public.kind:eq:reseller` — the key equals this value. */
+  eq(path2, value) {
+    return `${assertPath(path2)}:eq:${assertValue(value, false)}`;
+  },
+  /** `public.kind:in:reseller,partner` — the key equals any of these (SQL IN). */
+  in(path2, values) {
+    if (!Array.isArray(values) || values.length === 0) {
+      throw new RangeError("Authyon: `in` needs at least one value.");
+    }
+    if (values.length > TENANT_FILTER_MAX_VALUES) {
+      throw new RangeError(`Authyon: \`in\` takes at most ${TENANT_FILTER_MAX_VALUES} values.`);
+    }
+    const unique = [...new Set(values.map((value) => assertValue(value, true)))];
+    return `${assertPath(path2)}:in:${unique.join(",")}`;
+  },
+  /** `public.notes:like:nacional` — the key contains this text, case-insensitive.
+   *  The server escapes the LIKE metacharacters, so `100%` means `100%`. */
+  like(path2, text) {
+    return `${assertPath(path2)}:like:${assertValue(text, false)}`;
+  },
+  /** `custom.cnpj:exists` — the key is present, whatever its value. */
+  exists(path2) {
+    return `${assertPath(path2)}:exists`;
+  }
+};
 export {
   AuthorizationError,
   AuthyonAbility,
@@ -1026,6 +1125,9 @@ export {
   FetchHttpAdapter,
   JwksTokenVerifier,
   LoggingHttpAdapter,
+  TENANT_FILTER_MAX_DEPTH,
+  TENANT_FILTER_MAX_VALUES,
+  TENANT_FILTER_MAX_VALUE_LENGTH,
   TenantScopedClient,
   TokenVerificationError,
   UserScopedClient,
@@ -1038,5 +1140,6 @@ export {
   createExpressAuthorizationMiddleware,
   hasPermission,
   hasPermissionGroup,
-  normalizeClientIp
+  normalizeClientIp,
+  tenantFilter
 };

package/dist/next.d.cts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-DcA5oKZT.cjs';
-import { A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.cjs';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-Soblu-A5.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-DfFCoDQ6.js';
-import { A as AuthyonServerClient } from './authyonServerClient-UA7HdjtD.js';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-D8tznR96.js';
+import { A as AuthyonServerClient } from './authyonServerClient-COrfN4o_.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.20",
+  "version": "0.2.0-beta.21",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",