@authyon/server 0.2.0-beta.6 → 0.2.0-beta.8

package/README.md

@@ -37,6 +37,17 @@ O client também aceita `httpLogger: { enabled, logger? }`. A configuração é
 
 `AuthyonError`, `ErrorCodes` e `error.interpret()` também são exportados por este pacote. Use `category`, `action`, `retryable`, `retryAfter` e `requestId` para implementar middleware e observabilidade sem comparar mensagens humanas.
 
+## Sessão web no BFF (código ainda não publicado)
+
+O novo entrypoint `@authyon/server/bff` oferece login, 2FA, sessão HttpOnly,
+renovação sob demanda, logout e troca de organização. Os tokens ficam no servidor,
+com adaptador Redis cifrado e compare-and-swap para concorrência entre instâncias.
+Reutiliza os endpoints existentes e o cliente de validação server-side.
+
+Veja [contrato e integração](../../docs/bff.md) e [análise/plano](../../docs/bff-session-plan.md).
+O entrypoint padrão e `@authyon/server/next` mantêm seu comportamento anterior;
+a adoção do transporte BFF pelo consumidor é explícita.
+
 ## Validação local com JWKS
 
 Para APIs de alto volume, crie uma vez um verificador com discovery automático:

package/dist/authorization-BZTzR6iu.d.ts

@@ -0,0 +1,129 @@
+import { x as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-D8r47VSq.js';
+
+type AbilitySubject = string | Record<string, unknown>;
+type AbilityConditions = Record<string, unknown>;
+interface AbilityRule {
+    action: string | string[];
+    subject: string | string[];
+    inverted?: boolean;
+    conditions?: AbilityConditions;
+    fields?: string[];
+    reason?: string;
+}
+interface AuthyonPermissionSource {
+    permissions?: readonly string[] | null;
+    roles?: readonly string[] | null;
+    /** OAuth scopes are also accepted and interpreted as Authyon permissions. */
+    scope?: string | null;
+}
+/** A declarative group of permissions evaluated against an Authyon permission source. */
+interface PermissionGroup {
+    /** Permissions that must all be granted. */
+    allOf?: readonly string[];
+    /** Permissions where at least one must be granted. */
+    anyOf?: readonly string[];
+}
+interface AuthyonAbilityOptions {
+    rules?: readonly AbilityRule[];
+    /** Rules added when the source contains a matching Authyon role. */
+    roleRules?: Readonly<Record<string, readonly AbilityRule[]>>;
+    roles?: readonly string[] | null;
+    detectSubjectType?: (subject: Record<string, unknown>) => string;
+}
+type AbilityEvent = "updated";
+type AbilityListener = (rules: readonly AbilityRule[]) => void;
+/** Isomorphic, deny-by-default authorization engine backed by Authyon permissions. */
+declare class AuthyonAbility {
+    private readonly detectSubjectType;
+    private currentRules;
+    private readonly listeners;
+    constructor(rules?: readonly AbilityRule[], detectSubjectType?: (subject: Record<string, unknown>) => string);
+    get rules(): readonly AbilityRule[];
+    can(action: string, subject: AbilitySubject, field?: string): boolean;
+    cannot(action: string, subject: AbilitySubject, field?: string): boolean;
+    rulesFor(action: string, subject: string): readonly AbilityRule[];
+    update(rules: readonly AbilityRule[]): void;
+    on(event: AbilityEvent, listener: AbilityListener): () => void;
+}
+/** Fluent rule builder with CASL-like `can` and `cannot` methods. */
+declare class AuthyonAbilityBuilder {
+    readonly rules: AbilityRule[];
+    can(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[]): this;
+    cannot(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[], reason?: string): this;
+    build(options?: Pick<AuthyonAbilityOptions, "detectSubjectType">): AuthyonAbility;
+}
+/** Creates an ability from Authyon permissions, OAuth scope and optional role rules. */
+declare function createAuthyonAbility(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AuthyonAbility;
+/** Checks an Authyon permission string using the same wildcard rules as an ability. */
+declare function hasPermission(source: AuthyonPermissionSource | readonly string[], requiredPermission: string): boolean;
+/**
+ * Checks a permission group using Authyon's standard permission and wildcard rules.
+ * Empty or omitted groups do not add authorization requirements.
+ */
+declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly string[], group: PermissionGroup): boolean;
+/** Converts Authyon's `subject:action` permission strings to authorization rules. */
+declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
+
+interface AbilityRequirement {
+    action: string;
+    subject: AbilitySubject;
+    field?: string;
+}
+interface AuthorizationContext {
+    token: string;
+    userId?: string;
+    ability: AuthyonAbility;
+    permissions: readonly string[];
+    roles: readonly string[];
+}
+interface AuthorizationOptions extends AuthyonAbilityOptions {
+    requirement?: AbilityRequirement;
+    /** Uses database-backed validation by default; introspection can be selected when desired. */
+    verification?: "validate" | "introspect" | "jwks";
+    /** Required for local JWKS verification. Create once and reuse its key cache. */
+    jwksVerifier?: JwksTokenVerifier;
+    /** Real end-user IP, obtained from trusted application infrastructure. */
+    clientIp?: string;
+}
+declare class AuthorizationError extends Error {
+    readonly status: 401 | 403 | 503;
+    readonly code: "authorization.unauthenticated" | "authorization.forbidden" | "authorization.unavailable";
+    constructor(status: 401 | 403 | 503, code: "authorization.unauthenticated" | "authorization.forbidden" | "authorization.unavailable", message: string);
+}
+/** Validates a bearer token and creates an Authyon-backed ability for server runtimes. */
+declare function authorizeToken(client: AuthyonServerClient, token: string, options?: AuthorizationOptions): Promise<AuthorizationContext>;
+/** Works with Web Request objects used by Next.js Route Handlers and other Fetch runtimes. */
+declare function authorizeRequest(client: AuthyonServerClient, request: Pick<Request, "headers">, options?: RequestAuthorizationOptions): Promise<AuthorizationContext>;
+interface RequestAuthorizationOptions extends AuthorizationOptions {
+    /** Platform-aware resolver. Only read headers that your trusted proxy overwrites. */
+    resolveClientIp?: (request: Pick<Request, "headers">) => string | undefined;
+}
+interface ExpressRequestLike {
+    headers: Record<string, string | string[] | undefined>;
+    ip?: string;
+    socket?: {
+        remoteAddress?: string;
+    };
+    authyon?: AuthorizationContext;
+}
+interface ExpressResponseLike {
+    status(code: number): ExpressResponseLike;
+    json(body: unknown): unknown;
+}
+type ExpressNext = (error?: unknown) => void;
+interface ExpressAuthorizationMiddlewareOptions extends AuthorizationOptions {
+    /** Property assigned to the request. Defaults to `authyon`. */
+    requestProperty?: string;
+    /** Pass authorization errors to Express error middleware instead of writing a JSON response. */
+    passErrorsToNext?: boolean;
+    /** Trust Express's proxy-aware `request.ip`. Disabled by default. */
+    trustProxy?: boolean;
+    /** Overrides all built-in IP resolution; return only a trusted, single client IP. */
+    resolveClientIp?: (request: ExpressRequestLike) => string | undefined;
+}
+/** Dependency-free middleware compatible with Express and similar Connect frameworks. */
+declare function createExpressAuthorizationMiddleware(client: AuthyonServerClient, options?: ExpressAuthorizationMiddlewareOptions): (request: ExpressRequestLike & Record<string, unknown>, response: ExpressResponseLike, next: ExpressNext) => Promise<void>;
+/** Converts an authorization error into a Fetch Response suitable for Next.js. */
+declare function createAuthorizationErrorResponse(error: unknown): Response;
+
+export { type AbilitySubject as A, type ExpressAuthorizationMiddlewareOptions as E, type PermissionGroup as P, type RequestAuthorizationOptions as R, AuthorizationError as a, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRequirement as e, type AbilityRule as f, type AuthorizationContext as g, type AuthorizationOptions as h, AuthyonAbility as i, AuthyonAbilityBuilder as j, type AuthyonAbilityOptions as k, type AuthyonPermissionSource as l, type ExpressNext as m, type ExpressRequestLike as n, type ExpressResponseLike as o, authorizeRequest as p, authorizeToken as q, createAuthorizationErrorResponse as r, createAuthyonAbility as s, createAuthyonRules as t, createExpressAuthorizationMiddleware as u, hasPermission as v, hasPermissionGroup as w };

package/dist/authorization-DPlRA9qM.d.cts

@@ -0,0 +1,129 @@
+import { x as JwksTokenVerifier, A as AuthyonServerClient } from './authyonServerClient-D8r47VSq.cjs';
+
+type AbilitySubject = string | Record<string, unknown>;
+type AbilityConditions = Record<string, unknown>;
+interface AbilityRule {
+    action: string | string[];
+    subject: string | string[];
+    inverted?: boolean;
+    conditions?: AbilityConditions;
+    fields?: string[];
+    reason?: string;
+}
+interface AuthyonPermissionSource {
+    permissions?: readonly string[] | null;
+    roles?: readonly string[] | null;
+    /** OAuth scopes are also accepted and interpreted as Authyon permissions. */
+    scope?: string | null;
+}
+/** A declarative group of permissions evaluated against an Authyon permission source. */
+interface PermissionGroup {
+    /** Permissions that must all be granted. */
+    allOf?: readonly string[];
+    /** Permissions where at least one must be granted. */
+    anyOf?: readonly string[];
+}
+interface AuthyonAbilityOptions {
+    rules?: readonly AbilityRule[];
+    /** Rules added when the source contains a matching Authyon role. */
+    roleRules?: Readonly<Record<string, readonly AbilityRule[]>>;
+    roles?: readonly string[] | null;
+    detectSubjectType?: (subject: Record<string, unknown>) => string;
+}
+type AbilityEvent = "updated";
+type AbilityListener = (rules: readonly AbilityRule[]) => void;
+/** Isomorphic, deny-by-default authorization engine backed by Authyon permissions. */
+declare class AuthyonAbility {
+    private readonly detectSubjectType;
+    private currentRules;
+    private readonly listeners;
+    constructor(rules?: readonly AbilityRule[], detectSubjectType?: (subject: Record<string, unknown>) => string);
+    get rules(): readonly AbilityRule[];
+    can(action: string, subject: AbilitySubject, field?: string): boolean;
+    cannot(action: string, subject: AbilitySubject, field?: string): boolean;
+    rulesFor(action: string, subject: string): readonly AbilityRule[];
+    update(rules: readonly AbilityRule[]): void;
+    on(event: AbilityEvent, listener: AbilityListener): () => void;
+}
+/** Fluent rule builder with CASL-like `can` and `cannot` methods. */
+declare class AuthyonAbilityBuilder {
+    readonly rules: AbilityRule[];
+    can(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[]): this;
+    cannot(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[], reason?: string): this;
+    build(options?: Pick<AuthyonAbilityOptions, "detectSubjectType">): AuthyonAbility;
+}
+/** Creates an ability from Authyon permissions, OAuth scope and optional role rules. */
+declare function createAuthyonAbility(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AuthyonAbility;
+/** Checks an Authyon permission string using the same wildcard rules as an ability. */
+declare function hasPermission(source: AuthyonPermissionSource | readonly string[], requiredPermission: string): boolean;
+/**
+ * Checks a permission group using Authyon's standard permission and wildcard rules.
+ * Empty or omitted groups do not add authorization requirements.
+ */
+declare function hasPermissionGroup(source: AuthyonPermissionSource | readonly string[], group: PermissionGroup): boolean;
+/** Converts Authyon's `subject:action` permission strings to authorization rules. */
+declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
+
+interface AbilityRequirement {
+    action: string;
+    subject: AbilitySubject;
+    field?: string;
+}
+interface AuthorizationContext {
+    token: string;
+    userId?: string;
+    ability: AuthyonAbility;
+    permissions: readonly string[];
+    roles: readonly string[];
+}
+interface AuthorizationOptions extends AuthyonAbilityOptions {
+    requirement?: AbilityRequirement;
+    /** Uses database-backed validation by default; introspection can be selected when desired. */
+    verification?: "validate" | "introspect" | "jwks";
+    /** Required for local JWKS verification. Create once and reuse its key cache. */
+    jwksVerifier?: JwksTokenVerifier;
+    /** Real end-user IP, obtained from trusted application infrastructure. */
+    clientIp?: string;
+}
+declare class AuthorizationError extends Error {
+    readonly status: 401 | 403 | 503;
+    readonly code: "authorization.unauthenticated" | "authorization.forbidden" | "authorization.unavailable";
+    constructor(status: 401 | 403 | 503, code: "authorization.unauthenticated" | "authorization.forbidden" | "authorization.unavailable", message: string);
+}
+/** Validates a bearer token and creates an Authyon-backed ability for server runtimes. */
+declare function authorizeToken(client: AuthyonServerClient, token: string, options?: AuthorizationOptions): Promise<AuthorizationContext>;
+/** Works with Web Request objects used by Next.js Route Handlers and other Fetch runtimes. */
+declare function authorizeRequest(client: AuthyonServerClient, request: Pick<Request, "headers">, options?: RequestAuthorizationOptions): Promise<AuthorizationContext>;
+interface RequestAuthorizationOptions extends AuthorizationOptions {
+    /** Platform-aware resolver. Only read headers that your trusted proxy overwrites. */
+    resolveClientIp?: (request: Pick<Request, "headers">) => string | undefined;
+}
+interface ExpressRequestLike {
+    headers: Record<string, string | string[] | undefined>;
+    ip?: string;
+    socket?: {
+        remoteAddress?: string;
+    };
+    authyon?: AuthorizationContext;
+}
+interface ExpressResponseLike {
+    status(code: number): ExpressResponseLike;
+    json(body: unknown): unknown;
+}
+type ExpressNext = (error?: unknown) => void;
+interface ExpressAuthorizationMiddlewareOptions extends AuthorizationOptions {
+    /** Property assigned to the request. Defaults to `authyon`. */
+    requestProperty?: string;
+    /** Pass authorization errors to Express error middleware instead of writing a JSON response. */
+    passErrorsToNext?: boolean;
+    /** Trust Express's proxy-aware `request.ip`. Disabled by default. */
+    trustProxy?: boolean;
+    /** Overrides all built-in IP resolution; return only a trusted, single client IP. */
+    resolveClientIp?: (request: ExpressRequestLike) => string | undefined;
+}
+/** Dependency-free middleware compatible with Express and similar Connect frameworks. */
+declare function createExpressAuthorizationMiddleware(client: AuthyonServerClient, options?: ExpressAuthorizationMiddlewareOptions): (request: ExpressRequestLike & Record<string, unknown>, response: ExpressResponseLike, next: ExpressNext) => Promise<void>;
+/** Converts an authorization error into a Fetch Response suitable for Next.js. */
+declare function createAuthorizationErrorResponse(error: unknown): Response;
+
+export { type AbilitySubject as A, type ExpressAuthorizationMiddlewareOptions as E, type PermissionGroup as P, type RequestAuthorizationOptions as R, AuthorizationError as a, type AbilityConditions as b, type AbilityEvent as c, type AbilityListener as d, type AbilityRequirement as e, type AbilityRule as f, type AuthorizationContext as g, type AuthorizationOptions as h, AuthyonAbility as i, AuthyonAbilityBuilder as j, type AuthyonAbilityOptions as k, type AuthyonPermissionSource as l, type ExpressNext as m, type ExpressRequestLike as n, type ExpressResponseLike as o, authorizeRequest as p, authorizeToken as q, createAuthorizationErrorResponse as r, createAuthyonAbility as s, createAuthyonRules as t, createExpressAuthorizationMiddleware as u, hasPermission as v, hasPermissionGroup as w };

package/dist/{authorization-BGURVMFT.d.cts → authyonServerClient-D8r47VSq.d.cts}

@@ -97,6 +97,10 @@ interface Organization {
     memberCount?: number;
     createdAt?: string;
     updatedAt?: string;
+    /** JSON-encoded metadata that may be exposed to tenant members. */
+    publicMetadata?: string;
+    /** JSON-encoded metadata available only through administrative APIs. */
+    privateMetadata?: string;
 }
 /** One of a user's tenant memberships, as embedded in `EnvironmentUser.tenantMemberships`. */
 interface TenantMembership {
@@ -234,6 +238,8 @@ interface CreateOrganizationInput {
     name: string;
     slug: string;
     description?: string;
+    publicMetadata?: Record<string, unknown>;
+    privateMetadata?: Record<string, unknown>;
 }
 interface UpdateOrganizationInput {
     name: string;
@@ -741,7 +747,11 @@ declare class AuthyonServerClient {
             get: (tenantId: string) => Promise<Organization>;
             /** PUT /env/tenants/{tenantId} — update a tenant. */
             update: (tenantId: string, input: UpdateOrganizationInput) => Promise<Organization>;
-            /** DELETE /env/tenants/{tenantId} — delete a tenant. */
+            /** PUT /env/tenants/{tenantId}/metadata - replace public and private metadata. */
+            updateMetadata: (tenantId: string, input: Pick<CreateOrganizationInput, "publicMetadata" | "privateMetadata">) => Promise<void>;
+            /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+            disable: (tenantId: string) => Promise<void>;
+            /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
             delete: (tenantId: string) => Promise<void>;
             members: {
                 /**
@@ -881,118 +891,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-type AbilitySubject = string | Record<string, unknown>;
-type AbilityConditions = Record<string, unknown>;
-interface AbilityRule {
-    action: string | string[];
-    subject: string | string[];
-    inverted?: boolean;
-    conditions?: AbilityConditions;
-    fields?: string[];
-    reason?: string;
-}
-interface AuthyonPermissionSource {
-    permissions?: readonly string[] | null;
-    roles?: readonly string[] | null;
-    /** OAuth scopes are also accepted and interpreted as Authyon permissions. */
-    scope?: string | null;
-}
-interface AuthyonAbilityOptions {
-    rules?: readonly AbilityRule[];
-    /** Rules added when the source contains a matching Authyon role. */
-    roleRules?: Readonly<Record<string, readonly AbilityRule[]>>;
-    roles?: readonly string[] | null;
-    detectSubjectType?: (subject: Record<string, unknown>) => string;
-}
-type AbilityEvent = "updated";
-type AbilityListener = (rules: readonly AbilityRule[]) => void;
-/** Isomorphic, deny-by-default authorization engine backed by Authyon permissions. */
-declare class AuthyonAbility {
-    private readonly detectSubjectType;
-    private currentRules;
-    private readonly listeners;
-    constructor(rules?: readonly AbilityRule[], detectSubjectType?: (subject: Record<string, unknown>) => string);
-    get rules(): readonly AbilityRule[];
-    can(action: string, subject: AbilitySubject, field?: string): boolean;
-    cannot(action: string, subject: AbilitySubject, field?: string): boolean;
-    rulesFor(action: string, subject: string): readonly AbilityRule[];
-    update(rules: readonly AbilityRule[]): void;
-    on(event: AbilityEvent, listener: AbilityListener): () => void;
-}
-/** Fluent rule builder with CASL-like `can` and `cannot` methods. */
-declare class AuthyonAbilityBuilder {
-    readonly rules: AbilityRule[];
-    can(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[]): this;
-    cannot(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[], reason?: string): this;
-    build(options?: Pick<AuthyonAbilityOptions, "detectSubjectType">): AuthyonAbility;
-}
-/** Creates an ability from Authyon permissions, OAuth scope and optional role rules. */
-declare function createAuthyonAbility(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AuthyonAbility;
-/** Checks an Authyon permission string using the same wildcard rules as an ability. */
-declare function hasPermission(source: AuthyonPermissionSource | readonly string[], requiredPermission: string): boolean;
-/** Converts Authyon's `subject:action` permission strings to authorization rules. */
-declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
-
-interface AbilityRequirement {
-    action: string;
-    subject: AbilitySubject;
-    field?: string;
-}
-interface AuthorizationContext {
-    token: string;
-    userId?: string;
-    ability: AuthyonAbility;
-    permissions: readonly string[];
-    roles: readonly string[];
-}
-interface AuthorizationOptions extends AuthyonAbilityOptions {
-    requirement?: AbilityRequirement;
-    /** Uses database-backed validation by default; introspection can be selected when desired. */
-    verification?: "validate" | "introspect" | "jwks";
-    /** Required for local JWKS verification. Create once and reuse its key cache. */
-    jwksVerifier?: JwksTokenVerifier;
-    /** Real end-user IP, obtained from trusted application infrastructure. */
-    clientIp?: string;
-}
-declare class AuthorizationError extends Error {
-    readonly status: 401 | 403 | 503;
-    readonly code: "authorization.unauthenticated" | "authorization.forbidden" | "authorization.unavailable";
-    constructor(status: 401 | 403 | 503, code: "authorization.unauthenticated" | "authorization.forbidden" | "authorization.unavailable", message: string);
-}
-/** Validates a bearer token and creates an Authyon-backed ability for server runtimes. */
-declare function authorizeToken(client: AuthyonServerClient, token: string, options?: AuthorizationOptions): Promise<AuthorizationContext>;
-/** Works with Web Request objects used by Next.js Route Handlers and other Fetch runtimes. */
-declare function authorizeRequest(client: AuthyonServerClient, request: Pick<Request, "headers">, options?: RequestAuthorizationOptions): Promise<AuthorizationContext>;
-interface RequestAuthorizationOptions extends AuthorizationOptions {
-    /** Platform-aware resolver. Only read headers that your trusted proxy overwrites. */
-    resolveClientIp?: (request: Pick<Request, "headers">) => string | undefined;
-}
-interface ExpressRequestLike {
-    headers: Record<string, string | string[] | undefined>;
-    ip?: string;
-    socket?: {
-        remoteAddress?: string;
-    };
-    authyon?: AuthorizationContext;
-}
-interface ExpressResponseLike {
-    status(code: number): ExpressResponseLike;
-    json(body: unknown): unknown;
-}
-type ExpressNext = (error?: unknown) => void;
-interface ExpressAuthorizationMiddlewareOptions extends AuthorizationOptions {
-    /** Property assigned to the request. Defaults to `authyon`. */
-    requestProperty?: string;
-    /** Pass authorization errors to Express error middleware instead of writing a JSON response. */
-    passErrorsToNext?: boolean;
-    /** Trust Express's proxy-aware `request.ip`. Disabled by default. */
-    trustProxy?: boolean;
-    /** Overrides all built-in IP resolution; return only a trusted, single client IP. */
-    resolveClientIp?: (request: ExpressRequestLike) => string | undefined;
-}
-/** Dependency-free middleware compatible with Express and similar Connect frameworks. */
-declare function createExpressAuthorizationMiddleware(client: AuthyonServerClient, options?: ExpressAuthorizationMiddlewareOptions): (request: ExpressRequestLike & Record<string, unknown>, response: ExpressResponseLike, next: ExpressNext) => Promise<void>;
-/** Converts an authorization error into a Fetch Response suitable for Next.js. */
-declare function createAuthorizationErrorResponse(error: unknown): Response;
-
-export { type Organization as $, AuthyonServerClient as A, type CredentialCreator as B, type ClientCredentials as C, type CredentialDetail as D, type CredentialListOptions as E, type CredentialPermissionsInput as F, type CredentialScope as G, type HttpAdapter as H, type EnvironmentUser as I, type ExpressAuthorizationMiddlewareOptions as J, type ExpressNext as K, type ExpressRequestLike as L, type ExpressResponseLike as M, FetchHttpAdapter as N, type HttpAdapterRequest as O, type HttpLogEvent as P, type HttpLogger as Q, type RequestAuthorizationOptions as R, type IntrospectResult as S, type InviteTenantMemberInput as T, type InviteWorkspaceMemberInput as U, type JsonWebKeySet as V, JwksTokenVerifier as W, type JwksTokenVerifierOptions as X, LoggingHttpAdapter as Y, type LoginActivity as Z, type OpenIdConfiguration as _, type AbilitySubject as a, type Paged as a0, type PaginationOptions as a1, type Permission as a2, type PermissionsByRole as a3, PlatformScopedClient as a4, type ReservedPermissions as a5, type Role as a6, type RoleGrant as a7, type RoleInput as a8, type RoleList as a9, authorizeRequest as aA, authorizeToken as aB, createAuthorizationErrorResponse as aC, createAuthyonAbility as aD, createAuthyonRules as aE, createClient as aF, createExpressAuthorizationMiddleware as aG, hasPermission as aH, normalizeClientIp as aI, type RolePermissions as aa, type SafeJwtAlgorithm as ab, type TenantClientValidationResult as ac, type TenantCredentialIssued as ad, type TenantCredentialSummary as ae, type TenantManagementScope as af, type TenantMember as ag, type TenantMemberPage as ah, type TenantMembership as ai, TenantScopedClient as aj, type TokenResult as ak, TokenVerificationError as al, type TokenVerificationErrorCode as am, type UpdateOrganizationInput as an, type User as ao, UserScopedClient as ap, type ValidateResult as aq, type VerifiedAccessToken as ar, type WorkspaceInvite as as, type WorkspaceInviteAccepted as at, type WorkspaceInviteIssued as au, type WorkspaceInvitePreview as av, WorkspaceInvitesClient as aw, type WorkspaceMember as ax, type WorkspaceRole as ay, type WorkspaceTeam as az, AuthorizationError as b, type HttpLoggerOptions as c, type AbilityConditions as d, type AbilityEvent as e, type AbilityListener as f, type AbilityRequirement as g, type AbilityRule as h, type AcceptWorkspaceInviteInput as i, type AccessTokenSource as j, type AuditEvent as k, type AuthorizationContext as l, type AuthorizationOptions as m, AuthyonAbility as n, AuthyonAbilityBuilder as o, type AuthyonAbilityOptions as p, type AuthyonJwksDiscoveryOptions as q, type AuthyonJwtClaims as r, type AuthyonPermissionSource as s, type AuthyonServerClientOptions as t, type ClientRequestContext as u, type CreateCredentialInput as v, type CreateOrganizationInput as w, type CreatePermissionInput as x, type CreateTenantCredentialInput as y, type CreateUserInput as z };
+export { type TenantMemberPage as $, AuthyonServerClient as A, type Organization as B, type ClientCredentials as C, type PaginationOptions as D, type EnvironmentUser as E, FetchHttpAdapter as F, type Permission as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type PermissionsByRole as K, LoggingHttpAdapter as L, PlatformScopedClient as M, type Role as N, type OpenIdConfiguration as O, type Paged as P, type RoleGrant as Q, type ReservedPermissions as R, type RoleInput as S, type RoleList as T, type RolePermissions as U, type SafeJwtAlgorithm as V, type TenantClientValidationResult as W, type TenantCredentialIssued as X, type TenantCredentialSummary as Y, type TenantManagementScope as Z, type TenantMember as _, type HttpLoggerOptions as a, type TenantMembership as a0, TenantScopedClient as a1, type TokenResult as a2, TokenVerificationError as a3, type TokenVerificationErrorCode as a4, type UpdateOrganizationInput as a5, type User as a6, UserScopedClient as a7, type ValidateResult as a8, type VerifiedAccessToken as a9, type WorkspaceInvite as aa, type WorkspaceInviteAccepted as ab, type WorkspaceInviteIssued as ac, type WorkspaceInvitePreview as ad, WorkspaceInvitesClient as ae, type WorkspaceMember as af, type WorkspaceRole as ag, type WorkspaceTeam as ah, createClient as ai, normalizeClientIp as aj, type AcceptWorkspaceInviteInput as b, type AccessTokenSource as c, type AuditEvent as d, type AuthyonJwksDiscoveryOptions as e, type AuthyonJwtClaims as f, type AuthyonServerClientOptions as g, type ClientRequestContext as h, type CreateCredentialInput as i, type CreateOrganizationInput as j, type CreatePermissionInput as k, type CreateTenantCredentialInput as l, type CreateUserInput as m, type CredentialCreator as n, type CredentialDetail as o, type CredentialListOptions as p, type CredentialPermissionsInput as q, type CredentialScope as r, type HttpAdapterRequest as s, type HttpLogEvent as t, type HttpLogger as u, type InviteTenantMemberInput as v, type InviteWorkspaceMemberInput as w, JwksTokenVerifier as x, type JwksTokenVerifierOptions as y, type LoginActivity as z };

package/dist/{authorization-BGURVMFT.d.ts → authyonServerClient-D8r47VSq.d.ts}

@@ -97,6 +97,10 @@ interface Organization {
     memberCount?: number;
     createdAt?: string;
     updatedAt?: string;
+    /** JSON-encoded metadata that may be exposed to tenant members. */
+    publicMetadata?: string;
+    /** JSON-encoded metadata available only through administrative APIs. */
+    privateMetadata?: string;
 }
 /** One of a user's tenant memberships, as embedded in `EnvironmentUser.tenantMemberships`. */
 interface TenantMembership {
@@ -234,6 +238,8 @@ interface CreateOrganizationInput {
     name: string;
     slug: string;
     description?: string;
+    publicMetadata?: Record<string, unknown>;
+    privateMetadata?: Record<string, unknown>;
 }
 interface UpdateOrganizationInput {
     name: string;
@@ -741,7 +747,11 @@ declare class AuthyonServerClient {
             get: (tenantId: string) => Promise<Organization>;
             /** PUT /env/tenants/{tenantId} — update a tenant. */
             update: (tenantId: string, input: UpdateOrganizationInput) => Promise<Organization>;
-            /** DELETE /env/tenants/{tenantId} — delete a tenant. */
+            /** PUT /env/tenants/{tenantId}/metadata - replace public and private metadata. */
+            updateMetadata: (tenantId: string, input: Pick<CreateOrganizationInput, "publicMetadata" | "privateMetadata">) => Promise<void>;
+            /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+            disable: (tenantId: string) => Promise<void>;
+            /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
             delete: (tenantId: string) => Promise<void>;
             members: {
                 /**
@@ -881,118 +891,4 @@ declare class TenantScopedClient {
 /** Convenience factory: `const authyon = createClient({ clientId, clientSecret })`. */
 declare function createClient(options?: AuthyonServerClientOptions): AuthyonServerClient;
 
-type AbilitySubject = string | Record<string, unknown>;
-type AbilityConditions = Record<string, unknown>;
-interface AbilityRule {
-    action: string | string[];
-    subject: string | string[];
-    inverted?: boolean;
-    conditions?: AbilityConditions;
-    fields?: string[];
-    reason?: string;
-}
-interface AuthyonPermissionSource {
-    permissions?: readonly string[] | null;
-    roles?: readonly string[] | null;
-    /** OAuth scopes are also accepted and interpreted as Authyon permissions. */
-    scope?: string | null;
-}
-interface AuthyonAbilityOptions {
-    rules?: readonly AbilityRule[];
-    /** Rules added when the source contains a matching Authyon role. */
-    roleRules?: Readonly<Record<string, readonly AbilityRule[]>>;
-    roles?: readonly string[] | null;
-    detectSubjectType?: (subject: Record<string, unknown>) => string;
-}
-type AbilityEvent = "updated";
-type AbilityListener = (rules: readonly AbilityRule[]) => void;
-/** Isomorphic, deny-by-default authorization engine backed by Authyon permissions. */
-declare class AuthyonAbility {
-    private readonly detectSubjectType;
-    private currentRules;
-    private readonly listeners;
-    constructor(rules?: readonly AbilityRule[], detectSubjectType?: (subject: Record<string, unknown>) => string);
-    get rules(): readonly AbilityRule[];
-    can(action: string, subject: AbilitySubject, field?: string): boolean;
-    cannot(action: string, subject: AbilitySubject, field?: string): boolean;
-    rulesFor(action: string, subject: string): readonly AbilityRule[];
-    update(rules: readonly AbilityRule[]): void;
-    on(event: AbilityEvent, listener: AbilityListener): () => void;
-}
-/** Fluent rule builder with CASL-like `can` and `cannot` methods. */
-declare class AuthyonAbilityBuilder {
-    readonly rules: AbilityRule[];
-    can(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[]): this;
-    cannot(action: string | string[], subject: string | string[], conditions?: AbilityConditions, fields?: string[], reason?: string): this;
-    build(options?: Pick<AuthyonAbilityOptions, "detectSubjectType">): AuthyonAbility;
-}
-/** Creates an ability from Authyon permissions, OAuth scope and optional role rules. */
-declare function createAuthyonAbility(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AuthyonAbility;
-/** Checks an Authyon permission string using the same wildcard rules as an ability. */
-declare function hasPermission(source: AuthyonPermissionSource | readonly string[], requiredPermission: string): boolean;
-/** Converts Authyon's `subject:action` permission strings to authorization rules. */
-declare function createAuthyonRules(source?: AuthyonPermissionSource, options?: AuthyonAbilityOptions): AbilityRule[];
-
-interface AbilityRequirement {
-    action: string;
-    subject: AbilitySubject;
-    field?: string;
-}
-interface AuthorizationContext {
-    token: string;
-    userId?: string;
-    ability: AuthyonAbility;
-    permissions: readonly string[];
-    roles: readonly string[];
-}
-interface AuthorizationOptions extends AuthyonAbilityOptions {
-    requirement?: AbilityRequirement;
-    /** Uses database-backed validation by default; introspection can be selected when desired. */
-    verification?: "validate" | "introspect" | "jwks";
-    /** Required for local JWKS verification. Create once and reuse its key cache. */
-    jwksVerifier?: JwksTokenVerifier;
-    /** Real end-user IP, obtained from trusted application infrastructure. */
-    clientIp?: string;
-}
-declare class AuthorizationError extends Error {
-    readonly status: 401 | 403 | 503;
-    readonly code: "authorization.unauthenticated" | "authorization.forbidden" | "authorization.unavailable";
-    constructor(status: 401 | 403 | 503, code: "authorization.unauthenticated" | "authorization.forbidden" | "authorization.unavailable", message: string);
-}
-/** Validates a bearer token and creates an Authyon-backed ability for server runtimes. */
-declare function authorizeToken(client: AuthyonServerClient, token: string, options?: AuthorizationOptions): Promise<AuthorizationContext>;
-/** Works with Web Request objects used by Next.js Route Handlers and other Fetch runtimes. */
-declare function authorizeRequest(client: AuthyonServerClient, request: Pick<Request, "headers">, options?: RequestAuthorizationOptions): Promise<AuthorizationContext>;
-interface RequestAuthorizationOptions extends AuthorizationOptions {
-    /** Platform-aware resolver. Only read headers that your trusted proxy overwrites. */
-    resolveClientIp?: (request: Pick<Request, "headers">) => string | undefined;
-}
-interface ExpressRequestLike {
-    headers: Record<string, string | string[] | undefined>;
-    ip?: string;
-    socket?: {
-        remoteAddress?: string;
-    };
-    authyon?: AuthorizationContext;
-}
-interface ExpressResponseLike {
-    status(code: number): ExpressResponseLike;
-    json(body: unknown): unknown;
-}
-type ExpressNext = (error?: unknown) => void;
-interface ExpressAuthorizationMiddlewareOptions extends AuthorizationOptions {
-    /** Property assigned to the request. Defaults to `authyon`. */
-    requestProperty?: string;
-    /** Pass authorization errors to Express error middleware instead of writing a JSON response. */
-    passErrorsToNext?: boolean;
-    /** Trust Express's proxy-aware `request.ip`. Disabled by default. */
-    trustProxy?: boolean;
-    /** Overrides all built-in IP resolution; return only a trusted, single client IP. */
-    resolveClientIp?: (request: ExpressRequestLike) => string | undefined;
-}
-/** Dependency-free middleware compatible with Express and similar Connect frameworks. */
-declare function createExpressAuthorizationMiddleware(client: AuthyonServerClient, options?: ExpressAuthorizationMiddlewareOptions): (request: ExpressRequestLike & Record<string, unknown>, response: ExpressResponseLike, next: ExpressNext) => Promise<void>;
-/** Converts an authorization error into a Fetch Response suitable for Next.js. */
-declare function createAuthorizationErrorResponse(error: unknown): Response;
-
-export { type Organization as $, AuthyonServerClient as A, type CredentialCreator as B, type ClientCredentials as C, type CredentialDetail as D, type CredentialListOptions as E, type CredentialPermissionsInput as F, type CredentialScope as G, type HttpAdapter as H, type EnvironmentUser as I, type ExpressAuthorizationMiddlewareOptions as J, type ExpressNext as K, type ExpressRequestLike as L, type ExpressResponseLike as M, FetchHttpAdapter as N, type HttpAdapterRequest as O, type HttpLogEvent as P, type HttpLogger as Q, type RequestAuthorizationOptions as R, type IntrospectResult as S, type InviteTenantMemberInput as T, type InviteWorkspaceMemberInput as U, type JsonWebKeySet as V, JwksTokenVerifier as W, type JwksTokenVerifierOptions as X, LoggingHttpAdapter as Y, type LoginActivity as Z, type OpenIdConfiguration as _, type AbilitySubject as a, type Paged as a0, type PaginationOptions as a1, type Permission as a2, type PermissionsByRole as a3, PlatformScopedClient as a4, type ReservedPermissions as a5, type Role as a6, type RoleGrant as a7, type RoleInput as a8, type RoleList as a9, authorizeRequest as aA, authorizeToken as aB, createAuthorizationErrorResponse as aC, createAuthyonAbility as aD, createAuthyonRules as aE, createClient as aF, createExpressAuthorizationMiddleware as aG, hasPermission as aH, normalizeClientIp as aI, type RolePermissions as aa, type SafeJwtAlgorithm as ab, type TenantClientValidationResult as ac, type TenantCredentialIssued as ad, type TenantCredentialSummary as ae, type TenantManagementScope as af, type TenantMember as ag, type TenantMemberPage as ah, type TenantMembership as ai, TenantScopedClient as aj, type TokenResult as ak, TokenVerificationError as al, type TokenVerificationErrorCode as am, type UpdateOrganizationInput as an, type User as ao, UserScopedClient as ap, type ValidateResult as aq, type VerifiedAccessToken as ar, type WorkspaceInvite as as, type WorkspaceInviteAccepted as at, type WorkspaceInviteIssued as au, type WorkspaceInvitePreview as av, WorkspaceInvitesClient as aw, type WorkspaceMember as ax, type WorkspaceRole as ay, type WorkspaceTeam as az, AuthorizationError as b, type HttpLoggerOptions as c, type AbilityConditions as d, type AbilityEvent as e, type AbilityListener as f, type AbilityRequirement as g, type AbilityRule as h, type AcceptWorkspaceInviteInput as i, type AccessTokenSource as j, type AuditEvent as k, type AuthorizationContext as l, type AuthorizationOptions as m, AuthyonAbility as n, AuthyonAbilityBuilder as o, type AuthyonAbilityOptions as p, type AuthyonJwksDiscoveryOptions as q, type AuthyonJwtClaims as r, type AuthyonPermissionSource as s, type AuthyonServerClientOptions as t, type ClientRequestContext as u, type CreateCredentialInput as v, type CreateOrganizationInput as w, type CreatePermissionInput as x, type CreateTenantCredentialInput as y, type CreateUserInput as z };
+export { type TenantMemberPage as $, AuthyonServerClient as A, type Organization as B, type ClientCredentials as C, type PaginationOptions as D, type EnvironmentUser as E, FetchHttpAdapter as F, type Permission as G, type HttpAdapter as H, type IntrospectResult as I, type JsonWebKeySet as J, type PermissionsByRole as K, LoggingHttpAdapter as L, PlatformScopedClient as M, type Role as N, type OpenIdConfiguration as O, type Paged as P, type RoleGrant as Q, type ReservedPermissions as R, type RoleInput as S, type RoleList as T, type RolePermissions as U, type SafeJwtAlgorithm as V, type TenantClientValidationResult as W, type TenantCredentialIssued as X, type TenantCredentialSummary as Y, type TenantManagementScope as Z, type TenantMember as _, type HttpLoggerOptions as a, type TenantMembership as a0, TenantScopedClient as a1, type TokenResult as a2, TokenVerificationError as a3, type TokenVerificationErrorCode as a4, type UpdateOrganizationInput as a5, type User as a6, UserScopedClient as a7, type ValidateResult as a8, type VerifiedAccessToken as a9, type WorkspaceInvite as aa, type WorkspaceInviteAccepted as ab, type WorkspaceInviteIssued as ac, type WorkspaceInvitePreview as ad, WorkspaceInvitesClient as ae, type WorkspaceMember as af, type WorkspaceRole as ag, type WorkspaceTeam as ah, createClient as ai, normalizeClientIp as aj, type AcceptWorkspaceInviteInput as b, type AccessTokenSource as c, type AuditEvent as d, type AuthyonJwksDiscoveryOptions as e, type AuthyonJwtClaims as f, type AuthyonServerClientOptions as g, type ClientRequestContext as h, type CreateCredentialInput as i, type CreateOrganizationInput as j, type CreatePermissionInput as k, type CreateTenantCredentialInput as l, type CreateUserInput as m, type CredentialCreator as n, type CredentialDetail as o, type CredentialListOptions as p, type CredentialPermissionsInput as q, type CredentialScope as r, type HttpAdapterRequest as s, type HttpLogEvent as t, type HttpLogger as u, type InviteTenantMemberInput as v, type InviteWorkspaceMemberInput as w, JwksTokenVerifier as x, type JwksTokenVerifierOptions as y, type LoginActivity as z };