@ax-hub/admin-sdk 1.0.0

package/dist/index.d.cts

@@ -0,0 +1,873 @@
+interface FieldError {
+    name: string;
+    code: string;
+    message?: string;
+}
+interface RetryInfo {
+    afterMs: number;
+}
+interface AxHubErrorInit {
+    message: string;
+    code: string;
+    category: string;
+    httpStatus: number;
+    retryable: boolean;
+    requestId: string;
+    resource?: string;
+    fields?: FieldError[];
+    retry?: RetryInfo;
+    docUrl?: string;
+    cause?: unknown;
+}
+declare class AxHubError extends Error {
+    readonly code: string;
+    readonly category: string;
+    readonly httpStatus: number;
+    readonly retryable: boolean;
+    readonly requestId: string;
+    readonly resource?: string;
+    readonly fields?: FieldError[];
+    readonly retry?: RetryInfo;
+    readonly docUrl?: string;
+    constructor(init: AxHubErrorInit);
+    toJSON(): Record<string, unknown>;
+    toString(): string;
+}
+declare function formatErrorMessage(err: AxHubError): string;
+declare class ValidationError extends AxHubError {
+}
+declare class UnauthenticatedError extends AxHubError {
+}
+declare class PermissionDeniedError extends AxHubError {
+}
+declare class NotFoundError extends AxHubError {
+}
+declare class ConflictError extends AxHubError {
+}
+declare class PreconditionFailedError extends AxHubError {
+}
+declare class RateLimitedError extends AxHubError {
+}
+declare class InternalServerError extends AxHubError {
+}
+declare class UnavailableError extends AxHubError {
+}
+declare class SlugTakenError extends ConflictError {
+}
+declare class AlreadyMemberError extends ConflictError {
+}
+declare class AlreadyDeletedError extends ConflictError {
+}
+declare class TokenMissingError extends UnauthenticatedError {
+}
+declare class TokenExpiredError extends UnauthenticatedError {
+}
+declare class TokenInvalidError extends UnauthenticatedError {
+}
+declare class NotAdminError extends PermissionDeniedError {
+}
+declare class ForbiddenError extends PermissionDeniedError {
+}
+declare class PermanentlyDeletedError extends NotFoundError {
+}
+declare class InvitationExpiredError extends NotFoundError {
+}
+declare class AlreadyRevokedError extends ConflictError {
+}
+declare class AlreadySettledError extends ConflictError {
+}
+declare class AlreadyActiveError extends ConflictError {
+}
+declare class AlreadyInactiveError extends ConflictError {
+}
+declare class AlreadyAccessedError extends ConflictError {
+}
+declare class NotDeletedError extends ConflictError {
+}
+declare class LastAdminError extends ConflictError {
+}
+declare class PendingExistsError extends ConflictError {
+}
+declare class InvalidStateTransitionError extends ConflictError {
+}
+declare class SchemaNameTakenError extends ConflictError {
+}
+declare class DomainTakenError extends ConflictError {
+}
+declare class DuplicateError extends ConflictError {
+}
+declare class InvalidValueError extends ValidationError {
+}
+declare class RequiredError extends ValidationError {
+}
+declare class EmptyError extends ValidationError {
+}
+declare class BadRequestError extends ValidationError {
+}
+declare class NotMemberError extends PermissionDeniedError {
+}
+declare class NotAllowedError extends PermissionDeniedError {
+}
+declare class AppUnavailableError extends UnavailableError {
+}
+declare class NetworkError extends AxHubError {
+}
+declare class TimeoutError extends AxHubError {
+}
+declare class DecodeError extends AxHubError {
+}
+declare class AbortError extends AxHubError {
+}
+declare class InvalidPathError extends AxHubError {
+}
+declare class StreamConsumedError extends AxHubError {
+}
+declare class TenantSlugRequiredError extends AxHubError {
+}
+/**
+ * SDK-self error: tenant-scoped app routes
+ * (`POST`/`GET /api/v1/tenants/{tenantID}/apps`) require a tenant **UUID** in
+ * the path. Thrown before any request when the SDK holds only a slug (or no
+ * tenant context). Mirrors {@link TenantSlugRequiredError}; constructed inline
+ * at call sites (crud.ts / scoped.ts), like TenantSlugRequiredError in client.ts.
+ */
+declare class TenantIdRequiredError extends AxHubError {
+}
+declare class ConfigurationError extends AxHubError {
+}
+declare class PoolStaleError extends UnauthenticatedError {
+}
+declare class WebhookVerificationError extends ValidationError {
+}
+declare class TableNotFoundError extends NotFoundError {
+}
+declare class IntrospectFailedError extends InternalServerError {
+}
+declare class InvalidCursorError extends ValidationError {
+}
+declare class LegacyCursorError extends ValidationError {
+}
+declare class MockInProductionError extends ConfigurationError {
+}
+declare class ScanLimitExceededError extends InternalServerError {
+}
+interface OAuthErrorInit {
+    code: string;
+    description?: string;
+    uri?: string;
+    httpStatus: number;
+    retryable: boolean;
+    requestId: string;
+}
+declare class OAuthError extends AxHubError {
+    readonly description?: string;
+    readonly uri?: string;
+    constructor(init: OAuthErrorInit);
+}
+declare class InvalidGrantError extends OAuthError {
+}
+declare class AccessDeniedError extends OAuthError {
+}
+declare class AuthorizationPendingError extends OAuthError {
+}
+declare class SlowDownError extends OAuthError {
+}
+declare class ExpiredTokenError extends OAuthError {
+}
+declare class DeviceFlowDeniedError extends AccessDeniedError {
+}
+declare class DeviceFlowTimeoutError extends ExpiredTokenError {
+}
+declare class InvalidTargetError extends OAuthError {
+}
+declare class InvalidClientError extends OAuthError {
+}
+declare class InvalidRequestError extends OAuthError {
+}
+declare class InvalidScopeError extends OAuthError {
+}
+declare class InvalidTokenError extends OAuthError {
+}
+declare class UnauthorizedClientError extends OAuthError {
+}
+declare class UnsupportedGrantTypeError extends OAuthError {
+}
+declare class OAuthServerError extends OAuthError {
+}
+declare class TemporarilyUnavailableError extends OAuthError {
+}
+
+declare const brand: unique symbol;
+type Branded<T, B extends string> = T & {
+    readonly [brand]: B;
+};
+type AppId = Branded<string, 'AppId'>;
+type AppID = AppId;
+type DeploymentId = Branded<string, 'DeploymentId'>;
+type DeploymentID = DeploymentId;
+type TenantId = Branded<string, 'TenantId'>;
+type TenantID = TenantId;
+type TenantSlug = Branded<string, 'TenantSlug'>;
+type AppSlug = Branded<string, 'AppSlug'>;
+type PatId = Branded<string, 'PatId'>;
+type PATID = PatId;
+type UserId = Branded<string, 'UserId'>;
+type UserID = UserId;
+type RequestId = Branded<string, 'RequestId'>;
+type ResourceID = Branded<string, 'ResourceID'>;
+type ConnectorID = Branded<string, 'ConnectorID'>;
+type SubjectID = Branded<string, 'SubjectID'>;
+type GrantID = Branded<string, 'GrantID'>;
+type TagID = Branded<string, 'TagID'>;
+type AuditEventID = Branded<string, 'AuditEventID'>;
+type TableID = Branded<string, 'TableID'>;
+declare function asAppId(s: string): AppId;
+declare function asDeploymentId(s: string): DeploymentId;
+declare function asTenantId(s: string): TenantId;
+declare function asTenantSlug(s: string): TenantSlug;
+declare function asAppSlug(s: string): AppSlug;
+declare function asPatId(s: string): PatId;
+declare function asUserId(s: string): UserId;
+declare function asRequestId(s: string): RequestId;
+/**
+ * Runtime-validating branded ID factories. SDK methods still accept plain
+ * strings; these factories are for callers who want validation plus
+ * compile-time brand separation in their own code.
+ */
+declare const id: {
+    tenant(value: string): TenantID;
+    tenantSlug(value: string): TenantSlug;
+    app(value: string): AppID;
+    appSlug(value: string): AppSlug;
+    user(value: string): UserID;
+    deployment(value: string): DeploymentID;
+    pat(value: string): PATID;
+    resource(value: string): ResourceID;
+    connector(value: string): ConnectorID;
+    subject(value: string): SubjectID;
+    grant(value: string): GrantID;
+    tag(value: string): TagID;
+    auditEvent(value: string): AuditEventID;
+    table(value: string): TableID;
+};
+
+interface Logger {
+    debug(obj: object, msg?: string): void;
+    info(obj: object, msg?: string): void;
+    warn(obj: object, msg?: string): void;
+    error(obj: object, msg?: string): void;
+}
+
+declare function parseRetryAfter(header: string | null | undefined): number;
+type RateLimitStrategy = 'sleep' | 'throw';
+
+interface RetryPolicy {
+    maxAttempts: number;
+    baseMs: number;
+    capMs: number;
+    jitter: () => number;
+}
+
+type FetchLike = typeof fetch;
+type TokenType = 'pat' | 'jwt';
+type AuthRing = 'admin' | 'data' | 'public';
+interface AuthProvider {
+    headersFor(ring: AuthRing): Record<string, string>;
+    onUnauthorized(): Promise<boolean>;
+}
+interface HttpClientOptions {
+    baseUrl: string;
+    auth: AuthProvider;
+    fetch?: FetchLike;
+    logger?: Logger;
+    debug?: boolean;
+    timeoutMs?: number;
+    idempotencyKey?: {
+        autoGenerate?: boolean;
+        generator?: () => string;
+    };
+    retryPolicy?: RetryPolicy;
+    rateLimitStrategy?: RateLimitStrategy;
+}
+interface RequestInit2 {
+    ring: AuthRing;
+    query?: Record<string, string | number | boolean | undefined>;
+    body?: unknown;
+    parseBody?: boolean;
+    signal?: AbortSignal;
+    idempotent?: boolean;
+    rawResponse?: boolean;
+    headers?: Record<string, string>;
+    timeoutMs?: number;
+    idempotencyKey?: string | false;
+}
+declare class HttpClient {
+    readonly baseUrl: string;
+    readonly auth: AuthProvider;
+    readonly fetch: FetchLike;
+    readonly logger: Logger;
+    readonly debug: boolean;
+    readonly timeoutMs: number;
+    readonly idempotencyKey: Required<NonNullable<HttpClientOptions['idempotencyKey']>>;
+    readonly retryPolicy: RetryPolicy;
+    readonly rateLimitStrategy: RateLimitStrategy;
+    constructor(opts: HttpClientOptions);
+    request<T>(method: string, path: string, init: RequestInit2): Promise<T>;
+    private requestOnce;
+    private parseSuccess;
+    private safeParseJson;
+    private buildUrl;
+    private buildHeaders;
+    private resolveIdempotencyKey;
+    private withStableIdempotencyKey;
+    private logRequest;
+}
+
+interface StaticTokenAuthOptions {
+    token: string;
+    tokenType: TokenType;
+    onRefresh?: () => Promise<string>;
+}
+declare class StaticTokenAuth implements AuthProvider {
+    private token;
+    readonly tokenType: TokenType;
+    private readonly onRefresh?;
+    private refreshing;
+    constructor(opts: StaticTokenAuthOptions);
+    currentToken(): string;
+    headersFor(ring: AuthRing): Record<string, string>;
+    onUnauthorized(): Promise<boolean>;
+}
+declare class NoAuth implements AuthProvider {
+    headersFor(_ring: AuthRing): Record<string, string>;
+    onUnauthorized(): Promise<boolean>;
+}
+
+interface PaginatedList<T> {
+    items: T[];
+    nextCursor: string | null;
+    total: number;
+    firstCursor?: string | null;
+    hasNext?: boolean;
+    hasPrev?: boolean;
+    /**
+     * `true` when `total` reflects the full filtered result set the caller will
+     * see. `false` when SDK-side filtering (no backend `where` pushdown) means
+     * `total` is the backend's unfiltered total and the true filtered count
+     * requires walking remaining pages. Absent on plain unfiltered queries.
+     */
+    totalIsExact?: boolean;
+}
+interface ListOptions {
+    pageSize?: number;
+    cursor?: string;
+    after?: string;
+    before?: string;
+}
+interface ListAllOptions extends ListOptions {
+    signal?: AbortSignal;
+}
+type ListAllItem<T> = {
+    type: 'item';
+    value: T;
+} | {
+    type: 'drift';
+    addedSince: number;
+};
+type CursorDirection = 'forward' | 'backward';
+type OrderDirection = 'asc' | 'desc';
+interface OrderByField {
+    field: string;
+    dir?: OrderDirection;
+}
+type DataOrderBy = string | readonly OrderByField[];
+interface KeysetCursor {
+    values: Record<string, string | number | boolean | null>;
+    direction: CursorDirection;
+    orderBy: OrderByField[];
+    orderByFingerprint: string;
+    tiebreaker?: {
+        field: string;
+        value: string | number;
+    };
+    /**
+     * Backend compatibility metadata. Current AX Hub data API exposes offset
+     * `page`/`per_page` pagination and treats unknown query keys as filters, so
+     * SDK-generated v2 cursors carry the next/previous page number instead of
+     * sending unsupported `after`/`before` query parameters to production.
+     */
+    page?: number;
+    /**
+     * Scope binding. SDK-generated cursors carry a fingerprint of the
+     * `${tenant}/${app}/${table}` resource so a cursor minted on table A cannot
+     * be silently replayed against table B. Optional on decoded cursors for
+     * backward compatibility with backend-emitted cursors that omit it.
+     */
+    contextFingerprint?: string;
+}
+interface CursorBuildOptions {
+    direction?: CursorDirection;
+    orderBy?: DataOrderBy;
+    page?: number;
+    contextFingerprint?: string;
+}
+declare function encodeCursor(cursor: KeysetCursor): string;
+declare function decodeCursor(token: string): KeysetCursor;
+declare function orderByFingerprint(orderBy?: DataOrderBy): string;
+declare function cursorFromRow(row: Record<string, unknown> | undefined, opts?: CursorBuildOptions): string | null;
+
+interface ParsedFrame {
+    id?: string;
+    event?: string;
+    data: string;
+}
+type StreamItem<T> = {
+    type: 'item';
+    value: T;
+    id: string | undefined;
+} | {
+    type: 'gap';
+    sinceId: string | undefined;
+    missingCount?: number;
+} | {
+    type: 'decode-skip';
+    frame: ParsedFrame;
+    error: AxHubError;
+};
+interface SSEStreamOptions<T> {
+    url: string;
+    http: HttpClient;
+    ring: AuthRing;
+    signal?: AbortSignal;
+    maxReconnects?: number;
+    parseEvent: (frame: ParsedFrame) => T;
+}
+interface SSEStream<T> extends AsyncIterable<StreamItem<T>> {
+    dispose(): void;
+}
+
+type WebhookVerifyReason = 'signature_mismatch' | 'timestamp_skew' | 'malformed_signature' | 'missing_secret' | 'replay';
+interface VerifyWebhookInput {
+    rawBody: Buffer | Uint8Array | string;
+    signature: string;
+    secret: string;
+    tolerance?: number;
+    timestamp?: string;
+    replayCache?: Set<string>;
+    now?: () => number;
+}
+interface VerifyWebhookResult {
+    ok: boolean;
+    reason?: WebhookVerifyReason;
+}
+declare function signWebhook(rawBody: Buffer | Uint8Array | string, secret: string, timestamp?: string): string;
+declare function verifyWebhook(input: VerifyWebhookInput): VerifyWebhookResult;
+
+interface RequestOptions {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    idempotencyKey?: string | false;
+}
+interface PageRequestOptions extends ListOptions, RequestOptions {
+}
+
+interface AuditEvent {
+    id: string;
+    type?: string;
+    actorId?: string;
+    hash?: string;
+    prevHash?: string;
+    createdAt?: string;
+    [key: string]: unknown;
+}
+interface EmitAuditEventInput {
+    type: string;
+    actorId?: string;
+    resource?: string;
+    payload?: unknown;
+}
+interface IntegrityCheckResult {
+    ok: boolean;
+    checked: number;
+    firstBadSeq?: number;
+    reason?: string;
+}
+interface AnonymizeInput {
+    subjectId?: string;
+    actorId?: string;
+    anonymizedId?: string;
+    reason?: string;
+}
+declare class AuditClient {
+    private readonly http;
+    readonly events: AuditEventsClient;
+    readonly server: AuditServerClient;
+    constructor(http: HttpClient);
+    scoped(tenantSlug: string): TenantAuditClient;
+    integrityCheck(tenantSlug: string, opts?: RequestOptions): Promise<IntegrityCheckResult>;
+    anonymize(tenantSlug: string, input: AnonymizeInput, opts?: RequestOptions): Promise<AuditEvent | void>;
+}
+declare class TenantAuditClient {
+    private readonly http;
+    private readonly tenantSlug;
+    readonly events: AuditEventsForTenantClient;
+    readonly server: AuditServerForTenantClient;
+    constructor(http: HttpClient, tenantSlug: string);
+    integrityCheck(opts?: RequestOptions): Promise<IntegrityCheckResult>;
+    anonymize(input: AnonymizeInput, opts?: RequestOptions): Promise<AuditEvent | void>;
+}
+declare class AuditEventsClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    forTenant(tenantSlug: string): AuditEventsForTenantClient;
+}
+declare class AuditEventsForTenantClient {
+    private readonly http;
+    private readonly tenantSlug;
+    constructor(http: HttpClient, tenantSlug: string);
+    list(opts?: PageRequestOptions & {
+        type?: string;
+    }): Promise<PaginatedList<AuditEvent>>;
+    get(eventId: string, opts?: RequestOptions): Promise<AuditEvent>;
+}
+declare class AuditServerClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    forTenant(tenantSlug: string): AuditServerForTenantClient;
+}
+declare class AuditServerForTenantClient {
+    private readonly http;
+    private readonly tenantSlug;
+    constructor(http: HttpClient, tenantSlug: string);
+    /**
+     * Emit a server-side audit event.
+     *
+     * @remarks The backend route `POST /audit-events/server` is not yet
+     * implemented (currently 404). Retained ahead of backend support — see
+     * ADR-0040. Do not rely on this in production until the route ships.
+     */
+    emit(input: EmitAuditEventInput, opts?: RequestOptions): Promise<AuditEvent>;
+}
+
+interface AuthzTag {
+    id: string;
+    name: string;
+    parentId?: string;
+    [key: string]: unknown;
+}
+interface AuthzSubject {
+    id: string;
+    type: string;
+    externalId?: string;
+    [key: string]: unknown;
+}
+interface AuthzGrant {
+    id: string;
+    subjectId: string;
+    resource: string;
+    action: string;
+    effect: 'allow' | 'deny';
+    [key: string]: unknown;
+}
+declare class AuthzClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    scoped(tenantSlug: string): TenantAuthzClient;
+}
+declare class TenantAuthzClient {
+    /** @adminOnly Tag governance (tenant_admin). list/create/update/delete. */
+    readonly tags: AuthzTagsClient;
+    /** @adminOnly Subject governance (tenant_admin). list/create/update/delete. */
+    readonly subjects: AuthzSubjectsClient;
+    /** @adminOnly Grant governance (tenant_admin). list only — backend exposes no REST create/update/delete. */
+    readonly grants: AuthzGrantsClient;
+    constructor(http: HttpClient, tenantSlug: string);
+}
+declare class AuthzTagsClient {
+    private readonly http;
+    private readonly base;
+    constructor(http: HttpClient, base: string);
+    list(opts?: RequestOptions): Promise<AuthzTag[]>;
+    create(input: Record<string, unknown>, opts?: RequestOptions): Promise<AuthzTag>;
+    update(id: string, patch: Record<string, unknown>, opts?: RequestOptions): Promise<AuthzTag>;
+    delete(id: string, opts?: RequestOptions): Promise<void>;
+}
+declare class AuthzSubjectsClient {
+    private readonly http;
+    private readonly base;
+    constructor(http: HttpClient, base: string);
+    list(opts?: RequestOptions): Promise<AuthzSubject[]>;
+    create(input: Record<string, unknown>, opts?: RequestOptions): Promise<AuthzSubject>;
+    update(id: string, patch: Record<string, unknown>, opts?: RequestOptions): Promise<AuthzSubject>;
+    delete(id: string, opts?: RequestOptions): Promise<void>;
+}
+declare class AuthzGrantsClient {
+    private readonly http;
+    private readonly base;
+    constructor(http: HttpClient, base: string);
+    list(opts?: RequestOptions): Promise<AuthzGrant[]>;
+}
+
+type AdminMockFixtures = {
+    tenants?: Tenant[];
+};
+declare class AdminMockStore {
+    private tenants;
+    private nextId;
+    constructor(fixtures?: AdminMockFixtures);
+    createTenant(input: CreateTenantInput): Tenant;
+    getTenant(id: string): Tenant;
+    listTenants(): PaginatedList<Tenant>;
+    updateTenant(id: string, patch: UpdateTenantInput): Tenant;
+    deleteTenant(id: string): void;
+}
+
+interface Tenant {
+    id: string;
+    slug: string;
+    name: string;
+    plan?: string;
+    createdAt?: string;
+    updatedAt?: string;
+    [key: string]: unknown;
+}
+interface CreateTenantInput {
+    slug: string;
+    name: string;
+    plan?: string;
+}
+interface UpdateTenantInput {
+    name?: string;
+    plan?: string;
+}
+interface TenantMember {
+    id: string;
+    userId: string;
+    role: string;
+    status?: string;
+    [key: string]: unknown;
+}
+interface TenantInvitation {
+    id: string;
+    email: string;
+    role: string;
+    status: string;
+    reason?: string;
+    [key: string]: unknown;
+}
+interface InviteTenantMemberInput {
+    email: string;
+    role: string;
+    reason?: string;
+}
+interface BulkInviteResult {
+    accepted: TenantInvitation[];
+    rejected: Array<{
+        email: string;
+        reason: string;
+        message?: string;
+    }>;
+}
+interface EmailDomain {
+    domain: string;
+    verified?: boolean;
+    [key: string]: unknown;
+}
+interface TenantIconUploadResult {
+    uploadUrl: string;
+    getUrl: string;
+    expiresAt?: string;
+}
+declare class TenantsAdminClient {
+    private readonly http;
+    private readonly mockStore?;
+    constructor(http: HttpClient, mockStore?: AdminMockStore | undefined);
+    scoped(tenantIdOrSlug: string): TenantScopedTenantsAdminClient;
+    create(input: CreateTenantInput, opts?: RequestOptions): Promise<Tenant>;
+    get(tenantIdOrSlug: string, opts?: RequestOptions): Promise<Tenant>;
+    list(opts?: PageRequestOptions): Promise<PaginatedList<Tenant>>;
+    update(tenantIdOrSlug: string, patch: UpdateTenantInput, opts?: RequestOptions): Promise<Tenant>;
+    delete(tenantIdOrSlug: string, opts?: RequestOptions): Promise<void>;
+    signIconUploadURL(tenantIdOrSlug: string, input: {
+        contentType: string;
+    }, opts?: RequestOptions): Promise<TenantIconUploadResult>;
+    get members(): TenantMembersClient;
+    get invitations(): TenantInvitationsClient;
+    get emailDomains(): TenantEmailDomainsClient;
+}
+declare class TenantScopedTenantsAdminClient {
+    readonly members: TenantMembersForTenantClient;
+    readonly invitations: TenantInvitationsForTenantClient;
+    readonly emailDomains: TenantEmailDomainsForTenantClient;
+    constructor(http: HttpClient, tenantIdOrSlug: string);
+}
+declare class TenantMembersClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    forTenant(tenantIdOrSlug: string): TenantMembersForTenantClient;
+}
+declare class TenantMembersForTenantClient {
+    private readonly http;
+    private readonly tenant;
+    constructor(http: HttpClient, tenant: string);
+    list(opts?: PageRequestOptions): Promise<PaginatedList<TenantMember>>;
+    update(membershipId: string, patch: {
+        role?: string;
+    }, opts?: RequestOptions): Promise<void>;
+    deactivate(membershipId: string, opts?: RequestOptions): Promise<void>;
+    reactivate(membershipId: string, opts?: RequestOptions): Promise<void>;
+}
+declare class TenantInvitationsClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    forTenant(tenantIdOrSlug: string): TenantInvitationsForTenantClient;
+}
+declare class TenantInvitationsForTenantClient {
+    private readonly http;
+    private readonly tenant;
+    constructor(http: HttpClient, tenant: string);
+    list(opts?: PageRequestOptions): Promise<PaginatedList<TenantInvitation>>;
+    create(input: InviteTenantMemberInput, opts?: RequestOptions): Promise<TenantInvitation>;
+    bulkCreate(inputs: InviteTenantMemberInput[], opts?: RequestOptions): Promise<BulkInviteResult>;
+    delete(invitationId: string, opts?: RequestOptions): Promise<void>;
+}
+declare class TenantEmailDomainsClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    forTenant(tenantIdOrSlug: string): TenantEmailDomainsForTenantClient;
+}
+declare class TenantEmailDomainsForTenantClient {
+    private readonly http;
+    private readonly tenant;
+    constructor(http: HttpClient, tenant: string);
+    list(opts?: RequestOptions): Promise<EmailDomain[]>;
+    create(input: {
+        domain: string;
+    }, opts?: RequestOptions): Promise<EmailDomain>;
+    delete(domain: string, opts?: RequestOptions): Promise<void>;
+}
+
+interface IdentityProvider {
+    id: string;
+    tenantId?: string;
+    provider: string;
+    type: 'oidc' | 'oauth2' | 'saml' | string;
+    enabled?: boolean;
+    [key: string]: unknown;
+}
+declare class IdentityProviderClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(tenantId: string, opts?: RequestOptions): Promise<IdentityProvider[]>;
+    create(tenantId: string, input: Record<string, unknown>, opts?: RequestOptions): Promise<IdentityProvider>;
+    enable(tenantId: string, providerId: string, opts?: RequestOptions): Promise<IdentityProvider>;
+    disable(tenantId: string, providerId: string, opts?: RequestOptions): Promise<IdentityProvider>;
+}
+
+interface AppCategory {
+    id: string;
+    tenantId?: string;
+    slug: string;
+    name: string;
+    description?: string;
+    [key: string]: unknown;
+}
+interface CreateCategoryInput {
+    slug: string;
+    name: string;
+    description?: string;
+}
+declare class CategoriesAdminClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    create(tenantIdOrSlug: string, input: CreateCategoryInput, opts?: RequestOptions): Promise<AppCategory>;
+    update(tenantIdOrSlug: string, categoryId: string, patch: Partial<CreateCategoryInput>, opts?: RequestOptions): Promise<AppCategory>;
+    delete(tenantIdOrSlug: string, categoryId: string, opts?: RequestOptions): Promise<void>;
+}
+
+interface AdminMockClientOptions {
+    mode?: 'live' | 'mock';
+    fixtures?: AdminMockFixtures;
+}
+
+/**
+ * Default production base URL for AX Hub. Override via `baseUrl` for staging,
+ * local dev, or self-hosted environments.
+ */
+declare const DEFAULT_BASE_URL = "https://axhub-api.jocodingax.ai";
+interface AdminClientOptions extends AdminMockClientOptions {
+    /**
+     * Backend root URL. Defaults to {@link DEFAULT_BASE_URL}. Override for
+     * staging / self-hosted / local dev.
+     */
+    baseUrl?: string;
+    token?: string;
+    tokenType?: TokenType;
+    /**
+     * JWT refresh callback. Called when an admin-ring request returns 401.
+     * Should return the new JWT, or throw to surface the 401 to the caller.
+     */
+    onRefresh?: () => Promise<string>;
+    logger?: Logger;
+    debug?: boolean;
+    fetch?: FetchLike;
+    timeoutMs?: number;
+    idempotencyKey?: {
+        autoGenerate?: boolean;
+        generator?: () => string;
+    };
+    retryPolicy?: RetryPolicy;
+    rateLimitStrategy?: RateLimitStrategy;
+}
+interface AdminInternalOptions {
+    '__sharedHttp': HttpClient;
+    logger: Logger;
+}
+/**
+ * Governance entrypoint for AX Hub's platform/tenant admin surface. Mirrors
+ * {@link https://www.npmjs.com/package/@ax-hub/sdk | AxHubClient}'s construction
+ * and lazy-getter pattern, but exposes ONLY admin-gated resources
+ * (tenants CRUD, authz, audit, identity-providers, category CUD). The
+ * app-developer surface lives in `@ax-hub/sdk`.
+ *
+ * Constructor validates token/tokenType pairing eagerly — bad input dies at
+ * construction, not on first call.
+ */
+declare class AdminClient {
+    readonly http: HttpClient;
+    readonly logger: Logger;
+    readonly mock?: AdminMockStore;
+    private _tenants?;
+    private _authz?;
+    private _audit?;
+    private _identityProviders?;
+    private _categories?;
+    constructor(opts: AdminClientOptions | AdminInternalOptions);
+    get tenants(): TenantsAdminClient;
+    get authz(): AuthzClient;
+    get audit(): AuditClient;
+    get identityProviders(): IdentityProviderClient;
+    get categories(): CategoriesAdminClient;
+    /**
+     * Tenant-scoped governance surface. Path-tenant routes receive the
+     * tenant id/slug automatically.
+     *
+     * @example happy
+     *   const acme = admin.tenant('acme')
+     *   await acme.authz.tags.list()
+     *   await acme.audit.integrityCheck()
+     */
+    tenant(tenantIdOrSlug: string): TenantScopedAdminClient;
+}
+declare class TenantScopedAdminClient {
+    readonly tenant: string;
+    private readonly http;
+    constructor(tenant: string, http: HttpClient);
+    get tenants(): TenantScopedTenantsAdminClient;
+    get authz(): TenantAuthzClient;
+    get audit(): TenantAuditClient;
+    get identityProviders(): IdentityProviderClient;
+    get categories(): CategoriesAdminClient;
+}
+
+export { AbortError, AccessDeniedError, AdminClient, type AdminClientOptions, AlreadyAccessedError, AlreadyActiveError, AlreadyDeletedError, AlreadyInactiveError, AlreadyMemberError, AlreadyRevokedError, AlreadySettledError, type AnonymizeInput, type AppCategory, type AppID, type AppId, type AppSlug, AppUnavailableError, AuditClient, type AuditEvent, type AuditEventID, AuditEventsClient, AuditEventsForTenantClient, AuditServerClient, AuditServerForTenantClient, type AuthProvider, type AuthRing, AuthorizationPendingError, AuthzClient, type AuthzGrant, AuthzGrantsClient, type AuthzSubject, AuthzSubjectsClient, type AuthzTag, AuthzTagsClient, AxHubError, type AxHubErrorInit, BadRequestError, type Branded, type BulkInviteResult, CategoriesAdminClient, ConfigurationError, ConflictError, type ConnectorID, type CreateCategoryInput, type CreateTenantInput, type CursorBuildOptions, type CursorDirection, DEFAULT_BASE_URL, type DataOrderBy, DecodeError, type DeploymentID, type DeploymentId, DeviceFlowDeniedError, DeviceFlowTimeoutError, DomainTakenError, DuplicateError, type EmailDomain, type EmitAuditEventInput, EmptyError, ExpiredTokenError, type FetchLike, type FieldError, ForbiddenError, type GrantID, type IdentityProvider, IdentityProviderClient, type IntegrityCheckResult, InternalServerError, IntrospectFailedError, InvalidClientError, InvalidCursorError, InvalidGrantError, InvalidPathError, InvalidRequestError, InvalidScopeError, InvalidStateTransitionError, InvalidTargetError, InvalidTokenError, InvalidValueError, InvitationExpiredError, type InviteTenantMemberInput, type KeysetCursor, LastAdminError, LegacyCursorError, type ListAllItem, type ListAllOptions, type ListOptions, type Logger, MockInProductionError, NetworkError, NoAuth, NotAdminError, NotAllowedError, NotDeletedError, NotFoundError, NotMemberError, OAuthError, type OAuthErrorInit, OAuthServerError, type OrderByField, type OrderDirection, type PATID, type PageRequestOptions, type PaginatedList, type ParsedFrame, type PatId, PendingExistsError, PermanentlyDeletedError, PermissionDeniedError, PoolStaleError, PreconditionFailedError, type RateLimitStrategy, RateLimitedError, type RequestId, type RequestOptions, RequiredError, type ResourceID, type RetryInfo, type SSEStream, type SSEStreamOptions, ScanLimitExceededError, SchemaNameTakenError, SlowDownError, SlugTakenError, StaticTokenAuth, type StaticTokenAuthOptions, StreamConsumedError, type StreamItem, type SubjectID, type TableID, TableNotFoundError, type TagID, TemporarilyUnavailableError, type Tenant, TenantAuditClient, TenantAuthzClient, TenantEmailDomainsClient, TenantEmailDomainsForTenantClient, type TenantID, type TenantIconUploadResult, type TenantId, TenantIdRequiredError, type TenantInvitation, TenantInvitationsClient, TenantInvitationsForTenantClient, type TenantMember, TenantMembersClient, TenantMembersForTenantClient, TenantScopedAdminClient, TenantScopedTenantsAdminClient, type TenantSlug, TenantSlugRequiredError, TenantsAdminClient, TimeoutError, TokenExpiredError, TokenInvalidError, TokenMissingError, type TokenType, UnauthenticatedError, UnauthorizedClientError, UnavailableError, UnsupportedGrantTypeError, type UpdateTenantInput, type UserID, type UserId, ValidationError, type VerifyWebhookInput, type VerifyWebhookResult, WebhookVerificationError, type WebhookVerifyReason, asAppId, asAppSlug, asDeploymentId, asPatId, asRequestId, asTenantId, asTenantSlug, asUserId, cursorFromRow, decodeCursor, encodeCursor, formatErrorMessage, id, orderByFingerprint, parseRetryAfter, signWebhook, verifyWebhook };