@banata-auth/sdk 0.1.0

package/dist/index.d.cts

@@ -0,0 +1,1095 @@
+import { ApiKey, AuditEvent, PaginatedResult, Directory, DirectoryProvider, DirectoryUser, DirectoryGroup, DomainVerification, Organization, OrganizationMember, OrganizationInvitation, SsoProfile, SsoConnection, User, Session, VaultSecret, WebhookEndpoint, WebhookEvent } from '@banata-auth/shared';
+export { ApiKey, AuditEvent, AuthenticationError, BanataAuthError, ConflictError, Directory, DirectoryGroup, DirectoryUser, DomainVerification, ForbiddenError, InternalError, ListMetadata, NotFoundError, Organization, OrganizationInvitation, OrganizationMember, PaginatedResult, PortalSession, Project, RateLimitError, Session, SsoConnection, SsoProfile, Team, User, ValidationError, VaultSecret, WebhookEndpoint, WebhookEvent } from '@banata-auth/shared';
+
+/**
+ * API Keys resource.
+ * Manages API key lifecycle — creation, listing, and deletion.
+ */
+declare class ApiKeys {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Create a new API key.
+     *
+     * @returns The created key metadata **plus** the raw `key` value.
+     *   The raw key is only returned at creation time and cannot be retrieved later.
+     */
+    create(options: {
+        name: string;
+        /** Restrict the key to a specific organization. */
+        organizationId?: string;
+        /** Scoped permissions for this key. */
+        permissions?: string[];
+        /** When the key should expire (ISO 8601 or Date). */
+        expiresAt?: Date | string;
+    }): Promise<ApiKey & {
+        key: string;
+    }>;
+    /**
+     * List all API keys. The raw key value is **not** included.
+     */
+    list(): Promise<ApiKey[]>;
+    /**
+     * Delete (revoke) an API key by its ID.
+     */
+    delete(keyId: string): Promise<void>;
+}
+
+interface CreateAuditEventOptions {
+    action: string;
+    actorType: AuditEvent["actor"]["type"];
+    actorId: string;
+    actorName?: string;
+    actorEmail?: string;
+    targets?: AuditEvent["targets"];
+    organizationId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    changes?: AuditEvent["changes"];
+    idempotencyKey?: string;
+    metadata?: Record<string, string>;
+    occurredAt?: Date;
+}
+interface ListAuditEventsOptions {
+    organizationId?: string;
+    /** Filter by a single action string. */
+    action?: string;
+    actorId?: string;
+    after?: string;
+    before?: string;
+    limit?: number;
+}
+interface ExportAuditEventsOptions {
+    organizationId?: string;
+    format: "csv" | "json";
+    /** Start of the date range (converted to epoch ms). */
+    startDate?: Date;
+    /** End of the date range (converted to epoch ms). */
+    endDate?: Date;
+    /** Filter by a single action string. */
+    action?: string;
+    limit?: number;
+    /** Cursor for pagination (epoch ms number from the backend). */
+    cursor?: number;
+}
+interface ExportAuditEventsResult {
+    data: AuditEvent[];
+    count: number;
+    /** Cursor for next page (epoch ms number). */
+    nextCursor?: number;
+}
+declare class AuditLogs {
+    private readonly http;
+    constructor(http: HttpClient);
+    createEvent(options: CreateAuditEventOptions): Promise<AuditEvent>;
+    listEvents(options?: ListAuditEventsOptions): Promise<PaginatedResult<AuditEvent>>;
+    exportEvents(options: ExportAuditEventsOptions): Promise<ExportAuditEventsResult>;
+}
+
+declare class DirectorySync {
+    private readonly http;
+    constructor(http: HttpClient);
+    listDirectories(options?: {
+        organizationId?: string;
+        limit?: number;
+        before?: string;
+        after?: string;
+        projectId?: string;
+    }): Promise<PaginatedResult<Directory>>;
+    getDirectory(directoryId: string, options?: {
+        projectId?: string;
+    }): Promise<Directory>;
+    createDirectory(options: {
+        organizationId: string;
+        name: string;
+        provider: DirectoryProvider;
+        projectId?: string;
+    }): Promise<Directory & {
+        scimConfig: {
+            baseUrl: string;
+            bearerToken: string;
+        };
+    }>;
+    deleteDirectory(directoryId: string, options?: {
+        projectId?: string;
+    }): Promise<void>;
+    listUsers(options: {
+        directoryId: string;
+        state?: "active" | "suspended" | "deprovisioned";
+        limit?: number;
+        before?: string;
+        after?: string;
+        projectId?: string;
+    }): Promise<PaginatedResult<DirectoryUser>>;
+    getUser(directoryUserId: string, options?: {
+        projectId?: string;
+    }): Promise<DirectoryUser>;
+    listGroups(options: {
+        directoryId: string;
+        limit?: number;
+        before?: string;
+        after?: string;
+        projectId?: string;
+    }): Promise<PaginatedResult<DirectoryGroup>>;
+    getGroup(directoryGroupId: string, options?: {
+        projectId?: string;
+    }): Promise<DirectoryGroup>;
+}
+
+declare class Domains {
+    private readonly http;
+    constructor(http: HttpClient);
+    createVerification(options: {
+        organizationId: string;
+        domain: string;
+        projectId?: string;
+    }): Promise<DomainVerification>;
+    getVerification(verificationId: string, options?: {
+        projectId?: string;
+    }): Promise<DomainVerification>;
+    verify(verificationId: string, options?: {
+        projectId?: string;
+    }): Promise<DomainVerification>;
+    list(options: {
+        organizationId: string;
+        limit?: number;
+        before?: string;
+        after?: string;
+        projectId?: string;
+    }): Promise<PaginatedResult<DomainVerification>>;
+    delete(verificationId: string, options?: {
+        projectId?: string;
+    }): Promise<void>;
+}
+
+/**
+ * Built-in email template types supported by Banata Auth.
+ */
+type BuiltInEmailTemplateType = "verification" | "password-reset" | "magic-link" | "email-otp" | "invitation" | "welcome";
+/**
+ * Options for sending an email via the SDK.
+ */
+interface SendEmailOptions {
+    /** Recipient email address. */
+    to: string;
+    /**
+     * Template to render.
+     * Can be a built-in type (e.g. "verification") or a custom template slug
+     * (e.g. "marketing-welcome", "onboarding-day-3").
+     */
+    template: string;
+    /**
+     * Data/variables for the template. Shape depends on the template:
+     *
+     * Built-in templates:
+     * - `verification`: `{ userName, verificationUrl, token }`
+     * - `password-reset`: `{ userName, resetUrl, token }`
+     * - `magic-link`: `{ email, magicLinkUrl, token }`
+     * - `email-otp`: `{ email, otp }`
+     * - `invitation`: `{ email, invitationId, organizationName, inviterName, acceptUrl? }`
+     * - `welcome`: `{ userName, dashboardUrl? }`
+     *
+     * Custom templates: Keys match `{{variable}}` placeholders in the template blocks.
+     */
+    data: Record<string, unknown>;
+}
+/**
+ * Result of sending an email.
+ */
+interface SendEmailResult {
+    success: boolean;
+    messageId?: string;
+    error?: string;
+}
+/**
+ * Preview of a rendered email template.
+ */
+interface EmailPreview {
+    subject: string;
+    html: string;
+    text: string;
+}
+/**
+ * Email template category.
+ */
+type EmailTemplateCategory = "auth" | "marketing" | "transactional" | "onboarding" | "notification" | "custom";
+/**
+ * An email template definition (returned by the API).
+ */
+interface EmailTemplate {
+    id: string;
+    name: string;
+    slug: string;
+    subject: string;
+    previewText?: string | null;
+    category: string;
+    description?: string | null;
+    blocksJson: string;
+    variablesJson?: string | null;
+    builtIn: boolean;
+    builtInType?: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+/**
+ * Options for creating a new email template.
+ */
+interface CreateEmailTemplateOptions {
+    name: string;
+    slug: string;
+    subject: string;
+    previewText?: string;
+    category: EmailTemplateCategory;
+    description?: string;
+    /** JSON-serialized EmailBlock[] array. */
+    blocksJson: string;
+    /** JSON-serialized EmailTemplateVariable[] array. */
+    variablesJson?: string;
+}
+/**
+ * Options for updating an existing email template.
+ */
+interface UpdateEmailTemplateOptions {
+    name?: string;
+    slug?: string;
+    subject?: string;
+    previewText?: string;
+    category?: EmailTemplateCategory;
+    description?: string;
+    blocksJson?: string;
+    variablesJson?: string;
+}
+/**
+ * Emails resource.
+ * Send transactional emails, manage custom email templates, and preview
+ * templates using the configured email provider.
+ *
+ * @example
+ * ```ts
+ * const banataAuth = new BanataAuth({ apiKey: "sk_live_..." });
+ *
+ * // Send a built-in welcome email
+ * await banataAuth.emails.send({
+ *   to: "user@example.com",
+ *   template: "welcome",
+ *   data: { userName: "Jane Doe", dashboardUrl: "https://app.example.com" },
+ * });
+ *
+ * // Send a custom template
+ * await banataAuth.emails.send({
+ *   to: "user@example.com",
+ *   template: "marketing-welcome",
+ *   data: { userName: "Jane", promoCode: "WELCOME10" },
+ * });
+ *
+ * // List all templates
+ * const templates = await banataAuth.emails.templates.list();
+ *
+ * // Create a custom template
+ * await banataAuth.emails.templates.create({
+ *   name: "Marketing Welcome",
+ *   slug: "marketing-welcome",
+ *   subject: "Welcome, {{userName}}!",
+ *   category: "marketing",
+ *   blocksJson: JSON.stringify([...blocks]),
+ * });
+ * ```
+ */
+declare class Emails {
+    private readonly http;
+    readonly templates: EmailTemplates;
+    constructor(http: HttpClient);
+    /**
+     * Send a transactional email using a built-in or custom template.
+     *
+     * The email is rendered using the configured branding (colors, logo,
+     * app name) and sent via the active email provider configured in the
+     * dashboard.
+     */
+    send(options: SendEmailOptions): Promise<SendEmailResult>;
+    /**
+     * Preview a rendered email template.
+     *
+     * Returns the subject, HTML, and plain text of the template with
+     * the current branding applied. Uses sample data if none provided.
+     */
+    preview(template: string, data?: Record<string, unknown>): Promise<EmailPreview>;
+    /**
+     * Send a test email to verify the email provider configuration.
+     *
+     * Uses the "welcome" template by default with sample data.
+     */
+    sendTest(to: string, template?: string): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+}
+/**
+ * Email templates sub-resource for CRUD operations on custom email templates.
+ */
+declare class EmailTemplates {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * List all email templates, optionally filtered by category.
+     */
+    list(category?: EmailTemplateCategory): Promise<EmailTemplate[]>;
+    /**
+     * Get a single email template by ID or slug.
+     */
+    get(idOrSlug: string): Promise<EmailTemplate | null>;
+    /**
+     * Create a new custom email template.
+     */
+    create(options: CreateEmailTemplateOptions): Promise<EmailTemplate>;
+    /**
+     * Update an existing email template.
+     */
+    update(id: string, options: UpdateEmailTemplateOptions): Promise<EmailTemplate>;
+    /**
+     * Delete a custom email template.
+     * Built-in templates cannot be deleted.
+     */
+    delete(id: string): Promise<void>;
+}
+
+interface ListEventsOptions {
+    /** Filter by one or more event types (action strings). */
+    eventTypes?: string[];
+    /** Cursor for forward pagination. */
+    after?: string;
+    /** Maximum number of events to return. Default: 50, max: 200. */
+    limit?: number;
+    /** Filter by organization. */
+    organizationId?: string;
+    /** Range start date. */
+    rangeStart?: Date;
+    /** Range end date. */
+    rangeEnd?: Date;
+}
+interface EventPayload {
+    id: string;
+    type: string;
+    data: Record<string, unknown>;
+    createdAt: number;
+}
+interface ListEventsResult {
+    data: EventPayload[];
+    cursor?: string;
+    hasMore: boolean;
+}
+/**
+ * Events resource.
+ *
+ * Provides a pollable, unified event stream sourced from audit log records.
+ * Use this as an alternative to webhooks for consuming auth events.
+ */
+declare class Events {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * List events with optional filters and cursor-based pagination.
+     */
+    listEvents(options?: ListEventsOptions): Promise<ListEventsResult>;
+}
+
+interface ListOrganizationsOptions {
+    limit?: number;
+    before?: string;
+    after?: string;
+    order?: "asc" | "desc";
+}
+interface CreateOrganizationOptions {
+    name: string;
+    slug?: string;
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    requireMfa?: boolean;
+    allowedEmailDomains?: string[];
+    maxMembers?: number;
+}
+interface UpdateOrganizationOptions {
+    organizationId: string;
+    name?: string;
+    slug?: string;
+    logo?: string | null;
+    metadata?: Record<string, unknown>;
+    requireMfa?: boolean;
+    ssoEnforced?: boolean;
+    allowedEmailDomains?: string[] | null;
+    maxMembers?: number | null;
+}
+interface ListMembersOptions {
+    organizationId: string;
+    role?: string;
+    limit?: number;
+    before?: string;
+    after?: string;
+}
+interface SendInvitationOptions {
+    organizationId: string;
+    email: string;
+    role: string;
+}
+/**
+ * Organizations resource.
+ * Handles organization CRUD, member management, and invitations.
+ */
+declare class Organizations {
+    private readonly http;
+    constructor(http: HttpClient);
+    listOrganizations(options?: ListOrganizationsOptions): Promise<PaginatedResult<Organization>>;
+    getOrganization(organizationId: string): Promise<Organization>;
+    createOrganization(options: CreateOrganizationOptions): Promise<Organization>;
+    updateOrganization(options: UpdateOrganizationOptions): Promise<Organization>;
+    deleteOrganization(organizationId: string): Promise<void>;
+    listMembers(options: ListMembersOptions): Promise<PaginatedResult<OrganizationMember>>;
+    removeMember(options: {
+        organizationId: string;
+        memberIdOrUserId: string;
+    }): Promise<void>;
+    updateMemberRole(options: {
+        organizationId: string;
+        memberIdOrUserId: string;
+        role: string;
+    }): Promise<OrganizationMember>;
+    sendInvitation(options: SendInvitationOptions): Promise<OrganizationInvitation>;
+    revokeInvitation(invitationId: string): Promise<void>;
+    listInvitations(options: {
+        organizationId: string;
+        status?: string;
+        limit?: number;
+        before?: string;
+        after?: string;
+    }): Promise<PaginatedResult<OrganizationInvitation>>;
+}
+
+type PortalIntent = "sso" | "dsync" | "domain_verification" | "audit_logs" | "log_streams" | "users";
+interface GeneratePortalLinkOptions {
+    /** The organization to generate a portal link for. */
+    organizationId: string;
+    /** The portal section to open. */
+    intent: PortalIntent;
+    /** URL to redirect the admin back to after completing the portal flow. */
+    returnUrl?: string;
+    /** Session lifetime in seconds. Default: 300 (5 minutes). Max: 3600 (1 hour). */
+    expiresIn?: number;
+}
+interface PortalLinkResult {
+    /** The generated portal URL with embedded session token. */
+    link: string;
+    /** The portal session ID. */
+    sessionId: string;
+    /** The portal intent. */
+    intent: PortalIntent;
+    /** The organization ID. */
+    organizationId: string;
+    /** ISO 8601 expiration timestamp. */
+    expiresAt: string;
+}
+/**
+ * Portal resource.
+ *
+ * Generates short-lived admin portal links for organization IT admins.
+ * Each link grants access to a specific portal section (SSO config,
+ * Directory Sync, Audit Logs, etc.) within an organization context.
+ */
+declare class Portal {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Generate a short-lived admin portal link for an organization's IT admin.
+     *
+     * @param options - Portal link generation options
+     * @returns The generated portal link and session metadata
+     */
+    generateLink(options: GeneratePortalLinkOptions): Promise<PortalLinkResult>;
+}
+
+interface SdkProject {
+    id: string;
+    name: string;
+    slug: string;
+    description?: string;
+    logoUrl?: string;
+    ownerId: string;
+    createdAt: number;
+    updatedAt: number;
+}
+interface CreateProjectOptions {
+    name: string;
+    slug: string;
+    description?: string;
+    logoUrl?: string;
+}
+interface UpdateProjectOptions {
+    name?: string;
+    slug?: string;
+    description?: string;
+    logoUrl?: string;
+}
+/**
+ * Manage projects.
+ *
+ * Each project is a fully isolated auth tenant with its own users, sessions,
+ * organizations, branding, email templates, API keys, webhooks, etc.
+ */
+declare class Projects {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * List all projects.
+     */
+    listProjects(): Promise<SdkProject[]>;
+    /**
+     * Get a single project by ID.
+     */
+    getProject(id: string): Promise<SdkProject | null>;
+    /**
+     * Create a new project.
+     * Returns the project and seeds RBAC permissions + super_admin role.
+     */
+    createProject(data: CreateProjectOptions): Promise<{
+        success: boolean;
+        project?: SdkProject;
+        error?: string;
+    }>;
+    /**
+     * Update a project's metadata.
+     */
+    updateProject(id: string, update: UpdateProjectOptions): Promise<{
+        success: boolean;
+        project?: SdkProject;
+        error?: string;
+    }>;
+    /**
+     * Delete a project.
+     *
+     * Note: This deletes the project record only. Project-scoped data (users,
+     * organizations, etc.) is not automatically cascade-deleted. Use the
+     * `clearAllData` migration for a full reset.
+     */
+    deleteProject(id: string): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * Ensure at least one project exists. If none exist, creates a
+     * "Default Project" with seeded RBAC permissions.
+     */
+    ensureDefaultProject(): Promise<{
+        created: boolean;
+        project: SdkProject | null;
+    }>;
+}
+
+interface RoleDefinition {
+    id: string;
+    name: string;
+    slug: string;
+    description: string;
+    permissions: string[];
+    isDefault: boolean;
+    createdAt: string;
+}
+interface PermissionDefinition {
+    id: string;
+    name: string;
+    slug: string;
+    description: string;
+    createdAt: string;
+}
+interface CreateRoleOptions {
+    name: string;
+    slug: string;
+    description?: string;
+}
+interface CreatePermissionOptions {
+    name: string;
+    slug: string;
+    description?: string;
+}
+interface AssignRoleOptions {
+    organizationId: string;
+    userId: string;
+    role: string;
+}
+interface PermissionCheck {
+    resource: string;
+    action: string;
+}
+interface CheckPermissionOptions {
+    projectId: string;
+    permission: string | PermissionCheck;
+}
+interface CheckPermissionsOptions {
+    projectId: string;
+    permissions: Array<string | PermissionCheck>;
+    operator?: "all" | "any";
+}
+declare class Rbac {
+    private readonly http;
+    constructor(http: HttpClient);
+    listRoles(): Promise<RoleDefinition[]>;
+    createRole(options: CreateRoleOptions): Promise<RoleDefinition>;
+    deleteRole(id: string): Promise<void>;
+    listPermissions(): Promise<PermissionDefinition[]>;
+    createPermission(options: CreatePermissionOptions): Promise<PermissionDefinition>;
+    deletePermission(id: string): Promise<void>;
+    assignRole(options: AssignRoleOptions): Promise<void>;
+    checkPermission(options: CheckPermissionOptions): Promise<{
+        allowed: boolean;
+    }>;
+    checkPermissions(options: CheckPermissionsOptions): Promise<{
+        allowed: boolean;
+    }>;
+    getMyPermissions(projectId: string): Promise<string[]>;
+    hasPermission(projectId: string, permission: string | PermissionCheck): Promise<boolean>;
+    requirePermission(projectId: string, permission: string | PermissionCheck): Promise<void>;
+    revokeRole(options: {
+        organizationId: string;
+        userId: string;
+        fallbackRole?: string;
+    }): Promise<void>;
+}
+
+interface GetAuthorizationUrlOptions {
+    connectionId?: string;
+    organizationId?: string;
+    provider?: string;
+    loginHint?: string;
+    redirectUri: string;
+    state?: string;
+    domainHint?: string;
+    projectId?: string;
+}
+interface GetProfileAndTokenOptions {
+    code: string;
+}
+interface CreateConnectionOptions {
+    organizationId: string;
+    type: "saml" | "oidc";
+    name: string;
+    domains: string[];
+    projectId?: string;
+    samlConfig?: {
+        idpEntityId: string;
+        idpSsoUrl: string;
+        idpCertificate: string;
+        nameIdFormat?: string;
+        signRequest?: boolean;
+        allowIdpInitiated?: boolean;
+        attributeMapping?: Record<string, string>;
+    };
+    oidcConfig?: {
+        issuer: string;
+        clientId: string;
+        clientSecret: string;
+        scopes?: string[];
+    };
+}
+interface ListConnectionsOptions {
+    organizationId?: string;
+    connectionType?: "saml" | "oidc";
+    limit?: number;
+    before?: string;
+    after?: string;
+    projectId?: string;
+}
+/**
+ * SSO resource.
+ * Handles SSO connection management and authentication flows.
+ */
+declare class SSO {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Get the authorization URL to redirect the user to for SSO.
+     * Supports routing by organization ID or callback URL.
+     */
+    getAuthorizationUrl(options: GetAuthorizationUrlOptions): Promise<{
+        url: string;
+    }>;
+    /**
+     * @deprecated Better Auth handles SSO token exchange internally via callback.
+     * This method is kept for backward compatibility but will throw.
+     */
+    getProfileAndToken(_options: GetProfileAndTokenOptions): Promise<{
+        profile: SsoProfile;
+        accessToken: string;
+    }>;
+    listConnections(options?: ListConnectionsOptions): Promise<PaginatedResult<SsoConnection>>;
+    getConnection(connectionId: string, options?: {
+        projectId?: string;
+    }): Promise<SsoConnection>;
+    createConnection(options: CreateConnectionOptions): Promise<SsoConnection>;
+    updateConnection(options: {
+        connectionId: string;
+        name?: string;
+        domains?: string[];
+        samlConfig?: Partial<CreateConnectionOptions["samlConfig"]>;
+        oidcConfig?: Partial<CreateConnectionOptions["oidcConfig"]>;
+        projectId?: string;
+    }): Promise<SsoConnection>;
+    deleteConnection(connectionId: string, options?: {
+        projectId?: string;
+    }): Promise<void>;
+    activateConnection(connectionId: string, options?: {
+        projectId?: string;
+    }): Promise<SsoConnection>;
+    deactivateConnection(connectionId: string, options?: {
+        projectId?: string;
+    }): Promise<SsoConnection>;
+}
+
+interface ListUsersOptions {
+    projectId?: string;
+    email?: string;
+    organizationId?: string;
+    role?: string;
+    limit?: number;
+    before?: string;
+    after?: string;
+    order?: "asc" | "desc";
+}
+interface CreateUserOptions {
+    projectId?: string;
+    email: string;
+    password?: string;
+    name: string;
+    image?: string;
+    username?: string;
+    phoneNumber?: string;
+    emailVerified?: boolean;
+    role?: string | string[];
+    metadata?: Record<string, unknown>;
+    data?: Record<string, unknown>;
+}
+interface UpdateUserOptions {
+    userId: string;
+    projectId?: string;
+    name?: string;
+    image?: string | null;
+    username?: string;
+    phoneNumber?: string | null;
+    emailVerified?: boolean;
+    password?: string;
+    role?: string | string[];
+    metadata?: Record<string, unknown>;
+    data?: Record<string, unknown>;
+}
+interface AdminPermissionStatements {
+    [resource: string]: string[];
+}
+type AdminPermissionCheckInput = string | string[] | AdminPermissionStatements;
+type AdminPermissionCheckOptions = {
+    projectId?: string;
+    userId?: string;
+    role?: string | string[];
+    permission: AdminPermissionCheckInput;
+} | {
+    projectId?: string;
+    userId?: string;
+    role?: string | string[];
+    permissions: AdminPermissionCheckInput;
+};
+interface AdminSessionResponse {
+    session: Session;
+    user: User;
+}
+/**
+ * User Management resource.
+ * Handles user CRUD, session management, and account operations.
+ */
+declare class UserManagement {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * List users with optional filtering and pagination.
+     */
+    listUsers(options?: ListUsersOptions): Promise<PaginatedResult<User>>;
+    /**
+     * Get a user by ID.
+     */
+    getUser(userId: string, options?: {
+        projectId?: string;
+    }): Promise<User>;
+    /**
+     * Create a new user.
+     */
+    createUser(options: CreateUserOptions): Promise<User>;
+    /**
+     * Update an existing user.
+     */
+    updateUser(options: UpdateUserOptions): Promise<User>;
+    /**
+     * Delete a user.
+     */
+    deleteUser(userId: string, options?: {
+        projectId?: string;
+    }): Promise<void>;
+    /**
+     * Ban a user.
+     */
+    banUser(options: {
+        userId: string;
+        projectId?: string;
+        reason?: string;
+        expiresAt?: Date;
+    }): Promise<User>;
+    /**
+     * Unban a user.
+     */
+    unbanUser(userId: string, options?: {
+        projectId?: string;
+    }): Promise<User>;
+    /**
+     * List active sessions for a user.
+     */
+    listUserSessions(userId: string, options?: {
+        projectId?: string;
+    }): Promise<PaginatedResult<Session>>;
+    /**
+     * Start impersonating a user.
+     */
+    impersonateUser(userId: string, options?: {
+        projectId?: string;
+    }): Promise<AdminSessionResponse>;
+    /**
+     * Stop impersonating the current user.
+     */
+    stopImpersonating(): Promise<AdminSessionResponse>;
+    /**
+     * Revoke a specific session.
+     */
+    revokeSession(sessionId: string, options?: {
+        projectId?: string;
+    }): Promise<void>;
+    /**
+     * Revoke all sessions for a user.
+     */
+    revokeAllSessions(userId: string, options?: {
+        projectId?: string;
+    }): Promise<void>;
+    /**
+     * Set a user's global role.
+     */
+    setRole(userId: string, role: string | string[], options?: {
+        projectId?: string;
+    }): Promise<User>;
+    /**
+     * Force-set a user's password.
+     */
+    setUserPassword(userId: string, newPassword: string, options?: {
+        projectId?: string;
+    }): Promise<boolean>;
+    /**
+     * Check whether a user or role has the requested permissions.
+     */
+    hasPermission(options: AdminPermissionCheckOptions): Promise<boolean>;
+}
+
+/**
+ * Vault resource.
+ *
+ * Provides envelope encryption for secrets using AES-256-GCM.
+ * Secrets are encrypted at rest and can be decrypted by providing
+ * the correct context.
+ */
+declare class Vault {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Encrypt and store a secret.
+     *
+     * @returns The ID of the stored secret.
+     */
+    encrypt(options: {
+        name: string;
+        data: string;
+        context?: string;
+        organizationId?: string;
+        metadata?: Record<string, string>;
+    }): Promise<{
+        id: string;
+    }>;
+    /**
+     * Decrypt and return a secret by ID.
+     *
+     * @param options.context - Must match the context used during encryption.
+     */
+    decrypt(options: {
+        secretId: string;
+        context?: string;
+    }): Promise<{
+        data: string;
+    }>;
+    /**
+     * List vault secrets (metadata only — decrypted values are never returned).
+     */
+    list(options?: {
+        organizationId?: string;
+        limit?: number;
+        before?: string;
+        after?: string;
+    }): Promise<PaginatedResult<VaultSecret>>;
+    /**
+     * Delete a vault secret by ID.
+     */
+    delete(options: {
+        secretId: string;
+    }): Promise<{
+        status: string;
+    }>;
+    /**
+     * Rotate the encryption key by re-encrypting all secrets
+     * with the next version's derived key.
+     *
+     * @returns Status and count of rotated/failed secrets.
+     */
+    rotateKey(options?: {
+        batchSize?: number;
+    }): Promise<{
+        status: string;
+        rotated: number;
+        failed: number;
+        remaining: number;
+    }>;
+}
+
+/**
+ * Webhooks resource.
+ * Handles webhook endpoint management and signature verification.
+ */
+declare class Webhooks {
+    private readonly http;
+    constructor(http: HttpClient);
+    listEndpoints(options?: {
+        limit?: number;
+        before?: string;
+        after?: string;
+    }): Promise<PaginatedResult<WebhookEndpoint>>;
+    createEndpoint(options: {
+        url: string;
+        eventTypes?: string[];
+        enabled?: boolean;
+    }): Promise<WebhookEndpoint & {
+        secret: string;
+    }>;
+    updateEndpoint(options: {
+        endpointId: string;
+        url?: string;
+        eventTypes?: string[];
+        enabled?: boolean;
+    }): Promise<WebhookEndpoint>;
+    deleteEndpoint(endpointId: string): Promise<void>;
+    /**
+     * Verify a webhook signature and construct the event payload.
+     * Uses the Web Crypto API for HMAC-SHA256 signature verification.
+     *
+     * @example
+     * ```ts
+     * const event = await banataAuth.webhooks.constructEvent({
+     *   payload: req.body,
+     *   sigHeader: req.headers["x-banataauth-signature"],
+     *   secret: webhookSecret,
+     * });
+     * ```
+     */
+    constructEvent(options: {
+        payload: string;
+        sigHeader: string;
+        secret: string;
+        tolerance?: number;
+    }): Promise<WebhookEvent>;
+    /**
+     * Verify a webhook signature using the Web Crypto API (HMAC-SHA256).
+     */
+    verifySignature(options: {
+        payload: string;
+        sigHeader: string;
+        secret: string;
+        tolerance?: number;
+    }): Promise<boolean>;
+    private computeHmacAsync;
+    private timingSafeEqual;
+}
+
+interface BanataAuthOptions {
+    /** API key for authentication. */
+    apiKey: string;
+    /** Base URL for the Banata Auth API. Defaults to Convex site URL. */
+    baseUrl?: string;
+    /** Request timeout in milliseconds. Default: 30000. */
+    timeout?: number;
+    /** Number of retries on 5xx errors. Default: 3. */
+    retries?: number;
+    /** Project ID to scope all operations to. */
+    projectId?: string;
+    /** Environment ID to scope all operations to. */
+    environmentId?: string;
+}
+/**
+ * Internal HTTP client used by all resource classes.
+ */
+declare class HttpClient {
+    private readonly apiKey;
+    private readonly baseUrl;
+    private readonly timeout;
+    private readonly maxRetries;
+    private readonly projectId?;
+    constructor(options: BanataAuthOptions);
+    withProjectScope<T extends Record<string, unknown>>(body: T, projectId?: string): T & {
+        projectId?: string;
+    };
+    request<T>(method: string, path: string, options?: {
+        body?: unknown;
+        query?: Record<string, string | number | boolean | undefined>;
+        headers?: Record<string, string>;
+    }): Promise<T>;
+    get<T>(path: string, query?: Record<string, string | number | boolean | undefined>): Promise<T>;
+    post<T>(path: string, body?: unknown): Promise<T>;
+    put<T>(path: string, body?: unknown): Promise<T>;
+    patch<T>(path: string, body?: unknown): Promise<T>;
+    delete<T>(path: string): Promise<T>;
+}
+/**
+ * Main Banata Auth SDK client.
+ *
+ * @example
+ * ```ts
+ * import { BanataAuth } from "@banata-auth/sdk";
+ *
+ * const banataAuth = new BanataAuth({ apiKey: "sk_live_..." });
+ *
+ * // List users
+ * const users = await banataAuth.userManagement.listUsers();
+ *
+ * // Create organization
+ * const org = await banataAuth.organizations.createOrganization({
+ *   name: "Acme Corp",
+ * });
+ * ```
+ */
+declare class BanataAuth {
+    private readonly httpClient;
+    readonly apiKeys: ApiKeys;
+    readonly userManagement: UserManagement;
+    readonly organizations: Organizations;
+    readonly sso: SSO;
+    readonly directorySync: DirectorySync;
+    readonly auditLogs: AuditLogs;
+    readonly emails: Emails;
+    readonly events: Events;
+    readonly webhooks: Webhooks;
+    readonly portal: Portal;
+    readonly vault: Vault;
+    readonly domains: Domains;
+    readonly rbac: Rbac;
+    readonly projects: Projects;
+    constructor(options: string | BanataAuthOptions);
+    get users(): UserManagement;
+    get directories(): DirectorySync;
+    get orgs(): Organizations;
+}
+
+export { ApiKeys, AuditLogs, BanataAuth, type BanataAuthOptions, type BuiltInEmailTemplateType, type CreateAuditEventOptions, type CreateEmailTemplateOptions, type CreateProjectOptions, DirectorySync, Domains, type EmailPreview, type EmailTemplate, type EmailTemplateCategory, Emails, type EventPayload, Events, type ExportAuditEventsOptions, type ExportAuditEventsResult, type GeneratePortalLinkOptions, type ListAuditEventsOptions, type ListEventsOptions, type ListEventsResult, Organizations, Portal, type PortalIntent, type PortalLinkResult, Projects, Rbac, SSO, type SdkProject, type SendEmailOptions, type SendEmailResult, type UpdateEmailTemplateOptions, type UpdateProjectOptions, UserManagement, Vault, Webhooks };