@corvushold/guard-sdk 0.5.3

package/dist/index.d.ts

@@ -0,0 +1,1157 @@
+type HeadersMap = Record<string, string>;
+interface Meta {
+    status: number;
+    requestId?: string;
+    headers?: HeadersMap;
+}
+interface ResponseWrapper<T> {
+    data: T;
+    meta: Meta;
+}
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+type TenantId = string;
+/**
+ * SSO provider slug - can be any string configured in the tenant's SSO providers.
+ * Common values include 'okta', 'azure-ad', 'google-saml', 'onelogin', etc.
+ * Legacy values 'workos' and 'dev' are still supported for backward compatibility.
+ */
+type SsoProviderSlug = string;
+/**
+ * @deprecated Use SsoProviderSlug instead. This type is kept for backward compatibility.
+ */
+type SsoProvider = SsoProviderSlug;
+
+declare class ApiError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    readonly requestId?: string;
+    readonly raw?: unknown;
+    readonly headers?: HeadersMap;
+    constructor(params: {
+        status: number;
+        message?: string;
+        code?: string;
+        requestId?: string;
+        raw?: unknown;
+        headers?: HeadersMap;
+    });
+}
+declare class RateLimitError extends ApiError {
+    readonly retryAfter?: number;
+    readonly nextRetryAt?: Date;
+    constructor(params: {
+        status: number;
+        message?: string;
+        code?: string;
+        requestId?: string;
+        raw?: unknown;
+        headers?: HeadersMap;
+        retryAfter?: number;
+        nextRetryAt?: Date;
+    });
+}
+declare function isApiError(e: unknown): e is ApiError;
+declare function isRateLimitError(e: unknown): e is RateLimitError;
+
+declare function parseRetryAfter(retryAfter: string | null | undefined): {
+    seconds?: number;
+    nextRetryAt?: Date;
+};
+declare function toHeadersMap(headers: Headers): HeadersMap;
+declare function buildRateLimitError(args: {
+    status: number;
+    message?: string;
+    requestId?: string;
+    headers: Headers;
+    raw?: unknown;
+}): RateLimitError;
+
+interface TokenStorage {
+    getAccessToken(): Promise<string | null> | string | null;
+    setAccessToken(token: string | null): Promise<void> | void;
+    getRefreshToken(): Promise<string | null> | string | null;
+    setRefreshToken(token: string | null): Promise<void> | void;
+    clear(): Promise<void> | void;
+}
+interface TokenProvider {
+    getAccessToken(): Promise<string | null> | string | null;
+}
+declare const noopStorage: TokenStorage;
+
+declare class InMemoryStorage implements TokenStorage {
+    private accessToken;
+    private refreshToken;
+    getAccessToken(): string | null;
+    setAccessToken(token: string | null): void;
+    getRefreshToken(): string | null;
+    setRefreshToken(token: string | null): void;
+    clear(): void;
+}
+
+declare class WebLocalStorage implements TokenStorage {
+    private readonly prefix;
+    constructor(prefix?: string);
+    private k;
+    getAccessToken(): string | null;
+    setAccessToken(token: string | null): void;
+    getRefreshToken(): string | null;
+    setRefreshToken(token: string | null): void;
+    clear(): void;
+}
+
+interface AsyncStorageLike {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+declare function reactNativeStorageAdapter(AsyncStorage: AsyncStorageLike, prefix?: string): TokenStorage;
+
+type RequestInterceptor = (input: RequestInfo | URL, init: RequestInit) => Promise<[RequestInfo | URL, RequestInit]> | [RequestInfo | URL, RequestInit];
+type ResponseInterceptor = (response: Response) => Promise<Response> | Response;
+interface Interceptors {
+    request?: RequestInterceptor[];
+    response?: ResponseInterceptor[];
+}
+declare function applyRequestInterceptors(input: RequestInfo | URL, init: RequestInit, interceptors?: RequestInterceptor[]): Promise<[RequestInfo | URL, RequestInit]> | [RequestInfo | URL, RequestInit];
+declare function applyResponseInterceptors(response: Response, interceptors?: ResponseInterceptor[]): Promise<Response>;
+
+interface TransportOptions {
+    baseUrl: string;
+    fetchImpl?: FetchLike;
+    interceptors?: Interceptors;
+    clientHeader?: string;
+    defaultHeaders?: Record<string, string>;
+    credentials?: RequestCredentials;
+}
+declare class HttpClient {
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private readonly interceptors?;
+    private readonly clientHeader?;
+    private readonly defaultHeaders;
+    private readonly credentials?;
+    constructor(opts: TransportOptions);
+    private buildUrl;
+    request<T>(path: string, init?: RequestInit): Promise<ResponseWrapper<T>>;
+    requestRaw(path: string, init?: RequestInit): Promise<Response>;
+}
+
+interface components {
+    schemas: {
+        "controller.EmailDiscoveryRequest": {
+            email: string;
+        };
+        "controller.EmailDiscoveryResponse": {
+            found?: boolean;
+            has_tenant?: boolean;
+            suggestions?: string[];
+            tenant_id?: string;
+            tenant_name?: string;
+            user_exists?: boolean;
+        };
+        "controller.LoginOptionsResponse": {
+            /** @description If email domain matches an SSO provider's configured domains */
+            domain_matched_sso?: components["schemas"]["controller.SSOProviderOption"];
+            magic_link_enabled?: boolean;
+            /** @description Authentication methods available */
+            password_enabled?: boolean;
+            /** @description Recommended/preferred login method based on context
+             *     Values: "sso", "password", "magic_link", "social" */
+            preferred_method?: string;
+            /** @description Social login providers (tenant-wide or global) */
+            social_providers?: components["schemas"]["controller.SocialProviderOption"][];
+            /** @description SSO providers configured for this tenant */
+            sso_providers?: components["schemas"]["controller.SSOProviderOption"][];
+            /** @description If true, SSO is required for this domain/tenant (password disabled) */
+            sso_required?: boolean;
+            /** @description Tenant information (if discovered) */
+            tenant_id?: string;
+            tenant_name?: string;
+            /** @description If true, user exists and can use password login */
+            user_exists?: boolean;
+        };
+        "controller.SSOProviderOption": {
+            login_url?: string;
+            logo_url?: string;
+            name?: string;
+            /** @description "oidc", "saml" */
+            provider_type?: string;
+            slug?: string;
+        };
+        "controller.SocialProviderOption": {
+            login_url?: string;
+            logo_url?: string;
+            name?: string;
+            /** @description "google", "github", "microsoft", etc. */
+            provider?: string;
+        };
+        "controller.adminUpdateNamesReq": {
+            first_name?: string;
+            last_name?: string;
+        };
+        "controller.adminUpdateRolesReq": {
+            roles: string[];
+        };
+        "controller.adminUser": {
+            created_at?: string;
+            email_verified?: boolean;
+            first_name?: string;
+            id?: string;
+            is_active?: boolean;
+            last_login_at?: string;
+            last_name?: string;
+            roles?: string[];
+            updated_at?: string;
+        };
+        "controller.adminUsersResp": {
+            users?: components["schemas"]["controller.adminUser"][];
+        };
+        "controller.authExchangeResp": {
+            access_token?: string;
+            refresh_token?: string;
+            /** @example true */
+            success?: boolean;
+        };
+        "controller.changePasswordReq": {
+            current_password: string;
+            new_password: string;
+        };
+        "controller.createTenantReq": {
+            name: string;
+        };
+        "controller.fgaAuthorizeReq": {
+            object_id?: string;
+            object_type: string;
+            permission_key: string;
+            /** @description SubjectID is optional when subject_type=self; otherwise required.
+             *     When subject_type=self, the server derives the subject from the caller's token. */
+            subject_id?: string;
+            /** @enum {string} */
+            subject_type: "self" | "user" | "group";
+            tenant_id: string;
+        };
+        "controller.fgaAuthorizeResp": {
+            allowed?: boolean;
+            reason?: string;
+        };
+        "controller.fgaCreateACLTupleReq": {
+            object_id?: string;
+            object_type: string;
+            permission_key: string;
+            subject_id: string;
+            /** @enum {string} */
+            subject_type: "user" | "group";
+            tenant_id: string;
+        };
+        "controller.fgaCreateGroupReq": {
+            description?: string;
+            name: string;
+            tenant_id: string;
+        };
+        "controller.fgaDeleteACLTupleReq": {
+            object_id?: string;
+            object_type: string;
+            permission_key: string;
+            subject_id: string;
+            /** @enum {string} */
+            subject_type: "user" | "group";
+            tenant_id: string;
+        };
+        "controller.fgaGroupItem": {
+            description?: string;
+            id?: string;
+            name?: string;
+            tenant_id?: string;
+        };
+        "controller.fgaListGroupsResp": {
+            groups?: components["schemas"]["controller.fgaGroupItem"][];
+        };
+        "controller.fgaModifyGroupMemberReq": {
+            user_id: string;
+        };
+        "controller.introspectReq": {
+            token?: string;
+        };
+        "controller.listResponse": {
+            items?: components["schemas"]["controller.tenantResp"][];
+            page?: number;
+            page_size?: number;
+            total?: number;
+            total_pages?: number;
+        };
+        "controller.loginReq": {
+            email: string;
+            password: string;
+            tenant_id: string;
+        };
+        "controller.logoutReq": {
+            refresh_token?: string;
+        };
+        "controller.magicSendReq": {
+            email: string;
+            redirect_url?: string;
+            tenant_id: string;
+        };
+        "controller.magicVerifyReq": {
+            token: string;
+        };
+        "controller.mfaBackupConsumeReq": {
+            code: string;
+        };
+        "controller.mfaBackupConsumeResp": {
+            consumed?: boolean;
+        };
+        "controller.mfaBackupCountResp": {
+            count?: number;
+        };
+        "controller.mfaBackupGenerateReq": {
+            count?: number;
+        };
+        "controller.mfaBackupGenerateResp": {
+            codes?: string[];
+        };
+        "controller.mfaChallengeResp": {
+            challenge_token?: string;
+            methods?: string[];
+        };
+        "controller.mfaTOTPActivateReq": {
+            code: string;
+        };
+        "controller.mfaTOTPStartResp": {
+            otpauth_url?: string;
+            secret?: string;
+        };
+        "controller.mfaVerifyReq": {
+            challenge_token: string;
+            code: string;
+            /** @enum {string} */
+            method: "totp" | "backup_code";
+        };
+        "controller.oauth2MetadataResp": {
+            grant_types_supported?: string[];
+            guard_auth_mode_default?: string;
+            /** @description Guard-specific extensions */
+            guard_auth_modes_supported?: string[];
+            guard_version?: string;
+            introspection_endpoint?: string;
+            introspection_endpoint_auth_methods_supported?: string[];
+            issuer?: string;
+            response_types_supported?: string[];
+            revocation_endpoint?: string;
+            revocation_endpoint_auth_methods_supported?: string[];
+            scopes_supported?: string[];
+            token_endpoint?: string;
+            token_endpoint_auth_methods_supported?: string[];
+            userinfo_endpoint?: string;
+        };
+        "controller.permissionGrantItem": {
+            key?: string;
+            object_id?: string;
+            object_type?: string;
+        };
+        "controller.putSettingsRequest": {
+            /** @description App */
+            app_cors_allowed_origins?: string;
+            /** @description Auth */
+            jwt_signing_key?: string;
+            /** @description Scope is deprecated and ignored. Kept for backward compatibility with older SDKs. */
+            scope?: string;
+            sso_provider?: string;
+            sso_redirect_allowlist?: string;
+            sso_state_ttl?: string;
+            workos_api_key?: string;
+            workos_client_id?: string;
+            workos_client_secret?: string;
+            workos_default_connection_id?: string;
+            workos_default_organization_id?: string;
+        };
+        "controller.rbacCreateRoleReq": {
+            description?: string;
+            name: string;
+            tenant_id: string;
+        };
+        "controller.rbacModifyUserRoleReq": {
+            role_id: string;
+            tenant_id: string;
+        };
+        "controller.rbacPermissionItem": {
+            created_at?: string;
+            description?: string;
+            id?: string;
+            key?: string;
+            updated_at?: string;
+        };
+        "controller.rbacPermissionsResp": {
+            permissions?: components["schemas"]["controller.rbacPermissionItem"][];
+        };
+        "controller.rbacResolvedPermissionsResp": {
+            grants?: components["schemas"]["controller.permissionGrantItem"][];
+        };
+        "controller.rbacRoleItem": {
+            created_at?: string;
+            description?: string;
+            id?: string;
+            name?: string;
+            tenant_id?: string;
+            updated_at?: string;
+        };
+        "controller.rbacRolePermissionReq": {
+            permission_key: string;
+            resource_id?: string;
+            resource_type?: string;
+            scope_type: string;
+        };
+        "controller.rbacRolesResp": {
+            roles?: components["schemas"]["controller.rbacRoleItem"][];
+        };
+        "controller.rbacUpdateRoleReq": {
+            description?: string;
+            name: string;
+            tenant_id: string;
+        };
+        "controller.rbacUserRolesResp": {
+            role_ids?: string[];
+        };
+        "controller.refreshReq": {
+            refresh_token?: string;
+        };
+        "controller.resetPasswordConfirmReq": {
+            new_password: string;
+            tenant_id?: string;
+            token: string;
+        };
+        "controller.resetPasswordRequestReq": {
+            email: string;
+            tenant_id?: string;
+        };
+        "controller.revokeReq": {
+            token: string;
+            token_type: string;
+        };
+        "controller.sessionItem": {
+            auth_method?: string;
+            created_at?: string;
+            expires_at?: string;
+            id?: string;
+            ip?: string;
+            revoked?: boolean;
+            sso_provider_id?: string;
+            sso_provider_name?: string;
+            sso_provider_slug?: string;
+            user_agent?: string;
+        };
+        "controller.sessionsListResp": {
+            sessions?: components["schemas"]["controller.sessionItem"][];
+        };
+        "controller.settingsResponse": {
+            /** @description App */
+            app_cors_allowed_origins?: string;
+            /** @description SSO */
+            sso_provider?: string;
+            sso_redirect_allowlist?: string;
+            sso_state_ttl?: string;
+            /** @description masked */
+            workos_api_key?: string;
+            workos_client_id?: string;
+            /** @description masked */
+            workos_client_secret?: string;
+            workos_default_connection_id?: string;
+            workos_default_organization_id?: string;
+        };
+        "controller.signupReq": {
+            email: string;
+            first_name?: string;
+            last_name?: string;
+            password: string;
+            tenant_id: string;
+        };
+        "controller.spInfoResponse": {
+            acs_url?: string;
+            base_url?: string;
+            entity_id?: string;
+            login_url?: string;
+            metadata_url?: string;
+            slo_url?: string;
+            tenant_id?: string;
+        };
+        "controller.tenantResp": {
+            created_at?: string;
+            id?: string;
+            is_active?: boolean;
+            name?: string;
+            updated_at?: string;
+        };
+        "controller.updateProfileReq": {
+            first_name?: string;
+            last_name?: string;
+        };
+        "domain.Introspection": {
+            active?: boolean;
+            email?: string;
+            email_verified?: boolean;
+            exp?: number;
+            iat?: number;
+            mfa_verified?: boolean;
+            roles?: string[];
+            tenant_id?: string;
+            user_id?: string;
+        };
+        "domain.PortalLink": {
+            link?: string;
+        };
+        "domain.UserProfile": {
+            email?: string;
+            email_verified?: boolean;
+            first_name?: string;
+            id?: string;
+            last_login_at?: string;
+            last_name?: string;
+            mfa_enabled?: boolean;
+            roles?: string[];
+            tenant_id?: string;
+        };
+    };
+    responses: never;
+    parameters: never;
+    requestBodies: {
+        /** @description Magic token in JSON body */
+        "controller.magicVerifyReq": {
+            content: {
+                "application/json": components["schemas"]["controller.magicVerifyReq"];
+            };
+        };
+        /** @description permission_key, scope_type, optional resource_type/resource_id */
+        "controller.rbacRolePermissionReq": {
+            content: {
+                "application/json": components["schemas"]["controller.rbacRolePermissionReq"];
+            };
+        };
+        /** @description user_id */
+        "controller.fgaModifyGroupMemberReq": {
+            content: {
+                "application/json": components["schemas"]["controller.fgaModifyGroupMemberReq"];
+            };
+        };
+        /** @description tenant_id, role_id */
+        "controller.rbacModifyUserRoleReq": {
+            content: {
+                "application/json": components["schemas"]["controller.rbacModifyUserRoleReq"];
+            };
+        };
+    };
+    headers: never;
+    pathItems: never;
+}
+
+interface GuardClientOptions {
+    baseUrl: string;
+    tenantId?: TenantId;
+    fetchImpl?: FetchLike;
+    storage?: TokenStorage;
+    defaultHeaders?: Record<string, string>;
+    authMode?: 'bearer' | 'cookie';
+}
+type TokensResp = {
+    access_token?: string | null;
+    refresh_token?: string | null;
+    success?: boolean;
+};
+type MfaChallengeResp = components['schemas']['controller.mfaChallengeResp'];
+type OAuth2MetadataResp = components['schemas']['controller.oauth2MetadataResp'];
+type PortalLink = components['schemas']['domain.PortalLink'] & {
+    link: string;
+};
+interface SsoPortalSessionResp {
+    tenant_id: string;
+    provider_slug: string;
+    portal_token_id: string;
+    intent: string;
+}
+interface TenantOption {
+    tenant_id: string;
+    tenant_name: string;
+}
+interface TenantSelectionRequiredResp {
+    error: 'tenant_selection_required';
+    message: string;
+    tenants: TenantOption[];
+}
+declare function isTenantSelectionRequired(data: unknown): data is TenantSelectionRequiredResp;
+interface SsoPortalContext {
+    session: SsoPortalSessionResp;
+    provider: SsoProviderItem;
+}
+declare function isTokensResp(data: unknown): data is TokensResp;
+declare function isMfaChallengeResp(data: unknown): data is MfaChallengeResp;
+type MfaVerifyReq = components['schemas']['controller.mfaVerifyReq'];
+type RefreshReq = components['schemas']['controller.refreshReq'];
+type RbacPermissionsResp = components['schemas']['controller.rbacPermissionsResp'];
+type RbacRolesResp = components['schemas']['controller.rbacRolesResp'];
+type RbacRoleItem = components['schemas']['controller.rbacRoleItem'];
+type RbacCreateRoleReq = components['schemas']['controller.rbacCreateRoleReq'];
+type RbacUpdateRoleReq = components['schemas']['controller.rbacUpdateRoleReq'];
+type RbacRolePermissionReq = components['schemas']['controller.rbacRolePermissionReq'];
+type RbacUserRolesResp = components['schemas']['controller.rbacUserRolesResp'];
+type RbacModifyUserRoleReq = components['schemas']['controller.rbacModifyUserRoleReq'];
+type RbacResolvedPermissionsResp = components['schemas']['controller.rbacResolvedPermissionsResp'];
+type FgaGroup = {
+    id: string;
+    tenant_id: string;
+    name: string;
+    description?: string;
+    created_at: string;
+    updated_at: string;
+};
+type FgaGroupsResp = {
+    groups: FgaGroup[];
+};
+type FgaAclTuple = {
+    id: string;
+    tenant_id: string;
+    subject_type: string;
+    subject_id: string;
+    permission_key?: string;
+    object_type: string;
+    object_id?: string | null;
+    created_by?: string | null;
+    created_at: string;
+};
+interface TenantSummary {
+    id: string;
+    name?: string;
+}
+interface DiscoverTenantsResp {
+    tenants: TenantSummary[];
+}
+type UserProfile = components['schemas']['domain.UserProfile'];
+type Introspection = components['schemas']['domain.Introspection'];
+type MagicSendReq = components['schemas']['controller.magicSendReq'];
+type MagicVerifyReq = components['schemas']['controller.magicVerifyReq'];
+type PasswordSignupInput = {
+    email: string;
+    password: string;
+    tenant_id?: string;
+    first_name?: string;
+    last_name?: string;
+};
+interface AdminUser {
+    id: string;
+    email_verified: boolean;
+    is_active: boolean;
+    first_name: string;
+    last_name: string;
+    roles: string[];
+    created_at: string;
+    updated_at: string;
+    last_login_at?: string | null;
+}
+interface AdminUsersResp {
+    users: AdminUser[];
+}
+/** Auth method used to create a session */
+type AuthMethod = 'password' | 'sso' | 'magic_link';
+interface SessionItem {
+    id: string;
+    revoked: boolean;
+    user_agent: string;
+    ip: string;
+    created_at: string;
+    expires_at: string;
+    auth_method: AuthMethod;
+    sso_provider_id?: string;
+    sso_provider_name?: string;
+    sso_provider_slug?: string;
+}
+interface SessionsListResp {
+    sessions: SessionItem[];
+}
+interface TenantSettingsResponse {
+    sso_provider: string;
+    workos_client_id: string;
+    workos_client_secret?: string;
+    workos_api_key?: string;
+    workos_default_connection_id?: string;
+    workos_default_organization_id?: string;
+    sso_state_ttl: string;
+    sso_redirect_allowlist: string;
+}
+interface TenantSettingsPutRequest {
+    sso_provider?: string | null;
+    workos_client_id?: string | null;
+    workos_client_secret?: string | null;
+    workos_api_key?: string | null;
+    workos_default_connection_id?: string | null;
+    workos_default_organization_id?: string | null;
+    sso_state_ttl?: string | null;
+    sso_redirect_allowlist?: string | null;
+}
+type SsoProviderType = 'oidc' | 'saml';
+type SsoLinkingPolicy = 'never' | 'verified_email' | 'always';
+interface SsoProviderItem {
+    id: string;
+    tenant_id: string;
+    name: string;
+    slug: string;
+    provider_type: SsoProviderType;
+    enabled: boolean;
+    allow_signup: boolean;
+    trust_email_verified: boolean;
+    domains: string[];
+    attribute_mapping?: Record<string, any>;
+    issuer?: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    userinfo_endpoint?: string;
+    jwks_uri?: string;
+    client_id?: string;
+    client_secret?: string;
+    scopes?: string[];
+    response_type?: string;
+    response_mode?: string;
+    entity_id?: string;
+    acs_url?: string;
+    slo_url?: string;
+    idp_metadata_url?: string;
+    idp_metadata_xml?: string;
+    idp_entity_id?: string;
+    idp_sso_url?: string;
+    idp_slo_url?: string;
+    idp_certificate?: string;
+    sp_certificate?: string;
+    sp_private_key?: string;
+    sp_certificate_expires_at?: string;
+    want_assertions_signed?: boolean;
+    want_response_signed?: boolean;
+    sign_requests?: boolean;
+    force_authn?: boolean;
+    allow_idp_initiated?: boolean;
+    linking_policy?: SsoLinkingPolicy;
+    created_at: string;
+    updated_at: string;
+    created_by?: string;
+    updated_by?: string;
+}
+interface SsoProvidersListResp {
+    providers: SsoProviderItem[];
+    total: number;
+}
+interface SsoProviderOption {
+    slug: string;
+    name: string;
+    provider_type: SsoProviderType;
+    logo_url?: string;
+    login_url: string;
+}
+interface LoginOptionsResp {
+    password_enabled: boolean;
+    magic_link_enabled: boolean;
+    sso_providers: SsoProviderOption[];
+    preferred_method: AuthMethod;
+    sso_required: boolean;
+    user_exists: boolean;
+    tenant_id?: string;
+    tenant_name?: string;
+    domain_matched_sso?: SsoProviderOption;
+}
+interface CreateSsoProviderReq {
+    tenant_id: string;
+    name: string;
+    slug: string;
+    provider_type: SsoProviderType;
+    enabled?: boolean;
+    allow_signup?: boolean;
+    trust_email_verified?: boolean;
+    domains?: string[];
+    attribute_mapping?: Record<string, any>;
+    issuer?: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    userinfo_endpoint?: string;
+    jwks_uri?: string;
+    client_id?: string;
+    client_secret?: string;
+    scopes?: string[];
+    response_type?: string;
+    response_mode?: string;
+    entity_id?: string;
+    acs_url?: string;
+    slo_url?: string;
+    idp_metadata_url?: string;
+    idp_metadata_xml?: string;
+    idp_entity_id?: string;
+    idp_sso_url?: string;
+    idp_slo_url?: string;
+    idp_certificate?: string;
+    sp_certificate?: string;
+    sp_private_key?: string;
+    want_assertions_signed?: boolean;
+    want_response_signed?: boolean;
+    sign_requests?: boolean;
+    force_authn?: boolean;
+    allow_idp_initiated?: boolean;
+    linking_policy?: SsoLinkingPolicy;
+}
+interface UpdateSsoProviderReq {
+    name?: string;
+    enabled?: boolean;
+    allow_signup?: boolean;
+    trust_email_verified?: boolean;
+    domains?: string[];
+    attribute_mapping?: Record<string, any>;
+    issuer?: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    userinfo_endpoint?: string;
+    jwks_uri?: string;
+    client_id?: string;
+    client_secret?: string;
+    scopes?: string[];
+    response_type?: string;
+    response_mode?: string;
+    entity_id?: string;
+    acs_url?: string;
+    slo_url?: string;
+    idp_metadata_url?: string;
+    idp_metadata_xml?: string;
+    idp_entity_id?: string;
+    idp_sso_url?: string;
+    idp_slo_url?: string;
+    idp_certificate?: string;
+    sp_certificate?: string;
+    sp_private_key?: string;
+    want_assertions_signed?: boolean;
+    want_response_signed?: boolean;
+    sign_requests?: boolean;
+    force_authn?: boolean;
+    allow_idp_initiated?: boolean;
+    linking_policy?: SsoLinkingPolicy;
+}
+interface SsoTestProviderResp {
+    success: boolean;
+    metadata?: Record<string, any>;
+    error?: string;
+}
+interface SsoSPInfoResp {
+    /** SP Entity ID / Issuer URL (also called "Identifier" in some IdPs) */
+    entity_id: string;
+    /** Assertion Consumer Service URL where the IdP sends SAML responses */
+    acs_url: string;
+    /** Single Logout URL (optional) */
+    slo_url?: string;
+    /** URL where SP metadata XML can be downloaded */
+    metadata_url: string;
+    /** URL to initiate SSO login */
+    login_url: string;
+    /** Public base URL of the Guard service */
+    base_url: string;
+    /** Tenant ID used in the URL paths */
+    tenant_id: string;
+}
+type PasswordLoginInput = {
+    email: string;
+    password: string;
+    tenant_id?: string;
+};
+declare class GuardClient {
+    readonly baseUrl: string;
+    private readonly tenantId?;
+    private readonly storage;
+    private readonly http;
+    constructor(opts: GuardClientOptions);
+    protected request<T>(path: string, init: RequestInit): Promise<ResponseWrapper<T>>;
+    private persistTokensFrom;
+    private buildQuery;
+    passwordLogin(body: PasswordLoginInput): Promise<ResponseWrapper<TokensResp | MfaChallengeResp>>;
+    passwordSignup(body: PasswordSignupInput): Promise<ResponseWrapper<TokensResp>>;
+    mfaVerify(body: MfaVerifyReq): Promise<ResponseWrapper<TokensResp>>;
+    refresh(body?: Partial<RefreshReq>): Promise<ResponseWrapper<TokensResp>>;
+    logout(body?: {
+        refresh_token?: string | null;
+    }): Promise<ResponseWrapper<unknown>>;
+    me(): Promise<ResponseWrapper<UserProfile>>;
+    emailDiscover(body: {
+        email: string;
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<{
+        found: boolean;
+        has_tenant: boolean;
+        tenant_id?: string;
+        tenant_name?: string;
+        user_exists: boolean;
+        suggestions?: string[];
+    }>>;
+    getLoginOptions(params?: {
+        email?: string;
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<LoginOptionsResp>>;
+    mfaStartTotp(): Promise<ResponseWrapper<{
+        secret: string;
+        otpauth_url: string;
+    }>>;
+    mfaActivateTotp(body: {
+        code: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    mfaDisableTotp(): Promise<ResponseWrapper<unknown>>;
+    mfaGenerateBackupCodes(body?: {
+        count?: number;
+    }): Promise<ResponseWrapper<{
+        codes: string[];
+    }>>;
+    mfaCountBackupCodes(): Promise<ResponseWrapper<{
+        count: number;
+    }>>;
+    discoverTenants(params: {
+        email: string;
+    }): Promise<ResponseWrapper<DiscoverTenantsResp>>;
+    createTenant(body: {
+        name: string;
+    }): Promise<ResponseWrapper<{
+        id: string;
+        name: string;
+        is_active?: boolean;
+        created_at?: string;
+        updated_at?: string;
+    }>>;
+    getTenant(id: string): Promise<ResponseWrapper<{
+        id: string;
+        name: string;
+        is_active: boolean;
+        created_at: string;
+        updated_at: string;
+    }>>;
+    listTenants(params?: {
+        q?: string;
+        page?: number;
+        page_size?: number;
+        active?: number | boolean;
+    }): Promise<ResponseWrapper<{
+        items: Array<{
+            id: string;
+            name: string;
+            is_active: boolean;
+            created_at: string;
+            updated_at: string;
+        }>;
+        total: number;
+        page: number;
+        page_size: number;
+        total_pages: number;
+    }>>;
+    introspect(body?: {
+        token?: string;
+    }): Promise<ResponseWrapper<Introspection>>;
+    magicSend(body: MagicSendReq): Promise<ResponseWrapper<unknown>>;
+    magicVerify(params?: {
+        token?: string;
+    }, body?: MagicVerifyReq): Promise<ResponseWrapper<TokensResp>>;
+    passwordResetRequest(body: {
+        tenant_id?: string;
+        email: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    passwordResetConfirm(body: {
+        tenant_id?: string;
+        token: string;
+        new_password: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    changePassword(body: {
+        current_password: string;
+        new_password: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    updateProfile(body: {
+        first_name?: string;
+        last_name?: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    listUsers(params?: {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<AdminUsersResp>>;
+    updateUserNames(id: string, body: {
+        first_name?: string;
+        last_name?: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    blockUser(id: string): Promise<ResponseWrapper<unknown>>;
+    unblockUser(id: string): Promise<ResponseWrapper<unknown>>;
+    verifyUserEmail(id: string): Promise<ResponseWrapper<unknown>>;
+    unverifyUserEmail(id: string): Promise<ResponseWrapper<unknown>>;
+    listSessions(options?: {
+        includeAll?: boolean;
+    }): Promise<ResponseWrapper<SessionsListResp>>;
+    revokeSession(id: string): Promise<ResponseWrapper<unknown>>;
+    getTenantSettings(tenantId?: string): Promise<ResponseWrapper<TenantSettingsResponse>>;
+    updateTenantSettings(tenantId: string, settings: TenantSettingsPutRequest): Promise<ResponseWrapper<unknown>>;
+    /**
+     * Start SSO flow with a provider slug.
+     * Uses V2 tenant-scoped URLs: /auth/sso/t/{tenant_id}/{slug}/login
+     *
+     * @param providerSlug - The provider slug (e.g., 'okta', 'azure-ad', 'google-saml')
+     * @param params - Optional parameters for the SSO flow
+     * @returns The redirect URL to send the user to for authentication
+     *
+     * @example
+     * ```ts
+     * const result = await client.startSso('okta', { redirect_url: 'https://myapp.com/callback' });
+     * window.location.href = result.data.redirect_url;
+     * ```
+     */
+    startSso(providerSlug: SsoProvider, params?: {
+        tenant_id?: string;
+        redirect_url?: string;
+        login_hint?: string;
+        force_authn?: boolean;
+    }): Promise<ResponseWrapper<{
+        redirect_url: string;
+    }>>;
+    /**
+     * Handle SSO callback and exchange code for tokens.
+     * Uses V2 tenant-scoped URLs: /auth/sso/t/{tenant_id}/{slug}/callback
+     *
+     * @param providerSlug - The provider slug used in startSso
+     * @param params - Callback parameters (code, state from IdP redirect)
+     * @returns Access and refresh tokens
+     */
+    handleSsoCallback(providerSlug: SsoProvider, params: {
+        tenant_id?: string;
+        code: string;
+        state?: string;
+    }): Promise<ResponseWrapper<TokensResp>>;
+    /**
+     * Parse SSO callback tokens from URL query parameters or fragment.
+     * Use this when Guard redirects to your app's callback URL with tokens.
+     *
+     * **Note:** This method has a side effect: when tokens are successfully parsed,
+     * they are automatically persisted to the configured TokenStorage.
+     *
+     * @param url - The full callback URL or just the query/fragment string (e.g., window.location.search or window.location.hash)
+     * @returns Tokens if access_token is present in URL, null otherwise
+     *
+     * @remarks
+     * - access_token is required for a successful return
+     * - refresh_token is optional (some flows don't provide it)
+     * - When refresh_token is missing, token refresh via `refresh()` will not be available
+     * - Tokens are persisted to storage on successful parse (side effect)
+     */
+    parseSsoCallbackTokens(url: string): TokensResp | null;
+    getSsoOrganizationPortalLink(provider: SsoProvider, params: {
+        tenant_id?: string;
+        organization_id: string;
+        intent?: string;
+    }): Promise<ResponseWrapper<PortalLink>>;
+    ssoPortalSession(token: string): Promise<ResponseWrapper<SsoPortalSessionResp>>;
+    ssoPortalProvider(token: string): Promise<ResponseWrapper<SsoProviderItem>>;
+    loadSsoPortalContext(token: string): Promise<SsoPortalContext>;
+    private extractErrorDetails;
+    ssoListProviders(params?: {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<SsoProvidersListResp>>;
+    ssoCreateProvider(body: CreateSsoProviderReq): Promise<ResponseWrapper<SsoProviderItem>>;
+    ssoGetProvider(id: string): Promise<ResponseWrapper<SsoProviderItem>>;
+    ssoUpdateProvider(id: string, body: UpdateSsoProviderReq): Promise<ResponseWrapper<SsoProviderItem>>;
+    ssoDeleteProvider(id: string): Promise<ResponseWrapper<unknown>>;
+    ssoTestProvider(id: string): Promise<ResponseWrapper<SsoTestProviderResp>>;
+    /**
+     * Get computed Service Provider (SP) URLs for SAML configuration.
+     * These URLs are needed by admins to configure their Identity Provider (IdP).
+     * URLs use V2 tenant-scoped format: /auth/sso/t/{tenant_id}/{slug}/*
+     *
+     * @param slug - The provider slug (e.g. 'okta', 'azure-ad')
+     * @param tenantId - Optional tenant ID (uses client's default if not provided)
+     * @returns SP info including Entity ID, ACS URL, SLO URL, Metadata URL, Login URL, and Tenant ID
+     *
+     * @example
+     * ```ts
+     * const spInfo = await client.ssoGetSPInfo('okta');
+     * console.log(spInfo.data.entity_id);  // https://api.example.com/auth/sso/t/{tenant_id}/okta/metadata
+     * console.log(spInfo.data.acs_url);    // https://api.example.com/auth/sso/t/{tenant_id}/okta/callback
+     * console.log(spInfo.data.tenant_id);  // The tenant UUID used in the URLs
+     * ```
+     */
+    ssoGetSPInfo(slug: string, tenantId?: string): Promise<ResponseWrapper<SsoSPInfoResp>>;
+    rbacListPermissions(): Promise<ResponseWrapper<RbacPermissionsResp>>;
+    rbacListRoles(params?: {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<RbacRolesResp>>;
+    rbacCreateRole(body: Omit<RbacCreateRoleReq, 'tenant_id'> & {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<RbacRoleItem>>;
+    rbacUpdateRole(id: string, body: Omit<RbacUpdateRoleReq, 'tenant_id'> & {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<RbacRoleItem>>;
+    rbacDeleteRole(id: string, params?: {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    rbacListUserRoles(userId: string, params?: {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<RbacUserRolesResp>>;
+    rbacAddUserRole(userId: string, body: Omit<RbacModifyUserRoleReq, 'tenant_id'> & {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    rbacRemoveUserRole(userId: string, body: Omit<RbacModifyUserRoleReq, 'tenant_id'> & {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    rbacUpsertRolePermission(roleId: string, body: RbacRolePermissionReq): Promise<ResponseWrapper<unknown>>;
+    rbacDeleteRolePermission(roleId: string, body: RbacRolePermissionReq): Promise<ResponseWrapper<unknown>>;
+    rbacResolveUserPermissions(userId: string, params: {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<RbacResolvedPermissionsResp>>;
+    fgaListGroups(params: {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<FgaGroupsResp>>;
+    fgaCreateGroup(body: {
+        tenant_id?: string;
+        name: string;
+        description?: string | null;
+    }): Promise<ResponseWrapper<FgaGroup>>;
+    fgaDeleteGroup(id: string, params: {
+        tenant_id?: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    fgaAddGroupMember(groupId: string, body: {
+        user_id: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    fgaRemoveGroupMember(groupId: string, body: {
+        user_id: string;
+    }): Promise<ResponseWrapper<unknown>>;
+    fgaCreateAclTuple(body: {
+        tenant_id?: string;
+        subject_type: string;
+        subject_id: string;
+        permission_key: string;
+        object_type: string;
+        object_id?: string | null;
+        created_by?: string | null;
+    }): Promise<ResponseWrapper<FgaAclTuple>>;
+    fgaDeleteAclTuple(body: {
+        tenant_id?: string;
+        subject_type: string;
+        subject_id: string;
+        permission_key: string;
+        object_type: string;
+        object_id?: string | null;
+    }): Promise<ResponseWrapper<unknown>>;
+    /**
+     * Fetch OAuth 2.0 Authorization Server Metadata (RFC 8414)
+     * Returns server capabilities including supported auth modes, endpoints, and grant types.
+     * This endpoint is public and does not require authentication.
+     */
+    getOAuth2Metadata(): Promise<ResponseWrapper<OAuth2MetadataResp>>;
+    /**
+     * Static helper to discover OAuth2 metadata from any Guard API base URL.
+     * Useful for auto-configuration before creating a GuardClient instance.
+     *
+     * @example
+     * ```ts
+     * const metadata = await GuardClient.discover('https://api.example.com');
+     * console.log(metadata.guard_auth_modes_supported); // ['bearer', 'cookie']
+     * console.log(metadata.guard_auth_mode_default);    // 'bearer'
+     *
+     * // Create client with discovered default auth mode
+     * const client = new GuardClient({
+     *   baseUrl: 'https://api.example.com',
+     *   authMode: metadata.guard_auth_mode_default as 'bearer' | 'cookie'
+     * });
+     * ```
+     */
+    static discover(baseUrl: string, fetchImpl?: FetchLike): Promise<OAuth2MetadataResp>;
+}
+
+declare function generateTOTPCode(base32Secret: string): string;
+
+export { type AdminUser, type AdminUsersResp, ApiError, type AsyncStorageLike, type AuthMethod, type CreateSsoProviderReq, type DiscoverTenantsResp, type FetchLike, type FgaAclTuple, type FgaGroup, type FgaGroupsResp, GuardClient, type GuardClientOptions, type HeadersMap, HttpClient, InMemoryStorage, type Interceptors, type LoginOptionsResp, type Meta, RateLimitError, type RequestInterceptor, type ResponseInterceptor, type ResponseWrapper, type SessionItem, type SessionsListResp, type SsoLinkingPolicy, type SsoPortalContext, type SsoPortalSessionResp, type SsoProvider, type SsoProviderItem, type SsoProviderOption, type SsoProviderSlug, type SsoProviderType, type SsoProvidersListResp, type SsoSPInfoResp, type SsoTestProviderResp, type TenantId, type TenantOption, type TenantSelectionRequiredResp, type TenantSettingsPutRequest, type TenantSettingsResponse, type TenantSummary, type TokenProvider, type TokenStorage, type TransportOptions, type UpdateSsoProviderReq, WebLocalStorage, applyRequestInterceptors, applyResponseInterceptors, buildRateLimitError, generateTOTPCode, isApiError, isMfaChallengeResp, isRateLimitError, isTenantSelectionRequired, isTokensResp, noopStorage, parseRetryAfter, reactNativeStorageAdapter, toHeadersMap };