@tktchurch/auth 0.9.1 → 0.9.5

package/dist/memory-DNWYyNSB.d.ts

@@ -0,0 +1,1379 @@
+type DataSubjectRequestType = "access" | "correction" | "erasure" | "grievance" | "nominate";
+type DataSubjectRequestStatus = "submitted" | "in_progress" | "resolved" | "rejected" | "cancelled";
+type DataExportStatus = "pending" | "processing" | "completed" | "failed" | "expired";
+interface PrivacyNotice {
+    id: string;
+    version: string;
+    locale: string;
+    purpose: string;
+    title: string;
+    body: string;
+    effectiveAt: string;
+    isActive: boolean;
+    createdAt?: string;
+}
+interface PrivacyConsentRecord {
+    id: string;
+    userId: string;
+    noticeId: string;
+    lawfulBasis: string;
+    purposes: string[];
+    acceptedAt: string;
+    withdrawnAt?: string;
+    createdAt?: string;
+}
+interface DataSubjectRequest {
+    id: string;
+    userId: string;
+    organizationId?: string;
+    type: DataSubjectRequestType;
+    status: DataSubjectRequestStatus;
+    description?: string;
+    handlerUserId?: string;
+    slaDeadline?: string;
+    resolutionNotes?: string;
+    resolvedAt?: string;
+    createdAt?: string;
+    updatedAt?: string;
+}
+interface DataExportJob {
+    id: string;
+    status: DataExportStatus;
+    format: string;
+    downloadUrl?: string;
+    payload?: Record<string, string>;
+    expiresAt?: string;
+    errorMessage?: string;
+    completedAt?: string;
+    createdAt?: string;
+}
+interface GrievanceOfficer {
+    name: string;
+    email: string;
+    phone?: string;
+    address?: string;
+    slaDays: number;
+}
+interface RetentionPolicy {
+    id: string;
+    resourceType: string;
+    ttlDays: number;
+    isActive: boolean;
+    createdAt?: string;
+}
+interface PrivacyEndpoints {
+    currentNotice(input?: {
+        locale?: string;
+        purpose?: string;
+    }): Promise<PrivacyNotice>;
+    recordConsent(input: {
+        noticeId: string;
+        purposes: string[];
+        lawfulBasis?: string;
+    }): Promise<PrivacyConsentRecord>;
+    withdrawConsent(consentId: string): Promise<void>;
+    submitDataRequest(input: {
+        type: DataSubjectRequestType;
+        description?: string;
+    }): Promise<DataSubjectRequest>;
+    listMyRequests(query?: PageQuery): Promise<PageResponse<DataSubjectRequest>>;
+    requestExport(input?: {
+        refresh?: boolean;
+    }): Promise<DataExportJob>;
+    downloadExport(exportId: string): Promise<Record<string, string>>;
+    grievanceOfficer(): Promise<GrievanceOfficer>;
+    admin: {
+        listDataRequests(query?: PageQuery & {
+            type?: DataSubjectRequestType;
+            status?: DataSubjectRequestStatus;
+            userId?: string;
+        }): Promise<PageResponse<DataSubjectRequest>>;
+        getDataRequest(id: string): Promise<DataSubjectRequest>;
+        resolveDataRequest(id: string, input: {
+            status: DataSubjectRequestStatus;
+            resolutionNotes?: string;
+            handlerUserId?: string;
+        }): Promise<DataSubjectRequest>;
+        attachExportArtifact(exportId: string, input: {
+            downloadUrl: string;
+            expiresAt?: string;
+        }): Promise<DataExportJob>;
+        listNotices(query?: PageQuery): Promise<PageResponse<PrivacyNotice>>;
+        createNotice(input: JsonObject): Promise<PrivacyNotice>;
+        updateNotice(id: string, input: JsonObject): Promise<PrivacyNotice>;
+        listRetentionPolicies(query?: PageQuery): Promise<PageResponse<RetentionPolicy>>;
+        createRetentionPolicy(input: {
+            resourceType: string;
+            ttlDays: number;
+            isActive?: boolean;
+        }): Promise<RetentionPolicy>;
+        updateRetentionPolicy(id: string, input: {
+            ttlDays?: number;
+            isActive?: boolean;
+        }): Promise<RetentionPolicy>;
+    };
+}
+
+interface OAuthAuthorizationServerMetadata {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksUri?: string;
+    revocationEndpoint?: string;
+    introspectionEndpoint?: string;
+    registrationEndpoint?: string;
+    scopesSupported?: string[];
+    responseTypesSupported: string[];
+    grantTypesSupported?: string[];
+    codeChallengeMethodsSupported?: string[];
+    /** RFC 9126 pushed authorization request endpoint. */
+    pushedAuthorizationRequestEndpoint?: string;
+    /** RFC 9126: whether the server requires PAR. */
+    requirePushedAuthorizationRequests?: boolean;
+    /** RFC 9396 supported authorization details types. */
+    authorizationDetailsTypesSupported?: string[];
+    raw: JsonObject;
+}
+interface MemberLookupInput {
+    memberId: string;
+}
+interface MemberProfile {
+    memberId: string;
+    firstName?: string;
+    middleName?: string;
+    lastName?: string;
+    email?: string;
+    phoneNumber?: string;
+    familyName?: string;
+}
+interface MemberDirectoryEndpoints {
+    lookup(input: MemberLookupInput): Promise<MemberProfile>;
+}
+interface FederatedSignInUrlOptions {
+    clientId?: string;
+    redirectUri: string;
+    state?: string;
+    scope?: string;
+}
+interface FederatedLinkStartOptions {
+    redirectUri: string;
+    state?: string;
+}
+interface FederatedEndpoints {
+    googleSignInUrl(options: FederatedSignInUrlOptions): string;
+    appleSignInUrl(options: FederatedSignInUrlOptions): string;
+    googleLinkStart(options: FederatedLinkStartOptions): string;
+    appleLinkStart(options: FederatedLinkStartOptions): string;
+    googleLinkFinalize(input: {
+        code: string;
+        state: string;
+    }): Promise<JsonObject>;
+    appleLinkFinalize(input: {
+        idToken: string;
+        state: string;
+    }): Promise<JsonObject>;
+}
+interface FamilyMember {
+    id: string;
+    userId?: string;
+    email?: string;
+    role: string;
+    status: string;
+    externalMemberId?: string;
+}
+interface FamilyAccount {
+    id: string;
+    name: string;
+    source?: string;
+    externalFamilyId?: string;
+    members: FamilyMember[];
+}
+interface FamilyInviteInput {
+    email: string;
+    role?: string;
+}
+interface FamiliesEndpoints {
+    list(): Promise<FamilyAccount[]>;
+    invite(familyId: string, input: FamilyInviteInput): Promise<FamilyAccount>;
+    removeMember(familyId: string, memberId: string): Promise<void>;
+}
+interface DependentRecord {
+    id: string;
+    firstName?: string;
+    lastName?: string;
+    birthdate?: string;
+    accountType: string;
+    delegationLevel?: string;
+    canActOnBehalf?: boolean;
+    consentGivenAt?: string;
+    age?: number;
+    createdAt?: string;
+}
+interface GuardianConsentRecord {
+    id: string;
+    dependentUserId: string;
+    serviceType: string;
+    consentType: string;
+    consentedAt?: string;
+    expiresAt?: string;
+    revokedAt?: string;
+    isActive?: boolean;
+    coppaApplicable?: boolean;
+    gdprArticle8Applicable?: boolean;
+}
+interface GuardianFamilyMember {
+    memberId: string;
+    userId?: string;
+    role: string;
+    status: string;
+    canActOnBehalf?: boolean;
+    delegationLevel?: string;
+    accountType?: string;
+    displayName?: string;
+}
+interface GuardianFamily {
+    id: string;
+    name: string;
+    organizationId?: string;
+    members: GuardianFamilyMember[];
+}
+interface DependentsEndpoints {
+    list(): Promise<DependentRecord[]>;
+    create(input: JsonObject): Promise<DependentRecord>;
+    update(dependentId: string, input: JsonObject): Promise<DependentRecord>;
+    remove(dependentId: string): Promise<void>;
+    getFamily(): Promise<GuardianFamily>;
+    joinOrCreateFamily(input?: JsonObject): Promise<GuardianFamily>;
+    grantConsent(dependentId: string, input: JsonObject): Promise<GuardianConsentRecord>;
+    revokeConsent(dependentId: string, consentId: string): Promise<void>;
+}
+interface ClientProviderRecord {
+    id: string;
+    clientId?: string;
+    provider: string;
+    providerDisplayName?: string;
+    isEnabled?: boolean;
+    priority?: number;
+    customScopes?: string[];
+    createdAt?: string;
+    updatedAt?: string;
+}
+interface AvailableProviderRecord {
+    provider: string;
+    displayName?: string;
+    isConfigured?: boolean;
+    defaultScopes: string[];
+}
+interface ClientProviderEndpoints {
+    listAvailable(): Promise<AvailableProviderRecord[]>;
+    list(clientId: string): Promise<ClientProviderRecord[]>;
+    enable(clientId: string, input: JsonObject): Promise<ClientProviderRecord>;
+    get(clientId: string, provider: string): Promise<ClientProviderRecord>;
+    update(clientId: string, provider: string, input: JsonObject): Promise<ClientProviderRecord>;
+    disable(clientId: string, provider: string): Promise<void>;
+}
+interface ClientApiKeyRecord {
+    id: string;
+    organizationId?: string;
+    clientId?: string;
+    name: string;
+    keyPrefix?: string;
+    scopes: string[];
+    isActive?: boolean;
+    expiresAt?: string;
+    lastUsedAt?: string;
+    createdAt?: string;
+}
+interface CreatedClientApiKeyRecord extends ClientApiKeyRecord {
+    key?: string;
+}
+interface ClientApiKeysEndpoints {
+    list(clientId: string): Promise<ClientApiKeyRecord[]>;
+    create(clientId: string, input: JsonObject): Promise<CreatedClientApiKeyRecord>;
+    delete(clientId: string, keyId: string): Promise<void>;
+}
+interface TokenExchangeRequest {
+    subjectToken: string;
+    subjectTokenType?: string;
+    requestedSubject: string;
+    scope?: string;
+    audience?: string;
+}
+interface AuthorizationConsentBody {
+    username: string;
+    password: string;
+    approved?: boolean;
+    requestedScopes?: string[];
+    mfaCode?: string;
+    mfaBackupCode?: string;
+}
+interface AuthorizationConsentResponse {
+    redirectUri: string;
+    code?: string;
+    state?: string;
+    error?: string;
+    errorDescription?: string;
+    mfaMethods?: string[];
+    accessToken?: string;
+    tokenType?: string;
+    expiresIn?: number;
+    scope?: string;
+    idToken?: string;
+}
+interface ConsentWithCredentialsOptions {
+    callbackUrl: string;
+    username: string;
+    password: string;
+    approved?: boolean;
+    requestedScopes?: string[];
+    mfaCode?: string;
+    mfaBackupCode?: string;
+}
+interface AuthorizationConsentEvaluateBody {
+    username: string;
+    password: string;
+    requestedScopes?: string[];
+    mfaCode?: string;
+    mfaBackupCode?: string;
+}
+interface AuthorizationConsentEvaluateResponse {
+    consentSatisfied: boolean;
+    requiresMfa: boolean;
+    mfaMethods?: string[];
+    uncoveredScopes?: string[];
+    error?: string;
+    errorDescription?: string;
+}
+interface EvaluateConsentWithCredentialsOptions {
+    callbackUrl: string;
+    username: string;
+    password: string;
+    requestedScopes?: string[];
+    mfaCode?: string;
+    mfaBackupCode?: string;
+}
+interface PublicClientInfo {
+    clientId: string;
+    name: string;
+    description?: string;
+    isFirstParty: boolean;
+    /** Registered OAuth redirect URIs (not secret; used for hosted-login allowlisting). */
+    redirectUris: string[];
+}
+interface JwksDocument {
+    keys: JsonObject[];
+}
+interface InitRecoveryRequest {
+    clientId?: string;
+    recoveryType?: string;
+    redirectUri?: string;
+}
+interface PasswordResetRequestInput {
+    email?: string;
+    identifier?: string;
+    recoveryEmail?: string;
+    phoneNumber?: string;
+    memberId?: string;
+    securityQuestion?: string;
+    securityAnswer?: string;
+    redirectUri?: string;
+}
+interface PasswordResetRequestResult {
+    ok: boolean;
+    message: string;
+}
+interface PasswordResetValidationResult {
+    ok: boolean;
+    valid: boolean;
+    expiresAt?: string;
+}
+interface PasswordResetCompleteInput {
+    token: string;
+    password: string;
+    passwordConfirm: string;
+}
+interface PasswordResetCompleteResult {
+    ok: boolean;
+    message: string;
+}
+interface MfaSetupRequest {
+    deviceName: string;
+}
+interface MfaSetupResponse {
+    deviceId: string;
+    secret: string;
+    qrCodeUri: string;
+    backupCodes: string[];
+    algorithm: string;
+    digits: number;
+    period: number;
+}
+interface MfaVerifyRequest {
+    deviceId: string;
+    totpCode: string;
+}
+interface MfaDevice {
+    id: string;
+    deviceName: string;
+    isVerified: boolean;
+    isPrimary: boolean;
+    createdAt?: string;
+    lastUsedAt?: string;
+}
+interface MaintenanceStatus {
+    isActive: boolean;
+    message?: string;
+    scheduledStart?: string;
+    scheduledEnd?: string;
+    [key: string]: JsonValue | undefined;
+}
+interface ConsentRecord {
+    id: string;
+    clientId?: string;
+    clientName?: string;
+    scopes: string[];
+    isRevoked: boolean;
+    createdAt?: string;
+    updatedAt?: string;
+    [key: string]: JsonValue | undefined;
+}
+interface RecoveryContact {
+    id: string;
+    name?: string;
+    email?: string;
+    phoneNumber?: string;
+    relationship?: string;
+    isVerified?: boolean;
+    [key: string]: JsonValue | undefined;
+}
+interface UserIdentity {
+    id: string;
+    provider: string;
+    providerUserId?: string;
+    email?: string;
+    isPrimary?: boolean;
+    [key: string]: JsonValue | undefined;
+}
+interface AdminEntity {
+    id: string;
+    [key: string]: JsonValue | undefined;
+}
+interface ClientRecord extends AdminEntity {
+    clientId: string;
+    name: string;
+    description?: string;
+    isActive?: boolean;
+    isSystem?: boolean;
+}
+interface ScopeRecord extends AdminEntity {
+    name: string;
+    description?: string;
+    category?: string;
+}
+interface RoleRecord extends AdminEntity {
+    name: string;
+    slug: string;
+    description?: string;
+}
+interface PermissionRecord extends AdminEntity {
+    resource: string;
+    action: string;
+    description?: string;
+}
+interface OrganizationRecord extends AdminEntity {
+    name: string;
+    slug?: string;
+}
+interface AuditLogRecord extends AdminEntity {
+    action: string;
+    resourceType?: string;
+    resourceId?: string;
+    createdAt?: string;
+}
+interface WebhookRecord extends AdminEntity {
+    name: string;
+    url: string;
+    isActive?: boolean;
+}
+interface ClientListQuery extends PageQuery {
+    search?: string;
+    name?: string;
+    isActive?: boolean;
+    isDefault?: boolean;
+    createdAfter?: string;
+    createdBefore?: string;
+    sortBy?: string;
+    order?: "asc" | "desc";
+}
+interface UserListQuery extends PageQuery {
+    search?: string;
+    email?: string;
+    username?: string;
+    isActive?: boolean;
+    isVerified?: boolean;
+    mfaEnabled?: boolean;
+    createdAfter?: string;
+    createdBefore?: string;
+    sortBy?: string;
+    order?: "asc" | "desc";
+}
+interface RoleListQuery extends PageQuery {
+    search?: string;
+    name?: string;
+    slug?: string;
+    createdAfter?: string;
+    createdBefore?: string;
+    sortBy?: string;
+    order?: "asc" | "desc";
+}
+interface AuditLogListQuery extends PageQuery {
+    search?: string;
+    userId?: string;
+    organizationId?: string;
+    action?: string;
+    resourceType?: string;
+    status?: string;
+    createdAfter?: string;
+    createdBefore?: string;
+    sortBy?: string;
+    order?: "asc" | "desc";
+}
+interface ConsentListQuery extends PageQuery {
+    clientId?: string;
+    includeRevoked?: boolean;
+}
+interface DashboardRangeQuery {
+    range?: "7d" | "30d" | "90d";
+}
+interface PasswordResetEndpoints {
+    request(input: PasswordResetRequestInput): Promise<PasswordResetRequestResult>;
+    validate(token: string): Promise<PasswordResetValidationResult>;
+    complete(input: PasswordResetCompleteInput): Promise<PasswordResetCompleteResult>;
+}
+interface MfaEndpoints {
+    setup(input: MfaSetupRequest): Promise<MfaSetupResponse>;
+    verify(input: MfaVerifyRequest): Promise<JsonObject>;
+    devices(): Promise<MfaDevice[]>;
+    removeDevice(deviceId: string): Promise<void>;
+    regenerateBackupCodes(): Promise<{
+        backupCodes: string[];
+    }>;
+    disable(input?: {
+        password?: string;
+    }): Promise<void>;
+}
+interface MaintenanceEndpoints {
+    status(): Promise<MaintenanceStatus>;
+    enable(input?: JsonObject): Promise<MaintenanceStatus>;
+    disable(): Promise<MaintenanceStatus>;
+    schedule(input: JsonObject): Promise<JsonObject>;
+    listScheduled(): Promise<JsonObject[]>;
+}
+interface OAuthMetaEndpoints {
+    publicClient(clientId: string): Promise<PublicClientInfo>;
+    discoverAuthorizationServer(): Promise<OAuthAuthorizationServerMetadata>;
+}
+interface ConsentsEndpoints {
+    me: {
+        list(query?: ConsentListQuery): Promise<PageResponse<ConsentRecord>>;
+        get(id: string): Promise<ConsentRecord>;
+        create(input: JsonObject): Promise<ConsentRecord>;
+        update(id: string, input: JsonObject): Promise<ConsentRecord>;
+        revoke(id: string): Promise<void>;
+        stats(): Promise<JsonObject>;
+    };
+    list(query?: ConsentListQuery): Promise<PageResponse<ConsentRecord>>;
+    get(id: string): Promise<ConsentRecord>;
+    listForUser(userId: string, query?: ConsentListQuery): Promise<PageResponse<ConsentRecord>>;
+    listForClient(clientId: string, query?: ConsentListQuery): Promise<PageResponse<ConsentRecord>>;
+    revoke(id: string): Promise<void>;
+    stats(): Promise<JsonObject>;
+}
+interface ClientsEndpoints {
+    list(query?: ClientListQuery): Promise<PageResponse<ClientRecord>>;
+    create(input: JsonObject): Promise<ClientRecord>;
+    get(id: string): Promise<ClientRecord>;
+    update(id: string, input: JsonObject): Promise<ClientRecord>;
+    delete(id: string): Promise<void>;
+    regenerateSecret(id: string): Promise<JsonObject>;
+    assignScope(clientId: string, scopeId: string): Promise<void>;
+    removeScope(clientId: string, scopeId: string): Promise<void>;
+    stats(id: string, query?: DashboardRangeQuery): Promise<JsonObject>;
+    apiKeys: ClientApiKeysEndpoints;
+    providers: ClientProviderEndpoints;
+}
+interface ScopesEndpoints {
+    list(query?: PageQuery): Promise<PageResponse<ScopeRecord>>;
+    create(input: JsonObject): Promise<ScopeRecord>;
+    get(id: string): Promise<ScopeRecord>;
+    update(id: string, input: JsonObject): Promise<ScopeRecord>;
+    delete(id: string): Promise<void>;
+}
+interface RolesEndpoints {
+    list(query?: RoleListQuery): Promise<PageResponse<RoleRecord>>;
+    create(input: JsonObject): Promise<RoleRecord>;
+    get(id: string): Promise<RoleRecord>;
+    update(id: string, input: JsonObject): Promise<RoleRecord>;
+    delete(id: string): Promise<void>;
+    assignPermission(roleId: string, permissionId: string): Promise<void>;
+    removePermission(roleId: string, permissionId: string): Promise<void>;
+}
+interface PermissionsEndpoints {
+    list(query?: PageQuery): Promise<PageResponse<PermissionRecord>>;
+    create(input: JsonObject): Promise<PermissionRecord>;
+    get(id: string): Promise<PermissionRecord>;
+    update(id: string, input: JsonObject): Promise<PermissionRecord>;
+    delete(id: string): Promise<void>;
+}
+interface OrganizationsEndpoints {
+    list(query?: PageQuery): Promise<PageResponse<OrganizationRecord>>;
+    create(input: JsonObject): Promise<OrganizationRecord>;
+    get(id: string): Promise<OrganizationRecord>;
+    update(id: string, input: JsonObject): Promise<OrganizationRecord>;
+    delete(id: string): Promise<void>;
+}
+interface AuditLogsEndpoints {
+    list(query?: AuditLogListQuery): Promise<PageResponse<AuditLogRecord>>;
+    get(id: string): Promise<AuditLogRecord>;
+}
+interface DashboardEndpoints {
+    get(query?: DashboardRangeQuery): Promise<JsonObject>;
+    overview(query?: DashboardRangeQuery): Promise<JsonObject>;
+    timeSeries: {
+        registrations(query?: DashboardRangeQuery): Promise<JsonObject>;
+        logins(query?: DashboardRangeQuery): Promise<JsonObject>;
+        tokens(query?: DashboardRangeQuery): Promise<JsonObject>;
+        failures(query?: DashboardRangeQuery): Promise<JsonObject>;
+    };
+    distributions: {
+        devices(query?: DashboardRangeQuery): Promise<JsonObject>;
+        browsers(query?: DashboardRangeQuery): Promise<JsonObject>;
+        os(query?: DashboardRangeQuery): Promise<JsonObject>;
+        geography(query?: DashboardRangeQuery): Promise<JsonObject>;
+        grantTypes(query?: DashboardRangeQuery): Promise<JsonObject>;
+        mfa(query?: DashboardRangeQuery): Promise<JsonObject>;
+    };
+    security: {
+        summary(query?: DashboardRangeQuery): Promise<JsonObject>;
+    };
+    activity: {
+        recentLogins(query?: DashboardRangeQuery): Promise<JsonObject>;
+        recentSecurity(query?: DashboardRangeQuery): Promise<JsonObject>;
+    };
+}
+interface JwtKeysEndpoints {
+    list(query?: PageQuery): Promise<PageResponse<AdminEntity>>;
+    create(input: JsonObject): Promise<AdminEntity>;
+    get(id: string): Promise<AdminEntity>;
+    detail(id: string): Promise<JsonObject>;
+    update(id: string, input: JsonObject): Promise<AdminEntity>;
+    delete(id: string): Promise<void>;
+    rotate(): Promise<JsonObject>;
+}
+interface WebhooksEndpoints {
+    list(query?: PageQuery): Promise<PageResponse<WebhookRecord>>;
+    create(input: JsonObject): Promise<WebhookRecord>;
+    get(id: string): Promise<WebhookRecord>;
+    update(id: string, input: JsonObject): Promise<WebhookRecord>;
+    delete(id: string): Promise<void>;
+    deliveries(id: string, query?: PageQuery): Promise<PageResponse<JsonObject>>;
+    rotateSecret(id: string): Promise<JsonObject>;
+}
+interface CustomAttributesEndpoints {
+    list(query?: PageQuery): Promise<PageResponse<AdminEntity>>;
+    create(input: JsonObject): Promise<AdminEntity>;
+    get(id: string): Promise<AdminEntity>;
+    update(id: string, input: JsonObject): Promise<AdminEntity>;
+    delete(id: string): Promise<void>;
+}
+interface AuthMethodsEndpoints {
+    list(): Promise<JsonObject[]>;
+    enable(methodType: string, input: JsonObject): Promise<JsonObject>;
+    update(methodType: string, input: JsonObject): Promise<JsonObject>;
+    disable(methodType: string): Promise<void>;
+}
+interface AuthenticationFlowsAdminEndpoints {
+    list(query?: PageQuery): Promise<PageResponse<AdminEntity>>;
+    create(input: JsonObject): Promise<AdminEntity>;
+    get(id: string): Promise<AdminEntity>;
+    update(id: string, input: JsonObject): Promise<AdminEntity>;
+    delete(id: string): Promise<void>;
+    addStep(flowId: string, input: JsonObject): Promise<JsonObject>;
+    updateStep(flowId: string, stepId: string, input: JsonObject): Promise<JsonObject>;
+    deleteStep(flowId: string, stepId: string): Promise<void>;
+}
+interface UsersAdminEndpoints {
+    list(query?: UserListQuery): Promise<PageResponse<AdminEntity>>;
+    create(input: JsonObject): Promise<AdminEntity>;
+    get(id: string): Promise<AdminEntity>;
+    update(id: string, input: JsonObject): Promise<AdminEntity>;
+    delete(id: string): Promise<void>;
+    assignRole(userId: string, roleId: string): Promise<void>;
+    removeRole(userId: string, roleId: string): Promise<void>;
+    setPassword(userId: string, input: JsonObject): Promise<JsonObject>;
+    resetMfa(userId: string): Promise<JsonObject>;
+    getMfaDevices(userId: string): Promise<MfaDevice[]>;
+    getWebAuthnCredentials(userId: string): Promise<unknown[]>;
+}
+interface CommsEndpoints {
+    smsProviders: {
+        list(query?: PageQuery): Promise<PageResponse<AdminEntity>>;
+        create(input: JsonObject): Promise<AdminEntity>;
+        get(id: string): Promise<AdminEntity>;
+        update(id: string, input: JsonObject): Promise<AdminEntity>;
+        delete(id: string): Promise<void>;
+        test(id: string, input?: JsonObject): Promise<JsonObject>;
+    };
+    emailProviders: {
+        list(query?: PageQuery): Promise<PageResponse<AdminEntity>>;
+        create(input: JsonObject): Promise<AdminEntity>;
+        get(id: string): Promise<AdminEntity>;
+        update(id: string, input: JsonObject): Promise<AdminEntity>;
+        delete(id: string): Promise<void>;
+        test(id: string, input?: JsonObject): Promise<JsonObject>;
+    };
+    emailTemplates: {
+        list(query?: PageQuery): Promise<PageResponse<AdminEntity>>;
+        create(input: JsonObject): Promise<AdminEntity>;
+        get(id: string): Promise<AdminEntity>;
+        update(id: string, input: JsonObject): Promise<AdminEntity>;
+        delete(id: string): Promise<void>;
+        types(): Promise<JsonObject[]>;
+        preview(id: string, input?: JsonObject): Promise<JsonObject>;
+    };
+    smsLogs: {
+        list(query?: PageQuery): Promise<PageResponse<AdminEntity>>;
+        get(id: string): Promise<AdminEntity>;
+    };
+    systemSmsProviders: {
+        list(query?: PageQuery): Promise<PageResponse<AdminEntity>>;
+        create(input: JsonObject): Promise<AdminEntity>;
+        get(id: string): Promise<AdminEntity>;
+        update(id: string, input: JsonObject): Promise<AdminEntity>;
+        delete(id: string): Promise<void>;
+        test(id: string, input?: JsonObject): Promise<JsonObject>;
+    };
+    testPhones: {
+        list(query?: PageQuery): Promise<PageResponse<AdminEntity>>;
+        create(input: JsonObject): Promise<AdminEntity>;
+        update(id: string, input: JsonObject): Promise<AdminEntity>;
+        delete(id: string): Promise<void>;
+    };
+}
+
+/** Public maintenance probe — status only (no admin schedule/enable APIs). */
+interface ConsumerMaintenanceEndpoints {
+    status(): Promise<MaintenanceStatus>;
+}
+/** Self-service user profile APIs without admin user-management helpers. */
+type ConsumerUserEndpoints = Omit<UserEndpoints, "admin">;
+/** OAuth/OIDC consumer client surface shipped on public npmjs. */
+interface ConsumerAuthClient {
+    token: TokenEndpoints;
+    flow: FlowEndpoints;
+    oidc: OidcEndpoints;
+    authorize: AuthorizeEndpoints;
+    user: ConsumerUserEndpoints;
+    sessions: SessionEndpoints;
+    webauthn: WebAuthnEndpoints;
+    passwordReset: PasswordResetEndpoints;
+    mfa: MfaEndpoints;
+    maintenance: ConsumerMaintenanceEndpoints;
+    oauth: OAuthMetaEndpoints;
+    tokens: TokenStateEndpoints;
+}
+
+/** JSON primitive value type. */
+type JsonPrimitive = string | number | boolean | null;
+/** JSON value type used in extensible payloads. */
+type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
+/** JSON object type used in extensible payloads. */
+type JsonObject = {
+    [key: string]: JsonValue;
+};
+/**
+ * A single RFC 9396 (Rich Authorization Requests) authorization detail object.
+ * `type` is required and identifies the detail type; all other members
+ * (`locations`, `actions`, `datatypes`, `identifier`, `privileges`, and any
+ * type-specific fields) are open-ended.
+ */
+interface AuthorizationDetail {
+    type: string;
+    locations?: string[];
+    actions?: string[];
+    datatypes?: string[];
+    identifier?: string;
+    privileges?: string[];
+    [key: string]: JsonValue | undefined;
+}
+/** Canonical token shape used by SDK storage and endpoint wrappers. */
+interface AuthTokens {
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    refreshToken?: string;
+    scope?: string;
+    idToken?: string;
+    /** RFC 9396 granted authorization details, when returned by the server. */
+    authorizationDetails?: AuthorizationDetail[];
+}
+/**
+ * Pluggable token persistence contract.
+ *
+ * Implementations must:
+ * - Never log token values.
+ * - Validate payloads on read and write (use `assertValidAuthTokens` / `parseStoredAuthTokens`).
+ * - Prefer hardware-backed or server-side storage for refresh tokens in production.
+ * - Clear state on unrecoverable auth errors (the client calls `clear()` via `fetchWithAuth`).
+ */
+interface TokenStorage {
+    get(): Promise<AuthTokens | null> | AuthTokens | null;
+    set(tokens: AuthTokens | null): Promise<void> | void;
+    clear(): Promise<void> | void;
+}
+/** Client factory configuration. */
+interface AuthClientConfig {
+    clientId: string;
+    clientSecret?: string;
+    baseUrl?: string;
+    fetch?: typeof globalThis.fetch;
+    storage?: TokenStorage;
+    timeoutMs?: number;
+    defaultHeaders?: Record<string, string>;
+    autoRefresh?: boolean;
+    allowClientSecretInBrowser?: boolean;
+    /**
+     * Permits `http://` base URLs outside loopback hosts. Default `false`.
+     * Use only for trusted local integration tests — never in production.
+     */
+    allowInsecureTransport?: boolean;
+}
+/** Resource owner password token request. */
+interface PasswordTokenRequest {
+    username?: string;
+    email?: string;
+    password: string;
+    scope?: string;
+    mfaCode?: string;
+    mfaBackupCode?: string;
+}
+/** Refresh token request. */
+interface RefreshTokenRequest {
+    refreshToken?: string;
+    scope?: string;
+}
+/** Client credentials request. */
+interface ClientCredentialsRequest {
+    scope?: string;
+}
+/** Authorization code token exchange request (with optional PKCE). */
+interface AuthorizationCodeTokenRequest {
+    code: string;
+    redirectUri: string;
+    codeVerifier?: string;
+    scope?: string;
+}
+/** Options for building an authorization-code + PKCE redirect request. */
+interface AuthorizationUrlOptions {
+    /** Absolute redirect URI registered for this client. */
+    redirectUri: string;
+    /** Space-delimited scopes. Defaults to `openid profile email offline_access`. */
+    scope?: string;
+    /** Pre-generated `state`; one is generated (CSPRNG) when omitted. */
+    state?: string;
+    /** Pre-generated `nonce`; one is generated (CSPRNG) when omitted. */
+    nonce?: string;
+    /** PKCE challenge method. Defaults to `S256`. */
+    codeChallengeMethod?: "S256" | "plain";
+    /** OIDC `prompt` parameter (e.g. `login`, `none`, `consent`). */
+    prompt?: string;
+    /** OIDC `login_hint` to prefill the identifier. */
+    loginHint?: string;
+    /** OAuth `response_type`. Defaults to `code`. */
+    responseType?: string;
+    /** Override the authorization endpoint (defaults to `{baseUrl}/oauth/authorize`). */
+    authorizationEndpoint?: string;
+    /** RFC 9396 rich authorization details to request (serialized as JSON). */
+    authorizationDetails?: AuthorizationDetail[];
+    /**
+     * RFC 9126 pushed-request reference. When set, the SDK builds a slim
+     * authorization URL carrying only `client_id` and `request_uri`.
+     */
+    requestUri?: string;
+    /** Additional non-standard query parameters to append. */
+    extraParams?: Record<string, string>;
+}
+/**
+ * Everything produced when starting an auth-code flow. The caller MUST persist
+ * `state`, `nonce`, `codeVerifier`, and `redirectUri` (e.g. in an httpOnly
+ * cookie or server session) and replay them when handling the callback.
+ */
+interface AuthorizationRequest {
+    /** Fully-formed authorization URL to redirect the user agent to. */
+    url: string;
+    /** CSRF anti-forgery token; verify on callback. */
+    state: string;
+    /** OIDC nonce; bind to the returned ID token. */
+    nonce: string;
+    /** PKCE verifier; required at token exchange. Treat as a secret. */
+    codeVerifier: string;
+    /** PKCE challenge that was sent in the URL. */
+    codeChallenge: string;
+    /** Redirect URI echoed at token exchange. */
+    redirectUri: string;
+    /** Resolved scope string. */
+    scope: string;
+    /** RFC 9126 request_uri, present only when the request was pushed via PAR. */
+    requestUri?: string;
+}
+/** Options for pushing an authorization request (RFC 9126). */
+interface PushAuthorizationRequestOptions extends AuthorizationUrlOptions {
+}
+/** Result of a successful pushed authorization request (RFC 9126). */
+interface PushedAuthorizationResult {
+    /** The `urn:ietf:params:oauth:request_uri:...` reference. */
+    requestUri: string;
+    /** Lifetime of the request_uri in seconds. */
+    expiresIn: number;
+    /** The persisted request artefacts (state/nonce/codeVerifier) to replay on callback. */
+    request: AuthorizationRequest;
+}
+/** Result of probing `GET /oauth/authorize` with `redirect: manual`. */
+interface AuthorizationProbeResult {
+    kind: "redirect" | "json";
+    status: number;
+    location?: string;
+    authorizationUrl?: string;
+    payload?: JsonObject;
+}
+/** Parsed authorization-server redirect callback parameters. */
+interface CallbackParams {
+    code?: string;
+    state?: string;
+    error?: string;
+    errorDescription?: string;
+    errorUri?: string;
+    /** Any additional parameters present on the callback URL. */
+    raw: Record<string, string>;
+}
+/** Options for the one-call callback handler that validates state and exchanges the code. */
+interface HandleCallbackOptions {
+    /** The callback URL, its query string, or pre-parsed params. */
+    callback: string | URLSearchParams | Record<string, string> | CallbackParams;
+    /** The `state` issued in {@link AuthorizationRequest}; verified constant-time. */
+    expectedState: string;
+    /** The PKCE verifier issued in {@link AuthorizationRequest}. */
+    codeVerifier: string;
+    /** The redirect URI issued in {@link AuthorizationRequest}. */
+    redirectUri: string;
+    /** Optional scope override forwarded to the token exchange. */
+    scope?: string;
+}
+/** OIDC discovery document (`/.well-known/openid-configuration`), camelCased subset. */
+interface OidcDiscoveryDocument {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userinfoEndpoint?: string;
+    jwksUri: string;
+    revocationEndpoint?: string;
+    introspectionEndpoint?: string;
+    responseTypesSupported: string[];
+    grantTypesSupported?: string[];
+    scopesSupported?: string[];
+    codeChallengeMethodsSupported?: string[];
+    /** Raw, unmapped document for fields not surfaced above. */
+    raw: JsonObject;
+}
+/** Token revocation request. */
+interface RevokeTokenRequest {
+    token?: string;
+    tokenTypeHint?: "access_token" | "refresh_token";
+}
+/** Token introspection request. */
+interface IntrospectTokenRequest {
+    token: string;
+}
+/** Token introspection response. */
+interface TokenIntrospectionResponse {
+    active: boolean;
+    scope?: string;
+    clientId?: string;
+    username?: string;
+    tokenType?: string;
+    exp?: number;
+    iat?: number;
+    sub?: string;
+    /** RFC 9396 authorization details associated with the token. */
+    authorizationDetails?: AuthorizationDetail[];
+}
+/** Individual form field definition required for a flow step. */
+interface StepInputField {
+    name: string;
+    type: string;
+    required: boolean;
+    description: string;
+    sensitive: boolean;
+}
+/** Input schema definition for a flow step. */
+interface StepInputSchema {
+    fields: StepInputField[];
+}
+/** Authentication or registration flow step metadata. */
+interface FlowStep {
+    stepId: string;
+    stepType: string;
+    name: string;
+    description?: string;
+    order: number;
+    isRequired: boolean;
+    timeout: number;
+    inputSchema?: StepInputSchema;
+}
+/** Auth flow initialization request. */
+interface InitAuthenticationRequest {
+    clientId?: string;
+    username?: string;
+    flowType?: string;
+}
+/** Registration flow initialization request. */
+interface InitRegistrationRequest {
+    clientId?: string;
+    inviteCode?: string;
+    /** e.g. `phone_registration` for phone OTP signup flows. */
+    flowType?: string;
+}
+/** Shared response for auth/registration flow initialization. */
+interface FlowInitResponse {
+    sessionId: string;
+    flowId: string;
+    flowName: string;
+    currentStep: FlowStep;
+    remainingSteps: FlowStep[];
+    expiresAt: string;
+    /**
+     * One-time plaintext continuation token (Q-022). Clients must store it and
+     * send it on every subsequent step / status poll — session_id alone is not enough.
+     */
+    continuationToken: string;
+}
+/** Execute current flow step request. */
+interface ExecuteStepRequest {
+    sessionId: string;
+    stepId: string;
+    credential: Record<string, string>;
+    /** Required continuation token from {@link FlowInitResponse.continuationToken}. */
+    continuationToken: string;
+}
+/** Flow step response when additional steps are still required. */
+interface FlowStepInProgressResult {
+    status: "in_progress";
+    sessionId: string;
+    nextStep: FlowStep;
+    completedSteps: string[];
+    remainingSteps: FlowStep[];
+    /** Server debug payload (e.g. OTP code in non-prod). Never expose to browsers unless gated. */
+    debug?: Record<string, unknown>;
+}
+/** Flow step response when authentication is complete and tokens are issued. */
+interface FlowStepCompleteResult {
+    status: "complete";
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: string;
+    expiresIn: number;
+    scope?: string;
+    amr: string[];
+    acr: string;
+}
+/** Discriminated union of flow step execution outcomes. */
+type FlowStepResult = FlowStepInProgressResult | FlowStepCompleteResult;
+/** Full flow session status payload. */
+interface FlowSessionStatus {
+    sessionId: string;
+    status: string;
+    purpose: string;
+    currentStep?: FlowStep;
+    completedSteps: string[];
+    remainingSteps: FlowStep[];
+    failedAttempts: number;
+    expiresAt: string;
+    lastActivityAt: string;
+}
+/** Standard page metadata. */
+interface PageQuery {
+    page?: number;
+    perPage?: number;
+}
+/** Standard page metadata. */
+interface PageMetadata {
+    page: number;
+    per: number;
+    total: number;
+}
+/** Standard paginated response. */
+interface PageResponse<T> {
+    items: T[];
+    metadata: PageMetadata;
+}
+
+/** Session list item. */
+interface SessionSummary {
+    id: string;
+    deviceName?: string;
+    deviceType: string;
+    browser?: string;
+    os?: string;
+    ipAddress: string;
+    country?: string;
+    city?: string;
+    isActive: boolean;
+    isCurrent: boolean;
+    isTrusted: boolean;
+    lastUsedAt?: string;
+    createdAt?: string;
+}
+/** Session detail payload. */
+interface SessionDetail {
+    id: string;
+    deviceId?: string;
+    deviceName?: string;
+    deviceType: string;
+    userAgent?: string;
+    browser?: string;
+    browserVersion?: string;
+    os?: string;
+    osVersion?: string;
+    ipAddress: string;
+    country?: string;
+    city?: string;
+    isActive: boolean;
+    isRevoked: boolean;
+    isCurrent: boolean;
+    isTrusted: boolean;
+    requiresMfa: boolean;
+    accessTokenCount: number;
+    lastUsedAt?: string;
+    expiresAt?: string;
+    createdAt?: string;
+    revokedAt?: string;
+    revocationReason?: string;
+}
+/** Session update payload. */
+interface UpdateSessionRequest {
+    deviceName?: string;
+    isTrusted?: boolean;
+}
+/** Optional reason payload used during session revocation. */
+interface RevokeSessionRequest {
+    reason?: string;
+}
+/** Session/token revocation summary. */
+interface RevocationResponse {
+    success: boolean;
+    sessionsRevoked: number;
+    tokensRevoked: number;
+}
+/** Current user profile payload from `/api/v1/users/me`. */
+interface UserProfile {
+    id: string;
+    organizationId?: string;
+    email?: string;
+    username?: string;
+    firstName?: string;
+    lastName?: string;
+    isActive?: boolean;
+    isVerified?: boolean;
+    mfaEnabled?: boolean;
+    [key: string]: JsonValue | undefined;
+}
+/** OIDC UserInfo response payload. */
+interface UserInfoResponse {
+    sub: string;
+    name?: string;
+    givenName?: string;
+    familyName?: string;
+    middleName?: string;
+    nickname?: string;
+    preferredUsername?: string;
+    profile?: string;
+    picture?: string;
+    website?: string;
+    gender?: string;
+    birthdate?: string;
+    zoneinfo?: string;
+    locale?: string;
+    updatedAt?: number;
+    email?: string;
+    emailVerified?: boolean;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    [key: string]: JsonValue | undefined;
+}
+/** WebAuthn endpoint wrappers (browser ceremony intentionally out-of-scope). */
+interface WebAuthnEndpoints {
+    registerBegin(payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
+    registerFinish(payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
+    authenticateBegin(payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
+    authenticateFinish(payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
+    credentials(): Promise<Record<string, JsonValue>>;
+    removeCredential(credentialId: string, input?: {
+        password?: string;
+    }): Promise<void>;
+    renameCredential(credentialId: string, payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
+    setPrimaryCredential(credentialId: string): Promise<Record<string, JsonValue>>;
+}
+/** OAuth token endpoint wrappers. */
+interface TokenEndpoints {
+    password(input: PasswordTokenRequest): Promise<AuthTokens>;
+    refresh(input?: RefreshTokenRequest): Promise<AuthTokens>;
+    clientCredentials(input?: ClientCredentialsRequest): Promise<AuthTokens>;
+    authorizationCode(input: AuthorizationCodeTokenRequest): Promise<AuthTokens>;
+    tokenExchange(input: TokenExchangeRequest): Promise<AuthTokens>;
+    revoke(input?: RevokeTokenRequest): Promise<void>;
+    introspect(input: IntrospectTokenRequest): Promise<TokenIntrospectionResponse>;
+}
+/** Authentication and registration flow endpoint wrappers. */
+interface FlowEndpoints {
+    initAuthentication(input?: InitAuthenticationRequest): Promise<FlowInitResponse>;
+    executeStep(input: ExecuteStepRequest): Promise<FlowStepResult>;
+    initRegistration(input?: InitRegistrationRequest): Promise<FlowInitResponse>;
+    executeRegistrationStep(input: ExecuteStepRequest): Promise<FlowStepResult>;
+    initRecovery(input?: InitRecoveryRequest): Promise<FlowInitResponse>;
+    executeRecoveryStep(input: ExecuteStepRequest): Promise<FlowStepResult>;
+    /**
+     * Poll flow session status. `continuationToken` is required by the server
+     * (Q-022); omitting it yields 400.
+     */
+    getStatus(sessionId: string, continuationToken: string): Promise<FlowSessionStatus>;
+}
+/** OIDC endpoint wrappers. */
+interface OidcEndpoints {
+    userInfo(): Promise<UserInfoResponse>;
+    discover(): Promise<OidcDiscoveryDocument>;
+    jwks(): Promise<JwksDocument>;
+}
+/**
+ * Authorization-code + PKCE redirect-flow helpers. This is the high-level
+ * surface that removes per-app duplication of PKCE/state/URL plumbing.
+ */
+interface AuthorizeEndpoints {
+    createRequest(options: AuthorizationUrlOptions): Promise<AuthorizationRequest>;
+    /**
+     * RFC 9126: push the authorization request to the server and return a
+     * one-time `request_uri` plus a slim authorization `request` referencing it.
+     */
+    pushAuthorizationRequest(options: PushAuthorizationRequestOptions): Promise<PushedAuthorizationResult>;
+    parseCallback(input: string | URLSearchParams | Record<string, string>): CallbackParams;
+    handleCallback(options: HandleCallbackOptions): Promise<AuthTokens>;
+    consent(callbackUrl: string, body: AuthorizationConsentBody): Promise<AuthorizationConsentResponse>;
+    consentWithCredentials(options: ConsentWithCredentialsOptions): Promise<AuthorizationConsentResponse>;
+    evaluateConsent(callbackUrl: string, body: AuthorizationConsentEvaluateBody): Promise<AuthorizationConsentEvaluateResponse>;
+    evaluateConsentWithCredentials(options: EvaluateConsentWithCredentialsOptions): Promise<AuthorizationConsentEvaluateResponse>;
+    probeAuthorize(url: string): Promise<AuthorizationProbeResult>;
+}
+/** Current-user endpoint wrappers. */
+interface UserEndpoints {
+    me(): Promise<UserProfile>;
+    updateMe(input: JsonObject): Promise<UserProfile>;
+    changePassword(input: {
+        currentPassword: string;
+        newPassword: string;
+    }): Promise<void>;
+    uploadAvatar(file: Blob | Buffer, filename?: string): Promise<UserProfile>;
+    deleteAvatar(): Promise<UserProfile>;
+    verifyPhone(input: JsonObject): Promise<JsonObject>;
+    verifyRecoveryEmail(input: JsonObject): Promise<JsonObject>;
+    securityOverview(): Promise<JsonObject>;
+    recoveryContacts: {
+        list(): Promise<RecoveryContact[]>;
+        create(input: JsonObject): Promise<RecoveryContact>;
+        update(contactId: string, input: JsonObject): Promise<RecoveryContact>;
+        delete(contactId: string): Promise<void>;
+    };
+    identities: {
+        list(): Promise<UserIdentity[]>;
+        unlink(identityId: string): Promise<void>;
+        setPrimary(identityId: string): Promise<JsonObject>;
+    };
+    deleteMe(input: {
+        password: string;
+    }): Promise<void>;
+    admin: UsersAdminEndpoints;
+}
+/** Session list query parameters. */
+interface SessionListQuery {
+    page?: number;
+    perPage?: number;
+    userId?: string;
+}
+/** Session management endpoint wrappers. */
+interface SessionEndpoints {
+    list(input?: SessionListQuery): Promise<PageResponse<SessionSummary>>;
+    current(): Promise<SessionDetail>;
+    get(id: string): Promise<SessionDetail>;
+    update(id: string, input: UpdateSessionRequest): Promise<SessionDetail>;
+    revoke(id: string, input?: RevokeSessionRequest): Promise<RevocationResponse>;
+    revokeAll(): Promise<RevocationResponse>;
+    revokeAllDevices(): Promise<RevocationResponse>;
+}
+/** Token state helper endpoints for direct storage access. */
+interface TokenStateEndpoints {
+    get(): Promise<AuthTokens | null>;
+    set(tokens: AuthTokens | null): Promise<void>;
+    clear(): Promise<void>;
+}
+/** Fully composed SDK client surface (internal / GitHub Packages build). */
+interface AuthClient extends ConsumerAuthClient {
+    user: UserEndpoints;
+    maintenance: MaintenanceEndpoints;
+    consents: ConsentsEndpoints;
+    clients: ClientsEndpoints;
+    scopes: ScopesEndpoints;
+    roles: RolesEndpoints;
+    permissions: PermissionsEndpoints;
+    organizations: OrganizationsEndpoints;
+    auditLogs: AuditLogsEndpoints;
+    dashboard: DashboardEndpoints;
+    jwtKeys: JwtKeysEndpoints;
+    webhooks: WebhooksEndpoints;
+    customAttributes: CustomAttributesEndpoints;
+    authMethods: AuthMethodsEndpoints;
+    authenticationFlows: AuthenticationFlowsAdminEndpoints;
+    comms: CommsEndpoints;
+    memberDirectory: MemberDirectoryEndpoints;
+    federated: FederatedEndpoints;
+    families: FamiliesEndpoints;
+    dependents: DependentsEndpoints;
+    privacy: PrivacyEndpoints;
+    fetchWithAuth(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    /**
+     * Low-level escape hatch: issue a request to an arbitrary path on the
+     * configured auth server through the SDK's HTTP client (baseUrl resolution,
+     * default headers, timeout, and RFC-style error normalization), returning the
+     * parsed JSON body unmodified. Use for transparent passthrough/proxy endpoints
+     * that must preserve the server's raw response shape rather than a mapped one.
+     * Throws `AuthError` on non-2xx responses.
+     */
+    request<T = unknown>(path: string, options?: ApiRequestOptions): Promise<T>;
+}
+/** Options for the generic {@link AuthClient.request} escape hatch. */
+interface ApiRequestOptions {
+    method?: string;
+    headers?: Record<string, string>;
+    /** JSON-serializable body (objects are sent as `application/json`). */
+    body?: unknown;
+    /** Bearer token to attach for authenticated passthrough calls. */
+    token?: string;
+}
+
+/**
+ * Creates in-memory token storage suitable for Node, edge, and browser runtimes.
+ *
+ * Tokens are not encrypted and do not survive process restarts. This is the
+ * default and the recommended choice for server-side clients (SSR routes,
+ * workers) where persistence belongs in HttpOnly cookies or a server session.
+ */
+declare function createMemoryTokenStorage(): TokenStorage;
+
+export { type TokenStorage as $, type AuthClientConfig as A, type OidcEndpoints as B, type ConsumerAuthClient as C, type PageResponse as D, type ExecuteStepRequest as E, type FlowEndpoints as F, type PasswordResetEndpoints as G, type HandleCallbackOptions as H, type InitAuthenticationRequest as I, type PasswordTokenRequest as J, type PublicClientInfo as K, type PushAuthorizationRequestOptions as L, type MaintenanceStatus as M, type PushedAuthorizationResult as N, type OAuthAuthorizationServerMetadata as O, type PageQuery as P, type RevocationResponse as Q, type RefreshTokenRequest as R, type RevokeSessionRequest as S, type RevokeTokenRequest as T, type SessionDetail as U, type SessionEndpoints as V, type SessionListQuery as W, type SessionSummary as X, type TokenEndpoints as Y, type TokenExchangeRequest as Z, type TokenIntrospectionResponse as _, type AuthClient as a, type UpdateSessionRequest as a0, type UserEndpoints as a1, type UserInfoResponse as a2, type UserProfile as a3, type WebAuthnEndpoints as a4, createMemoryTokenStorage as a5, type AuthTokens as b, type AuthorizationCodeTokenRequest as c, type AuthorizationConsentBody as d, type AuthorizationConsentResponse as e, type AuthorizationDetail as f, type AuthorizationProbeResult as g, type AuthorizationRequest as h, type AuthorizationUrlOptions as i, type AuthorizeEndpoints as j, type CallbackParams as k, type ClientCredentialsRequest as l, type ConsumerMaintenanceEndpoints as m, type ConsumerUserEndpoints as n, type FlowInitResponse as o, type FlowSessionStatus as p, type FlowStep as q, type FlowStepCompleteResult as r, type FlowStepInProgressResult as s, type FlowStepResult as t, type InitRegistrationRequest as u, type IntrospectTokenRequest as v, type MfaDevice as w, type MfaEndpoints as x, type OAuthMetaEndpoints as y, type OidcDiscoveryDocument as z };