@tktchurch/auth 0.9.1 → 0.9.6

package/dist/memory-CVWZvsJ0.d.cts

@@ -1,730 +0,0 @@
-interface OAuthAuthorizationServerMetadata {
-    issuer: string;
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    jwksUri?: string;
-    revocationEndpoint?: string;
-    introspectionEndpoint?: string;
-    registrationEndpoint?: string;
-    scopesSupported?: string[];
-    responseTypesSupported: string[];
-    grantTypesSupported?: string[];
-    codeChallengeMethodsSupported?: string[];
-    /** RFC 9126 pushed authorization request endpoint. */
-    pushedAuthorizationRequestEndpoint?: string;
-    /** RFC 9126: whether the server requires PAR. */
-    requirePushedAuthorizationRequests?: boolean;
-    /** RFC 9396 supported authorization details types. */
-    authorizationDetailsTypesSupported?: string[];
-    raw: JsonObject;
-}
-interface TokenExchangeRequest {
-    subjectToken: string;
-    subjectTokenType?: string;
-    requestedSubject: string;
-    scope?: string;
-    audience?: string;
-}
-interface AuthorizationConsentBody {
-    username: string;
-    password: string;
-    approved?: boolean;
-    requestedScopes?: string[];
-    mfaCode?: string;
-    mfaBackupCode?: string;
-}
-interface AuthorizationConsentResponse {
-    redirectUri: string;
-    code?: string;
-    state?: string;
-    error?: string;
-    errorDescription?: string;
-    mfaMethods?: string[];
-    accessToken?: string;
-    tokenType?: string;
-    expiresIn?: number;
-    scope?: string;
-    idToken?: string;
-}
-interface ConsentWithCredentialsOptions {
-    callbackUrl: string;
-    username: string;
-    password: string;
-    approved?: boolean;
-    requestedScopes?: string[];
-    mfaCode?: string;
-    mfaBackupCode?: string;
-}
-interface PublicClientInfo {
-    clientId: string;
-    name: string;
-    description?: string;
-    isFirstParty: boolean;
-}
-interface JwksDocument {
-    keys: JsonObject[];
-}
-interface InitRecoveryRequest {
-    clientId?: string;
-    recoveryType?: string;
-    redirectUri?: string;
-}
-interface PasswordResetRequestInput {
-    email?: string;
-    identifier?: string;
-    recoveryEmail?: string;
-    phoneNumber?: string;
-    memberId?: string;
-    securityQuestion?: string;
-    securityAnswer?: string;
-    redirectUri?: string;
-}
-interface PasswordResetRequestResult {
-    ok: boolean;
-    message: string;
-}
-interface PasswordResetValidationResult {
-    ok: boolean;
-    valid: boolean;
-    expiresAt?: string;
-}
-interface PasswordResetCompleteInput {
-    token: string;
-    password: string;
-    passwordConfirm: string;
-}
-interface PasswordResetCompleteResult {
-    ok: boolean;
-    message: string;
-}
-interface MfaSetupRequest {
-    deviceName: string;
-}
-interface MfaSetupResponse {
-    deviceId: string;
-    secret: string;
-    qrCodeUri: string;
-    backupCodes: string[];
-    algorithm: string;
-    digits: number;
-    period: number;
-}
-interface MfaVerifyRequest {
-    deviceId: string;
-    totpCode: string;
-}
-interface MfaDevice {
-    id: string;
-    deviceName: string;
-    isVerified: boolean;
-    isPrimary: boolean;
-    createdAt?: string;
-    lastUsedAt?: string;
-}
-interface MaintenanceStatus {
-    isActive: boolean;
-    message?: string;
-    scheduledStart?: string;
-    scheduledEnd?: string;
-    [key: string]: JsonValue | undefined;
-}
-interface RecoveryContact {
-    id: string;
-    name?: string;
-    email?: string;
-    phoneNumber?: string;
-    relationship?: string;
-    isVerified?: boolean;
-    [key: string]: JsonValue | undefined;
-}
-interface UserIdentity {
-    id: string;
-    provider: string;
-    providerUserId?: string;
-    email?: string;
-    isPrimary?: boolean;
-    [key: string]: JsonValue | undefined;
-}
-interface AdminEntity {
-    id: string;
-    [key: string]: JsonValue | undefined;
-}
-interface UserListQuery extends PageQuery {
-    search?: string;
-    email?: string;
-    username?: string;
-    isActive?: boolean;
-    isVerified?: boolean;
-    mfaEnabled?: boolean;
-    createdAfter?: string;
-    createdBefore?: string;
-    sortBy?: string;
-    order?: "asc" | "desc";
-}
-interface PasswordResetEndpoints {
-    request(input: PasswordResetRequestInput): Promise<PasswordResetRequestResult>;
-    validate(token: string): Promise<PasswordResetValidationResult>;
-    complete(input: PasswordResetCompleteInput): Promise<PasswordResetCompleteResult>;
-}
-interface MfaEndpoints {
-    setup(input: MfaSetupRequest): Promise<MfaSetupResponse>;
-    verify(input: MfaVerifyRequest): Promise<JsonObject>;
-    devices(): Promise<MfaDevice[]>;
-    removeDevice(deviceId: string): Promise<void>;
-    regenerateBackupCodes(): Promise<{
-        backupCodes: string[];
-    }>;
-    disable(input?: {
-        password?: string;
-    }): Promise<void>;
-}
-interface OAuthMetaEndpoints {
-    publicClient(clientId: string): Promise<PublicClientInfo>;
-    discoverAuthorizationServer(): Promise<OAuthAuthorizationServerMetadata>;
-}
-interface UsersAdminEndpoints {
-    list(query?: UserListQuery): Promise<PageResponse<AdminEntity>>;
-    create(input: JsonObject): Promise<AdminEntity>;
-    get(id: string): Promise<AdminEntity>;
-    update(id: string, input: JsonObject): Promise<AdminEntity>;
-    delete(id: string): Promise<void>;
-    assignRole(userId: string, roleId: string): Promise<void>;
-    removeRole(userId: string, roleId: string): Promise<void>;
-    setPassword(userId: string, input: JsonObject): Promise<JsonObject>;
-    resetMfa(userId: string): Promise<JsonObject>;
-    getMfaDevices(userId: string): Promise<MfaDevice[]>;
-    getWebAuthnCredentials(userId: string): Promise<unknown[]>;
-}
-
-/** JSON primitive value type. */
-type JsonPrimitive = string | number | boolean | null;
-/** JSON value type used in extensible payloads. */
-type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
-/** JSON object type used in extensible payloads. */
-type JsonObject = {
-    [key: string]: JsonValue;
-};
-/**
- * A single RFC 9396 (Rich Authorization Requests) authorization detail object.
- * `type` is required and identifies the detail type; all other members
- * (`locations`, `actions`, `datatypes`, `identifier`, `privileges`, and any
- * type-specific fields) are open-ended.
- */
-interface AuthorizationDetail {
-    type: string;
-    locations?: string[];
-    actions?: string[];
-    datatypes?: string[];
-    identifier?: string;
-    privileges?: string[];
-    [key: string]: JsonValue | undefined;
-}
-/** Canonical token shape used by SDK storage and endpoint wrappers. */
-interface AuthTokens {
-    accessToken: string;
-    tokenType: string;
-    expiresIn: number;
-    refreshToken?: string;
-    scope?: string;
-    idToken?: string;
-    /** RFC 9396 granted authorization details, when returned by the server. */
-    authorizationDetails?: AuthorizationDetail[];
-}
-/**
- * Pluggable token persistence contract.
- *
- * Implementations must:
- * - Never log token values.
- * - Validate payloads on read and write (use `assertValidAuthTokens` / `parseStoredAuthTokens`).
- * - Prefer hardware-backed or server-side storage for refresh tokens in production.
- * - Clear state on unrecoverable auth errors (the client calls `clear()` via `fetchWithAuth`).
- */
-interface TokenStorage {
-    get(): Promise<AuthTokens | null> | AuthTokens | null;
-    set(tokens: AuthTokens | null): Promise<void> | void;
-    clear(): Promise<void> | void;
-}
-/** Client factory configuration. */
-interface AuthClientConfig {
-    clientId: string;
-    clientSecret?: string;
-    baseUrl?: string;
-    fetch?: typeof globalThis.fetch;
-    storage?: TokenStorage;
-    timeoutMs?: number;
-    defaultHeaders?: Record<string, string>;
-    autoRefresh?: boolean;
-    allowClientSecretInBrowser?: boolean;
-    /**
-     * Permits `http://` base URLs outside loopback hosts. Default `false`.
-     * Use only for trusted local integration tests — never in production.
-     */
-    allowInsecureTransport?: boolean;
-}
-/** Resource owner password token request. */
-interface PasswordTokenRequest {
-    username?: string;
-    email?: string;
-    password: string;
-    scope?: string;
-    mfaCode?: string;
-    mfaBackupCode?: string;
-}
-/** Refresh token request. */
-interface RefreshTokenRequest {
-    refreshToken?: string;
-    scope?: string;
-}
-/** Client credentials request. */
-interface ClientCredentialsRequest {
-    scope?: string;
-}
-/** Authorization code token exchange request (with optional PKCE). */
-interface AuthorizationCodeTokenRequest {
-    code: string;
-    redirectUri: string;
-    codeVerifier?: string;
-    scope?: string;
-}
-/** Options for building an authorization-code + PKCE redirect request. */
-interface AuthorizationUrlOptions {
-    /** Absolute redirect URI registered for this client. */
-    redirectUri: string;
-    /** Space-delimited scopes. Defaults to `openid profile email offline_access`. */
-    scope?: string;
-    /** Pre-generated `state`; one is generated (CSPRNG) when omitted. */
-    state?: string;
-    /** Pre-generated `nonce`; one is generated (CSPRNG) when omitted. */
-    nonce?: string;
-    /** PKCE challenge method. Defaults to `S256`. */
-    codeChallengeMethod?: "S256" | "plain";
-    /** OIDC `prompt` parameter (e.g. `login`, `none`, `consent`). */
-    prompt?: string;
-    /** OIDC `login_hint` to prefill the identifier. */
-    loginHint?: string;
-    /** OAuth `response_type`. Defaults to `code`. */
-    responseType?: string;
-    /** Override the authorization endpoint (defaults to `{baseUrl}/oauth/authorize`). */
-    authorizationEndpoint?: string;
-    /** RFC 9396 rich authorization details to request (serialized as JSON). */
-    authorizationDetails?: AuthorizationDetail[];
-    /**
-     * RFC 9126 pushed-request reference. When set, the SDK builds a slim
-     * authorization URL carrying only `client_id` and `request_uri`.
-     */
-    requestUri?: string;
-    /** Additional non-standard query parameters to append. */
-    extraParams?: Record<string, string>;
-}
-/**
- * Everything produced when starting an auth-code flow. The caller MUST persist
- * `state`, `nonce`, `codeVerifier`, and `redirectUri` (e.g. in an httpOnly
- * cookie or server session) and replay them when handling the callback.
- */
-interface AuthorizationRequest {
-    /** Fully-formed authorization URL to redirect the user agent to. */
-    url: string;
-    /** CSRF anti-forgery token; verify on callback. */
-    state: string;
-    /** OIDC nonce; bind to the returned ID token. */
-    nonce: string;
-    /** PKCE verifier; required at token exchange. Treat as a secret. */
-    codeVerifier: string;
-    /** PKCE challenge that was sent in the URL. */
-    codeChallenge: string;
-    /** Redirect URI echoed at token exchange. */
-    redirectUri: string;
-    /** Resolved scope string. */
-    scope: string;
-    /** RFC 9126 request_uri, present only when the request was pushed via PAR. */
-    requestUri?: string;
-}
-/** Options for pushing an authorization request (RFC 9126). */
-interface PushAuthorizationRequestOptions extends AuthorizationUrlOptions {
-}
-/** Result of a successful pushed authorization request (RFC 9126). */
-interface PushedAuthorizationResult {
-    /** The `urn:ietf:params:oauth:request_uri:...` reference. */
-    requestUri: string;
-    /** Lifetime of the request_uri in seconds. */
-    expiresIn: number;
-    /** The persisted request artefacts (state/nonce/codeVerifier) to replay on callback. */
-    request: AuthorizationRequest;
-}
-/** Result of probing `GET /oauth/authorize` with `redirect: manual`. */
-interface AuthorizationProbeResult {
-    kind: "redirect" | "json";
-    status: number;
-    location?: string;
-    authorizationUrl?: string;
-    payload?: JsonObject;
-}
-/** Parsed authorization-server redirect callback parameters. */
-interface CallbackParams {
-    code?: string;
-    state?: string;
-    error?: string;
-    errorDescription?: string;
-    errorUri?: string;
-    /** Any additional parameters present on the callback URL. */
-    raw: Record<string, string>;
-}
-/** Options for the one-call callback handler that validates state and exchanges the code. */
-interface HandleCallbackOptions {
-    /** The callback URL, its query string, or pre-parsed params. */
-    callback: string | URLSearchParams | Record<string, string> | CallbackParams;
-    /** The `state` issued in {@link AuthorizationRequest}; verified constant-time. */
-    expectedState: string;
-    /** The PKCE verifier issued in {@link AuthorizationRequest}. */
-    codeVerifier: string;
-    /** The redirect URI issued in {@link AuthorizationRequest}. */
-    redirectUri: string;
-    /** Optional scope override forwarded to the token exchange. */
-    scope?: string;
-}
-/** OIDC discovery document (`/.well-known/openid-configuration`), camelCased subset. */
-interface OidcDiscoveryDocument {
-    issuer: string;
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    userinfoEndpoint?: string;
-    jwksUri: string;
-    revocationEndpoint?: string;
-    introspectionEndpoint?: string;
-    responseTypesSupported: string[];
-    grantTypesSupported?: string[];
-    scopesSupported?: string[];
-    codeChallengeMethodsSupported?: string[];
-    /** Raw, unmapped document for fields not surfaced above. */
-    raw: JsonObject;
-}
-/** Token revocation request. */
-interface RevokeTokenRequest {
-    token?: string;
-    tokenTypeHint?: "access_token" | "refresh_token";
-}
-/** Token introspection request. */
-interface IntrospectTokenRequest {
-    token: string;
-}
-/** Token introspection response. */
-interface TokenIntrospectionResponse {
-    active: boolean;
-    scope?: string;
-    clientId?: string;
-    username?: string;
-    tokenType?: string;
-    exp?: number;
-    iat?: number;
-    sub?: string;
-    /** RFC 9396 authorization details associated with the token. */
-    authorizationDetails?: AuthorizationDetail[];
-}
-/** Individual form field definition required for a flow step. */
-interface StepInputField {
-    name: string;
-    type: string;
-    required: boolean;
-    description: string;
-    sensitive: boolean;
-}
-/** Input schema definition for a flow step. */
-interface StepInputSchema {
-    fields: StepInputField[];
-}
-/** Authentication or registration flow step metadata. */
-interface FlowStep {
-    stepId: string;
-    stepType: string;
-    name: string;
-    description?: string;
-    order: number;
-    isRequired: boolean;
-    timeout: number;
-    inputSchema?: StepInputSchema;
-}
-/** Auth flow initialization request. */
-interface InitAuthenticationRequest {
-    clientId?: string;
-    username?: string;
-}
-/** Registration flow initialization request. */
-interface InitRegistrationRequest {
-    clientId?: string;
-    inviteCode?: string;
-}
-/** Shared response for auth/registration flow initialization. */
-interface FlowInitResponse {
-    sessionId: string;
-    flowId: string;
-    flowName: string;
-    currentStep: FlowStep;
-    remainingSteps: FlowStep[];
-    expiresAt: string;
-}
-/** Execute current flow step request. */
-interface ExecuteStepRequest {
-    sessionId: string;
-    stepId: string;
-    credential: Record<string, string>;
-}
-/** Flow step response when additional steps are still required. */
-interface FlowStepInProgressResult {
-    status: "in_progress";
-    sessionId: string;
-    nextStep: FlowStep;
-    completedSteps: string[];
-    remainingSteps: FlowStep[];
-}
-/** Flow step response when authentication is complete and tokens are issued. */
-interface FlowStepCompleteResult {
-    status: "complete";
-    accessToken: string;
-    refreshToken?: string;
-    tokenType: string;
-    expiresIn: number;
-    scope?: string;
-    amr: string[];
-    acr: string;
-}
-/** Discriminated union of flow step execution outcomes. */
-type FlowStepResult = FlowStepInProgressResult | FlowStepCompleteResult;
-/** Full flow session status payload. */
-interface FlowSessionStatus {
-    sessionId: string;
-    status: string;
-    purpose: string;
-    currentStep?: FlowStep;
-    completedSteps: string[];
-    remainingSteps: FlowStep[];
-    failedAttempts: number;
-    expiresAt: string;
-    lastActivityAt: string;
-}
-/** Standard page metadata. */
-interface PageQuery {
-    page?: number;
-    perPage?: number;
-}
-/** Standard page metadata. */
-interface PageMetadata {
-    page: number;
-    per: number;
-    total: number;
-}
-/** Standard paginated response. */
-interface PageResponse<T> {
-    items: T[];
-    metadata: PageMetadata;
-}
-
-/** Session list item. */
-interface SessionSummary {
-    id: string;
-    deviceName?: string;
-    deviceType: string;
-    browser?: string;
-    os?: string;
-    ipAddress: string;
-    country?: string;
-    city?: string;
-    isActive: boolean;
-    isCurrent: boolean;
-    isTrusted: boolean;
-    lastUsedAt?: string;
-    createdAt?: string;
-}
-/** Session detail payload. */
-interface SessionDetail {
-    id: string;
-    deviceId?: string;
-    deviceName?: string;
-    deviceType: string;
-    userAgent?: string;
-    browser?: string;
-    browserVersion?: string;
-    os?: string;
-    osVersion?: string;
-    ipAddress: string;
-    country?: string;
-    city?: string;
-    isActive: boolean;
-    isRevoked: boolean;
-    isCurrent: boolean;
-    isTrusted: boolean;
-    requiresMfa: boolean;
-    accessTokenCount: number;
-    lastUsedAt?: string;
-    expiresAt?: string;
-    createdAt?: string;
-    revokedAt?: string;
-    revocationReason?: string;
-}
-/** Session update payload. */
-interface UpdateSessionRequest {
-    deviceName?: string;
-    isTrusted?: boolean;
-}
-/** Optional reason payload used during session revocation. */
-interface RevokeSessionRequest {
-    reason?: string;
-}
-/** Session/token revocation summary. */
-interface RevocationResponse {
-    success: boolean;
-    sessionsRevoked: number;
-    tokensRevoked: number;
-}
-/** Current user profile payload from `/api/v1/users/me`. */
-interface UserProfile {
-    id: string;
-    organizationId?: string;
-    email?: string;
-    username?: string;
-    firstName?: string;
-    lastName?: string;
-    isActive?: boolean;
-    isVerified?: boolean;
-    mfaEnabled?: boolean;
-    [key: string]: JsonValue | undefined;
-}
-/** OIDC UserInfo response payload. */
-interface UserInfoResponse {
-    sub: string;
-    name?: string;
-    givenName?: string;
-    familyName?: string;
-    middleName?: string;
-    nickname?: string;
-    preferredUsername?: string;
-    profile?: string;
-    picture?: string;
-    website?: string;
-    gender?: string;
-    birthdate?: string;
-    zoneinfo?: string;
-    locale?: string;
-    updatedAt?: number;
-    email?: string;
-    emailVerified?: boolean;
-    phoneNumber?: string;
-    phoneNumberVerified?: boolean;
-    [key: string]: JsonValue | undefined;
-}
-/** WebAuthn endpoint wrappers (browser ceremony intentionally out-of-scope). */
-interface WebAuthnEndpoints {
-    registerBegin(payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
-    registerFinish(payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
-    authenticateBegin(payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
-    authenticateFinish(payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
-    credentials(): Promise<Record<string, JsonValue>>;
-    removeCredential(credentialId: string, input?: {
-        password?: string;
-    }): Promise<void>;
-    renameCredential(credentialId: string, payload: Record<string, JsonValue>): Promise<Record<string, JsonValue>>;
-    setPrimaryCredential(credentialId: string): Promise<Record<string, JsonValue>>;
-}
-/** OAuth token endpoint wrappers. */
-interface TokenEndpoints {
-    password(input: PasswordTokenRequest): Promise<AuthTokens>;
-    refresh(input?: RefreshTokenRequest): Promise<AuthTokens>;
-    clientCredentials(input?: ClientCredentialsRequest): Promise<AuthTokens>;
-    authorizationCode(input: AuthorizationCodeTokenRequest): Promise<AuthTokens>;
-    tokenExchange(input: TokenExchangeRequest): Promise<AuthTokens>;
-    revoke(input?: RevokeTokenRequest): Promise<void>;
-    introspect(input: IntrospectTokenRequest): Promise<TokenIntrospectionResponse>;
-}
-/** Authentication and registration flow endpoint wrappers. */
-interface FlowEndpoints {
-    initAuthentication(input?: InitAuthenticationRequest): Promise<FlowInitResponse>;
-    executeStep(input: ExecuteStepRequest): Promise<FlowStepResult>;
-    initRegistration(input?: InitRegistrationRequest): Promise<FlowInitResponse>;
-    executeRegistrationStep(input: ExecuteStepRequest): Promise<FlowStepResult>;
-    initRecovery(input?: InitRecoveryRequest): Promise<FlowInitResponse>;
-    executeRecoveryStep(input: ExecuteStepRequest): Promise<FlowStepResult>;
-    getStatus(sessionId: string): Promise<FlowSessionStatus>;
-}
-/** OIDC endpoint wrappers. */
-interface OidcEndpoints {
-    userInfo(): Promise<UserInfoResponse>;
-    discover(): Promise<OidcDiscoveryDocument>;
-    jwks(): Promise<JwksDocument>;
-}
-/**
- * Authorization-code + PKCE redirect-flow helpers. This is the high-level
- * surface that removes per-app duplication of PKCE/state/URL plumbing.
- */
-interface AuthorizeEndpoints {
-    createRequest(options: AuthorizationUrlOptions): Promise<AuthorizationRequest>;
-    /**
-     * RFC 9126: push the authorization request to the server and return a
-     * one-time `request_uri` plus a slim authorization `request` referencing it.
-     */
-    pushAuthorizationRequest(options: PushAuthorizationRequestOptions): Promise<PushedAuthorizationResult>;
-    parseCallback(input: string | URLSearchParams | Record<string, string>): CallbackParams;
-    handleCallback(options: HandleCallbackOptions): Promise<AuthTokens>;
-    consent(callbackUrl: string, body: AuthorizationConsentBody): Promise<AuthorizationConsentResponse>;
-    consentWithCredentials(options: ConsentWithCredentialsOptions): Promise<AuthorizationConsentResponse>;
-    probeAuthorize(url: string): Promise<AuthorizationProbeResult>;
-}
-/** Current-user endpoint wrappers. */
-interface UserEndpoints {
-    me(): Promise<UserProfile>;
-    updateMe(input: JsonObject): Promise<UserProfile>;
-    changePassword(input: {
-        currentPassword: string;
-        newPassword: string;
-    }): Promise<void>;
-    uploadAvatar(file: Blob | Buffer, filename?: string): Promise<UserProfile>;
-    deleteAvatar(): Promise<UserProfile>;
-    verifyPhone(input: JsonObject): Promise<JsonObject>;
-    securityOverview(): Promise<JsonObject>;
-    recoveryContacts: {
-        list(): Promise<RecoveryContact[]>;
-        create(input: JsonObject): Promise<RecoveryContact>;
-        update(contactId: string, input: JsonObject): Promise<RecoveryContact>;
-        delete(contactId: string): Promise<void>;
-    };
-    identities: {
-        list(): Promise<UserIdentity[]>;
-        unlink(identityId: string): Promise<void>;
-        setPrimary(identityId: string): Promise<JsonObject>;
-    };
-    deleteMe(input: {
-        password: string;
-    }): Promise<void>;
-    admin: UsersAdminEndpoints;
-}
-/** Session list query parameters. */
-interface SessionListQuery {
-    page?: number;
-    perPage?: number;
-    userId?: string;
-}
-/** Session management endpoint wrappers. */
-interface SessionEndpoints {
-    list(input?: SessionListQuery): Promise<PageResponse<SessionSummary>>;
-    current(): Promise<SessionDetail>;
-    get(id: string): Promise<SessionDetail>;
-    update(id: string, input: UpdateSessionRequest): Promise<SessionDetail>;
-    revoke(id: string, input?: RevokeSessionRequest): Promise<RevocationResponse>;
-    revokeAll(): Promise<RevocationResponse>;
-    revokeAllDevices(): Promise<RevocationResponse>;
-}
-/** Token state helper endpoints for direct storage access. */
-interface TokenStateEndpoints {
-    get(): Promise<AuthTokens | null>;
-    set(tokens: AuthTokens | null): Promise<void>;
-    clear(): Promise<void>;
-}
-
-/**
- * Creates in-memory token storage suitable for Node, edge, and browser runtimes.
- *
- * Tokens are not encrypted and do not survive process restarts. This is the
- * default and the recommended choice for server-side clients (SSR routes,
- * workers) where persistence belongs in HttpOnly cookies or a server session.
- */
-declare function createMemoryTokenStorage(): TokenStorage;
-
-export { type UpdateSessionRequest as $, type AuthorizeEndpoints as A, type PasswordTokenRequest as B, type CallbackParams as C, type PublicClientInfo as D, type ExecuteStepRequest as E, type FlowEndpoints as F, type PushAuthorizationRequestOptions as G, type HandleCallbackOptions as H, type InitAuthenticationRequest as I, type PushedAuthorizationResult as J, type RevocationResponse as K, type RevokeSessionRequest as L, type MfaEndpoints as M, type RevokeTokenRequest as N, type OidcEndpoints as O, type PasswordResetEndpoints as P, type SessionDetail as Q, type RefreshTokenRequest as R, type SessionEndpoints as S, type TokenEndpoints as T, type UserEndpoints as U, type SessionListQuery as V, type WebAuthnEndpoints as W, type SessionSummary as X, type TokenExchangeRequest as Y, type TokenIntrospectionResponse as Z, type TokenStorage as _, type MaintenanceStatus as a, type UserInfoResponse as a0, type UserProfile as a1, createMemoryTokenStorage as a2, type OAuthMetaEndpoints as b, type TokenStateEndpoints as c, type AuthClientConfig as d, type AuthTokens as e, type AuthorizationCodeTokenRequest as f, type AuthorizationConsentBody as g, type AuthorizationConsentResponse as h, type AuthorizationDetail as i, type AuthorizationProbeResult as j, type AuthorizationRequest as k, type AuthorizationUrlOptions as l, type ClientCredentialsRequest as m, type FlowInitResponse as n, type FlowSessionStatus as o, type FlowStep as p, type FlowStepCompleteResult as q, type FlowStepInProgressResult as r, type FlowStepResult as s, type InitRegistrationRequest as t, type IntrospectTokenRequest as u, type MfaDevice as v, type OAuthAuthorizationServerMetadata as w, type OidcDiscoveryDocument as x, type PageQuery as y, type PageResponse as z };