cauthy-auth 0.2.0 → 0.3.0

package/dist/system-BWLddIt2.d.mts

@@ -0,0 +1,233 @@
+import { JWK } from 'jose';
+
+/** How an application is set up to sign its people in with Cauthy. */
+interface CauthyOptions {
+    /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The application's OAuth client id. Default: `CAUTHY_CLIENT_ID`. */
+    clientId?: string;
+    /** Its secret, when the client is confidential. Default: `CAUTHY_CLIENT_SECRET`. */
+    clientSecret?: string;
+    /**
+     * The key the session cookie is encrypted with: any string of 32 characters
+     * or more, kept on the server. Default: `CAUTHY_SECRET`.
+     */
+    secret?: string;
+    /**
+     * The system this application is, as its organizations are filed under in
+     * Cauthy (`"pondari"`). When set, a session's organizations are that
+     * system's. Default: `CAUTHY_SYSTEM`.
+     */
+    system?: string;
+    /** Where the routes are mounted. Default: `/api/auth`. */
+    basePath?: string;
+    /**
+     * The application's own public origin (`https://app.example.com`), for the
+     * redirect URI. Default: the origin of each request, which is right unless
+     * a proxy hides it.
+     */
+    baseURL?: string;
+    /** Where a person lands after signing in, when no `return_to` was asked. Default: `/`. */
+    afterSignIn?: string;
+    /** Where a person lands after signing out. Default: `/`. */
+    afterSignOut?: string;
+    /** Name of the session cookie. Default: `cauthy_session`. */
+    cookieName?: string;
+    /**
+     * A key the application proves who it is with when it acts on its own
+     * (`auth.system`), instead of its secret. Default: `CAUTHY_SYSTEM_KEY` and
+     * `CAUTHY_SYSTEM_KEY_ID`.
+     */
+    systemKey?: SystemKey;
+    /** `fetch` to reach Cauthy with. Default: the global one. */
+    fetch?: typeof fetch;
+}
+/** The person signed in. Every moment is UTC. */
+interface SessionUser {
+    id: string;
+    email: string;
+    name: string;
+    emailVerified: boolean;
+    /**
+     * True when the account ran out of time to confirm its address: let it read
+     * and refuse its writes.
+     */
+    restricted: boolean;
+    /** When an unconfirmed address stops being enough (ISO 8601, UTC), if there is a deadline. */
+    emailVerifyBy?: string;
+    /** The language the person reads in ("es", "en-US"), when Cauthy knows it. */
+    locale?: string;
+}
+/** A value JSON can carry. What crosses from server to browser is typed as this, never `unknown`. */
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** An organization the person belongs to, with their role in it. */
+interface SessionOrganization {
+    id: string;
+    system: string;
+    name: string;
+    kind: string;
+    externalId?: string;
+    role: string;
+    /** What the system keeps about the organization, as it filed it in Cauthy. */
+    metadata: Record<string, JsonValue>;
+    /**
+     * What the person may do here, as "resource:action" entries ("*" is any):
+     * their role's permissions, what it inherits, and anything given to them
+     * apart from it. Absent when the system keeps no catalog of roles in Cauthy.
+     * Check with `can(organization, resource, action)`.
+     */
+    permissions?: string[];
+    /** What the person is denied here, whatever else allows it. */
+    denied?: string[];
+}
+/** A signed-in person, as the server sees them. */
+interface Session {
+    user: SessionUser;
+    /** The Cauthy tenant the account is of. */
+    tenantId: string;
+    /** The roles the account holds in that tenant. */
+    roles: string[];
+    /**
+     * Cauthy's access token for this person: send it as `Authorization: Bearer`
+     * to another service that verifies Cauthy's tokens. Never give it to the browser.
+     */
+    accessToken: string;
+    /** When the access token expires and the session is checked with Cauthy again (ISO 8601, UTC). */
+    expiresAt: string;
+}
+/** What the browser is told of a session: who, and their organizations — never a token. */
+interface PublicSession {
+    user: SessionUser;
+    tenantId: string;
+    roles: string[];
+    organizations: SessionOrganization[];
+    expiresAt: string;
+}
+/** Why there is no session. */
+type SessionStatus = 'authenticated' | 'unauthenticated' | 'expired';
+declare class CauthyConfigError extends Error {
+    constructor(message: string);
+}
+
+/** The key an application signs its assertions with. */
+interface SystemKey {
+    /** The private key: PKCS#8 PEM, or a JWK (as an object or its JSON). RSA, for RS256. */
+    privateKey: string | JWK;
+    /** The id the public key is published under (`kid`). */
+    keyId: string;
+}
+interface SystemOptions {
+    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The application's client id. Default: `CAUTHY_CLIENT_ID`. */
+    clientId?: string;
+    /** Its secret. Default: `CAUTHY_CLIENT_SECRET`. Not needed with `key`. */
+    clientSecret?: string;
+    /**
+     * The key to prove who the application is with, instead of the secret.
+     * Default: `CAUTHY_SYSTEM_KEY` (the private key) and `CAUTHY_SYSTEM_KEY_ID`.
+     */
+    key?: SystemKey;
+    fetch?: typeof fetch;
+}
+/** Cauthy refused a request of the application's own. */
+declare class CauthyApiError extends Error {
+    readonly status: number;
+    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`… */
+    readonly code: string;
+    constructor(status: number, 
+    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`… */
+    code: string, message: string);
+}
+/** An organization of the application's system. Every moment is UTC. */
+interface Organization {
+    id: string;
+    system: string;
+    name: string;
+    kind: string;
+    /** The id the application knows it by. */
+    externalId?: string;
+    status: 'active' | 'archived';
+    metadata: Record<string, JsonValue>;
+    members: number;
+    createdAt: string;
+    updatedAt: string;
+}
+interface OrganizationMember {
+    userId: string;
+    email: string;
+    name: string;
+    /** The account's status: a disabled member is still listed. */
+    status: string;
+    role: string;
+    /** True when the address had no account: one was made and invited. */
+    invited?: boolean;
+}
+/** Who to add: an account by its id, or anybody by their address (invited when new). */
+type NewMember = {
+    role: string;
+    name?: string;
+    locale?: string;
+} & ({
+    userId: string;
+    email?: undefined;
+} | {
+    email: string;
+    userId?: undefined;
+});
+interface CauthySystem {
+    /** The application's own token, asked for when needed and kept until it is about to run out. */
+    token(): Promise<string>;
+    /** Any route the application's token may call; answers what Cauthy put under `data`. */
+    request<T = unknown>(method: string, path: string, body?: unknown): Promise<T>;
+    organizations: {
+        list(query?: {
+            q?: string;
+            status?: 'active' | 'archived';
+            limit?: number;
+            offset?: number;
+        }): Promise<{
+            items: Organization[];
+            total: number;
+        }>;
+        create(input: {
+            name: string;
+            kind?: string;
+            externalId?: string;
+            metadata?: Record<string, JsonValue>;
+        }): Promise<Organization>;
+        get(id: string): Promise<Organization>;
+        update(id: string, patch: {
+            name?: string;
+            kind?: string;
+            status?: 'active' | 'archived';
+            metadata?: Record<string, JsonValue>;
+        }): Promise<Organization>;
+        /** Removes the organization and every membership of it, for good. */
+        remove(id: string): Promise<void>;
+    };
+    members: {
+        list(organizationId: string): Promise<OrganizationMember[]>;
+        add(organizationId: string, member: NewMember): Promise<OrganizationMember>;
+        setRole(organizationId: string, userId: string, role: string): Promise<OrganizationMember>;
+        remove(organizationId: string, userId: string): Promise<void>;
+    };
+    /** Invites a person who has no account yet; answers the account made for them. */
+    invite(person: {
+        email: string;
+        name?: string;
+        locale?: string;
+    }): Promise<{
+        id: string;
+        email: string;
+    }>;
+    /** The public half of `key`, to serve at the address Cauthy was given (`jwks_uri`). Empty with a secret. */
+    publicJwks(): Promise<{
+        keys: JWK[];
+    }>;
+}
+declare function createSystem(given?: SystemOptions): CauthySystem;
+
+export { CauthyApiError as C, type JsonValue as J, type NewMember as N, type Organization as O, type PublicSession as P, type Session as S, CauthyConfigError as a, type CauthyOptions as b, type CauthySystem as c, type OrganizationMember as d, type SessionOrganization as e, type SessionStatus as f, type SessionUser as g, type SystemKey as h, type SystemOptions as i, createSystem as j };

package/dist/system-BWLddIt2.d.ts

@@ -0,0 +1,233 @@
+import { JWK } from 'jose';
+
+/** How an application is set up to sign its people in with Cauthy. */
+interface CauthyOptions {
+    /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The application's OAuth client id. Default: `CAUTHY_CLIENT_ID`. */
+    clientId?: string;
+    /** Its secret, when the client is confidential. Default: `CAUTHY_CLIENT_SECRET`. */
+    clientSecret?: string;
+    /**
+     * The key the session cookie is encrypted with: any string of 32 characters
+     * or more, kept on the server. Default: `CAUTHY_SECRET`.
+     */
+    secret?: string;
+    /**
+     * The system this application is, as its organizations are filed under in
+     * Cauthy (`"pondari"`). When set, a session's organizations are that
+     * system's. Default: `CAUTHY_SYSTEM`.
+     */
+    system?: string;
+    /** Where the routes are mounted. Default: `/api/auth`. */
+    basePath?: string;
+    /**
+     * The application's own public origin (`https://app.example.com`), for the
+     * redirect URI. Default: the origin of each request, which is right unless
+     * a proxy hides it.
+     */
+    baseURL?: string;
+    /** Where a person lands after signing in, when no `return_to` was asked. Default: `/`. */
+    afterSignIn?: string;
+    /** Where a person lands after signing out. Default: `/`. */
+    afterSignOut?: string;
+    /** Name of the session cookie. Default: `cauthy_session`. */
+    cookieName?: string;
+    /**
+     * A key the application proves who it is with when it acts on its own
+     * (`auth.system`), instead of its secret. Default: `CAUTHY_SYSTEM_KEY` and
+     * `CAUTHY_SYSTEM_KEY_ID`.
+     */
+    systemKey?: SystemKey;
+    /** `fetch` to reach Cauthy with. Default: the global one. */
+    fetch?: typeof fetch;
+}
+/** The person signed in. Every moment is UTC. */
+interface SessionUser {
+    id: string;
+    email: string;
+    name: string;
+    emailVerified: boolean;
+    /**
+     * True when the account ran out of time to confirm its address: let it read
+     * and refuse its writes.
+     */
+    restricted: boolean;
+    /** When an unconfirmed address stops being enough (ISO 8601, UTC), if there is a deadline. */
+    emailVerifyBy?: string;
+    /** The language the person reads in ("es", "en-US"), when Cauthy knows it. */
+    locale?: string;
+}
+/** A value JSON can carry. What crosses from server to browser is typed as this, never `unknown`. */
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** An organization the person belongs to, with their role in it. */
+interface SessionOrganization {
+    id: string;
+    system: string;
+    name: string;
+    kind: string;
+    externalId?: string;
+    role: string;
+    /** What the system keeps about the organization, as it filed it in Cauthy. */
+    metadata: Record<string, JsonValue>;
+    /**
+     * What the person may do here, as "resource:action" entries ("*" is any):
+     * their role's permissions, what it inherits, and anything given to them
+     * apart from it. Absent when the system keeps no catalog of roles in Cauthy.
+     * Check with `can(organization, resource, action)`.
+     */
+    permissions?: string[];
+    /** What the person is denied here, whatever else allows it. */
+    denied?: string[];
+}
+/** A signed-in person, as the server sees them. */
+interface Session {
+    user: SessionUser;
+    /** The Cauthy tenant the account is of. */
+    tenantId: string;
+    /** The roles the account holds in that tenant. */
+    roles: string[];
+    /**
+     * Cauthy's access token for this person: send it as `Authorization: Bearer`
+     * to another service that verifies Cauthy's tokens. Never give it to the browser.
+     */
+    accessToken: string;
+    /** When the access token expires and the session is checked with Cauthy again (ISO 8601, UTC). */
+    expiresAt: string;
+}
+/** What the browser is told of a session: who, and their organizations — never a token. */
+interface PublicSession {
+    user: SessionUser;
+    tenantId: string;
+    roles: string[];
+    organizations: SessionOrganization[];
+    expiresAt: string;
+}
+/** Why there is no session. */
+type SessionStatus = 'authenticated' | 'unauthenticated' | 'expired';
+declare class CauthyConfigError extends Error {
+    constructor(message: string);
+}
+
+/** The key an application signs its assertions with. */
+interface SystemKey {
+    /** The private key: PKCS#8 PEM, or a JWK (as an object or its JSON). RSA, for RS256. */
+    privateKey: string | JWK;
+    /** The id the public key is published under (`kid`). */
+    keyId: string;
+}
+interface SystemOptions {
+    /** Cauthy's address. Default: `CAUTHY_ISSUER`. */
+    issuer?: string;
+    /** The application's client id. Default: `CAUTHY_CLIENT_ID`. */
+    clientId?: string;
+    /** Its secret. Default: `CAUTHY_CLIENT_SECRET`. Not needed with `key`. */
+    clientSecret?: string;
+    /**
+     * The key to prove who the application is with, instead of the secret.
+     * Default: `CAUTHY_SYSTEM_KEY` (the private key) and `CAUTHY_SYSTEM_KEY_ID`.
+     */
+    key?: SystemKey;
+    fetch?: typeof fetch;
+}
+/** Cauthy refused a request of the application's own. */
+declare class CauthyApiError extends Error {
+    readonly status: number;
+    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`… */
+    readonly code: string;
+    constructor(status: number, 
+    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`… */
+    code: string, message: string);
+}
+/** An organization of the application's system. Every moment is UTC. */
+interface Organization {
+    id: string;
+    system: string;
+    name: string;
+    kind: string;
+    /** The id the application knows it by. */
+    externalId?: string;
+    status: 'active' | 'archived';
+    metadata: Record<string, JsonValue>;
+    members: number;
+    createdAt: string;
+    updatedAt: string;
+}
+interface OrganizationMember {
+    userId: string;
+    email: string;
+    name: string;
+    /** The account's status: a disabled member is still listed. */
+    status: string;
+    role: string;
+    /** True when the address had no account: one was made and invited. */
+    invited?: boolean;
+}
+/** Who to add: an account by its id, or anybody by their address (invited when new). */
+type NewMember = {
+    role: string;
+    name?: string;
+    locale?: string;
+} & ({
+    userId: string;
+    email?: undefined;
+} | {
+    email: string;
+    userId?: undefined;
+});
+interface CauthySystem {
+    /** The application's own token, asked for when needed and kept until it is about to run out. */
+    token(): Promise<string>;
+    /** Any route the application's token may call; answers what Cauthy put under `data`. */
+    request<T = unknown>(method: string, path: string, body?: unknown): Promise<T>;
+    organizations: {
+        list(query?: {
+            q?: string;
+            status?: 'active' | 'archived';
+            limit?: number;
+            offset?: number;
+        }): Promise<{
+            items: Organization[];
+            total: number;
+        }>;
+        create(input: {
+            name: string;
+            kind?: string;
+            externalId?: string;
+            metadata?: Record<string, JsonValue>;
+        }): Promise<Organization>;
+        get(id: string): Promise<Organization>;
+        update(id: string, patch: {
+            name?: string;
+            kind?: string;
+            status?: 'active' | 'archived';
+            metadata?: Record<string, JsonValue>;
+        }): Promise<Organization>;
+        /** Removes the organization and every membership of it, for good. */
+        remove(id: string): Promise<void>;
+    };
+    members: {
+        list(organizationId: string): Promise<OrganizationMember[]>;
+        add(organizationId: string, member: NewMember): Promise<OrganizationMember>;
+        setRole(organizationId: string, userId: string, role: string): Promise<OrganizationMember>;
+        remove(organizationId: string, userId: string): Promise<void>;
+    };
+    /** Invites a person who has no account yet; answers the account made for them. */
+    invite(person: {
+        email: string;
+        name?: string;
+        locale?: string;
+    }): Promise<{
+        id: string;
+        email: string;
+    }>;
+    /** The public half of `key`, to serve at the address Cauthy was given (`jwks_uri`). Empty with a secret. */
+    publicJwks(): Promise<{
+        keys: JWK[];
+    }>;
+}
+declare function createSystem(given?: SystemOptions): CauthySystem;
+
+export { CauthyApiError as C, type JsonValue as J, type NewMember as N, type Organization as O, type PublicSession as P, type Session as S, CauthyConfigError as a, type CauthyOptions as b, type CauthySystem as c, type OrganizationMember as d, type SessionOrganization as e, type SessionStatus as f, type SessionUser as g, type SystemKey as h, type SystemOptions as i, createSystem as j };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cauthy-auth",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Sign in with Cauthy: one route to mount, getSession on the server, useSession in the browser. No database, no screens to build.",
   "license": "Apache-2.0",
   "main": "dist/index.js",

package/dist/types-CYmUVWzY.d.mts

@@ -1,106 +0,0 @@
-/** How an application is set up to sign its people in with Cauthy. */
-interface CauthyOptions {
-    /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */
-    issuer?: string;
-    /** The application's OAuth client id. Default: `CAUTHY_CLIENT_ID`. */
-    clientId?: string;
-    /** Its secret, when the client is confidential. Default: `CAUTHY_CLIENT_SECRET`. */
-    clientSecret?: string;
-    /**
-     * The key the session cookie is encrypted with: any string of 32 characters
-     * or more, kept on the server. Default: `CAUTHY_SECRET`.
-     */
-    secret?: string;
-    /**
-     * The system this application is, as its organizations are filed under in
-     * Cauthy (`"pondari"`). When set, a session's organizations are that
-     * system's. Default: `CAUTHY_SYSTEM`.
-     */
-    system?: string;
-    /** Where the routes are mounted. Default: `/api/auth`. */
-    basePath?: string;
-    /**
-     * The application's own public origin (`https://app.example.com`), for the
-     * redirect URI. Default: the origin of each request, which is right unless
-     * a proxy hides it.
-     */
-    baseURL?: string;
-    /** Where a person lands after signing in, when no `return_to` was asked. Default: `/`. */
-    afterSignIn?: string;
-    /** Where a person lands after signing out. Default: `/`. */
-    afterSignOut?: string;
-    /** Name of the session cookie. Default: `cauthy_session`. */
-    cookieName?: string;
-    /** `fetch` to reach Cauthy with. Default: the global one. */
-    fetch?: typeof fetch;
-}
-/** The person signed in. Every moment is UTC. */
-interface SessionUser {
-    id: string;
-    email: string;
-    name: string;
-    emailVerified: boolean;
-    /**
-     * True when the account ran out of time to confirm its address: let it read
-     * and refuse its writes.
-     */
-    restricted: boolean;
-    /** When an unconfirmed address stops being enough (ISO 8601, UTC), if there is a deadline. */
-    emailVerifyBy?: string;
-    /** The language the person reads in ("es", "en-US"), when Cauthy knows it. */
-    locale?: string;
-}
-/** A value JSON can carry. What crosses from server to browser is typed as this, never `unknown`. */
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-/** An organization the person belongs to, with their role in it. */
-interface SessionOrganization {
-    id: string;
-    system: string;
-    name: string;
-    kind: string;
-    externalId?: string;
-    role: string;
-    /** What the system keeps about the organization, as it filed it in Cauthy. */
-    metadata: Record<string, JsonValue>;
-    /**
-     * What the person may do here, as "resource:action" entries ("*" is any):
-     * their role's permissions, what it inherits, and anything given to them
-     * apart from it. Absent when the system keeps no catalog of roles in Cauthy.
-     * Check with `can(organization, resource, action)`.
-     */
-    permissions?: string[];
-    /** What the person is denied here, whatever else allows it. */
-    denied?: string[];
-}
-/** A signed-in person, as the server sees them. */
-interface Session {
-    user: SessionUser;
-    /** The Cauthy tenant the account is of. */
-    tenantId: string;
-    /** The roles the account holds in that tenant. */
-    roles: string[];
-    /**
-     * Cauthy's access token for this person: send it as `Authorization: Bearer`
-     * to another service that verifies Cauthy's tokens. Never give it to the browser.
-     */
-    accessToken: string;
-    /** When the access token expires and the session is checked with Cauthy again (ISO 8601, UTC). */
-    expiresAt: string;
-}
-/** What the browser is told of a session: who, and their organizations — never a token. */
-interface PublicSession {
-    user: SessionUser;
-    tenantId: string;
-    roles: string[];
-    organizations: SessionOrganization[];
-    expiresAt: string;
-}
-/** Why there is no session. */
-type SessionStatus = 'authenticated' | 'unauthenticated' | 'expired';
-declare class CauthyConfigError extends Error {
-    constructor(message: string);
-}
-
-export { CauthyConfigError as C, type JsonValue as J, type PublicSession as P, type Session as S, type CauthyOptions as a, type SessionOrganization as b, type SessionStatus as c, type SessionUser as d };

package/dist/types-CYmUVWzY.d.ts

@@ -1,106 +0,0 @@
-/** How an application is set up to sign its people in with Cauthy. */
-interface CauthyOptions {
-    /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */
-    issuer?: string;
-    /** The application's OAuth client id. Default: `CAUTHY_CLIENT_ID`. */
-    clientId?: string;
-    /** Its secret, when the client is confidential. Default: `CAUTHY_CLIENT_SECRET`. */
-    clientSecret?: string;
-    /**
-     * The key the session cookie is encrypted with: any string of 32 characters
-     * or more, kept on the server. Default: `CAUTHY_SECRET`.
-     */
-    secret?: string;
-    /**
-     * The system this application is, as its organizations are filed under in
-     * Cauthy (`"pondari"`). When set, a session's organizations are that
-     * system's. Default: `CAUTHY_SYSTEM`.
-     */
-    system?: string;
-    /** Where the routes are mounted. Default: `/api/auth`. */
-    basePath?: string;
-    /**
-     * The application's own public origin (`https://app.example.com`), for the
-     * redirect URI. Default: the origin of each request, which is right unless
-     * a proxy hides it.
-     */
-    baseURL?: string;
-    /** Where a person lands after signing in, when no `return_to` was asked. Default: `/`. */
-    afterSignIn?: string;
-    /** Where a person lands after signing out. Default: `/`. */
-    afterSignOut?: string;
-    /** Name of the session cookie. Default: `cauthy_session`. */
-    cookieName?: string;
-    /** `fetch` to reach Cauthy with. Default: the global one. */
-    fetch?: typeof fetch;
-}
-/** The person signed in. Every moment is UTC. */
-interface SessionUser {
-    id: string;
-    email: string;
-    name: string;
-    emailVerified: boolean;
-    /**
-     * True when the account ran out of time to confirm its address: let it read
-     * and refuse its writes.
-     */
-    restricted: boolean;
-    /** When an unconfirmed address stops being enough (ISO 8601, UTC), if there is a deadline. */
-    emailVerifyBy?: string;
-    /** The language the person reads in ("es", "en-US"), when Cauthy knows it. */
-    locale?: string;
-}
-/** A value JSON can carry. What crosses from server to browser is typed as this, never `unknown`. */
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-/** An organization the person belongs to, with their role in it. */
-interface SessionOrganization {
-    id: string;
-    system: string;
-    name: string;
-    kind: string;
-    externalId?: string;
-    role: string;
-    /** What the system keeps about the organization, as it filed it in Cauthy. */
-    metadata: Record<string, JsonValue>;
-    /**
-     * What the person may do here, as "resource:action" entries ("*" is any):
-     * their role's permissions, what it inherits, and anything given to them
-     * apart from it. Absent when the system keeps no catalog of roles in Cauthy.
-     * Check with `can(organization, resource, action)`.
-     */
-    permissions?: string[];
-    /** What the person is denied here, whatever else allows it. */
-    denied?: string[];
-}
-/** A signed-in person, as the server sees them. */
-interface Session {
-    user: SessionUser;
-    /** The Cauthy tenant the account is of. */
-    tenantId: string;
-    /** The roles the account holds in that tenant. */
-    roles: string[];
-    /**
-     * Cauthy's access token for this person: send it as `Authorization: Bearer`
-     * to another service that verifies Cauthy's tokens. Never give it to the browser.
-     */
-    accessToken: string;
-    /** When the access token expires and the session is checked with Cauthy again (ISO 8601, UTC). */
-    expiresAt: string;
-}
-/** What the browser is told of a session: who, and their organizations — never a token. */
-interface PublicSession {
-    user: SessionUser;
-    tenantId: string;
-    roles: string[];
-    organizations: SessionOrganization[];
-    expiresAt: string;
-}
-/** Why there is no session. */
-type SessionStatus = 'authenticated' | 'unauthenticated' | 'expired';
-declare class CauthyConfigError extends Error {
-    constructor(message: string);
-}
-
-export { CauthyConfigError as C, type JsonValue as J, type PublicSession as P, type Session as S, type CauthyOptions as a, type SessionOrganization as b, type SessionStatus as c, type SessionUser as d };