terrascale 0.3.0

package/types/ts-auth.d.ts

@@ -0,0 +1,1826 @@
+/**
+ * @param {TsAuthClientConfig} config
+ * @returns {TsAuthClient}
+ */
+export function createTsAuthClient(config: TsAuthClientConfig): TsAuthClient;
+/**
+ * Verifies a ts-auth webhook delivery signature: sha256=lowercaseHex(HMAC-
+ * SHA256(key = UTF8(signingSecret), message = UTF8(timestamp + "." + rawBody)))
+ * compared in constant time over the RAW body bytes. Malformed input returns
+ * false; this function never throws.
+ * @param {string} signingSecret
+ * @param {string | undefined} timestamp
+ * @param {string | undefined} signature
+ * @param {Uint8Array} payload
+ * @returns {Promise<boolean>}
+ */
+export function verifyTsAuthWebhook(signingSecret: string, timestamp: string | undefined, signature: string | undefined, payload: Uint8Array): Promise<boolean>;
+/**
+ * verifyTsAuthWebhook plus a replay window: the timestamp header must be
+ * within ±toleranceMs of `now` (milliseconds).
+ * @param {string} signingSecret
+ * @param {string | undefined} timestamp
+ * @param {string | undefined} signature
+ * @param {Uint8Array} payload
+ * @param {number} toleranceMs
+ * @param {number} now
+ * @returns {Promise<boolean>}
+ */
+export function verifyTsAuthWebhookWithTolerance(signingSecret: string, timestamp: string | undefined, signature: string | undefined, payload: Uint8Array, toleranceMs: number, now: number): Promise<boolean>;
+/** @import { TerraScaleResult } from "./result.js" */
+/** @typedef {import("./config.js").TsAuthRuntimeConfig} TsAuthRuntimeConfig */
+/**
+ * ts-auth is a separate hosted IdP service on its own origin. This client
+ * speaks that service's published management and OIDC contract, which mirrors
+ * the ts-auth service routes — not the TerraScale product /api/v1 producer
+ * contract. The deployment's public origin is `apiBaseUrl` and the instance
+ * `sk_` management key is `accessToken`.
+ * @typedef {Omit<TsAuthRuntimeConfig, "apiBaseUrl"> & {
+ *   readonly apiBaseUrl: string; // The ts-auth deployment's public origin; there is no default.
+ *   readonly instanceSlug: string; // The instance the `sk_` key belongs to; it prefixes every route.
+ *   readonly useReverseProxy?: boolean; // Route public auth calls through the reverse proxy instead of regional discovery.
+ * }} TsAuthClientConfig
+ */
+/**
+ * @typedef {{
+ *   readonly signal?: AbortSignal | undefined;
+ * }} TsAuthRequestOptions
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly email: string | null;
+ *   readonly email_verified: boolean;
+ *   readonly username: string | null;
+ *   readonly name: string | null;
+ *   readonly banned: boolean;
+ *   readonly ban_reason?: string | null | undefined; // Omitted by list responses; present on the full single-user view.
+ *   readonly created_at: number; // Unix seconds.
+ *   readonly last_sign_in_at?: number | null | undefined;
+ *   readonly public_metadata: Record<string, unknown>;
+ *   readonly private_metadata?: Record<string, unknown> | undefined;
+ * }} TsAuthUser
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly status: string;
+ *   readonly created_at: number; // Unix seconds.
+ *   readonly expires_at: number; // Unix seconds.
+ *   readonly last_active_at?: number | null | undefined;
+ *   readonly user_agent?: string | null | undefined;
+ *   readonly ip_address?: string | null | undefined;
+ * }} TsAuthSession
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly type: string;
+ *   readonly confirmed: boolean;
+ *   readonly createdAt: number; // Unix seconds.
+ * }} TsAuthMfaFactor
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly nickname: string | null;
+ *   readonly algorithm: string;
+ *   readonly createdAt: number; // Unix seconds.
+ *   readonly lastUsedAt: number | null; // Unix seconds.
+ * }} TsAuthPasskey
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly name: string;
+ *   readonly slug: string;
+ *   readonly created_at: number; // Unix seconds.
+ * }} TsAuthOrganization
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly role: string;
+ *   readonly created_at: number; // Unix seconds.
+ *   readonly organization: TsAuthOrganization | null;
+ * }} TsAuthUserOrganizationMembership
+ */
+/**
+ * @typedef {{
+ *   readonly token: string;
+ *   readonly expires_at: number; // Unix seconds.
+ * }} TsAuthImpersonationSession
+ */
+/** @typedef {{ readonly data: readonly TsAuthUser[] }} TsAuthUserPage */
+/** @typedef {{ readonly data: readonly TsAuthSession[] }} TsAuthSessionPage */
+/**
+ * @typedef {{ readonly data: readonly TsAuthMfaFactor[] }} TsAuthMfaFactorPage
+ */
+/**
+ * @typedef {{ readonly passkeys: readonly TsAuthPasskey[] }} TsAuthPasskeyPage
+ */
+/** @typedef {{ readonly data: readonly string[] }} TsAuthRecoveryCodePage */
+/**
+ * @typedef {TsAuthRequestOptions & {
+ *   readonly limit?: number | undefined; // 1 to 100; the service default is 20.
+ *   readonly startingAfter?: string | undefined;
+ * }} TsAuthUserListOptions
+ */
+/**
+ * @typedef {TsAuthRequestOptions & {
+ *   readonly pageSize?: number | undefined;
+ * }} TsAuthUserListAllOptions
+ */
+/**
+ * @typedef {{
+ *   readonly email?: string | undefined;
+ *   readonly username?: string | undefined;
+ *   readonly password?: string | undefined;
+ *   readonly name?: string | undefined;
+ * }} TsAuthCreateUserRequest
+ */
+/**
+ * Tri-state user patch: an absent field leaves the stored value unchanged, an
+ * explicit unset sends JSON null, and a with-call sends the value. Email can
+ * only be set — the service rejects `email: null` with a 400.
+ */
+export class TsAuthUserPatch {
+    /**
+     * @param {string} name
+     * @returns {this}
+     */
+    withName(name: string): this;
+    /** @returns {this} */
+    unsetName(): this;
+    /**
+     * @param {string} username
+     * @returns {this}
+     */
+    withUsername(username: string): this;
+    /** @returns {this} */
+    unsetUsername(): this;
+    /**
+     * @param {string} password
+     * @returns {this}
+     */
+    withPassword(password: string): this;
+    /** @returns {this} */
+    unsetPassword(): this;
+    /**
+     * @param {string} email
+     * @returns {this}
+     */
+    withEmail(email: string): this;
+    /**
+     * @param {boolean} banned
+     * @returns {this}
+     */
+    withBanned(banned: boolean): this;
+    /**
+     * @param {string} banReason
+     * @returns {this}
+     */
+    withBanReason(banReason: string): this;
+    /** @returns {this} */
+    unsetBanReason(): this;
+    /**
+     * @param {Record<string, unknown>} metadata
+     * @returns {this}
+     */
+    withPublicMetadata(metadata: Record<string, unknown>): this;
+    /** @returns {this} */
+    unsetPublicMetadata(): this;
+    /**
+     * @param {Record<string, unknown>} metadata
+     * @returns {this}
+     */
+    withPrivateMetadata(metadata: Record<string, unknown>): this;
+    /** @returns {this} */
+    unsetPrivateMetadata(): this;
+    /**
+     * The exact wire record: only configured fields are present.
+     * @returns {Record<string, unknown>}
+     */
+    toJSON(): Record<string, unknown>;
+    #private;
+}
+export class TsAuthUsersClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {TsAuthUserListOptions} [options={}]
+     * @returns {Promise<TerraScaleResult<TsAuthUserPage>>}
+     */
+    list(options?: TsAuthUserListOptions): Promise<TerraScaleResult<TsAuthUserPage>>;
+    /**
+     * Walks the id cursor until a short page; one request per page.
+     * @param {TsAuthUserListAllOptions} [options={}]
+     * @returns {Promise<TerraScaleResult<readonly TsAuthUser[]>>}
+     */
+    listAll(options?: TsAuthUserListAllOptions): Promise<TerraScaleResult<readonly TsAuthUser[]>>;
+    /**
+     * @param {string} userId
+     * @returns {Promise<TerraScaleResult<TsAuthUser>>}
+     */
+    get(userId: string): Promise<TerraScaleResult<TsAuthUser>>;
+    /**
+     * @param {TsAuthCreateUserRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthUser>>}
+     */
+    create(request: TsAuthCreateUserRequest): Promise<TerraScaleResult<TsAuthUser>>;
+    /**
+     * @param {string} userId
+     * @param {TsAuthUserPatch} patch
+     * @returns {Promise<TerraScaleResult<TsAuthUser>>}
+     */
+    update(userId: string, patch: TsAuthUserPatch): Promise<TerraScaleResult<TsAuthUser>>;
+    /**
+     * @param {string} userId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    delete(userId: string): Promise<TerraScaleResult<void>>;
+    /**
+     * @param {string} userId
+     * @returns {Promise<TerraScaleResult<TsAuthImpersonationSession>>}
+     */
+    impersonate(userId: string): Promise<TerraScaleResult<TsAuthImpersonationSession>>;
+    /**
+     * @param {string} userId
+     * @returns {Promise<TerraScaleResult<TsAuthSessionPage>>}
+     */
+    sessions(userId: string): Promise<TerraScaleResult<TsAuthSessionPage>>;
+    /**
+     * @param {string} userId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    revokeAllSessions(userId: string): Promise<TerraScaleResult<void>>;
+    /**
+     * @param {string} userId
+     * @returns {Promise<TerraScaleResult<TsAuthMfaFactorPage>>}
+     */
+    mfaFactors(userId: string): Promise<TerraScaleResult<TsAuthMfaFactorPage>>;
+    /**
+     * @param {string} userId
+     * @param {string} factorId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    deleteMfaFactor(userId: string, factorId: string): Promise<TerraScaleResult<void>>;
+    /**
+     * @param {string} userId
+     * @param {string} factorId
+     * @returns {Promise<TerraScaleResult<TsAuthRecoveryCodePage>>}
+     */
+    regenerateRecoveryCodes(userId: string, factorId: string): Promise<TerraScaleResult<TsAuthRecoveryCodePage>>;
+    /**
+     * @param {string} userId
+     * @returns {Promise<TerraScaleResult<TsAuthPasskeyPage>>}
+     */
+    passkeys(userId: string): Promise<TerraScaleResult<TsAuthPasskeyPage>>;
+    /**
+     * @param {string} userId
+     * @param {string} passkeyId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    deletePasskey(userId: string, passkeyId: string): Promise<TerraScaleResult<void>>;
+    /**
+     * @param {string} userId
+     * @returns {Promise<TerraScaleResult<readonly TsAuthUserOrganizationMembership[]>>}
+     */
+    organizations(userId: string): Promise<TerraScaleResult<readonly TsAuthUserOrganizationMembership[]>>;
+    #private;
+}
+export class TsAuthSessionsClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {string} sessionId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    revoke(sessionId: string): Promise<TerraScaleResult<void>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly name: string;
+ *   readonly api_key: string; // One-time full sk_ bearer; only the creating call returns it.
+ *   readonly scopes: readonly string[];
+ * }} TsAuthApiKeyWithSecret
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly name: string;
+ *   readonly scopes: readonly string[];
+ *   readonly created_at: number; // Unix seconds.
+ *   readonly last_used_at?: number | null | undefined;
+ *   readonly revoked: boolean;
+ * }} TsAuthApiKey
+ */
+/** @typedef {{ readonly data: readonly TsAuthApiKey[] }} TsAuthApiKeyPage */
+/**
+ * @typedef {{
+ *   readonly name: string;
+ *   readonly scopes?: readonly string[] | undefined;
+ * }} TsAuthCreateApiKeyRequest
+ */
+export class TsAuthApiKeysClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {TsAuthCreateApiKeyRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthApiKeyWithSecret>>}
+     */
+    create(request: TsAuthCreateApiKeyRequest): Promise<TerraScaleResult<TsAuthApiKeyWithSecret>>;
+    /** @returns {Promise<TerraScaleResult<TsAuthApiKeyPage>>} */
+    list(): Promise<TerraScaleResult<TsAuthApiKeyPage>>;
+    /**
+     * @param {string} keyId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    delete(keyId: string): Promise<TerraScaleResult<void>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly organization_id: string;
+ *   readonly user_id: string;
+ *   readonly role: string;
+ *   readonly created_at: number; // Unix seconds.
+ * }} TsAuthMembership
+ */
+/**
+ * @typedef {TsAuthMembership & {
+ *   readonly user: {
+ *     readonly id: string;
+ *     readonly email: string;
+ *     readonly name: string;
+ *   } | null;
+ * }} TsAuthMembershipWithUser
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly organization_id: string;
+ *   readonly email: string;
+ *   readonly role: string;
+ *   readonly status: string;
+ *   readonly expires_at: number; // Unix seconds.
+ *   readonly created_at: number; // Unix seconds.
+ * }} TsAuthInvitation
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly organization_id: string;
+ *   readonly domain: string;
+ *   readonly created_at: number; // Unix seconds.
+ * }} TsAuthOrganizationDomain
+ */
+/** @typedef {{ readonly org_id: string }} TsAuthDomainEnrollment */
+/**
+ * @typedef {{
+ *   readonly name: string;
+ *   readonly slug?: string | undefined;
+ * }} TsAuthCreateOrganizationRequest
+ */
+/**
+ * @typedef {{
+ *   readonly name: string;
+ * }} TsAuthUpdateOrganizationRequest
+ */
+/**
+ * @typedef {{
+ *   readonly user_id: string;
+ *   readonly role: string;
+ * }} TsAuthCreateMembershipRequest
+ */
+/**
+ * @typedef {{
+ *   readonly email: string;
+ *   readonly role: string;
+ * }} TsAuthCreateInvitationRequest
+ */
+/**
+ * @typedef {{
+ *   readonly domain: string;
+ * }} TsAuthAddDomainRequest
+ */
+/**
+ * @typedef {{
+ *   readonly user_id: string;
+ * }} TsAuthEnrollRequest
+ */
+export class TsAuthOrganizationsClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {TsAuthCreateOrganizationRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthOrganization>>}
+     */
+    create(request: TsAuthCreateOrganizationRequest): Promise<TerraScaleResult<TsAuthOrganization>>;
+    /** @returns {Promise<TerraScaleResult<readonly TsAuthOrganization[]>>} */
+    list(): Promise<TerraScaleResult<readonly TsAuthOrganization[]>>;
+    /**
+     * @param {string} organizationId
+     * @returns {Promise<TerraScaleResult<TsAuthOrganization>>}
+     */
+    get(organizationId: string): Promise<TerraScaleResult<TsAuthOrganization>>;
+    /**
+     * @param {string} organizationId
+     * @param {TsAuthUpdateOrganizationRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthOrganization>>}
+     */
+    update(organizationId: string, request: TsAuthUpdateOrganizationRequest): Promise<TerraScaleResult<TsAuthOrganization>>;
+    /**
+     * @param {string} organizationId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    delete(organizationId: string): Promise<TerraScaleResult<void>>;
+    /**
+     * @param {string} organizationId
+     * @param {TsAuthCreateMembershipRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthMembership>>}
+     */
+    createMembership(organizationId: string, request: TsAuthCreateMembershipRequest): Promise<TerraScaleResult<TsAuthMembership>>;
+    /**
+     * @param {string} organizationId
+     * @returns {Promise<TerraScaleResult<readonly TsAuthMembershipWithUser[]>>}
+     */
+    listMemberships(organizationId: string): Promise<TerraScaleResult<readonly TsAuthMembershipWithUser[]>>;
+    /**
+     * @param {string} organizationId
+     * @param {string} membershipId
+     * @param {{ readonly role: string }} request
+     * @returns {Promise<TerraScaleResult<TsAuthMembership>>}
+     */
+    updateMembership(organizationId: string, membershipId: string, request: {
+        readonly role: string;
+    }): Promise<TerraScaleResult<TsAuthMembership>>;
+    /**
+     * @param {string} organizationId
+     * @param {string} membershipId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    deleteMembership(organizationId: string, membershipId: string): Promise<TerraScaleResult<void>>;
+    /**
+     * @param {string} organizationId
+     * @param {TsAuthCreateInvitationRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthInvitation>>}
+     */
+    createInvitation(organizationId: string, request: TsAuthCreateInvitationRequest): Promise<TerraScaleResult<TsAuthInvitation>>;
+    /**
+     * @param {string} organizationId
+     * @returns {Promise<TerraScaleResult<readonly TsAuthInvitation[]>>}
+     */
+    listInvitations(organizationId: string): Promise<TerraScaleResult<readonly TsAuthInvitation[]>>;
+    /**
+     * @param {string} organizationId
+     * @param {string} invitationId
+     * @returns {Promise<TerraScaleResult<TsAuthInvitation>>}
+     */
+    revokeInvitation(organizationId: string, invitationId: string): Promise<TerraScaleResult<TsAuthInvitation>>;
+    /**
+     * @param {string} organizationId
+     * @param {TsAuthAddDomainRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthOrganizationDomain>>}
+     */
+    createDomain(organizationId: string, request: TsAuthAddDomainRequest): Promise<TerraScaleResult<TsAuthOrganizationDomain>>;
+    /**
+     * @param {string} organizationId
+     * @returns {Promise<TerraScaleResult<readonly TsAuthOrganizationDomain[]>>}
+     */
+    listDomains(organizationId: string): Promise<TerraScaleResult<readonly TsAuthOrganizationDomain[]>>;
+    /**
+     * @param {string} organizationId
+     * @param {string} domainId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    deleteDomain(organizationId: string, domainId: string): Promise<TerraScaleResult<void>>;
+    /**
+     * @param {string} domain
+     * @param {TsAuthEnrollRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthDomainEnrollment>>}
+     */
+    enrollDomain(domain: string, request: TsAuthEnrollRequest): Promise<TerraScaleResult<TsAuthDomainEnrollment>>;
+    #private;
+}
+/**
+ * @typedef {"authorization_code"
+ *   | "refresh_token"
+ *   | "client_credentials"
+ *   | "urn:ietf:params:oauth:grant-type:device_code"} TsAuthOauthGrantType
+ */
+/**
+ * @typedef {"none"
+ *   | "client_secret_post"
+ *   | "client_secret_basic"} TsAuthOauthClientAuthMethod
+ */
+/**
+ * @typedef {{
+ *   readonly name?: string | undefined;
+ *   readonly redirect_uris?: readonly string[] | undefined;
+ *   readonly post_logout_redirect_uris?: readonly string[] | undefined;
+ *   readonly public?: boolean | undefined;
+ *   readonly token_endpoint_auth_method?: TsAuthOauthClientAuthMethod | undefined;
+ *   readonly allowed_origins?: readonly string[] | undefined;
+ *   readonly allow_anonymous?: boolean | undefined;
+ *   readonly allowed_resource_audiences?: readonly string[] | undefined;
+ *   readonly allowed_scopes?: readonly string[] | undefined;
+ *   readonly allowed_grant_types?: readonly TsAuthOauthGrantType[] | undefined;
+ * }} TsAuthCreateOauthClientRequest
+ */
+/**
+ * @typedef {Omit<TsAuthCreateOauthClientRequest, "public" | "token_endpoint_auth_method"> & {
+ *   readonly expected_auth_epoch?: number | undefined;
+ *   readonly enabled?: boolean | undefined;
+ *   readonly rotate_secret?: boolean | undefined;
+ * }} TsAuthUpdateOauthClientRequest
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly client_id: string;
+ *   readonly name: string;
+ *   readonly redirect_uris: readonly string[];
+ *   readonly post_logout_redirect_uris: readonly string[];
+ *   readonly token_endpoint_auth_method: TsAuthOauthClientAuthMethod;
+ *   readonly public: boolean;
+ *   readonly allowed_origins: readonly string[];
+ *   readonly allow_anonymous: boolean;
+ *   readonly created_at: number;
+ *   readonly allowed_resource_audiences: readonly string[];
+ *   readonly allowed_scopes: readonly string[];
+ *   readonly allowed_grant_types: readonly TsAuthOauthGrantType[];
+ *   readonly auth_epoch: number; // JSON u64 values outside JavaScript's exact integer range are rejected.
+ *   readonly enabled: boolean;
+ * }} TsAuthOauthClientView
+ */
+/**
+ * @typedef {{
+ *   readonly client: TsAuthOauthClientView;
+ *   readonly client_secret: string | null;
+ * }} TsAuthOauthClientWithSecret
+ */
+/**
+ * @typedef {{
+ *   readonly clients: readonly TsAuthOauthClientView[];
+ * }} TsAuthOauthClientList
+ */
+/**
+ * @typedef {TsAuthOauthClientView
+ *   | TsAuthOauthClientWithSecret} TsAuthOauthClientUpdate
+ */
+export class TsAuthOauthClientsClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {TsAuthCreateOauthClientRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthOauthClientWithSecret>>}
+     */
+    create(request: TsAuthCreateOauthClientRequest): Promise<TerraScaleResult<TsAuthOauthClientWithSecret>>;
+    /** @returns {Promise<TerraScaleResult<TsAuthOauthClientList>>} */
+    list(): Promise<TerraScaleResult<TsAuthOauthClientList>>;
+    /**
+     * @param {string} clientId
+     * @param {TsAuthUpdateOauthClientRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthOauthClientUpdate>>}
+     */
+    update(clientId: string, request: TsAuthUpdateOauthClientRequest): Promise<TerraScaleResult<TsAuthOauthClientUpdate>>;
+    /**
+     * @param {string} clientId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    delete(clientId: string): Promise<TerraScaleResult<void>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly audience: string;
+ *   readonly allowed_client_ids: readonly string[];
+ *   readonly allowed_grant_types: readonly TsAuthOauthGrantType[];
+ *   readonly allowed_scopes: readonly string[];
+ * }} TsAuthCreateOauthResourceRequest
+ */
+/**
+ * @typedef {{
+ *   readonly expected_auth_epoch: number;
+ *   readonly allowed_client_ids?: readonly string[] | undefined;
+ *   readonly allowed_grant_types?: readonly TsAuthOauthGrantType[] | undefined;
+ *   readonly allowed_scopes?: readonly string[] | undefined;
+ *   readonly enabled?: boolean | undefined;
+ *   readonly rotate_secret?: boolean | undefined;
+ * }} TsAuthUpdateOauthResourceRequest
+ */
+/**
+ * @typedef {TsAuthCreateOauthResourceRequest & {
+ *   readonly id: string;
+ *   readonly introspection_client_id: string;
+ *   readonly token_endpoint_auth_method: "client_secret_basic";
+ *   readonly auth_epoch: number;
+ *   readonly enabled: boolean;
+ *   readonly created_at: number;
+ *   readonly updated_at: number;
+ * }} TsAuthOauthResourceView
+ */
+/**
+ * @typedef {{
+ *   readonly resource: TsAuthOauthResourceView;
+ *   readonly introspection_secret: string | null;
+ * }} TsAuthOauthResourceWithSecret
+ */
+/**
+ * @typedef {{
+ *   readonly resources: readonly TsAuthOauthResourceView[];
+ * }} TsAuthOauthResourceList
+ */
+export class TsAuthOauthResourcesClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {TsAuthCreateOauthResourceRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthOauthResourceWithSecret>>}
+     */
+    create(request: TsAuthCreateOauthResourceRequest): Promise<TerraScaleResult<TsAuthOauthResourceWithSecret>>;
+    /** @returns {Promise<TerraScaleResult<TsAuthOauthResourceList>>} */
+    list(): Promise<TerraScaleResult<TsAuthOauthResourceList>>;
+    /**
+     * @param {string} resourceId
+     * @param {TsAuthUpdateOauthResourceRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthOauthResourceWithSecret>>}
+     */
+    update(resourceId: string, request: TsAuthUpdateOauthResourceRequest): Promise<TerraScaleResult<TsAuthOauthResourceWithSecret>>;
+    /**
+     * Disables the resource; its registered identity remains reserved.
+     * @param {string} resourceId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    revoke(resourceId: string): Promise<TerraScaleResult<void>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly type: "oidc" | "saml";
+ *   readonly name: string;
+ *   readonly enabled: boolean;
+ *   readonly org_id: string | null;
+ *   readonly issuer_url: string | null;
+ *   readonly client_id: string | null;
+ *   readonly authorization_endpoint: string | null;
+ *   readonly token_endpoint: string | null;
+ *   readonly userinfo_endpoint: string | null;
+ *   readonly idp_entity_id: string | null;
+ *   readonly sso_redirect_url: string | null;
+ *   readonly sp_entity_id: string | null;
+ *   readonly created_at: number; // Unix seconds.
+ * }} TsAuthConnectionView
+ */
+/**
+ * @typedef {{
+ *       readonly type: "oidc";
+ *       readonly name: string;
+ *       readonly org_id?: string | undefined;
+ *       readonly issuer_url: string;
+ *       readonly client_id: string;
+ *       readonly client_secret: string;
+ *       readonly scopes?: readonly string[] | undefined;
+ *       readonly authorization_endpoint?: string | undefined;
+ *       readonly token_endpoint?: string | undefined;
+ *       readonly userinfo_endpoint?: string | undefined;
+ *     }
+ *   | {
+ *       readonly type: "saml";
+ *       readonly name: string;
+ *       readonly org_id?: string | undefined;
+ *       readonly idp_entity_id: string;
+ *       readonly sso_redirect_url: string;
+ *       readonly x509_certificate_pem: string;
+ *     }} TsAuthCreateConnectionRequest
+ */
+/**
+ * @typedef {{
+ *   readonly enabled?: boolean | undefined;
+ *   readonly name?: string | undefined;
+ *   readonly client_secret?: string | undefined;
+ * }} TsAuthConnectionPatch
+ */
+export class TsAuthConnectionsClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {TsAuthCreateConnectionRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthConnectionView>>}
+     */
+    create(request: TsAuthCreateConnectionRequest): Promise<TerraScaleResult<TsAuthConnectionView>>;
+    /**
+     * @returns {Promise<TerraScaleResult<{ readonly data: readonly TsAuthConnectionView[] }>>}
+     */
+    list(): Promise<TerraScaleResult<{
+        readonly data: readonly TsAuthConnectionView[];
+    }>>;
+    /**
+     * @param {string} connectionId
+     * @param {TsAuthConnectionPatch} request
+     * @returns {Promise<TerraScaleResult<TsAuthConnectionView>>}
+     */
+    update(connectionId: string, request: TsAuthConnectionPatch): Promise<TerraScaleResult<TsAuthConnectionView>>;
+    /**
+     * @param {string} connectionId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    delete(connectionId: string): Promise<TerraScaleResult<void>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly org_id: string | null;
+ *   readonly token: string; // One-time SCIM bearer; only create and rotate return it.
+ * }} TsAuthDirectoryWithToken
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly org_id: string | null;
+ *   readonly created_at: number; // Unix seconds.
+ * }} TsAuthDirectory
+ */
+export class TsAuthDirectoriesClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {{ readonly org_id?: string | undefined }} [request={}]
+     * @returns {Promise<TerraScaleResult<TsAuthDirectoryWithToken>>}
+     */
+    create(request?: {
+        readonly org_id?: string | undefined;
+    }): Promise<TerraScaleResult<TsAuthDirectoryWithToken>>;
+    /**
+     * @returns {Promise<TerraScaleResult<{ readonly data: readonly TsAuthDirectory[] }>>}
+     */
+    list(): Promise<TerraScaleResult<{
+        readonly data: readonly TsAuthDirectory[];
+    }>>;
+    /**
+     * @param {string} directoryId
+     * @returns {Promise<TerraScaleResult<TsAuthDirectoryWithToken>>}
+     */
+    rotate(directoryId: string): Promise<TerraScaleResult<TsAuthDirectoryWithToken>>;
+    /**
+     * @param {string} directoryId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    delete(directoryId: string): Promise<TerraScaleResult<void>>;
+    #private;
+}
+export class TsAuthJwtTemplatesClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {TsAuthCreateJwtTemplateRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthJwtTemplate>>}
+     */
+    create(request: TsAuthCreateJwtTemplateRequest): Promise<TerraScaleResult<TsAuthJwtTemplate>>;
+    /** @returns {Promise<TerraScaleResult<readonly TsAuthJwtTemplate[]>>} */
+    list(): Promise<TerraScaleResult<readonly TsAuthJwtTemplate[]>>;
+    /**
+     * @param {string} name
+     * @param {TsAuthUpdateJwtTemplateRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthJwtTemplate>>}
+     */
+    update(name: string, request: TsAuthUpdateJwtTemplateRequest): Promise<TerraScaleResult<TsAuthJwtTemplate>>;
+    /**
+     * @param {string} name
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    delete(name: string): Promise<TerraScaleResult<void>>;
+    /**
+     * @param {string} name
+     * @param {{ readonly user_id: string }} request
+     * @returns {Promise<TerraScaleResult<TsAuthJwtTokenResponse>>}
+     */
+    issueToken(name: string, request: {
+        readonly user_id: string;
+    }): Promise<TerraScaleResult<TsAuthJwtTokenResponse>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly url: string;
+ *   readonly events: readonly string[];
+ *   readonly signing_secret: string; // One-time HMAC key for verifying deliveries; only create returns it.
+ * }} TsAuthWebhookWithSecret
+ */
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly url: string;
+ *   readonly events: readonly string[];
+ *   readonly enabled: boolean;
+ *   readonly created_at: number; // Unix seconds.
+ * }} TsAuthWebhook
+ */
+/**
+ * @typedef {{
+ *   readonly id: string; // endpointId:eventId
+ *   readonly endpoint_id: string;
+ *   readonly event_id: string;
+ *   readonly attempts: number;
+ *   readonly last_error?: string | undefined;
+ *   readonly updated_at: number; // Unix seconds.
+ * }} TsAuthDeadLetterEntry
+ */
+export class TsAuthWebhooksClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {{ readonly url: string; readonly events: readonly string[] }} request
+     * @returns {Promise<TerraScaleResult<TsAuthWebhookWithSecret>>}
+     */
+    create(request: {
+        readonly url: string;
+        readonly events: readonly string[];
+    }): Promise<TerraScaleResult<TsAuthWebhookWithSecret>>;
+    /** @returns {Promise<TerraScaleResult<readonly TsAuthWebhook[]>>} */
+    list(): Promise<TerraScaleResult<readonly TsAuthWebhook[]>>;
+    /**
+     * @param {string} webhookId
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    delete(webhookId: string): Promise<TerraScaleResult<void>>;
+    /**
+     * @param {string} webhookId
+     * @returns {Promise<TerraScaleResult<{ readonly queued: boolean }>>}
+     */
+    test(webhookId: string): Promise<TerraScaleResult<{
+        readonly queued: boolean;
+    }>>;
+    /** @returns {Promise<TerraScaleResult<readonly TsAuthDeadLetterEntry[]>>} */
+    deadLetter(): Promise<TerraScaleResult<readonly TsAuthDeadLetterEntry[]>>;
+    /**
+     * @param {string} entryId
+     * @returns {Promise<TerraScaleResult<{ readonly replayed: boolean }>>}
+     */
+    replayDeadLetter(entryId: string): Promise<TerraScaleResult<{
+        readonly replayed: boolean;
+    }>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly instance_id: string;
+ *   readonly type: string;
+ *   readonly actor_id?: string | undefined; // Omitted from the wire when null.
+ *   readonly data: Record<string, unknown>;
+ *   readonly created_at: number; // Unix seconds.
+ *   readonly integrity_version: number;
+ *   readonly integrity_hash: string;
+ *   readonly integrity_signature: string | null; // Both are null when the instance has no audit signing key.
+ *   readonly integrity_key_fingerprint: string | null;
+ * }} TsAuthAuditEvent
+ */
+export class TsAuthAuditEventsClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * @param {TsAuthRequestOptions & { readonly limit?: number | undefined }} [options={}]
+     * @returns {Promise<TerraScaleResult<readonly TsAuthAuditEvent[]>>}
+     */
+    list(options?: TsAuthRequestOptions & {
+        readonly limit?: number | undefined;
+    }): Promise<TerraScaleResult<readonly TsAuthAuditEvent[]>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly plan: "free" | "pro" | "enterprise";
+ *   readonly status: string;
+ *   readonly stripe_customer_id?: string | undefined;
+ *   readonly stripe_subscription_id?: string | undefined;
+ *   readonly current_period_end?: number | undefined;
+ *   readonly user_count: number;
+ *   readonly quota: number;
+ * }} TsAuthBillingOverview
+ */
+export class TsAuthBillingClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /** @returns {Promise<TerraScaleResult<TsAuthBillingOverview>>} */
+    get(): Promise<TerraScaleResult<TsAuthBillingOverview>>;
+    /**
+     * @param {{ readonly plan: "pro" | "enterprise" }} request
+     * @returns {Promise<TerraScaleResult<{ readonly checkout_url: string }>>}
+     */
+    checkout(request: {
+        readonly plan: "pro" | "enterprise";
+    }): Promise<TerraScaleResult<{
+        readonly checkout_url: string;
+    }>>;
+    /** @returns {Promise<TerraScaleResult<{ readonly portal_url: string }>>} */
+    portal(): Promise<TerraScaleResult<{
+        readonly portal_url: string;
+    }>>;
+    /**
+     * @param {{ readonly current_users: number }} request
+     * @returns {Promise<TerraScaleResult<{ readonly allowed: boolean; readonly plan: string; readonly quota: number }>>}
+     */
+    enforceCheck(request: {
+        readonly current_users: number;
+    }): Promise<TerraScaleResult<{
+        readonly allowed: boolean;
+        readonly plan: string;
+        readonly quota: number;
+    }>>;
+    /**
+     * @returns {Promise<TerraScaleResult<{ readonly claims_examined: number; readonly claims_removed: number; readonly claims_retained: number }>>}
+     */
+    reconcileQuota(): Promise<TerraScaleResult<{
+        readonly claims_examined: number;
+        readonly claims_removed: number;
+        readonly claims_retained: number;
+    }>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly id: string;
+ *   readonly slug: string;
+ *   readonly name: string;
+ *   readonly logo_url?: string | null | undefined;
+ *   readonly theme_color?: string | null | undefined;
+ *   readonly created_at: number; // Unix seconds.
+ * }} TsAuthInstance
+ */
+/**
+ * The PATCH response omits created_at.
+ * @typedef {Omit<TsAuthInstance, "created_at">} TsAuthInstanceUpdateResponse
+ */
+/**
+ * Absent leaves the stored value unchanged; the service treats null the same as absent.
+ * @typedef {{
+ *   readonly name?: string | undefined;
+ *   readonly logo_url?: string | undefined;
+ *   readonly theme_color?: string | undefined;
+ * }} TsAuthInstanceUpdateRequest
+ */
+export class TsAuthInstanceClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /** @returns {Promise<TerraScaleResult<TsAuthInstance>>} */
+    get(): Promise<TerraScaleResult<TsAuthInstance>>;
+    /**
+     * @param {TsAuthInstanceUpdateRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthInstanceUpdateResponse>>}
+     */
+    update(request: TsAuthInstanceUpdateRequest): Promise<TerraScaleResult<TsAuthInstanceUpdateResponse>>;
+    #private;
+}
+/**
+ * @typedef {{
+ *   readonly issuer: string;
+ *   readonly authorization_endpoint: string;
+ *   readonly token_endpoint: string;
+ *   readonly userinfo_endpoint: string;
+ *   readonly jwks_uri: string;
+ *   readonly revocation_endpoint: string;
+ *   readonly introspection_endpoint: string;
+ *   readonly device_authorization_endpoint: string;
+ *   readonly end_session_endpoint: string;
+ *   readonly response_types_supported: readonly string[];
+ *   readonly grant_types_supported: readonly string[];
+ *   readonly code_challenge_methods_supported: readonly string[];
+ *   readonly subject_types_supported: readonly string[];
+ *   readonly id_token_signing_alg_values_supported: readonly string[];
+ *   readonly token_endpoint_auth_methods_supported: readonly string[];
+ *   readonly scopes_supported: readonly string[];
+ * }} TsAuthOidcDiscovery
+ */
+/**
+ * @typedef {{
+ *   readonly kty: "EC";
+ *   readonly crv: "P-256";
+ *   readonly alg: "ES256";
+ *   readonly use: "sig";
+ *   readonly kid: string;
+ *   readonly x: string;
+ *   readonly y: string;
+ * }} TsAuthOidcJwk
+ */
+/** @typedef {{ readonly keys: readonly TsAuthOidcJwk[] }} TsAuthOidcJwks */
+/**
+ * @typedef {{
+ *   readonly client_id: string;
+ *   readonly redirect_uri: string;
+ *   readonly response_type: "code";
+ *   readonly scope?: string | undefined;
+ *   readonly resource?: string | undefined;
+ *   readonly state?: string | undefined;
+ *   readonly nonce?: string | undefined;
+ *   readonly code_challenge?: string | undefined;
+ *   readonly code_challenge_method?: "S256" | undefined;
+ *   readonly prompt?:
+ *     | "none"
+ *     | "login"
+ *     | "consent"
+ *     | "login consent"
+ *     | "consent login"
+ *     | undefined;
+ * }} TsAuthOidcAuthorizationRequest
+ */
+/**
+ * @typedef {{
+ *   readonly scope?: string | undefined;
+ *   readonly resource?: string | undefined;
+ * }} TsAuthOidcDeviceAuthorizationRequest
+ */
+/**
+ * @typedef {{
+ *   readonly device_code: string;
+ *   readonly user_code: string;
+ *   readonly verification_uri: string;
+ *   readonly verification_uri_complete: string;
+ *   readonly expires_in: number;
+ *   readonly interval: number;
+ * }} TsAuthOidcDeviceAuthorizationResponse
+ */
+/**
+ * @typedef {{
+ *       readonly grant_type: "authorization_code";
+ *       readonly code: string;
+ *       readonly redirect_uri: string;
+ *       readonly code_verifier?: string | undefined;
+ *       readonly resource?: string | undefined;
+ *     }
+ *   | {
+ *       readonly grant_type: "refresh_token";
+ *       readonly refresh_token: string;
+ *       readonly scope?: string | undefined;
+ *       readonly resource?: string | undefined;
+ *     }
+ *   | {
+ *       readonly grant_type: "client_credentials";
+ *       readonly scope: string;
+ *       readonly resource: string;
+ *     }
+ *   | {
+ *       readonly grant_type: "urn:ietf:params:oauth:grant-type:device_code";
+ *       readonly device_code: string;
+ *       readonly resource?: string | undefined;
+ *     }} TsAuthOidcTokenRequest
+ */
+/**
+ * @typedef {{
+ *   readonly access_token: string;
+ *   readonly token_type: "Bearer";
+ *   readonly expires_in: number;
+ *   readonly scope: string;
+ *   readonly refresh_token?: string | null | undefined; // Omitted for client_credentials; nullable for user code/device issuance.
+ *   readonly id_token?: string | undefined; // Present only on code/device issuance with openid scope; omitted on refresh.
+ * }} TsAuthOidcTokenResponse
+ */
+/** @typedef {{ readonly active: false }} TsAuthOidcInactiveIntrospection */
+/**
+ * @typedef {{
+ *   readonly active: true;
+ *   readonly token_type: "Bearer";
+ *   readonly iss: string;
+ *   readonly sub: string;
+ *   readonly aud: string;
+ *   readonly client_id: string;
+ *   readonly scope: string;
+ *   readonly exp: number;
+ *   readonly iat: number;
+ *   readonly sid: string | null;
+ *   readonly principal_kind: "user" | "service";
+ * }} TsAuthOidcAccessIntrospection
+ */
+/**
+ * @typedef {Omit<TsAuthOidcAccessIntrospection, "token_type" | "principal_kind"> & {
+ *   readonly token_type: "refresh_token";
+ *   readonly family_id: string;
+ * }} TsAuthOidcRefreshIntrospection
+ */
+/**
+ * @typedef {TsAuthOidcInactiveIntrospection
+ *   | TsAuthOidcAccessIntrospection
+ *   | TsAuthOidcRefreshIntrospection} TsAuthOidcIntrospection
+ */
+/**
+ * @typedef {Omit<TsAuthOidcAccessIntrospection, "sid" | "principal_kind"> &
+ *   (
+ *     | { readonly principal_kind: "user"; readonly sid: string }
+ *     | { readonly principal_kind: "service"; readonly sid: null }
+ *   )} TsAuthOidcResourceAccessIntrospection
+ */
+/**
+ * @typedef {TsAuthOidcInactiveIntrospection
+ *   | TsAuthOidcResourceAccessIntrospection} TsAuthOidcResourceIntrospection
+ */
+/**
+ * @typedef {{
+ *   readonly issuer: string; // Configured canonical provider issuer, independently trusted by the caller.
+ *   readonly audience: string; // Exact registered resource URI; never derived from the response.
+ *   readonly introspection_client_id: string;
+ *   readonly introspection_secret: string;
+ * }} TsAuthOidcResourceCredentials
+ */
+/**
+ * @typedef {{
+ *   readonly sub: string;
+ *   readonly email?: string | undefined;
+ *   readonly email_verified?: boolean | undefined;
+ *   readonly name?: string | undefined;
+ * }} TsAuthOidcUserInfo
+ */
+export class TsAuthOidcClient {
+    /**
+     * @param {TsAuthHttp} http
+     * @param {string} instanceSlug
+     */
+    constructor(http: TsAuthHttp, instanceSlug: string);
+    /**
+     * Public discovery document; sent without any authorization header.
+     * @returns {Promise<TerraScaleResult<TsAuthOidcDiscovery>>}
+     */
+    discovery(): Promise<TerraScaleResult<TsAuthOidcDiscovery>>;
+    /**
+     * Public signing keys; sent without any authorization header.
+     * @returns {Promise<TerraScaleResult<TsAuthOidcJwks>>}
+     */
+    jwks(): Promise<TerraScaleResult<TsAuthOidcJwks>>;
+    /**
+     * Builds the named authorize URL without dispatching or changing resource bytes.
+     * @param {TsAuthOidcAuthorizationRequest} request
+     * @returns {URL}
+     */
+    authorizationUrl(request: TsAuthOidcAuthorizationRequest): URL;
+    /**
+     * Explicit client_secret_post device flow; polling is caller-controlled.
+     * @param {string} clientId
+     * @param {string} clientSecret
+     * @param {TsAuthOidcDeviceAuthorizationRequest} [request={}]
+     * @returns {Promise<TerraScaleResult<TsAuthOidcDeviceAuthorizationResponse>>}
+     */
+    deviceAuthorization(clientId: string, clientSecret: string, request?: TsAuthOidcDeviceAuthorizationRequest): Promise<TerraScaleResult<TsAuthOidcDeviceAuthorizationResponse>>;
+    /**
+     * client_secret_post only. Omitted resource retains the stored code/device/refresh binding.
+     * @param {string} clientId
+     * @param {string} clientSecret
+     * @param {TsAuthOidcTokenRequest} request
+     * @returns {Promise<TerraScaleResult<TsAuthOidcTokenResponse>>}
+     */
+    token(clientId: string, clientSecret: string, request: TsAuthOidcTokenRequest): Promise<TerraScaleResult<TsAuthOidcTokenResponse>>;
+    /**
+     * Originating-client client_secret_post introspection, including browser refresh tokens.
+     * @param {string} clientId
+     * @param {string} clientSecret
+     * @param {string} token
+     * @returns {Promise<TerraScaleResult<TsAuthOidcIntrospection>>}
+     */
+    introspect(clientId: string, clientSecret: string, token: string): Promise<TerraScaleResult<TsAuthOidcIntrospection>>;
+    /**
+     * Resource Basic-only access-token introspection. Acceptance checks exact issuer/audience,
+     * current local time and principal/session shape; product ownership stays caller-owned.
+     * @param {TsAuthOidcResourceCredentials} credentials
+     * @param {string} token
+     * @param {"access_token"} [tokenTypeHint]
+     * @returns {Promise<TerraScaleResult<TsAuthOidcResourceIntrospection>>}
+     */
+    introspectResource(credentials: TsAuthOidcResourceCredentials, token: string, tokenTypeHint?: "access_token"): Promise<TerraScaleResult<TsAuthOidcResourceIntrospection>>;
+    /**
+     * RFC 7009 semantics: the service answers 200 with an empty body even for
+     * unknown tokens, so success carries no payload.
+     * @param {string} clientId
+     * @param {string} clientSecret
+     * @param {string} token
+     * @returns {Promise<TerraScaleResult<void>>}
+     */
+    revoke(clientId: string, clientSecret: string, token: string): Promise<TerraScaleResult<void>>;
+    /**
+     * Bearer access token issued by the token endpoint, not the sk_ key.
+     * @param {string} accessToken
+     * @returns {Promise<TerraScaleResult<TsAuthOidcUserInfo>>}
+     */
+    userinfo(accessToken: string): Promise<TerraScaleResult<TsAuthOidcUserInfo>>;
+    #private;
+}
+/** The ts-auth management client: one hosted identity instance. */
+export class TsAuthClient {
+    /** @param {TsAuthClientConfig} config */
+    constructor(config: TsAuthClientConfig);
+    /**
+     * @type {TsAuthUsersClient}
+     * @readonly
+     */
+    readonly users: TsAuthUsersClient;
+    /**
+     * @type {TsAuthSessionsClient}
+     * @readonly
+     */
+    readonly sessions: TsAuthSessionsClient;
+    /**
+     * @type {TsAuthApiKeysClient}
+     * @readonly
+     */
+    readonly apiKeys: TsAuthApiKeysClient;
+    /**
+     * @type {TsAuthOrganizationsClient}
+     * @readonly
+     */
+    readonly organizations: TsAuthOrganizationsClient;
+    /**
+     * @type {TsAuthConnectionsClient}
+     * @readonly
+     */
+    readonly connections: TsAuthConnectionsClient;
+    /**
+     * @type {TsAuthDirectoriesClient}
+     * @readonly
+     */
+    readonly directories: TsAuthDirectoriesClient;
+    /**
+     * @type {TsAuthJwtTemplatesClient}
+     * @readonly
+     */
+    readonly jwtTemplates: TsAuthJwtTemplatesClient;
+    /**
+     * @type {TsAuthWebhooksClient}
+     * @readonly
+     */
+    readonly webhooks: TsAuthWebhooksClient;
+    /**
+     * @type {TsAuthAuditEventsClient}
+     * @readonly
+     */
+    readonly auditEvents: TsAuthAuditEventsClient;
+    /**
+     * @type {TsAuthBillingClient}
+     * @readonly
+     */
+    readonly billing: TsAuthBillingClient;
+    /**
+     * @type {TsAuthInstanceClient}
+     * @readonly
+     */
+    readonly instance: TsAuthInstanceClient;
+    /**
+     * @type {TsAuthOauthClientsClient}
+     * @readonly
+     */
+    readonly oauthClients: TsAuthOauthClientsClient;
+    /**
+     * @type {TsAuthOauthResourcesClient}
+     * @readonly
+     */
+    readonly oauthResources: TsAuthOauthResourcesClient;
+    /**
+     * @type {TsAuthOidcClient}
+     * @readonly
+     */
+    readonly oidc: TsAuthOidcClient;
+    get config(): import("./config.js").ResolvedTsAuthRuntimeConfig;
+    #private;
+}
+export type TsAuthRuntimeConfig = import("./config.js").TsAuthRuntimeConfig;
+/**
+ * ts-auth is a separate hosted IdP service on its own origin. This client
+ * speaks that service's published management and OIDC contract, which mirrors
+ * the ts-auth service routes — not the TerraScale product /api/v1 producer
+ * contract. The deployment's public origin is `apiBaseUrl` and the instance
+ * `sk_` management key is `accessToken`.
+ */
+export type TsAuthClientConfig = Omit<TsAuthRuntimeConfig, "apiBaseUrl"> & {
+    readonly apiBaseUrl: string;
+    readonly instanceSlug: string;
+    readonly useReverseProxy?: boolean;
+};
+export type TsAuthRequestOptions = {
+    readonly signal?: AbortSignal | undefined;
+};
+export type TsAuthUser = {
+    readonly id: string;
+    readonly email: string | null;
+    readonly email_verified: boolean;
+    readonly username: string | null;
+    readonly name: string | null;
+    readonly banned: boolean;
+    readonly ban_reason?: string | null | undefined;
+    readonly created_at: number;
+    readonly last_sign_in_at?: number | null | undefined;
+    readonly public_metadata: Record<string, unknown>;
+    readonly private_metadata?: Record<string, unknown> | undefined;
+};
+export type TsAuthSession = {
+    readonly id: string;
+    readonly status: string;
+    readonly created_at: number;
+    readonly expires_at: number;
+    readonly last_active_at?: number | null | undefined;
+    readonly user_agent?: string | null | undefined;
+    readonly ip_address?: string | null | undefined;
+};
+export type TsAuthMfaFactor = {
+    readonly id: string;
+    readonly type: string;
+    readonly confirmed: boolean;
+    readonly createdAt: number;
+};
+export type TsAuthPasskey = {
+    readonly id: string;
+    readonly nickname: string | null;
+    readonly algorithm: string;
+    readonly createdAt: number;
+    readonly lastUsedAt: number | null;
+};
+export type TsAuthOrganization = {
+    readonly id: string;
+    readonly name: string;
+    readonly slug: string;
+    readonly created_at: number;
+};
+export type TsAuthUserOrganizationMembership = {
+    readonly id: string;
+    readonly role: string;
+    readonly created_at: number;
+    readonly organization: TsAuthOrganization | null;
+};
+export type TsAuthImpersonationSession = {
+    readonly token: string;
+    readonly expires_at: number;
+};
+export type TsAuthUserPage = {
+    readonly data: readonly TsAuthUser[];
+};
+export type TsAuthSessionPage = {
+    readonly data: readonly TsAuthSession[];
+};
+export type TsAuthMfaFactorPage = {
+    readonly data: readonly TsAuthMfaFactor[];
+};
+export type TsAuthPasskeyPage = {
+    readonly passkeys: readonly TsAuthPasskey[];
+};
+export type TsAuthRecoveryCodePage = {
+    readonly data: readonly string[];
+};
+export type TsAuthUserListOptions = TsAuthRequestOptions & {
+    readonly limit?: number | undefined;
+    readonly startingAfter?: string | undefined;
+};
+export type TsAuthUserListAllOptions = TsAuthRequestOptions & {
+    readonly pageSize?: number | undefined;
+};
+export type TsAuthCreateUserRequest = {
+    readonly email?: string | undefined;
+    readonly username?: string | undefined;
+    readonly password?: string | undefined;
+    readonly name?: string | undefined;
+};
+export type TsAuthApiKeyWithSecret = {
+    readonly id: string;
+    readonly name: string;
+    readonly api_key: string;
+    readonly scopes: readonly string[];
+};
+export type TsAuthApiKey = {
+    readonly id: string;
+    readonly name: string;
+    readonly scopes: readonly string[];
+    readonly created_at: number;
+    readonly last_used_at?: number | null | undefined;
+    readonly revoked: boolean;
+};
+export type TsAuthApiKeyPage = {
+    readonly data: readonly TsAuthApiKey[];
+};
+export type TsAuthCreateApiKeyRequest = {
+    readonly name: string;
+    readonly scopes?: readonly string[] | undefined;
+};
+export type TsAuthMembership = {
+    readonly id: string;
+    readonly organization_id: string;
+    readonly user_id: string;
+    readonly role: string;
+    readonly created_at: number;
+};
+export type TsAuthMembershipWithUser = TsAuthMembership & {
+    readonly user: {
+        readonly id: string;
+        readonly email: string;
+        readonly name: string;
+    } | null;
+};
+export type TsAuthInvitation = {
+    readonly id: string;
+    readonly organization_id: string;
+    readonly email: string;
+    readonly role: string;
+    readonly status: string;
+    readonly expires_at: number;
+    readonly created_at: number;
+};
+export type TsAuthOrganizationDomain = {
+    readonly id: string;
+    readonly organization_id: string;
+    readonly domain: string;
+    readonly created_at: number;
+};
+export type TsAuthDomainEnrollment = {
+    readonly org_id: string;
+};
+export type TsAuthCreateOrganizationRequest = {
+    readonly name: string;
+    readonly slug?: string | undefined;
+};
+export type TsAuthUpdateOrganizationRequest = {
+    readonly name: string;
+};
+export type TsAuthCreateMembershipRequest = {
+    readonly user_id: string;
+    readonly role: string;
+};
+export type TsAuthCreateInvitationRequest = {
+    readonly email: string;
+    readonly role: string;
+};
+export type TsAuthAddDomainRequest = {
+    readonly domain: string;
+};
+export type TsAuthEnrollRequest = {
+    readonly user_id: string;
+};
+export type TsAuthOauthGrantType = "authorization_code" | "refresh_token" | "client_credentials" | "urn:ietf:params:oauth:grant-type:device_code";
+export type TsAuthOauthClientAuthMethod = "none" | "client_secret_post" | "client_secret_basic";
+export type TsAuthCreateOauthClientRequest = {
+    readonly name?: string | undefined;
+    readonly redirect_uris?: readonly string[] | undefined;
+    readonly post_logout_redirect_uris?: readonly string[] | undefined;
+    readonly public?: boolean | undefined;
+    readonly token_endpoint_auth_method?: TsAuthOauthClientAuthMethod | undefined;
+    readonly allowed_origins?: readonly string[] | undefined;
+    readonly allow_anonymous?: boolean | undefined;
+    readonly allowed_resource_audiences?: readonly string[] | undefined;
+    readonly allowed_scopes?: readonly string[] | undefined;
+    readonly allowed_grant_types?: readonly TsAuthOauthGrantType[] | undefined;
+};
+export type TsAuthUpdateOauthClientRequest = Omit<TsAuthCreateOauthClientRequest, "public" | "token_endpoint_auth_method"> & {
+    readonly expected_auth_epoch?: number | undefined;
+    readonly enabled?: boolean | undefined;
+    readonly rotate_secret?: boolean | undefined;
+};
+export type TsAuthOauthClientView = {
+    readonly id: string;
+    readonly client_id: string;
+    readonly name: string;
+    readonly redirect_uris: readonly string[];
+    readonly post_logout_redirect_uris: readonly string[];
+    readonly token_endpoint_auth_method: TsAuthOauthClientAuthMethod;
+    readonly public: boolean;
+    readonly allowed_origins: readonly string[];
+    readonly allow_anonymous: boolean;
+    readonly created_at: number;
+    readonly allowed_resource_audiences: readonly string[];
+    readonly allowed_scopes: readonly string[];
+    readonly allowed_grant_types: readonly TsAuthOauthGrantType[];
+    readonly auth_epoch: number;
+    readonly enabled: boolean;
+};
+export type TsAuthOauthClientWithSecret = {
+    readonly client: TsAuthOauthClientView;
+    readonly client_secret: string | null;
+};
+export type TsAuthOauthClientList = {
+    readonly clients: readonly TsAuthOauthClientView[];
+};
+export type TsAuthOauthClientUpdate = TsAuthOauthClientView | TsAuthOauthClientWithSecret;
+export type TsAuthCreateOauthResourceRequest = {
+    readonly audience: string;
+    readonly allowed_client_ids: readonly string[];
+    readonly allowed_grant_types: readonly TsAuthOauthGrantType[];
+    readonly allowed_scopes: readonly string[];
+};
+export type TsAuthUpdateOauthResourceRequest = {
+    readonly expected_auth_epoch: number;
+    readonly allowed_client_ids?: readonly string[] | undefined;
+    readonly allowed_grant_types?: readonly TsAuthOauthGrantType[] | undefined;
+    readonly allowed_scopes?: readonly string[] | undefined;
+    readonly enabled?: boolean | undefined;
+    readonly rotate_secret?: boolean | undefined;
+};
+export type TsAuthOauthResourceView = TsAuthCreateOauthResourceRequest & {
+    readonly id: string;
+    readonly introspection_client_id: string;
+    readonly token_endpoint_auth_method: "client_secret_basic";
+    readonly auth_epoch: number;
+    readonly enabled: boolean;
+    readonly created_at: number;
+    readonly updated_at: number;
+};
+export type TsAuthOauthResourceWithSecret = {
+    readonly resource: TsAuthOauthResourceView;
+    readonly introspection_secret: string | null;
+};
+export type TsAuthOauthResourceList = {
+    readonly resources: readonly TsAuthOauthResourceView[];
+};
+export type TsAuthConnectionView = {
+    readonly id: string;
+    readonly type: "oidc" | "saml";
+    readonly name: string;
+    readonly enabled: boolean;
+    readonly org_id: string | null;
+    readonly issuer_url: string | null;
+    readonly client_id: string | null;
+    readonly authorization_endpoint: string | null;
+    readonly token_endpoint: string | null;
+    readonly userinfo_endpoint: string | null;
+    readonly idp_entity_id: string | null;
+    readonly sso_redirect_url: string | null;
+    readonly sp_entity_id: string | null;
+    readonly created_at: number;
+};
+export type TsAuthCreateConnectionRequest = {
+    readonly type: "oidc";
+    readonly name: string;
+    readonly org_id?: string | undefined;
+    readonly issuer_url: string;
+    readonly client_id: string;
+    readonly client_secret: string;
+    readonly scopes?: readonly string[] | undefined;
+    readonly authorization_endpoint?: string | undefined;
+    readonly token_endpoint?: string | undefined;
+    readonly userinfo_endpoint?: string | undefined;
+} | {
+    readonly type: "saml";
+    readonly name: string;
+    readonly org_id?: string | undefined;
+    readonly idp_entity_id: string;
+    readonly sso_redirect_url: string;
+    readonly x509_certificate_pem: string;
+};
+export type TsAuthConnectionPatch = {
+    readonly enabled?: boolean | undefined;
+    readonly name?: string | undefined;
+    readonly client_secret?: string | undefined;
+};
+export type TsAuthDirectoryWithToken = {
+    readonly id: string;
+    readonly org_id: string | null;
+    readonly token: string;
+};
+export type TsAuthDirectory = {
+    readonly id: string;
+    readonly org_id: string | null;
+    readonly created_at: number;
+};
+export type TsAuthJwtTemplate = {
+    readonly id: string;
+    readonly name: string;
+    readonly claims: Record<string, string>;
+    readonly lifetime_seconds: number;
+    readonly created_at: number;
+};
+export type TsAuthJwtTokenResponse = {
+    readonly jwt: string;
+};
+export type TsAuthCreateJwtTemplateRequest = {
+    readonly name: string;
+    readonly claims: Record<string, string>;
+    readonly lifetime_seconds?: number | undefined;
+};
+export type TsAuthUpdateJwtTemplateRequest = {
+    readonly name?: string | undefined;
+    readonly claims?: Record<string, string> | undefined;
+    readonly lifetime_seconds?: number | undefined;
+};
+export type TsAuthWebhookWithSecret = {
+    readonly id: string;
+    readonly url: string;
+    readonly events: readonly string[];
+    readonly signing_secret: string;
+};
+export type TsAuthWebhook = {
+    readonly id: string;
+    readonly url: string;
+    readonly events: readonly string[];
+    readonly enabled: boolean;
+    readonly created_at: number;
+};
+export type TsAuthDeadLetterEntry = {
+    readonly id: string;
+    readonly endpoint_id: string;
+    readonly event_id: string;
+    readonly attempts: number;
+    readonly last_error?: string | undefined;
+    readonly updated_at: number;
+};
+export type TsAuthAuditEvent = {
+    readonly id: string;
+    readonly instance_id: string;
+    readonly type: string;
+    readonly actor_id?: string | undefined;
+    readonly data: Record<string, unknown>;
+    readonly created_at: number;
+    readonly integrity_version: number;
+    readonly integrity_hash: string;
+    readonly integrity_signature: string | null;
+    readonly integrity_key_fingerprint: string | null;
+};
+export type TsAuthBillingOverview = {
+    readonly plan: "free" | "pro" | "enterprise";
+    readonly status: string;
+    readonly stripe_customer_id?: string | undefined;
+    readonly stripe_subscription_id?: string | undefined;
+    readonly current_period_end?: number | undefined;
+    readonly user_count: number;
+    readonly quota: number;
+};
+export type TsAuthInstance = {
+    readonly id: string;
+    readonly slug: string;
+    readonly name: string;
+    readonly logo_url?: string | null | undefined;
+    readonly theme_color?: string | null | undefined;
+    readonly created_at: number;
+};
+/**
+ * The PATCH response omits created_at.
+ */
+export type TsAuthInstanceUpdateResponse = Omit<TsAuthInstance, "created_at">;
+/**
+ * Absent leaves the stored value unchanged; the service treats null the same as absent.
+ */
+export type TsAuthInstanceUpdateRequest = {
+    readonly name?: string | undefined;
+    readonly logo_url?: string | undefined;
+    readonly theme_color?: string | undefined;
+};
+export type TsAuthOidcDiscovery = {
+    readonly issuer: string;
+    readonly authorization_endpoint: string;
+    readonly token_endpoint: string;
+    readonly userinfo_endpoint: string;
+    readonly jwks_uri: string;
+    readonly revocation_endpoint: string;
+    readonly introspection_endpoint: string;
+    readonly device_authorization_endpoint: string;
+    readonly end_session_endpoint: string;
+    readonly response_types_supported: readonly string[];
+    readonly grant_types_supported: readonly string[];
+    readonly code_challenge_methods_supported: readonly string[];
+    readonly subject_types_supported: readonly string[];
+    readonly id_token_signing_alg_values_supported: readonly string[];
+    readonly token_endpoint_auth_methods_supported: readonly string[];
+    readonly scopes_supported: readonly string[];
+};
+export type TsAuthOidcJwk = {
+    readonly kty: "EC";
+    readonly crv: "P-256";
+    readonly alg: "ES256";
+    readonly use: "sig";
+    readonly kid: string;
+    readonly x: string;
+    readonly y: string;
+};
+export type TsAuthOidcJwks = {
+    readonly keys: readonly TsAuthOidcJwk[];
+};
+export type TsAuthOidcAuthorizationRequest = {
+    readonly client_id: string;
+    readonly redirect_uri: string;
+    readonly response_type: "code";
+    readonly scope?: string | undefined;
+    readonly resource?: string | undefined;
+    readonly state?: string | undefined;
+    readonly nonce?: string | undefined;
+    readonly code_challenge?: string | undefined;
+    readonly code_challenge_method?: "S256" | undefined;
+    readonly prompt?: "none" | "login" | "consent" | "login consent" | "consent login" | undefined;
+};
+export type TsAuthOidcDeviceAuthorizationRequest = {
+    readonly scope?: string | undefined;
+    readonly resource?: string | undefined;
+};
+export type TsAuthOidcDeviceAuthorizationResponse = {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete: string;
+    readonly expires_in: number;
+    readonly interval: number;
+};
+export type TsAuthOidcTokenRequest = {
+    readonly grant_type: "authorization_code";
+    readonly code: string;
+    readonly redirect_uri: string;
+    readonly code_verifier?: string | undefined;
+    readonly resource?: string | undefined;
+} | {
+    readonly grant_type: "refresh_token";
+    readonly refresh_token: string;
+    readonly scope?: string | undefined;
+    readonly resource?: string | undefined;
+} | {
+    readonly grant_type: "client_credentials";
+    readonly scope: string;
+    readonly resource: string;
+} | {
+    readonly grant_type: "urn:ietf:params:oauth:grant-type:device_code";
+    readonly device_code: string;
+    readonly resource?: string | undefined;
+};
+export type TsAuthOidcTokenResponse = {
+    readonly access_token: string;
+    readonly token_type: "Bearer";
+    readonly expires_in: number;
+    readonly scope: string;
+    readonly refresh_token?: string | null | undefined;
+    readonly id_token?: string | undefined;
+};
+export type TsAuthOidcInactiveIntrospection = {
+    readonly active: false;
+};
+export type TsAuthOidcAccessIntrospection = {
+    readonly active: true;
+    readonly token_type: "Bearer";
+    readonly iss: string;
+    readonly sub: string;
+    readonly aud: string;
+    readonly client_id: string;
+    readonly scope: string;
+    readonly exp: number;
+    readonly iat: number;
+    readonly sid: string | null;
+    readonly principal_kind: "user" | "service";
+};
+export type TsAuthOidcRefreshIntrospection = Omit<TsAuthOidcAccessIntrospection, "token_type" | "principal_kind"> & {
+    readonly token_type: "refresh_token";
+    readonly family_id: string;
+};
+export type TsAuthOidcIntrospection = TsAuthOidcInactiveIntrospection | TsAuthOidcAccessIntrospection | TsAuthOidcRefreshIntrospection;
+export type TsAuthOidcResourceAccessIntrospection = Omit<TsAuthOidcAccessIntrospection, "sid" | "principal_kind"> & ({
+    readonly principal_kind: "user";
+    readonly sid: string;
+} | {
+    readonly principal_kind: "service";
+    readonly sid: null;
+});
+export type TsAuthOidcResourceIntrospection = TsAuthOidcInactiveIntrospection | TsAuthOidcResourceAccessIntrospection;
+export type TsAuthOidcResourceCredentials = {
+    readonly issuer: string;
+    readonly audience: string;
+    readonly introspection_client_id: string;
+    readonly introspection_secret: string;
+};
+export type TsAuthOidcUserInfo = {
+    readonly sub: string;
+    readonly email?: string | undefined;
+    readonly email_verified?: boolean | undefined;
+    readonly name?: string | undefined;
+};
+import type { TerraScaleResult } from "./result.js";
+import { TsAuthHttp } from "./http.js";