@auth-gate/core 0.7.1 → 0.8.0

package/dist/index.cjs

@@ -49,9 +49,14 @@ __export(index_exports, {
   SUPPORTED_PROVIDERS: () => SUPPORTED_PROVIDERS,
   SessionDecryptionError: () => SessionDecryptionError,
   TokenVerificationError: () => TokenVerificationError,
+  checkFeature: () => checkFeature,
   createAuthGateClient: () => createAuthGateClient,
+  hasAllPermissions: () => hasAllPermissions,
+  hasAnyPermission: () => hasAnyPermission,
   hasFeature: () => hasFeature,
-  hasPlan: () => hasPlan
+  hasPermission: () => hasPermission,
+  hasPlan: () => hasPlan,
+  hasRole: () => hasRole
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -903,6 +908,253 @@ var AuthGateClient = class {
     });
   }
   // ---------------------------------------------------------------------------
+  // Organizations
+  // ---------------------------------------------------------------------------
+  /**
+   * Create a new organization.
+   *
+   * @param data - Organization creation data including name, slug, optional image URL, and metadata.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async createOrg(data) {
+    return fetch(`${this.config.baseUrl}/api/proxy/orgs`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        name: data.name,
+        slug: data.slug,
+        image_url: data.imageUrl,
+        metadata: data.metadata
+      })
+    });
+  }
+  /**
+   * List all organizations accessible to the current project.
+   *
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async listOrgs() {
+    return fetch(`${this.config.baseUrl}/api/proxy/orgs`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`
+      }
+    });
+  }
+  /**
+   * Get a single organization by ID or slug.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async getOrg(orgIdOrSlug) {
+    return fetch(`${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`
+      }
+    });
+  }
+  /**
+   * Update an organization's details.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param data - Fields to update. All fields are optional.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async updateOrg(orgIdOrSlug, data) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}`,
+      {
+        method: "PATCH",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          name: data.name,
+          slug: data.slug,
+          image_url: data.imageUrl,
+          max_members: data.maxMembers,
+          metadata: data.metadata
+        })
+      }
+    );
+  }
+  /**
+   * Delete an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async deleteOrg(orgIdOrSlug) {
+    return fetch(`${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`
+      }
+    });
+  }
+  /**
+   * List all members of an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async listOrgMembers(orgIdOrSlug) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/members`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`
+        }
+      }
+    );
+  }
+  /**
+   * Update a member's role within an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param memberId - The member's user ID.
+   * @param data - The new role to assign.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async updateOrgMember(orgIdOrSlug, memberId, data) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/members/${memberId}`,
+      {
+        method: "PATCH",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          role_key: data.roleKey
+        })
+      }
+    );
+  }
+  /**
+   * Remove a member from an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param memberId - The member's user ID.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async removeOrgMember(orgIdOrSlug, memberId) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/members/${memberId}`,
+      {
+        method: "DELETE",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`
+        }
+      }
+    );
+  }
+  /**
+   * Invite a user to an organization by email.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param data - The invitee's email and optional role.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async inviteToOrg(orgIdOrSlug, data) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/invitations`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          email: data.email,
+          role_key: data.roleKey
+        })
+      }
+    );
+  }
+  /**
+   * List all pending invitations for an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async listOrgInvitations(orgIdOrSlug) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/invitations`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`
+        }
+      }
+    );
+  }
+  /**
+   * Revoke a pending organization invitation.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param invitationId - The invitation ID to revoke.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async revokeOrgInvitation(orgIdOrSlug, invitationId) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/invitations/${invitationId}`,
+      {
+        method: "DELETE",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`
+        }
+      }
+    );
+  }
+  /**
+   * Accept an organization invitation using a token.
+   *
+   * @param data - The invitation token received via email.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async acceptOrgInvitation(data) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/invitations/accept`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          token: data.token
+        })
+      }
+    );
+  }
+  /**
+   * Leave an organization as the current user.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async leaveOrg(orgIdOrSlug) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/leave`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: "{}"
+      }
+    );
+  }
+  // ---------------------------------------------------------------------------
   // Cookie config accessors
   // ---------------------------------------------------------------------------
   /** The name of the session cookie (default: `"__authgate"`). */
@@ -1026,3 +1278,52 @@ function hasFeature(entitlements, feature) {
   const lower = feature.toLowerCase();
   return entitlements.features.some((f) => f.toLowerCase() === lower);
 }
+function checkFeature(entitlements, feature) {
+  if (!(entitlements == null ? void 0 : entitlements.featureDetails)) {
+    const allowed = hasFeature(entitlements, feature);
+    return { type: "boolean", feature, allowed };
+  }
+  const lower = feature.toLowerCase();
+  const key = Object.keys(entitlements.featureDetails).find(
+    (k) => k.toLowerCase() === lower
+  );
+  if (key) return entitlements.featureDetails[key];
+  return { type: "boolean", feature, allowed: false };
+}
+
+// src/organizations.ts
+function hasPermission(membership, permission) {
+  var _a;
+  if (!((_a = membership == null ? void 0 : membership.role) == null ? void 0 : _a.permissions)) return false;
+  return matchesPermission(membership.role.permissions, permission);
+}
+function hasRole(membership, roleKey) {
+  var _a;
+  if (!((_a = membership == null ? void 0 : membership.role) == null ? void 0 : _a.key)) return false;
+  return membership.role.key === roleKey;
+}
+function hasAnyPermission(membership, permissions) {
+  var _a;
+  if (!((_a = membership == null ? void 0 : membership.role) == null ? void 0 : _a.permissions)) return false;
+  return permissions.some(
+    (p) => matchesPermission(membership.role.permissions, p)
+  );
+}
+function hasAllPermissions(membership, permissions) {
+  var _a;
+  if (!((_a = membership == null ? void 0 : membership.role) == null ? void 0 : _a.permissions)) return false;
+  return permissions.every(
+    (p) => matchesPermission(membership.role.permissions, p)
+  );
+}
+function matchesPermission(granted, required) {
+  for (const perm of granted) {
+    if (perm === "*") return true;
+    if (perm === required) return true;
+    if (perm.endsWith(":*")) {
+      const prefix = perm.slice(0, -1);
+      if (required.startsWith(prefix)) return true;
+    }
+  }
+  return false;
+}

package/dist/index.d.cts

@@ -448,6 +448,120 @@ declare class AuthGateClient {
      * @returns The raw `Response`.
      */
     mfaSmsSendCode(challenge: string): Promise<Response>;
+    /**
+     * Create a new organization.
+     *
+     * @param data - Organization creation data including name, slug, optional image URL, and metadata.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    createOrg(data: {
+        name: string;
+        slug: string;
+        imageUrl?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<Response>;
+    /**
+     * List all organizations accessible to the current project.
+     *
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    listOrgs(): Promise<Response>;
+    /**
+     * Get a single organization by ID or slug.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    getOrg(orgIdOrSlug: string): Promise<Response>;
+    /**
+     * Update an organization's details.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param data - Fields to update. All fields are optional.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    updateOrg(orgIdOrSlug: string, data: {
+        name?: string;
+        slug?: string;
+        imageUrl?: string;
+        maxMembers?: number | null;
+        metadata?: Record<string, unknown>;
+    }): Promise<Response>;
+    /**
+     * Delete an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    deleteOrg(orgIdOrSlug: string): Promise<Response>;
+    /**
+     * List all members of an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    listOrgMembers(orgIdOrSlug: string): Promise<Response>;
+    /**
+     * Update a member's role within an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param memberId - The member's user ID.
+     * @param data - The new role to assign.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    updateOrgMember(orgIdOrSlug: string, memberId: string, data: {
+        roleKey: string;
+    }): Promise<Response>;
+    /**
+     * Remove a member from an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param memberId - The member's user ID.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    removeOrgMember(orgIdOrSlug: string, memberId: string): Promise<Response>;
+    /**
+     * Invite a user to an organization by email.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param data - The invitee's email and optional role.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    inviteToOrg(orgIdOrSlug: string, data: {
+        email: string;
+        roleKey?: string;
+    }): Promise<Response>;
+    /**
+     * List all pending invitations for an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    listOrgInvitations(orgIdOrSlug: string): Promise<Response>;
+    /**
+     * Revoke a pending organization invitation.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param invitationId - The invitation ID to revoke.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    revokeOrgInvitation(orgIdOrSlug: string, invitationId: string): Promise<Response>;
+    /**
+     * Accept an organization invitation using a token.
+     *
+     * @param data - The invitation token received via email.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    acceptOrgInvitation(data: {
+        token: string;
+    }): Promise<Response>;
+    /**
+     * Leave an organization as the current user.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    leaveOrg(orgIdOrSlug: string): Promise<Response>;
     /** The name of the session cookie (default: `"__authgate"`). */
     get cookieName(): string;
     /** The name of the OAuth nonce cookie (`"__authgate_nonce"`). */
@@ -591,15 +705,31 @@ interface BillingPrice {
     interval: "daily" | "weekly" | "monthly" | "yearly";
     intervalCount: number;
 }
+/** A single item within a subscription (price + product). */
+interface BillingSubscriptionItem {
+    id: string;
+    quantity: number;
+    price: BillingPrice;
+    product: {
+        id: string;
+        name: string;
+        description: string | null;
+        features: string[];
+    };
+}
 /** An active subscription for an end user. */
 interface BillingSubscription {
     id: string;
     status: "active" | "past_due" | "canceled" | "paused" | "trialing" | "unpaid";
+    /** Convenience: derived from the first subscription item's product. */
     plan: {
         id: string;
         name: string;
     } | null;
+    /** Convenience: derived from the first subscription item's price. */
     price: BillingPrice | null;
+    /** The full list of subscription items returned by the API. */
+    items: BillingSubscriptionItem[];
     currentPeriodStart: string;
     currentPeriodEnd: string;
     cancelAtPeriodEnd: boolean;
@@ -610,10 +740,30 @@ interface BillingEntitlement {
     plan: string | null;
     features: string[];
     status: string | null;
-    subscription: {
-        id: string;
-        currentPeriodEnd: string;
-    } | null;
+    currentPeriodEnd: string | null;
+    cancelAtPeriodEnd: boolean;
+}
+/** Typed entitlement detail for a boolean feature. */
+interface BooleanEntitlementDetail {
+    type: "boolean";
+    feature: string;
+    allowed: boolean;
+}
+/** Typed entitlement detail for a metered feature. */
+interface MeteredEntitlementDetail {
+    type: "metered";
+    feature: string;
+    allowed: boolean;
+    used: number;
+    limit: number;
+    remaining: number;
+}
+/** A single feature entitlement detail. */
+type EntitlementDetail = BooleanEntitlementDetail | MeteredEntitlementDetail;
+/** Extended entitlement data with typed feature details. */
+interface BillingEntitlementV2 extends BillingEntitlement {
+    /** Typed feature details with metered usage info. */
+    featureDetails?: Record<string, EntitlementDetail>;
 }
 /** A single usage event to report. */
 interface UsageEvent {
@@ -638,5 +788,96 @@ declare function hasPlan(entitlements: BillingEntitlement | null | undefined, pl
  * @returns `true` if the user has the given feature.
  */
 declare function hasFeature(entitlements: BillingEntitlement | null | undefined, feature: string): boolean;
+/**
+ * Check a specific feature entitlement, returning typed detail with metered usage info.
+ *
+ * @param entitlements - The extended entitlement object from the billing API.
+ * @param feature - The feature name to check (case-insensitive).
+ * @returns The typed entitlement detail, or a denied boolean detail if not found.
+ */
+declare function checkFeature(entitlements: BillingEntitlementV2 | null | undefined, feature: string): EntitlementDetail;
+
+/** An organization within a project. */
+interface Organization {
+    id: string;
+    name: string;
+    slug: string;
+    imageUrl: string | null;
+    metadata: Record<string, unknown> | null;
+    createdAt: string;
+}
+/** A role definition with its permissions. */
+interface OrgRole {
+    key: string;
+    name: string;
+    permissions: string[];
+}
+/** The current user's membership in an organization. */
+interface OrgMembership {
+    id: string;
+    orgId: string;
+    role: OrgRole;
+    createdAt: string;
+}
+/** A member of an organization with user details. */
+interface OrgMember {
+    id: string;
+    endUserId: string;
+    name: string | null;
+    email: string | null;
+    avatarUrl: string | null;
+    role: OrgRole;
+    createdAt: string;
+}
+/** An invitation to join an organization. */
+interface OrgInvitation {
+    id: string;
+    email: string;
+    roleKey: string | null;
+    status: "pending" | "accepted" | "revoked" | "expired";
+    expiresAt: string;
+    createdAt: string;
+}
+/** An organization paired with the current user's membership. */
+interface OrgWithMembership {
+    organization: Organization;
+    membership: OrgMembership;
+}
+/**
+ * Check whether a membership includes a specific permission.
+ *
+ * Supports wildcard matching:
+ * - `"*"` matches all permissions.
+ * - `"resource:*"` matches any permission starting with `"resource:"`.
+ *
+ * @param membership - The user's org membership (or null).
+ * @param permission - The permission string to check, e.g. `"documents:write"`.
+ * @returns `true` if the membership grants the permission.
+ */
+declare function hasPermission(membership: OrgMembership | null | undefined, permission: string): boolean;
+/**
+ * Check whether a membership has a specific role key.
+ *
+ * @param membership - The user's org membership (or null).
+ * @param roleKey - The role key to check, e.g. `"admin"`.
+ * @returns `true` if the membership's role key matches.
+ */
+declare function hasRole(membership: OrgMembership | null | undefined, roleKey: string): boolean;
+/**
+ * Check whether a membership has at least one of the given permissions.
+ *
+ * @param membership - The user's org membership (or null).
+ * @param permissions - Array of permission strings.
+ * @returns `true` if at least one permission is granted.
+ */
+declare function hasAnyPermission(membership: OrgMembership | null | undefined, permissions: string[]): boolean;
+/**
+ * Check whether a membership has all of the given permissions.
+ *
+ * @param membership - The user's org membership (or null).
+ * @param permissions - Array of permission strings.
+ * @returns `true` if every permission is granted.
+ */
+declare function hasAllPermissions(membership: OrgMembership | null | undefined, permissions: string[]): boolean;
 
-export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingPlan, type BillingPrice, type BillingSubscription, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, createAuthGateClient, hasFeature, hasPlan };
+export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingEntitlementV2, type BillingPlan, type BillingPrice, type BillingSubscription, type BillingSubscriptionItem, type BooleanEntitlementDetail, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, type EntitlementDetail, InvalidStateError, type MeteredEntitlementDetail, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, type OrgInvitation, type OrgMember, type OrgMembership, type OrgRole, type OrgWithMembership, type Organization, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, checkFeature, createAuthGateClient, hasAllPermissions, hasAnyPermission, hasFeature, hasPermission, hasPlan, hasRole };

package/dist/index.d.ts

@@ -448,6 +448,120 @@ declare class AuthGateClient {
      * @returns The raw `Response`.
      */
     mfaSmsSendCode(challenge: string): Promise<Response>;
+    /**
+     * Create a new organization.
+     *
+     * @param data - Organization creation data including name, slug, optional image URL, and metadata.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    createOrg(data: {
+        name: string;
+        slug: string;
+        imageUrl?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<Response>;
+    /**
+     * List all organizations accessible to the current project.
+     *
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    listOrgs(): Promise<Response>;
+    /**
+     * Get a single organization by ID or slug.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    getOrg(orgIdOrSlug: string): Promise<Response>;
+    /**
+     * Update an organization's details.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param data - Fields to update. All fields are optional.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    updateOrg(orgIdOrSlug: string, data: {
+        name?: string;
+        slug?: string;
+        imageUrl?: string;
+        maxMembers?: number | null;
+        metadata?: Record<string, unknown>;
+    }): Promise<Response>;
+    /**
+     * Delete an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    deleteOrg(orgIdOrSlug: string): Promise<Response>;
+    /**
+     * List all members of an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    listOrgMembers(orgIdOrSlug: string): Promise<Response>;
+    /**
+     * Update a member's role within an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param memberId - The member's user ID.
+     * @param data - The new role to assign.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    updateOrgMember(orgIdOrSlug: string, memberId: string, data: {
+        roleKey: string;
+    }): Promise<Response>;
+    /**
+     * Remove a member from an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param memberId - The member's user ID.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    removeOrgMember(orgIdOrSlug: string, memberId: string): Promise<Response>;
+    /**
+     * Invite a user to an organization by email.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param data - The invitee's email and optional role.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    inviteToOrg(orgIdOrSlug: string, data: {
+        email: string;
+        roleKey?: string;
+    }): Promise<Response>;
+    /**
+     * List all pending invitations for an organization.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    listOrgInvitations(orgIdOrSlug: string): Promise<Response>;
+    /**
+     * Revoke a pending organization invitation.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @param invitationId - The invitation ID to revoke.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    revokeOrgInvitation(orgIdOrSlug: string, invitationId: string): Promise<Response>;
+    /**
+     * Accept an organization invitation using a token.
+     *
+     * @param data - The invitation token received via email.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    acceptOrgInvitation(data: {
+        token: string;
+    }): Promise<Response>;
+    /**
+     * Leave an organization as the current user.
+     *
+     * @param orgIdOrSlug - The organization ID or slug.
+     * @returns The raw `Response` from the AuthGate proxy.
+     */
+    leaveOrg(orgIdOrSlug: string): Promise<Response>;
     /** The name of the session cookie (default: `"__authgate"`). */
     get cookieName(): string;
     /** The name of the OAuth nonce cookie (`"__authgate_nonce"`). */
@@ -591,15 +705,31 @@ interface BillingPrice {
     interval: "daily" | "weekly" | "monthly" | "yearly";
     intervalCount: number;
 }
+/** A single item within a subscription (price + product). */
+interface BillingSubscriptionItem {
+    id: string;
+    quantity: number;
+    price: BillingPrice;
+    product: {
+        id: string;
+        name: string;
+        description: string | null;
+        features: string[];
+    };
+}
 /** An active subscription for an end user. */
 interface BillingSubscription {
     id: string;
     status: "active" | "past_due" | "canceled" | "paused" | "trialing" | "unpaid";
+    /** Convenience: derived from the first subscription item's product. */
     plan: {
         id: string;
         name: string;
     } | null;
+    /** Convenience: derived from the first subscription item's price. */
     price: BillingPrice | null;
+    /** The full list of subscription items returned by the API. */
+    items: BillingSubscriptionItem[];
     currentPeriodStart: string;
     currentPeriodEnd: string;
     cancelAtPeriodEnd: boolean;
@@ -610,10 +740,30 @@ interface BillingEntitlement {
     plan: string | null;
     features: string[];
     status: string | null;
-    subscription: {
-        id: string;
-        currentPeriodEnd: string;
-    } | null;
+    currentPeriodEnd: string | null;
+    cancelAtPeriodEnd: boolean;
+}
+/** Typed entitlement detail for a boolean feature. */
+interface BooleanEntitlementDetail {
+    type: "boolean";
+    feature: string;
+    allowed: boolean;
+}
+/** Typed entitlement detail for a metered feature. */
+interface MeteredEntitlementDetail {
+    type: "metered";
+    feature: string;
+    allowed: boolean;
+    used: number;
+    limit: number;
+    remaining: number;
+}
+/** A single feature entitlement detail. */
+type EntitlementDetail = BooleanEntitlementDetail | MeteredEntitlementDetail;
+/** Extended entitlement data with typed feature details. */
+interface BillingEntitlementV2 extends BillingEntitlement {
+    /** Typed feature details with metered usage info. */
+    featureDetails?: Record<string, EntitlementDetail>;
 }
 /** A single usage event to report. */
 interface UsageEvent {
@@ -638,5 +788,96 @@ declare function hasPlan(entitlements: BillingEntitlement | null | undefined, pl
  * @returns `true` if the user has the given feature.
  */
 declare function hasFeature(entitlements: BillingEntitlement | null | undefined, feature: string): boolean;
+/**
+ * Check a specific feature entitlement, returning typed detail with metered usage info.
+ *
+ * @param entitlements - The extended entitlement object from the billing API.
+ * @param feature - The feature name to check (case-insensitive).
+ * @returns The typed entitlement detail, or a denied boolean detail if not found.
+ */
+declare function checkFeature(entitlements: BillingEntitlementV2 | null | undefined, feature: string): EntitlementDetail;
+
+/** An organization within a project. */
+interface Organization {
+    id: string;
+    name: string;
+    slug: string;
+    imageUrl: string | null;
+    metadata: Record<string, unknown> | null;
+    createdAt: string;
+}
+/** A role definition with its permissions. */
+interface OrgRole {
+    key: string;
+    name: string;
+    permissions: string[];
+}
+/** The current user's membership in an organization. */
+interface OrgMembership {
+    id: string;
+    orgId: string;
+    role: OrgRole;
+    createdAt: string;
+}
+/** A member of an organization with user details. */
+interface OrgMember {
+    id: string;
+    endUserId: string;
+    name: string | null;
+    email: string | null;
+    avatarUrl: string | null;
+    role: OrgRole;
+    createdAt: string;
+}
+/** An invitation to join an organization. */
+interface OrgInvitation {
+    id: string;
+    email: string;
+    roleKey: string | null;
+    status: "pending" | "accepted" | "revoked" | "expired";
+    expiresAt: string;
+    createdAt: string;
+}
+/** An organization paired with the current user's membership. */
+interface OrgWithMembership {
+    organization: Organization;
+    membership: OrgMembership;
+}
+/**
+ * Check whether a membership includes a specific permission.
+ *
+ * Supports wildcard matching:
+ * - `"*"` matches all permissions.
+ * - `"resource:*"` matches any permission starting with `"resource:"`.
+ *
+ * @param membership - The user's org membership (or null).
+ * @param permission - The permission string to check, e.g. `"documents:write"`.
+ * @returns `true` if the membership grants the permission.
+ */
+declare function hasPermission(membership: OrgMembership | null | undefined, permission: string): boolean;
+/**
+ * Check whether a membership has a specific role key.
+ *
+ * @param membership - The user's org membership (or null).
+ * @param roleKey - The role key to check, e.g. `"admin"`.
+ * @returns `true` if the membership's role key matches.
+ */
+declare function hasRole(membership: OrgMembership | null | undefined, roleKey: string): boolean;
+/**
+ * Check whether a membership has at least one of the given permissions.
+ *
+ * @param membership - The user's org membership (or null).
+ * @param permissions - Array of permission strings.
+ * @returns `true` if at least one permission is granted.
+ */
+declare function hasAnyPermission(membership: OrgMembership | null | undefined, permissions: string[]): boolean;
+/**
+ * Check whether a membership has all of the given permissions.
+ *
+ * @param membership - The user's org membership (or null).
+ * @param permissions - Array of permission strings.
+ * @returns `true` if every permission is granted.
+ */
+declare function hasAllPermissions(membership: OrgMembership | null | undefined, permissions: string[]): boolean;
 
-export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingPlan, type BillingPrice, type BillingSubscription, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, createAuthGateClient, hasFeature, hasPlan };
+export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingEntitlementV2, type BillingPlan, type BillingPrice, type BillingSubscription, type BillingSubscriptionItem, type BooleanEntitlementDetail, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, type EntitlementDetail, InvalidStateError, type MeteredEntitlementDetail, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, type OrgInvitation, type OrgMember, type OrgMembership, type OrgRole, type OrgWithMembership, type Organization, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, checkFeature, createAuthGateClient, hasAllPermissions, hasAnyPermission, hasFeature, hasPermission, hasPlan, hasRole };

package/dist/index.mjs

@@ -866,6 +866,253 @@ var AuthGateClient = class {
     });
   }
   // ---------------------------------------------------------------------------
+  // Organizations
+  // ---------------------------------------------------------------------------
+  /**
+   * Create a new organization.
+   *
+   * @param data - Organization creation data including name, slug, optional image URL, and metadata.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async createOrg(data) {
+    return fetch(`${this.config.baseUrl}/api/proxy/orgs`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        name: data.name,
+        slug: data.slug,
+        image_url: data.imageUrl,
+        metadata: data.metadata
+      })
+    });
+  }
+  /**
+   * List all organizations accessible to the current project.
+   *
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async listOrgs() {
+    return fetch(`${this.config.baseUrl}/api/proxy/orgs`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`
+      }
+    });
+  }
+  /**
+   * Get a single organization by ID or slug.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async getOrg(orgIdOrSlug) {
+    return fetch(`${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`
+      }
+    });
+  }
+  /**
+   * Update an organization's details.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param data - Fields to update. All fields are optional.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async updateOrg(orgIdOrSlug, data) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}`,
+      {
+        method: "PATCH",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          name: data.name,
+          slug: data.slug,
+          image_url: data.imageUrl,
+          max_members: data.maxMembers,
+          metadata: data.metadata
+        })
+      }
+    );
+  }
+  /**
+   * Delete an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async deleteOrg(orgIdOrSlug) {
+    return fetch(`${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`
+      }
+    });
+  }
+  /**
+   * List all members of an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async listOrgMembers(orgIdOrSlug) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/members`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`
+        }
+      }
+    );
+  }
+  /**
+   * Update a member's role within an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param memberId - The member's user ID.
+   * @param data - The new role to assign.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async updateOrgMember(orgIdOrSlug, memberId, data) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/members/${memberId}`,
+      {
+        method: "PATCH",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          role_key: data.roleKey
+        })
+      }
+    );
+  }
+  /**
+   * Remove a member from an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param memberId - The member's user ID.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async removeOrgMember(orgIdOrSlug, memberId) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/members/${memberId}`,
+      {
+        method: "DELETE",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`
+        }
+      }
+    );
+  }
+  /**
+   * Invite a user to an organization by email.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param data - The invitee's email and optional role.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async inviteToOrg(orgIdOrSlug, data) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/invitations`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          email: data.email,
+          role_key: data.roleKey
+        })
+      }
+    );
+  }
+  /**
+   * List all pending invitations for an organization.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async listOrgInvitations(orgIdOrSlug) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/invitations`,
+      {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`
+        }
+      }
+    );
+  }
+  /**
+   * Revoke a pending organization invitation.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @param invitationId - The invitation ID to revoke.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async revokeOrgInvitation(orgIdOrSlug, invitationId) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/invitations/${invitationId}`,
+      {
+        method: "DELETE",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`
+        }
+      }
+    );
+  }
+  /**
+   * Accept an organization invitation using a token.
+   *
+   * @param data - The invitation token received via email.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async acceptOrgInvitation(data) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/invitations/accept`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          token: data.token
+        })
+      }
+    );
+  }
+  /**
+   * Leave an organization as the current user.
+   *
+   * @param orgIdOrSlug - The organization ID or slug.
+   * @returns The raw `Response` from the AuthGate proxy.
+   */
+  async leaveOrg(orgIdOrSlug) {
+    return fetch(
+      `${this.config.baseUrl}/api/proxy/orgs/${orgIdOrSlug}/leave`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: "{}"
+      }
+    );
+  }
+  // ---------------------------------------------------------------------------
   // Cookie config accessors
   // ---------------------------------------------------------------------------
   /** The name of the session cookie (default: `"__authgate"`). */
@@ -989,6 +1236,55 @@ function hasFeature(entitlements, feature) {
   const lower = feature.toLowerCase();
   return entitlements.features.some((f) => f.toLowerCase() === lower);
 }
+function checkFeature(entitlements, feature) {
+  if (!(entitlements == null ? void 0 : entitlements.featureDetails)) {
+    const allowed = hasFeature(entitlements, feature);
+    return { type: "boolean", feature, allowed };
+  }
+  const lower = feature.toLowerCase();
+  const key = Object.keys(entitlements.featureDetails).find(
+    (k) => k.toLowerCase() === lower
+  );
+  if (key) return entitlements.featureDetails[key];
+  return { type: "boolean", feature, allowed: false };
+}
+
+// src/organizations.ts
+function hasPermission(membership, permission) {
+  var _a;
+  if (!((_a = membership == null ? void 0 : membership.role) == null ? void 0 : _a.permissions)) return false;
+  return matchesPermission(membership.role.permissions, permission);
+}
+function hasRole(membership, roleKey) {
+  var _a;
+  if (!((_a = membership == null ? void 0 : membership.role) == null ? void 0 : _a.key)) return false;
+  return membership.role.key === roleKey;
+}
+function hasAnyPermission(membership, permissions) {
+  var _a;
+  if (!((_a = membership == null ? void 0 : membership.role) == null ? void 0 : _a.permissions)) return false;
+  return permissions.some(
+    (p) => matchesPermission(membership.role.permissions, p)
+  );
+}
+function hasAllPermissions(membership, permissions) {
+  var _a;
+  if (!((_a = membership == null ? void 0 : membership.role) == null ? void 0 : _a.permissions)) return false;
+  return permissions.every(
+    (p) => matchesPermission(membership.role.permissions, p)
+  );
+}
+function matchesPermission(granted, required) {
+  for (const perm of granted) {
+    if (perm === "*") return true;
+    if (perm === required) return true;
+    if (perm.endsWith(":*")) {
+      const prefix = perm.slice(0, -1);
+      if (required.startsWith(prefix)) return true;
+    }
+  }
+  return false;
+}
 export {
   AuthGateClient,
   AuthGateError,
@@ -1002,7 +1298,12 @@ export {
   SUPPORTED_PROVIDERS,
   SessionDecryptionError,
   TokenVerificationError,
+  checkFeature,
   createAuthGateClient,
+  hasAllPermissions,
+  hasAnyPermission,
   hasFeature,
-  hasPlan
+  hasPermission,
+  hasPlan,
+  hasRole
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-gate/core",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "type": "module",
   "exports": {
     ".": {