@auth0/auth0-server-js 1.8.0 → 1.10.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, TokenResponse } from '@auth0/auth0-auth-js';
-export { ActClaim, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, TelemetryConfig, TokenExchangeError, TokenResponse, isMfaRequiredError } from '@auth0/auth0-auth-js';
+import { AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, SignUpOptions, SignUpResult, ChangePasswordOptions, TokenResponse } from '@auth0/auth0-auth-js';
+export { ActClaim, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, ChangePasswordError, ChangePasswordOptions, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, SignUpError, SignUpOptions, SignUpResult, TelemetryConfig, TokenExchangeError, TokenResponse, TokenRevocationError, isMfaRequiredError } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 
 /**
@@ -26,6 +26,12 @@ interface ServerClientOptions<TStoreOptions = unknown> {
     clientAssertionSigningKey?: string | CryptoKey;
     clientAssertionSigningAlg?: string;
     authorizationParams?: AuthorizationParameters;
+    /**
+     * Default organization for all interactive login flows from this client.
+     * Can be an organization ID (e.g. `org_abc123`) or an organization name (e.g. `acme-corp`).
+     * A per-login value in {@link StartInteractiveLoginOptions} overrides this.
+     */
+    organization?: string;
     discoveryCache?: DiscoveryCacheOptions;
     transactionIdentifier?: string;
     stateIdentifier?: string;
@@ -57,12 +63,19 @@ interface UserClaims {
     email?: string;
     email_verified?: boolean;
     org_id?: string;
+    org_name?: string;
     [key: string]: unknown;
 }
 interface AuthorizationParameters {
     scope?: string;
     audience?: string;
     redirect_uri?: string;
+    /**
+     * The organization to log the user into. Prefer the first-class `organization`
+     * option on {@link StartInteractiveLoginOptions} / {@link ServerClientOptions};
+     * this is supported for backwards compatibility.
+     */
+    organization?: string;
     [key: string]: unknown;
 }
 interface TokenSet {
@@ -112,6 +125,11 @@ interface TransactionData {
      */
     codeVerifier?: string;
     domain?: string;
+    /**
+     * The organization requested at login, carried across the redirect so the
+     * returned ID token's organization claim can be validated at callback.
+     */
+    organization?: string;
     [key: string]: unknown;
 }
 interface AbstractDataStore<TData, TStoreOptions = unknown> {
@@ -146,6 +164,18 @@ interface StartInteractiveLoginOptions<TAppState = unknown> {
     pushedAuthorizationRequests?: boolean;
     appState?: TAppState;
     authorizationParams?: AuthorizationParameters;
+    /**
+     * The organization to log the user into. Overrides the client-level
+     * `organization` default. Can be an organization ID (`org_abc123`) or name
+     * (`acme-corp`). Also passable via `authorizationParams.organization`.
+     */
+    organization?: string;
+    /**
+     * The organization invitation ticket, when handling an invitation-acceptance flow.
+     * Requires `organization` to be set (per-login, client-level default, or via
+     * `authorizationParams`); providing `invitation` without an organization throws.
+     */
+    invitation?: string;
 }
 interface LoginBackchannelOptions {
     bindingMessage: string;
@@ -300,6 +330,13 @@ interface GetAccessTokenOptions {
      */
     scope?: string;
 }
+interface RevokeRefreshTokenOptions {
+    /**
+     * Explicitly provide a refresh token to revoke.
+     * If omitted, the token stored in the current session is used.
+     */
+    token?: string;
+}
 interface LogoutOptions {
     returnTo: string;
 }
@@ -572,6 +609,59 @@ declare class ServerPasskeyClient<TStoreOptions = unknown> {
     getToken(options: GetTokenByPasskeyOptions, storeOptions?: TStoreOptions): Promise<PasskeyGetTokenResult>;
 }
 
+/**
+ * @internal
+ * Options for constructing a ServerDatabaseClient.
+ *
+ * Like the passkey client, the database client resolves the domain per call so
+ * it keeps working in resolver (multi-tenant) mode. It therefore receives the
+ * parent client's `resolveDomain` and `getAuthClient` helpers instead of a
+ * fixed domain/authClient. Unlike the MFA/passkey clients, it never touches the
+ * state store — signup and change-password write no session.
+ */
+interface ServerDatabaseClientOptions<TStoreOptions = unknown> {
+    resolveDomain: (storeOptions?: TStoreOptions) => Promise<string>;
+    getAuthClient: (domain: string) => AuthClient;
+}
+
+declare class ServerDatabaseClient<TStoreOptions = unknown> {
+    #private;
+    /**
+     * @internal
+     */
+    constructor(options: ServerDatabaseClientOptions<TStoreOptions>);
+    /**
+     * Registers a new user in a database connection.
+     *
+     * Delegates to the underlying `AuthClient.database.signUp` without any session
+     * state modification. The caller is responsible for handling the returned user
+     * data as needed.
+     *
+     * @param options The signup options (email, password, connection, etc.).
+     * @param storeOptions Optional options used to resolve the domain (resolver mode).
+     *
+     * @throws {SignUpError} If there was an issue signing the user up.
+     *
+     * @returns A promise resolving to the created user result with a normalized `id` field.
+     */
+    signUp(options: SignUpOptions, storeOptions?: TStoreOptions): Promise<SignUpResult>;
+    /**
+     * Requests a password-change email for a database connection user.
+     *
+     * Delegates to the underlying `AuthClient.database.changePassword` without any
+     * session state modification. The caller is responsible for informing the user
+     * of the sent email as needed.
+     *
+     * @param options The password change options (email, connection, organization, etc.).
+     * @param storeOptions Optional options used to resolve the domain (resolver mode).
+     *
+     * @throws {ChangePasswordError} If there was an issue requesting the password change.
+     *
+     * @returns A promise resolving to the server's plain-text confirmation message.
+     */
+    changePassword(options: ChangePasswordOptions, storeOptions?: TStoreOptions): Promise<string>;
+}
+
 declare class ServerClient<TStoreOptions = unknown> {
     #private;
     /**
@@ -609,12 +699,32 @@ declare class ServerClient<TStoreOptions = unknown> {
      * and `getToken()` so the credential is exchanged against the tenant that issued it.
      */
     get passkey(): ServerPasskeyClient<TStoreOptions>;
+    /**
+     * The database client for self-service sign-up and password-change requests
+     * against an Auth0 database connection.
+     *
+     * Provides `signUp()` to register a user and `changePassword()` to request a
+     * password-reset email. Both are pure passthrough operations to the Auth0
+     * Authentication API — they never read or write the session/state store.
+     *
+     * Like `passkey`, this property is available in both static and resolver
+     * (multi-tenant) domain modes. In resolver mode, pass `storeOptions` so the
+     * request resolves the intended tenant.
+     */
+    get database(): ServerDatabaseClient<TStoreOptions>;
     constructor(options: ServerClientOptions<TStoreOptions>);
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
+     *
+     * When `organization` is provided (per-login option, client-level default, or via
+     * `authorizationParams.organization`), it is forwarded to `/authorize` and remembered so the
+     * returned ID token's organization claim can be validated in `completeInteractiveLogin`.
+     *
      * @param options Optional options used to configure the interactive login process.
      * @param storeOptions Optional options used to pass to the Transaction and State Store.
      *
+     * @throws {OrganizationValidationError} If the resolved `organization` is blank.
+     * @throws {InvalidConfigurationError} If `invitation` is provided without an `organization`.
      * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.
      *
      * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
@@ -628,6 +738,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      *
      * @throws {MissingTransactionError} When no transaction was found.
      * @throws {TokenByCodeError} If there was an issue requesting the access token.
+     * @throws {OrganizationValidationError} When an organization was requested at login and the returned ID token's organization claim is missing or does not match; nothing is persisted.
      * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
      *
      * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
@@ -812,6 +923,22 @@ declare class ServerClient<TStoreOptions = unknown> {
      * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.
      */
     getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet>;
+    /**
+     * Revokes the refresh token stored in the current session, or an explicitly supplied token.
+     *
+     * In resolver mode, revocation only occurs when the session domain matches the domain resolved
+     * for the current request. If the domains differ (or the session has no stored domain), the call
+     * returns without revoking to avoid sending a token to the wrong tenant. This guard applies even
+     * when a token is passed explicitly via `options.token`.
+     *
+     * @param options Optionally supply a token to revoke instead of reading from the session.
+     * @param storeOptions Optional options passed to the StateStore.
+     *
+     * @throws {MissingRequiredArgumentError} If `options.token` is an empty string.
+     * @throws {MissingSessionError} If no refresh token is found in the session and none was provided.
+     * @throws {TokenRevocationError} If the revocation request fails.
+     */
+    revokeRefreshToken(options?: RevokeRefreshTokenOptions, storeOptions?: TStoreOptions): Promise<void>;
     /**
      * Logs the user out and returns a URL to redirect the user-agent to after they log out.
      * @param options Options used to configure the logout process.
@@ -1053,4 +1180,4 @@ declare class SessionExpiredError extends Error {
     constructor(message?: string);
 }
 
-export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, ServerClient, type ServerClientOptions, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };
+export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, type RevokeRefreshTokenOptions, ServerClient, type ServerClientOptions, ServerDatabaseClient, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, TokenResponse } from '@auth0/auth0-auth-js';
-export { ActClaim, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, TelemetryConfig, TokenExchangeError, TokenResponse, isMfaRequiredError } from '@auth0/auth0-auth-js';
+import { AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, SignUpOptions, SignUpResult, ChangePasswordOptions, TokenResponse } from '@auth0/auth0-auth-js';
+export { ActClaim, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, ChangePasswordError, ChangePasswordOptions, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, SignUpError, SignUpOptions, SignUpResult, TelemetryConfig, TokenExchangeError, TokenResponse, TokenRevocationError, isMfaRequiredError } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 
 /**
@@ -26,6 +26,12 @@ interface ServerClientOptions<TStoreOptions = unknown> {
     clientAssertionSigningKey?: string | CryptoKey;
     clientAssertionSigningAlg?: string;
     authorizationParams?: AuthorizationParameters;
+    /**
+     * Default organization for all interactive login flows from this client.
+     * Can be an organization ID (e.g. `org_abc123`) or an organization name (e.g. `acme-corp`).
+     * A per-login value in {@link StartInteractiveLoginOptions} overrides this.
+     */
+    organization?: string;
     discoveryCache?: DiscoveryCacheOptions;
     transactionIdentifier?: string;
     stateIdentifier?: string;
@@ -57,12 +63,19 @@ interface UserClaims {
     email?: string;
     email_verified?: boolean;
     org_id?: string;
+    org_name?: string;
     [key: string]: unknown;
 }
 interface AuthorizationParameters {
     scope?: string;
     audience?: string;
     redirect_uri?: string;
+    /**
+     * The organization to log the user into. Prefer the first-class `organization`
+     * option on {@link StartInteractiveLoginOptions} / {@link ServerClientOptions};
+     * this is supported for backwards compatibility.
+     */
+    organization?: string;
     [key: string]: unknown;
 }
 interface TokenSet {
@@ -112,6 +125,11 @@ interface TransactionData {
      */
     codeVerifier?: string;
     domain?: string;
+    /**
+     * The organization requested at login, carried across the redirect so the
+     * returned ID token's organization claim can be validated at callback.
+     */
+    organization?: string;
     [key: string]: unknown;
 }
 interface AbstractDataStore<TData, TStoreOptions = unknown> {
@@ -146,6 +164,18 @@ interface StartInteractiveLoginOptions<TAppState = unknown> {
     pushedAuthorizationRequests?: boolean;
     appState?: TAppState;
     authorizationParams?: AuthorizationParameters;
+    /**
+     * The organization to log the user into. Overrides the client-level
+     * `organization` default. Can be an organization ID (`org_abc123`) or name
+     * (`acme-corp`). Also passable via `authorizationParams.organization`.
+     */
+    organization?: string;
+    /**
+     * The organization invitation ticket, when handling an invitation-acceptance flow.
+     * Requires `organization` to be set (per-login, client-level default, or via
+     * `authorizationParams`); providing `invitation` without an organization throws.
+     */
+    invitation?: string;
 }
 interface LoginBackchannelOptions {
     bindingMessage: string;
@@ -300,6 +330,13 @@ interface GetAccessTokenOptions {
      */
     scope?: string;
 }
+interface RevokeRefreshTokenOptions {
+    /**
+     * Explicitly provide a refresh token to revoke.
+     * If omitted, the token stored in the current session is used.
+     */
+    token?: string;
+}
 interface LogoutOptions {
     returnTo: string;
 }
@@ -572,6 +609,59 @@ declare class ServerPasskeyClient<TStoreOptions = unknown> {
     getToken(options: GetTokenByPasskeyOptions, storeOptions?: TStoreOptions): Promise<PasskeyGetTokenResult>;
 }
 
+/**
+ * @internal
+ * Options for constructing a ServerDatabaseClient.
+ *
+ * Like the passkey client, the database client resolves the domain per call so
+ * it keeps working in resolver (multi-tenant) mode. It therefore receives the
+ * parent client's `resolveDomain` and `getAuthClient` helpers instead of a
+ * fixed domain/authClient. Unlike the MFA/passkey clients, it never touches the
+ * state store — signup and change-password write no session.
+ */
+interface ServerDatabaseClientOptions<TStoreOptions = unknown> {
+    resolveDomain: (storeOptions?: TStoreOptions) => Promise<string>;
+    getAuthClient: (domain: string) => AuthClient;
+}
+
+declare class ServerDatabaseClient<TStoreOptions = unknown> {
+    #private;
+    /**
+     * @internal
+     */
+    constructor(options: ServerDatabaseClientOptions<TStoreOptions>);
+    /**
+     * Registers a new user in a database connection.
+     *
+     * Delegates to the underlying `AuthClient.database.signUp` without any session
+     * state modification. The caller is responsible for handling the returned user
+     * data as needed.
+     *
+     * @param options The signup options (email, password, connection, etc.).
+     * @param storeOptions Optional options used to resolve the domain (resolver mode).
+     *
+     * @throws {SignUpError} If there was an issue signing the user up.
+     *
+     * @returns A promise resolving to the created user result with a normalized `id` field.
+     */
+    signUp(options: SignUpOptions, storeOptions?: TStoreOptions): Promise<SignUpResult>;
+    /**
+     * Requests a password-change email for a database connection user.
+     *
+     * Delegates to the underlying `AuthClient.database.changePassword` without any
+     * session state modification. The caller is responsible for informing the user
+     * of the sent email as needed.
+     *
+     * @param options The password change options (email, connection, organization, etc.).
+     * @param storeOptions Optional options used to resolve the domain (resolver mode).
+     *
+     * @throws {ChangePasswordError} If there was an issue requesting the password change.
+     *
+     * @returns A promise resolving to the server's plain-text confirmation message.
+     */
+    changePassword(options: ChangePasswordOptions, storeOptions?: TStoreOptions): Promise<string>;
+}
+
 declare class ServerClient<TStoreOptions = unknown> {
     #private;
     /**
@@ -609,12 +699,32 @@ declare class ServerClient<TStoreOptions = unknown> {
      * and `getToken()` so the credential is exchanged against the tenant that issued it.
      */
     get passkey(): ServerPasskeyClient<TStoreOptions>;
+    /**
+     * The database client for self-service sign-up and password-change requests
+     * against an Auth0 database connection.
+     *
+     * Provides `signUp()` to register a user and `changePassword()` to request a
+     * password-reset email. Both are pure passthrough operations to the Auth0
+     * Authentication API — they never read or write the session/state store.
+     *
+     * Like `passkey`, this property is available in both static and resolver
+     * (multi-tenant) domain modes. In resolver mode, pass `storeOptions` so the
+     * request resolves the intended tenant.
+     */
+    get database(): ServerDatabaseClient<TStoreOptions>;
     constructor(options: ServerClientOptions<TStoreOptions>);
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
+     *
+     * When `organization` is provided (per-login option, client-level default, or via
+     * `authorizationParams.organization`), it is forwarded to `/authorize` and remembered so the
+     * returned ID token's organization claim can be validated in `completeInteractiveLogin`.
+     *
      * @param options Optional options used to configure the interactive login process.
      * @param storeOptions Optional options used to pass to the Transaction and State Store.
      *
+     * @throws {OrganizationValidationError} If the resolved `organization` is blank.
+     * @throws {InvalidConfigurationError} If `invitation` is provided without an `organization`.
      * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.
      *
      * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
@@ -628,6 +738,7 @@ declare class ServerClient<TStoreOptions = unknown> {
      *
      * @throws {MissingTransactionError} When no transaction was found.
      * @throws {TokenByCodeError} If there was an issue requesting the access token.
+     * @throws {OrganizationValidationError} When an organization was requested at login and the returned ID token's organization claim is missing or does not match; nothing is persisted.
      * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
      *
      * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
@@ -812,6 +923,22 @@ declare class ServerClient<TStoreOptions = unknown> {
      * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.
      */
     getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet>;
+    /**
+     * Revokes the refresh token stored in the current session, or an explicitly supplied token.
+     *
+     * In resolver mode, revocation only occurs when the session domain matches the domain resolved
+     * for the current request. If the domains differ (or the session has no stored domain), the call
+     * returns without revoking to avoid sending a token to the wrong tenant. This guard applies even
+     * when a token is passed explicitly via `options.token`.
+     *
+     * @param options Optionally supply a token to revoke instead of reading from the session.
+     * @param storeOptions Optional options passed to the StateStore.
+     *
+     * @throws {MissingRequiredArgumentError} If `options.token` is an empty string.
+     * @throws {MissingSessionError} If no refresh token is found in the session and none was provided.
+     * @throws {TokenRevocationError} If the revocation request fails.
+     */
+    revokeRefreshToken(options?: RevokeRefreshTokenOptions, storeOptions?: TStoreOptions): Promise<void>;
     /**
      * Logs the user out and returns a URL to redirect the user-agent to after they log out.
      * @param options Options used to configure the logout process.
@@ -1053,4 +1180,4 @@ declare class SessionExpiredError extends Error {
     constructor(message?: string);
 }
 
-export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, ServerClient, type ServerClientOptions, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };
+export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, type RevokeRefreshTokenOptions, ServerClient, type ServerClientOptions, ServerDatabaseClient, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };