@headless-lms/adapter-auth 0.3.1 → 0.4.1

package/dist/better-auth.d.ts

@@ -1,15 +1,19 @@
 import { CreateAuthOptions, Hooks } from "./types.js";
 import { SessionAdmin } from "@headless-lms/core/identity";
-import { AuthHeaders, AuthOrganization, MemberWriteContext, OrgAdmin, Role, UpdateOrganizationInput } from "@headless-lms/core/organizations";
+import { Accounts, ApiKeys, AuthHeaders, AuthOrganization, NewApiKey, OrgAdmin, PlatformAccount, StoredApiKey, UpdateOrganizationInput } from "@headless-lms/core/organizations";
 import { AccessTokenAuthorization } from "better-auth/oauth2";
 import { BetterAuthOptions, BetterAuthPlugin } from "better-auth";
-import { AccessGrant, AccessRequest, AccessTokenVerifier, ActiveSession, ApiKeySummary, AppAccessAdmin, ConnectedApp, CreatedApiKey, HeaderBag, Logger, NewApiKey, NewOrganizationInput, SessionVerifier } from "@headless-lms/core/types";
+import { AccessGrant, AccessRequest, AccessTokenVerifier, ActiveSession, ConnectedApp, HeaderBag, Logger, NewOrganizationInput, SessionVerifier } from "@headless-lms/core/types";
 import { IncomingHttpHeaders } from "node:http";
 //#region src/better-auth.d.ts
+declare const API_KEY_PREFIX = "hlms_";
 declare function buildAuthOptions(opts: CreateAuthOptions): {
   baseURL: string;
   secret: string;
   trustedOrigins: string[];
+  logger: {
+    log: (level: "debug" | "info" | "warn" | "error", message: string, ...args: any[]) => void;
+  };
   session: {
     cookieCache: {
       enabled: true;
@@ -169,18 +173,12 @@ declare function buildAuthOptions(opts: CreateAuthOptions): {
   }, import("better-auth/plugins").DefaultOrganizationPlugin<{
     ac: {
       newRole<const TRoleStatements extends import("better-auth/plugins").Statements>(statements: import("better-auth/plugins").RoleInput<{
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
         readonly team: readonly ["create", "update", "delete"];
         readonly ac: readonly ["create", "read", "update", "delete"];
       }, TRoleStatements>): import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<TRoleStatements>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
@@ -188,9 +186,6 @@ declare function buildAuthOptions(opts: CreateAuthOptions): {
         readonly ac: readonly ["create", "read", "update", "delete"];
       }>;
       statements: {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
@@ -199,77 +194,26 @@ declare function buildAuthOptions(opts: CreateAuthOptions): {
       };
     };
     roles: {
-      owner: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["create", "read", "update", "delete"];
-        readonly progress: ["view"];
-        readonly community: ["moderate"];
-        readonly organization: readonly ["update", "delete"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
-        readonly organization: readonly ["update", "delete"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>;
-      admin: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["create", "read", "update", "delete"];
-        readonly progress: ["view"];
-        readonly community: ["moderate"];
-        readonly organization: readonly ["update"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
-        readonly organization: readonly ["update", "delete"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>;
-      instructor: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["read", "update"];
-        readonly progress: ["view"];
-        readonly community: ["moderate"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
+      owner: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<import("better-auth/plugins").ExactRoleStatements<{
+        readonly organization: ["update", "delete"];
+        readonly member: ["create", "update", "delete"];
+        readonly invitation: ["create", "cancel"];
+        readonly team: ["create", "update", "delete"];
+        readonly ac: ["create", "read", "update", "delete"];
+      }>>, {
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
         readonly team: readonly ["create", "update", "delete"];
         readonly ac: readonly ["create", "read", "update", "delete"];
       }>;
-      moderator: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["read"];
-        readonly community: ["moderate"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
-        readonly organization: readonly ["update", "delete"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>;
-      student: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["read"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
+      participant: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<import("better-auth/plugins").ExactRoleStatements<{
+        readonly organization: [];
+        readonly member: [];
+        readonly invitation: [];
+        readonly team: [];
+        readonly ac: ["read"];
+      }>>, {
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
@@ -278,146 +222,9 @@ declare function buildAuthOptions(opts: CreateAuthOptions): {
       }>;
     };
     creatorRole: string;
+    membershipLimit: number;
     organizationHooks: Hooks;
-  }>, BetterAuthPlugin, ...BetterAuthPlugin[], BetterAuthPlugin, {
-    id: "custom-session";
-    version: string;
-    hooks: {
-      after: {
-        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
-        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
-          user: {
-            id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            email: string;
-            emailVerified: boolean;
-            name: string;
-            image?: string | null | undefined;
-          };
-          session: {
-            id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            userId: string;
-            expiresAt: Date;
-            token: string;
-            ipAddress?: string | null | undefined;
-            userAgent?: string | null | undefined;
-          };
-          activeMemberRole: string | null;
-          activeOrganization: {
-            id: string;
-            name: string;
-            slug: string;
-          } | null;
-          organizations: {
-            id: string;
-            name: string;
-            slug: string;
-          }[];
-        }[] | undefined>>;
-      }[];
-    };
-    endpoints: {
-      getSession: import("better-auth").StrictEndpoint<"/get-session", {
-        method: "GET";
-        query: import("better-auth").ZodOptional<import("better-auth").ZodObject<{
-          disableCookieCache: import("better-auth").ZodOptional<import("better-auth").ZodCoercedBoolean<unknown>>;
-          disableRefresh: import("better-auth").ZodOptional<import("better-auth").ZodCoercedBoolean<unknown>>;
-        }, import("zod/v4/core").$strip>>;
-        metadata: {
-          CUSTOM_SESSION: boolean;
-          openapi: {
-            description: string;
-            responses: {
-              "200": {
-                description: string;
-                content: {
-                  "application/json": {
-                    schema: {
-                      type: "array";
-                      nullable: boolean;
-                      items: {
-                        $ref: string;
-                      };
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-        requireHeaders: true;
-      }, {
-        user: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          email: string;
-          emailVerified: boolean;
-          name: string;
-          image?: string | null | undefined;
-        };
-        session: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          userId: string;
-          expiresAt: Date;
-          token: string;
-          ipAddress?: string | null | undefined;
-          userAgent?: string | null | undefined;
-        };
-        activeMemberRole: string | null;
-        activeOrganization: {
-          id: string;
-          name: string;
-          slug: string;
-        } | null;
-        organizations: {
-          id: string;
-          name: string;
-          slug: string;
-        }[];
-      } | null>;
-    };
-    $Infer: {
-      Session: {
-        user: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          email: string;
-          emailVerified: boolean;
-          name: string;
-          image?: string | null | undefined;
-        };
-        session: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          userId: string;
-          expiresAt: Date;
-          token: string;
-          ipAddress?: string | null | undefined;
-          userAgent?: string | null | undefined;
-        };
-        activeMemberRole: string | null;
-        activeOrganization: {
-          id: string;
-          name: string;
-          slug: string;
-        } | null;
-        organizations: {
-          id: string;
-          name: string;
-          slug: string;
-        }[];
-      };
-    };
-    options: import("better-auth/plugins").CustomSessionPluginOptions | undefined;
-  }];
+  }>, BetterAuthPlugin, ...BetterAuthPlugin[], BetterAuthPlugin];
   hooks: {
     before: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
       context: {
@@ -446,6 +253,9 @@ declare function createAuth(opts: CreateAuthOptions): import("better-auth").Auth
   baseURL: string;
   secret: string;
   trustedOrigins: string[];
+  logger: {
+    log: (level: "debug" | "info" | "warn" | "error", message: string, ...args: any[]) => void;
+  };
   session: {
     cookieCache: {
       enabled: true;
@@ -605,18 +415,12 @@ declare function createAuth(opts: CreateAuthOptions): import("better-auth").Auth
   }, import("better-auth/plugins").DefaultOrganizationPlugin<{
     ac: {
       newRole<const TRoleStatements extends import("better-auth/plugins").Statements>(statements: import("better-auth/plugins").RoleInput<{
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
         readonly team: readonly ["create", "update", "delete"];
         readonly ac: readonly ["create", "read", "update", "delete"];
       }, TRoleStatements>): import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<TRoleStatements>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
@@ -624,9 +428,6 @@ declare function createAuth(opts: CreateAuthOptions): import("better-auth").Auth
         readonly ac: readonly ["create", "read", "update", "delete"];
       }>;
       statements: {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
@@ -635,77 +436,26 @@ declare function createAuth(opts: CreateAuthOptions): import("better-auth").Auth
       };
     };
     roles: {
-      owner: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["create", "read", "update", "delete"];
-        readonly progress: ["view"];
-        readonly community: ["moderate"];
-        readonly organization: readonly ["update", "delete"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
-        readonly organization: readonly ["update", "delete"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>;
-      admin: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["create", "read", "update", "delete"];
-        readonly progress: ["view"];
-        readonly community: ["moderate"];
-        readonly organization: readonly ["update"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
-        readonly organization: readonly ["update", "delete"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>;
-      instructor: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["read", "update"];
-        readonly progress: ["view"];
-        readonly community: ["moderate"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
+      owner: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<import("better-auth/plugins").ExactRoleStatements<{
+        readonly organization: ["update", "delete"];
+        readonly member: ["create", "update", "delete"];
+        readonly invitation: ["create", "cancel"];
+        readonly team: ["create", "update", "delete"];
+        readonly ac: ["create", "read", "update", "delete"];
+      }>>, {
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
         readonly team: readonly ["create", "update", "delete"];
         readonly ac: readonly ["create", "read", "update", "delete"];
       }>;
-      moderator: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["read"];
-        readonly community: ["moderate"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
-        readonly organization: readonly ["update", "delete"];
-        readonly member: readonly ["create", "update", "delete"];
-        readonly invitation: readonly ["create", "cancel"];
-        readonly team: readonly ["create", "update", "delete"];
-        readonly ac: readonly ["create", "read", "update", "delete"];
-      }>;
-      student: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
-        readonly course: ["read"];
-      }>, {
-        readonly course: readonly ["create", "read", "update", "delete"];
-        readonly progress: readonly ["view"];
-        readonly community: readonly ["moderate"];
+      participant: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<import("better-auth/plugins").ExactRoleStatements<{
+        readonly organization: [];
+        readonly member: [];
+        readonly invitation: [];
+        readonly team: [];
+        readonly ac: ["read"];
+      }>>, {
         readonly organization: readonly ["update", "delete"];
         readonly member: readonly ["create", "update", "delete"];
         readonly invitation: readonly ["create", "cancel"];
@@ -714,146 +464,9 @@ declare function createAuth(opts: CreateAuthOptions): import("better-auth").Auth
       }>;
     };
     creatorRole: string;
+    membershipLimit: number;
     organizationHooks: Hooks;
-  }>, BetterAuthPlugin, ...BetterAuthPlugin[], BetterAuthPlugin, {
-    id: "custom-session";
-    version: string;
-    hooks: {
-      after: {
-        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
-        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
-          user: {
-            id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            email: string;
-            emailVerified: boolean;
-            name: string;
-            image?: string | null | undefined;
-          };
-          session: {
-            id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            userId: string;
-            expiresAt: Date;
-            token: string;
-            ipAddress?: string | null | undefined;
-            userAgent?: string | null | undefined;
-          };
-          activeMemberRole: string | null;
-          activeOrganization: {
-            id: string;
-            name: string;
-            slug: string;
-          } | null;
-          organizations: {
-            id: string;
-            name: string;
-            slug: string;
-          }[];
-        }[] | undefined>>;
-      }[];
-    };
-    endpoints: {
-      getSession: import("better-auth").StrictEndpoint<"/get-session", {
-        method: "GET";
-        query: import("better-auth").ZodOptional<import("better-auth").ZodObject<{
-          disableCookieCache: import("better-auth").ZodOptional<import("better-auth").ZodCoercedBoolean<unknown>>;
-          disableRefresh: import("better-auth").ZodOptional<import("better-auth").ZodCoercedBoolean<unknown>>;
-        }, import("zod/v4/core").$strip>>;
-        metadata: {
-          CUSTOM_SESSION: boolean;
-          openapi: {
-            description: string;
-            responses: {
-              "200": {
-                description: string;
-                content: {
-                  "application/json": {
-                    schema: {
-                      type: "array";
-                      nullable: boolean;
-                      items: {
-                        $ref: string;
-                      };
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-        requireHeaders: true;
-      }, {
-        user: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          email: string;
-          emailVerified: boolean;
-          name: string;
-          image?: string | null | undefined;
-        };
-        session: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          userId: string;
-          expiresAt: Date;
-          token: string;
-          ipAddress?: string | null | undefined;
-          userAgent?: string | null | undefined;
-        };
-        activeMemberRole: string | null;
-        activeOrganization: {
-          id: string;
-          name: string;
-          slug: string;
-        } | null;
-        organizations: {
-          id: string;
-          name: string;
-          slug: string;
-        }[];
-      } | null>;
-    };
-    $Infer: {
-      Session: {
-        user: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          email: string;
-          emailVerified: boolean;
-          name: string;
-          image?: string | null | undefined;
-        };
-        session: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          userId: string;
-          expiresAt: Date;
-          token: string;
-          ipAddress?: string | null | undefined;
-          userAgent?: string | null | undefined;
-        };
-        activeMemberRole: string | null;
-        activeOrganization: {
-          id: string;
-          name: string;
-          slug: string;
-        } | null;
-        organizations: {
-          id: string;
-          name: string;
-          slug: string;
-        }[];
-      };
-    };
-    options: import("better-auth/plugins").CustomSessionPluginOptions | undefined;
-  }];
+  }>, BetterAuthPlugin, ...BetterAuthPlugin[], BetterAuthPlugin];
   hooks: {
     before: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
       context: {
@@ -882,15 +495,15 @@ type Auth = ReturnType<typeof createAuth>;
 type JSONWebKeySet = {
   keys: Array<Record<string, unknown>>;
 };
-type PluginApiKey = {
+type ApiKeyRow = {
   id: string;
   name: string | null;
   start: string | null;
   referenceId: string;
   metadata: unknown;
-  permissions: Record<string, string[]> | null;
-  createdAt: Date;
-  lastRequest: Date | null;
+  createdAt: Date | string;
+  lastRequest: Date | string | null;
+  expiresAt: Date | string | null;
 };
 type PluginApi = {
   getJwks(): Promise<JSONWebKeySet>;
@@ -900,32 +513,22 @@ type PluginApi = {
     };
   }): Promise<{
     valid: boolean;
-    key: PluginApiKey | null;
+    key: ApiKeyRow | null;
   }>;
   createApiKey(input: {
     body: {
       name: string;
       userId: string;
       metadata: Record<string, unknown>;
-      permissions: Record<string, string[]>;
+      expiresIn?: number;
     };
-  }): Promise<PluginApiKey & {
+  }): Promise<ApiKeyRow & {
     key: string;
   }>;
-  listApiKeys(input: {
-    headers: Headers;
-  }): Promise<{
-    apiKeys: PluginApiKey[];
-  }>;
-  deleteApiKey(input: {
-    body: {
-      keyId: string;
-    };
-    headers: Headers;
-  }): Promise<unknown>;
 };
-declare class BetterAuth implements SessionVerifier, OrgAdmin, SessionAdmin, AccessTokenVerifier, AppAccessAdmin {
+declare class BetterAuth implements SessionVerifier, OrgAdmin, SessionAdmin, AccessTokenVerifier, ApiKeys, Accounts {
   protected auth: Auth;
+  protected db: CreateAuthOptions["db"];
   protected logger: Logger;
   protected mcp: CreateAuthOptions["mcp"];
   protected issuer: string;
@@ -935,29 +538,563 @@ declare class BetterAuth implements SessionVerifier, OrgAdmin, SessionAdmin, Acc
   handler(request: Request): Promise<Response>;
   authorizationServerMetadata(request: Request): Promise<Response>;
   verifyAccess(request: AccessRequest): Promise<AccessGrant | null>;
+  verifyApiKey(headers: HeaderBag): Promise<AccessGrant | null>;
   protected verifyAccessToken(authorization: AccessTokenAuthorization, request: AccessRequest): Promise<AccessGrant | null>;
-  protected verifyApiKey(key: string): Promise<AccessGrant | null>;
-  protected sessionUserId(headers: HeaderBag): Promise<string>;
-  listConnectedApps(headers: HeaderBag, orgId: string): Promise<ConnectedApp[]>;
-  revokeConnectedApp(headers: HeaderBag, orgId: string, clientId: string): Promise<void>;
-  listApiKeys(headers: HeaderBag, orgId: string): Promise<ApiKeySummary[]>;
-  createApiKey(input: NewApiKey): Promise<CreatedApiKey>;
-  deleteApiKey(headers: HeaderBag, orgId: string, keyId: string): Promise<void>;
+  protected grantForKey(key: string): Promise<AccessGrant | null>;
+  protected ownKeys(orgId: string, userExternalId: string): Promise<ApiKeyRow[]>;
+  list(orgId: string, userExternalId: string): Promise<StoredApiKey[]>;
+  create(orgId: string, userExternalId: string, input: NewApiKey): Promise<StoredApiKey & {
+    key: string;
+  }>;
+  countWithRole(orgId: string, roleKey: string): Promise<number>;
+  createAccount(input: PlatformAccount): Promise<{
+    externalId: string;
+  }>;
+  revoke(orgId: string, userExternalId: string, keyId: string): Promise<void>;
+  listApps(orgId: string, userExternalId: string): Promise<ConnectedApp[]>;
+  revokeApp(orgId: string, userExternalId: string, clientId: string): Promise<void>;
+  revokeAllFor(orgId: string, userExternalId: string): Promise<void>;
   verify(headers: IncomingHttpHeaders): Promise<ActiveSession | null>;
   /** Stamps the org onto the caller's session row. The 5-minute cookie cache
    *  still holds the pre-stamp session, so callers refresh it client-side with
    *  `getSession({ disableCookieCache: true })`. */
   stampActiveOrganization(headers: AuthHeaders, orgId: string): Promise<boolean>;
   createOrganization(headers: AuthHeaders, input: NewOrganizationInput): Promise<AuthOrganization>;
+  createOrganizationFor(ownerExternalId: string, input: NewOrganizationInput): Promise<AuthOrganization>;
   setActiveOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
-  updateOrganization(headers: AuthHeaders, externalId: string, input: UpdateOrganizationInput): Promise<AuthOrganization>;
+  protected orgAdapter(): Promise<{
+    findOrganizationBySlug: (slug: string) => Promise<{
+      id: string;
+      name: string;
+      slug: string;
+      createdAt: Date;
+      logo?: string | null | undefined;
+      metadata?: any;
+    } | null>;
+    createOrganization: (data: {
+      organization: import("better-auth/plugins").OrganizationInput & Record<string, any>;
+    }) => Promise<{
+      id: string;
+      name: string;
+      slug: string;
+      createdAt: Date;
+      logo?: string | null | undefined;
+      metadata?: any;
+    }>;
+    findMemberByEmail: (data: {
+      email: string;
+      organizationId: string;
+    }) => Promise<({
+      id: string;
+      organizationId: string;
+      role: "member" | "owner" | "admin";
+      createdAt: Date;
+      userId: string;
+      user: {
+        id: string;
+        email: string;
+        name: string;
+        image?: string | undefined;
+      };
+    } & {
+      user: {
+        id: string;
+        name: string;
+        email: string;
+        image: string | null | undefined;
+      };
+    }) | null>;
+    listMembers: (data: {
+      organizationId?: string | undefined;
+      limit?: number | undefined;
+      offset?: number | undefined;
+      sortBy?: string | undefined;
+      sortOrder?: ("asc" | "desc") | undefined;
+      filter?: {
+        field: string;
+        operator?: "in" | "lte" | "eq" | "ne" | "lt" | "gt" | "gte" | "not_in" | "contains" | "starts_with" | "ends_with";
+        value: any;
+      } | undefined;
+    }) => Promise<{
+      members: ({
+        id: string;
+        organizationId: string;
+        role: "member" | "owner" | "admin";
+        createdAt: Date;
+        userId: string;
+        user: {
+          id: string;
+          email: string;
+          name: string;
+          image?: string | undefined;
+        };
+      } & {
+        user: {
+          id: string;
+          name: string;
+          email: string;
+          image: string | null | undefined;
+        };
+      })[];
+      total: number;
+    }>;
+    findMemberByOrgId: (data: {
+      userId: string;
+      organizationId: string;
+    }) => Promise<(Omit<{
+      id: string;
+      organizationId: string;
+      role: "member" | "owner" | "admin";
+      createdAt: Date;
+      userId: string;
+      user: {
+        id: string;
+        email: string;
+        name: string;
+        image?: string | undefined;
+      };
+    } & {
+      user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    }, "user"> & {
+      user: {
+        id: string;
+        name: string;
+        email: string;
+        image: string | undefined;
+      };
+    }) | null>;
+    findMemberById: (memberId: string) => Promise<({
+      id: string;
+      organizationId: string;
+      role: "member" | "owner" | "admin";
+      createdAt: Date;
+      userId: string;
+      user: {
+        id: string;
+        email: string;
+        name: string;
+        image?: string | undefined;
+      };
+    } & {
+      user: {
+        id: string;
+        name: string;
+        email: string;
+        image: string | undefined;
+      };
+    }) | null>;
+    createMember: (data: Omit<import("better-auth/plugins").MemberInput, "id"> & Record<string, any>) => Promise<{
+      id: string;
+      organizationId: string;
+      userId: string;
+      role: string;
+      createdAt: Date;
+    }>;
+    updateMember: (memberId: string, role: string) => Promise<{
+      id: string;
+      organizationId: string;
+      role: "member" | "owner" | "admin";
+      createdAt: Date;
+      userId: string;
+      user: {
+        id: string;
+        email: string;
+        name: string;
+        image?: string | undefined;
+      };
+    } | null>;
+    deleteMember: ({ memberId, organizationId, userId: _userId }: {
+      memberId: string;
+      organizationId: string;
+      userId?: string;
+    }) => Promise<void>;
+    updateOrganization: (organizationId: string, data: Partial<import("better-auth/plugins").OrganizationInput>) => Promise<{
+      id: string;
+      name: string;
+      slug: string;
+      createdAt: Date;
+      logo?: string | null | undefined;
+      metadata?: any;
+    } | null>;
+    deleteOrganization: (organizationId: string) => Promise<string>;
+    setActiveOrganization: (sessionToken: string, organizationId: string | null, ctx: import("better-auth").GenericEndpointContext) => Promise<{
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    }>;
+    findOrganizationById: (organizationId: string) => Promise<{
+      id: string;
+      name: string;
+      slug: string;
+      createdAt: Date;
+      logo?: string | null | undefined;
+      metadata?: any;
+    } | null>;
+    checkMembership: ({ userId, organizationId }: {
+      userId: string;
+      organizationId: string;
+    }) => Promise<{
+      id: string;
+      organizationId: string;
+      role: "member" | "owner" | "admin";
+      createdAt: Date;
+      userId: string;
+      user: {
+        id: string;
+        email: string;
+        name: string;
+        image?: string | undefined;
+      };
+    } | null>;
+    findFullOrganization: ({ organizationId, isSlug, includeTeams, membersLimit }: {
+      organizationId: string;
+      isSlug?: boolean | undefined;
+      includeTeams?: boolean | undefined;
+      membersLimit?: number | undefined;
+    }) => Promise<(Omit<{
+      id: string;
+      name: string;
+      slug: string;
+      createdAt: Date;
+      logo?: string | null | undefined | undefined;
+      metadata?: any;
+    } & {
+      invitation: {
+        id: string;
+        organizationId: string;
+        email: string;
+        role: "member" | "owner" | "admin";
+        status: import("better-auth/plugins").InvitationStatus;
+        inviterId: string;
+        expiresAt: Date;
+        createdAt: Date;
+      }[];
+      member: {
+        id: string;
+        organizationId: string;
+        role: "member" | "owner" | "admin";
+        createdAt: Date;
+        userId: string;
+        user: {
+          id: string;
+          email: string;
+          name: string;
+          image?: string | undefined;
+        };
+      }[];
+      team: {
+        id: string;
+        name: string;
+        organizationId: string;
+        createdAt: Date;
+        updatedAt?: Date | undefined;
+      }[] | undefined;
+    }, "member" | "invitation" | "team"> & {
+      invitations: {
+        id: string;
+        organizationId: string;
+        email: string;
+        role: "member" | "owner" | "admin";
+        status: import("better-auth/plugins").InvitationStatus;
+        inviterId: string;
+        expiresAt: Date;
+        createdAt: Date;
+      }[];
+      members: ({
+        id: string;
+        organizationId: string;
+        role: "member" | "owner" | "admin";
+        createdAt: Date;
+        userId: string;
+        user: {
+          id: string;
+          email: string;
+          name: string;
+          image?: string | undefined;
+        };
+      } & {
+        user: {
+          id: string;
+          name: string;
+          email: string;
+          image: string | null | undefined;
+        };
+      })[];
+      teams: {
+        id: string;
+        name: string;
+        organizationId: string;
+        createdAt: Date;
+        updatedAt?: Date | undefined;
+      }[] | undefined;
+    }) | null>;
+    listOrganizations: (userId: string) => Promise<{
+      id: string;
+      name: string;
+      slug: string;
+      createdAt: Date;
+      logo?: string | null | undefined;
+      metadata?: any;
+    }[]>;
+    createTeam: (data: import("better-auth/plugins").TeamInput) => Promise<{
+      id: string;
+      name: string;
+      organizationId: string;
+      createdAt: Date;
+      updatedAt?: Date | undefined;
+    }>;
+    findTeamById: <IncludeMembers extends boolean>({ teamId, organizationId, includeTeamMembers }: {
+      teamId: string;
+      organizationId?: string | undefined;
+      includeTeamMembers?: IncludeMembers | undefined;
+    }) => Promise<({
+      id: string;
+      name: string;
+      organizationId: string;
+      createdAt: Date;
+      updatedAt?: Date | undefined;
+    } & (IncludeMembers extends true ? {
+      members: import("better-auth/plugins").TeamMember[];
+    } : {})) | null>;
+    updateTeam: (teamId: string, data: {
+      name?: string | undefined;
+      description?: string | undefined;
+      status?: string | undefined;
+    }) => Promise<{
+      id: string;
+      name: string;
+      organizationId: string;
+      createdAt: Date;
+      updatedAt?: Date | undefined;
+    } | null>;
+    deleteTeam: (teamId: string) => Promise<void>;
+    listTeams: (organizationId: string) => Promise<{
+      id: string;
+      name: string;
+      organizationId: string;
+      createdAt: Date;
+      updatedAt?: Date | undefined;
+    }[]>;
+    createTeamInvitation: ({ email, role, teamId, organizationId, inviterId, expiresIn }: {
+      email: string;
+      role: string;
+      teamId: string;
+      organizationId: string;
+      inviterId: string;
+      expiresIn?: number | undefined;
+    }) => Promise<{
+      id: string;
+      organizationId: string;
+      email: string;
+      role: "member" | "owner" | "admin";
+      status: import("better-auth/plugins").InvitationStatus;
+      inviterId: string;
+      expiresAt: Date;
+      createdAt: Date;
+    }>;
+    setActiveTeam: (sessionToken: string, teamId: string | null, ctx: import("better-auth").GenericEndpointContext) => Promise<{
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    }>;
+    listTeamMembers: (data: {
+      teamId: string;
+    }) => Promise<{
+      id: string;
+      teamId: string;
+      userId: string;
+      createdAt: Date;
+    }[]>;
+    countTeamMembers: (data: {
+      teamId: string;
+    }) => Promise<number>;
+    countMembers: (data: {
+      organizationId: string;
+    }) => Promise<number>;
+    listTeamsByUser: (data: {
+      userId: string;
+    }) => Promise<{
+      id: string;
+      name: string;
+      organizationId: string;
+      createdAt: Date;
+      updatedAt?: Date | undefined;
+    }[]>;
+    findTeamMember: (data: {
+      teamId: string;
+      userId: string;
+    }) => Promise<{
+      id: string;
+      teamId: string;
+      userId: string;
+      createdAt: Date;
+    } | null>;
+    findOrCreateTeamMember: (data: {
+      teamId: string;
+      userId: string;
+    }) => Promise<{
+      id: string;
+      teamId: string;
+      userId: string;
+      createdAt: Date;
+    }>;
+    addTeamMemberWithLimit: (data: {
+      teamId: string;
+      userId: string;
+      maximumMembersPerTeam: number;
+    }) => Promise<{
+      status: "added";
+      member: import("better-auth/plugins").TeamMember;
+    } | {
+      status: "limitReached";
+    }>;
+    removeTeamMember: (data: {
+      teamId: string;
+      userId: string;
+    }) => Promise<void>;
+    findInvitationsByTeamId: (teamId: string) => Promise<{
+      id: string;
+      organizationId: string;
+      email: string;
+      role: "member" | "owner" | "admin";
+      status: import("better-auth/plugins").InvitationStatus;
+      inviterId: string;
+      expiresAt: Date;
+      createdAt: Date;
+    }[]>;
+    listUserInvitations: (email: string) => Promise<(Omit<{
+      id: string;
+      organizationId: string;
+      email: string;
+      role: "member" | "owner" | "admin";
+      status: import("better-auth/plugins").InvitationStatus;
+      inviterId: string;
+      expiresAt: Date;
+      createdAt: Date;
+    } & {
+      organization: {
+        id: string;
+        name: string;
+        slug: string;
+        createdAt: Date;
+        logo?: string | null | undefined;
+        metadata?: any;
+      };
+    }, "organization"> & {
+      organizationName: string;
+    })[]>;
+    createInvitation: ({ invitation, user }: {
+      invitation: {
+        email: string;
+        role: string;
+        organizationId: string;
+        teamIds: string[];
+      } & Record<string, any>;
+      user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    }) => Promise<{
+      id: string;
+      organizationId: string;
+      email: string;
+      role: "member" | "owner" | "admin";
+      status: import("better-auth/plugins").InvitationStatus;
+      inviterId: string;
+      expiresAt: Date;
+      createdAt: Date;
+    }>;
+    findInvitationById: (id: string) => Promise<{
+      id: string;
+      organizationId: string;
+      email: string;
+      role: "member" | "owner" | "admin";
+      status: import("better-auth/plugins").InvitationStatus;
+      inviterId: string;
+      expiresAt: Date;
+      createdAt: Date;
+    } | null>;
+    findPendingInvitation: (data: {
+      email: string;
+      organizationId: string;
+    }) => Promise<{
+      id: string;
+      organizationId: string;
+      email: string;
+      role: "member" | "owner" | "admin";
+      status: import("better-auth/plugins").InvitationStatus;
+      inviterId: string;
+      expiresAt: Date;
+      createdAt: Date;
+    }[]>;
+    findPendingInvitations: (data: {
+      organizationId: string;
+    }) => Promise<{
+      id: string;
+      organizationId: string;
+      email: string;
+      role: "member" | "owner" | "admin";
+      status: import("better-auth/plugins").InvitationStatus;
+      inviterId: string;
+      expiresAt: Date;
+      createdAt: Date;
+    }[]>;
+    listInvitations: (data: {
+      organizationId: string;
+    }) => Promise<{
+      id: string;
+      organizationId: string;
+      email: string;
+      role: "member" | "owner" | "admin";
+      status: import("better-auth/plugins").InvitationStatus;
+      inviterId: string;
+      expiresAt: Date;
+      createdAt: Date;
+    }[]>;
+    updateInvitation: (data: {
+      invitationId: string;
+      status: "pending" | "accepted" | "canceled" | "rejected";
+      fromStatus?: "pending" | "accepted" | "canceled" | "rejected";
+    }) => Promise<{
+      id: string;
+      organizationId: string;
+      email: string;
+      role: "member" | "owner" | "admin";
+      status: import("better-auth/plugins").InvitationStatus;
+      inviterId: string;
+      expiresAt: Date;
+      createdAt: Date;
+    } | null>;
+  }>;
+  updateOrganization(externalId: string, input: UpdateOrganizationInput): Promise<void>;
   deleteOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
-  grantMembership(orgExternalId: string, userExternalId: string, role: string): Promise<void>;
-  updateRole(ctx: MemberWriteContext, userExternalId: string, role: Role): Promise<void>;
-  removeMember(ctx: MemberWriteContext, userExternalId: string): Promise<void>;
-  protected headersOf(ctx: MemberWriteContext): Headers;
-  protected resolveMemberId(ctx: MemberWriteContext, userExternalId: string): Promise<string>;
+  grantMembership(orgExternalId: string, userExternalId: string): Promise<void>;
+  setMembershipOwner(orgExternalId: string, userExternalId: string, owner: boolean): Promise<void>;
+  removeMembership(orgExternalId: string, userExternalId: string): Promise<void>;
 }
 //#endregion
-export { Auth, BetterAuth, buildAuthOptions, createAuth };
+export { API_KEY_PREFIX, Auth, BetterAuth, buildAuthOptions, createAuth };
 //# sourceMappingURL=better-auth.d.ts.map