@meistrari/auth-core 1.13.2 → 1.14.0

package/dist/index.d.mts

@@ -1,7 +1,8 @@
 import * as better_auth_plugins from 'better-auth/plugins';
 import * as better_auth from 'better-auth';
-import { JWTPayload } from 'better-auth';
+import { JWTPayload as JWTPayload$1 } from 'better-auth';
 export { APIError } from 'better-auth';
+import { z } from 'zod';
 import * as better_auth_client from 'better-auth/client';
 import { BetterFetchOption } from 'better-auth/client';
 import * as jose from 'jose';
@@ -188,20 +189,33 @@ declare const memberAdditionalFields: {
         defaultValue: null;
     };
 };
-type JWTTokenPayload = JWTPayload & {
-    email: string;
-    user: {
-        id: string;
-        name: string;
-        image: string | null | undefined;
-        role: string | null;
-    };
-    workspace: {
-        id: string;
-        title: string;
-    };
-    sessionKey: string;
-};
+declare const JWTPayloadUser: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    role: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type JWTPayloadUser = z.infer<typeof JWTPayloadUser>;
+declare const JWTPayloadWorkspace: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+}, z.core.$strip>;
+type JWTPayloadWorkspace = z.infer<typeof JWTPayloadWorkspace>;
+declare const JWTPayload: z.ZodObject<{
+    email: z.ZodString;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        role: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    workspace: z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+    }, z.core.$strip>;
+    sessionKey: z.ZodString;
+}, z.core.$strip>;
+type JWTPayload = JWTPayload$1 & z.infer<typeof JWTPayload>;
 
 type ApiKeyMetadata = {
     user: {
@@ -3310,6 +3324,61 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             data: StartAuthorizationFlowResponse;
             error: null;
         }>;
+        startDeviceAuthorizationFlow: (requesterApplicationId: string, targetApplicationId: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: DeviceAuthorizationResponse;
+            error: null;
+        }>;
+        getDeviceAuthorizationContext: (userCode: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: DeviceAuthorizationContextResponse;
+            error: null;
+        }>;
+        approveDeviceAuthorizationFlow: (userCode: string, organizationId: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: DeviceAuthorizationActionResponse;
+            error: null;
+        }>;
+        denyDeviceAuthorizationFlow: (userCode: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: DeviceAuthorizationActionResponse;
+            error: null;
+        }>;
+        exchangeDeviceCodeForTokens: (deviceCode: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: CompleteAuthorizationFlowResponse;
+            error: null;
+        }>;
         completeAuthorizationFlow: (code: string, codeVerifier: string) => Promise<{
             data: null;
             error: {
@@ -4346,6 +4415,32 @@ type WhoAmIResponse = {
     user: User;
     organization: FullOrganization;
 };
+type DeviceAuthorizationResponse = {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+};
+type DeviceContextApplication = {
+    id: string;
+    name: string;
+    description: string | null;
+};
+type DeviceAuthorizationContextResponse = {
+    requester: DeviceContextApplication & {
+        isVerified: boolean;
+    };
+    target: DeviceContextApplication;
+    organizations: FullOrganization[];
+    preselectedOrganizationId: string | null;
+    status: 'pending' | 'approved' | 'denied';
+    expiresIn: number;
+};
+type DeviceAuthorizationActionResponse = {
+    success: boolean;
+};
 
 declare class BaseError extends Error {
     code: string;
@@ -4364,6 +4459,21 @@ declare class AuthorizationFlowError extends ApplicationError {
 declare class UserNotLoggedInError extends ApplicationError {
     constructor(message: string, options?: ErrorOptions);
 }
+declare class DeviceAuthorizationPendingError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+declare class DeviceAuthorizationSlowDownError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+declare class DeviceAccessDeniedError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+declare class DeviceCodeExpiredError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+declare class DeviceTransientServerError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
 
 /**
  * Service for managing applications and their candidate organizations.
@@ -4404,6 +4514,11 @@ declare class ApplicationService {
      * @param organizationId - The organization ID to start the authorization flow for
      */
     startAuthorizationFlow(applicationId: string, redirectUri: string, codeChallenge: string, organizationId: string): Promise<StartAuthorizationFlowResponse>;
+    startDeviceAuthorizationFlow(requesterApplicationId: string, targetApplicationId: string): Promise<DeviceAuthorizationResponse>;
+    getDeviceAuthorizationContext(userCode: string): Promise<DeviceAuthorizationContextResponse>;
+    approveDeviceAuthorizationFlow(userCode: string, organizationId: string): Promise<DeviceAuthorizationActionResponse>;
+    denyDeviceAuthorizationFlow(userCode: string): Promise<DeviceAuthorizationActionResponse>;
+    exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
     /**
      * Completes an authorization flow for a specific application.
      *
@@ -5067,7 +5182,7 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  * console.log(payload.exp) // expiration timestamp
  * ```
  */
-declare function extractTokenPayload(token: string): JWTTokenPayload;
+declare function extractTokenPayload(token: string): JWTPayload;
 
-export { ApplicationError, AuthClient, AuthorizationFlowError, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, RefreshTokenExpiredError, Roles, UserNotLoggedInError, ac, createAPIClient, extractTokenPayload, isTokenExpired, memberAdditionalFields, organizationAdditionalFields, rolesAccessControl, userAdditionalFields, validateToken };
-export type { APIClient, ApiKey, ApiKeyMetadata, ApiKeyWithoutSecret, Application, CompleteAuthorizationFlowResponse, CreateApiKeyPayload, CreateTeamPayload, FullOrganization, Invitation, InviteUserToOrganizationOptions, JWTTokenPayload, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, RemoveUserFromOrganizationOptions, Role, Session, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Team, TeamMember, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIResponse };
+export { ApplicationError, AuthClient, AuthorizationFlowError, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadUser, JWTPayloadWorkspace, RefreshTokenExpiredError, Roles, UserNotLoggedInError, ac, createAPIClient, extractTokenPayload, isTokenExpired, memberAdditionalFields, organizationAdditionalFields, rolesAccessControl, userAdditionalFields, validateToken };
+export type { APIClient, ApiKey, ApiKeyMetadata, ApiKeyWithoutSecret, Application, CompleteAuthorizationFlowResponse, CreateApiKeyPayload, CreateTeamPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, FullOrganization, Invitation, InviteUserToOrganizationOptions, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, RemoveUserFromOrganizationOptions, Role, Session, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Team, TeamMember, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIResponse };

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 import * as better_auth_plugins from 'better-auth/plugins';
 import * as better_auth from 'better-auth';
-import { JWTPayload } from 'better-auth';
+import { JWTPayload as JWTPayload$1 } from 'better-auth';
 export { APIError } from 'better-auth';
+import { z } from 'zod';
 import * as better_auth_client from 'better-auth/client';
 import { BetterFetchOption } from 'better-auth/client';
 import * as jose from 'jose';
@@ -188,20 +189,33 @@ declare const memberAdditionalFields: {
         defaultValue: null;
     };
 };
-type JWTTokenPayload = JWTPayload & {
-    email: string;
-    user: {
-        id: string;
-        name: string;
-        image: string | null | undefined;
-        role: string | null;
-    };
-    workspace: {
-        id: string;
-        title: string;
-    };
-    sessionKey: string;
-};
+declare const JWTPayloadUser: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    role: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type JWTPayloadUser = z.infer<typeof JWTPayloadUser>;
+declare const JWTPayloadWorkspace: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+}, z.core.$strip>;
+type JWTPayloadWorkspace = z.infer<typeof JWTPayloadWorkspace>;
+declare const JWTPayload: z.ZodObject<{
+    email: z.ZodString;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        role: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    workspace: z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+    }, z.core.$strip>;
+    sessionKey: z.ZodString;
+}, z.core.$strip>;
+type JWTPayload = JWTPayload$1 & z.infer<typeof JWTPayload>;
 
 type ApiKeyMetadata = {
     user: {
@@ -3310,6 +3324,61 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             data: StartAuthorizationFlowResponse;
             error: null;
         }>;
+        startDeviceAuthorizationFlow: (requesterApplicationId: string, targetApplicationId: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: DeviceAuthorizationResponse;
+            error: null;
+        }>;
+        getDeviceAuthorizationContext: (userCode: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: DeviceAuthorizationContextResponse;
+            error: null;
+        }>;
+        approveDeviceAuthorizationFlow: (userCode: string, organizationId: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: DeviceAuthorizationActionResponse;
+            error: null;
+        }>;
+        denyDeviceAuthorizationFlow: (userCode: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: DeviceAuthorizationActionResponse;
+            error: null;
+        }>;
+        exchangeDeviceCodeForTokens: (deviceCode: string) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: CompleteAuthorizationFlowResponse;
+            error: null;
+        }>;
         completeAuthorizationFlow: (code: string, codeVerifier: string) => Promise<{
             data: null;
             error: {
@@ -4346,6 +4415,32 @@ type WhoAmIResponse = {
     user: User;
     organization: FullOrganization;
 };
+type DeviceAuthorizationResponse = {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+};
+type DeviceContextApplication = {
+    id: string;
+    name: string;
+    description: string | null;
+};
+type DeviceAuthorizationContextResponse = {
+    requester: DeviceContextApplication & {
+        isVerified: boolean;
+    };
+    target: DeviceContextApplication;
+    organizations: FullOrganization[];
+    preselectedOrganizationId: string | null;
+    status: 'pending' | 'approved' | 'denied';
+    expiresIn: number;
+};
+type DeviceAuthorizationActionResponse = {
+    success: boolean;
+};
 
 declare class BaseError extends Error {
     code: string;
@@ -4364,6 +4459,21 @@ declare class AuthorizationFlowError extends ApplicationError {
 declare class UserNotLoggedInError extends ApplicationError {
     constructor(message: string, options?: ErrorOptions);
 }
+declare class DeviceAuthorizationPendingError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+declare class DeviceAuthorizationSlowDownError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+declare class DeviceAccessDeniedError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+declare class DeviceCodeExpiredError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+declare class DeviceTransientServerError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
 
 /**
  * Service for managing applications and their candidate organizations.
@@ -4404,6 +4514,11 @@ declare class ApplicationService {
      * @param organizationId - The organization ID to start the authorization flow for
      */
     startAuthorizationFlow(applicationId: string, redirectUri: string, codeChallenge: string, organizationId: string): Promise<StartAuthorizationFlowResponse>;
+    startDeviceAuthorizationFlow(requesterApplicationId: string, targetApplicationId: string): Promise<DeviceAuthorizationResponse>;
+    getDeviceAuthorizationContext(userCode: string): Promise<DeviceAuthorizationContextResponse>;
+    approveDeviceAuthorizationFlow(userCode: string, organizationId: string): Promise<DeviceAuthorizationActionResponse>;
+    denyDeviceAuthorizationFlow(userCode: string): Promise<DeviceAuthorizationActionResponse>;
+    exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
     /**
      * Completes an authorization flow for a specific application.
      *
@@ -5067,7 +5182,7 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  * console.log(payload.exp) // expiration timestamp
  * ```
  */
-declare function extractTokenPayload(token: string): JWTTokenPayload;
+declare function extractTokenPayload(token: string): JWTPayload;
 
-export { ApplicationError, AuthClient, AuthorizationFlowError, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, RefreshTokenExpiredError, Roles, UserNotLoggedInError, ac, createAPIClient, extractTokenPayload, isTokenExpired, memberAdditionalFields, organizationAdditionalFields, rolesAccessControl, userAdditionalFields, validateToken };
-export type { APIClient, ApiKey, ApiKeyMetadata, ApiKeyWithoutSecret, Application, CompleteAuthorizationFlowResponse, CreateApiKeyPayload, CreateTeamPayload, FullOrganization, Invitation, InviteUserToOrganizationOptions, JWTTokenPayload, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, RemoveUserFromOrganizationOptions, Role, Session, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Team, TeamMember, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIResponse };
+export { ApplicationError, AuthClient, AuthorizationFlowError, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadUser, JWTPayloadWorkspace, RefreshTokenExpiredError, Roles, UserNotLoggedInError, ac, createAPIClient, extractTokenPayload, isTokenExpired, memberAdditionalFields, organizationAdditionalFields, rolesAccessControl, userAdditionalFields, validateToken };
+export type { APIClient, ApiKey, ApiKeyMetadata, ApiKeyWithoutSecret, Application, CompleteAuthorizationFlowResponse, CreateApiKeyPayload, CreateTeamPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, FullOrganization, Invitation, InviteUserToOrganizationOptions, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, RemoveUserFromOrganizationOptions, Role, Session, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Team, TeamMember, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIResponse };

package/dist/index.mjs

@@ -5,9 +5,10 @@ import { createAuthClient } from 'better-auth/client';
 import { organizationClient, inferOrgAdditionalFields, twoFactorClient, jwtClient, adminClient, inferAdditionalFields } from 'better-auth/client/plugins';
 import { createAccessControl } from 'better-auth/plugins/access';
 import { defaultStatements } from 'better-auth/plugins/organization/access';
+import { z } from 'zod';
 export { APIError } from 'better-auth';
 
-const version = "1.13.2";
+const version = "1.14.0";
 
 const statements = {
   ...defaultStatements,
@@ -60,7 +61,24 @@ const memberAdditionalFields = {
     defaultValue: null
   }
 };
+const JWTPayloadUser = z.object({
+  id: z.string(),
+  name: z.string(),
+  image: z.string().nullable().optional(),
+  role: z.string().nullable()
+});
+const JWTPayloadWorkspace = z.object({
+  id: z.string(),
+  title: z.string()
+});
+const JWTPayload = z.object({
+  email: z.string(),
+  user: JWTPayloadUser,
+  workspace: JWTPayloadWorkspace,
+  sessionKey: z.string()
+});
 
+const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 function applicationsPluginClient() {
   return {
     id: "applications",
@@ -93,6 +111,49 @@ function applicationsPluginClient() {
               }
             });
           },
+          startDeviceAuthorizationFlow: async (requesterApplicationId, targetApplicationId) => {
+            return await $fetch("/applications/device/authorize", {
+              method: "POST",
+              body: {
+                requesterApplicationId,
+                targetApplicationId
+              }
+            });
+          },
+          getDeviceAuthorizationContext: async (userCode) => {
+            return await $fetch("/applications/device/context", {
+              method: "GET",
+              query: {
+                userCode
+              }
+            });
+          },
+          approveDeviceAuthorizationFlow: async (userCode, organizationId) => {
+            return await $fetch("/applications/device/approve", {
+              method: "POST",
+              body: {
+                userCode,
+                organizationId
+              }
+            });
+          },
+          denyDeviceAuthorizationFlow: async (userCode) => {
+            return await $fetch("/applications/device/deny", {
+              method: "POST",
+              body: {
+                userCode
+              }
+            });
+          },
+          exchangeDeviceCodeForTokens: async (deviceCode) => {
+            return await $fetch("/applications/token", {
+              method: "POST",
+              body: {
+                grantType: DEVICE_CODE_GRANT,
+                deviceCode
+              }
+            });
+          },
           completeAuthorizationFlow: async (code, codeVerifier) => {
             return await $fetch("/applications/token", {
               method: "POST",
@@ -224,7 +285,70 @@ class UserNotLoggedInError extends ApplicationError {
     this.code = "USER_NOT_LOGGED_IN";
   }
 }
+class DeviceAuthorizationPendingError extends ApplicationError {
+  constructor(options) {
+    super("Authorization is still pending", options);
+    this.code = "AUTHORIZATION_PENDING";
+  }
+}
+class DeviceAuthorizationSlowDownError extends ApplicationError {
+  constructor(options) {
+    super("Polling too frequently. Slow down and retry later.", options);
+    this.code = "SLOW_DOWN";
+  }
+}
+class DeviceAccessDeniedError extends ApplicationError {
+  constructor(options) {
+    super("The user denied the device authorization request", options);
+    this.code = "ACCESS_DENIED";
+  }
+}
+class DeviceCodeExpiredError extends ApplicationError {
+  constructor(options) {
+    super("The device code expired or has already been consumed", options);
+    this.code = "EXPIRED_TOKEN";
+  }
+}
+class DeviceTransientServerError extends ApplicationError {
+  constructor(options) {
+    super("The authorization server returned a transient error. The exchange can be safely retried.", options);
+    this.code = "TRANSIENT_SERVER_ERROR";
+  }
+}
 
+function parseErrorCode(error) {
+  if (!error || typeof error !== "object") {
+    return null;
+  }
+  const candidateError = error;
+  return candidateError.code ?? candidateError.error?.code ?? null;
+}
+function parseErrorMessage(error) {
+  if (!error || typeof error !== "object") {
+    return "Failed to exchange device code for tokens";
+  }
+  const candidateError = error;
+  return candidateError.message ?? candidateError.error?.message ?? "Failed to exchange device code for tokens";
+}
+function throwDeviceGrantError(error) {
+  const code = parseErrorCode(error);
+  if (code === "authorization_pending") {
+    throw new DeviceAuthorizationPendingError({ cause: error });
+  }
+  if (code === "slow_down") {
+    throw new DeviceAuthorizationSlowDownError({ cause: error });
+  }
+  if (code === "access_denied") {
+    throw new DeviceAccessDeniedError({ cause: error });
+  }
+  if (code === "expired_token") {
+    throw new DeviceCodeExpiredError({ cause: error });
+  }
+  if (code === "temporarily_unavailable") {
+    throw new DeviceTransientServerError({ cause: error });
+  }
+  throw new ApplicationError(parseErrorMessage(error), { cause: error });
+}
 class ApplicationService {
   /**
    * Creates a new ApplicationService instance.
@@ -265,6 +389,41 @@ class ApplicationService {
     }
     return response.data;
   }
+  async startDeviceAuthorizationFlow(requesterApplicationId, targetApplicationId) {
+    const response = await this.client.applications.startDeviceAuthorizationFlow(requesterApplicationId, targetApplicationId);
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data;
+  }
+  async getDeviceAuthorizationContext(userCode) {
+    const response = await this.client.applications.getDeviceAuthorizationContext(userCode);
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data;
+  }
+  async approveDeviceAuthorizationFlow(userCode, organizationId) {
+    const response = await this.client.applications.approveDeviceAuthorizationFlow(userCode, organizationId);
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data;
+  }
+  async denyDeviceAuthorizationFlow(userCode) {
+    const response = await this.client.applications.denyDeviceAuthorizationFlow(userCode);
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data;
+  }
+  async exchangeDeviceCodeForTokens(deviceCode) {
+    const response = await this.client.applications.exchangeDeviceCodeForTokens(deviceCode);
+    if (!response.data) {
+      throwDeviceGrantError(response.error);
+    }
+    return response.data;
+  }
   /**
    * Completes an authorization flow for a specific application.
    *
@@ -860,4 +1019,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { ApplicationError, AuthClient, AuthorizationFlowError, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, RefreshTokenExpiredError, Roles, UserNotLoggedInError, ac, extractTokenPayload, isTokenExpired, memberAdditionalFields, organizationAdditionalFields, rolesAccessControl, userAdditionalFields, validateToken };
+export { ApplicationError, AuthClient, AuthorizationFlowError, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadUser, JWTPayloadWorkspace, RefreshTokenExpiredError, Roles, UserNotLoggedInError, ac, extractTokenPayload, isTokenExpired, memberAdditionalFields, organizationAdditionalFields, rolesAccessControl, userAdditionalFields, validateToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.13.2",
+  "version": "1.14.0",
   "type": "module",
   "exports": {
     ".": {
@@ -20,7 +20,8 @@
     "@better-auth/api-key": "1.5.4",
     "@better-auth/sso": "1.5.4",
     "better-auth": "1.5.4",
-    "jose": "6.1.3"
+    "jose": "6.1.3",
+    "zod": "4.3.6"
   },
   "devDependencies": {
     "@types/node": "latest",