@meistrari/auth-core 1.20.0 → 1.21.0

package/dist/index.d.mts

@@ -2,13 +2,95 @@ import * as better_auth_plugins from 'better-auth/plugins';
 import * as better_auth from 'better-auth';
 import { JWTPayload as JWTPayload$1 } from 'better-auth';
 export { APIError } from 'better-auth';
-import z$1, { z } from 'zod';
+import z, { z as z$1 } from 'zod';
 import * as better_auth_client from 'better-auth/client';
 import { BetterFetchOption } from 'better-auth/client';
 import * as jose from 'jose';
 import * as _better_auth_sso from '@better-auth/sso';
 import { ApiKey as ApiKey$1 } from '@better-auth/api-key';
 
+declare const AMRBrand: unique symbol;
+declare const AALBrand: unique symbol;
+declare const ACRBrand: unique symbol;
+declare const AuthMethodBrand: unique symbol;
+declare const AMRs: {
+    readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+};
+declare const AALs: {
+    readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
+    readonly Aal2: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
+    readonly Aal3: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
+};
+declare const ACRs: {
+    readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
+};
+declare const AuthMethods: {
+    readonly Password: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly EmailOTP: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly OAuth: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly SAML: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly Unknown: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+};
+declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
+    readonly Pwd: "pwd";
+    readonly Otp: "otp";
+    readonly Oauth: "oauth";
+    readonly Sso: "sso";
+    readonly Saml: "saml";
+}>, typeof AMRBrand, "out">;
+type AMR = z.infer<typeof AMR>;
+declare const AAL: z.core.$ZodBranded<z.ZodEnum<{
+    readonly Aal1: "aal1";
+    readonly Aal2: "aal2";
+    readonly Aal3: "aal3";
+}>, typeof AALBrand, "out">;
+type AAL = z.infer<typeof AAL>;
+declare const ACR: z.core.$ZodBranded<z.ZodEnum<{
+    readonly Unspecified: "urn:tela:auth:unspecified";
+}>, typeof ACRBrand, "out">;
+type ACR = z.infer<typeof ACR>;
+declare const AuthMethod: z.core.$ZodBranded<z.ZodEnum<{
+    readonly Password: "password";
+    readonly EmailOTP: "email_otp";
+    readonly OAuth: "oauth";
+    readonly SAML: "saml";
+    readonly Unknown: "unknown";
+}>, typeof AuthMethodBrand, "out">;
+type AuthMethod = z.infer<typeof AuthMethod>;
+declare const assuranceFields: {
+    authMethod: {
+        type: "string";
+        required: true;
+    };
+    amr: {
+        type: "json";
+        required: true;
+    };
+    aal: {
+        type: "string";
+        required: true;
+    };
+    acr: {
+        type: "string";
+        required: true;
+    };
+    assuredAt: {
+        type: "date";
+        required: true;
+    };
+};
+type AssuranceFields = {
+    authMethod: AuthMethod;
+    amr: AMR[];
+    aal: AAL;
+    acr: ACR;
+    assuredAt: Date;
+};
+
 declare const ac: {
     newRole<K extends "member" | "access" | "organization" | "invitation" | "team" | "ac">(statements: better_auth_plugins.Subset<K, {
         access: string[];
@@ -224,61 +306,249 @@ declare const invitationAdditionalFields: {
 /**
  * Zod schema and type for the `user` claim within a JWT payload.
  */
-declare const JWTPayloadUser: z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodString;
-    image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    role: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
-type JWTPayloadUser = z.infer<typeof JWTPayloadUser>;
+declare const JWTPayloadUser: z$1.ZodObject<{
+    id: z$1.ZodString;
+    name: z$1.ZodString;
+    image: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+    role: z$1.ZodNullable<z$1.ZodString>;
+}, z$1.core.$strip>;
+type JWTPayloadUser = z$1.infer<typeof JWTPayloadUser>;
 /**
  * Zod schema and type for the `workspace` claim within a JWT payload.
  */
-declare const JWTPayloadWorkspace: z.ZodObject<{
-    id: z.ZodString;
-    title: z.ZodString;
-}, z.core.$strip>;
-type JWTPayloadWorkspace = z.infer<typeof JWTPayloadWorkspace>;
+declare const JWTPayloadWorkspace: z$1.ZodObject<{
+    id: z$1.ZodString;
+    title: z$1.ZodString;
+}, z$1.core.$strip>;
+type JWTPayloadWorkspace = z$1.infer<typeof JWTPayloadWorkspace>;
+type JWTPayloadAssurance = {
+    authMethod: AuthMethod;
+    amr: AMR[];
+    aal: AAL;
+    acr: ACR;
+    assuredAt: string;
+};
+declare const JWTPayloadAssurance: z$1.ZodType<JWTPayloadAssurance>;
+declare const DEFAULT_JWT_ASSURANCE: JWTPayloadAssurance;
+type JWTPayloadData = {
+    email: string;
+    user: JWTPayloadUser;
+    workspace: JWTPayloadWorkspace;
+    sessionKey: string;
+    assurance: JWTPayloadAssurance;
+};
 /**
  * Zod schema and type for the full JWT payload issued by the auth API.
  *
  * Includes `email`, `user`, `workspace`, and `sessionKey` claims
  * on top of the standard Better Auth JWT fields (`sub`, `iss`, `exp`, etc.).
  */
-declare const JWTPayload: z.ZodObject<{
-    email: z.ZodString;
+declare const JWTPayload: z$1.ZodType<JWTPayloadData>;
+type JWTPayload = JWTPayload$1 & JWTPayloadData;
+
+declare const OAuthStepUpProvider: z.ZodEnum<{
+    google: "google";
+    microsoft: "microsoft";
+}>;
+type OAuthStepUpProvider = z.infer<typeof OAuthStepUpProvider>;
+type StepUpOption = {
+    method: typeof AMRs.Pwd;
+} | {
+    method: typeof AMRs.Otp;
+} | {
+    method: typeof AMRs.Oauth;
+    providers: OAuthStepUpProvider[];
+};
+declare const StepUpOption: z.ZodType<StepUpOption>;
+type SessionAssurancePolicy = {
+    minAal: typeof AALs.Aal1 | typeof AALs.Aal2 | typeof AALs.Aal3;
+    acceptedAmr: AMR[];
+};
+declare const SessionAssurancePolicy: z.ZodType<SessionAssurancePolicy>;
+declare const SENSITIVE_ACTION_ASSURANCE_POLICY: SessionAssurancePolicy;
+declare function getAalRank(aal: JWTPayload['assurance']['aal']): number;
+declare function isAssuranceSufficientForPolicy(assurance: JWTPayload['assurance'] | null | undefined, policy: SessionAssurancePolicy): boolean;
+declare function canStepUpWithAmr(assurance: JWTPayload['assurance'], amr: AMR): boolean;
+declare function mergeStepUpAssurance(assurance: JWTPayload['assurance'], amr: AMR, now?: Date): JWTPayload['assurance'];
+
+/**
+ * Base error class for all SDK errors.
+ *
+ * Extends the native `Error` with a machine-readable `code` property
+ * that can be used for programmatic error handling.
+ */
+declare class BaseError extends Error {
+    /** Machine-readable error code (e.g. `"INVALID_SOCIAL_PROVIDER"`). */
+    code: string;
+    /**
+     * @param code - A machine-readable error code
+     * @param message - A human-readable error message
+     * @param options - Standard `ErrorOptions` (e.g. `cause`)
+     */
+    constructor(code: string, message: string, options?: ErrorOptions);
+}
+
+declare const SessionAssuranceRequiredPayload: z.ZodObject<{
+    code: z.ZodEnum<{
+        session_assurance_required: "session_assurance_required";
+        application_session_assurance_not_met: "application_session_assurance_not_met";
+    }>;
+    currentAssurance: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodType<JWTPayloadAssurance, unknown, z.core.$ZodTypeInternals<JWTPayloadAssurance, unknown>>>;
+    requiredAssurance: z.ZodType<SessionAssurancePolicy, unknown, z.core.$ZodTypeInternals<SessionAssurancePolicy, unknown>>;
+    validStepUps: z.ZodArray<z.ZodType<StepUpOption, unknown, z.core.$ZodTypeInternals<StepUpOption, unknown>>>;
+}, z.core.$strip>;
+type SessionAssuranceRequiredPayload = z.infer<typeof SessionAssuranceRequiredPayload>;
+declare function parseSessionAssuranceRequiredPayload(error: unknown): {
+    code: "session_assurance_required" | "application_session_assurance_not_met";
+    currentAssurance: JWTPayloadAssurance;
+    requiredAssurance: SessionAssurancePolicy;
+    validStepUps: StepUpOption[];
+} | null;
+declare class SessionAssuranceRequiredError extends BaseError {
+    readonly payload: SessionAssuranceRequiredPayload;
+    readonly currentAssurance: SessionAssuranceRequiredPayload['currentAssurance'];
+    readonly requiredAssurance: SessionAssuranceRequiredPayload['requiredAssurance'];
+    readonly validStepUps: SessionAssuranceRequiredPayload['validStepUps'];
+    constructor(payload: SessionAssuranceRequiredPayload, options?: ErrorOptions);
+}
+
+declare function sessionAssurancePluginClient(): {
+    id: "session-assurance";
+    getActions: ($fetch: better_auth_client.BetterFetch) => {
+        sessionAssurance: {
+            getSessionAssurance: () => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            stepUpWithPassword: (body: {
+                password: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            sendOtp: () => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            verifyOtp: (body: {
+                otp: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            beginOAuthStepUp: (body: {
+                provider: OAuthStepUpProvider;
+                returnUrl?: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            completeOAuthStepUp: (body: {
+                stepUpToken: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+        };
+    };
+};
+type SessionAssuranceActions = ReturnType<ReturnType<typeof sessionAssurancePluginClient>['getActions']>['sessionAssurance'];
+
+type BeginOAuthStepUpParams = {
+    provider: OAuthStepUpProvider;
+    returnUrl?: string;
+};
+declare const SessionAssuranceResponse: z.ZodObject<{
+    assurance: z.ZodType<AssuranceFields, unknown, z.core.$ZodTypeInternals<AssuranceFields, unknown>>;
+    validStepUps: z.ZodArray<z.ZodType<StepUpOption, unknown, z.core.$ZodTypeInternals<StepUpOption, unknown>>>;
+}, z.core.$strip>;
+type SessionAssuranceResponse = z.infer<typeof SessionAssuranceResponse>;
+declare const OAuthBeginStepUpResponse: z.ZodObject<{
+    stepUpToken: z.ZodString;
+    callbackURL: z.ZodString;
+}, z.core.$strip>;
+type OAuthBeginStepUpResponse = z.infer<typeof OAuthBeginStepUpResponse>;
+declare const OAuthCompleteStepUpResponse: z.ZodObject<{
+    assurance: z.ZodType<AssuranceFields, unknown, z.core.$ZodTypeInternals<AssuranceFields, unknown>>;
+    validStepUps: z.ZodArray<z.ZodType<StepUpOption, unknown, z.core.$ZodTypeInternals<StepUpOption, unknown>>>;
+    returnPath: z.ZodString;
+}, z.core.$strip>;
+type OAuthCompleteStepUpResponse = z.infer<typeof OAuthCompleteStepUpResponse>;
+declare const SendOtpResponse: z.ZodObject<{
+    success: z.ZodBoolean;
+}, z.core.$strip>;
+type SendOtpResponse = z.infer<typeof SendOtpResponse>;
+declare class SessionAssuranceService {
+    private readonly client;
+    constructor(client: APIClient);
+    get(): Promise<SessionAssuranceResponse>;
+    stepUpWithPassword(password: string): Promise<SessionAssuranceResponse>;
+    sendOtp(): Promise<SendOtpResponse>;
+    verifyOtp(otp: string): Promise<SessionAssuranceResponse>;
+    beginOAuthStepUp(params: BeginOAuthStepUpParams): Promise<OAuthBeginStepUpResponse>;
+    completeOAuthStepUp(stepUpToken: string): Promise<OAuthCompleteStepUpResponse>;
+}
+
+declare const ApiKeyMetadata: z.ZodObject<{
     user: z.ZodObject<{
         id: z.ZodString;
-        name: z.ZodString;
-        image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        role: z.ZodNullable<z.ZodString>;
+        email: z.ZodString;
     }, z.core.$strip>;
     workspace: z.ZodObject<{
         id: z.ZodString;
         title: z.ZodString;
     }, z.core.$strip>;
-    sessionKey: z.ZodString;
+    application: z.ZodNullable<z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
-type JWTPayload = JWTPayload$1 & z.infer<typeof JWTPayload>;
-
-declare const ApiKeyMetadata: z$1.ZodObject<{
-    user: z$1.ZodObject<{
-        id: z$1.ZodString;
-        email: z$1.ZodString;
-    }, z$1.core.$strip>;
-    workspace: z$1.ZodObject<{
-        id: z$1.ZodString;
-        title: z$1.ZodString;
-    }, z$1.core.$strip>;
-    application: z$1.ZodNullable<z$1.ZodOptional<z$1.ZodObject<{
-        id: z$1.ZodString;
-        name: z$1.ZodString;
-    }, z$1.core.$strip>>>;
-}, z$1.core.$strip>;
 /**
  * Metadata attached to an API key, identifying the owning user and workspace.
  */
-type ApiKeyMetadata = z$1.infer<typeof ApiKeyMetadata> & Record<string, unknown>;
+type ApiKeyMetadata = z.infer<typeof ApiKeyMetadata> & Record<string, unknown>;
 /**
  * A full API key including the secret key value.
  *
@@ -2704,10 +2974,258 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             message?: string | undefined;
         }, FetchOptions["throw"] extends true ? true : true>>;
     };
+} & {
+    emailOtp: {
+        sendVerificationOtp: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
+            email: string;
+            type: "sign-in" | "change-email" | "email-verification" | "forget-password";
+        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
+            email: string;
+            type: "sign-in" | "change-email" | "email-verification" | "forget-password";
+        } & {
+            fetchOptions?: FetchOptions | undefined;
+        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
+            success: boolean;
+        }, {
+            code?: string | undefined;
+            message?: string | undefined;
+        }, FetchOptions["throw"] extends true ? true : true>>;
+    };
+} & {
+    emailOtp: {
+        checkVerificationOtp: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
+            email: string;
+            type: "sign-in" | "change-email" | "email-verification" | "forget-password";
+            otp: string;
+        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
+            email: string;
+            type: "sign-in" | "change-email" | "email-verification" | "forget-password";
+            otp: string;
+        } & {
+            fetchOptions?: FetchOptions | undefined;
+        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
+            success: boolean;
+        }, {
+            code?: string | undefined;
+            message?: string | undefined;
+        }, FetchOptions["throw"] extends true ? true : true>>;
+    };
+} & {
+    emailOtp: {
+        verifyEmail: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
+            email: string;
+            otp: string;
+        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
+            email: string;
+            otp: string;
+        } & {
+            fetchOptions?: FetchOptions | undefined;
+        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<(Omit<{
+            status: boolean;
+            token: string;
+            user: {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            } & Record<string, any>;
+        }, "user"> & {
+            user: better_auth.StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            } & {
+                twoFactorEnabled: boolean | null | undefined;
+            } & {} & {
+                banned: boolean | null | undefined;
+            } & {
+                role?: string | null | undefined;
+                banReason?: string | null | undefined;
+                banExpires?: Date | null | undefined;
+            } & {} & {
+                lastActiveAt?: Date | null | undefined;
+            }>;
+        }) | (Omit<{
+            status: boolean;
+            token: null;
+            user: {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            } & Record<string, any>;
+        }, "user"> & {
+            user: better_auth.StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            } & {
+                twoFactorEnabled: boolean | null | undefined;
+            } & {} & {
+                banned: boolean | null | undefined;
+            } & {
+                role?: string | null | undefined;
+                banReason?: string | null | undefined;
+                banExpires?: Date | null | undefined;
+            } & {} & {
+                lastActiveAt?: Date | null | undefined;
+            }>;
+        }), {
+            code?: string | undefined;
+            message?: string | undefined;
+        }, FetchOptions["throw"] extends true ? true : true>>;
+    };
+} & {
+    signIn: {
+        emailOtp: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
+            email: string;
+            otp: string;
+            name?: string | undefined;
+            image?: string | undefined;
+        } & Record<string, any>> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
+            email: string;
+            otp: string;
+            name?: string | undefined;
+            image?: string | undefined;
+        } & Record<string, any> & {
+            fetchOptions?: FetchOptions | undefined;
+        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<Omit<{
+            token: string;
+            user: {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            };
+        }, "user"> & {
+            user: better_auth.StripEmptyObjects<{
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            } & {
+                twoFactorEnabled: boolean | null | undefined;
+            } & {} & {
+                banned: boolean | null | undefined;
+            } & {
+                role?: string | null | undefined;
+                banReason?: string | null | undefined;
+                banExpires?: Date | null | undefined;
+            } & {} & {
+                lastActiveAt?: Date | null | undefined;
+            }>;
+        }, {
+            code?: string | undefined;
+            message?: string | undefined;
+        }, FetchOptions["throw"] extends true ? true : true>>;
+    };
+} & {
+    emailOtp: {
+        requestPasswordReset: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
+            email: string;
+        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
+            email: string;
+        } & {
+            fetchOptions?: FetchOptions | undefined;
+        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
+            success: boolean;
+        }, {
+            code?: string | undefined;
+            message?: string | undefined;
+        }, FetchOptions["throw"] extends true ? true : true>>;
+    };
+} & {
+    forgetPassword: {
+        emailOtp: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
+            email: string;
+        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
+            email: string;
+        } & {
+            fetchOptions?: FetchOptions | undefined;
+        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
+            success: boolean;
+        }, {
+            code?: string | undefined;
+            message?: string | undefined;
+        }, FetchOptions["throw"] extends true ? true : true>>;
+    };
+} & {
+    emailOtp: {
+        resetPassword: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
+            email: string;
+            otp: string;
+            password: string;
+        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
+            email: string;
+            otp: string;
+            password: string;
+        } & {
+            fetchOptions?: FetchOptions | undefined;
+        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
+            success: boolean;
+        }, {
+            code?: string | undefined;
+            message?: string | undefined;
+        }, FetchOptions["throw"] extends true ? true : true>>;
+    };
+} & {
+    emailOtp: {
+        requestEmailChange: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
+            newEmail: string;
+            otp?: string | undefined;
+        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
+            newEmail: string;
+            otp?: string | undefined;
+        } & {
+            fetchOptions?: FetchOptions | undefined;
+        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
+            success: boolean;
+        }, {
+            code?: string | undefined;
+            message?: string | undefined;
+        }, FetchOptions["throw"] extends true ? true : true>>;
+    };
+} & {
+    emailOtp: {
+        changeEmail: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
+            newEmail: string;
+            otp: string;
+        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
+            newEmail: string;
+            otp: string;
+        } & {
+            fetchOptions?: FetchOptions | undefined;
+        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
+            success: boolean;
+        }, {
+            code?: string | undefined;
+            message?: string | undefined;
+        }, FetchOptions["throw"] extends true ? true : true>>;
+    };
 } & {
     signIn: {
         social: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            provider: (string & {}) | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
+            provider: (string & {}) | "google" | "microsoft" | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
             callbackURL?: string | undefined;
             newUserCallbackURL?: string | undefined;
             errorCallbackURL?: string | undefined;
@@ -2724,7 +3242,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             loginHint?: string | undefined;
             additionalData?: Record<string, any> | undefined;
         }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            provider: (string & {}) | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
+            provider: (string & {}) | "google" | "microsoft" | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
             callbackURL?: string | undefined;
             newUserCallbackURL?: string | undefined;
             errorCallbackURL?: string | undefined;
@@ -3518,6 +4036,84 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             error: null;
         }>;
     };
+} & {
+    sessionAssurance: {
+        getSessionAssurance: () => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        stepUpWithPassword: (body: {
+            password: string;
+        }) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        sendOtp: () => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        verifyOtp: (body: {
+            otp: string;
+        }) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        beginOAuthStepUp: (body: {
+            provider: OAuthStepUpProvider;
+            returnUrl?: string;
+        }) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        completeOAuthStepUp: (body: {
+            stepUpToken: string;
+        }) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+    };
 } & {
     $Infer: {
         ActiveOrganization: {
@@ -4266,6 +4862,18 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             readonly code: "INVALID_ROLE_TYPE";
             message: string;
         };
+        OTP_EXPIRED: {
+            readonly code: "OTP_EXPIRED";
+            message: string;
+        };
+        INVALID_OTP: {
+            readonly code: "INVALID_OTP";
+            message: string;
+        };
+        TOO_MANY_ATTEMPTS: {
+            readonly code: "TOO_MANY_ATTEMPTS";
+            message: string;
+        };
         USER_NOT_FOUND: {
             readonly code: "USER_NOT_FOUND";
             message: string;
@@ -4513,6 +5121,21 @@ type TeamMember = {
     createdAt: Date;
 };
 
+declare const DEFAULT_SESSION_ASSURANCE_CONFIG: ApplicationSessionAssuranceConfig;
+declare const DEFAULT_APPLICATION_CONFIG: {
+    version: 1;
+    sessionAssurance: ApplicationSessionAssuranceConfig;
+};
+type ApplicationSessionAssuranceConfig = {
+    acceptedAmr: AMR[];
+    minAal: AAL;
+};
+declare const ApplicationSessionAssuranceConfig: z.ZodType<ApplicationSessionAssuranceConfig>;
+type ApplicationConfig = {
+    version: 1;
+    sessionAssurance: ApplicationSessionAssuranceConfig;
+};
+declare const ApplicationConfig: z.ZodType<ApplicationConfig>;
 /**
  * Keys of the organization's related collections that can be optionally
  * included in the "who am I" response.
@@ -4530,6 +5153,8 @@ type Application = {
     description: string;
     /** Allowed OAuth redirect URIs for this application. */
     redirectUris: string[];
+    /** Additional configuration for this application. */
+    config?: ApplicationConfig;
 };
 /**
  * Response returned when listing candidate organizations for an application.
@@ -4540,7 +5165,7 @@ type ListCandidateOrganizationsResponse = FullOrganization[];
  */
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
-    application: Pick<Application, 'id' | 'name'>;
+    application: Pick<Application, 'id' | 'name' | 'config'>;
 };
 /**
  * Response returned when starting an authorization flow.
@@ -4561,6 +5186,8 @@ type CompleteAuthorizationFlowResponse = {
     user: User;
     /** The organization the tokens are scoped to. */
     organization: FullOrganization;
+    /** Assurance context embedded in the issued access token. */
+    assurance: JWTPayload['assurance'];
 };
 /**
  * Response returned by the "who am I" endpoint.
@@ -4574,6 +5201,8 @@ type WhoAmIResponse = {
     user: User;
     /** The user's active organization. */
     organization: WhoAmIOrganization;
+    /** Assurance context embedded in the verified access token. */
+    assurance: JWTPayload['assurance'];
 };
 /**
  * Options accepted by the "who am I" client method.
@@ -4642,23 +5271,6 @@ type DeviceAuthorizationActionResponse = {
     success: boolean;
 };
 
-/**
- * Base error class for all SDK errors.
- *
- * Extends the native `Error` with a machine-readable `code` property
- * that can be used for programmatic error handling.
- */
-declare class BaseError extends Error {
-    /** Machine-readable error code (e.g. `"INVALID_SOCIAL_PROVIDER"`). */
-    code: string;
-    /**
-     * @param code - A machine-readable error code
-     * @param message - A human-readable error message
-     * @param options - Standard `ErrorOptions` (e.g. `cause`)
-     */
-    constructor(code: string, message: string, options?: ErrorOptions);
-}
-
 /**
  * Generic error thrown by the `ApplicationService`.
  *
@@ -4683,6 +5295,20 @@ declare class RefreshTokenExpiredError extends ApplicationError {
 declare class AuthorizationFlowError extends ApplicationError {
     constructor(message: string, options?: ErrorOptions);
 }
+/**
+ * Thrown when the authenticated session no longer satisfies the target
+ * application's assurance policy.
+ *
+ * During device-code token exchange this is a final error: the consumed flow
+ * cannot be retried and the client must start a new device authorization flow.
+ */
+declare class ApplicationSessionAssuranceError extends ApplicationError {
+    readonly payload: SessionAssuranceRequiredPayload | null;
+    readonly currentAssurance: SessionAssuranceRequiredPayload['currentAssurance'] | null;
+    readonly requiredAssurance: SessionAssuranceRequiredPayload['requiredAssurance'] | null;
+    readonly validStepUps: SessionAssuranceRequiredPayload['validStepUps'];
+    constructor(payload?: SessionAssuranceRequiredPayload | null, options?: ErrorOptions);
+}
 /**
  * Thrown when an operation requires an authenticated user but no session exists.
  */
@@ -4728,6 +5354,11 @@ declare class DeviceTransientServerError extends ApplicationError {
     constructor(options?: ErrorOptions);
 }
 
+/**
+ * Checks whether a session assurance value satisfies an application policy.
+ */
+declare function isSessionAssuranceSufficient(sessionAssurance: JWTPayload['assurance'] | null | undefined, config?: ApplicationConfig): boolean;
+
 /**
  * Service for managing applications and their candidate organizations.
  *
@@ -4821,6 +5452,7 @@ declare class ApplicationService {
      * @throws {DeviceAccessDeniedError} The user denied the request
      * @throws {DeviceCodeExpiredError} The device code has expired
      * @throws {DeviceTransientServerError} Transient server error — safe to retry
+     * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
      */
     exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
     /**
@@ -5258,8 +5890,6 @@ type SignInWithEmailAndPasswordOptions = {
     password: string;
     /** URL to redirect to after successful authentication. */
     callbackURL: string;
-    /** URL to redirect to if authentication fails. */
-    errorCallbackURL?: string;
 };
 
 /**
@@ -5357,8 +5987,9 @@ declare class SessionService {
      * @param options - Email/password sign-in configuration
      * @param options.email - User's email address
      * @param options.password - User's password
+     * @param options.callbackURL - URL to redirect to after successful authentication
      */
-    signInWithEmailAndPassword({ email, password, }: SignInWithEmailAndPasswordOptions): Promise<void>;
+    signInWithEmailAndPassword({ email, password, callbackURL, }: SignInWithEmailAndPasswordOptions): Promise<void>;
     /**
      * Signs out the currently authenticated user.
      *
@@ -5455,6 +6086,92 @@ declare class ApiKeyService {
     }>;
 }
 
+/**
+ * Options for requesting an email OTP.
+ */
+type SendVerificationOTPOptions = {
+    /**
+     * Application ID used to scope the OTP request to an application's
+     * configured sign-in policy.
+     */
+    applicationId: string;
+};
+/**
+ * Options for completing email OTP sign-in.
+ */
+type EmailOTPSignInOptions = {
+    /**
+     * Application ID used to scope the OTP sign-in to an application's
+     * configured sign-in policy.
+     */
+    applicationId: string;
+};
+/**
+ * Service for email OTP authentication operations.
+ *
+ * Provides helpers for sending one-time passcodes used by passwordless
+ * sign-in flows.
+ */
+declare class EmailOTPService {
+    private client;
+    /**
+     * Creates a new EmailOTPService instance.
+     *
+     * @param client - The API client for making email OTP requests
+     */
+    constructor(client: APIClient);
+    /**
+     * Sends a sign-in verification OTP to an email address.
+     *
+     * @param email - Email address that should receive the OTP
+     * @param options - Request configuration
+     * @returns The underlying email OTP API response
+     */
+    sendVerificationOTP(email: string, options: SendVerificationOTPOptions): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * Completes email OTP sign-in with a one-time passcode.
+     *
+     * @param email - Email address that received the OTP
+     * @param otp - One-time passcode from the sign-in email
+     * @param options - Request configuration
+     * @returns The underlying email OTP sign-in API response
+     */
+    signIn(email: string, otp: string, options: EmailOTPSignInOptions): Promise<Omit<{
+        token: string;
+        user: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        };
+    }, "user"> & {
+        user: better_auth.StripEmptyObjects<{
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            email: string;
+            emailVerified: boolean;
+            name: string;
+            image?: string | null | undefined;
+        } & {
+            twoFactorEnabled: boolean | null | undefined;
+        } & {} & {
+            banned: boolean | null | undefined;
+        } & {
+            role?: string | null | undefined;
+            banReason?: string | null | undefined;
+            banExpires?: Date | null | undefined;
+        } & {} & {
+            lastActiveAt?: Date | null | undefined;
+        }>;
+    }>;
+}
+
 /**
  * Error thrown when an invalid social provider is specified.
  */
@@ -5480,7 +6197,7 @@ declare class EmailRequired extends BaseError {
 /**
  * Main authentication client for interacting with the Auth API.
  *
- * Provides access to session management and organization management services.
+ * Provides access to session, organization, application, API key, and email OTP services.
  *
  * @example
  * ```typescript
@@ -5498,6 +6215,11 @@ declare class EmailRequired extends BaseError {
  * ```
  */
 declare class AuthClient {
+    /**
+     * Configured Better Auth client used by the public service wrappers.
+     *
+     * @internal
+     */
     private client;
     /**
      * Session management service for authentication operations
@@ -5515,6 +6237,14 @@ declare class AuthClient {
      * API key management service for API key operations
      */
     apiKey: ApiKeyService;
+    /**
+     * Email OTP service for passwordless sign-in operations
+     */
+    emailOtp: EmailOTPService;
+    /**
+     * Session assurance service for step-up operations
+     */
+    sessionAssurance: SessionAssuranceService;
     /**
      * Creates a new AuthClient instance.
      *
@@ -5524,6 +6254,9 @@ declare class AuthClient {
     constructor(apiUrl: string, fetchOptions?: BetterFetchOption);
 }
 
+type DecodedJWTPayload = Omit<JWTPayload, 'assurance'> & {
+    assurance?: JWTPayloadAssurance;
+};
 /**
  * Checks if a JWT token has expired or will expire within a specified time window.
  *
@@ -5583,7 +6316,7 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  * console.log(payload.exp) // expiration timestamp
  * ```
  */
-declare function extractTokenPayload(token: string): JWTPayload;
+declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { ApiKeyMetadata, ApplicationError, AuthClient, AuthorizationFlowError, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadUser, JWTPayloadWorkspace, RefreshTokenExpiredError, Roles, UserNotLoggedInError, ac, createAPIClient, extractTokenPayload, invitationAdditionalFields, isTokenExpired, memberAdditionalFields, organizationAdditionalFields, rolesAccessControl, userAdditionalFields, validateToken };
-export type { APIClient, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, BaseOrganization, CompleteAuthorizationFlowResponse, CreateApiKeyPayload, CreateTeamPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, FullOrganization, Invitation, InviteUserToOrganizationOptions, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, Session, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, CompleteAuthorizationFlowResponse, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };