@meistrari/auth-core 1.20.1 → 1.22.0

package/dist/index.d.ts

@@ -2,13 +2,94 @@ import * as better_auth_plugins from 'better-auth/plugins';
 import * as better_auth from 'better-auth';
 import { JWTPayload as JWTPayload$1 } from 'better-auth';
 export { APIError } from 'better-auth';
-import z$1, { z } from 'zod';
+import z, { z as z$1 } from 'zod';
 import * as better_auth_client from 'better-auth/client';
 import { BetterFetchOption } from 'better-auth/client';
 import * as jose from 'jose';
-import * as _better_auth_sso from '@better-auth/sso';
 import { ApiKey as ApiKey$1 } from '@better-auth/api-key';
 
+declare const AMRBrand: unique symbol;
+declare const AALBrand: unique symbol;
+declare const ACRBrand: unique symbol;
+declare const AuthMethodBrand: unique symbol;
+declare const AMRs: {
+    readonly Pwd: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Otp: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Oauth: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Sso: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Saml: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+};
+declare const AALs: {
+    readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
+    readonly Aal2: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
+    readonly Aal3: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
+};
+declare const ACRs: {
+    readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
+};
+declare const AuthMethods: {
+    readonly Password: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly EmailOTP: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly OAuth: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly SAML: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly Unknown: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+};
+declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
+    readonly Pwd: "pwd";
+    readonly Otp: "otp";
+    readonly Oauth: "oauth";
+    readonly Sso: "sso";
+    readonly Saml: "saml";
+}>, typeof AMRBrand, "out">;
+type AMR = z.infer<typeof AMR>;
+declare const AAL: z.core.$ZodBranded<z.ZodEnum<{
+    readonly Aal1: "aal1";
+    readonly Aal2: "aal2";
+    readonly Aal3: "aal3";
+}>, typeof AALBrand, "out">;
+type AAL = z.infer<typeof AAL>;
+declare const ACR: z.core.$ZodBranded<z.ZodEnum<{
+    readonly Unspecified: "urn:tela:auth:unspecified";
+}>, typeof ACRBrand, "out">;
+type ACR = z.infer<typeof ACR>;
+declare const AuthMethod: z.core.$ZodBranded<z.ZodEnum<{
+    readonly Password: "password";
+    readonly EmailOTP: "email_otp";
+    readonly OAuth: "oauth";
+    readonly SAML: "saml";
+    readonly Unknown: "unknown";
+}>, typeof AuthMethodBrand, "out">;
+type AuthMethod = z.infer<typeof AuthMethod>;
+declare const assuranceFields: {
+    authMethod: {
+        type: "string";
+        required: true;
+    };
+    amr: {
+        type: "json";
+        required: true;
+    };
+    aal: {
+        type: "string";
+        required: true;
+    };
+    acr: {
+        type: "string";
+        required: true;
+    };
+    assuredAt: {
+        type: "date";
+        required: true;
+    };
+};
+type AssuranceFields = {
+    authMethod: AuthMethod;
+    amr: AMR[];
+    aal: AAL;
+    acr: ACR;
+    assuredAt: Date;
+};
+
 declare const ac: {
     newRole<K extends "member" | "access" | "organization" | "invitation" | "team" | "ac">(statements: better_auth_plugins.Subset<K, {
         access: string[];
@@ -224,2490 +305,756 @@ declare const invitationAdditionalFields: {
 /**
  * Zod schema and type for the `user` claim within a JWT payload.
  */
-declare const JWTPayloadUser: z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodString;
-    image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    role: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
-type JWTPayloadUser = z.infer<typeof JWTPayloadUser>;
+declare const JWTPayloadUser: z$1.ZodObject<{
+    id: z$1.ZodString;
+    name: z$1.ZodString;
+    image: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+    role: z$1.ZodNullable<z$1.ZodString>;
+}, z$1.core.$strip>;
+type JWTPayloadUser = z$1.infer<typeof JWTPayloadUser>;
 /**
  * Zod schema and type for the `workspace` claim within a JWT payload.
  */
-declare const JWTPayloadWorkspace: z.ZodObject<{
-    id: z.ZodString;
-    title: z.ZodString;
-}, z.core.$strip>;
-type JWTPayloadWorkspace = z.infer<typeof JWTPayloadWorkspace>;
+declare const JWTPayloadWorkspace: z$1.ZodObject<{
+    id: z$1.ZodString;
+    title: z$1.ZodString;
+}, z$1.core.$strip>;
+type JWTPayloadWorkspace = z$1.infer<typeof JWTPayloadWorkspace>;
+type JWTPayloadAssurance = {
+    authMethod: AuthMethod;
+    amr: AMR[];
+    aal: AAL;
+    acr: ACR;
+    assuredAt: string;
+};
+declare const JWTPayloadAssurance: z$1.ZodType<JWTPayloadAssurance>;
+declare const DEFAULT_JWT_ASSURANCE: JWTPayloadAssurance;
+type JWTPayloadData = {
+    email: string;
+    user: JWTPayloadUser;
+    workspace: JWTPayloadWorkspace;
+    sessionKey: string;
+    assurance: JWTPayloadAssurance;
+};
 /**
  * Zod schema and type for the full JWT payload issued by the auth API.
  *
  * Includes `email`, `user`, `workspace`, and `sessionKey` claims
  * on top of the standard Better Auth JWT fields (`sub`, `iss`, `exp`, etc.).
  */
-declare const JWTPayload: z.ZodObject<{
-    email: z.ZodString;
-    user: z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-        image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        role: z.ZodNullable<z.ZodString>;
-    }, z.core.$strip>;
-    workspace: z.ZodObject<{
-        id: z.ZodString;
-        title: z.ZodString;
-    }, z.core.$strip>;
-    sessionKey: z.ZodString;
+declare const JWTPayload: z$1.ZodType<JWTPayloadData>;
+type JWTPayload = JWTPayload$1 & JWTPayloadData;
+
+declare const OAuthStepUpProvider: z.ZodEnum<{
+    google: "google";
+    microsoft: "microsoft";
+}>;
+type OAuthStepUpProvider = z.infer<typeof OAuthStepUpProvider>;
+type StepUpOption = {
+    method: typeof AMRs.Pwd;
+} | {
+    method: typeof AMRs.Otp;
+} | {
+    method: typeof AMRs.Oauth;
+    providers: OAuthStepUpProvider[];
+};
+declare const StepUpOption: z.ZodType<StepUpOption>;
+type SessionAssurancePolicy = {
+    minAal: typeof AALs.Aal1 | typeof AALs.Aal2 | typeof AALs.Aal3;
+    acceptedAmr: AMR[];
+};
+declare const SessionAssurancePolicy: z.ZodType<SessionAssurancePolicy>;
+declare const SENSITIVE_ACTION_ASSURANCE_POLICY: SessionAssurancePolicy;
+declare function getAalRank(aal: JWTPayload['assurance']['aal']): number;
+declare function isAssuranceSufficientForPolicy(assurance: JWTPayload['assurance'] | null | undefined, policy: SessionAssurancePolicy): boolean;
+declare function canStepUpWithAmr(assurance: JWTPayload['assurance'], amr: AMR): boolean;
+declare function mergeStepUpAssurance(assurance: JWTPayload['assurance'], amr: AMR, now?: Date): JWTPayload['assurance'];
+
+/**
+ * Base error class for all SDK errors.
+ *
+ * Extends the native `Error` with a machine-readable `code` property
+ * that can be used for programmatic error handling.
+ */
+declare class BaseError extends Error {
+    /** Machine-readable error code (e.g. `"INVALID_SOCIAL_PROVIDER"`). */
+    code: string;
+    /**
+     * @param code - A machine-readable error code
+     * @param message - A human-readable error message
+     * @param options - Standard `ErrorOptions` (e.g. `cause`)
+     */
+    constructor(code: string, message: string, options?: ErrorOptions);
+}
+
+declare const SessionAssuranceRequiredPayload: z.ZodObject<{
+    code: z.ZodEnum<{
+        session_assurance_required: "session_assurance_required";
+        application_session_assurance_not_met: "application_session_assurance_not_met";
+    }>;
+    currentAssurance: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodType<JWTPayloadAssurance, unknown, z.core.$ZodTypeInternals<JWTPayloadAssurance, unknown>>>;
+    requiredAssurance: z.ZodType<SessionAssurancePolicy, unknown, z.core.$ZodTypeInternals<SessionAssurancePolicy, unknown>>;
+    validStepUps: z.ZodArray<z.ZodType<StepUpOption, unknown, z.core.$ZodTypeInternals<StepUpOption, unknown>>>;
 }, z.core.$strip>;
-type JWTPayload = JWTPayload$1 & z.infer<typeof JWTPayload>;
+type SessionAssuranceRequiredPayload = z.infer<typeof SessionAssuranceRequiredPayload>;
+declare function parseSessionAssuranceRequiredPayload(error: unknown): {
+    code: "session_assurance_required" | "application_session_assurance_not_met";
+    currentAssurance: JWTPayloadAssurance;
+    requiredAssurance: SessionAssurancePolicy;
+    validStepUps: StepUpOption[];
+} | null;
+declare class SessionAssuranceRequiredError extends BaseError {
+    readonly payload: SessionAssuranceRequiredPayload;
+    readonly currentAssurance: SessionAssuranceRequiredPayload['currentAssurance'];
+    readonly requiredAssurance: SessionAssuranceRequiredPayload['requiredAssurance'];
+    readonly validStepUps: SessionAssuranceRequiredPayload['validStepUps'];
+    constructor(payload: SessionAssuranceRequiredPayload, options?: ErrorOptions);
+}
 
-declare const ApiKeyMetadata: z$1.ZodObject<{
-    user: z$1.ZodObject<{
-        id: z$1.ZodString;
-        email: z$1.ZodString;
-    }, z$1.core.$strip>;
-    workspace: z$1.ZodObject<{
-        id: z$1.ZodString;
-        title: z$1.ZodString;
-    }, z$1.core.$strip>;
-    application: z$1.ZodNullable<z$1.ZodOptional<z$1.ZodObject<{
-        id: z$1.ZodString;
-        name: z$1.ZodString;
-    }, z$1.core.$strip>>>;
-}, z$1.core.$strip>;
+declare function sessionAssurancePluginClient(): {
+    id: "session-assurance";
+    getActions: ($fetch: better_auth_client.BetterFetch) => {
+        sessionAssurance: {
+            getSessionAssurance: () => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            stepUpWithPassword: (body: {
+                password: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            sendOtp: () => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            verifyOtp: (body: {
+                otp: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            beginOAuthStepUp: (body: {
+                provider: OAuthStepUpProvider;
+                returnUrl?: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+            completeOAuthStepUp: (body: {
+                stepUpToken: string;
+            }) => Promise<{
+                data: null;
+                error: {
+                    message?: string | undefined;
+                    status: number;
+                    statusText: string;
+                };
+            } | {
+                data: unknown;
+                error: null;
+            }>;
+        };
+    };
+};
+type SessionAssuranceActions = ReturnType<ReturnType<typeof sessionAssurancePluginClient>['getActions']>['sessionAssurance'];
+
+type BeginOAuthStepUpParams = {
+    provider: OAuthStepUpProvider;
+    returnUrl?: string;
+};
+declare const SessionAssuranceResponse: z.ZodObject<{
+    assurance: z.ZodType<AssuranceFields, unknown, z.core.$ZodTypeInternals<AssuranceFields, unknown>>;
+    validStepUps: z.ZodArray<z.ZodType<StepUpOption, unknown, z.core.$ZodTypeInternals<StepUpOption, unknown>>>;
+}, z.core.$strip>;
+type SessionAssuranceResponse = z.infer<typeof SessionAssuranceResponse>;
+declare const OAuthBeginStepUpResponse: z.ZodObject<{
+    stepUpToken: z.ZodString;
+    callbackURL: z.ZodString;
+}, z.core.$strip>;
+type OAuthBeginStepUpResponse = z.infer<typeof OAuthBeginStepUpResponse>;
+declare const OAuthCompleteStepUpResponse: z.ZodObject<{
+    assurance: z.ZodType<AssuranceFields, unknown, z.core.$ZodTypeInternals<AssuranceFields, unknown>>;
+    validStepUps: z.ZodArray<z.ZodType<StepUpOption, unknown, z.core.$ZodTypeInternals<StepUpOption, unknown>>>;
+    returnPath: z.ZodString;
+}, z.core.$strip>;
+type OAuthCompleteStepUpResponse = z.infer<typeof OAuthCompleteStepUpResponse>;
+declare const SendOtpResponse: z.ZodObject<{
+    success: z.ZodBoolean;
+}, z.core.$strip>;
+type SendOtpResponse = z.infer<typeof SendOtpResponse>;
+declare class SessionAssuranceService {
+    private readonly client;
+    constructor(client: APIClient);
+    get(): Promise<SessionAssuranceResponse>;
+    stepUpWithPassword(password: string): Promise<SessionAssuranceResponse>;
+    sendOtp(): Promise<SendOtpResponse>;
+    verifyOtp(otp: string): Promise<SessionAssuranceResponse>;
+    beginOAuthStepUp(params: BeginOAuthStepUpParams): Promise<OAuthBeginStepUpResponse>;
+    completeOAuthStepUp(stepUpToken: string): Promise<OAuthCompleteStepUpResponse>;
+}
+
+declare const DEFAULT_SESSION_ASSURANCE_CONFIG: ApplicationSessionAssuranceConfig;
+declare const DEFAULT_APPLICATION_CONFIG: {
+    version: 1;
+    sessionAssurance: ApplicationSessionAssuranceConfig;
+};
+type ApplicationSessionAssuranceConfig = {
+    acceptedAmr: AMR[];
+    minAal: AAL;
+};
+declare const ApplicationSessionAssuranceConfig: z.ZodType<ApplicationSessionAssuranceConfig>;
+type ApplicationConfig = {
+    version: 1;
+    sessionAssurance: ApplicationSessionAssuranceConfig;
+};
+declare const ApplicationConfig: z.ZodType<ApplicationConfig>;
 /**
- * Metadata attached to an API key, identifying the owning user and workspace.
+ * Keys of the organization's related collections that can be optionally
+ * included in the "who am I" response.
  */
-type ApiKeyMetadata = z$1.infer<typeof ApiKeyMetadata> & Record<string, unknown>;
+type WhoAmIInclude = 'members' | 'teams' | 'invitations';
 /**
- * A full API key including the secret key value.
- *
- * The secret `key` field is only returned once at creation time.
+ * Represents a registered OAuth application.
  */
-type ApiKey = Omit<ApiKey$1, 'metadata' | 'name'> & {
-    /** Display name of the API key. */
+type Application = {
+    /** Unique application identifier. */
+    id: string;
+    /** Display name of the application. */
     name: string;
-    /** Metadata identifying the key's owner and workspace. */
-    metadata: ApiKeyMetadata;
+    /** Human-readable description of the application. */
+    description: string;
+    /** Allowed OAuth redirect URIs for this application. */
+    redirectUris: string[];
+    /** Additional configuration for this application. */
+    config?: ApplicationConfig;
 };
 /**
- * An API key with the secret key value omitted.
+ * Response returned when listing candidate organizations for an application.
+ */
+type ListCandidateOrganizationsResponse = FullOrganization[];
+/**
+ * Public application context used to preserve continuity during auth redirects.
+ */
+type ApplicationAuthContextResponse = {
+    /** Minimal application identity shown in the hosted auth flow. */
+    application: Pick<Application, 'id' | 'name' | 'config'>;
+};
+/**
+ * Response returned when starting an authorization flow.
+ */
+type StartAuthorizationFlowResponse = {
+    /** The authorization code to exchange for tokens. */
+    code: string;
+};
+/**
+ * Response returned when completing an authorization flow or refreshing tokens.
+ */
+type CompleteAuthorizationFlowResponse = {
+    /** Short-lived JWT access token. */
+    accessToken: string;
+    /** Long-lived refresh token for obtaining new access tokens. */
+    refreshToken: string;
+    /** The authenticated user. */
+    user: User;
+    /** The organization the tokens are scoped to. */
+    organization: FullOrganization;
+    /** Assurance context embedded in the issued access token. */
+    assurance: JWTPayload['assurance'];
+};
+/**
+ * Response returned by the "who am I" endpoint.
  *
- * Used in list and get operations where the secret should not be exposed.
+ * By default, the `organization` only contains the base organization fields.
+ * The `members`, `teams`, and `invitations` collections are only populated
+ * when explicitly requested via the `include` query parameter.
  */
-type ApiKeyWithoutSecret = Omit<ApiKey, 'key'>;
+type WhoAmIResponse = {
+    /** The authenticated user. */
+    user: User;
+    /** The user's active organization. */
+    organization: WhoAmIOrganization;
+    /** Assurance context embedded in the verified access token. */
+    assurance: JWTPayload['assurance'];
+};
 /**
- * Payload for creating a new API key.
+ * Options accepted by the "who am I" client method.
  */
-type CreateApiKeyPayload = {
-    /** Display name for the API key. */
-    name: string;
-    /** Time in milliseconds until the key expires. Omit for a non-expiring key. */
-    expiresIn?: number;
-    /** Optional prefix prepended to the generated key for identification. */
-    prefix?: string;
-    /** Optional metadata to attach to the key. */
-    metadata?: ApiKeyMetadata;
+type WhoAmIOptions = {
+    /**
+     * Collections to include in the returned organization. When omitted or
+     * empty, only the base organization fields are returned.
+     */
+    include?: WhoAmIInclude[];
 };
 /**
- * Payload for updating an existing API key.
+ * Response returned when starting a device authorization flow (RFC 8628).
  */
-type UpdateApiKeyPayload = {
-    /** The ID of the API key to update. */
+type DeviceAuthorizationResponse = {
+    /** The device verification code for polling. */
+    device_code: string;
+    /** The user-facing code to enter on the verification page. */
+    user_code: string;
+    /** The URI the user should visit to authorize the device. */
+    verification_uri: string;
+    /** A complete URI including the user code for convenience. */
+    verification_uri_complete: string;
+    /** Number of seconds until the device code expires. */
+    expires_in: number;
+    /** Minimum polling interval in seconds. */
+    interval: number;
+};
+/**
+ * Minimal application info shown in device authorization context.
+ *
+ * @internal
+ */
+type DeviceContextApplication = {
+    /** Unique application identifier. */
     id: string;
-    /** The new display name for the API key. */
+    /** Display name of the application. */
     name: string;
+    /** Human-readable description, or `null` if not set. */
+    description: string | null;
 };
-
 /**
- * Removes index signatures from a type
- * @template T - The type to remove index signatures from
- * @example
- * ```typescript
- * type MyType = {
- *     foo: string
- *     bar: number
- *     [key: string]: any
- * }
- *
- * type StrictMyType = Strict<MyType> // { foo: string; bar: number; }
- * ```
+ * Context information for a pending device authorization request.
  */
-type Strict<T> = {
-    [K in keyof T as string extends K ? never : number extends K ? never : K]: T[K];
+type DeviceAuthorizationContextResponse = {
+    /** The application that initiated the device flow, with verification status. */
+    requester: DeviceContextApplication & {
+        isVerified: boolean;
+    };
+    /** The target application the requester wants access to. */
+    target: DeviceContextApplication;
+    /** Organizations the user can authorize the device for. */
+    organizations: FullOrganization[];
+    /** Organization pre-selected by the requester, if any. */
+    preselectedOrganizationId: string | null;
+    /** Current status of the device authorization request. */
+    status: 'pending' | 'approved' | 'denied';
+    /** Seconds remaining before the device code expires. */
+    expiresIn: number;
 };
 /**
- * Creates a configured Better Auth API client with all required plugins.
+ * Response returned when approving or denying a device authorization request.
+ */
+type DeviceAuthorizationActionResponse = {
+    /** Whether the action was performed successfully. */
+    success: boolean;
+};
+
+/**
+ * Generic error thrown by the `ApplicationService`.
  *
- * @param apiUrl - The base URL of the authentication API
- * @param fetchOptions - Custom fetch options to include in all API requests
- * @returns A fully-configured Better Auth client instance
+ * All application-specific errors extend this class, so you can catch
+ * `ApplicationError` to handle any application-related failure.
+ */
+declare class ApplicationError extends BaseError {
+    constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * Thrown when a refresh token has expired or been revoked.
  *
- * @internal
+ * The client should discard its stored tokens and prompt the user
+ * to re-authenticate.
  */
-declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOption): {
-    useActiveOrganization: better_auth_client.AuthQueryAtom<better_auth.Prettify<{
-        id: string;
-        name: string;
-        slug: string;
-        createdAt: Date;
-        logo?: string | null | undefined | undefined;
-        metadata?: any;
-    } & {
-        members: {
-            id: string;
-            organizationId: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            createdAt: Date;
-            userId: string;
-            teamId?: string | undefined | undefined;
-            user: {
-                id: string;
-                email: string;
-                name: string;
-                image?: string | undefined;
-            };
-        }[];
-        invitations: {
-            id: string;
-            organizationId: string;
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            status: better_auth_plugins.InvitationStatus;
-            inviterId: string;
-            expiresAt: Date;
-            createdAt: Date;
-            teamId?: string | undefined | undefined;
-        }[];
-    }>>;
-    useListOrganizations: better_auth_client.AuthQueryAtom<{
-        id: string;
-        name: string;
-        slug: string;
-        createdAt: Date;
-        logo?: string | null | undefined | undefined;
-        metadata?: any;
-    }[]>;
-    useActiveMember: better_auth_client.AuthQueryAtom<{
-        id: string;
-        organizationId: string;
-        userId: string;
-        role: string;
-        createdAt: Date;
-    }>;
-    useActiveMemberRole: better_auth_client.AuthQueryAtom<{
-        role: string;
-    }>;
-} & {
-    customEndpoints: {
-        teams: {
-            ":id": {
-                members: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, {
-                    id: string;
-                }>>(data_0?: better_auth.Prettify<{
-                    query?: Record<string, any> | undefined;
-                    fetchOptions?: FetchOptions | undefined;
-                }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-                    teamMembers: {
-                        id: string;
-                        teamId: string;
-                        userId: string;
-                        createdAt: Date;
-                    }[];
-                }, {
-                    code?: string | undefined;
-                    message?: string | undefined;
-                }, FetchOptions["throw"] extends true ? true : true>>;
-            };
-        };
-    };
-} & {
-    customEndpoints: {
-        organizations: {
-            apiKeys: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-                query?: Record<string, any> | undefined;
-                fetchOptions?: FetchOptions | undefined;
-            }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-                id: string;
-                name: string;
-                start: string | null;
-                prefix: string | null;
-                referenceId: string;
-                configId: string;
-                refillInterval: number | null;
-                refillAmount: number | null;
-                lastRefillAt: Date | null;
-                enabled: boolean;
-                rateLimitEnabled: boolean;
-                rateLimitTimeWindow: number | null;
-                rateLimitMax: number | null;
-                requestCount: number;
-                remaining: number | null;
-                lastRequest: Date | null;
-                expiresAt: Date | null;
-                createdAt: Date;
-                updatedAt: Date;
-                permissions: string | null;
-                metadata: any;
-            }[], {
-                code?: string | undefined;
-                message?: string | undefined;
-            }, FetchOptions["throw"] extends true ? true : true>>;
-        };
-    };
-} & {
-    handshake: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-        origin: string;
-    }> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-        query: {
-            origin: string;
-        };
-        fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-        status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_auth.Status;
-        body: ({
-            message?: string;
-            code?: string;
-            cause?: unknown;
-        } & Record<string, any>) | undefined;
-        headers: HeadersInit;
-        statusCode: number;
-        name: string;
-        message: string;
-        stack?: string;
-        cause?: unknown;
-    }, {
-        code?: string | undefined;
-        message?: string | undefined;
-    }, FetchOptions["throw"] extends true ? true : true>>;
-} & {
-    handshake: {
-        noncePayload: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            nonce: string;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            query: {
-                nonce: string;
-            };
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            token: string;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        create: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            name: string;
-            slug: string;
-            userId?: string | undefined;
-            logo?: string | undefined;
-            metadata?: Record<string, any> | undefined;
-            keepCurrentActiveOrganization?: boolean | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            name: string;
-            slug: string;
-            userId?: string | undefined;
-            logo?: string | undefined;
-            metadata?: Record<string, any> | undefined;
-            keepCurrentActiveOrganization?: boolean | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<NonNullable<{
-            id: string;
-            name: string;
-            slug: string;
-            createdAt: Date;
-            logo?: string | null | undefined | undefined;
-            metadata?: any;
-        } & {
-            metadata: any;
-            members: ({
-                id: string;
-                organizationId: string;
-                userId: string;
-                role: string;
-                createdAt: Date;
-            } | undefined)[];
-        }>, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        update: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            data: {
-                name?: string | undefined;
-                slug?: string | undefined;
-                logo?: string | undefined;
-                metadata?: Record<string, any> | undefined;
-            } & Partial<{}>;
-            organizationId?: string | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            data: {
-                name?: string | undefined;
-                slug?: string | undefined;
-                logo?: string | undefined;
-                metadata?: Record<string, any> | undefined;
-            } & Partial<{}>;
-            organizationId?: string | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            name: string;
-            slug: string;
-            createdAt: Date;
-            logo?: string | null | undefined | undefined;
-            metadata?: any;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        delete: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            organizationId: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            organizationId: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            name: string;
-            slug: string;
-            createdAt: Date;
-            logo?: string | null | undefined | undefined;
-            metadata?: any;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        setActive: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            organizationId?: string | null | undefined;
-            organizationSlug?: string | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            organizationId?: string | null | undefined;
-            organizationSlug?: string | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            members: {
-                id: string;
-                organizationId: string;
-                role: "org:admin" | "org:member" | "org:reviewer";
-                createdAt: Date;
-                userId: string;
-                teamId?: string | undefined | undefined;
-                user: {
-                    id: string;
-                    email: string;
-                    name: string;
-                    image?: string | undefined;
-                };
-            }[];
-            invitations: {
-                id: string;
-                organizationId: string;
-                email: string;
-                role: "org:admin" | "org:member" | "org:reviewer";
-                status: better_auth_plugins.InvitationStatus;
-                inviterId: string;
-                expiresAt: Date;
-                createdAt: Date;
-                teamId?: string | undefined | undefined;
-            }[];
-            teams: {
-                id: string;
-                name: string;
-                organizationId: string;
-                createdAt: Date;
-                updatedAt?: Date | undefined;
-            }[];
-        } & {
-            id: string;
-            name: string;
-            slug: string;
-            createdAt: Date;
-            logo?: string | null | undefined | undefined;
-            metadata?: any;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        getFullOrganization: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            organizationId?: string | undefined;
-            organizationSlug?: string | undefined;
-            membersLimit?: string | number | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: {
-                organizationId?: string | undefined;
-                organizationSlug?: string | undefined;
-                membersLimit?: string | number | undefined;
-            } | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            members: {
-                id: string;
-                organizationId: string;
-                role: "org:admin" | "org:member" | "org:reviewer";
-                createdAt: Date;
-                userId: string;
-                teamId?: string | undefined | undefined;
-                user: {
-                    id: string;
-                    email: string;
-                    name: string;
-                    image?: string | undefined;
-                };
-            }[];
-            invitations: {
-                id: string;
-                organizationId: string;
-                email: string;
-                role: "org:admin" | "org:member" | "org:reviewer";
-                status: better_auth_plugins.InvitationStatus;
-                inviterId: string;
-                expiresAt: Date;
-                createdAt: Date;
-                teamId?: string | undefined | undefined;
-            }[];
-            teams: {
-                id: string;
-                name: string;
-                organizationId: string;
-                createdAt: Date;
-                updatedAt?: Date | undefined;
-            }[];
-        } & {
-            id: string;
-            name: string;
-            slug: string;
-            createdAt: Date;
-            logo?: string | null | undefined | undefined;
-            metadata?: any;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        list: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: Record<string, any> | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            name: string;
-            slug: string;
-            createdAt: Date;
-            logo?: string | null | undefined | undefined;
-            metadata?: any;
-        }[], {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        inviteMember: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer" | ("org:admin" | "org:member" | "org:reviewer")[];
-            organizationId?: string | undefined;
-            resend?: boolean | undefined;
-        } & {
-            teamId?: (string | string[]) | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer" | ("org:admin" | "org:member" | "org:reviewer")[];
-            organizationId?: string | undefined;
-            resend?: boolean | undefined;
-        } & {
-            teamId?: (string | string[]) | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<NonNullable<{
-            id: string;
-            organizationId: string;
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            status: better_auth_plugins.InvitationStatus;
-            inviterId: string;
-            expiresAt: Date;
-            createdAt: Date;
-            teamId?: string | undefined | undefined;
-        } | {
-            id: string;
-            organizationId: string;
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            status: better_auth_plugins.InvitationStatus;
-            inviterId: string;
-            expiresAt: Date;
-            createdAt: Date;
-            teamId?: string | undefined | undefined;
-        }>, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        cancelInvitation: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            invitationId: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            invitationId: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            organizationId: string;
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            status: better_auth_plugins.InvitationStatus;
-            inviterId: string;
-            expiresAt: Date;
-            createdAt: Date;
-            teamId?: string | undefined | undefined;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        acceptInvitation: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            invitationId: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            invitationId: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            invitation: {
-                id: string;
-                organizationId: string;
-                email: string;
-                role: "org:admin" | "org:member" | "org:reviewer";
-                status: better_auth_plugins.InvitationStatus;
-                inviterId: string;
-                expiresAt: Date;
-                createdAt: Date;
-                teamId?: string | undefined | undefined;
-            };
-            member: {
-                id: string;
-                organizationId: string;
-                userId: string;
-                role: string;
-                createdAt: Date;
-            };
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        getInvitation: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            id: string;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            query: {
-                id: string;
-            };
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<NonNullable<{
-            id: string;
-            organizationId: string;
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            status: better_auth_plugins.InvitationStatus;
-            inviterId: string;
-            expiresAt: Date;
-            createdAt: Date;
-            teamId?: string | undefined | undefined;
-        } & {
-            organizationName: string;
-            organizationSlug: string;
-            inviterEmail: string;
-        }>, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        rejectInvitation: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            invitationId: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            invitationId: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            invitation: {
-                id: string;
-                organizationId: string;
-                email: string;
-                role: "admin" | "member" | "owner";
-                status: better_auth_plugins.InvitationStatus;
-                inviterId: string;
-                expiresAt: Date;
-                createdAt: Date;
-            } | null;
-            member: null;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        listInvitations: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            organizationId?: string | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: {
-                organizationId?: string | undefined;
-            } | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            organizationId: string;
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            status: better_auth_plugins.InvitationStatus;
-            inviterId: string;
-            expiresAt: Date;
-            createdAt: Date;
-            teamId?: string | undefined | undefined;
-        }[], {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        getActiveMember: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: Record<string, any> | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<NonNullable<Omit<{
-            id: string;
-            organizationId: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            createdAt: Date;
-            userId: string;
-            teamId?: string | undefined | undefined;
-            user: {
-                id: string;
-                email: string;
-                name: string;
-                image?: string | undefined;
-            };
-        } & {
-            user: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            };
-        }, "user"> & {
-            user: {
-                id: string;
-                name: string;
-                email: string;
-                image: string | undefined;
-            };
-        }>, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        checkSlug: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            slug: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            slug: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            status: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        removeMember: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            memberIdOrEmail: string;
-            organizationId?: string | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            memberIdOrEmail: string;
-            organizationId?: string | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            member: {
-                id: string;
-                organizationId: string;
-                role: "org:admin" | "org:member" | "org:reviewer";
-                createdAt: Date;
-                userId: string;
-                teamId?: string | undefined | undefined;
-                user: {
-                    id: string;
-                    email: string;
-                    name: string;
-                    image?: string | undefined;
-                };
-            };
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        updateMemberRole: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            role: better_auth.LiteralString | "org:admin" | "org:member" | "org:reviewer" | better_auth.LiteralString[] | ("org:admin" | "org:member" | "org:reviewer")[];
-            memberId: string;
-            organizationId?: string | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            role: better_auth.LiteralString | "org:admin" | "org:member" | "org:reviewer" | better_auth.LiteralString[] | ("org:admin" | "org:member" | "org:reviewer")[];
-            memberId: string;
-            organizationId?: string | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            organizationId: string;
-            role: "admin" | "member" | "owner";
-            createdAt: Date;
-            userId: string;
-            user: {
-                id: string;
-                email: string;
-                name: string;
-                image?: string | undefined;
-            };
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        leave: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            organizationId: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            organizationId: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<NonNullable<Omit<{
-            id: string;
-            organizationId: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            createdAt: Date;
-            userId: string;
-            teamId?: string | undefined | undefined;
-            user: {
-                id: string;
-                email: string;
-                name: string;
-                image?: string | undefined;
-            };
-        } & {
-            user: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            };
-        }, "user"> & {
-            user: {
-                id: string;
-                name: string;
-                email: string;
-                image: string | undefined;
-            };
-        }>, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        listUserInvitations: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            email?: string | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: {
-                email?: string | undefined;
-            } | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<(Omit<{
-            id: string;
-            organizationId: string;
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            status: better_auth_plugins.InvitationStatus;
-            inviterId: string;
-            expiresAt: Date;
-            createdAt: Date;
-            teamId?: string | undefined | undefined;
-        } & {
-            organization: {
-                id: string;
-                name: string;
-                slug: string;
-                createdAt: Date;
-                logo?: string | null | undefined | undefined;
-                metadata?: any;
-            };
-        }, "organization"> & {
-            organizationName: string;
-        })[], {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        listMembers: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            limit?: string | number | undefined;
-            offset?: string | number | undefined;
-            sortBy?: string | undefined;
-            sortDirection?: "asc" | "desc" | undefined;
-            filterField?: string | undefined;
-            filterValue?: string | number | boolean | string[] | number[] | undefined;
-            filterOperator?: "in" | "eq" | "ne" | "gt" | "gte" | "lt" | "lte" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
-            organizationId?: string | undefined;
-            organizationSlug?: string | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: {
-                limit?: string | number | undefined;
-                offset?: string | number | undefined;
-                sortBy?: string | undefined;
-                sortDirection?: "asc" | "desc" | undefined;
-                filterField?: string | undefined;
-                filterValue?: string | number | boolean | string[] | number[] | undefined;
-                filterOperator?: "in" | "eq" | "ne" | "gt" | "gte" | "lt" | "lte" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
-                organizationId?: string | undefined;
-                organizationSlug?: string | undefined;
-            } | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            members: ({
-                id: string;
-                organizationId: string;
-                role: "org:admin" | "org:member" | "org:reviewer";
-                createdAt: Date;
-                userId: string;
-                teamId?: string | undefined | undefined;
-                user: {
-                    id: string;
-                    email: string;
-                    name: string;
-                    image?: string | undefined;
-                };
-            } & {
-                user: {
-                    id: string;
-                    name: string;
-                    email: string;
-                    image: string | null | undefined;
-                };
-            })[];
-            total: number;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        getActiveMemberRole: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            userId?: string | undefined;
-            organizationId?: string | undefined;
-            organizationSlug?: string | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: {
-                userId?: string | undefined;
-                organizationId?: string | undefined;
-                organizationSlug?: string | undefined;
-            } | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            role: "org:admin" | "org:member" | "org:reviewer";
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        hasPermission: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            permissions: {
-                access?: string[] | undefined;
-                organization?: ("update" | "delete")[] | undefined;
-                member?: ("update" | "delete" | "create")[] | undefined;
-                invitation?: ("create" | "cancel")[] | undefined;
-                team?: ("update" | "delete" | "create")[] | undefined;
-                ac?: ("update" | "delete" | "create" | "read")[] | undefined;
-            };
-        } & {
-            organizationId?: string | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            permissions: {
-                access?: string[] | undefined;
-                organization?: ("update" | "delete")[] | undefined;
-                member?: ("update" | "delete" | "create")[] | undefined;
-                invitation?: ("create" | "cancel")[] | undefined;
-                team?: ("update" | "delete" | "create")[] | undefined;
-                ac?: ("update" | "delete" | "create" | "read")[] | undefined;
-            };
-        } & {
-            organizationId?: string | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            error: null;
-            success: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        createTeam: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            name: string;
-            organizationId?: string | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            name: string;
-            organizationId?: string | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            name: string;
-            organizationId: string;
-            createdAt: Date;
-            updatedAt?: Date | undefined;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        listTeams: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            organizationId?: string | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: {
-                organizationId?: string | undefined;
-            } | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            name: string;
-            organizationId: string;
-            createdAt: Date;
-            updatedAt?: Date | undefined;
-        }[], {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        removeTeam: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            teamId: string;
-            organizationId?: string | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            teamId: string;
-            organizationId?: string | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            message: string;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        updateTeam: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            teamId: string;
-            data: Partial<{
-                name: string;
-                organizationId: string;
-            }>;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            teamId: string;
-            data: Partial<{
-                name: string;
-                organizationId: string;
-            }>;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            name: string;
-            organizationId: string;
-            createdAt: Date;
-            updatedAt?: Date | undefined;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        setActiveTeam: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            teamId?: string | null | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            teamId?: string | null | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            name: string;
-            organizationId: string;
-            createdAt: Date;
-            updatedAt?: Date | undefined;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        listUserTeams: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: Record<string, any> | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            name: string;
-            organizationId: string;
-            createdAt: Date;
-            updatedAt?: Date | undefined;
-        }[], {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        listTeamMembers: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            teamId?: string | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: {
-                teamId?: string | undefined;
-            } | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            teamId: string;
-            userId: string;
-            createdAt: Date;
-        }[], {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        addTeamMember: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            teamId: string;
-            userId: unknown;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            teamId: string;
-            userId: unknown;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            id: string;
-            teamId: string;
-            userId: string;
-            createdAt: Date;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    organization: {
-        removeTeamMember: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            teamId: string;
-            userId: unknown;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            teamId: string;
-            userId: unknown;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            message: string;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    sso: {
-        saml2: {
-            sp: {
-                metadata: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-                    providerId: string;
-                    format?: "json" | "xml" | undefined;
-                }> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-                    query: {
-                        providerId: string;
-                        format?: "json" | "xml" | undefined;
-                    };
-                    fetchOptions?: FetchOptions | undefined;
-                }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<Response, {
-                    code?: string | undefined;
-                    message?: string | undefined;
-                }, FetchOptions["throw"] extends true ? true : true>>;
-            };
-        };
-    };
-} & {
-    sso: {
-        register: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            providerId: string;
-            issuer: string;
-            domain: string;
-            oidcConfig?: {
-                clientId: string;
-                clientSecret: string;
-                authorizationEndpoint?: string | undefined;
-                tokenEndpoint?: string | undefined;
-                userInfoEndpoint?: string | undefined;
-                tokenEndpointAuthentication?: "client_secret_post" | "client_secret_basic" | undefined;
-                jwksEndpoint?: string | undefined;
-                discoveryEndpoint?: string | undefined;
-                skipDiscovery?: boolean | undefined;
-                scopes?: string[] | undefined;
-                pkce?: boolean | undefined;
-                mapping?: {
-                    id: string;
-                    email: string;
-                    name: string;
-                    emailVerified?: string | undefined;
-                    image?: string | undefined;
-                    extraFields?: Record<string, any> | undefined;
-                } | undefined;
-            } | undefined;
-            samlConfig?: {
-                entryPoint: string;
-                cert: string;
-                callbackUrl: string;
-                spMetadata: {
-                    metadata?: string | undefined;
-                    entityID?: string | undefined;
-                    binding?: string | undefined;
-                    privateKey?: string | undefined;
-                    privateKeyPass?: string | undefined;
-                    isAssertionEncrypted?: boolean | undefined;
-                    encPrivateKey?: string | undefined;
-                    encPrivateKeyPass?: string | undefined;
-                };
-                audience?: string | undefined;
-                idpMetadata?: {
-                    metadata?: string | undefined;
-                    entityID?: string | undefined;
-                    cert?: string | undefined;
-                    privateKey?: string | undefined;
-                    privateKeyPass?: string | undefined;
-                    isAssertionEncrypted?: boolean | undefined;
-                    encPrivateKey?: string | undefined;
-                    encPrivateKeyPass?: string | undefined;
-                    singleSignOnService?: {
-                        Binding: string;
-                        Location: string;
-                    }[] | undefined;
-                } | undefined;
-                wantAssertionsSigned?: boolean | undefined;
-                authnRequestsSigned?: boolean | undefined;
-                signatureAlgorithm?: string | undefined;
-                digestAlgorithm?: string | undefined;
-                identifierFormat?: string | undefined;
-                privateKey?: string | undefined;
-                decryptionPvk?: string | undefined;
-                additionalParams?: Record<string, any> | undefined;
-                mapping?: {
-                    id: string;
-                    email: string;
-                    name: string;
-                    emailVerified?: string | undefined;
-                    firstName?: string | undefined;
-                    lastName?: string | undefined;
-                    extraFields?: Record<string, any> | undefined;
-                } | undefined;
-            } | undefined;
-            organizationId?: string | undefined;
-            overrideUserInfo?: boolean | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            providerId: string;
-            issuer: string;
-            domain: string;
-            oidcConfig?: {
-                clientId: string;
-                clientSecret: string;
-                authorizationEndpoint?: string | undefined;
-                tokenEndpoint?: string | undefined;
-                userInfoEndpoint?: string | undefined;
-                tokenEndpointAuthentication?: "client_secret_post" | "client_secret_basic" | undefined;
-                jwksEndpoint?: string | undefined;
-                discoveryEndpoint?: string | undefined;
-                skipDiscovery?: boolean | undefined;
-                scopes?: string[] | undefined;
-                pkce?: boolean | undefined;
-                mapping?: {
-                    id: string;
-                    email: string;
-                    name: string;
-                    emailVerified?: string | undefined;
-                    image?: string | undefined;
-                    extraFields?: Record<string, any> | undefined;
-                } | undefined;
-            } | undefined;
-            samlConfig?: {
-                entryPoint: string;
-                cert: string;
-                callbackUrl: string;
-                spMetadata: {
-                    metadata?: string | undefined;
-                    entityID?: string | undefined;
-                    binding?: string | undefined;
-                    privateKey?: string | undefined;
-                    privateKeyPass?: string | undefined;
-                    isAssertionEncrypted?: boolean | undefined;
-                    encPrivateKey?: string | undefined;
-                    encPrivateKeyPass?: string | undefined;
-                };
-                audience?: string | undefined;
-                idpMetadata?: {
-                    metadata?: string | undefined;
-                    entityID?: string | undefined;
-                    cert?: string | undefined;
-                    privateKey?: string | undefined;
-                    privateKeyPass?: string | undefined;
-                    isAssertionEncrypted?: boolean | undefined;
-                    encPrivateKey?: string | undefined;
-                    encPrivateKeyPass?: string | undefined;
-                    singleSignOnService?: {
-                        Binding: string;
-                        Location: string;
-                    }[] | undefined;
-                } | undefined;
-                wantAssertionsSigned?: boolean | undefined;
-                authnRequestsSigned?: boolean | undefined;
-                signatureAlgorithm?: string | undefined;
-                digestAlgorithm?: string | undefined;
-                identifierFormat?: string | undefined;
-                privateKey?: string | undefined;
-                decryptionPvk?: string | undefined;
-                additionalParams?: Record<string, any> | undefined;
-                mapping?: {
-                    id: string;
-                    email: string;
-                    name: string;
-                    emailVerified?: string | undefined;
-                    firstName?: string | undefined;
-                    lastName?: string | undefined;
-                    extraFields?: Record<string, any> | undefined;
-                } | undefined;
-            } | undefined;
-            organizationId?: string | undefined;
-            overrideUserInfo?: boolean | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<NonNullable<{
-            redirectURI: string;
-            oidcConfig: _better_auth_sso.OIDCConfig | null;
-            samlConfig: _better_auth_sso.SAMLConfig | null;
-        } & Omit<{
-            issuer: string;
-            oidcConfig?: _better_auth_sso.OIDCConfig | undefined;
-            samlConfig?: _better_auth_sso.SAMLConfig | undefined;
-            userId: string;
-            providerId: string;
-            organizationId?: string | undefined;
-            domain: string;
-        }, "oidcConfig" | "samlConfig">>, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    signIn: {
-        sso: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            callbackURL: string;
-            email?: string | undefined;
-            organizationSlug?: string | undefined;
-            providerId?: string | undefined;
-            domain?: string | undefined;
-            errorCallbackURL?: string | undefined;
-            newUserCallbackURL?: string | undefined;
-            scopes?: string[] | undefined;
-            loginHint?: string | undefined;
-            requestSignUp?: boolean | undefined;
-            providerType?: "saml" | "oidc" | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            callbackURL: string;
-            email?: string | undefined;
-            organizationSlug?: string | undefined;
-            providerId?: string | undefined;
-            domain?: string | undefined;
-            errorCallbackURL?: string | undefined;
-            newUserCallbackURL?: string | undefined;
-            scopes?: string[] | undefined;
-            loginHint?: string | undefined;
-            requestSignUp?: boolean | undefined;
-            providerType?: "saml" | "oidc" | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            url: string;
-            redirect: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    sso: {
-        providers: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: Record<string, any> | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            providers: {
-                providerId: string;
-                type: string;
-                issuer: string;
-                domain: string;
-                organizationId: string | null;
-                domainVerified: boolean;
-                oidcConfig: {
-                    discoveryEndpoint: string;
-                    clientIdLastFour: string;
-                    pkce: boolean;
-                    authorizationEndpoint: string | undefined;
-                    tokenEndpoint: string | undefined;
-                    userInfoEndpoint: string | undefined;
-                    jwksEndpoint: string | undefined;
-                    scopes: string[] | undefined;
-                    tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | undefined;
-                } | undefined;
-                samlConfig: {
-                    entryPoint: string;
-                    callbackUrl: string;
-                    audience: string | undefined;
-                    wantAssertionsSigned: boolean | undefined;
-                    authnRequestsSigned: boolean | undefined;
-                    identifierFormat: string | undefined;
-                    signatureAlgorithm: string | undefined;
-                    digestAlgorithm: string | undefined;
-                    certificate: {
-                        fingerprintSha256: string;
-                        notBefore: string;
-                        notAfter: string;
-                        publicKeyAlgorithm: string;
-                    } | {
-                        error: string;
-                    };
-                } | undefined;
-                spMetadataUrl: string;
-            }[];
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    sso: {
-        getProvider: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            providerId: string;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            query: {
-                providerId: string;
-            };
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            providerId: string;
-            type: string;
-            issuer: string;
-            domain: string;
-            organizationId: string | null;
-            domainVerified: boolean;
-            oidcConfig: {
-                discoveryEndpoint: string;
-                clientIdLastFour: string;
-                pkce: boolean;
-                authorizationEndpoint: string | undefined;
-                tokenEndpoint: string | undefined;
-                userInfoEndpoint: string | undefined;
-                jwksEndpoint: string | undefined;
-                scopes: string[] | undefined;
-                tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | undefined;
-            } | undefined;
-            samlConfig: {
-                entryPoint: string;
-                callbackUrl: string;
-                audience: string | undefined;
-                wantAssertionsSigned: boolean | undefined;
-                authnRequestsSigned: boolean | undefined;
-                identifierFormat: string | undefined;
-                signatureAlgorithm: string | undefined;
-                digestAlgorithm: string | undefined;
-                certificate: {
-                    fingerprintSha256: string;
-                    notBefore: string;
-                    notAfter: string;
-                    publicKeyAlgorithm: string;
-                } | {
-                    error: string;
-                };
-            } | undefined;
-            spMetadataUrl: string;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    sso: {
-        updateProvider: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            providerId: string;
-            issuer?: string | undefined;
-            domain?: string | undefined;
-            oidcConfig?: {
-                clientId?: string | undefined;
-                clientSecret?: string | undefined;
-                authorizationEndpoint?: string | undefined;
-                tokenEndpoint?: string | undefined;
-                userInfoEndpoint?: string | undefined;
-                tokenEndpointAuthentication?: "client_secret_post" | "client_secret_basic" | undefined;
-                jwksEndpoint?: string | undefined;
-                discoveryEndpoint?: string | undefined;
-                scopes?: string[] | undefined;
-                pkce?: boolean | undefined;
-                overrideUserInfo?: boolean | undefined;
-                mapping?: {
-                    id?: string | undefined;
-                    email?: string | undefined;
-                    emailVerified?: string | undefined;
-                    name?: string | undefined;
-                    image?: string | undefined;
-                    extraFields?: Record<string, any> | undefined;
-                } | undefined;
-            } | undefined;
-            samlConfig?: {
-                entryPoint?: string | undefined;
-                cert?: string | undefined;
-                callbackUrl?: string | undefined;
-                audience?: string | undefined;
-                idpMetadata?: {
-                    metadata?: string | undefined;
-                    entityID?: string | undefined;
-                    cert?: string | undefined;
-                    privateKey?: string | undefined;
-                    privateKeyPass?: string | undefined;
-                    isAssertionEncrypted?: boolean | undefined;
-                    encPrivateKey?: string | undefined;
-                    encPrivateKeyPass?: string | undefined;
-                    singleSignOnService?: {
-                        Binding: string;
-                        Location: string;
-                    }[] | undefined;
-                } | undefined;
-                spMetadata?: {
-                    metadata?: string | undefined;
-                    entityID?: string | undefined;
-                    binding?: string | undefined;
-                    privateKey?: string | undefined;
-                    privateKeyPass?: string | undefined;
-                    isAssertionEncrypted?: boolean | undefined;
-                    encPrivateKey?: string | undefined;
-                    encPrivateKeyPass?: string | undefined;
-                } | undefined;
-                wantAssertionsSigned?: boolean | undefined;
-                authnRequestsSigned?: boolean | undefined;
-                signatureAlgorithm?: string | undefined;
-                digestAlgorithm?: string | undefined;
-                identifierFormat?: string | undefined;
-                privateKey?: string | undefined;
-                decryptionPvk?: string | undefined;
-                additionalParams?: Record<string, any> | undefined;
-                mapping?: {
-                    id?: string | undefined;
-                    email?: string | undefined;
-                    emailVerified?: string | undefined;
-                    name?: string | undefined;
-                    firstName?: string | undefined;
-                    lastName?: string | undefined;
-                    extraFields?: Record<string, any> | undefined;
-                } | undefined;
-            } | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            providerId: string;
-            issuer?: string | undefined;
-            domain?: string | undefined;
-            oidcConfig?: {
-                clientId?: string | undefined;
-                clientSecret?: string | undefined;
-                authorizationEndpoint?: string | undefined;
-                tokenEndpoint?: string | undefined;
-                userInfoEndpoint?: string | undefined;
-                tokenEndpointAuthentication?: "client_secret_post" | "client_secret_basic" | undefined;
-                jwksEndpoint?: string | undefined;
-                discoveryEndpoint?: string | undefined;
-                scopes?: string[] | undefined;
-                pkce?: boolean | undefined;
-                overrideUserInfo?: boolean | undefined;
-                mapping?: {
-                    id?: string | undefined;
-                    email?: string | undefined;
-                    emailVerified?: string | undefined;
-                    name?: string | undefined;
-                    image?: string | undefined;
-                    extraFields?: Record<string, any> | undefined;
-                } | undefined;
-            } | undefined;
-            samlConfig?: {
-                entryPoint?: string | undefined;
-                cert?: string | undefined;
-                callbackUrl?: string | undefined;
-                audience?: string | undefined;
-                idpMetadata?: {
-                    metadata?: string | undefined;
-                    entityID?: string | undefined;
-                    cert?: string | undefined;
-                    privateKey?: string | undefined;
-                    privateKeyPass?: string | undefined;
-                    isAssertionEncrypted?: boolean | undefined;
-                    encPrivateKey?: string | undefined;
-                    encPrivateKeyPass?: string | undefined;
-                    singleSignOnService?: {
-                        Binding: string;
-                        Location: string;
-                    }[] | undefined;
-                } | undefined;
-                spMetadata?: {
-                    metadata?: string | undefined;
-                    entityID?: string | undefined;
-                    binding?: string | undefined;
-                    privateKey?: string | undefined;
-                    privateKeyPass?: string | undefined;
-                    isAssertionEncrypted?: boolean | undefined;
-                    encPrivateKey?: string | undefined;
-                    encPrivateKeyPass?: string | undefined;
-                } | undefined;
-                wantAssertionsSigned?: boolean | undefined;
-                authnRequestsSigned?: boolean | undefined;
-                signatureAlgorithm?: string | undefined;
-                digestAlgorithm?: string | undefined;
-                identifierFormat?: string | undefined;
-                privateKey?: string | undefined;
-                decryptionPvk?: string | undefined;
-                additionalParams?: Record<string, any> | undefined;
-                mapping?: {
-                    id?: string | undefined;
-                    email?: string | undefined;
-                    emailVerified?: string | undefined;
-                    name?: string | undefined;
-                    firstName?: string | undefined;
-                    lastName?: string | undefined;
-                    extraFields?: Record<string, any> | undefined;
-                } | undefined;
-            } | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            providerId: string;
-            type: string;
-            issuer: string;
-            domain: string;
-            organizationId: string | null;
-            domainVerified: boolean;
-            oidcConfig: {
-                discoveryEndpoint: string;
-                clientIdLastFour: string;
-                pkce: boolean;
-                authorizationEndpoint: string | undefined;
-                tokenEndpoint: string | undefined;
-                userInfoEndpoint: string | undefined;
-                jwksEndpoint: string | undefined;
-                scopes: string[] | undefined;
-                tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | undefined;
-            } | undefined;
-            samlConfig: {
-                entryPoint: string;
-                callbackUrl: string;
-                audience: string | undefined;
-                wantAssertionsSigned: boolean | undefined;
-                authnRequestsSigned: boolean | undefined;
-                identifierFormat: string | undefined;
-                signatureAlgorithm: string | undefined;
-                digestAlgorithm: string | undefined;
-                certificate: {
-                    fingerprintSha256: string;
-                    notBefore: string;
-                    notAfter: string;
-                    publicKeyAlgorithm: string;
-                } | {
-                    error: string;
-                };
-            } | undefined;
-            spMetadataUrl: string;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    sso: {
-        deleteProvider: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            providerId: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            providerId: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            success: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    twoFactor: {
-        enable: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            password: string;
-            issuer?: string | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            password: string;
-            issuer?: string | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            totpURI: string;
-            backupCodes: string[];
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    twoFactor: {
-        disable: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            password: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            password: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            status: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    twoFactor: {
-        verifyBackupCode: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            code: string;
-            disableSession?: boolean | undefined;
-            trustDevice?: boolean | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            code: string;
-            disableSession?: boolean | undefined;
-            trustDevice?: boolean | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<Omit<{
-            token: string | undefined;
-            user: (Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            }) | better_auth_plugins.UserWithTwoFactor;
-        }, "user"> & {
-            user: better_auth.StripEmptyObjects<{
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            } & {
-                twoFactorEnabled: boolean | null | undefined;
-            } & {} & {
-                banned: boolean | null | undefined;
-            } & {
-                role?: string | null | undefined;
-                banReason?: string | null | undefined;
-                banExpires?: Date | null | undefined;
-            } & {} & {
-                lastActiveAt?: Date | null | undefined;
-            }>;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    twoFactor: {
-        generateBackupCodes: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            password: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            password: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            status: boolean;
-            backupCodes: string[];
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    twoFactor: {
-        sendOtp: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            trustDevice?: boolean | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: Record<string, any> | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            status: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    twoFactor: {
-        verifyOtp: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            code: string;
-            trustDevice?: boolean | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            code: string;
-            trustDevice?: boolean | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<(Omit<{
-            token: string;
-            user: better_auth_plugins.UserWithTwoFactor;
-        }, "user"> & {
-            user: better_auth.StripEmptyObjects<{
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            } & {
-                twoFactorEnabled: boolean | null | undefined;
-            } & {} & {
-                banned: boolean | null | undefined;
-            } & {
-                role?: string | null | undefined;
-                banReason?: string | null | undefined;
-                banExpires?: Date | null | undefined;
-            } & {} & {
-                lastActiveAt?: Date | null | undefined;
-            }>;
-        }) | (Omit<{
-            token: string;
-            user: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            };
-        }, "user"> & {
-            user: better_auth.StripEmptyObjects<{
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            } & {
-                twoFactorEnabled: boolean | null | undefined;
-            } & {} & {
-                banned: boolean | null | undefined;
-            } & {
-                role?: string | null | undefined;
-                banReason?: string | null | undefined;
-                banExpires?: Date | null | undefined;
-            } & {} & {
-                lastActiveAt?: Date | null | undefined;
-            }>;
-        }), {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    twoFactor: {
-        getTotpUri: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            password: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            password: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            totpURI: string;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    twoFactor: {
-        verifyTotp: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            code: string;
-            trustDevice?: boolean | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            code: string;
-            trustDevice?: boolean | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<(Omit<{
-            token: string;
-            user: better_auth_plugins.UserWithTwoFactor;
-        }, "user"> & {
-            user: better_auth.StripEmptyObjects<{
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            } & {
-                twoFactorEnabled: boolean | null | undefined;
-            } & {} & {
-                banned: boolean | null | undefined;
-            } & {
-                role?: string | null | undefined;
-                banReason?: string | null | undefined;
-                banExpires?: Date | null | undefined;
-            } & {} & {
-                lastActiveAt?: Date | null | undefined;
-            }>;
-        }) | (Omit<{
-            token: string;
-            user: Record<string, any> & {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            };
-        }, "user"> & {
-            user: better_auth.StripEmptyObjects<{
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            } & {
-                twoFactorEnabled: boolean | null | undefined;
-            } & {} & {
-                banned: boolean | null | undefined;
-            } & {
-                role?: string | null | undefined;
-                banReason?: string | null | undefined;
-                banExpires?: Date | null | undefined;
-            } & {} & {
-                lastActiveAt?: Date | null | undefined;
-            }>;
-        }), {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    token: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-        query?: Record<string, any> | undefined;
-        fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-        token: string;
-    }, {
-        code?: string | undefined;
-        message?: string | undefined;
-    }, FetchOptions["throw"] extends true ? true : true>>;
-} & {
-    apiKey: {
-        create: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            configId?: string | undefined;
-            name?: string | undefined;
-            expiresIn?: number | null | undefined;
-            prefix?: string | undefined;
-            remaining?: number | null | undefined;
-            metadata?: any;
-            refillAmount?: number | undefined;
-            refillInterval?: number | undefined;
-            rateLimitTimeWindow?: number | undefined;
-            rateLimitMax?: number | undefined;
-            rateLimitEnabled?: boolean | undefined;
-            permissions?: Record<string, string[]> | undefined;
-            userId?: unknown;
-            organizationId?: unknown;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            configId?: string | undefined;
-            name?: string | undefined;
-            expiresIn?: number | null | undefined;
-            prefix?: string | undefined;
-            remaining?: number | null | undefined;
-            metadata?: any;
-            refillAmount?: number | undefined;
-            refillInterval?: number | undefined;
-            rateLimitTimeWindow?: number | undefined;
-            rateLimitMax?: number | undefined;
-            rateLimitEnabled?: boolean | undefined;
-            permissions?: Record<string, string[]> | undefined;
-            userId?: unknown;
-            organizationId?: unknown;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            key: string;
-            metadata: any;
-            permissions: any;
-            id: string;
-            configId: string;
-            name: string | null;
-            start: string | null;
-            prefix: string | null;
-            referenceId: string;
-            refillInterval: number | null;
-            refillAmount: number | null;
-            lastRefillAt: Date | null;
-            enabled: boolean;
-            rateLimitEnabled: boolean;
-            rateLimitTimeWindow: number | null;
-            rateLimitMax: number | null;
-            requestCount: number;
-            remaining: number | null;
-            lastRequest: Date | null;
-            expiresAt: Date | null;
-            createdAt: Date;
-            updatedAt: Date;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    apiKey: {
-        get: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            id: string;
-            configId?: string | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            query: {
-                id: string;
-                configId?: string | undefined;
-            };
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            metadata: Record<string, any> | null;
-            permissions: {
-                [key: string]: string[];
-            } | null;
-            id: string;
-            configId: string;
-            name: string | null;
-            start: string | null;
-            prefix: string | null;
-            referenceId: string;
-            refillInterval: number | null;
-            refillAmount: number | null;
-            lastRefillAt: Date | null;
-            enabled: boolean;
-            rateLimitEnabled: boolean;
-            rateLimitTimeWindow: number | null;
-            rateLimitMax: number | null;
-            requestCount: number;
-            remaining: number | null;
-            lastRequest: Date | null;
-            expiresAt: Date | null;
-            createdAt: Date;
-            updatedAt: Date;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    apiKey: {
-        update: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            keyId: string;
-            configId?: string | undefined;
-            userId?: unknown;
-            name?: string | undefined;
-            enabled?: boolean | undefined;
-            remaining?: number | undefined;
-            refillAmount?: number | undefined;
-            refillInterval?: number | undefined;
-            metadata?: any;
-            expiresIn?: number | null | undefined;
-            rateLimitEnabled?: boolean | undefined;
-            rateLimitTimeWindow?: number | undefined;
-            rateLimitMax?: number | undefined;
-            permissions?: Record<string, string[]> | null | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            keyId: string;
-            configId?: string | undefined;
-            userId?: unknown;
-            name?: string | undefined;
-            enabled?: boolean | undefined;
-            remaining?: number | undefined;
-            refillAmount?: number | undefined;
-            refillInterval?: number | undefined;
-            metadata?: any;
-            expiresIn?: number | null | undefined;
-            rateLimitEnabled?: boolean | undefined;
-            rateLimitTimeWindow?: number | undefined;
-            rateLimitMax?: number | undefined;
-            permissions?: Record<string, string[]> | null | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            metadata: Record<string, any> | null;
-            permissions: {
-                [key: string]: string[];
-            } | null;
-            id: string;
-            configId: string;
-            name: string | null;
-            start: string | null;
-            prefix: string | null;
-            referenceId: string;
-            refillInterval: number | null;
-            refillAmount: number | null;
-            lastRefillAt: Date | null;
-            enabled: boolean;
-            rateLimitEnabled: boolean;
-            rateLimitTimeWindow: number | null;
-            rateLimitMax: number | null;
-            requestCount: number;
-            remaining: number | null;
-            lastRequest: Date | null;
-            expiresAt: Date | null;
-            createdAt: Date;
-            updatedAt: Date;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    apiKey: {
-        delete: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            keyId: string;
-            configId?: string | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            keyId: string;
-            configId?: string | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            success: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    apiKey: {
-        list: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            configId?: string | undefined;
-            organizationId?: string | undefined;
-            limit?: unknown;
-            offset?: unknown;
-            sortBy?: string | undefined;
-            sortDirection?: "asc" | "desc" | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: {
-                configId?: string | undefined;
-                organizationId?: string | undefined;
-                limit?: unknown;
-                offset?: unknown;
-                sortBy?: string | undefined;
-                sortDirection?: "asc" | "desc" | undefined;
-            } | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            apiKeys: {
-                metadata: Record<string, any> | null;
-                permissions: {
-                    [key: string]: string[];
-                } | null;
-                id: string;
-                configId: string;
-                name: string | null;
-                start: string | null;
-                prefix: string | null;
-                referenceId: string;
-                refillInterval: number | null;
-                refillAmount: number | null;
-                lastRefillAt: Date | null;
-                enabled: boolean;
-                rateLimitEnabled: boolean;
-                rateLimitTimeWindow: number | null;
-                rateLimitMax: number | null;
-                requestCount: number;
-                remaining: number | null;
-                lastRequest: Date | null;
-                expiresAt: Date | null;
-                createdAt: Date;
-                updatedAt: Date;
-            }[];
-            total: number;
-            limit: number | undefined;
-            offset: number | undefined;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        setRole: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            userId: string;
-            role: "admin" | "user" | ("admin" | "user")[];
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            userId: string;
-            role: "admin" | "user" | ("admin" | "user")[];
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            user: better_auth_plugins.UserWithRole;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        getUser: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            id: string;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            query: {
-                id: string;
-            };
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<better_auth_plugins.UserWithRole, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        createUser: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            email: string;
-            password?: string | undefined;
-            name: string;
-            role?: "admin" | "user" | ("admin" | "user")[] | undefined;
-            data?: Record<string, any> | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            email: string;
-            password?: string | undefined;
-            name: string;
-            role?: "admin" | "user" | ("admin" | "user")[] | undefined;
-            data?: Record<string, any> | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            user: better_auth_plugins.UserWithRole;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        updateUser: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            userId: unknown;
-            data: Record<any, any>;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            userId: unknown;
-            data: Record<any, any>;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<better_auth_plugins.UserWithRole, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        listUsers: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<{
-            searchValue?: string | undefined;
-            searchField?: "name" | "email" | undefined;
-            searchOperator?: "contains" | "starts_with" | "ends_with" | undefined;
-            limit?: string | number | undefined;
-            offset?: string | number | undefined;
-            sortBy?: string | undefined;
-            sortDirection?: "asc" | "desc" | undefined;
-            filterField?: string | undefined;
-            filterValue?: string | number | boolean | string[] | number[] | undefined;
-            filterOperator?: "in" | "eq" | "ne" | "gt" | "gte" | "lt" | "lte" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
-        }> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            query: {
-                searchValue?: string | undefined;
-                searchField?: "name" | "email" | undefined;
-                searchOperator?: "contains" | "starts_with" | "ends_with" | undefined;
-                limit?: string | number | undefined;
-                offset?: string | number | undefined;
-                sortBy?: string | undefined;
-                sortDirection?: "asc" | "desc" | undefined;
-                filterField?: string | undefined;
-                filterValue?: string | number | boolean | string[] | number[] | undefined;
-                filterOperator?: "in" | "eq" | "ne" | "gt" | "gte" | "lt" | "lte" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
-            };
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            users: better_auth_plugins.UserWithRole[];
-            total: number;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        listUserSessions: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            userId: unknown;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            userId: unknown;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            sessions: better_auth_plugins.SessionWithImpersonatedBy[];
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        unbanUser: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            userId: unknown;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            userId: unknown;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            user: better_auth_plugins.UserWithRole;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        banUser: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            userId: unknown;
-            banReason?: string | undefined;
-            banExpiresIn?: number | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            userId: unknown;
-            banReason?: string | undefined;
-            banExpiresIn?: number | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            user: better_auth_plugins.UserWithRole;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        impersonateUser: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            userId: unknown;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            userId: unknown;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            session: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-            };
-            user: better_auth_plugins.UserWithRole;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        stopImpersonating: <FetchOptions extends better_auth.ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: better_auth.Prettify<{
-            query?: Record<string, any> | undefined;
-            fetchOptions?: FetchOptions | undefined;
-        }> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            session: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-            } & Record<string, any>;
-            user: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-            } & Record<string, any>;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        revokeUserSession: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            sessionToken: string;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            sessionToken: string;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            success: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        revokeUserSessions: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            userId: unknown;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            userId: unknown;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            success: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        removeUser: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            userId: unknown;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            userId: unknown;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            success: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        setUserPassword: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            newPassword: string;
-            userId: unknown;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            newPassword: string;
-            userId: unknown;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            status: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
-} & {
-    admin: {
-        hasPermission: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            permissions: {
-                readonly user?: ("update" | "delete" | "create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "get")[] | undefined;
-                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
-            };
-        } & {
-            userId?: string | undefined;
-            role?: "admin" | "user" | undefined;
-        }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            permissions: {
-                readonly user?: ("update" | "delete" | "create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "get")[] | undefined;
-                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+declare class RefreshTokenExpiredError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+/**
+ * Thrown when an authorization flow fails unexpectedly.
+ */
+declare class AuthorizationFlowError extends ApplicationError {
+    constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * Thrown when the authenticated session no longer satisfies the target
+ * application's assurance policy.
+ *
+ * During device-code token exchange this is a final error: the consumed flow
+ * cannot be retried and the client must start a new device authorization flow.
+ */
+declare class ApplicationSessionAssuranceError extends ApplicationError {
+    readonly payload: SessionAssuranceRequiredPayload | null;
+    readonly currentAssurance: SessionAssuranceRequiredPayload['currentAssurance'] | null;
+    readonly requiredAssurance: SessionAssuranceRequiredPayload['requiredAssurance'] | null;
+    readonly validStepUps: SessionAssuranceRequiredPayload['validStepUps'];
+    constructor(payload?: SessionAssuranceRequiredPayload | null, options?: ErrorOptions);
+}
+/**
+ * Thrown when an operation requires an authenticated user but no session exists.
+ */
+declare class UserNotLoggedInError extends ApplicationError {
+    constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * Thrown during device code polling when the user has not yet authorized the request.
+ *
+ * The client should continue polling at the specified interval.
+ */
+declare class DeviceAuthorizationPendingError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+/**
+ * Thrown when the client is polling too frequently during the device flow.
+ *
+ * The client should increase its polling interval before retrying.
+ */
+declare class DeviceAuthorizationSlowDownError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+/**
+ * Thrown when the user explicitly denies the device authorization request.
+ */
+declare class DeviceAccessDeniedError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+/**
+ * Thrown when the device code has expired or has already been consumed.
+ *
+ * The client must start a new device authorization flow.
+ */
+declare class DeviceCodeExpiredError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+/**
+ * Thrown when the authorization server returns a transient error during the device flow.
+ *
+ * The token exchange can be safely retried.
+ */
+declare class DeviceTransientServerError extends ApplicationError {
+    constructor(options?: ErrorOptions);
+}
+
+/**
+ * Checks whether a session assurance value satisfies an application policy.
+ */
+declare function isSessionAssuranceSufficient(sessionAssurance: JWTPayload['assurance'] | null | undefined, config?: ApplicationConfig): boolean;
+
+/**
+ * Service for managing applications and their candidate organizations.
+ *
+ * Provides functionality for:
+ * - OAuth authorization code flow (PKCE)
+ * - Device authorization flow (RFC 8628)
+ * - Token management (refresh, exchange)
+ * - Organization switching
+ */
+declare class ApplicationService {
+    private client;
+    /**
+     * Creates a new ApplicationService instance.
+     *
+     * @param client - The API client for making application requests
+     */
+    constructor(client: APIClient);
+    /**
+     * Gets public display context for an application auth redirect.
+     *
+     * @param applicationId - The application ID to get public auth context for
+     * @returns The minimal application identity safe to show before login
+     */
+    getApplicationAuthContext(applicationId: string): Promise<ApplicationAuthContextResponse>;
+    /**
+     * Lists candidate organizations for a specific application.
+     *
+     * Returns organizations where the authenticated user is a member and
+     * the application has been enabled with appropriate entitlement rules.
+     *
+     * @param applicationId - The application ID to get candidate organizations for
+     * @returns The list of candidate organizations
+     */
+    listCandidateOrganizations(applicationId: string): Promise<ListCandidateOrganizationsResponse>;
+    /**
+     * Starts an authorization flow for a specific application.
+     *
+     * @param applicationId - The application ID to start the authorization flow for
+     * @param redirectUri - The redirect URI to use for the authorization flow
+     * @param codeChallenge - The code challenge to use for the authorization flow
+     * @param organizationId - The organization ID to start the authorization flow for
+     */
+    startAuthorizationFlow(applicationId: string, redirectUri: string, codeChallenge: string, organizationId: string): Promise<StartAuthorizationFlowResponse>;
+    /**
+     * Starts a device authorization flow (RFC 8628).
+     *
+     * Returns a device code and user code that the end user must enter
+     * on the verification URI to authorize the device.
+     *
+     * @param requesterApplicationId - The application requesting authorization
+     * @param targetApplicationId - The target application to gain access to
+     * @returns Device authorization details including codes and verification URI
+     */
+    startDeviceAuthorizationFlow(requesterApplicationId: string, targetApplicationId: string): Promise<DeviceAuthorizationResponse>;
+    /**
+     * Retrieves the context for a pending device authorization request.
+     *
+     * Used by the authorization page to display details about the requesting
+     * and target applications before the user approves or denies.
+     *
+     * @param userCode - The user code from the device authorization response
+     * @returns Context including application info, available organizations, and status
+     */
+    getDeviceAuthorizationContext(userCode: string): Promise<DeviceAuthorizationContextResponse>;
+    /**
+     * Approves a pending device authorization request.
+     *
+     * @param userCode - The user code identifying the device authorization request
+     * @param organizationId - The organization to authorize the device for
+     * @returns Confirmation of the approval action
+     */
+    approveDeviceAuthorizationFlow(userCode: string, organizationId: string): Promise<DeviceAuthorizationActionResponse>;
+    /**
+     * Denies a pending device authorization request.
+     *
+     * @param userCode - The user code identifying the device authorization request
+     * @returns Confirmation of the denial action
+     */
+    denyDeviceAuthorizationFlow(userCode: string): Promise<DeviceAuthorizationActionResponse>;
+    /**
+     * Exchanges a device code for access and refresh tokens.
+     *
+     * This should be called by the device client while polling. It will throw
+     * typed errors to indicate the polling state (pending, slow down, denied, expired).
+     *
+     * @param deviceCode - The device code obtained from {@link startDeviceAuthorizationFlow}
+     * @returns Access and refresh tokens along with user and organization info
+     *
+     * @throws {DeviceAuthorizationPendingError} The user hasn't authorized yet — keep polling
+     * @throws {DeviceAuthorizationSlowDownError} Polling too fast — increase the interval
+     * @throws {DeviceAccessDeniedError} The user denied the request
+     * @throws {DeviceCodeExpiredError} The device code has expired
+     * @throws {DeviceTransientServerError} Transient server error — safe to retry
+     * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
+     */
+    exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
+    /**
+     * Completes an authorization flow for a specific application.
+     *
+     * @param code - The code to use for the authorization flow
+     * @param codeVerifier - The code verifier to use for the authorization flow
+     */
+    completeAuthorizationFlow(code: string, codeVerifier: string): Promise<CompleteAuthorizationFlowResponse>;
+    /**
+     * Refreshes an authentication token for a specific application.
+     *
+     * @param refreshToken - The refresh token to use for the authentication token refresh
+     * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
+     * @throws {ApplicationError} For other API errors
+     */
+    refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse | null>;
+    /**
+     * Gets the current user and organization for a specific application.
+     *
+     * By default, the returned organization does not include its `members`,
+     * `teams`, or `invitations` collections. Pass `options.include` to request
+     * any of them explicitly.
+     *
+     * @param accessToken - The access token to use for the who am I request
+     * @param options - Optional include list controlling which relations are loaded
+     * @returns The current user and organization
+     */
+    whoAmI(accessToken: string, options?: WhoAmIOptions): Promise<WhoAmIResponse>;
+    /**
+     * Switches the active organization for the authenticated user.
+     *
+     * Issues new access and refresh tokens scoped to the specified organization.
+     * The target organization must be entitled to the application and the entitlement's
+     * access rules must allow the current user.
+     *
+     * @param organizationId - The ID of the organization to switch to
+     * @param accessToken - Optional access token for authentication (uses cookie if not provided)
+     * @returns New authentication tokens and user/organization details
+     */
+    switchOrganization(organizationId: string, accessToken: string): Promise<CompleteAuthorizationFlowResponse>;
+    /**
+     * Logs out the user by invalidating their refresh token.
+     *
+     * Revokes the refresh token on the server, preventing further token refreshes
+     * and effectively ending the user's session.
+     *
+     * @param refreshToken - The refresh token to invalidate
+     */
+    logout(refreshToken: string): Promise<void>;
+}
+
+declare const ApiKeyMetadata: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+    }, z.core.$strip>;
+    workspace: z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+    }, z.core.$strip>;
+    application: z.ZodNullable<z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * Metadata attached to an API key, identifying the owning user and workspace.
+ */
+type ApiKeyMetadata = z.infer<typeof ApiKeyMetadata> & Record<string, unknown>;
+/**
+ * A full API key including the secret key value.
+ *
+ * The secret `key` field is only returned once at creation time.
+ */
+type ApiKey = Omit<ApiKey$1, 'metadata' | 'name'> & {
+    /** Display name of the API key. */
+    name: string;
+    /** Metadata identifying the key's owner and workspace. */
+    metadata: ApiKeyMetadata;
+};
+/**
+ * An API key with the secret key value omitted.
+ *
+ * Used in list and get operations where the secret should not be exposed.
+ */
+type ApiKeyWithoutSecret = Omit<ApiKey, 'key'>;
+/**
+ * Payload for creating a new API key.
+ */
+type CreateApiKeyPayload = {
+    /** Display name for the API key. */
+    name: string;
+    /** Time in milliseconds until the key expires. Omit for a non-expiring key. */
+    expiresIn?: number;
+    /** Optional prefix prepended to the generated key for identification. */
+    prefix?: string;
+    /** Optional metadata to attach to the key. */
+    metadata?: ApiKeyMetadata;
+};
+/**
+ * Payload for updating an existing API key.
+ */
+type UpdateApiKeyPayload = {
+    /** The ID of the API key to update. */
+    id: string;
+    /** The new display name for the API key. */
+    name: string;
+};
+
+/**
+ * Removes index signatures from a type
+ * @template T - The type to remove index signatures from
+ * @example
+ * ```typescript
+ * type MyType = {
+ *     foo: string
+ *     bar: number
+ *     [key: string]: any
+ * }
+ *
+ * type StrictMyType = Strict<MyType> // { foo: string; bar: number; }
+ * ```
+ */
+type Strict<T> = {
+    [K in keyof T as string extends K ? never : number extends K ? never : K]: T[K];
+};
+/**
+ * Creates a configured Better Auth API client with all required plugins.
+ *
+ * @param apiUrl - The base URL of the authentication API
+ * @param fetchOptions - Custom fetch options to include in all API requests
+ * @returns A fully-configured Better Auth client instance
+ *
+ * @internal
+ */
+declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOption): {
+    useActiveOrganization: better_auth_client.AuthQueryAtom<better_auth.Prettify<{
+        id: string;
+        name: string;
+        slug: string;
+        createdAt: Date;
+        logo?: string | null | undefined | undefined;
+        metadata?: any;
+    } & {
+        members: {
+            id: string;
+            organizationId: string;
+            role: "org:admin" | "org:member" | "org:reviewer";
+            createdAt: Date;
+            userId: string;
+            teamId?: string | undefined | undefined;
+            user: {
+                id: string;
+                email: string;
+                name: string;
+                image?: string | undefined;
             };
-        } & {
-            userId?: string | undefined;
-            role?: "admin" | "user" | undefined;
-        } & {
-            fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
-            error: null;
-            success: boolean;
-        }, {
-            code?: string | undefined;
-            message?: string | undefined;
-        }, FetchOptions["throw"] extends true ? true : true>>;
-    };
+        }[];
+        invitations: {
+            id: string;
+            organizationId: string;
+            email: string;
+            role: "org:admin" | "org:member" | "org:reviewer";
+            status: better_auth_plugins.InvitationStatus;
+            inviterId: string;
+            expiresAt: Date;
+            createdAt: Date;
+            teamId?: string | undefined | undefined;
+        }[];
+    }>>;
+    useListOrganizations: better_auth_client.AuthQueryAtom<{
+        id: string;
+        name: string;
+        slug: string;
+        createdAt: Date;
+        logo?: string | null | undefined | undefined;
+        metadata?: any;
+    }[]>;
+    useActiveMember: better_auth_client.AuthQueryAtom<{
+        id: string;
+        organizationId: string;
+        userId: string;
+        role: string;
+        createdAt: Date;
+    }>;
+    useActiveMemberRole: better_auth_client.AuthQueryAtom<{
+        role: string;
+    }>;
 } & {
     signIn: {
         social: <FetchOptions extends better_auth.ClientFetchOption<Partial<{
-            provider: (string & {}) | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
+            provider: (string & {}) | "google" | "microsoft" | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
             callbackURL?: string | undefined;
             newUserCallbackURL?: string | undefined;
             errorCallbackURL?: string | undefined;
@@ -2724,7 +1071,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             loginHint?: string | undefined;
             additionalData?: Record<string, any> | undefined;
         }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: better_auth.Prettify<{
-            provider: (string & {}) | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
+            provider: (string & {}) | "google" | "microsoft" | "linear" | "huggingface" | "github" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel";
             callbackURL?: string | undefined;
             newUserCallbackURL?: string | undefined;
             errorCallbackURL?: string | undefined;
@@ -3518,6 +1865,84 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             error: null;
         }>;
     };
+} & {
+    sessionAssurance: {
+        getSessionAssurance: () => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        stepUpWithPassword: (body: {
+            password: string;
+        }) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        sendOtp: () => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        verifyOtp: (body: {
+            otp: string;
+        }) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        beginOAuthStepUp: (body: {
+            provider: OAuthStepUpProvider;
+            returnUrl?: string;
+        }) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+        completeOAuthStepUp: (body: {
+            stepUpToken: string;
+        }) => Promise<{
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        } | {
+            data: unknown;
+            error: null;
+        }>;
+    };
 } & {
     $Infer: {
         ActiveOrganization: {
@@ -3741,7 +2166,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
         body?: any;
         query?: any;
         params?: any;
-        duplex?: "full" | "half" | undefined;
+        duplex? /** Number of hours to retain data before automatic cleanup. */: "full" | "half" | undefined;
         jsonParser: (text: string) => Promise<any> | any;
         retry?: better_auth_client.RetryOptions | undefined;
         retryAttempt?: number | undefined;
@@ -4266,6 +2691,18 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             readonly code: "INVALID_ROLE_TYPE";
             message: string;
         };
+        OTP_EXPIRED: {
+            readonly code: "OTP_EXPIRED";
+            message: string;
+        };
+        INVALID_OTP: {
+            readonly code: "INVALID_OTP";
+            message: string;
+        };
+        TOO_MANY_ATTEMPTS: {
+            readonly code: "TOO_MANY_ATTEMPTS";
+            message: string;
+        };
         USER_NOT_FOUND: {
             readonly code: "USER_NOT_FOUND";
             message: string;
@@ -4469,408 +2906,380 @@ type Member = Strict<APIClient['$Infer']['Member']>;
 /**
  * Custom settings that can be applied to an organization.
  */
+type BillingMode = 'credits' | 'plan';
 type OrganizationSettings = {
-    /** Whether file storage is disabled for this organization. */
-    disableStorage?: boolean;
-    /** Number of hours to retain data before automatic cleanup. */
-    dataRetentionHours?: number;
-};
-/**
- * An organization with optional custom settings.
- */
-type ExtendedOrganization = BaseOrganization & {
-    settings?: OrganizationSettings;
-};
-/**
- * A complete organization object including its members, invitations, and teams.
- */
-type FullOrganization = ExtendedOrganization & {
-    members: Member[];
-    invitations: Invitation[];
-    teams: Team[];
-};
-/**
- * An organization as returned by the "who am I" endpoint, where related
- * collections (`members`, `teams`, `invitations`) are optional and only
- * populated when explicitly requested via the `include` query parameter.
- */
-type WhoAmIOrganization = Omit<FullOrganization, 'members' | 'invitations' | 'teams'> & {
-    members?: Member[];
-    invitations?: Invitation[];
-    teams?: Team[];
-};
-/**
- * A record linking a user to a team.
- */
-type TeamMember = {
-    /** Unique identifier for this team membership. */
-    id: string;
-    /** The team this membership belongs to. */
-    teamId: string;
-    /** The user who is a member of the team. */
-    userId: string;
-    /** When the user was added to the team. */
-    createdAt: Date;
-};
-
-/**
- * Keys of the organization's related collections that can be optionally
- * included in the "who am I" response.
- */
-type WhoAmIInclude = 'members' | 'teams' | 'invitations';
-/**
- * Represents a registered OAuth application.
- */
-type Application = {
-    /** Unique application identifier. */
-    id: string;
-    /** Display name of the application. */
-    name: string;
-    /** Human-readable description of the application. */
-    description: string;
-    /** Allowed OAuth redirect URIs for this application. */
-    redirectUris: string[];
-};
-/**
- * Response returned when listing candidate organizations for an application.
- */
-type ListCandidateOrganizationsResponse = FullOrganization[];
-/**
- * Public application context used to preserve continuity during auth redirects.
- */
-type ApplicationAuthContextResponse = {
-    /** Minimal application identity shown in the hosted auth flow. */
-    application: Pick<Application, 'id' | 'name'>;
-};
-/**
- * Response returned when starting an authorization flow.
- */
-type StartAuthorizationFlowResponse = {
-    /** The authorization code to exchange for tokens. */
-    code: string;
-};
-/**
- * Response returned when completing an authorization flow or refreshing tokens.
- */
-type CompleteAuthorizationFlowResponse = {
-    /** Short-lived JWT access token. */
-    accessToken: string;
-    /** Long-lived refresh token for obtaining new access tokens. */
-    refreshToken: string;
-    /** The authenticated user. */
-    user: User;
-    /** The organization the tokens are scoped to. */
-    organization: FullOrganization;
+    /** Whether file storage is disabled for this organization. */
+    disableStorage?: boolean;
+    /** Number of hours to retain data before automatic cleanup. */
+    dataRetentionHours?: number;
+    /** How the organization is billed for usage. */
+    billing?: {
+        mode: BillingMode;
+        cvp?: number;
+        limits?: {
+            enabled: boolean;
+            soft_usd?: number;
+            hard_usd?: number;
+            soft_credits?: number;
+            hard_credits?: number;
+            period: 'monthly';
+            notify_emails?: string[];
+        };
+    };
 };
 /**
- * Response returned by the "who am I" endpoint.
- *
- * By default, the `organization` only contains the base organization fields.
- * The `members`, `teams`, and `invitations` collections are only populated
- * when explicitly requested via the `include` query parameter.
+ * An organization with optional custom settings.
  */
-type WhoAmIResponse = {
-    /** The authenticated user. */
-    user: User;
-    /** The user's active organization. */
-    organization: WhoAmIOrganization;
+type ExtendedOrganization = BaseOrganization & {
+    settings?: OrganizationSettings;
 };
 /**
- * Options accepted by the "who am I" client method.
+ * A complete organization object including its members, invitations, and teams.
  */
-type WhoAmIOptions = {
-    /**
-     * Collections to include in the returned organization. When omitted or
-     * empty, only the base organization fields are returned.
-     */
-    include?: WhoAmIInclude[];
+type FullOrganization = ExtendedOrganization & {
+    members: Member[];
+    invitations: Invitation[];
+    teams: Team[];
 };
 /**
- * Response returned when starting a device authorization flow (RFC 8628).
+ * An organization as returned by the "who am I" endpoint, where related
+ * collections (`members`, `teams`, `invitations`) are optional and only
+ * populated when explicitly requested via the `include` query parameter.
  */
-type DeviceAuthorizationResponse = {
-    /** The device verification code for polling. */
-    device_code: string;
-    /** The user-facing code to enter on the verification page. */
-    user_code: string;
-    /** The URI the user should visit to authorize the device. */
-    verification_uri: string;
-    /** A complete URI including the user code for convenience. */
-    verification_uri_complete: string;
-    /** Number of seconds until the device code expires. */
-    expires_in: number;
-    /** Minimum polling interval in seconds. */
-    interval: number;
+type WhoAmIOrganization = Omit<FullOrganization, 'members' | 'invitations' | 'teams'> & {
+    members?: Member[];
+    invitations?: Invitation[];
+    teams?: Team[];
 };
 /**
- * Minimal application info shown in device authorization context.
- *
- * @internal
+ * A record linking a user to a team.
  */
-type DeviceContextApplication = {
-    /** Unique application identifier. */
+type TeamMember = {
+    /** Unique identifier for this team membership. */
     id: string;
-    /** Display name of the application. */
-    name: string;
-    /** Human-readable description, or `null` if not set. */
-    description: string | null;
+    /** The team this membership belongs to. */
+    teamId: string;
+    /** The user who is a member of the team. */
+    userId: string;
+    /** When the user was added to the team. */
+    createdAt: Date;
 };
+
 /**
- * Context information for a pending device authorization request.
+ * Options accepted when listing users through the Better Auth admin plugin.
  */
-type DeviceAuthorizationContextResponse = {
-    /** The application that initiated the device flow, with verification status. */
-    requester: DeviceContextApplication & {
-        isVerified: boolean;
-    };
-    /** The target application the requester wants access to. */
-    target: DeviceContextApplication;
-    /** Organizations the user can authorize the device for. */
-    organizations: FullOrganization[];
-    /** Organization pre-selected by the requester, if any. */
-    preselectedOrganizationId: string | null;
-    /** Current status of the device authorization request. */
-    status: 'pending' | 'approved' | 'denied';
-    /** Seconds remaining before the device code expires. */
-    expiresIn: number;
+type ListAdminUsersOptions = {
+    /** Maximum number of users to return. */
+    limit?: number;
+    /** Number of users to skip. */
+    offset?: number;
+    /** Free-text search value. */
+    searchValue?: string;
+    /** User field searched by Better Auth. Defaults to email. */
+    searchField?: 'email' | 'name';
+    /** Search comparison operator. Defaults to contains. */
+    searchOperator?: 'contains' | 'starts_with' | 'ends_with';
+    /** Field used to sort the listing. */
+    sortBy?: string;
+    /** Sort direction. */
+    sortDirection?: 'asc' | 'desc';
+    /** User field filtered by Better Auth. Defaults to email. */
+    filterField?: string;
+    /** Filter value. */
+    filterValue?: string | number | boolean | string[] | number[];
+    /** Filter comparison operator. Defaults to eq. */
+    filterOperator?: 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'contains' | 'starts_with' | 'ends_with';
 };
 /**
- * Response returned when approving or denying a device authorization request.
+ * Options accepted when listing all organizations as a global admin.
  */
-type DeviceAuthorizationActionResponse = {
-    /** Whether the action was performed successfully. */
-    success: boolean;
+type ListAdminOrganizationsOptions = {
+    /** Maximum number of organizations to return. Defaults to 50. */
+    limit?: number;
+    /** Number of organizations to skip. Defaults to 0. */
+    offset?: number;
+    /** Column used to order the listing. Defaults to creation date. */
+    sortBy?: 'createdAt' | 'title';
+    /** Order direction. Defaults to descending. */
+    sortDirection?: 'asc' | 'desc';
+    /** Free-text search matched against organization name, slug, and ID. */
+    query?: string;
+    /**
+     * Number of member previews to include per organization (max 10).
+     * When greater than 0, each row also includes the total member count.
+     * Defaults to 0 (no members or member count returned).
+     */
+    membersPreview?: number;
+    /**
+     * Number of application previews to include per organization (max 10).
+     * When greater than 0, each row also includes the total application count.
+     * Defaults to 0 (no applications or application count returned).
+     */
+    applicationsPreview?: number;
 };
-
 /**
- * Base error class for all SDK errors.
- *
- * Extends the native `Error` with a machine-readable `code` property
- * that can be used for programmatic error handling.
+ * Options accepted when fetching a single organization as a global admin.
  */
-declare class BaseError extends Error {
-    /** Machine-readable error code (e.g. `"INVALID_SOCIAL_PROVIDER"`). */
-    code: string;
+type GetAdminOrganizationOptions = {
+    /** ID of the organization to fetch. */
+    organizationId: string;
+    /** Column the listing adjacency is computed against. Defaults to creation date. */
+    sortBy?: 'createdAt' | 'title';
+    /** Order direction the listing adjacency is computed against. Defaults to descending. */
+    sortDirection?: 'asc' | 'desc';
     /**
-     * @param code - A machine-readable error code
-     * @param message - A human-readable error message
-     * @param options - Standard `ErrorOptions` (e.g. `cause`)
+     * When true, the organization includes adjacent IDs in the listing
+     * defined by the ordering options.
      */
-    constructor(code: string, message: string, options?: ErrorOptions);
-}
-
+    includeAdjacent?: boolean;
+};
 /**
- * Generic error thrown by the `ApplicationService`.
- *
- * All application-specific errors extend this class, so you can catch
- * `ApplicationError` to handle any application-related failure.
+ * Options accepted when listing members for a single organization as a global admin.
  */
-declare class ApplicationError extends BaseError {
-    constructor(message: string, options?: ErrorOptions);
-}
+type ListAdminOrganizationMembersOptions = {
+    /** ID of the organization whose members should be listed. */
+    organizationId: string;
+    /** Maximum number of members to return. Defaults to 50. */
+    limit?: number;
+    /** Number of members to skip. Defaults to 0. */
+    offset?: number;
+};
 /**
- * Thrown when a refresh token has expired or been revoked.
- *
- * The client should discard its stored tokens and prompt the user
- * to re-authenticate.
+ * Options accepted when creating an organization as a global admin.
  */
-declare class RefreshTokenExpiredError extends ApplicationError {
-    constructor(options?: ErrorOptions);
-}
+type CreateAdminOrganizationOptions = {
+    /** Optional organization ID. Generated by the API when omitted. */
+    id?: string;
+    /** Display name of the organization. */
+    name: string;
+    /** URL-friendly identifier. Generated from the name when omitted. */
+    slug?: string;
+    /** Logo URL. */
+    logo?: string;
+    /** Opaque metadata stored with the organization. */
+    metadata?: string;
+    /** Custom organization settings. */
+    settings?: OrganizationSettings;
+};
 /**
- * Thrown when an authorization flow fails unexpectedly.
- */
-declare class AuthorizationFlowError extends ApplicationError {
-    constructor(message: string, options?: ErrorOptions);
-}
+ * Options accepted when updating an organization as a global admin.
+ */
+type UpdateAdminOrganizationOptions = {
+    /** ID of the organization to update. */
+    organizationId: string;
+    /** Display name of the organization. */
+    name?: string;
+    /** URL-friendly identifier. */
+    slug?: string;
+    /** Logo URL. */
+    logo?: string;
+    /** Opaque metadata stored with the organization. */
+    metadata?: string;
+    /** Custom organization settings. Replaces the stored settings object. */
+    settings?: OrganizationSettings;
+};
 /**
- * Thrown when an operation requires an authenticated user but no session exists.
+ * User row returned by the Better Auth admin user listing endpoint.
  */
-declare class UserNotLoggedInError extends ApplicationError {
-    constructor(message: string, options?: ErrorOptions);
-}
+type AdminUser = {
+    id: string;
+    name: string;
+    email: string;
+    emailVerified: boolean;
+    image: string | null;
+    createdAt: string | Date;
+    updatedAt: string | Date;
+    role: string | null;
+    banned: boolean | null;
+    banReason: string | null;
+    banExpires: string | Date | null;
+    lastActiveAt?: string | Date | null;
+    twoFactorEnabled?: boolean | null;
+};
 /**
- * Thrown during device code polling when the user has not yet authorized the request.
- *
- * The client should continue polling at the specified interval.
+ * Paginated Better Auth admin user listing response.
  */
-declare class DeviceAuthorizationPendingError extends ApplicationError {
-    constructor(options?: ErrorOptions);
-}
+type ListAdminUsersResult = {
+    users: AdminUser[];
+    total: number;
+    limit?: number;
+    offset?: number;
+};
 /**
- * Thrown when the client is polling too frequently during the device flow.
- *
- * The client should increase its polling interval before retrying.
+ * Member preview returned alongside each admin organization row.
  */
-declare class DeviceAuthorizationSlowDownError extends ApplicationError {
-    constructor(options?: ErrorOptions);
-}
+type AdminOrganizationMember = {
+    id: string;
+    name: string;
+    email: string;
+    image: string | null;
+};
 /**
- * Thrown when the user explicitly denies the device authorization request.
+ * Full organization member row returned by the admin organization member listing endpoint.
  */
-declare class DeviceAccessDeniedError extends ApplicationError {
-    constructor(options?: ErrorOptions);
-}
+type AdminOrganizationMemberRecord = AdminOrganizationMember & {
+    memberId: string;
+    organizationId: string;
+    role: string;
+    createdAt: string;
+};
 /**
- * Thrown when the device code has expired or has already been consumed.
- *
- * The client must start a new device authorization flow.
+ * Paginated organization member listing response.
  */
-declare class DeviceCodeExpiredError extends ApplicationError {
-    constructor(options?: ErrorOptions);
-}
+type ListAdminOrganizationMembersResult = {
+    members: AdminOrganizationMemberRecord[];
+    total: number;
+    limit: number;
+    offset: number;
+};
 /**
- * Thrown when the authorization server returns a transient error during the device flow.
- *
- * The token exchange can be safely retried.
+ * Application preview returned alongside each admin organization row.
  */
-declare class DeviceTransientServerError extends ApplicationError {
-    constructor(options?: ErrorOptions);
-}
-
+type AdminOrganizationApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+    createdAt: string;
+};
 /**
- * Service for managing applications and their candidate organizations.
- *
- * Provides functionality for:
- * - OAuth authorization code flow (PKCE)
- * - Device authorization flow (RFC 8628)
- * - Token management (refresh, exchange)
- * - Organization switching
+ * Organization row returned by the admin organization listing endpoint.
  */
-declare class ApplicationService {
-    private client;
-    /**
-     * Creates a new ApplicationService instance.
-     *
-     * @param client - The API client for making application requests
-     */
-    constructor(client: APIClient);
-    /**
-     * Gets public display context for an application auth redirect.
-     *
-     * @param applicationId - The application ID to get public auth context for
-     * @returns The minimal application identity safe to show before login
-     */
-    getApplicationAuthContext(applicationId: string): Promise<ApplicationAuthContextResponse>;
-    /**
-     * Lists candidate organizations for a specific application.
-     *
-     * Returns organizations where the authenticated user is a member and
-     * the application has been enabled with appropriate entitlement rules.
-     *
-     * @param applicationId - The application ID to get candidate organizations for
-     * @returns The list of candidate organizations
-     */
-    listCandidateOrganizations(applicationId: string): Promise<ListCandidateOrganizationsResponse>;
-    /**
-     * Starts an authorization flow for a specific application.
-     *
-     * @param applicationId - The application ID to start the authorization flow for
-     * @param redirectUri - The redirect URI to use for the authorization flow
-     * @param codeChallenge - The code challenge to use for the authorization flow
-     * @param organizationId - The organization ID to start the authorization flow for
-     */
-    startAuthorizationFlow(applicationId: string, redirectUri: string, codeChallenge: string, organizationId: string): Promise<StartAuthorizationFlowResponse>;
-    /**
-     * Starts a device authorization flow (RFC 8628).
-     *
-     * Returns a device code and user code that the end user must enter
-     * on the verification URI to authorize the device.
-     *
-     * @param requesterApplicationId - The application requesting authorization
-     * @param targetApplicationId - The target application to gain access to
-     * @returns Device authorization details including codes and verification URI
-     */
-    startDeviceAuthorizationFlow(requesterApplicationId: string, targetApplicationId: string): Promise<DeviceAuthorizationResponse>;
+type AdminOrganization = {
+    id: string;
+    name: string;
+    slug: string;
+    logo: string | null;
+    createdAt: string;
+    metadata: string | null;
+    settings: OrganizationSettings | null;
+    /** Total number of active members. Present when requested via membersPreview. */
+    memberCount?: number;
+    /** Preview of the first members. Present when requested via membersPreview. */
+    members?: AdminOrganizationMember[];
+    /** Total number of enabled applications. Present when requested via applicationsPreview. */
+    applicationCount?: number;
+    /** Preview of the first enabled applications. Present when requested via applicationsPreview. */
+    applications?: AdminOrganizationApplication[];
     /**
-     * Retrieves the context for a pending device authorization request.
-     *
-     * Used by the authorization page to display details about the requesting
-     * and target applications before the user approves or denies.
-     *
-     * @param userCode - The user code from the device authorization response
-     * @returns Context including application info, available organizations, and status
+     * Adjacent organization IDs in the listing defined by the ordering options.
+     * Present when requested via includeAdjacent.
      */
-    getDeviceAuthorizationContext(userCode: string): Promise<DeviceAuthorizationContextResponse>;
+    adjacent?: {
+        previous: string | null;
+        next: string | null;
+        /** 1-based position in the listing. */
+        index: number;
+        total: number;
+    };
+};
+/**
+ * Paginated admin organization listing response.
+ */
+type ListAdminOrganizationsResult = {
+    organizations: AdminOrganization[];
+    total: number;
+    limit: number;
+    offset: number;
+};
+
+/**
+ * Service for global admin operations.
+ *
+ * All endpoints require the authenticated user to hold the global admin role.
+ */
+declare class AdminService {
+    private client;
     /**
-     * Approves a pending device authorization request.
+     * Creates a new AdminService instance.
      *
-     * @param userCode - The user code identifying the device authorization request
-     * @param organizationId - The organization to authorize the device for
-     * @returns Confirmation of the approval action
+     * @param client - The API client for making admin requests
      */
-    approveDeviceAuthorizationFlow(userCode: string, organizationId: string): Promise<DeviceAuthorizationActionResponse>;
+    constructor(client: APIClient);
     /**
-     * Denies a pending device authorization request.
+     * Lists all organizations, optionally with member and application previews
+     * and totals when a preview size is requested.
      *
-     * @param userCode - The user code identifying the device authorization request
-     * @returns Confirmation of the denial action
+     * @param options - Pagination, ordering, search, and preview options
+     * @returns The paginated organization listing
      */
-    denyDeviceAuthorizationFlow(userCode: string): Promise<DeviceAuthorizationActionResponse>;
+    listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
+        data: null;
+        error: {
+            message?: string | undefined;
+            status: number;
+            statusText: string;
+        };
+    } | {
+        data: ListAdminOrganizationsResult;
+        error: null;
+    }>;
     /**
-     * Exchanges a device code for access and refresh tokens.
-     *
-     * This should be called by the device client while polling. It will throw
-     * typed errors to indicate the polling state (pending, slow down, denied, expired).
+     * Lists all Better Auth users from the user table.
      *
-     * @param deviceCode - The device code obtained from {@link startDeviceAuthorizationFlow}
-     * @returns Access and refresh tokens along with user and organization info
-     *
-     * @throws {DeviceAuthorizationPendingError} The user hasn't authorized yet — keep polling
-     * @throws {DeviceAuthorizationSlowDownError} Polling too fast — increase the interval
-     * @throws {DeviceAccessDeniedError} The user denied the request
-     * @throws {DeviceCodeExpiredError} The device code has expired
-     * @throws {DeviceTransientServerError} Transient server error — safe to retry
+     * @param options - Pagination, search, filter, and ordering options
+     * @returns The paginated user listing
      */
-    exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
+    listUsers(options?: ListAdminUsersOptions): Promise<{
+        data: null;
+        error: {
+            message?: string | undefined;
+            status: number;
+            statusText: string;
+        };
+    } | {
+        data: ListAdminUsersResult;
+        error: null;
+    }>;
     /**
-     * Completes an authorization flow for a specific application.
+     * Fetches a single organization, optionally with adjacent IDs in
+     * the listing defined by the ordering options.
      *
-     * @param code - The code to use for the authorization flow
-     * @param codeVerifier - The code verifier to use for the authorization flow
+     * @param options - Organization ID and listing adjacency options
+     * @returns The organization
      */
-    completeAuthorizationFlow(code: string, codeVerifier: string): Promise<CompleteAuthorizationFlowResponse>;
+    getOrganization(options: GetAdminOrganizationOptions): Promise<{
+        data: AdminOrganization;
+    } | null>;
     /**
-     * Refreshes an authentication token for a specific application.
+     * Lists active members for one organization as a global admin.
      *
-     * @param refreshToken - The refresh token to use for the authentication token refresh
-     * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
-     * @throws {ApplicationError} For other API errors
+     * @param options - Organization ID and pagination options
+     * @returns The paginated organization member listing
      */
-    refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse | null>;
+    listOrganizationMembers(options: ListAdminOrganizationMembersOptions): Promise<{
+        data: null;
+        error: {
+            message?: string | undefined;
+            status: number;
+            statusText: string;
+        };
+    } | {
+        data: ListAdminOrganizationMembersResult;
+        error: null;
+    }>;
     /**
-     * Gets the current user and organization for a specific application.
-     *
-     * By default, the returned organization does not include its `members`,
-     * `teams`, or `invitations` collections. Pass `options.include` to request
-     * any of them explicitly.
+     * Creates an organization without adding the creator as a member.
      *
-     * @param accessToken - The access token to use for the who am I request
-     * @param options - Optional include list controlling which relations are loaded
-     * @returns The current user and organization
+     * @param options - Organization name and optional slug, logo, metadata, and settings
+     * @returns The created organization
      */
-    whoAmI(accessToken: string, options?: WhoAmIOptions): Promise<WhoAmIResponse>;
+    createOrganization(options: CreateAdminOrganizationOptions): Promise<{
+        data: AdminOrganization;
+    } | null>;
     /**
-     * Switches the active organization for the authenticated user.
+     * Updates an organization's profile and settings.
      *
-     * Issues new access and refresh tokens scoped to the specified organization.
-     * The target organization must be entitled to the application and the entitlement's
-     * access rules must allow the current user.
-     *
-     * @param organizationId - The ID of the organization to switch to
-     * @param accessToken - Optional access token for authentication (uses cookie if not provided)
-     * @returns New authentication tokens and user/organization details
+     * @param options - Organization ID and the fields to update
+     * @returns The updated organization
      */
-    switchOrganization(organizationId: string, accessToken: string): Promise<CompleteAuthorizationFlowResponse>;
+    updateOrganization(options: UpdateAdminOrganizationOptions): Promise<{
+        data: AdminOrganization;
+    } | null>;
     /**
-     * Logs out the user by invalidating their refresh token.
-     *
-     * Revokes the refresh token on the server, preventing further token refreshes
-     * and effectively ending the user's session.
-     *
-     * @param refreshToken - The refresh token to invalidate
+     * Bans a user from the auth system and invalidates all their sessions.
+     * @param userId - The ID of the user to ban
      */
-    logout(refreshToken: string): Promise<void>;
+    banUser(userId: string): Promise<void>;
 }
 
 /**
@@ -4958,47 +3367,7 @@ declare class OrganizationService {
      * @param id - The organization ID
      * @returns The organization with members, invitations, and teams
      */
-    getOrganization(id: string): Promise<{
-        members: {
-            id: string;
-            organizationId: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            createdAt: Date;
-            userId: string;
-            teamId?: string | undefined | undefined;
-            user: {
-                id: string;
-                email: string;
-                name: string;
-                image?: string | undefined;
-            };
-        }[];
-        invitations: {
-            id: string;
-            organizationId: string;
-            email: string;
-            role: "org:admin" | "org:member" | "org:reviewer";
-            status: better_auth_plugins.InvitationStatus;
-            inviterId: string;
-            expiresAt: Date;
-            createdAt: Date;
-            teamId?: string | undefined | undefined;
-        }[];
-        teams: {
-            id: string;
-            name: string;
-            organizationId: string;
-            createdAt: Date;
-            updatedAt?: Date | undefined;
-        }[];
-    } & {
-        id: string;
-        name: string;
-        slug: string;
-        createdAt: Date;
-        logo?: string | null | undefined | undefined;
-        metadata?: any;
-    }>;
+    getOrganization(id: string): Promise<any>;
     /**
      * Lists all organizations accessible to the current user.
      *
@@ -5026,63 +3395,13 @@ declare class OrganizationService {
      * @param options.offset - Number of members to skip
      * @returns An array of organization members
      */
-    listMembers(options?: ListMembersOptions): Promise<({
-        id: string;
-        organizationId: string;
-        role: "org:admin" | "org:member" | "org:reviewer";
-        createdAt: Date;
-        userId: string;
-        teamId?: string | undefined | undefined;
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            image?: string | undefined;
-        };
-    } & {
-        user: {
-            id: string;
-            name: string;
-            email: string;
-            image: string | null | undefined;
-        };
-    })[]>;
+    listMembers(options?: ListMembersOptions): Promise<any>;
     /**
      * Gets the currently active organization member for the authenticated user.
      *
      * @returns The active member object
      */
-    getActiveMember(): Promise<NonNullable<Omit<{
-        id: string;
-        organizationId: string;
-        role: "org:admin" | "org:member" | "org:reviewer";
-        createdAt: Date;
-        userId: string;
-        teamId?: string | undefined | undefined;
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            image?: string | undefined;
-        };
-    } & {
-        user: {
-            id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            email: string;
-            emailVerified: boolean;
-            name: string;
-            image?: string | null | undefined;
-        };
-    }, "user"> & {
-        user: {
-            id: string;
-            name: string;
-            email: string;
-            image: string | undefined;
-        };
-    }>>;
+    getActiveMember(): Promise<any>;
     /**
      * Invites a user to join the active organization.
      *
@@ -5096,27 +3415,7 @@ declare class OrganizationService {
      * @param options.resend - Whether to resend if invitation already exists
      * @returns The created invitation
      */
-    inviteUserToOrganization({ userEmail, role, teamId, resend }: InviteUserToOrganizationOptions): Promise<NonNullable<{
-        id: string;
-        organizationId: string;
-        email: string;
-        role: "org:admin" | "org:member" | "org:reviewer";
-        status: better_auth_plugins.InvitationStatus;
-        inviterId: string;
-        expiresAt: Date;
-        createdAt: Date;
-        teamId?: string | undefined | undefined;
-    } | {
-        id: string;
-        organizationId: string;
-        email: string;
-        role: "org:admin" | "org:member" | "org:reviewer";
-        status: better_auth_plugins.InvitationStatus;
-        inviterId: string;
-        expiresAt: Date;
-        createdAt: Date;
-        teamId?: string | undefined | undefined;
-    }>>;
+    inviteUserToOrganization({ userEmail, role, teamId, resend }: InviteUserToOrganizationOptions): Promise<any>;
     /**
      * Cancels a pending organization invitation.
      *
@@ -5153,13 +3452,7 @@ declare class OrganizationService {
      * @param payload - Team configuration with a `name` field
      * @returns The created team
      */
-    createTeam(payload: CreateTeamPayload): Promise<{
-        id: string;
-        name: string;
-        organizationId: string;
-        createdAt: Date;
-        updatedAt?: Date | undefined;
-    }>;
+    createTeam(payload: CreateTeamPayload): Promise<any>;
     /**
      * Updates an existing team's details.
      *
@@ -5167,13 +3460,7 @@ declare class OrganizationService {
      * @param payload - Team fields to update (currently supports `name`)
      * @returns The updated team
      */
-    updateTeam(id: string, payload: UpdateTeamPayload): Promise<{
-        id: string;
-        name: string;
-        organizationId: string;
-        createdAt: Date;
-        updatedAt?: Date | undefined;
-    }>;
+    updateTeam(id: string, payload: UpdateTeamPayload): Promise<any>;
     /**
      * Deletes a team from the active organization.
      *
@@ -5185,25 +3472,14 @@ declare class OrganizationService {
      *
      * @returns An array of teams
      */
-    listTeams(): Promise<{
-        id: string;
-        name: string;
-        organizationId: string;
-        createdAt: Date;
-        updatedAt?: Date | undefined;
-    }[]>;
+    listTeams(): Promise<any>;
     /**
      * Lists all members of a specific team.
      *
      * @param id - The team ID
      * @returns An array of team members
      */
-    listTeamMembers(id: string): Promise<{
-        id: string;
-        teamId: string;
-        userId: string;
-        createdAt: Date;
-    }[]>;
+    listTeamMembers(id: string): Promise<any>;
     /**
      * Adds a user to a team.
      *
@@ -5211,12 +3487,7 @@ declare class OrganizationService {
      * @param userId - The user ID to add
      * @returns The added team member
      */
-    addTeamMember(teamId: string, userId: string): Promise<{
-        id: string;
-        teamId: string;
-        userId: string;
-        createdAt: Date;
-    }>;
+    addTeamMember(teamId: string, userId: string): Promise<any>;
     /**
      * Removes a user from a team.
      *
@@ -5322,9 +3593,7 @@ declare class SessionService {
      *
      * @returns The JWT token
      */
-    getToken(): Promise<{
-        token: string;
-    }>;
+    getToken(): Promise<any>;
     /**
      * Initiates social authentication flow with Google or Microsoft.
      *
@@ -5384,9 +3653,7 @@ declare class SessionService {
      * @param nonce - The nonce to retrieve the token for
      * @returns The JWT token for the nonce
      */
-    getNoncePayload(nonce: string): Promise<{
-        token: string;
-    }>;
+    getNoncePayload(nonce: string): Promise<any>;
 }
 
 /**
@@ -5449,9 +3716,60 @@ declare class ApiKeyService {
      *
      * @param id - The API key ID to delete
      */
-    deleteApiKey(id: string): Promise<{
-        success: boolean;
-    }>;
+    deleteApiKey(id: string): Promise<any>;
+}
+
+/**
+ * Options for requesting an email OTP.
+ */
+type SendVerificationOTPOptions = {
+    /**
+     * Application ID used to scope the OTP request to an application's
+     * configured sign-in policy.
+     */
+    applicationId: string;
+};
+/**
+ * Options for completing email OTP sign-in.
+ */
+type EmailOTPSignInOptions = {
+    /**
+     * Application ID used to scope the OTP sign-in to an application's
+     * configured sign-in policy.
+     */
+    applicationId: string;
+};
+/**
+ * Service for email OTP authentication operations.
+ *
+ * Provides helpers for sending one-time passcodes used by passwordless
+ * sign-in flows.
+ */
+declare class EmailOTPService {
+    private client;
+    /**
+     * Creates a new EmailOTPService instance.
+     *
+     * @param client - The API client for making email OTP requests
+     */
+    constructor(client: APIClient);
+    /**
+     * Sends a sign-in verification OTP to an email address.
+     *
+     * @param email - Email address that should receive the OTP
+     * @param options - Request configuration
+     * @returns The underlying email OTP API response
+     */
+    sendVerificationOTP(email: string, options: SendVerificationOTPOptions): Promise<any>;
+    /**
+     * Completes email OTP sign-in with a one-time passcode.
+     *
+     * @param email - Email address that received the OTP
+     * @param otp - One-time passcode from the sign-in email
+     * @param options - Request configuration
+     * @returns The underlying email OTP sign-in API response
+     */
+    signIn(email: string, otp: string, options: EmailOTPSignInOptions): Promise<any>;
 }
 
 /**
@@ -5479,7 +3797,7 @@ declare class EmailRequired extends BaseError {
 /**
  * Main authentication client for interacting with the Auth API.
  *
- * Provides access to session management and organization management services.
+ * Provides access to session, organization, application, API key, and email OTP services.
  *
  * @example
  * ```typescript
@@ -5497,6 +3815,11 @@ declare class EmailRequired extends BaseError {
  * ```
  */
 declare class AuthClient {
+    /**
+     * Configured Better Auth client used by the public service wrappers.
+     *
+     * @internal
+     */
     private client;
     /**
      * Session management service for authentication operations
@@ -5514,6 +3837,18 @@ declare class AuthClient {
      * API key management service for API key operations
      */
     apiKey: ApiKeyService;
+    /**
+     * Email OTP service for passwordless sign-in operations
+     */
+    emailOtp: EmailOTPService;
+    /**
+     * Session assurance service for step-up operations
+     */
+    sessionAssurance: SessionAssuranceService;
+    /**
+     * Admin service for global admin operations
+     */
+    admin: AdminService;
     /**
      * Creates a new AuthClient instance.
      *
@@ -5523,6 +3858,9 @@ declare class AuthClient {
     constructor(apiUrl: string, fetchOptions?: BetterFetchOption);
 }
 
+type DecodedJWTPayload = Omit<JWTPayload, 'assurance'> & {
+    assurance?: JWTPayloadAssurance;
+};
 /**
  * Checks if a JWT token has expired or will expire within a specified time window.
  *
@@ -5582,7 +3920,7 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  * console.log(payload.exp) // expiration timestamp
  * ```
  */
-declare function extractTokenPayload(token: string): JWTPayload;
+declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { ApiKeyMetadata, ApplicationError, AuthClient, AuthorizationFlowError, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadUser, JWTPayloadWorkspace, RefreshTokenExpiredError, Roles, UserNotLoggedInError, ac, createAPIClient, extractTokenPayload, invitationAdditionalFields, isTokenExpired, memberAdditionalFields, organizationAdditionalFields, rolesAccessControl, userAdditionalFields, validateToken };
-export type { APIClient, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, BaseOrganization, CompleteAuthorizationFlowResponse, CreateApiKeyPayload, CreateTeamPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, FullOrganization, Invitation, InviteUserToOrganizationOptions, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, Session, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminOrganizationOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };