@meistrari/auth-core 1.22.0 → 1.23.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/index.d.mts +94 -11
  2. package/dist/index.d.ts +94 -11
  3. package/dist/index.mjs +1 -1
  4. package/package.json +1 -1
package/dist/index.d.mts CHANGED
@@ -13,11 +13,11 @@ declare const AALBrand: unique symbol;
13
13
  declare const ACRBrand: unique symbol;
14
14
  declare const AuthMethodBrand: unique symbol;
15
15
  declare const AMRs: {
16
- readonly Pwd: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
17
- readonly Otp: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
18
- readonly Oauth: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
19
- readonly Sso: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
20
- readonly Saml: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
16
+ readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
17
+ readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
18
+ readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
19
+ readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
20
+ readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
21
21
  };
22
22
  declare const AALs: {
23
23
  readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
@@ -28,11 +28,11 @@ declare const ACRs: {
28
28
  readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
29
29
  };
30
30
  declare const AuthMethods: {
31
- readonly Password: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
32
- readonly EmailOTP: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
33
- readonly OAuth: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
34
- readonly SAML: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
35
- readonly Unknown: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
31
+ readonly Password: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
32
+ readonly EmailOTP: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
33
+ readonly OAuth: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
34
+ readonly SAML: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
35
+ readonly Unknown: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
36
36
  };
37
37
  declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
38
38
  readonly Pwd: "pwd";
@@ -3017,6 +3017,29 @@ type ListAdminOrganizationsOptions = {
3017
3017
  */
3018
3018
  applicationsPreview?: number;
3019
3019
  };
3020
+ /**
3021
+ * Options accepted when listing applications as a global admin.
3022
+ */
3023
+ type ListAdminApplicationsOptions = {
3024
+ /** Maximum number of applications to return. Defaults to 50. */
3025
+ limit?: number;
3026
+ /**
3027
+ * Number of member previews to include per application (max 10).
3028
+ * When greater than 0, each row also includes the total member count.
3029
+ * Defaults to 0 (no members or member count returned).
3030
+ */
3031
+ membersPreview?: number;
3032
+ /** Number of applications to skip. Defaults to 0. */
3033
+ offset?: number;
3034
+ /** Column used to order the listing. Defaults to creation date. */
3035
+ orderBy?: 'createdAt' | 'updatedAt' | 'name';
3036
+ /** Order direction. Defaults to descending. */
3037
+ orderDirection?: 'asc' | 'desc';
3038
+ /** When provided, only applications enabled for this organization are returned. */
3039
+ organizationId?: string;
3040
+ /** Free-text search matched against application name, description, and UUIDs. */
3041
+ search?: string;
3042
+ };
3020
3043
  /**
3021
3044
  * Options accepted when fetching a single organization as a global admin.
3022
3045
  */
@@ -3132,6 +3155,66 @@ type ListAdminOrganizationMembersResult = {
3132
3155
  limit: number;
3133
3156
  offset: number;
3134
3157
  };
3158
+ /**
3159
+ * Organization row embedded in an admin application entitlement.
3160
+ */
3161
+ type AdminApplicationOrganization = {
3162
+ id: string;
3163
+ title: string;
3164
+ slug: string | null;
3165
+ avatarUrl: string | null;
3166
+ createdAt: string;
3167
+ metadata: string | null;
3168
+ settings: OrganizationSettings | null;
3169
+ };
3170
+ /**
3171
+ * Entitlement returned alongside each admin application row.
3172
+ */
3173
+ type AdminApplicationEntitlement = {
3174
+ id: string;
3175
+ applicationId: string;
3176
+ organizationId: string;
3177
+ enabled: boolean;
3178
+ createdAt: string;
3179
+ updatedAt: string;
3180
+ createdBy: string;
3181
+ updatedBy: string;
3182
+ organization: AdminApplicationOrganization | null;
3183
+ };
3184
+ /**
3185
+ * Member preview returned alongside each admin application row.
3186
+ */
3187
+ type AdminApplicationMember = {
3188
+ id: string;
3189
+ name: string;
3190
+ email: string;
3191
+ image: string | null;
3192
+ };
3193
+ /**
3194
+ * Application row returned by the admin application listing endpoint.
3195
+ */
3196
+ type AdminApplication = {
3197
+ id: string;
3198
+ name: string;
3199
+ description: string | null;
3200
+ imageUrl: string | null;
3201
+ redirectUris: string[];
3202
+ homeUrl: string | null;
3203
+ config: ApplicationConfig | null;
3204
+ createdBy: string;
3205
+ updatedBy: string;
3206
+ createdAt: string;
3207
+ updatedAt: string;
3208
+ entitlements: AdminApplicationEntitlement[];
3209
+ /** Total number of users with application access. Present when requested via membersPreview. */
3210
+ memberCount?: number;
3211
+ /** Preview of the first users with application access. Present when requested via membersPreview. */
3212
+ members?: AdminApplicationMember[];
3213
+ };
3214
+ /**
3215
+ * Admin application listing response.
3216
+ */
3217
+ type ListAdminApplicationsResult = AdminApplication[];
3135
3218
  /**
3136
3219
  * Application preview returned alongside each admin organization row.
3137
3220
  */
@@ -3923,4 +4006,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
3923
4006
  declare function extractTokenPayload(token: string): DecodedJWTPayload;
3924
4007
 
3925
4008
  export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
3926
- export type { APIClient, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminOrganizationOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
4009
+ export type { APIClient, AdminApplication, AdminApplicationEntitlement, AdminApplicationMember, AdminApplicationOrganization, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminOrganizationOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
package/dist/index.d.ts CHANGED
@@ -13,11 +13,11 @@ declare const AALBrand: unique symbol;
13
13
  declare const ACRBrand: unique symbol;
14
14
  declare const AuthMethodBrand: unique symbol;
15
15
  declare const AMRs: {
16
- readonly Pwd: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
17
- readonly Otp: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
18
- readonly Oauth: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
19
- readonly Sso: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
20
- readonly Saml: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
16
+ readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
17
+ readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
18
+ readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
19
+ readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
20
+ readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
21
21
  };
22
22
  declare const AALs: {
23
23
  readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
@@ -28,11 +28,11 @@ declare const ACRs: {
28
28
  readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
29
29
  };
30
30
  declare const AuthMethods: {
31
- readonly Password: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
32
- readonly EmailOTP: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
33
- readonly OAuth: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
34
- readonly SAML: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
35
- readonly Unknown: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
31
+ readonly Password: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
32
+ readonly EmailOTP: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
33
+ readonly OAuth: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
34
+ readonly SAML: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
35
+ readonly Unknown: ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
36
36
  };
37
37
  declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
38
38
  readonly Pwd: "pwd";
@@ -3017,6 +3017,29 @@ type ListAdminOrganizationsOptions = {
3017
3017
  */
3018
3018
  applicationsPreview?: number;
3019
3019
  };
3020
+ /**
3021
+ * Options accepted when listing applications as a global admin.
3022
+ */
3023
+ type ListAdminApplicationsOptions = {
3024
+ /** Maximum number of applications to return. Defaults to 50. */
3025
+ limit?: number;
3026
+ /**
3027
+ * Number of member previews to include per application (max 10).
3028
+ * When greater than 0, each row also includes the total member count.
3029
+ * Defaults to 0 (no members or member count returned).
3030
+ */
3031
+ membersPreview?: number;
3032
+ /** Number of applications to skip. Defaults to 0. */
3033
+ offset?: number;
3034
+ /** Column used to order the listing. Defaults to creation date. */
3035
+ orderBy?: 'createdAt' | 'updatedAt' | 'name';
3036
+ /** Order direction. Defaults to descending. */
3037
+ orderDirection?: 'asc' | 'desc';
3038
+ /** When provided, only applications enabled for this organization are returned. */
3039
+ organizationId?: string;
3040
+ /** Free-text search matched against application name, description, and UUIDs. */
3041
+ search?: string;
3042
+ };
3020
3043
  /**
3021
3044
  * Options accepted when fetching a single organization as a global admin.
3022
3045
  */
@@ -3132,6 +3155,66 @@ type ListAdminOrganizationMembersResult = {
3132
3155
  limit: number;
3133
3156
  offset: number;
3134
3157
  };
3158
+ /**
3159
+ * Organization row embedded in an admin application entitlement.
3160
+ */
3161
+ type AdminApplicationOrganization = {
3162
+ id: string;
3163
+ title: string;
3164
+ slug: string | null;
3165
+ avatarUrl: string | null;
3166
+ createdAt: string;
3167
+ metadata: string | null;
3168
+ settings: OrganizationSettings | null;
3169
+ };
3170
+ /**
3171
+ * Entitlement returned alongside each admin application row.
3172
+ */
3173
+ type AdminApplicationEntitlement = {
3174
+ id: string;
3175
+ applicationId: string;
3176
+ organizationId: string;
3177
+ enabled: boolean;
3178
+ createdAt: string;
3179
+ updatedAt: string;
3180
+ createdBy: string;
3181
+ updatedBy: string;
3182
+ organization: AdminApplicationOrganization | null;
3183
+ };
3184
+ /**
3185
+ * Member preview returned alongside each admin application row.
3186
+ */
3187
+ type AdminApplicationMember = {
3188
+ id: string;
3189
+ name: string;
3190
+ email: string;
3191
+ image: string | null;
3192
+ };
3193
+ /**
3194
+ * Application row returned by the admin application listing endpoint.
3195
+ */
3196
+ type AdminApplication = {
3197
+ id: string;
3198
+ name: string;
3199
+ description: string | null;
3200
+ imageUrl: string | null;
3201
+ redirectUris: string[];
3202
+ homeUrl: string | null;
3203
+ config: ApplicationConfig | null;
3204
+ createdBy: string;
3205
+ updatedBy: string;
3206
+ createdAt: string;
3207
+ updatedAt: string;
3208
+ entitlements: AdminApplicationEntitlement[];
3209
+ /** Total number of users with application access. Present when requested via membersPreview. */
3210
+ memberCount?: number;
3211
+ /** Preview of the first users with application access. Present when requested via membersPreview. */
3212
+ members?: AdminApplicationMember[];
3213
+ };
3214
+ /**
3215
+ * Admin application listing response.
3216
+ */
3217
+ type ListAdminApplicationsResult = AdminApplication[];
3135
3218
  /**
3136
3219
  * Application preview returned alongside each admin organization row.
3137
3220
  */
@@ -3923,4 +4006,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
3923
4006
  declare function extractTokenPayload(token: string): DecodedJWTPayload;
3924
4007
 
3925
4008
  export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
3926
- export type { APIClient, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminOrganizationOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
4009
+ export type { APIClient, AdminApplication, AdminApplicationEntitlement, AdminApplicationMember, AdminApplicationOrganization, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminOrganizationOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
package/dist/index.mjs CHANGED
@@ -8,7 +8,7 @@ import { defaultStatements } from 'better-auth/plugins/organization/access';
8
8
  import z, { z as z$1 } from 'zod';
9
9
  export { APIError } from 'better-auth';
10
10
 
11
- const version = "1.22.0";
11
+ const version = "1.23.0";
12
12
 
13
13
  function parsedEnumValues(schema) {
14
14
  return Object.fromEntries(
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@meistrari/auth-core",
3
- "version": "1.22.0",
3
+ "version": "1.23.0",
4
4
  "type": "module",
5
5
  "exports": {
6
6
  ".": {