@meistrari/auth-core 1.28.1 → 1.29.0

package/dist/index.d.mts

@@ -14,11 +14,11 @@ declare const AALBrand: unique symbol;
 declare const ACRBrand: unique symbol;
 declare const AuthMethodBrand: unique symbol;
 declare const AMRs: {
-    readonly Pwd: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
-    readonly Otp: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
-    readonly Oauth: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
-    readonly Sso: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
-    readonly Saml: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
 };
 declare const AALs: {
     readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
@@ -29,11 +29,11 @@ declare const ACRs: {
     readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
 };
 declare const AuthMethods: {
-    readonly Password: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly EmailOTP: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly OAuth: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly SAML: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly Unknown: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly Password: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly EmailOTP: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly OAuth: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly SAML: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly Unknown: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
 };
 declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
     readonly Pwd: "pwd";
@@ -390,8 +390,16 @@ type SessionAssurancePolicy = {
 };
 declare const SessionAssurancePolicy: z.ZodType<SessionAssurancePolicy>;
 declare const SENSITIVE_ACTION_ASSURANCE_POLICY: SessionAssurancePolicy;
+/**
+ * Maximum age of an elevated (stepped-up) assurance, in seconds. Enforced by
+ * `isAssuranceSufficientForPolicy` for any policy that requires AAL2 or higher,
+ * so a one-time step-up cannot satisfy a sensitive-action policy indefinitely.
+ * Baseline AAL1 policies impose no freshness requirement, so ordinary sessions
+ * and their token refreshes are unaffected.
+ */
+declare const STEP_UP_MAX_AGE_SECONDS: number;
 declare function getAalRank(aal: JWTPayload['assurance']['aal']): number;
-declare function isAssuranceSufficientForPolicy(assurance: JWTPayload['assurance'] | null | undefined, policy: SessionAssurancePolicy): boolean;
+declare function isAssuranceSufficientForPolicy(assurance: JWTPayload['assurance'] | null | undefined, policy: SessionAssurancePolicy, now?: Date): boolean;
 declare function canStepUpWithAmr(assurance: JWTPayload['assurance'], amr: AMR): boolean;
 declare function mergeStepUpAssurance(assurance: JWTPayload['assurance'], amr: AMR, now?: Date): JWTPayload['assurance'];
 
@@ -4394,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 } & {
     applications: {
         getApplicationAuthContext: (applicationId: string) => Promise<{
+            data: ApplicationAuthContextResponse;
+            error: null;
+        } | {
             data: null;
             error: {
                 message?: string | undefined;
                 status: number;
                 statusText: string;
             };
-        } | {
-            data: ApplicationAuthContextResponse;
-            error: null;
         }>;
         listCandidateOrganizations: (applicationId: string) => Promise<{
             data: ListCandidateOrganizationsResponse;
@@ -5568,8 +5576,16 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 type APIClient = ReturnType<typeof createAPIClient>;
 /** An authenticated user. */
 type User = APIClient['$Infer']['Session']['user'];
-/** A user session containing the user and session metadata. */
-type Session = APIClient['$Infer']['Session'];
+/**
+ * A user session record.
+ *
+ * Breaking change in 1.12: this was previously the full `{ user, session }`
+ * response object, even though runtime session state only ever held the
+ * inner record. Use {@link SessionData} for the full response shape.
+ */
+type Session = APIClient['$Infer']['Session']['session'];
+/** A full session response containing the user and the session record. */
+type SessionData = APIClient['$Infer']['Session'];
 /** An organization the user belongs to. */
 type BaseOrganization = Strict<APIClient['$Infer']['Organization']>;
 /** A team within an organization. */
@@ -5641,29 +5657,39 @@ type TeamMember = {
 };
 
 /**
- * Options accepted when listing users through the Better Auth admin plugin.
+ * Options accepted when listing users as a global admin.
  */
 type ListAdminUsersOptions = {
-    /** Maximum number of users to return. */
+    /** Maximum number of users to return. Defaults to 50. */
     limit?: number;
-    /** Number of users to skip. */
+    /** Number of users to skip. Defaults to 0. */
     offset?: number;
-    /** Free-text search value. */
-    searchValue?: string;
-    /** User field searched by Better Auth. Defaults to email. */
-    searchField?: 'email' | 'name';
-    /** Search comparison operator. Defaults to contains. */
-    searchOperator?: 'contains' | 'starts_with' | 'ends_with';
-    /** Field used to sort the listing. */
-    sortBy?: string;
-    /** Sort direction. */
+    /** Column used to order the listing. Defaults to creation date. */
+    sortBy?: 'createdAt' | 'name';
+    /** Order direction. Defaults to descending. */
     sortDirection?: 'asc' | 'desc';
-    /** User field filtered by Better Auth. Defaults to email. */
-    filterField?: string;
-    /** Filter value. */
-    filterValue?: string | number | boolean | string[] | number[];
-    /** Filter comparison operator. Defaults to eq. */
-    filterOperator?: 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'contains' | 'starts_with' | 'ends_with';
+    /** Free-text search matched against user name, email, and ID. */
+    query?: string;
+    /**
+     * Number of organization previews to include per user (max 10).
+     * When greater than 0, each row also includes the total organization count.
+     * Defaults to 0.
+     */
+    organizationsPreview?: number;
+    /**
+     * When true, invitation-only rows for people invited but not yet registered
+     * are merged into the listing, grouped by email. Defaults to false.
+     */
+    includeInvitations?: boolean;
+};
+/**
+ * Organization preview returned alongside each admin user row.
+ */
+type AdminUserOrganization = {
+    id: string;
+    name: string;
+    logo: string | null;
+    createdAt: string;
 };
 /**
  * Options accepted when listing all organizations as a global admin.
@@ -5767,8 +5793,16 @@ type ListAdminOrganizationMembersOptions = {
     limit?: number;
     /** Number of members to skip. Defaults to 0. */
     offset?: number;
-    /** Free-text search matched against member name, email, role, user ID, and member ID. */
+    /** Case-insensitive name/email match; also matches an exact user ID when a UUID. */
     query?: string;
+    /** Organization role filter, e.g. 'org:admin'. */
+    role?: string;
+    /** Restricts the listing to members belonging to any of these teams. */
+    teamIds?: string[];
+    /** When true, pending invitation rows for the organization are merged into the listing. */
+    includeInvitations?: boolean;
+    /** When true, each row includes the member's teams and accessible applications. */
+    includeAccess?: boolean;
 };
 /**
  * Options accepted when listing teams for a single organization as a global admin.
@@ -5798,6 +5832,66 @@ type CreateAdminOrganizationTeamOptions = {
     /** User IDs of organization members to add to the team. */
     memberIds?: string[];
 };
+/**
+ * Options accepted when updating an organization member's role as a global admin.
+ */
+type UpdateAdminMemberRoleOptions = {
+    /** ID of the membership to update. */
+    memberId: string;
+    /** New organization role for the membership. */
+    role: string;
+};
+/**
+ * Options accepted when removing an organization member as a global admin.
+ */
+type RemoveAdminMemberOptions = {
+    /** ID of the membership to remove. */
+    memberId: string;
+};
+/**
+ * Options accepted when setting a user's effective application role as a global admin.
+ */
+type SetAdminUserApplicationRoleOptions = {
+    /** ID of the user whose application role is being set. */
+    userId: string;
+    /** Organization the entitlement belongs to. */
+    organizationId: string;
+    /** Application the entitlement grants access to. */
+    applicationId: string;
+    /** Non-null grants access with the role, null denies access (leave application). Ignored when clear is true. */
+    role?: string | null;
+    /** When true, removes the user's override rule so broader organization rules apply again. */
+    clear?: boolean;
+};
+/**
+ * Options accepted when assigning or clearing a user's team as a global admin.
+ */
+type SetAdminUserTeamOptions = {
+    /** ID of the user whose team membership is being set. */
+    userId: string;
+    /** Organization the teams belong to. */
+    organizationId: string;
+    /** Desired teams within the organization; an empty array clears the user's team memberships. */
+    teamIds: string[];
+};
+/**
+ * Team row returned by the admin organization team listing endpoint.
+ */
+type AdminOrganizationTeam = {
+    id: string;
+    name: string;
+};
+/**
+ * Organization membership row returned by the admin member mutation endpoints.
+ */
+type AdminMember = {
+    id: string;
+    organizationId: string;
+    userId: string;
+    role: string;
+    createdAt: string;
+    deletedAt: string | null;
+};
 /**
  * Options accepted when creating an organization as a global admin.
  */
@@ -5833,7 +5927,36 @@ type UpdateAdminOrganizationOptions = {
     settings?: OrganizationSettings;
 };
 /**
- * User row returned by the Better Auth admin user listing endpoint.
+ * Invitation attached to an invitation row in the admin user listing.
+ */
+type AdminUserInvitation = {
+    id: string;
+    organizationId: string;
+    organizationName: string;
+    organizationLogo: string | null;
+    applicationId: string | null;
+    role: string | null;
+    teamIds: string[];
+    status: 'pending' | 'expired';
+    expiresAt: string;
+    createdAt: string;
+};
+/**
+ * Options accepted when resending an organization invitation as a global admin.
+ */
+type ResendAdminInviteOptions = {
+    organizationId: string;
+    email: string;
+    role: string;
+    applicationId?: string;
+    /**
+     * Teams joined when the re-sent invitation is accepted. Resending replaces the
+     * invitation, so these must be provided to preserve the original team assignments.
+     */
+    teamIds?: string[];
+};
+/**
+ * User row returned by the admin user listing endpoint.
  */
 type AdminUser = {
     id: string;
@@ -5849,15 +5972,25 @@ type AdminUser = {
     banExpires: string | Date | null;
     lastActiveAt?: string | Date | null;
     twoFactorEnabled?: boolean | null;
+    /** Discriminates registered users from invitation-only rows. */
+    type: 'user' | 'invitation';
+    /** Aggregate invitation status. Present on invitation rows. */
+    invitationStatus?: 'pending' | 'expired';
+    /** Pending invitations grouped on this row. Present on invitation rows. */
+    invitations?: AdminUserInvitation[];
+    /** Total number of organizations the user belongs to. Present when requested via organizationsPreview. */
+    organizationCount?: number;
+    /** Preview of the first organizations the user belongs to. Present when requested via organizationsPreview. */
+    organizations?: AdminUserOrganization[];
 };
 /**
- * Paginated Better Auth admin user listing response.
+ * Paginated admin user listing response.
  */
 type ListAdminUsersResult = {
     users: AdminUser[];
     total: number;
-    limit?: number;
-    offset?: number;
+    limit: number;
+    offset: number;
 };
 /**
  * Member preview returned alongside each admin organization row.
@@ -5869,13 +6002,40 @@ type AdminOrganizationMember = {
     image: string | null;
 };
 /**
- * Full organization member row returned by the admin organization member listing endpoint.
+ * Team row attached to an organization member listing row.
  */
-type AdminOrganizationMemberRecord = AdminOrganizationMember & {
-    memberId: string;
+type AdminOrganizationMemberTeam = {
+    id: string;
+    name: string;
+};
+/**
+ * Application row attached to an organization member listing row.
+ */
+type AdminOrganizationMemberApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+};
+/**
+ * Row returned by the admin organization member listing endpoint. Members and
+ * pending invitations share this shape, discriminated by type.
+ */
+type AdminOrganizationMemberRecord = {
+    type: 'member' | 'invitation';
+    id: string;
+    memberId: string | null;
     organizationId: string;
-    role: string;
+    name: string | null;
+    email: string;
+    image: string | null;
+    role: string | null;
+    lastActiveAt: string | null;
     createdAt: string;
+    invitationId?: string;
+    invitationStatus?: 'pending' | 'expired';
+    expiresAt?: string;
+    teams?: AdminOrganizationMemberTeam[];
+    applications?: AdminOrganizationMemberApplication[];
 };
 /**
  * Paginated organization member listing response.
@@ -5906,6 +6066,41 @@ type ListAdminOrganizationTeamsResult = {
     limit: number;
     offset: number;
 };
+/**
+ * Application row in an admin user access report.
+ */
+type AdminUserAccessApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+    /** Effective role from entitlement rule evaluation. Null when the first matching rule denies access or no rule matches. */
+    role: string | null;
+};
+/**
+ * Team row in an admin user access report.
+ */
+type AdminUserAccessTeam = {
+    id: string;
+    name: string;
+};
+/**
+ * Organization row in an admin user access report.
+ */
+type AdminUserAccessOrganization = {
+    id: string;
+    name: string;
+    logo: string | null;
+    memberId: string;
+    role: string;
+    teams: AdminUserAccessTeam[];
+    applications: AdminUserAccessApplication[];
+};
+/**
+ * Access report returned by the admin user access endpoint.
+ */
+type AdminUserAccess = {
+    organizations: AdminUserAccessOrganization[];
+};
 /**
  * Organization row embedded in an admin application entitlement.
  */
@@ -6023,6 +6218,27 @@ type ListAdminOrganizationsResult = {
     limit: number;
     offset: number;
 };
+/**
+ * Options accepted when inviting several users to an organization as a global admin.
+ */
+type InviteAdminOrganizationUsersOptions = {
+    organizationId: string;
+    emails: string[];
+    role: string;
+    /** Teams joined when each invitation is accepted. */
+    teamIds?: string[];
+    applicationId?: string;
+};
+/**
+ * Per-email outcome of a batch organization invite.
+ */
+type InviteAdminOrganizationUsersResult = {
+    results: {
+        email: string;
+        status: 'invited' | 'added' | 'error';
+        message?: string;
+    }[];
+};
 
 /**
  * Service for global admin operations.
@@ -6045,20 +6261,21 @@ declare class AdminService {
      * @returns The paginated organization listing
      */
     listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
-        data: ListAdminOrganizationsResult;
-        error: null;
-    } | {
         data: null;
         error: {
             message?: string | undefined;
             status: number;
             statusText: string;
         };
+    } | {
+        data: ListAdminOrganizationsResult;
+        error: null;
     }>;
     /**
-     * Lists all Better Auth users from the user table.
+     * Lists users as a global admin, optionally with organization previews
+     * and totals when a preview size is requested.
      *
-     * @param options - Pagination, search, filter, and ordering options
+     * @param options - Pagination, ordering, search, and preview options
      * @returns The paginated user listing
      */
     listUsers(options?: ListAdminUsersOptions): Promise<{
@@ -6082,6 +6299,17 @@ declare class AdminService {
     getOrganization(options: GetAdminOrganizationOptions): Promise<{
         data: AdminOrganization;
     } | null>;
+    /**
+     * Fetches the per-organization access report for a single user: their
+     * organizations with role, membership ID, and teams, plus each
+     * organization's entitled applications with the user's effective role.
+     *
+     * @param userId - The ID of the user to fetch access for
+     * @returns The user access report
+     */
+    getUserAccess(userId: string): Promise<{
+        data: AdminUserAccess;
+    } | null>;
     /**
      * Lists active members for one organization as a global admin.
      *
@@ -6143,11 +6371,73 @@ declare class AdminService {
     updateOrganization(options: UpdateAdminOrganizationOptions): Promise<{
         data: AdminOrganization;
     } | null>;
+    /**
+     * Updates an organization member's role.
+     *
+     * @param options - Membership ID and the new role
+     * @returns The updated membership
+     */
+    updateMemberRole(options: UpdateAdminMemberRoleOptions): Promise<{
+        data: AdminMember;
+    } | null>;
+    /**
+     * Removes an organization member.
+     *
+     * @param options - Membership ID to remove
+     * @returns The removed membership
+     */
+    removeMember(options: RemoveAdminMemberOptions): Promise<{
+        data: AdminMember;
+    } | null>;
+    /**
+     * Sets a user's effective application role within an organization. A
+     * non-null role grants access, a null role denies access (leave
+     * application), and clear removes the user-specific override.
+     *
+     * @param options - User, organization, application, and the role or clear flag
+     */
+    setUserApplicationRole(options: SetAdminUserApplicationRoleOptions): Promise<void>;
+    /**
+     * Reconciles a user's team memberships within an organization to a given set.
+     *
+     * @param options - User, organization, and the desired teams (empty to clear)
+     */
+    setUserTeam(options: SetAdminUserTeamOptions): Promise<void>;
     /**
      * Bans a user from the auth system and invalidates all their sessions.
      * @param userId - The ID of the user to ban
      */
     banUser(userId: string): Promise<void>;
+    /**
+     * Lifts a user's ban.
+     * @param userId - The ID of the user to unban
+     */
+    unbanUser(userId: string): Promise<void>;
+    /**
+     * Permanently removes a user from the auth system.
+     * @param userId - The ID of the user to remove
+     */
+    removeUser(userId: string): Promise<void>;
+    /**
+     * Cancels a pending invitation as a global admin.
+     * @param invitationId - The ID of the invitation to cancel
+     */
+    cancelInvite(invitationId: string): Promise<void>;
+    /**
+     * Re-sends an organization invitation email as a global admin.
+     * @param options - Organization, email, role, and optional application and teams
+     */
+    resendInvite(options: ResendAdminInviteOptions): Promise<void>;
+    /**
+     * Invites several users to an organization in one call. Failures are
+     * isolated per email in the results payload.
+     *
+     * @param options - Organization, emails, role, and optional teams/application
+     * @returns Per-email invite outcomes
+     */
+    inviteOrganizationUsers(options: InviteAdminOrganizationUsersOptions): Promise<{
+        data: InviteAdminOrganizationUsersResult;
+    } | null>;
 }
 
 /**
@@ -7075,5 +7365,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminOrganizationTeamRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };