@meistrari/auth-core 1.28.2 → 1.30.0

package/dist/index.d.mts

@@ -4402,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 } & {
     applications: {
         getApplicationAuthContext: (applicationId: string) => Promise<{
-            data: ApplicationAuthContextResponse;
-            error: null;
-        } | {
             data: null;
             error: {
                 message?: string | undefined;
                 status: number;
                 statusText: string;
             };
+        } | {
+            data: ApplicationAuthContextResponse;
+            error: null;
         }>;
         listCandidateOrganizations: (applicationId: string) => Promise<{
             data: ListCandidateOrganizationsResponse;
@@ -5576,8 +5576,16 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 type APIClient = ReturnType<typeof createAPIClient>;
 /** An authenticated user. */
 type User = APIClient['$Infer']['Session']['user'];
-/** A user session containing the user and session metadata. */
-type Session = APIClient['$Infer']['Session'];
+/**
+ * A user session record.
+ *
+ * Breaking change in 1.12: this was previously the full `{ user, session }`
+ * response object, even though runtime session state only ever held the
+ * inner record. Use {@link SessionData} for the full response shape.
+ */
+type Session = APIClient['$Infer']['Session']['session'];
+/** A full session response containing the user and the session record. */
+type SessionData = APIClient['$Infer']['Session'];
 /** An organization the user belongs to. */
 type BaseOrganization = Strict<APIClient['$Infer']['Organization']>;
 /** A team within an organization. */
@@ -5649,29 +5657,39 @@ type TeamMember = {
 };
 
 /**
- * Options accepted when listing users through the Better Auth admin plugin.
+ * Options accepted when listing users as a global admin.
  */
 type ListAdminUsersOptions = {
-    /** Maximum number of users to return. */
+    /** Maximum number of users to return. Defaults to 50. */
     limit?: number;
-    /** Number of users to skip. */
+    /** Number of users to skip. Defaults to 0. */
     offset?: number;
-    /** Free-text search value. */
-    searchValue?: string;
-    /** User field searched by Better Auth. Defaults to email. */
-    searchField?: 'email' | 'name';
-    /** Search comparison operator. Defaults to contains. */
-    searchOperator?: 'contains' | 'starts_with' | 'ends_with';
-    /** Field used to sort the listing. */
-    sortBy?: string;
-    /** Sort direction. */
+    /** Column used to order the listing. Defaults to creation date. */
+    sortBy?: 'createdAt' | 'name';
+    /** Order direction. Defaults to descending. */
     sortDirection?: 'asc' | 'desc';
-    /** User field filtered by Better Auth. Defaults to email. */
-    filterField?: string;
-    /** Filter value. */
-    filterValue?: string | number | boolean | string[] | number[];
-    /** Filter comparison operator. Defaults to eq. */
-    filterOperator?: 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'contains' | 'starts_with' | 'ends_with';
+    /** Free-text search matched against user name, email, and ID. */
+    query?: string;
+    /**
+     * Number of organization previews to include per user (max 10).
+     * When greater than 0, each row also includes the total organization count.
+     * Defaults to 0.
+     */
+    organizationsPreview?: number;
+    /**
+     * When true, invitation-only rows for people invited but not yet registered
+     * are merged into the listing, grouped by email. Defaults to false.
+     */
+    includeInvitations?: boolean;
+};
+/**
+ * Organization preview returned alongside each admin user row.
+ */
+type AdminUserOrganization = {
+    id: string;
+    name: string;
+    logo: string | null;
+    createdAt: string;
 };
 /**
  * Options accepted when listing all organizations as a global admin.
@@ -5775,8 +5793,16 @@ type ListAdminOrganizationMembersOptions = {
     limit?: number;
     /** Number of members to skip. Defaults to 0. */
     offset?: number;
-    /** Free-text search matched against member name, email, role, user ID, and member ID. */
+    /** Case-insensitive name/email match; also matches an exact user ID when a UUID. */
     query?: string;
+    /** Organization role filter, e.g. 'org:admin'. */
+    role?: string;
+    /** Restricts the listing to members belonging to any of these teams. */
+    teamIds?: string[];
+    /** When true, pending invitation rows for the organization are merged into the listing. */
+    includeInvitations?: boolean;
+    /** When true, each row includes the member's teams and accessible applications. */
+    includeAccess?: boolean;
 };
 /**
  * Options accepted when listing teams for a single organization as a global admin.
@@ -5806,6 +5832,66 @@ type CreateAdminOrganizationTeamOptions = {
     /** User IDs of organization members to add to the team. */
     memberIds?: string[];
 };
+/**
+ * Options accepted when updating an organization member's role as a global admin.
+ */
+type UpdateAdminMemberRoleOptions = {
+    /** ID of the membership to update. */
+    memberId: string;
+    /** New organization role for the membership. */
+    role: string;
+};
+/**
+ * Options accepted when removing an organization member as a global admin.
+ */
+type RemoveAdminMemberOptions = {
+    /** ID of the membership to remove. */
+    memberId: string;
+};
+/**
+ * Options accepted when setting a user's effective application role as a global admin.
+ */
+type SetAdminUserApplicationRoleOptions = {
+    /** ID of the user whose application role is being set. */
+    userId: string;
+    /** Organization the entitlement belongs to. */
+    organizationId: string;
+    /** Application the entitlement grants access to. */
+    applicationId: string;
+    /** Non-null grants access with the role, null denies access (leave application). Ignored when clear is true. */
+    role?: string | null;
+    /** When true, removes the user's override rule so broader organization rules apply again. */
+    clear?: boolean;
+};
+/**
+ * Options accepted when assigning or clearing a user's team as a global admin.
+ */
+type SetAdminUserTeamOptions = {
+    /** ID of the user whose team membership is being set. */
+    userId: string;
+    /** Organization the teams belong to. */
+    organizationId: string;
+    /** Desired teams within the organization; an empty array clears the user's team memberships. */
+    teamIds: string[];
+};
+/**
+ * Team row returned by the admin organization team listing endpoint.
+ */
+type AdminOrganizationTeam = {
+    id: string;
+    name: string;
+};
+/**
+ * Organization membership row returned by the admin member mutation endpoints.
+ */
+type AdminMember = {
+    id: string;
+    organizationId: string;
+    userId: string;
+    role: string;
+    createdAt: string;
+    deletedAt: string | null;
+};
 /**
  * Options accepted when creating an organization as a global admin.
  */
@@ -5841,7 +5927,36 @@ type UpdateAdminOrganizationOptions = {
     settings?: OrganizationSettings;
 };
 /**
- * User row returned by the Better Auth admin user listing endpoint.
+ * Invitation attached to an invitation row in the admin user listing.
+ */
+type AdminUserInvitation = {
+    id: string;
+    organizationId: string;
+    organizationName: string;
+    organizationLogo: string | null;
+    applicationId: string | null;
+    role: string | null;
+    teamIds: string[];
+    status: 'pending' | 'expired';
+    expiresAt: string;
+    createdAt: string;
+};
+/**
+ * Options accepted when resending an organization invitation as a global admin.
+ */
+type ResendAdminInviteOptions = {
+    organizationId: string;
+    email: string;
+    role: string;
+    applicationId?: string;
+    /**
+     * Teams joined when the re-sent invitation is accepted. Resending replaces the
+     * invitation, so these must be provided to preserve the original team assignments.
+     */
+    teamIds?: string[];
+};
+/**
+ * User row returned by the admin user listing endpoint.
  */
 type AdminUser = {
     id: string;
@@ -5857,15 +5972,25 @@ type AdminUser = {
     banExpires: string | Date | null;
     lastActiveAt?: string | Date | null;
     twoFactorEnabled?: boolean | null;
+    /** Discriminates registered users from invitation-only rows. */
+    type: 'user' | 'invitation';
+    /** Aggregate invitation status. Present on invitation rows. */
+    invitationStatus?: 'pending' | 'expired';
+    /** Pending invitations grouped on this row. Present on invitation rows. */
+    invitations?: AdminUserInvitation[];
+    /** Total number of organizations the user belongs to. Present when requested via organizationsPreview. */
+    organizationCount?: number;
+    /** Preview of the first organizations the user belongs to. Present when requested via organizationsPreview. */
+    organizations?: AdminUserOrganization[];
 };
 /**
- * Paginated Better Auth admin user listing response.
+ * Paginated admin user listing response.
  */
 type ListAdminUsersResult = {
     users: AdminUser[];
     total: number;
-    limit?: number;
-    offset?: number;
+    limit: number;
+    offset: number;
 };
 /**
  * Member preview returned alongside each admin organization row.
@@ -5877,13 +6002,40 @@ type AdminOrganizationMember = {
     image: string | null;
 };
 /**
- * Full organization member row returned by the admin organization member listing endpoint.
+ * Team row attached to an organization member listing row.
  */
-type AdminOrganizationMemberRecord = AdminOrganizationMember & {
-    memberId: string;
+type AdminOrganizationMemberTeam = {
+    id: string;
+    name: string;
+};
+/**
+ * Application row attached to an organization member listing row.
+ */
+type AdminOrganizationMemberApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+};
+/**
+ * Row returned by the admin organization member listing endpoint. Members and
+ * pending invitations share this shape, discriminated by type.
+ */
+type AdminOrganizationMemberRecord = {
+    type: 'member' | 'invitation';
+    id: string;
+    memberId: string | null;
     organizationId: string;
-    role: string;
+    name: string | null;
+    email: string;
+    image: string | null;
+    role: string | null;
+    lastActiveAt: string | null;
     createdAt: string;
+    invitationId?: string;
+    invitationStatus?: 'pending' | 'expired';
+    expiresAt?: string;
+    teams?: AdminOrganizationMemberTeam[];
+    applications?: AdminOrganizationMemberApplication[];
 };
 /**
  * Paginated organization member listing response.
@@ -5914,6 +6066,41 @@ type ListAdminOrganizationTeamsResult = {
     limit: number;
     offset: number;
 };
+/**
+ * Application row in an admin user access report.
+ */
+type AdminUserAccessApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+    /** Effective role from entitlement rule evaluation. Null when the first matching rule denies access or no rule matches. */
+    role: string | null;
+};
+/**
+ * Team row in an admin user access report.
+ */
+type AdminUserAccessTeam = {
+    id: string;
+    name: string;
+};
+/**
+ * Organization row in an admin user access report.
+ */
+type AdminUserAccessOrganization = {
+    id: string;
+    name: string;
+    logo: string | null;
+    memberId: string;
+    role: string;
+    teams: AdminUserAccessTeam[];
+    applications: AdminUserAccessApplication[];
+};
+/**
+ * Access report returned by the admin user access endpoint.
+ */
+type AdminUserAccess = {
+    organizations: AdminUserAccessOrganization[];
+};
 /**
  * Organization row embedded in an admin application entitlement.
  */
@@ -6031,6 +6218,27 @@ type ListAdminOrganizationsResult = {
     limit: number;
     offset: number;
 };
+/**
+ * Options accepted when inviting several users to an organization as a global admin.
+ */
+type InviteAdminOrganizationUsersOptions = {
+    organizationId: string;
+    emails: string[];
+    role: string;
+    /** Teams joined when each invitation is accepted. */
+    teamIds?: string[];
+    applicationId?: string;
+};
+/**
+ * Per-email outcome of a batch organization invite.
+ */
+type InviteAdminOrganizationUsersResult = {
+    results: {
+        email: string;
+        status: 'invited' | 'added' | 'error';
+        message?: string;
+    }[];
+};
 
 /**
  * Service for global admin operations.
@@ -6053,20 +6261,21 @@ declare class AdminService {
      * @returns The paginated organization listing
      */
     listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
+        data: ListAdminOrganizationsResult;
+        error: null;
+    } | {
         data: null;
         error: {
             message?: string | undefined;
             status: number;
             statusText: string;
         };
-    } | {
-        data: ListAdminOrganizationsResult;
-        error: null;
     }>;
     /**
-     * Lists all Better Auth users from the user table.
+     * Lists users as a global admin, optionally with organization previews
+     * and totals when a preview size is requested.
      *
-     * @param options - Pagination, search, filter, and ordering options
+     * @param options - Pagination, ordering, search, and preview options
      * @returns The paginated user listing
      */
     listUsers(options?: ListAdminUsersOptions): Promise<{
@@ -6090,6 +6299,17 @@ declare class AdminService {
     getOrganization(options: GetAdminOrganizationOptions): Promise<{
         data: AdminOrganization;
     } | null>;
+    /**
+     * Fetches the per-organization access report for a single user: their
+     * organizations with role, membership ID, and teams, plus each
+     * organization's entitled applications with the user's effective role.
+     *
+     * @param userId - The ID of the user to fetch access for
+     * @returns The user access report
+     */
+    getUserAccess(userId: string): Promise<{
+        data: AdminUserAccess;
+    } | null>;
     /**
      * Lists active members for one organization as a global admin.
      *
@@ -6151,13 +6371,84 @@ declare class AdminService {
     updateOrganization(options: UpdateAdminOrganizationOptions): Promise<{
         data: AdminOrganization;
     } | null>;
+    /**
+     * Updates an organization member's role.
+     *
+     * @param options - Membership ID and the new role
+     * @returns The updated membership
+     */
+    updateMemberRole(options: UpdateAdminMemberRoleOptions): Promise<{
+        data: AdminMember;
+    } | null>;
+    /**
+     * Removes an organization member.
+     *
+     * @param options - Membership ID to remove
+     * @returns The removed membership
+     */
+    removeMember(options: RemoveAdminMemberOptions): Promise<{
+        data: AdminMember;
+    } | null>;
+    /**
+     * Sets a user's effective application role within an organization. A
+     * non-null role grants access, a null role denies access (leave
+     * application), and clear removes the user-specific override.
+     *
+     * @param options - User, organization, application, and the role or clear flag
+     */
+    setUserApplicationRole(options: SetAdminUserApplicationRoleOptions): Promise<void>;
+    /**
+     * Reconciles a user's team memberships within an organization to a given set.
+     *
+     * @param options - User, organization, and the desired teams (empty to clear)
+     */
+    setUserTeam(options: SetAdminUserTeamOptions): Promise<void>;
     /**
      * Bans a user from the auth system and invalidates all their sessions.
      * @param userId - The ID of the user to ban
      */
     banUser(userId: string): Promise<void>;
+    /**
+     * Lifts a user's ban.
+     * @param userId - The ID of the user to unban
+     */
+    unbanUser(userId: string): Promise<void>;
+    /**
+     * Permanently removes a user from the auth system.
+     * @param userId - The ID of the user to remove
+     */
+    removeUser(userId: string): Promise<void>;
+    /**
+     * Cancels a pending invitation as a global admin.
+     * @param invitationId - The ID of the invitation to cancel
+     */
+    cancelInvite(invitationId: string): Promise<void>;
+    /**
+     * Re-sends an organization invitation email as a global admin.
+     * @param options - Organization, email, role, and optional application and teams
+     */
+    resendInvite(options: ResendAdminInviteOptions): Promise<void>;
+    /**
+     * Invites several users to an organization in one call. Failures are
+     * isolated per email in the results payload.
+     *
+     * @param options - Organization, emails, role, and optional teams/application
+     * @returns Per-email invite outcomes
+     */
+    inviteOrganizationUsers(options: InviteAdminOrganizationUsersOptions): Promise<{
+        data: InviteAdminOrganizationUsersResult;
+    } | null>;
 }
 
+/**
+ * Result of accepting an organization invitation.
+ */
+type AcceptInvitationResult = {
+    /** Application home URL for application-scoped invitations, otherwise `null`. */
+    homeUrl: string | null;
+    /** The accepted organization membership. This may be an existing membership. */
+    member: Member;
+};
 /**
  * Fields that can be updated on an organization.
  */
@@ -6412,12 +6703,10 @@ declare class OrganizationService {
      * Accepts an organization invitation.
      *
      * @param id - The invitation ID to accept
-     * @returns Object containing the application's `homeUrl` when the invitation is
-     *   scoped to an application that defines one; otherwise `null`.
+     * @returns The accepted member and the application's `homeUrl` when the invitation
+     *   is scoped to an application that defines one; otherwise `null`.
      */
-    acceptInvitation(id: string): Promise<{
-        homeUrl: string | null;
-    }>;
+    acceptInvitation(id: string): Promise<AcceptInvitationResult>;
     /**
      * Removes a user from the active organization.
      *
@@ -7084,4 +7373,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminOrganizationTeamRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -4402,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 } & {
     applications: {
         getApplicationAuthContext: (applicationId: string) => Promise<{
-            data: ApplicationAuthContextResponse;
-            error: null;
-        } | {
             data: null;
             error: {
                 message?: string | undefined;
                 status: number;
                 statusText: string;
             };
+        } | {
+            data: ApplicationAuthContextResponse;
+            error: null;
         }>;
         listCandidateOrganizations: (applicationId: string) => Promise<{
             data: ListCandidateOrganizationsResponse;
@@ -5576,8 +5576,16 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 type APIClient = ReturnType<typeof createAPIClient>;
 /** An authenticated user. */
 type User = APIClient['$Infer']['Session']['user'];
-/** A user session containing the user and session metadata. */
-type Session = APIClient['$Infer']['Session'];
+/**
+ * A user session record.
+ *
+ * Breaking change in 1.12: this was previously the full `{ user, session }`
+ * response object, even though runtime session state only ever held the
+ * inner record. Use {@link SessionData} for the full response shape.
+ */
+type Session = APIClient['$Infer']['Session']['session'];
+/** A full session response containing the user and the session record. */
+type SessionData = APIClient['$Infer']['Session'];
 /** An organization the user belongs to. */
 type BaseOrganization = Strict<APIClient['$Infer']['Organization']>;
 /** A team within an organization. */
@@ -5649,29 +5657,39 @@ type TeamMember = {
 };
 
 /**
- * Options accepted when listing users through the Better Auth admin plugin.
+ * Options accepted when listing users as a global admin.
  */
 type ListAdminUsersOptions = {
-    /** Maximum number of users to return. */
+    /** Maximum number of users to return. Defaults to 50. */
     limit?: number;
-    /** Number of users to skip. */
+    /** Number of users to skip. Defaults to 0. */
     offset?: number;
-    /** Free-text search value. */
-    searchValue?: string;
-    /** User field searched by Better Auth. Defaults to email. */
-    searchField?: 'email' | 'name';
-    /** Search comparison operator. Defaults to contains. */
-    searchOperator?: 'contains' | 'starts_with' | 'ends_with';
-    /** Field used to sort the listing. */
-    sortBy?: string;
-    /** Sort direction. */
+    /** Column used to order the listing. Defaults to creation date. */
+    sortBy?: 'createdAt' | 'name';
+    /** Order direction. Defaults to descending. */
     sortDirection?: 'asc' | 'desc';
-    /** User field filtered by Better Auth. Defaults to email. */
-    filterField?: string;
-    /** Filter value. */
-    filterValue?: string | number | boolean | string[] | number[];
-    /** Filter comparison operator. Defaults to eq. */
-    filterOperator?: 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'contains' | 'starts_with' | 'ends_with';
+    /** Free-text search matched against user name, email, and ID. */
+    query?: string;
+    /**
+     * Number of organization previews to include per user (max 10).
+     * When greater than 0, each row also includes the total organization count.
+     * Defaults to 0.
+     */
+    organizationsPreview?: number;
+    /**
+     * When true, invitation-only rows for people invited but not yet registered
+     * are merged into the listing, grouped by email. Defaults to false.
+     */
+    includeInvitations?: boolean;
+};
+/**
+ * Organization preview returned alongside each admin user row.
+ */
+type AdminUserOrganization = {
+    id: string;
+    name: string;
+    logo: string | null;
+    createdAt: string;
 };
 /**
  * Options accepted when listing all organizations as a global admin.
@@ -5775,8 +5793,16 @@ type ListAdminOrganizationMembersOptions = {
     limit?: number;
     /** Number of members to skip. Defaults to 0. */
     offset?: number;
-    /** Free-text search matched against member name, email, role, user ID, and member ID. */
+    /** Case-insensitive name/email match; also matches an exact user ID when a UUID. */
     query?: string;
+    /** Organization role filter, e.g. 'org:admin'. */
+    role?: string;
+    /** Restricts the listing to members belonging to any of these teams. */
+    teamIds?: string[];
+    /** When true, pending invitation rows for the organization are merged into the listing. */
+    includeInvitations?: boolean;
+    /** When true, each row includes the member's teams and accessible applications. */
+    includeAccess?: boolean;
 };
 /**
  * Options accepted when listing teams for a single organization as a global admin.
@@ -5806,6 +5832,66 @@ type CreateAdminOrganizationTeamOptions = {
     /** User IDs of organization members to add to the team. */
     memberIds?: string[];
 };
+/**
+ * Options accepted when updating an organization member's role as a global admin.
+ */
+type UpdateAdminMemberRoleOptions = {
+    /** ID of the membership to update. */
+    memberId: string;
+    /** New organization role for the membership. */
+    role: string;
+};
+/**
+ * Options accepted when removing an organization member as a global admin.
+ */
+type RemoveAdminMemberOptions = {
+    /** ID of the membership to remove. */
+    memberId: string;
+};
+/**
+ * Options accepted when setting a user's effective application role as a global admin.
+ */
+type SetAdminUserApplicationRoleOptions = {
+    /** ID of the user whose application role is being set. */
+    userId: string;
+    /** Organization the entitlement belongs to. */
+    organizationId: string;
+    /** Application the entitlement grants access to. */
+    applicationId: string;
+    /** Non-null grants access with the role, null denies access (leave application). Ignored when clear is true. */
+    role?: string | null;
+    /** When true, removes the user's override rule so broader organization rules apply again. */
+    clear?: boolean;
+};
+/**
+ * Options accepted when assigning or clearing a user's team as a global admin.
+ */
+type SetAdminUserTeamOptions = {
+    /** ID of the user whose team membership is being set. */
+    userId: string;
+    /** Organization the teams belong to. */
+    organizationId: string;
+    /** Desired teams within the organization; an empty array clears the user's team memberships. */
+    teamIds: string[];
+};
+/**
+ * Team row returned by the admin organization team listing endpoint.
+ */
+type AdminOrganizationTeam = {
+    id: string;
+    name: string;
+};
+/**
+ * Organization membership row returned by the admin member mutation endpoints.
+ */
+type AdminMember = {
+    id: string;
+    organizationId: string;
+    userId: string;
+    role: string;
+    createdAt: string;
+    deletedAt: string | null;
+};
 /**
  * Options accepted when creating an organization as a global admin.
  */
@@ -5841,7 +5927,36 @@ type UpdateAdminOrganizationOptions = {
     settings?: OrganizationSettings;
 };
 /**
- * User row returned by the Better Auth admin user listing endpoint.
+ * Invitation attached to an invitation row in the admin user listing.
+ */
+type AdminUserInvitation = {
+    id: string;
+    organizationId: string;
+    organizationName: string;
+    organizationLogo: string | null;
+    applicationId: string | null;
+    role: string | null;
+    teamIds: string[];
+    status: 'pending' | 'expired';
+    expiresAt: string;
+    createdAt: string;
+};
+/**
+ * Options accepted when resending an organization invitation as a global admin.
+ */
+type ResendAdminInviteOptions = {
+    organizationId: string;
+    email: string;
+    role: string;
+    applicationId?: string;
+    /**
+     * Teams joined when the re-sent invitation is accepted. Resending replaces the
+     * invitation, so these must be provided to preserve the original team assignments.
+     */
+    teamIds?: string[];
+};
+/**
+ * User row returned by the admin user listing endpoint.
  */
 type AdminUser = {
     id: string;
@@ -5857,15 +5972,25 @@ type AdminUser = {
     banExpires: string | Date | null;
     lastActiveAt?: string | Date | null;
     twoFactorEnabled?: boolean | null;
+    /** Discriminates registered users from invitation-only rows. */
+    type: 'user' | 'invitation';
+    /** Aggregate invitation status. Present on invitation rows. */
+    invitationStatus?: 'pending' | 'expired';
+    /** Pending invitations grouped on this row. Present on invitation rows. */
+    invitations?: AdminUserInvitation[];
+    /** Total number of organizations the user belongs to. Present when requested via organizationsPreview. */
+    organizationCount?: number;
+    /** Preview of the first organizations the user belongs to. Present when requested via organizationsPreview. */
+    organizations?: AdminUserOrganization[];
 };
 /**
- * Paginated Better Auth admin user listing response.
+ * Paginated admin user listing response.
  */
 type ListAdminUsersResult = {
     users: AdminUser[];
     total: number;
-    limit?: number;
-    offset?: number;
+    limit: number;
+    offset: number;
 };
 /**
  * Member preview returned alongside each admin organization row.
@@ -5877,13 +6002,40 @@ type AdminOrganizationMember = {
     image: string | null;
 };
 /**
- * Full organization member row returned by the admin organization member listing endpoint.
+ * Team row attached to an organization member listing row.
  */
-type AdminOrganizationMemberRecord = AdminOrganizationMember & {
-    memberId: string;
+type AdminOrganizationMemberTeam = {
+    id: string;
+    name: string;
+};
+/**
+ * Application row attached to an organization member listing row.
+ */
+type AdminOrganizationMemberApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+};
+/**
+ * Row returned by the admin organization member listing endpoint. Members and
+ * pending invitations share this shape, discriminated by type.
+ */
+type AdminOrganizationMemberRecord = {
+    type: 'member' | 'invitation';
+    id: string;
+    memberId: string | null;
     organizationId: string;
-    role: string;
+    name: string | null;
+    email: string;
+    image: string | null;
+    role: string | null;
+    lastActiveAt: string | null;
     createdAt: string;
+    invitationId?: string;
+    invitationStatus?: 'pending' | 'expired';
+    expiresAt?: string;
+    teams?: AdminOrganizationMemberTeam[];
+    applications?: AdminOrganizationMemberApplication[];
 };
 /**
  * Paginated organization member listing response.
@@ -5914,6 +6066,41 @@ type ListAdminOrganizationTeamsResult = {
     limit: number;
     offset: number;
 };
+/**
+ * Application row in an admin user access report.
+ */
+type AdminUserAccessApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+    /** Effective role from entitlement rule evaluation. Null when the first matching rule denies access or no rule matches. */
+    role: string | null;
+};
+/**
+ * Team row in an admin user access report.
+ */
+type AdminUserAccessTeam = {
+    id: string;
+    name: string;
+};
+/**
+ * Organization row in an admin user access report.
+ */
+type AdminUserAccessOrganization = {
+    id: string;
+    name: string;
+    logo: string | null;
+    memberId: string;
+    role: string;
+    teams: AdminUserAccessTeam[];
+    applications: AdminUserAccessApplication[];
+};
+/**
+ * Access report returned by the admin user access endpoint.
+ */
+type AdminUserAccess = {
+    organizations: AdminUserAccessOrganization[];
+};
 /**
  * Organization row embedded in an admin application entitlement.
  */
@@ -6031,6 +6218,27 @@ type ListAdminOrganizationsResult = {
     limit: number;
     offset: number;
 };
+/**
+ * Options accepted when inviting several users to an organization as a global admin.
+ */
+type InviteAdminOrganizationUsersOptions = {
+    organizationId: string;
+    emails: string[];
+    role: string;
+    /** Teams joined when each invitation is accepted. */
+    teamIds?: string[];
+    applicationId?: string;
+};
+/**
+ * Per-email outcome of a batch organization invite.
+ */
+type InviteAdminOrganizationUsersResult = {
+    results: {
+        email: string;
+        status: 'invited' | 'added' | 'error';
+        message?: string;
+    }[];
+};
 
 /**
  * Service for global admin operations.
@@ -6053,20 +6261,21 @@ declare class AdminService {
      * @returns The paginated organization listing
      */
     listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
+        data: ListAdminOrganizationsResult;
+        error: null;
+    } | {
         data: null;
         error: {
             message?: string | undefined;
             status: number;
             statusText: string;
         };
-    } | {
-        data: ListAdminOrganizationsResult;
-        error: null;
     }>;
     /**
-     * Lists all Better Auth users from the user table.
+     * Lists users as a global admin, optionally with organization previews
+     * and totals when a preview size is requested.
      *
-     * @param options - Pagination, search, filter, and ordering options
+     * @param options - Pagination, ordering, search, and preview options
      * @returns The paginated user listing
      */
     listUsers(options?: ListAdminUsersOptions): Promise<{
@@ -6090,6 +6299,17 @@ declare class AdminService {
     getOrganization(options: GetAdminOrganizationOptions): Promise<{
         data: AdminOrganization;
     } | null>;
+    /**
+     * Fetches the per-organization access report for a single user: their
+     * organizations with role, membership ID, and teams, plus each
+     * organization's entitled applications with the user's effective role.
+     *
+     * @param userId - The ID of the user to fetch access for
+     * @returns The user access report
+     */
+    getUserAccess(userId: string): Promise<{
+        data: AdminUserAccess;
+    } | null>;
     /**
      * Lists active members for one organization as a global admin.
      *
@@ -6151,13 +6371,84 @@ declare class AdminService {
     updateOrganization(options: UpdateAdminOrganizationOptions): Promise<{
         data: AdminOrganization;
     } | null>;
+    /**
+     * Updates an organization member's role.
+     *
+     * @param options - Membership ID and the new role
+     * @returns The updated membership
+     */
+    updateMemberRole(options: UpdateAdminMemberRoleOptions): Promise<{
+        data: AdminMember;
+    } | null>;
+    /**
+     * Removes an organization member.
+     *
+     * @param options - Membership ID to remove
+     * @returns The removed membership
+     */
+    removeMember(options: RemoveAdminMemberOptions): Promise<{
+        data: AdminMember;
+    } | null>;
+    /**
+     * Sets a user's effective application role within an organization. A
+     * non-null role grants access, a null role denies access (leave
+     * application), and clear removes the user-specific override.
+     *
+     * @param options - User, organization, application, and the role or clear flag
+     */
+    setUserApplicationRole(options: SetAdminUserApplicationRoleOptions): Promise<void>;
+    /**
+     * Reconciles a user's team memberships within an organization to a given set.
+     *
+     * @param options - User, organization, and the desired teams (empty to clear)
+     */
+    setUserTeam(options: SetAdminUserTeamOptions): Promise<void>;
     /**
      * Bans a user from the auth system and invalidates all their sessions.
      * @param userId - The ID of the user to ban
      */
     banUser(userId: string): Promise<void>;
+    /**
+     * Lifts a user's ban.
+     * @param userId - The ID of the user to unban
+     */
+    unbanUser(userId: string): Promise<void>;
+    /**
+     * Permanently removes a user from the auth system.
+     * @param userId - The ID of the user to remove
+     */
+    removeUser(userId: string): Promise<void>;
+    /**
+     * Cancels a pending invitation as a global admin.
+     * @param invitationId - The ID of the invitation to cancel
+     */
+    cancelInvite(invitationId: string): Promise<void>;
+    /**
+     * Re-sends an organization invitation email as a global admin.
+     * @param options - Organization, email, role, and optional application and teams
+     */
+    resendInvite(options: ResendAdminInviteOptions): Promise<void>;
+    /**
+     * Invites several users to an organization in one call. Failures are
+     * isolated per email in the results payload.
+     *
+     * @param options - Organization, emails, role, and optional teams/application
+     * @returns Per-email invite outcomes
+     */
+    inviteOrganizationUsers(options: InviteAdminOrganizationUsersOptions): Promise<{
+        data: InviteAdminOrganizationUsersResult;
+    } | null>;
 }
 
+/**
+ * Result of accepting an organization invitation.
+ */
+type AcceptInvitationResult = {
+    /** Application home URL for application-scoped invitations, otherwise `null`. */
+    homeUrl: string | null;
+    /** The accepted organization membership. This may be an existing membership. */
+    member: Member;
+};
 /**
  * Fields that can be updated on an organization.
  */
@@ -6412,12 +6703,10 @@ declare class OrganizationService {
      * Accepts an organization invitation.
      *
      * @param id - The invitation ID to accept
-     * @returns Object containing the application's `homeUrl` when the invitation is
-     *   scoped to an application that defines one; otherwise `null`.
+     * @returns The accepted member and the application's `homeUrl` when the invitation
+     *   is scoped to an application that defines one; otherwise `null`.
      */
-    acceptInvitation(id: string): Promise<{
-        homeUrl: string | null;
-    }>;
+    acceptInvitation(id: string): Promise<AcceptInvitationResult>;
     /**
      * Removes a user from the active organization.
      *
@@ -7084,4 +7373,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberRecord, AdminOrganizationTeamRecord, AdminUser, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -8,7 +8,7 @@ import { defaultStatements } from 'better-auth/plugins/organization/access';
 import z, { z as z$1 } from 'zod';
 export { APIError } from 'better-auth';
 
-const version = "1.28.2";
+const version = "1.30.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -439,25 +439,23 @@ class AdminService {
     });
   }
   /**
-   * Lists all Better Auth users from the user table.
+   * Lists users as a global admin, optionally with organization previews
+   * and totals when a preview size is requested.
    *
-   * @param options - Pagination, search, filter, and ordering options
+   * @param options - Pagination, ordering, search, and preview options
    * @returns The paginated user listing
    */
   async listUsers(options = {}) {
-    return await this.client.$fetch("/admin/list-users", {
+    return await this.client.$fetch("/admin/users", {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
         ...options.offset !== void 0 ? { offset: options.offset } : {},
-        ...options.searchValue ? { searchValue: options.searchValue } : {},
-        ...options.searchField ? { searchField: options.searchField } : {},
-        ...options.searchOperator ? { searchOperator: options.searchOperator } : {},
         ...options.sortBy ? { sortBy: options.sortBy } : {},
         ...options.sortDirection ? { sortDirection: options.sortDirection } : {},
-        ...options.filterField ? { filterField: options.filterField } : {},
-        ...options.filterValue !== void 0 ? { filterValue: options.filterValue } : {},
-        ...options.filterOperator ? { filterOperator: options.filterOperator } : {}
+        ...options.query ? { query: options.query } : {},
+        ...options.organizationsPreview !== void 0 ? { organizations_preview: options.organizationsPreview } : {},
+        ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {}
       }
     });
   }
@@ -479,6 +477,20 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Fetches the per-organization access report for a single user: their
+   * organizations with role, membership ID, and teams, plus each
+   * organization's entitled applications with the user's effective role.
+   *
+   * @param userId - The ID of the user to fetch access for
+   * @returns The user access report
+   */
+  async getUserAccess(userId) {
+    const { data } = await this.client.$fetch(`/admin/users/${encodeURIComponent(userId)}/access`, {
+      method: "GET"
+    });
+    return data;
+  }
   /**
    * Lists active members for one organization as a global admin.
    *
@@ -491,7 +503,11 @@ class AdminService {
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
         ...options.offset !== void 0 ? { offset: options.offset } : {},
-        ...options.query ? { query: options.query } : {}
+        ...options.query ? { query: options.query } : {},
+        ...options.role ? { role: options.role } : {},
+        ...options.teamIds !== void 0 && options.teamIds.length > 0 ? { team_ids: options.teamIds } : {},
+        ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {},
+        ...options.includeAccess !== void 0 ? { include_access: options.includeAccess } : {}
       }
     });
   }
@@ -555,6 +571,63 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Updates an organization member's role.
+   *
+   * @param options - Membership ID and the new role
+   * @returns The updated membership
+   */
+  async updateMemberRole(options) {
+    const { data } = await this.client.$fetch("/admin/organizations/members/update-role", {
+      method: "POST",
+      body: options
+    });
+    return data;
+  }
+  /**
+   * Removes an organization member.
+   *
+   * @param options - Membership ID to remove
+   * @returns The removed membership
+   */
+  async removeMember(options) {
+    const { data } = await this.client.$fetch("/admin/organizations/members/remove", {
+      method: "POST",
+      body: options
+    });
+    return data;
+  }
+  /**
+   * Sets a user's effective application role within an organization. A
+   * non-null role grants access, a null role denies access (leave
+   * application), and clear removes the user-specific override.
+   *
+   * @param options - User, organization, application, and the role or clear flag
+   */
+  async setUserApplicationRole(options) {
+    await this.client.$fetch(`/admin/users/${encodeURIComponent(options.userId)}/applications/role`, {
+      method: "POST",
+      body: {
+        organizationId: options.organizationId,
+        applicationId: options.applicationId,
+        ...options.clear === true ? { clear: true } : { role: options.role }
+      }
+    });
+  }
+  /**
+   * Reconciles a user's team memberships within an organization to a given set.
+   *
+   * @param options - User, organization, and the desired teams (empty to clear)
+   */
+  async setUserTeam(options) {
+    await this.client.$fetch(`/admin/users/${encodeURIComponent(options.userId)}/team`, {
+      method: "POST",
+      body: {
+        organizationId: options.organizationId,
+        teamIds: options.teamIds
+      }
+    });
+  }
   /**
    * Bans a user from the auth system and invalidates all their sessions.
    * @param userId - The ID of the user to ban
@@ -562,6 +635,51 @@ class AdminService {
   async banUser(userId) {
     await this.client.$fetch("/admin/ban-user", { method: "POST", body: { userId } });
   }
+  /**
+   * Lifts a user's ban.
+   * @param userId - The ID of the user to unban
+   */
+  async unbanUser(userId) {
+    await this.client.$fetch("/admin/unban-user", { method: "POST", body: { userId } });
+  }
+  /**
+   * Permanently removes a user from the auth system.
+   * @param userId - The ID of the user to remove
+   */
+  async removeUser(userId) {
+    await this.client.$fetch("/admin/remove-user", { method: "POST", body: { userId } });
+  }
+  /**
+   * Cancels a pending invitation as a global admin.
+   * @param invitationId - The ID of the invitation to cancel
+   */
+  async cancelInvite(invitationId) {
+    await this.client.$fetch("/admin/invites/cancel", { method: "POST", body: { invitationId } });
+  }
+  /**
+   * Re-sends an organization invitation email as a global admin.
+   * @param options - Organization, email, role, and optional application and teams
+   */
+  async resendInvite(options) {
+    await this.client.$fetch("/admin/organizations/users", {
+      method: "POST",
+      body: { ...options, sendInvite: true, resend: true }
+    });
+  }
+  /**
+   * Invites several users to an organization in one call. Failures are
+   * isolated per email in the results payload.
+   *
+   * @param options - Organization, emails, role, and optional teams/application
+   * @returns Per-email invite outcomes
+   */
+  async inviteOrganizationUsers(options) {
+    const { data } = await this.client.$fetch("/admin/organizations/users", {
+      method: "POST",
+      body: { ...options, sendInvite: true }
+    });
+    return data;
+  }
 }
 
 class BaseError extends Error {
@@ -1226,14 +1344,18 @@ class OrganizationService {
    * Accepts an organization invitation.
    *
    * @param id - The invitation ID to accept
-   * @returns Object containing the application's `homeUrl` when the invitation is
-   *   scoped to an application that defines one; otherwise `null`.
+   * @returns The accepted member and the application's `homeUrl` when the invitation
+   *   is scoped to an application that defines one; otherwise `null`.
    */
   async acceptInvitation(id) {
     const response = await this.client.organization.acceptInvitation({
       invitationId: id
     });
-    return { homeUrl: response?.homeUrl ?? null };
+    const responseWithHomeUrl = response;
+    return {
+      homeUrl: responseWithHomeUrl.homeUrl ?? null,
+      member: response.member
+    };
   }
   /**
    * Removes a user from the active organization.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.28.2",
+  "version": "1.30.0",
   "type": "module",
   "exports": {
     ".": {