@meistrari/auth-core 1.33.0 → 1.34.0

package/dist/index.d.mts

@@ -4402,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 } & {
     applications: {
         getApplicationAuthContext: (applicationId: string) => Promise<{
-            data: ApplicationAuthContextResponse;
-            error: null;
-        } | {
             data: null;
             error: {
                 message?: string | undefined;
                 status: number;
                 statusText: string;
             };
+        } | {
+            data: ApplicationAuthContextResponse;
+            error: null;
         }>;
         listCandidateOrganizations: (applicationId: string) => Promise<{
             data: ListCandidateOrganizationsResponse;
@@ -6135,6 +6135,31 @@ type AdminApplicationEntitlement = {
  * Entitlement record returned by entitlement mutation endpoints.
  */
 type AdminApplicationEntitlementRecord = Omit<AdminApplicationEntitlement, 'organization'>;
+/** Kind of matcher an entitlement rule applies. */
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+/**
+ * A single access rule on an entitlement. Rules are evaluated in `position`
+ * order, first match wins. A non-null `role` grants access with that role; a
+ * null `role` denies access.
+ */
+type AdminEntitlementRule = {
+    type: AdminEntitlementRuleType;
+    value: string;
+    role?: string | null;
+    position: number;
+};
+/** An entitlement together with its ordered access rules. */
+type AdminEntitlementWithRules = AdminApplicationEntitlementRecord & {
+    rules: AdminEntitlementRule[];
+};
+/** Options accepted when enabling or disabling an entitlement. */
+type UpdateAdminEntitlementOptions = {
+    enabled: boolean;
+};
+/** Options accepted when replacing all rules on an entitlement. */
+type SetAdminEntitlementRulesOptions = {
+    rules: AdminEntitlementRule[];
+};
 /**
  * Member preview returned alongside each admin application row.
  */
@@ -6268,12 +6293,60 @@ type InviteAdminOrganizationUsersResult = {
  */
 declare class AdminService {
     private client;
+    private apiUrl;
     /**
      * Creates a new AdminService instance.
      *
      * @param client - The API client for making admin requests
+     * @param apiUrl - The base URL of the authentication API, used to reach the
+     * application routes that the Better Auth client cannot address
      */
-    constructor(client: APIClient);
+    constructor(client: APIClient, apiUrl: string);
+    /**
+     * Requests an application management route.
+     *
+     * These routes are served by the API itself rather than by the Better Auth
+     * handler, so they sit outside the `/api/auth` base path that the Better
+     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
+     * authenticate with the session cookie alone; a bearer token must never be
+     * attached, since the API reads one only as an internal API key and would
+     * reject the request.
+     *
+     * @param path - Path relative to the API root, without a leading slash
+     * @param request - Method, body, and query parameters
+     * @returns The parsed JSON response
+     */
+    private requestApplicationRoute;
+    /**
+     * Lists applications, optionally filtered by organization.
+     *
+     * @param options - Pagination, ordering, organization filter, and search options
+     * @returns The application listing with entitlement details
+     */
+    listApplications(options?: ListAdminApplicationsOptions): Promise<ListAdminApplicationsResult>;
+    /**
+     * Creates an application.
+     *
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The created application
+     */
+    createApplication(options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Updates an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The updated application
+     */
+    updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Enables an organization for an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Organization entitlement payload
+     * @returns The created entitlement
+     */
+    createApplicationEntitlement(applicationId: string, options: CreateAdminApplicationEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Lists all organizations, optionally with member and application previews
      * and totals when a preview size is requested.
@@ -6282,15 +6355,15 @@ declare class AdminService {
      * @returns The paginated organization listing
      */
     listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
+        data: ListAdminOrganizationsResult;
+        error: null;
+    } | {
         data: null;
         error: {
             message?: string | undefined;
             status: number;
             statusText: string;
         };
-    } | {
-        data: ListAdminOrganizationsResult;
-        error: null;
     }>;
     /**
      * Lists users as a global admin, optionally with organization previews
@@ -6393,6 +6466,36 @@ declare class AdminService {
     createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
         data: AdminOrganizationTeamRecord;
     } | null>;
+    /**
+     * Fetches a single entitlement together with its ordered access rules.
+     *
+     * @param entitlementId - ID of the entitlement to fetch
+     * @returns The entitlement and its rules
+     */
+    getEntitlement(entitlementId: string): Promise<AdminEntitlementWithRules>;
+    /**
+     * Replaces all access rules on an entitlement in a single call.
+     *
+     * @param entitlementId - ID of the entitlement whose rules are replaced
+     * @param options - The full set of rules to persist
+     * @returns The entitlement with the saved rules
+     */
+    setEntitlementRules(entitlementId: string, options: SetAdminEntitlementRulesOptions): Promise<AdminEntitlementWithRules>;
+    /**
+     * Enables or disables an entitlement.
+     *
+     * @param entitlementId - ID of the entitlement to update
+     * @param options - The desired enabled state
+     * @returns The updated entitlement
+     */
+    updateEntitlement(entitlementId: string, options: UpdateAdminEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
+    /**
+     * Deletes an entitlement and all of its access rules.
+     *
+     * @param entitlementId - ID of the entitlement to delete
+     * @returns The deleted entitlement
+     */
+    deleteEntitlement(entitlementId: string): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Creates an organization without adding the creator as a member.
      *
@@ -6484,8 +6587,14 @@ declare class AdminService {
  * Result of accepting an organization invitation.
  */
 type AcceptInvitationResult = {
+    /** The scoped application's ID, or `null` for a plain organization invitation. */
+    applicationId: string | null;
+    /** The scoped application's display name, or `null` for a plain organization invitation. */
+    applicationName: string | null;
     /** Application home URL for application-scoped invitations, otherwise `null`. */
     homeUrl: string | null;
+    /** Configured post-acceptance URL for plain organization invitations. */
+    inviteAcceptedUrl: string | null;
     /** The accepted organization membership. This may be an existing membership. */
     member: Member;
 };
@@ -6743,8 +6852,8 @@ declare class OrganizationService {
      * Accepts an organization invitation.
      *
      * @param id - The invitation ID to accept
-     * @returns The accepted member and the application's `homeUrl` when the invitation
-     *   is scoped to an application that defines one; otherwise `null`.
+     * @returns The accepted member, application context for app-scoped invitations,
+     *   and the configured post-acceptance URL for plain organization invitations.
      */
     acceptInvitation(id: string): Promise<AcceptInvitationResult>;
     /**
@@ -7413,4 +7522,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -4402,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 } & {
     applications: {
         getApplicationAuthContext: (applicationId: string) => Promise<{
-            data: ApplicationAuthContextResponse;
-            error: null;
-        } | {
             data: null;
             error: {
                 message?: string | undefined;
                 status: number;
                 statusText: string;
             };
+        } | {
+            data: ApplicationAuthContextResponse;
+            error: null;
         }>;
         listCandidateOrganizations: (applicationId: string) => Promise<{
             data: ListCandidateOrganizationsResponse;
@@ -6135,6 +6135,31 @@ type AdminApplicationEntitlement = {
  * Entitlement record returned by entitlement mutation endpoints.
  */
 type AdminApplicationEntitlementRecord = Omit<AdminApplicationEntitlement, 'organization'>;
+/** Kind of matcher an entitlement rule applies. */
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+/**
+ * A single access rule on an entitlement. Rules are evaluated in `position`
+ * order, first match wins. A non-null `role` grants access with that role; a
+ * null `role` denies access.
+ */
+type AdminEntitlementRule = {
+    type: AdminEntitlementRuleType;
+    value: string;
+    role?: string | null;
+    position: number;
+};
+/** An entitlement together with its ordered access rules. */
+type AdminEntitlementWithRules = AdminApplicationEntitlementRecord & {
+    rules: AdminEntitlementRule[];
+};
+/** Options accepted when enabling or disabling an entitlement. */
+type UpdateAdminEntitlementOptions = {
+    enabled: boolean;
+};
+/** Options accepted when replacing all rules on an entitlement. */
+type SetAdminEntitlementRulesOptions = {
+    rules: AdminEntitlementRule[];
+};
 /**
  * Member preview returned alongside each admin application row.
  */
@@ -6268,12 +6293,60 @@ type InviteAdminOrganizationUsersResult = {
  */
 declare class AdminService {
     private client;
+    private apiUrl;
     /**
      * Creates a new AdminService instance.
      *
      * @param client - The API client for making admin requests
+     * @param apiUrl - The base URL of the authentication API, used to reach the
+     * application routes that the Better Auth client cannot address
      */
-    constructor(client: APIClient);
+    constructor(client: APIClient, apiUrl: string);
+    /**
+     * Requests an application management route.
+     *
+     * These routes are served by the API itself rather than by the Better Auth
+     * handler, so they sit outside the `/api/auth` base path that the Better
+     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
+     * authenticate with the session cookie alone; a bearer token must never be
+     * attached, since the API reads one only as an internal API key and would
+     * reject the request.
+     *
+     * @param path - Path relative to the API root, without a leading slash
+     * @param request - Method, body, and query parameters
+     * @returns The parsed JSON response
+     */
+    private requestApplicationRoute;
+    /**
+     * Lists applications, optionally filtered by organization.
+     *
+     * @param options - Pagination, ordering, organization filter, and search options
+     * @returns The application listing with entitlement details
+     */
+    listApplications(options?: ListAdminApplicationsOptions): Promise<ListAdminApplicationsResult>;
+    /**
+     * Creates an application.
+     *
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The created application
+     */
+    createApplication(options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Updates an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The updated application
+     */
+    updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Enables an organization for an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Organization entitlement payload
+     * @returns The created entitlement
+     */
+    createApplicationEntitlement(applicationId: string, options: CreateAdminApplicationEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Lists all organizations, optionally with member and application previews
      * and totals when a preview size is requested.
@@ -6282,15 +6355,15 @@ declare class AdminService {
      * @returns The paginated organization listing
      */
     listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
+        data: ListAdminOrganizationsResult;
+        error: null;
+    } | {
         data: null;
         error: {
             message?: string | undefined;
             status: number;
             statusText: string;
         };
-    } | {
-        data: ListAdminOrganizationsResult;
-        error: null;
     }>;
     /**
      * Lists users as a global admin, optionally with organization previews
@@ -6393,6 +6466,36 @@ declare class AdminService {
     createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
         data: AdminOrganizationTeamRecord;
     } | null>;
+    /**
+     * Fetches a single entitlement together with its ordered access rules.
+     *
+     * @param entitlementId - ID of the entitlement to fetch
+     * @returns The entitlement and its rules
+     */
+    getEntitlement(entitlementId: string): Promise<AdminEntitlementWithRules>;
+    /**
+     * Replaces all access rules on an entitlement in a single call.
+     *
+     * @param entitlementId - ID of the entitlement whose rules are replaced
+     * @param options - The full set of rules to persist
+     * @returns The entitlement with the saved rules
+     */
+    setEntitlementRules(entitlementId: string, options: SetAdminEntitlementRulesOptions): Promise<AdminEntitlementWithRules>;
+    /**
+     * Enables or disables an entitlement.
+     *
+     * @param entitlementId - ID of the entitlement to update
+     * @param options - The desired enabled state
+     * @returns The updated entitlement
+     */
+    updateEntitlement(entitlementId: string, options: UpdateAdminEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
+    /**
+     * Deletes an entitlement and all of its access rules.
+     *
+     * @param entitlementId - ID of the entitlement to delete
+     * @returns The deleted entitlement
+     */
+    deleteEntitlement(entitlementId: string): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Creates an organization without adding the creator as a member.
      *
@@ -6484,8 +6587,14 @@ declare class AdminService {
  * Result of accepting an organization invitation.
  */
 type AcceptInvitationResult = {
+    /** The scoped application's ID, or `null` for a plain organization invitation. */
+    applicationId: string | null;
+    /** The scoped application's display name, or `null` for a plain organization invitation. */
+    applicationName: string | null;
     /** Application home URL for application-scoped invitations, otherwise `null`. */
     homeUrl: string | null;
+    /** Configured post-acceptance URL for plain organization invitations. */
+    inviteAcceptedUrl: string | null;
     /** The accepted organization membership. This may be an existing membership. */
     member: Member;
 };
@@ -6743,8 +6852,8 @@ declare class OrganizationService {
      * Accepts an organization invitation.
      *
      * @param id - The invitation ID to accept
-     * @returns The accepted member and the application's `homeUrl` when the invitation
-     *   is scoped to an application that defines one; otherwise `null`.
+     * @returns The accepted member, application context for app-scoped invitations,
+     *   and the configured post-acceptance URL for plain organization invitations.
      */
     acceptInvitation(id: string): Promise<AcceptInvitationResult>;
     /**
@@ -7413,4 +7522,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -8,7 +8,7 @@ import { defaultStatements } from 'better-auth/plugins/organization/access';
 import z, { z as z$1 } from 'zod';
 export { APIError } from 'better-auth';
 
-const version = "1.33.0";
+const version = "1.34.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -408,14 +408,116 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
   });
 }
 
+async function readErrorMessage(response) {
+  try {
+    const body = await response.json();
+    return body.error ?? body.message ?? response.statusText;
+  } catch {
+    return response.statusText;
+  }
+}
 class AdminService {
   /**
    * Creates a new AdminService instance.
    *
    * @param client - The API client for making admin requests
+   * @param apiUrl - The base URL of the authentication API, used to reach the
+   * application routes that the Better Auth client cannot address
    */
-  constructor(client) {
+  constructor(client, apiUrl) {
     this.client = client;
+    this.apiUrl = apiUrl;
+  }
+  /**
+   * Requests an application management route.
+   *
+   * These routes are served by the API itself rather than by the Better Auth
+   * handler, so they sit outside the `/api/auth` base path that the Better
+   * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
+   * authenticate with the session cookie alone; a bearer token must never be
+   * attached, since the API reads one only as an internal API key and would
+   * reject the request.
+   *
+   * @param path - Path relative to the API root, without a leading slash
+   * @param request - Method, body, and query parameters
+   * @returns The parsed JSON response
+   */
+  async requestApplicationRoute(path, request = {}) {
+    const base = this.apiUrl.endsWith("/") ? this.apiUrl : `${this.apiUrl}/`;
+    const url = new URL(path, base);
+    for (const [key, value] of Object.entries(request.query ?? {})) {
+      if (value !== void 0)
+        url.searchParams.set(key, String(value));
+    }
+    const headers = new Headers({ Accept: "application/json" });
+    if (request.body !== void 0)
+      headers.set("Content-Type", "application/json");
+    const response = await fetch(url, {
+      method: request.method ?? "GET",
+      credentials: "include",
+      headers,
+      ...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {}
+    });
+    if (!response.ok)
+      throw new Error(await readErrorMessage(response));
+    return await response.json();
+  }
+  /**
+   * Lists applications, optionally filtered by organization.
+   *
+   * @param options - Pagination, ordering, organization filter, and search options
+   * @returns The application listing with entitlement details
+   */
+  async listApplications(options = {}) {
+    return await this.requestApplicationRoute("applications", {
+      query: {
+        limit: options.limit,
+        membersPreview: options.membersPreview,
+        offset: options.offset,
+        orderBy: options.orderBy,
+        orderDirection: options.orderDirection,
+        organizationId: options.organizationId,
+        search: options.search
+      }
+    });
+  }
+  /**
+   * Creates an application.
+   *
+   * @param options - Application name, URLs, logo, and authentication settings
+   * @returns The created application
+   */
+  async createApplication(options) {
+    return await this.requestApplicationRoute("applications", {
+      method: "POST",
+      body: options
+    });
+  }
+  /**
+   * Updates an application.
+   *
+   * @param applicationId - ID of the application to update
+   * @param options - Application name, URLs, logo, and authentication settings
+   * @returns The updated application
+   */
+  async updateApplication(applicationId, options) {
+    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}`, {
+      method: "PUT",
+      body: options
+    });
+  }
+  /**
+   * Enables an organization for an application.
+   *
+   * @param applicationId - ID of the application to update
+   * @param options - Organization entitlement payload
+   * @returns The created entitlement
+   */
+  async createApplicationEntitlement(applicationId, options) {
+    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/entitlements`, {
+      method: "POST",
+      body: options
+    });
   }
   /**
    * Lists all organizations, optionally with member and application previews
@@ -586,6 +688,55 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Fetches a single entitlement together with its ordered access rules.
+   *
+   * @param entitlementId - ID of the entitlement to fetch
+   * @returns The entitlement and its rules
+   */
+  async getEntitlement(entitlementId) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}`
+    );
+  }
+  /**
+   * Replaces all access rules on an entitlement in a single call.
+   *
+   * @param entitlementId - ID of the entitlement whose rules are replaced
+   * @param options - The full set of rules to persist
+   * @returns The entitlement with the saved rules
+   */
+  async setEntitlementRules(entitlementId, options) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}/rules`,
+      { method: "PUT", body: options }
+    );
+  }
+  /**
+   * Enables or disables an entitlement.
+   *
+   * @param entitlementId - ID of the entitlement to update
+   * @param options - The desired enabled state
+   * @returns The updated entitlement
+   */
+  async updateEntitlement(entitlementId, options) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
+      { method: "PUT", body: options }
+    );
+  }
+  /**
+   * Deletes an entitlement and all of its access rules.
+   *
+   * @param entitlementId - ID of the entitlement to delete
+   * @returns The deleted entitlement
+   */
+  async deleteEntitlement(entitlementId) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
+      { method: "DELETE" }
+    );
+  }
   /**
    * Creates an organization without adding the creator as a member.
    *
@@ -1385,16 +1536,19 @@ class OrganizationService {
    * Accepts an organization invitation.
    *
    * @param id - The invitation ID to accept
-   * @returns The accepted member and the application's `homeUrl` when the invitation
-   *   is scoped to an application that defines one; otherwise `null`.
+   * @returns The accepted member, application context for app-scoped invitations,
+   *   and the configured post-acceptance URL for plain organization invitations.
    */
   async acceptInvitation(id) {
     const response = await this.client.organization.acceptInvitation({
       invitationId: id
     });
-    const responseWithHomeUrl = response;
+    const responseWithContext = response;
     return {
-      homeUrl: responseWithHomeUrl.homeUrl ?? null,
+      applicationId: responseWithContext.applicationId ?? responseWithContext.invitation?.applicationId ?? null,
+      applicationName: responseWithContext.applicationName ?? null,
+      homeUrl: responseWithContext.homeUrl ?? null,
+      inviteAcceptedUrl: responseWithContext.inviteAcceptedUrl ?? null,
       member: response.member
     };
   }
@@ -1977,7 +2131,7 @@ class AuthClient {
     this.emailOtp = new EmailOTPService(this.client);
     this.sessionAssurance = new SessionAssuranceService(this.client);
     this.user = new UserService(this.client);
-    this.admin = new AdminService(this.client);
+    this.admin = new AdminService(this.client, apiUrl);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "type": "module",
   "exports": {
     ".": {