@meistrari/auth-core 1.33.1 → 1.34.0

package/dist/index.d.mts

@@ -14,11 +14,11 @@ declare const AALBrand: unique symbol;
 declare const ACRBrand: unique symbol;
 declare const AuthMethodBrand: unique symbol;
 declare const AMRs: {
-    readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
-    readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
-    readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
-    readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
-    readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Pwd: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Otp: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Oauth: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Sso: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Saml: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
 };
 declare const AALs: {
     readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
@@ -29,11 +29,11 @@ declare const ACRs: {
     readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
 };
 declare const AuthMethods: {
-    readonly Password: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly EmailOTP: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly OAuth: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly SAML: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly Unknown: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly Password: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly EmailOTP: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly OAuth: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly SAML: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly Unknown: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
 };
 declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
     readonly Pwd: "pwd";
@@ -6135,6 +6135,31 @@ type AdminApplicationEntitlement = {
  * Entitlement record returned by entitlement mutation endpoints.
  */
 type AdminApplicationEntitlementRecord = Omit<AdminApplicationEntitlement, 'organization'>;
+/** Kind of matcher an entitlement rule applies. */
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+/**
+ * A single access rule on an entitlement. Rules are evaluated in `position`
+ * order, first match wins. A non-null `role` grants access with that role; a
+ * null `role` denies access.
+ */
+type AdminEntitlementRule = {
+    type: AdminEntitlementRuleType;
+    value: string;
+    role?: string | null;
+    position: number;
+};
+/** An entitlement together with its ordered access rules. */
+type AdminEntitlementWithRules = AdminApplicationEntitlementRecord & {
+    rules: AdminEntitlementRule[];
+};
+/** Options accepted when enabling or disabling an entitlement. */
+type UpdateAdminEntitlementOptions = {
+    enabled: boolean;
+};
+/** Options accepted when replacing all rules on an entitlement. */
+type SetAdminEntitlementRulesOptions = {
+    rules: AdminEntitlementRule[];
+};
 /**
  * Member preview returned alongside each admin application row.
  */
@@ -6268,12 +6293,60 @@ type InviteAdminOrganizationUsersResult = {
  */
 declare class AdminService {
     private client;
+    private apiUrl;
     /**
      * Creates a new AdminService instance.
      *
      * @param client - The API client for making admin requests
+     * @param apiUrl - The base URL of the authentication API, used to reach the
+     * application routes that the Better Auth client cannot address
      */
-    constructor(client: APIClient);
+    constructor(client: APIClient, apiUrl: string);
+    /**
+     * Requests an application management route.
+     *
+     * These routes are served by the API itself rather than by the Better Auth
+     * handler, so they sit outside the `/api/auth` base path that the Better
+     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
+     * authenticate with the session cookie alone; a bearer token must never be
+     * attached, since the API reads one only as an internal API key and would
+     * reject the request.
+     *
+     * @param path - Path relative to the API root, without a leading slash
+     * @param request - Method, body, and query parameters
+     * @returns The parsed JSON response
+     */
+    private requestApplicationRoute;
+    /**
+     * Lists applications, optionally filtered by organization.
+     *
+     * @param options - Pagination, ordering, organization filter, and search options
+     * @returns The application listing with entitlement details
+     */
+    listApplications(options?: ListAdminApplicationsOptions): Promise<ListAdminApplicationsResult>;
+    /**
+     * Creates an application.
+     *
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The created application
+     */
+    createApplication(options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Updates an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The updated application
+     */
+    updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Enables an organization for an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Organization entitlement payload
+     * @returns The created entitlement
+     */
+    createApplicationEntitlement(applicationId: string, options: CreateAdminApplicationEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Lists all organizations, optionally with member and application previews
      * and totals when a preview size is requested.
@@ -6393,6 +6466,36 @@ declare class AdminService {
     createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
         data: AdminOrganizationTeamRecord;
     } | null>;
+    /**
+     * Fetches a single entitlement together with its ordered access rules.
+     *
+     * @param entitlementId - ID of the entitlement to fetch
+     * @returns The entitlement and its rules
+     */
+    getEntitlement(entitlementId: string): Promise<AdminEntitlementWithRules>;
+    /**
+     * Replaces all access rules on an entitlement in a single call.
+     *
+     * @param entitlementId - ID of the entitlement whose rules are replaced
+     * @param options - The full set of rules to persist
+     * @returns The entitlement with the saved rules
+     */
+    setEntitlementRules(entitlementId: string, options: SetAdminEntitlementRulesOptions): Promise<AdminEntitlementWithRules>;
+    /**
+     * Enables or disables an entitlement.
+     *
+     * @param entitlementId - ID of the entitlement to update
+     * @param options - The desired enabled state
+     * @returns The updated entitlement
+     */
+    updateEntitlement(entitlementId: string, options: UpdateAdminEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
+    /**
+     * Deletes an entitlement and all of its access rules.
+     *
+     * @param entitlementId - ID of the entitlement to delete
+     * @returns The deleted entitlement
+     */
+    deleteEntitlement(entitlementId: string): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Creates an organization without adding the creator as a member.
      *
@@ -7419,4 +7522,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -14,11 +14,11 @@ declare const AALBrand: unique symbol;
 declare const ACRBrand: unique symbol;
 declare const AuthMethodBrand: unique symbol;
 declare const AMRs: {
-    readonly Pwd: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
-    readonly Otp: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
-    readonly Oauth: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
-    readonly Sso: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
-    readonly Saml: ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("pwd" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>);
+    readonly Pwd: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Otp: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Oauth: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Sso: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
+    readonly Saml: ("pwd" & z.core.$brand<typeof AMRBrand>) | ("otp" & z.core.$brand<typeof AMRBrand>) | ("oauth" & z.core.$brand<typeof AMRBrand>) | ("sso" & z.core.$brand<typeof AMRBrand>) | ("saml" & z.core.$brand<typeof AMRBrand>);
 };
 declare const AALs: {
     readonly Aal1: ("aal1" & z.core.$brand<typeof AALBrand>) | ("aal2" & z.core.$brand<typeof AALBrand>) | ("aal3" & z.core.$brand<typeof AALBrand>);
@@ -29,11 +29,11 @@ declare const ACRs: {
     readonly Unspecified: "urn:tela:auth:unspecified" & z.core.$brand<typeof ACRBrand>;
 };
 declare const AuthMethods: {
-    readonly Password: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly EmailOTP: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly OAuth: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly SAML: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
-    readonly Unknown: ("unknown" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly Password: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly EmailOTP: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly OAuth: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly SAML: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
+    readonly Unknown: ("oauth" & z.core.$brand<typeof AuthMethodBrand>) | ("saml" & z.core.$brand<typeof AuthMethodBrand>) | ("password" & z.core.$brand<typeof AuthMethodBrand>) | ("email_otp" & z.core.$brand<typeof AuthMethodBrand>) | ("unknown" & z.core.$brand<typeof AuthMethodBrand>);
 };
 declare const AMR: z.core.$ZodBranded<z.ZodEnum<{
     readonly Pwd: "pwd";
@@ -6135,6 +6135,31 @@ type AdminApplicationEntitlement = {
  * Entitlement record returned by entitlement mutation endpoints.
  */
 type AdminApplicationEntitlementRecord = Omit<AdminApplicationEntitlement, 'organization'>;
+/** Kind of matcher an entitlement rule applies. */
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+/**
+ * A single access rule on an entitlement. Rules are evaluated in `position`
+ * order, first match wins. A non-null `role` grants access with that role; a
+ * null `role` denies access.
+ */
+type AdminEntitlementRule = {
+    type: AdminEntitlementRuleType;
+    value: string;
+    role?: string | null;
+    position: number;
+};
+/** An entitlement together with its ordered access rules. */
+type AdminEntitlementWithRules = AdminApplicationEntitlementRecord & {
+    rules: AdminEntitlementRule[];
+};
+/** Options accepted when enabling or disabling an entitlement. */
+type UpdateAdminEntitlementOptions = {
+    enabled: boolean;
+};
+/** Options accepted when replacing all rules on an entitlement. */
+type SetAdminEntitlementRulesOptions = {
+    rules: AdminEntitlementRule[];
+};
 /**
  * Member preview returned alongside each admin application row.
  */
@@ -6268,12 +6293,60 @@ type InviteAdminOrganizationUsersResult = {
  */
 declare class AdminService {
     private client;
+    private apiUrl;
     /**
      * Creates a new AdminService instance.
      *
      * @param client - The API client for making admin requests
+     * @param apiUrl - The base URL of the authentication API, used to reach the
+     * application routes that the Better Auth client cannot address
      */
-    constructor(client: APIClient);
+    constructor(client: APIClient, apiUrl: string);
+    /**
+     * Requests an application management route.
+     *
+     * These routes are served by the API itself rather than by the Better Auth
+     * handler, so they sit outside the `/api/auth` base path that the Better
+     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
+     * authenticate with the session cookie alone; a bearer token must never be
+     * attached, since the API reads one only as an internal API key and would
+     * reject the request.
+     *
+     * @param path - Path relative to the API root, without a leading slash
+     * @param request - Method, body, and query parameters
+     * @returns The parsed JSON response
+     */
+    private requestApplicationRoute;
+    /**
+     * Lists applications, optionally filtered by organization.
+     *
+     * @param options - Pagination, ordering, organization filter, and search options
+     * @returns The application listing with entitlement details
+     */
+    listApplications(options?: ListAdminApplicationsOptions): Promise<ListAdminApplicationsResult>;
+    /**
+     * Creates an application.
+     *
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The created application
+     */
+    createApplication(options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Updates an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The updated application
+     */
+    updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Enables an organization for an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Organization entitlement payload
+     * @returns The created entitlement
+     */
+    createApplicationEntitlement(applicationId: string, options: CreateAdminApplicationEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Lists all organizations, optionally with member and application previews
      * and totals when a preview size is requested.
@@ -6393,6 +6466,36 @@ declare class AdminService {
     createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
         data: AdminOrganizationTeamRecord;
     } | null>;
+    /**
+     * Fetches a single entitlement together with its ordered access rules.
+     *
+     * @param entitlementId - ID of the entitlement to fetch
+     * @returns The entitlement and its rules
+     */
+    getEntitlement(entitlementId: string): Promise<AdminEntitlementWithRules>;
+    /**
+     * Replaces all access rules on an entitlement in a single call.
+     *
+     * @param entitlementId - ID of the entitlement whose rules are replaced
+     * @param options - The full set of rules to persist
+     * @returns The entitlement with the saved rules
+     */
+    setEntitlementRules(entitlementId: string, options: SetAdminEntitlementRulesOptions): Promise<AdminEntitlementWithRules>;
+    /**
+     * Enables or disables an entitlement.
+     *
+     * @param entitlementId - ID of the entitlement to update
+     * @param options - The desired enabled state
+     * @returns The updated entitlement
+     */
+    updateEntitlement(entitlementId: string, options: UpdateAdminEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
+    /**
+     * Deletes an entitlement and all of its access rules.
+     *
+     * @param entitlementId - ID of the entitlement to delete
+     * @returns The deleted entitlement
+     */
+    deleteEntitlement(entitlementId: string): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Creates an organization without adding the creator as a member.
      *
@@ -7419,4 +7522,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -8,7 +8,7 @@ import { defaultStatements } from 'better-auth/plugins/organization/access';
 import z, { z as z$1 } from 'zod';
 export { APIError } from 'better-auth';
 
-const version = "1.33.1";
+const version = "1.34.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -408,14 +408,116 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
   });
 }
 
+async function readErrorMessage(response) {
+  try {
+    const body = await response.json();
+    return body.error ?? body.message ?? response.statusText;
+  } catch {
+    return response.statusText;
+  }
+}
 class AdminService {
   /**
    * Creates a new AdminService instance.
    *
    * @param client - The API client for making admin requests
+   * @param apiUrl - The base URL of the authentication API, used to reach the
+   * application routes that the Better Auth client cannot address
    */
-  constructor(client) {
+  constructor(client, apiUrl) {
     this.client = client;
+    this.apiUrl = apiUrl;
+  }
+  /**
+   * Requests an application management route.
+   *
+   * These routes are served by the API itself rather than by the Better Auth
+   * handler, so they sit outside the `/api/auth` base path that the Better
+   * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
+   * authenticate with the session cookie alone; a bearer token must never be
+   * attached, since the API reads one only as an internal API key and would
+   * reject the request.
+   *
+   * @param path - Path relative to the API root, without a leading slash
+   * @param request - Method, body, and query parameters
+   * @returns The parsed JSON response
+   */
+  async requestApplicationRoute(path, request = {}) {
+    const base = this.apiUrl.endsWith("/") ? this.apiUrl : `${this.apiUrl}/`;
+    const url = new URL(path, base);
+    for (const [key, value] of Object.entries(request.query ?? {})) {
+      if (value !== void 0)
+        url.searchParams.set(key, String(value));
+    }
+    const headers = new Headers({ Accept: "application/json" });
+    if (request.body !== void 0)
+      headers.set("Content-Type", "application/json");
+    const response = await fetch(url, {
+      method: request.method ?? "GET",
+      credentials: "include",
+      headers,
+      ...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {}
+    });
+    if (!response.ok)
+      throw new Error(await readErrorMessage(response));
+    return await response.json();
+  }
+  /**
+   * Lists applications, optionally filtered by organization.
+   *
+   * @param options - Pagination, ordering, organization filter, and search options
+   * @returns The application listing with entitlement details
+   */
+  async listApplications(options = {}) {
+    return await this.requestApplicationRoute("applications", {
+      query: {
+        limit: options.limit,
+        membersPreview: options.membersPreview,
+        offset: options.offset,
+        orderBy: options.orderBy,
+        orderDirection: options.orderDirection,
+        organizationId: options.organizationId,
+        search: options.search
+      }
+    });
+  }
+  /**
+   * Creates an application.
+   *
+   * @param options - Application name, URLs, logo, and authentication settings
+   * @returns The created application
+   */
+  async createApplication(options) {
+    return await this.requestApplicationRoute("applications", {
+      method: "POST",
+      body: options
+    });
+  }
+  /**
+   * Updates an application.
+   *
+   * @param applicationId - ID of the application to update
+   * @param options - Application name, URLs, logo, and authentication settings
+   * @returns The updated application
+   */
+  async updateApplication(applicationId, options) {
+    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}`, {
+      method: "PUT",
+      body: options
+    });
+  }
+  /**
+   * Enables an organization for an application.
+   *
+   * @param applicationId - ID of the application to update
+   * @param options - Organization entitlement payload
+   * @returns The created entitlement
+   */
+  async createApplicationEntitlement(applicationId, options) {
+    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/entitlements`, {
+      method: "POST",
+      body: options
+    });
   }
   /**
    * Lists all organizations, optionally with member and application previews
@@ -586,6 +688,55 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Fetches a single entitlement together with its ordered access rules.
+   *
+   * @param entitlementId - ID of the entitlement to fetch
+   * @returns The entitlement and its rules
+   */
+  async getEntitlement(entitlementId) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}`
+    );
+  }
+  /**
+   * Replaces all access rules on an entitlement in a single call.
+   *
+   * @param entitlementId - ID of the entitlement whose rules are replaced
+   * @param options - The full set of rules to persist
+   * @returns The entitlement with the saved rules
+   */
+  async setEntitlementRules(entitlementId, options) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}/rules`,
+      { method: "PUT", body: options }
+    );
+  }
+  /**
+   * Enables or disables an entitlement.
+   *
+   * @param entitlementId - ID of the entitlement to update
+   * @param options - The desired enabled state
+   * @returns The updated entitlement
+   */
+  async updateEntitlement(entitlementId, options) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
+      { method: "PUT", body: options }
+    );
+  }
+  /**
+   * Deletes an entitlement and all of its access rules.
+   *
+   * @param entitlementId - ID of the entitlement to delete
+   * @returns The deleted entitlement
+   */
+  async deleteEntitlement(entitlementId) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
+      { method: "DELETE" }
+    );
+  }
   /**
    * Creates an organization without adding the creator as a member.
    *
@@ -1980,7 +2131,7 @@ class AuthClient {
     this.emailOtp = new EmailOTPService(this.client);
     this.sessionAssurance = new SessionAssuranceService(this.client);
     this.user = new UserService(this.client);
-    this.admin = new AdminService(this.client);
+    this.admin = new AdminService(this.client, apiUrl);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.33.1",
+  "version": "1.34.0",
   "type": "module",
   "exports": {
     ".": {