@meistrari/auth-core 1.33.1 → 1.35.0

package/dist/index.d.mts

@@ -4402,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 } & {
     applications: {
         getApplicationAuthContext: (applicationId: string) => Promise<{
+            data: ApplicationAuthContextResponse;
+            error: null;
+        } | {
             data: null;
             error: {
                 message?: string | undefined;
                 status: number;
                 statusText: string;
             };
-        } | {
-            data: ApplicationAuthContextResponse;
-            error: null;
         }>;
         listCandidateOrganizations: (applicationId: string) => Promise<{
             data: ListCandidateOrganizationsResponse;
@@ -6079,6 +6079,8 @@ type AdminUserAccessApplication = {
     imageUrl: string | null;
     /** Effective role from entitlement rule evaluation. Null when the first matching rule denies access or no rule matches. */
     role: string | null;
+    /** User-facing name from the application role catalog. Null when no role matches. */
+    roleDisplayName: string | null;
 };
 /**
  * Team row in an admin user access report.
@@ -6135,6 +6137,42 @@ type AdminApplicationEntitlement = {
  * Entitlement record returned by entitlement mutation endpoints.
  */
 type AdminApplicationEntitlementRecord = Omit<AdminApplicationEntitlement, 'organization'>;
+/** Application-scoped role definition used by entitlement rules. */
+type AdminApplicationRole = {
+    applicationId: string;
+    name: string;
+    displayName: string;
+    description: string;
+};
+/** Options accepted when creating an application role. */
+type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId'>;
+/** Options accepted when updating an application role. */
+type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
+/** Kind of matcher an entitlement rule applies. */
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+/**
+ * A single access rule on an entitlement. Rules are evaluated in `position`
+ * order, first match wins. A non-null `role` grants access with that role; a
+ * null `role` denies access.
+ */
+type AdminEntitlementRule = {
+    type: AdminEntitlementRuleType;
+    value: string;
+    role: string | null;
+    position: number;
+};
+/** An entitlement together with its ordered access rules. */
+type AdminEntitlementWithRules = AdminApplicationEntitlementRecord & {
+    rules: AdminEntitlementRule[];
+};
+/** Options accepted when enabling or disabling an entitlement. */
+type UpdateAdminEntitlementOptions = {
+    enabled: boolean;
+};
+/** Options accepted when replacing all rules on an entitlement. */
+type SetAdminEntitlementRulesOptions = {
+    rules: AdminEntitlementRule[];
+};
 /**
  * Member preview returned alongside each admin application row.
  */
@@ -6268,12 +6306,68 @@ type InviteAdminOrganizationUsersResult = {
  */
 declare class AdminService {
     private client;
+    private apiUrl;
     /**
      * Creates a new AdminService instance.
      *
      * @param client - The API client for making admin requests
+     * @param apiUrl - The base URL of the authentication API, used to reach the
+     * application routes that the Better Auth client cannot address
      */
-    constructor(client: APIClient);
+    constructor(client: APIClient, apiUrl: string);
+    /**
+     * Requests an application management route.
+     *
+     * These routes are served by the API itself rather than by the Better Auth
+     * handler, so they sit outside the `/api/auth` base path that the Better
+     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
+     * authenticate with the session cookie alone; a bearer token must never be
+     * attached, since the API reads one only as an internal API key and would
+     * reject the request.
+     *
+     * @param path - Path relative to the API root, without a leading slash
+     * @param request - Method, body, and query parameters
+     * @returns The parsed JSON response
+     */
+    private requestApplicationRoute;
+    /**
+     * Lists applications, optionally filtered by organization.
+     *
+     * @param options - Pagination, ordering, organization filter, and search options
+     * @returns The application listing with entitlement details
+     */
+    listApplications(options?: ListAdminApplicationsOptions): Promise<ListAdminApplicationsResult>;
+    /**
+     * Creates an application.
+     *
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The created application
+     */
+    createApplication(options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Updates an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The updated application
+     */
+    updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /** Lists the role catalog for an application. */
+    listApplicationRoles(applicationId: string): Promise<AdminApplicationRole[]>;
+    /** Creates an application-scoped role definition. */
+    createApplicationRole(applicationId: string, options: CreateAdminApplicationRoleOptions): Promise<AdminApplicationRole>;
+    /** Updates an application-scoped role definition. */
+    updateApplicationRole(applicationId: string, currentName: string, options: UpdateAdminApplicationRoleOptions): Promise<AdminApplicationRole>;
+    /** Deletes an application-scoped role definition. */
+    deleteApplicationRole(applicationId: string, name: string): Promise<AdminApplicationRole>;
+    /**
+     * Enables an organization for an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Organization entitlement payload
+     * @returns The created entitlement
+     */
+    createApplicationEntitlement(applicationId: string, options: CreateAdminApplicationEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Lists all organizations, optionally with member and application previews
      * and totals when a preview size is requested.
@@ -6282,15 +6376,15 @@ declare class AdminService {
      * @returns The paginated organization listing
      */
     listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
-        data: ListAdminOrganizationsResult;
-        error: null;
-    } | {
         data: null;
         error: {
             message?: string | undefined;
             status: number;
             statusText: string;
         };
+    } | {
+        data: ListAdminOrganizationsResult;
+        error: null;
     }>;
     /**
      * Lists users as a global admin, optionally with organization previews
@@ -6393,6 +6487,36 @@ declare class AdminService {
     createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
         data: AdminOrganizationTeamRecord;
     } | null>;
+    /**
+     * Fetches a single entitlement together with its ordered access rules.
+     *
+     * @param entitlementId - ID of the entitlement to fetch
+     * @returns The entitlement and its rules
+     */
+    getEntitlement(entitlementId: string): Promise<AdminEntitlementWithRules>;
+    /**
+     * Replaces all access rules on an entitlement in a single call.
+     *
+     * @param entitlementId - ID of the entitlement whose rules are replaced
+     * @param options - The full set of rules to persist
+     * @returns The entitlement with the saved rules
+     */
+    setEntitlementRules(entitlementId: string, options: SetAdminEntitlementRulesOptions): Promise<AdminEntitlementWithRules>;
+    /**
+     * Enables or disables an entitlement.
+     *
+     * @param entitlementId - ID of the entitlement to update
+     * @param options - The desired enabled state
+     * @returns The updated entitlement
+     */
+    updateEntitlement(entitlementId: string, options: UpdateAdminEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
+    /**
+     * Deletes an entitlement and all of its access rules.
+     *
+     * @param entitlementId - ID of the entitlement to delete
+     * @returns The deleted entitlement
+     */
+    deleteEntitlement(entitlementId: string): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Creates an organization without adding the creator as a member.
      *
@@ -7419,4 +7543,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -4402,15 +4402,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 } & {
     applications: {
         getApplicationAuthContext: (applicationId: string) => Promise<{
+            data: ApplicationAuthContextResponse;
+            error: null;
+        } | {
             data: null;
             error: {
                 message?: string | undefined;
                 status: number;
                 statusText: string;
             };
-        } | {
-            data: ApplicationAuthContextResponse;
-            error: null;
         }>;
         listCandidateOrganizations: (applicationId: string) => Promise<{
             data: ListCandidateOrganizationsResponse;
@@ -6079,6 +6079,8 @@ type AdminUserAccessApplication = {
     imageUrl: string | null;
     /** Effective role from entitlement rule evaluation. Null when the first matching rule denies access or no rule matches. */
     role: string | null;
+    /** User-facing name from the application role catalog. Null when no role matches. */
+    roleDisplayName: string | null;
 };
 /**
  * Team row in an admin user access report.
@@ -6135,6 +6137,42 @@ type AdminApplicationEntitlement = {
  * Entitlement record returned by entitlement mutation endpoints.
  */
 type AdminApplicationEntitlementRecord = Omit<AdminApplicationEntitlement, 'organization'>;
+/** Application-scoped role definition used by entitlement rules. */
+type AdminApplicationRole = {
+    applicationId: string;
+    name: string;
+    displayName: string;
+    description: string;
+};
+/** Options accepted when creating an application role. */
+type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId'>;
+/** Options accepted when updating an application role. */
+type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
+/** Kind of matcher an entitlement rule applies. */
+type AdminEntitlementRuleType = 'email_equals' | 'email_domain_equals' | 'organization_member' | 'user_id_equals';
+/**
+ * A single access rule on an entitlement. Rules are evaluated in `position`
+ * order, first match wins. A non-null `role` grants access with that role; a
+ * null `role` denies access.
+ */
+type AdminEntitlementRule = {
+    type: AdminEntitlementRuleType;
+    value: string;
+    role: string | null;
+    position: number;
+};
+/** An entitlement together with its ordered access rules. */
+type AdminEntitlementWithRules = AdminApplicationEntitlementRecord & {
+    rules: AdminEntitlementRule[];
+};
+/** Options accepted when enabling or disabling an entitlement. */
+type UpdateAdminEntitlementOptions = {
+    enabled: boolean;
+};
+/** Options accepted when replacing all rules on an entitlement. */
+type SetAdminEntitlementRulesOptions = {
+    rules: AdminEntitlementRule[];
+};
 /**
  * Member preview returned alongside each admin application row.
  */
@@ -6268,12 +6306,68 @@ type InviteAdminOrganizationUsersResult = {
  */
 declare class AdminService {
     private client;
+    private apiUrl;
     /**
      * Creates a new AdminService instance.
      *
      * @param client - The API client for making admin requests
+     * @param apiUrl - The base URL of the authentication API, used to reach the
+     * application routes that the Better Auth client cannot address
      */
-    constructor(client: APIClient);
+    constructor(client: APIClient, apiUrl: string);
+    /**
+     * Requests an application management route.
+     *
+     * These routes are served by the API itself rather than by the Better Auth
+     * handler, so they sit outside the `/api/auth` base path that the Better
+     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
+     * authenticate with the session cookie alone; a bearer token must never be
+     * attached, since the API reads one only as an internal API key and would
+     * reject the request.
+     *
+     * @param path - Path relative to the API root, without a leading slash
+     * @param request - Method, body, and query parameters
+     * @returns The parsed JSON response
+     */
+    private requestApplicationRoute;
+    /**
+     * Lists applications, optionally filtered by organization.
+     *
+     * @param options - Pagination, ordering, organization filter, and search options
+     * @returns The application listing with entitlement details
+     */
+    listApplications(options?: ListAdminApplicationsOptions): Promise<ListAdminApplicationsResult>;
+    /**
+     * Creates an application.
+     *
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The created application
+     */
+    createApplication(options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Updates an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Application name, URLs, logo, and authentication settings
+     * @returns The updated application
+     */
+    updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /** Lists the role catalog for an application. */
+    listApplicationRoles(applicationId: string): Promise<AdminApplicationRole[]>;
+    /** Creates an application-scoped role definition. */
+    createApplicationRole(applicationId: string, options: CreateAdminApplicationRoleOptions): Promise<AdminApplicationRole>;
+    /** Updates an application-scoped role definition. */
+    updateApplicationRole(applicationId: string, currentName: string, options: UpdateAdminApplicationRoleOptions): Promise<AdminApplicationRole>;
+    /** Deletes an application-scoped role definition. */
+    deleteApplicationRole(applicationId: string, name: string): Promise<AdminApplicationRole>;
+    /**
+     * Enables an organization for an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Organization entitlement payload
+     * @returns The created entitlement
+     */
+    createApplicationEntitlement(applicationId: string, options: CreateAdminApplicationEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Lists all organizations, optionally with member and application previews
      * and totals when a preview size is requested.
@@ -6282,15 +6376,15 @@ declare class AdminService {
      * @returns The paginated organization listing
      */
     listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
-        data: ListAdminOrganizationsResult;
-        error: null;
-    } | {
         data: null;
         error: {
             message?: string | undefined;
             status: number;
             statusText: string;
         };
+    } | {
+        data: ListAdminOrganizationsResult;
+        error: null;
     }>;
     /**
      * Lists users as a global admin, optionally with organization previews
@@ -6393,6 +6487,36 @@ declare class AdminService {
     createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
         data: AdminOrganizationTeamRecord;
     } | null>;
+    /**
+     * Fetches a single entitlement together with its ordered access rules.
+     *
+     * @param entitlementId - ID of the entitlement to fetch
+     * @returns The entitlement and its rules
+     */
+    getEntitlement(entitlementId: string): Promise<AdminEntitlementWithRules>;
+    /**
+     * Replaces all access rules on an entitlement in a single call.
+     *
+     * @param entitlementId - ID of the entitlement whose rules are replaced
+     * @param options - The full set of rules to persist
+     * @returns The entitlement with the saved rules
+     */
+    setEntitlementRules(entitlementId: string, options: SetAdminEntitlementRulesOptions): Promise<AdminEntitlementWithRules>;
+    /**
+     * Enables or disables an entitlement.
+     *
+     * @param entitlementId - ID of the entitlement to update
+     * @param options - The desired enabled state
+     * @returns The updated entitlement
+     */
+    updateEntitlement(entitlementId: string, options: UpdateAdminEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
+    /**
+     * Deletes an entitlement and all of its access rules.
+     *
+     * @param entitlementId - ID of the entitlement to delete
+     * @returns The deleted entitlement
+     */
+    deleteEntitlement(entitlementId: string): Promise<AdminApplicationEntitlementRecord>;
     /**
      * Creates an organization without adding the creator as a member.
      *
@@ -7419,4 +7543,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -8,7 +8,7 @@ import { defaultStatements } from 'better-auth/plugins/organization/access';
 import z, { z as z$1 } from 'zod';
 export { APIError } from 'better-auth';
 
-const version = "1.33.1";
+const version = "1.35.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -408,14 +408,143 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
   });
 }
 
+async function readErrorMessage(response) {
+  try {
+    const body = await response.json();
+    return body.error ?? body.message ?? response.statusText;
+  } catch {
+    return response.statusText;
+  }
+}
 class AdminService {
   /**
    * Creates a new AdminService instance.
    *
    * @param client - The API client for making admin requests
+   * @param apiUrl - The base URL of the authentication API, used to reach the
+   * application routes that the Better Auth client cannot address
    */
-  constructor(client) {
+  constructor(client, apiUrl) {
     this.client = client;
+    this.apiUrl = apiUrl;
+  }
+  /**
+   * Requests an application management route.
+   *
+   * These routes are served by the API itself rather than by the Better Auth
+   * handler, so they sit outside the `/api/auth` base path that the Better
+   * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
+   * authenticate with the session cookie alone; a bearer token must never be
+   * attached, since the API reads one only as an internal API key and would
+   * reject the request.
+   *
+   * @param path - Path relative to the API root, without a leading slash
+   * @param request - Method, body, and query parameters
+   * @returns The parsed JSON response
+   */
+  async requestApplicationRoute(path, request = {}) {
+    const base = this.apiUrl.endsWith("/") ? this.apiUrl : `${this.apiUrl}/`;
+    const url = new URL(path, base);
+    for (const [key, value] of Object.entries(request.query ?? {})) {
+      if (value !== void 0)
+        url.searchParams.set(key, String(value));
+    }
+    const headers = new Headers({ Accept: "application/json" });
+    if (request.body !== void 0)
+      headers.set("Content-Type", "application/json");
+    const response = await fetch(url, {
+      method: request.method ?? "GET",
+      credentials: "include",
+      headers,
+      ...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {}
+    });
+    if (!response.ok)
+      throw new Error(await readErrorMessage(response));
+    return await response.json();
+  }
+  /**
+   * Lists applications, optionally filtered by organization.
+   *
+   * @param options - Pagination, ordering, organization filter, and search options
+   * @returns The application listing with entitlement details
+   */
+  async listApplications(options = {}) {
+    return await this.requestApplicationRoute("applications", {
+      query: {
+        limit: options.limit,
+        membersPreview: options.membersPreview,
+        offset: options.offset,
+        orderBy: options.orderBy,
+        orderDirection: options.orderDirection,
+        organizationId: options.organizationId,
+        search: options.search
+      }
+    });
+  }
+  /**
+   * Creates an application.
+   *
+   * @param options - Application name, URLs, logo, and authentication settings
+   * @returns The created application
+   */
+  async createApplication(options) {
+    return await this.requestApplicationRoute("applications", {
+      method: "POST",
+      body: options
+    });
+  }
+  /**
+   * Updates an application.
+   *
+   * @param applicationId - ID of the application to update
+   * @param options - Application name, URLs, logo, and authentication settings
+   * @returns The updated application
+   */
+  async updateApplication(applicationId, options) {
+    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}`, {
+      method: "PUT",
+      body: options
+    });
+  }
+  /** Lists the role catalog for an application. */
+  async listApplicationRoles(applicationId) {
+    return await this.requestApplicationRoute(
+      `applications/${encodeURIComponent(applicationId)}/roles`
+    );
+  }
+  /** Creates an application-scoped role definition. */
+  async createApplicationRole(applicationId, options) {
+    return await this.requestApplicationRoute(
+      `applications/${encodeURIComponent(applicationId)}/roles`,
+      { method: "POST", body: options }
+    );
+  }
+  /** Updates an application-scoped role definition. */
+  async updateApplicationRole(applicationId, currentName, options) {
+    return await this.requestApplicationRoute(
+      `applications/${encodeURIComponent(applicationId)}/roles/${encodeURIComponent(currentName)}`,
+      { method: "PUT", body: options }
+    );
+  }
+  /** Deletes an application-scoped role definition. */
+  async deleteApplicationRole(applicationId, name) {
+    return await this.requestApplicationRoute(
+      `applications/${encodeURIComponent(applicationId)}/roles/${encodeURIComponent(name)}`,
+      { method: "DELETE" }
+    );
+  }
+  /**
+   * Enables an organization for an application.
+   *
+   * @param applicationId - ID of the application to update
+   * @param options - Organization entitlement payload
+   * @returns The created entitlement
+   */
+  async createApplicationEntitlement(applicationId, options) {
+    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/entitlements`, {
+      method: "POST",
+      body: options
+    });
   }
   /**
    * Lists all organizations, optionally with member and application previews
@@ -586,6 +715,55 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Fetches a single entitlement together with its ordered access rules.
+   *
+   * @param entitlementId - ID of the entitlement to fetch
+   * @returns The entitlement and its rules
+   */
+  async getEntitlement(entitlementId) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}`
+    );
+  }
+  /**
+   * Replaces all access rules on an entitlement in a single call.
+   *
+   * @param entitlementId - ID of the entitlement whose rules are replaced
+   * @param options - The full set of rules to persist
+   * @returns The entitlement with the saved rules
+   */
+  async setEntitlementRules(entitlementId, options) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}/rules`,
+      { method: "PUT", body: options }
+    );
+  }
+  /**
+   * Enables or disables an entitlement.
+   *
+   * @param entitlementId - ID of the entitlement to update
+   * @param options - The desired enabled state
+   * @returns The updated entitlement
+   */
+  async updateEntitlement(entitlementId, options) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
+      { method: "PUT", body: options }
+    );
+  }
+  /**
+   * Deletes an entitlement and all of its access rules.
+   *
+   * @param entitlementId - ID of the entitlement to delete
+   * @returns The deleted entitlement
+   */
+  async deleteEntitlement(entitlementId) {
+    return await this.requestApplicationRoute(
+      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
+      { method: "DELETE" }
+    );
+  }
   /**
    * Creates an organization without adding the creator as a member.
    *
@@ -1980,7 +2158,7 @@ class AuthClient {
     this.emailOtp = new EmailOTPService(this.client);
     this.sessionAssurance = new SessionAssuranceService(this.client);
     this.user = new UserService(this.client);
-    this.admin = new AdminService(this.client);
+    this.admin = new AdminService(this.client, apiUrl);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.33.1",
+  "version": "1.35.0",
   "type": "module",
   "exports": {
     ".": {