@meistrari/auth-core 1.35.0 → 1.37.0

package/dist/index.d.ts

@@ -92,7 +92,7 @@ type AssuranceFields = {
 };
 
 declare const ac: {
-    newRole<K extends "member" | "access" | "organization" | "invitation" | "team" | "ac">(statements: better_auth_plugins.Subset<K, {
+    newRole<K extends "organization" | "ac" | "member" | "access" | "invitation" | "team">(statements: better_auth_plugins.Subset<K, {
         access: string[];
         organization: readonly ["update", "delete"];
         member: readonly ["create", "update", "delete"];
@@ -166,7 +166,7 @@ type Role = typeof Roles[keyof typeof Roles];
  */
 declare const rolesAccessControl: {
     "org:admin": {
-        authorize<K_1 extends "member" | "access" | "organization" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins.Subset<"member" | "access" | "organization" | "invitation" | "team", {
+        authorize<K_1 extends "organization" | "member" | "access" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins.Subset<"organization" | "member" | "access" | "invitation" | "team", {
             access: string[];
             organization: readonly ["update", "delete"];
             member: readonly ["create", "update", "delete"];
@@ -174,7 +174,7 @@ declare const rolesAccessControl: {
             team: readonly ["create", "update", "delete"];
             ac: readonly ["create", "read", "update", "delete"];
         }>[key] | {
-            actions: better_auth_plugins.Subset<"member" | "access" | "organization" | "invitation" | "team", {
+            actions: better_auth_plugins.Subset<"organization" | "member" | "access" | "invitation" | "team", {
                 access: string[];
                 organization: readonly ["update", "delete"];
                 member: readonly ["create", "update", "delete"];
@@ -184,7 +184,7 @@ declare const rolesAccessControl: {
             }>[key];
             connector: "OR" | "AND";
         } | undefined; } : never, connector?: "OR" | "AND"): better_auth_plugins.AuthorizeResponse;
-        statements: better_auth_plugins.Subset<"member" | "access" | "organization" | "invitation" | "team", {
+        statements: better_auth_plugins.Subset<"organization" | "member" | "access" | "invitation" | "team", {
             access: string[];
             organization: readonly ["update", "delete"];
             member: readonly ["create", "update", "delete"];
@@ -370,6 +370,30 @@ type JWTPayloadData = {
 declare const JWTPayload: z$1.ZodType<JWTPayloadData>;
 type JWTPayload = JWTPayload$1 & JWTPayloadData;
 
+/**
+ * Checks if a JWT token has expired or will expire within a specified time window.
+ *
+ * @param token - The JWT token string to check
+ * @param expiresInMs - Optional time window in milliseconds. If provided, returns `true` if the token will expire within this time window
+ * @returns `true` if the token is expired (or will expire within the specified window), `false` otherwise
+ *
+ * @example
+ * ```typescript
+ * const token = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...'
+ *
+ * // Check if token is already expired
+ * if (isTokenExpired(token)) {
+ *   console.log('Token has expired')
+ * }
+ *
+ * // Check if token will expire in the next 5 minutes
+ * if (isTokenExpired(token, 5 * 60 * 1000)) {
+ *   console.log('Token will expire in the next 5 minutes')
+ * }
+ * ```
+ */
+declare function isTokenExpired(token: string, expiresInMs?: number): boolean;
+
 declare const OAuthStepUpProvider: z.ZodEnum<{
     google: "google";
     microsoft: "microsoft";
@@ -631,6 +655,24 @@ type CompleteAuthorizationFlowResponse = {
     /** Assurance context embedded in the issued access token. */
     assurance: JWTPayload['assurance'];
 };
+/**
+ * Credentials used to authenticate an application service account.
+ */
+type ClientCredentialsGrant = {
+    /** The application identifier. */
+    clientId: string;
+    /** A valid secret issued for the application. */
+    clientSecret: string;
+    /** The organization to scope the access token to. */
+    organizationId: string;
+};
+/**
+ * Response returned after a successful client credentials exchange.
+ *
+ * Client credentials issue only a short-lived access token, so this response
+ * intentionally does not include a refresh token.
+ */
+type ClientCredentialsTokenResponse = Omit<CompleteAuthorizationFlowResponse, 'refreshToken'>;
 /**
  * Response returned by the "who am I" endpoint.
  *
@@ -815,6 +857,7 @@ declare function isSessionAssuranceSufficient(sessionAssurance: JWTPayload['assu
  * Provides functionality for:
  * - OAuth authorization code flow (PKCE)
  * - Device authorization flow (RFC 8628)
+ * - Client credentials flow for service accounts
  * - Token management (refresh, exchange)
  * - Organization switching
  */
@@ -905,6 +948,16 @@ declare class ApplicationService {
      * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
      */
     exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
+    /**
+     * Exchanges application client credentials for a service-account access token.
+     *
+     * The returned token is scoped to the requested organization and cannot be
+     * refreshed. Exchange the credentials again when a new token is needed.
+     *
+     * @param credentials - Application credentials and target organization
+     * @returns A short-lived access token with service-account and organization details
+     */
+    exchangeClientCredentialsForToken(credentials: ClientCredentialsGrant): Promise<ClientCredentialsTokenResponse>;
     /**
      * Completes an authorization flow for a specific application.
      *
@@ -2667,10 +2720,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }, {
             code?: string | undefined;
@@ -2740,10 +2793,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }) | (Omit<{
             token: string;
@@ -2776,10 +2829,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }), {
             code?: string | undefined;
@@ -2834,10 +2887,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }) | (Omit<{
             token: string;
@@ -2870,10 +2923,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }), {
             code?: string | undefined;
@@ -3501,10 +3554,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }) | (Omit<{
             status: boolean;
@@ -3538,10 +3591,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }), {
             code?: string | undefined;
@@ -3593,10 +3646,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }, {
             code?: string | undefined;
@@ -3760,10 +3813,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }), {
             code?: string | undefined;
@@ -3797,11 +3850,11 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             callbackURL?: string | undefined;
             fetchOptions?: FetchOptions | undefined;
         } & {} & {} & {} & {} & {} & {
-            lastActiveAt?: Date | null | undefined;
             displayName?: string | null | undefined;
             title?: string | null | undefined;
             pronouns?: string | null | undefined;
             preferredLanguage?: string | null | undefined;
+            lastActiveAt?: Date | null | undefined;
         }>, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<(Omit<{
             token: null;
             user: {
@@ -3833,10 +3886,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }) | (Omit<{
             token: string;
@@ -3869,10 +3922,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }), {
             code?: string | undefined;
@@ -3926,10 +3979,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
         }, {
             code?: string | undefined;
@@ -4049,10 +4102,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
         } & {
             preferredLanguage: string;
         } & {
-            lastActiveAt?: Date | null | undefined;
             displayName?: string | null | undefined;
             title?: string | null | undefined;
             pronouns?: string | null | undefined;
+            lastActiveAt?: Date | null | undefined;
         }>;
     }, {
         code?: string | undefined;
@@ -4085,11 +4138,11 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
         name?: string | undefined;
         fetchOptions?: FetchOptions | undefined;
     } & Partial<{} & {} & {} & {} & {} & {
-        lastActiveAt?: Date | null | undefined;
         displayName?: string | null | undefined;
         title?: string | null | undefined;
         pronouns?: string | null | undefined;
         preferredLanguage?: string | null | undefined;
+        lastActiveAt?: Date | null | undefined;
     }>> | undefined, data_1?: FetchOptions | undefined) => Promise<better_auth_client.BetterFetchResponse<{
         status: boolean;
     }, {
@@ -4375,10 +4428,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
         } & {
             preferredLanguage: string;
         } & {
-            lastActiveAt?: Date | null | undefined;
             displayName?: string | null | undefined;
             title?: string | null | undefined;
             pronouns?: string | null | undefined;
+            lastActiveAt?: Date | null | undefined;
         }>;
         session: better_auth.StripEmptyObjects<{
             id: string;
@@ -4402,15 +4455,15 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
 } & {
     applications: {
         getApplicationAuthContext: (applicationId: string) => Promise<{
-            data: ApplicationAuthContextResponse;
-            error: null;
-        } | {
             data: null;
             error: {
                 message?: string | undefined;
                 status: number;
                 statusText: string;
             };
+        } | {
+            data: ApplicationAuthContextResponse;
+            error: null;
         }>;
         listCandidateOrganizations: (applicationId: string) => Promise<{
             data: ListCandidateOrganizationsResponse;
@@ -4482,6 +4535,17 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             data: CompleteAuthorizationFlowResponse;
             error: null;
         }>;
+        exchangeClientCredentialsForToken: (credentials: ClientCredentialsGrant) => Promise<{
+            data: ClientCredentialsTokenResponse;
+            error: null;
+        } | {
+            data: null;
+            error: {
+                message?: string | undefined;
+                status: number;
+                statusText: string;
+            };
+        }>;
         completeAuthorizationFlow: (code: string, codeVerifier: string) => Promise<{
             data: null;
             error: {
@@ -4759,10 +4823,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
             session: better_auth.StripEmptyObjects<{
                 id: string;
@@ -4879,10 +4943,10 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
             } & {
                 preferredLanguage: string;
             } & {
-                lastActiveAt?: Date | null | undefined;
                 displayName?: string | null | undefined;
                 title?: string | null | undefined;
                 pronouns?: string | null | undefined;
+                lastActiveAt?: Date | null | undefined;
             }>;
             session: better_auth.StripEmptyObjects<{
                 id: string;
@@ -5767,6 +5831,39 @@ type CreateAdminApplicationEntitlementOptions = {
     /** Organization that should be entitled to the application. */
     organizationId: string;
 };
+/**
+ * Options accepted when creating a client secret for an application.
+ */
+type CreateAdminApplicationSecretOptions = {
+    /** Optional display name for the secret. */
+    name?: string;
+};
+/**
+ * Client secret metadata returned by application management endpoints.
+ */
+type AdminApplicationSecret = {
+    id: string;
+    applicationId: string;
+    name: string | null;
+    /** First characters of the secret, kept for later identification. */
+    start: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+};
+/**
+ * Service-account identity backing client-credentials tokens for an application.
+ */
+type AdminApplicationIdentity = {
+    id: string;
+    email: string;
+};
+/**
+ * Newly-created client secret. The plaintext secret is returned only once.
+ */
+type CreatedAdminApplicationSecret = AdminApplicationSecret & {
+    secret: string;
+    serviceAccountUser: AdminApplicationIdentity;
+};
 /**
  * Options accepted when fetching a single organization as a global admin.
  */
@@ -6193,6 +6290,8 @@ type AdminApplication = {
     redirectUris: string[];
     homeUrl: string | null;
     config: ApplicationConfig | null;
+    serviceAccountUserId: string | null;
+    serviceAccountUser?: AdminApplicationIdentity | null;
     createdBy: string;
     updatedBy: string;
     createdAt: string;
@@ -6368,6 +6467,36 @@ declare class AdminService {
      * @returns The created entitlement
      */
     createApplicationEntitlement(applicationId: string, options: CreateAdminApplicationEntitlementOptions): Promise<AdminApplicationEntitlementRecord>;
+    /**
+     * Lists client secrets for an application.
+     *
+     * @param applicationId - ID of the application to inspect
+     * @returns Secret metadata without plaintext values
+     */
+    listApplicationSecrets(applicationId: string): Promise<AdminApplicationSecret[]>;
+    /**
+     * Creates a client secret for an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param options - Optional secret display name
+     * @returns The created secret, including the plaintext value shown only once
+     */
+    createApplicationSecret(applicationId: string, options?: CreateAdminApplicationSecretOptions): Promise<CreatedAdminApplicationSecret>;
+    /**
+     * Deletes one client secret for an application.
+     *
+     * @param applicationId - ID of the application to update
+     * @param secretId - ID of the secret to delete
+     * @returns The deleted secret metadata
+     */
+    deleteApplicationSecret(applicationId: string, secretId: string): Promise<AdminApplicationSecret>;
+    /**
+     * Retires an application's service-account identity.
+     *
+     * @param applicationId - ID of the application to update
+     * @returns The updated application
+     */
+    retireApplicationServiceAccount(applicationId: string): Promise<AdminApplicationRecord>;
     /**
      * Lists all organizations, optionally with member and application previews
      * and totals when a preview size is requested.
@@ -6604,6 +6733,25 @@ declare class AdminService {
     } | null>;
 }
 
+/**
+ * Optional related data that can be included when listing organizations.
+ */
+type ListOrganizationsOptions = {
+    /** Additional organization data to include in the response. */
+    include?: readonly 'role'[];
+};
+/**
+ * Organization list options that guarantee the current user's membership role.
+ */
+type ListOrganizationsWithRoleOptions = {
+    include: readonly ['role', ...'role'[]];
+};
+/**
+ * An organization with the current user's membership role.
+ */
+type OrganizationWithRole = ExtendedOrganization & {
+    role: string;
+};
 /**
  * Result of accepting an organization invitation.
  */
@@ -6748,9 +6896,11 @@ declare class OrganizationService {
     /**
      * Lists all organizations accessible to the current user.
      *
+     * @param options - Optional related organization data to include
      * @returns An array of organizations
      */
-    listOrganizations(): Promise<ExtendedOrganization[]>;
+    listOrganizations(options: ListOrganizationsWithRoleOptions): Promise<OrganizationWithRole[]>;
+    listOrganizations(options?: ListOrganizationsOptions): Promise<ExtendedOrganization[]>;
     /**
      * Sets the active organization for the current user session.
      *
@@ -7045,10 +7195,10 @@ declare class SessionService {
         } & {
             preferredLanguage: string;
         } & {
-            lastActiveAt?: Date | null | undefined;
             displayName?: string | null | undefined;
             title?: string | null | undefined;
             pronouns?: string | null | undefined;
+            lastActiveAt?: Date | null | undefined;
         }>;
         session: better_auth.StripEmptyObjects<{
             id: string;
@@ -7286,10 +7436,10 @@ declare class EmailOTPService {
         } & {
             preferredLanguage: string;
         } & {
-            lastActiveAt?: Date | null | undefined;
             displayName?: string | null | undefined;
             title?: string | null | undefined;
             pronouns?: string | null | undefined;
+            lastActiveAt?: Date | null | undefined;
         }>;
     }>;
 }
@@ -7339,10 +7489,10 @@ declare class UserService {
         } & {
             preferredLanguage: string;
         } & {
-            lastActiveAt?: Date | null | undefined;
             displayName?: string | null | undefined;
             title?: string | null | undefined;
             pronouns?: string | null | undefined;
+            lastActiveAt?: Date | null | undefined;
         }>;
     }>;
     updateProfile(profile: UpdateUserProfilePayload): Promise<{
@@ -7478,32 +7628,59 @@ declare class AuthClient {
     constructor(apiUrl: string, fetchOptions?: BetterFetchOption);
 }
 
-type DecodedJWTPayload = Omit<JWTPayload, 'assurance'> & {
-    assurance?: JWTPayloadAssurance;
+/** Configuration for an in-memory application token cache. */
+type ApplicationTokenStorageOptions = {
+    /** Base URL of the Auth API. */
+    authApiUrl: string;
+    /** Application identifier used for client-credentials exchanges. */
+    clientId: string;
+    /** Application secret used for client-credentials exchanges. */
+    clientSecret: string;
+    /** Full-jitter upper bound for the first retry delay. Defaults to 100 milliseconds. */
+    initialBackoffMs?: number;
+    /** Maximum number of exchange attempts, including the initial request. Defaults to 3. */
+    maxAttempts?: number;
+    /** Maximum number of organization tokens retained in memory. Defaults to 300. */
+    maxOrganizations?: number;
+};
+/** Per-call retry overrides for {@link ApplicationTokenStorage.getToken}. */
+type GetTokenOptions = {
+    /** Full-jitter upper bound for the first retry delay. */
+    initialBackoffMs?: number;
+    /** Maximum number of exchange attempts, including the initial request. */
+    maxAttempts?: number;
 };
 /**
- * Checks if a JWT token has expired or will expire within a specified time window.
- *
- * @param token - The JWT token string to check
- * @param expiresInMs - Optional time window in milliseconds. If provided, returns `true` if the token will expire within this time window
- * @returns `true` if the token is expired (or will expire within the specified window), `false` otherwise
+ * Caches organization-scoped application tokens in memory.
  *
- * @example
- * ```typescript
- * const token = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...'
- *
- * // Check if token is already expired
- * if (isTokenExpired(token)) {
- *   console.log('Token has expired')
- * }
- *
- * // Check if token will expire in the next 5 minutes
- * if (isTokenExpired(token, 5 * 60 * 1000)) {
- *   console.log('Token will expire in the next 5 minutes')
- * }
- * ```
+ * Tokens are reissued one minute before expiry. Cache hits promote their
+ * organization to the most-recently-used position, and insertions beyond the
+ * configured limit evict the least recently used organization. Transient
+ * exchange failures use full-jitter exponential backoff.
  */
-declare function isTokenExpired(token: string, expiresInMs?: number): boolean;
+declare class ApplicationTokenStorage {
+    private readonly auth;
+    private readonly clientId;
+    private readonly clientSecret;
+    private readonly initialBackoffMs;
+    private readonly inFlight;
+    private readonly maxAttempts;
+    private readonly maxOrganizations;
+    private readonly tokens;
+    /** Creates an application token cache for one client-credentials identity. */
+    constructor({ authApiUrl, clientId, clientSecret, initialBackoffMs, maxAttempts, maxOrganizations, }: ApplicationTokenStorageOptions);
+    /** Returns a fresh access token scoped to the requested organization. */
+    getToken(organizationId: string, { initialBackoffMs, maxAttempts, }?: GetTokenOptions): Promise<string>;
+    private exchangeTokenWithRetry;
+    /** Performs the client-credentials exchange for one organization. */
+    protected exchangeToken(organizationId: string): Promise<string>;
+    /** Waits before the next exchange attempt. */
+    protected wait(delayMs: number): Promise<void>;
+}
+
+type DecodedJWTPayload = Omit<JWTPayload, 'assurance'> & {
+    assurance?: JWTPayloadAssurance;
+};
 /**
  * Validates a JWT token by checking its expiration and verifying its signature
  * against the JWKS endpoint.
@@ -7542,5 +7719,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };