@meistrari/auth-core 1.36.0 → 1.38.0

package/dist/index.d.mts

@@ -5745,6 +5745,12 @@ type ListAdminUsersOptions = {
      * are merged into the listing, grouped by email. Defaults to false.
      */
     includeInvitations?: boolean;
+    /**
+     * Restricts the listing to users with an active membership in this
+     * organization, and to invitations sent by it. Ignored for an organization
+     * admin, whose listing is always pinned to their own organization.
+     */
+    organizationId?: string;
 };
 /**
  * Organization preview returned alongside each admin user row.
@@ -6516,10 +6522,12 @@ declare class AdminService {
         error: null;
     }>;
     /**
-     * Lists users as a global admin, optionally with organization previews
-     * and totals when a preview size is requested.
+     * Lists users, optionally with organization previews and totals when a
+     * preview size is requested. Global admins list across every organization
+     * and may narrow to one with organizationId; an organization admin always
+     * gets their own organization's users, without previews.
      *
-     * @param options - Pagination, ordering, search, and preview options
+     * @param options - Pagination, ordering, search, preview, and organization options
      * @returns The paginated user listing
      */
     listUsers(options?: ListAdminUsersOptions): Promise<{
@@ -6591,7 +6599,8 @@ declare class AdminService {
         error: null;
     }>;
     /**
-     * Lists teams for one organization as a global admin.
+     * Lists teams for one organization. Global admins may list any organization;
+     * an organization admin only their own.
      *
      * @param options - Organization ID, pagination, search, and ordering options
      * @returns The paginated organization team listing
@@ -6656,7 +6665,10 @@ declare class AdminService {
         data: AdminOrganization;
     } | null>;
     /**
-     * Updates an organization's profile and settings.
+     * Updates an organization's profile and settings. Global admins may update
+     * any organization; an organization admin only their own, and only the
+     * fields they own — the slug, metadata, and billing configuration stay
+     * global admin territory.
      *
      * @param options - Organization ID and the fields to update
      * @returns The updated organization
@@ -6733,6 +6745,25 @@ declare class AdminService {
     } | null>;
 }
 
+/**
+ * Optional related data that can be included when listing organizations.
+ */
+type ListOrganizationsOptions = {
+    /** Additional organization data to include in the response. */
+    include?: readonly 'role'[];
+};
+/**
+ * Organization list options that guarantee the current user's membership role.
+ */
+type ListOrganizationsWithRoleOptions = {
+    include: readonly ['role', ...'role'[]];
+};
+/**
+ * An organization with the current user's membership role.
+ */
+type OrganizationWithRole = ExtendedOrganization & {
+    role: string;
+};
 /**
  * Result of accepting an organization invitation.
  */
@@ -6760,6 +6791,10 @@ type ListMembersOptions = {
     limit?: number;
     /** Number of members to skip for pagination. */
     offset?: number;
+    /** Member field used to order the page. */
+    sortBy?: 'createdAt';
+    /** Sort direction for the member page. */
+    sortDirection?: 'asc' | 'desc';
 };
 /**
  * Options for inviting a user to the active organization.
@@ -6804,7 +6839,10 @@ type UpdateMemberRoleOptions = {
 /**
  * Payload for creating a new team.
  */
-type CreateTeamPayload = Pick<Team, 'name'>;
+type CreateTeamPayload = Pick<Team, 'name'> & {
+    /** User IDs of organization members to add to the team as it is created. */
+    memberIds?: string[];
+};
 /**
  * Payload for updating an existing team.
  */
@@ -6877,9 +6915,11 @@ declare class OrganizationService {
     /**
      * Lists all organizations accessible to the current user.
      *
+     * @param options - Optional related organization data to include
      * @returns An array of organizations
      */
-    listOrganizations(): Promise<ExtendedOrganization[]>;
+    listOrganizations(options: ListOrganizationsWithRoleOptions): Promise<OrganizationWithRole[]>;
+    listOrganizations(options?: ListOrganizationsOptions): Promise<ExtendedOrganization[]>;
     /**
      * Sets the active organization for the current user session.
      *
@@ -7010,6 +7050,8 @@ declare class OrganizationService {
      * Removes a user from the active organization.
      *
      * @param options - Provide either `memberId` or `userEmail` to identify the user
+     * @param options.memberId - Membership ID to remove
+     * @param options.userEmail - Email address of the member to remove
      */
     removeUserFromOrganization({ memberId, userEmail }: RemoveUserFromOrganizationOptions): Promise<void>;
     /**
@@ -7023,7 +7065,7 @@ declare class OrganizationService {
     /**
      * Creates a new team within the active organization.
      *
-     * @param payload - Team configuration with a `name` field
+     * @param payload - Team configuration with a `name` field and optional `memberIds`
      * @returns The created team
      */
     createTeam(payload: CreateTeamPayload): Promise<{
@@ -7699,4 +7741,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -5745,6 +5745,12 @@ type ListAdminUsersOptions = {
      * are merged into the listing, grouped by email. Defaults to false.
      */
     includeInvitations?: boolean;
+    /**
+     * Restricts the listing to users with an active membership in this
+     * organization, and to invitations sent by it. Ignored for an organization
+     * admin, whose listing is always pinned to their own organization.
+     */
+    organizationId?: string;
 };
 /**
  * Organization preview returned alongside each admin user row.
@@ -6516,10 +6522,12 @@ declare class AdminService {
         error: null;
     }>;
     /**
-     * Lists users as a global admin, optionally with organization previews
-     * and totals when a preview size is requested.
+     * Lists users, optionally with organization previews and totals when a
+     * preview size is requested. Global admins list across every organization
+     * and may narrow to one with organizationId; an organization admin always
+     * gets their own organization's users, without previews.
      *
-     * @param options - Pagination, ordering, search, and preview options
+     * @param options - Pagination, ordering, search, preview, and organization options
      * @returns The paginated user listing
      */
     listUsers(options?: ListAdminUsersOptions): Promise<{
@@ -6591,7 +6599,8 @@ declare class AdminService {
         error: null;
     }>;
     /**
-     * Lists teams for one organization as a global admin.
+     * Lists teams for one organization. Global admins may list any organization;
+     * an organization admin only their own.
      *
      * @param options - Organization ID, pagination, search, and ordering options
      * @returns The paginated organization team listing
@@ -6656,7 +6665,10 @@ declare class AdminService {
         data: AdminOrganization;
     } | null>;
     /**
-     * Updates an organization's profile and settings.
+     * Updates an organization's profile and settings. Global admins may update
+     * any organization; an organization admin only their own, and only the
+     * fields they own — the slug, metadata, and billing configuration stay
+     * global admin territory.
      *
      * @param options - Organization ID and the fields to update
      * @returns The updated organization
@@ -6733,6 +6745,25 @@ declare class AdminService {
     } | null>;
 }
 
+/**
+ * Optional related data that can be included when listing organizations.
+ */
+type ListOrganizationsOptions = {
+    /** Additional organization data to include in the response. */
+    include?: readonly 'role'[];
+};
+/**
+ * Organization list options that guarantee the current user's membership role.
+ */
+type ListOrganizationsWithRoleOptions = {
+    include: readonly ['role', ...'role'[]];
+};
+/**
+ * An organization with the current user's membership role.
+ */
+type OrganizationWithRole = ExtendedOrganization & {
+    role: string;
+};
 /**
  * Result of accepting an organization invitation.
  */
@@ -6760,6 +6791,10 @@ type ListMembersOptions = {
     limit?: number;
     /** Number of members to skip for pagination. */
     offset?: number;
+    /** Member field used to order the page. */
+    sortBy?: 'createdAt';
+    /** Sort direction for the member page. */
+    sortDirection?: 'asc' | 'desc';
 };
 /**
  * Options for inviting a user to the active organization.
@@ -6804,7 +6839,10 @@ type UpdateMemberRoleOptions = {
 /**
  * Payload for creating a new team.
  */
-type CreateTeamPayload = Pick<Team, 'name'>;
+type CreateTeamPayload = Pick<Team, 'name'> & {
+    /** User IDs of organization members to add to the team as it is created. */
+    memberIds?: string[];
+};
 /**
  * Payload for updating an existing team.
  */
@@ -6877,9 +6915,11 @@ declare class OrganizationService {
     /**
      * Lists all organizations accessible to the current user.
      *
+     * @param options - Optional related organization data to include
      * @returns An array of organizations
      */
-    listOrganizations(): Promise<ExtendedOrganization[]>;
+    listOrganizations(options: ListOrganizationsWithRoleOptions): Promise<OrganizationWithRole[]>;
+    listOrganizations(options?: ListOrganizationsOptions): Promise<ExtendedOrganization[]>;
     /**
      * Sets the active organization for the current user session.
      *
@@ -7010,6 +7050,8 @@ declare class OrganizationService {
      * Removes a user from the active organization.
      *
      * @param options - Provide either `memberId` or `userEmail` to identify the user
+     * @param options.memberId - Membership ID to remove
+     * @param options.userEmail - Email address of the member to remove
      */
     removeUserFromOrganization({ memberId, userEmail }: RemoveUserFromOrganizationOptions): Promise<void>;
     /**
@@ -7023,7 +7065,7 @@ declare class OrganizationService {
     /**
      * Creates a new team within the active organization.
      *
-     * @param payload - Team configuration with a `name` field
+     * @param payload - Team configuration with a `name` field and optional `memberIds`
      * @returns The created team
      */
     createTeam(payload: CreateTeamPayload): Promise<{
@@ -7699,4 +7741,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "1.36.0";
+const version = "1.38.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -652,10 +652,12 @@ class AdminService {
     });
   }
   /**
-   * Lists users as a global admin, optionally with organization previews
-   * and totals when a preview size is requested.
+   * Lists users, optionally with organization previews and totals when a
+   * preview size is requested. Global admins list across every organization
+   * and may narrow to one with organizationId; an organization admin always
+   * gets their own organization's users, without previews.
    *
-   * @param options - Pagination, ordering, search, and preview options
+   * @param options - Pagination, ordering, search, preview, and organization options
    * @returns The paginated user listing
    */
   async listUsers(options = {}) {
@@ -668,7 +670,8 @@ class AdminService {
         ...options.sortDirection ? { sortDirection: options.sortDirection } : {},
         ...options.query ? { query: options.query } : {},
         ...options.organizationsPreview !== void 0 ? { organizations_preview: options.organizationsPreview } : {},
-        ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {}
+        ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {},
+        ...options.organizationId ? { organization_id: options.organizationId } : {}
       }
     });
   }
@@ -766,7 +769,8 @@ class AdminService {
     });
   }
   /**
-   * Lists teams for one organization as a global admin.
+   * Lists teams for one organization. Global admins may list any organization;
+   * an organization admin only their own.
    *
    * @param options - Organization ID, pagination, search, and ordering options
    * @returns The paginated organization team listing
@@ -862,7 +866,10 @@ class AdminService {
     return data;
   }
   /**
-   * Updates an organization's profile and settings.
+   * Updates an organization's profile and settings. Global admins may update
+   * any organization; an organization admin only their own, and only the
+   * fields they own — the slug, metadata, and billing configuration stay
+   * global admin territory.
    *
    * @param options - Organization ID and the fields to update
    * @returns The updated organization
@@ -1572,14 +1579,10 @@ class OrganizationService {
     });
     return organization;
   }
-  /**
-   * Lists all organizations accessible to the current user.
-   *
-   * @returns An array of organizations
-   */
-  async listOrganizations() {
-    const organizations = await this.client.organization.list();
-    return organizations;
+  async listOrganizations(options = {}) {
+    return await this.client.organization.list({
+      query: options.include?.length ? { include: options.include.join(",") } : void 0
+    });
   }
   /**
    * Sets the active organization for the current user session.
@@ -1683,6 +1686,8 @@ class OrganizationService {
    * Removes a user from the active organization.
    *
    * @param options - Provide either `memberId` or `userEmail` to identify the user
+   * @param options.memberId - Membership ID to remove
+   * @param options.userEmail - Email address of the member to remove
    */
   async removeUserFromOrganization({ memberId, userEmail }) {
     await this.client.organization.removeMember({
@@ -1705,7 +1710,7 @@ class OrganizationService {
   /**
    * Creates a new team within the active organization.
    *
-   * @param payload - Team configuration with a `name` field
+   * @param payload - Team configuration with a `name` field and optional `memberIds`
    * @returns The created team
    */
   async createTeam(payload) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.36.0",
+  "version": "1.38.0",
   "type": "module",
   "exports": {
     ".": {