@meistrari/auth-core 1.39.3 → 1.41.0

package/dist/index.d.mts

@@ -1357,6 +1357,14 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 noncePayload: (nonce: string) => Promise<NoncePayloadResponse>;
             };
         };
+    } | {
+        id: "invitation-signup";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            invitationSignup: {
+                status: (invitationId: string) => Promise<InvitationSignupStatus>;
+                setupPassword: (invitationId: string, password: string) => Promise<InvitationPasswordSetupResult>;
+            };
+        };
     } | {
         id: "sso-client";
         version: string;
@@ -4450,6 +4458,28 @@ type CreateAdminOrganizationTeamOptions = {
     /** User IDs of organization members to add to the team. */
     memberIds?: string[];
 };
+/**
+ * Options accepted when updating an organization team as a global admin.
+ */
+type UpdateAdminOrganizationTeamOptions = {
+    /** ID of the organization that owns the team. */
+    organizationId: string;
+    /** ID of the team to update. */
+    teamId: string;
+    /** New display name of the team. */
+    name: string;
+    /** Complete replacement set of active organization member user IDs. */
+    memberIds?: string[];
+};
+/**
+ * Options accepted when deleting an organization team as a global admin.
+ */
+type DeleteAdminOrganizationTeamOptions = {
+    /** ID of the organization that owns the team. */
+    organizationId: string;
+    /** ID of the team to delete. */
+    teamId: string;
+};
 /**
  * Options accepted when updating an organization member's role as a global admin.
  */
@@ -5143,6 +5173,24 @@ declare class AdminService {
     createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
         data: AdminOrganizationTeamRecord;
     } | null>;
+    /**
+     * Updates a team for one organization. Global admins may update any
+     * organization; an organization admin only their own.
+     *
+     * @param options - Organization ID, team ID, new name, and optional replacement member IDs
+     * @returns The updated team
+     */
+    updateOrganizationTeam(options: UpdateAdminOrganizationTeamOptions): Promise<{
+        data: AdminOrganizationTeamRecord;
+    } | null>;
+    /**
+     * Deletes a team for one organization, detaching its members with it.
+     * Global admins may delete from any organization; an organization admin
+     * only from their own.
+     *
+     * @param options - Organization ID and team ID
+     */
+    deleteOrganizationTeam(options: DeleteAdminOrganizationTeamOptions): Promise<void>;
     /**
      * Fetches a single entitlement together with its ordered access rules.
      *
@@ -5368,6 +5416,33 @@ type CreateTeamPayload = Pick<Team, 'name'> & {
  */
 type UpdateTeamPayload = Pick<Team, 'name'>;
 
+/**
+ * Status of an invitation as seen by the pre-login invite flow.
+ *
+ * `email` and `requiresAccountSetup` are only present while the invitation is
+ * still pending; other statuses return the status alone.
+ */
+type InvitationSignupStatus = {
+    status: 'pending';
+    email: string;
+    /** True when the invited user has no account yet and has never signed in. */
+    requiresAccountSetup: boolean;
+} | {
+    status: 'accepted' | 'canceled' | 'rejected' | 'expired';
+};
+/**
+ * Result of creating a password from an invitation. The user is signed in
+ * as part of the call; the session cookie is set on the response.
+ */
+type InvitationPasswordSetupResult = {
+    token: string;
+    user: {
+        id: string;
+        email: string;
+        name: string;
+    };
+};
+
 /**
  * Service for managing organizations, members, invitations, and teams.
  *
@@ -5566,6 +5641,29 @@ declare class OrganizationService {
      *   and the configured post-acceptance URL for plain organization invitations.
      */
     acceptInvitation(id: string): Promise<AcceptInvitationResult>;
+    /**
+     * Gets the pre-login signup status for an invitation.
+     *
+     * Public endpoint keyed by the invitation id from the emailed invite link.
+     * While the invitation is pending, the result includes the invited email
+     * and whether the invited user still needs to set up their account.
+     *
+     * @param id - The invitation ID from the invite link
+     * @returns The invitation status with account-setup information
+     */
+    getInvitationSignupStatus(id: string): Promise<InvitationSignupStatus>;
+    /**
+     * Creates a password for an invited user who has no account yet.
+     *
+     * Only available once per invitation, while the invitation is pending and
+     * the invited user has never signed in. The user is signed in as part of
+     * the call; the session cookie is set on the response.
+     *
+     * @param id - The invitation ID from the invite link
+     * @param password - The password to create (minimum 8 characters)
+     * @returns The session token and signed-in user
+     */
+    setupInvitationPassword(id: string, password: string): Promise<InvitationPasswordSetupResult>;
     /**
      * Removes a user from the active organization.
      *
@@ -5671,6 +5769,8 @@ type SocialSignInOptions = {
     callbackURL: string;
     /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
     errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
 };
 /**
  * Options for signing in via SAML Single Sign-On.
@@ -5772,11 +5872,12 @@ declare class SessionService {
      * @param options.provider - The social provider
      * @param options.callbackURL - URL to redirect to after successful authentication
      * @param options.errorCallbackURL - URL to redirect to on error
+     * @param options.loginHint - Email to preselect at the provider
      *
      * @throws {InvalidSocialProvider} When the provider is not 'google' or 'microsoft'
      * @throws {InvalidCallbackURL} When callback URLs are malformed
      */
-    signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, }: SocialSignInOptions): Promise<void>;
+    signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
     /**
      * Initiates SAML-based Single Sign-On authentication flow.
      *
@@ -6275,4 +6376,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -1357,6 +1357,14 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 noncePayload: (nonce: string) => Promise<NoncePayloadResponse>;
             };
         };
+    } | {
+        id: "invitation-signup";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            invitationSignup: {
+                status: (invitationId: string) => Promise<InvitationSignupStatus>;
+                setupPassword: (invitationId: string, password: string) => Promise<InvitationPasswordSetupResult>;
+            };
+        };
     } | {
         id: "sso-client";
         version: string;
@@ -4450,6 +4458,28 @@ type CreateAdminOrganizationTeamOptions = {
     /** User IDs of organization members to add to the team. */
     memberIds?: string[];
 };
+/**
+ * Options accepted when updating an organization team as a global admin.
+ */
+type UpdateAdminOrganizationTeamOptions = {
+    /** ID of the organization that owns the team. */
+    organizationId: string;
+    /** ID of the team to update. */
+    teamId: string;
+    /** New display name of the team. */
+    name: string;
+    /** Complete replacement set of active organization member user IDs. */
+    memberIds?: string[];
+};
+/**
+ * Options accepted when deleting an organization team as a global admin.
+ */
+type DeleteAdminOrganizationTeamOptions = {
+    /** ID of the organization that owns the team. */
+    organizationId: string;
+    /** ID of the team to delete. */
+    teamId: string;
+};
 /**
  * Options accepted when updating an organization member's role as a global admin.
  */
@@ -5143,6 +5173,24 @@ declare class AdminService {
     createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
         data: AdminOrganizationTeamRecord;
     } | null>;
+    /**
+     * Updates a team for one organization. Global admins may update any
+     * organization; an organization admin only their own.
+     *
+     * @param options - Organization ID, team ID, new name, and optional replacement member IDs
+     * @returns The updated team
+     */
+    updateOrganizationTeam(options: UpdateAdminOrganizationTeamOptions): Promise<{
+        data: AdminOrganizationTeamRecord;
+    } | null>;
+    /**
+     * Deletes a team for one organization, detaching its members with it.
+     * Global admins may delete from any organization; an organization admin
+     * only from their own.
+     *
+     * @param options - Organization ID and team ID
+     */
+    deleteOrganizationTeam(options: DeleteAdminOrganizationTeamOptions): Promise<void>;
     /**
      * Fetches a single entitlement together with its ordered access rules.
      *
@@ -5368,6 +5416,33 @@ type CreateTeamPayload = Pick<Team, 'name'> & {
  */
 type UpdateTeamPayload = Pick<Team, 'name'>;
 
+/**
+ * Status of an invitation as seen by the pre-login invite flow.
+ *
+ * `email` and `requiresAccountSetup` are only present while the invitation is
+ * still pending; other statuses return the status alone.
+ */
+type InvitationSignupStatus = {
+    status: 'pending';
+    email: string;
+    /** True when the invited user has no account yet and has never signed in. */
+    requiresAccountSetup: boolean;
+} | {
+    status: 'accepted' | 'canceled' | 'rejected' | 'expired';
+};
+/**
+ * Result of creating a password from an invitation. The user is signed in
+ * as part of the call; the session cookie is set on the response.
+ */
+type InvitationPasswordSetupResult = {
+    token: string;
+    user: {
+        id: string;
+        email: string;
+        name: string;
+    };
+};
+
 /**
  * Service for managing organizations, members, invitations, and teams.
  *
@@ -5566,6 +5641,29 @@ declare class OrganizationService {
      *   and the configured post-acceptance URL for plain organization invitations.
      */
     acceptInvitation(id: string): Promise<AcceptInvitationResult>;
+    /**
+     * Gets the pre-login signup status for an invitation.
+     *
+     * Public endpoint keyed by the invitation id from the emailed invite link.
+     * While the invitation is pending, the result includes the invited email
+     * and whether the invited user still needs to set up their account.
+     *
+     * @param id - The invitation ID from the invite link
+     * @returns The invitation status with account-setup information
+     */
+    getInvitationSignupStatus(id: string): Promise<InvitationSignupStatus>;
+    /**
+     * Creates a password for an invited user who has no account yet.
+     *
+     * Only available once per invitation, while the invitation is pending and
+     * the invited user has never signed in. The user is signed in as part of
+     * the call; the session cookie is set on the response.
+     *
+     * @param id - The invitation ID from the invite link
+     * @param password - The password to create (minimum 8 characters)
+     * @returns The session token and signed-in user
+     */
+    setupInvitationPassword(id: string, password: string): Promise<InvitationPasswordSetupResult>;
     /**
      * Removes a user from the active organization.
      *
@@ -5671,6 +5769,8 @@ type SocialSignInOptions = {
     callbackURL: string;
     /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
     errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
 };
 /**
  * Options for signing in via SAML Single Sign-On.
@@ -5772,11 +5872,12 @@ declare class SessionService {
      * @param options.provider - The social provider
      * @param options.callbackURL - URL to redirect to after successful authentication
      * @param options.errorCallbackURL - URL to redirect to on error
+     * @param options.loginHint - Email to preselect at the provider
      *
      * @throws {InvalidSocialProvider} When the provider is not 'google' or 'microsoft'
      * @throws {InvalidCallbackURL} When callback URLs are malformed
      */
-    signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, }: SocialSignInOptions): Promise<void>;
+    signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
     /**
      * Initiates SAML-based Single Sign-On authentication flow.
      *
@@ -6275,4 +6376,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "1.39.3";
+const version = "1.41.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -389,6 +389,27 @@ function handshakePluginClient() {
   };
 }
 
+function invitationSignupPluginClient() {
+  return {
+    id: "invitation-signup",
+    getActions: ($fetch) => ({
+      invitationSignup: {
+        status: async (invitationId) => {
+          return await $fetch("/invitation/signup-status", {
+            query: { invitationId }
+          });
+        },
+        setupPassword: async (invitationId, password) => {
+          return await $fetch("/invitation/setup-password", {
+            method: "POST",
+            body: { invitationId, password }
+          });
+        }
+      }
+    })
+  };
+}
+
 function sessionAssurancePluginClient() {
   return {
     id: "session-assurance",
@@ -433,6 +454,7 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
       }),
       customEndpointsPluginClient(),
       handshakePluginClient(),
+      invitationSignupPluginClient(),
       ssoClient(),
       twoFactorClient(),
       jwtClient(),
@@ -826,6 +848,36 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Updates a team for one organization. Global admins may update any
+   * organization; an organization admin only their own.
+   *
+   * @param options - Organization ID, team ID, new name, and optional replacement member IDs
+   * @returns The updated team
+   */
+  async updateOrganizationTeam(options) {
+    const { data } = await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams/update`, {
+      method: "POST",
+      body: {
+        teamId: options.teamId,
+        name: options.name,
+        ...options.memberIds !== void 0 ? { memberIds: options.memberIds } : {}
+      }
+    });
+    return data;
+  }
+  /**
+   * Deletes a team for one organization, detaching its members with it.
+   * Global admins may delete from any organization; an organization admin
+   * only from their own.
+   *
+   * @param options - Organization ID and team ID
+   */
+  async deleteOrganizationTeam(options) {
+    await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams/${encodeURIComponent(options.teamId)}`, {
+      method: "DELETE"
+    });
+  }
   /**
    * Fetches a single entitlement together with its ordered access rules.
    *
@@ -1708,6 +1760,33 @@ class OrganizationService {
       member: response.member
     };
   }
+  /**
+   * Gets the pre-login signup status for an invitation.
+   *
+   * Public endpoint keyed by the invitation id from the emailed invite link.
+   * While the invitation is pending, the result includes the invited email
+   * and whether the invited user still needs to set up their account.
+   *
+   * @param id - The invitation ID from the invite link
+   * @returns The invitation status with account-setup information
+   */
+  async getInvitationSignupStatus(id) {
+    return await this.client.invitationSignup.status(id);
+  }
+  /**
+   * Creates a password for an invited user who has no account yet.
+   *
+   * Only available once per invitation, while the invitation is pending and
+   * the invited user has never signed in. The user is signed in as part of
+   * the call; the session cookie is set on the response.
+   *
+   * @param id - The invitation ID from the invite link
+   * @param password - The password to create (minimum 8 characters)
+   * @returns The session token and signed-in user
+   */
+  async setupInvitationPassword(id, password) {
+    return await this.client.invitationSignup.setupPassword(id, password);
+  }
   /**
    * Removes a user from the active organization.
    *
@@ -1874,6 +1953,7 @@ class SessionService {
    * @param options.provider - The social provider
    * @param options.callbackURL - URL to redirect to after successful authentication
    * @param options.errorCallbackURL - URL to redirect to on error
+   * @param options.loginHint - Email to preselect at the provider
    *
    * @throws {InvalidSocialProvider} When the provider is not 'google' or 'microsoft'
    * @throws {InvalidCallbackURL} When callback URLs are malformed
@@ -1881,7 +1961,8 @@ class SessionService {
   async signInWithSocialProvider({
     provider,
     callbackURL,
-    errorCallbackURL
+    errorCallbackURL,
+    loginHint
   }) {
     if (provider !== "google" && provider !== "microsoft") {
       throw new InvalidSocialProvider("Invalid social provider");
@@ -1896,7 +1977,8 @@ class SessionService {
     await this.client.signIn.social({
       provider,
       callbackURL,
-      errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`
+      errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`,
+      ...loginHint && { loginHint }
     });
   }
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.39.3",
+  "version": "1.41.0",
   "type": "module",
   "exports": {
     ".": {