@meistrari/auth-core 2.1.0 → 2.3.0

package/dist/index.d.mts

@@ -4914,6 +4914,47 @@ type AdminApplicationMember = {
     email: string;
     image: string | null;
 };
+/**
+ * Options accepted when listing the users with access to an application.
+ */
+type ListAdminApplicationMembersOptions = {
+    /** ID of the application whose members should be listed. */
+    applicationId: string;
+    /** Restricts the listing to users with access through this organization. */
+    organizationId?: string;
+    /** Case-insensitive name or email match. */
+    query?: string;
+    /** Maximum number of users to return. Defaults to 50. */
+    limit?: number;
+    /** Number of users to skip. Defaults to 0. */
+    offset?: number;
+};
+/**
+ * Organization through which a user can access an application, with the role
+ * the first matching entitlement rule grants them there.
+ */
+type AdminApplicationMemberOrganization = {
+    id: string;
+    name: string;
+    role: string;
+    /** User-facing name from the application role catalog. Null when the role is not in the catalog. */
+    roleDisplayName: string | null;
+};
+/**
+ * User row returned by the admin application member listing endpoint.
+ */
+type AdminApplicationMemberRecord = AdminApplicationMember & {
+    organizations: AdminApplicationMemberOrganization[];
+};
+/**
+ * Paginated application member listing response.
+ */
+type ListAdminApplicationMembersResult = {
+    members: AdminApplicationMemberRecord[];
+    total: number;
+    limit: number;
+    offset: number;
+};
 /**
  * Application row returned by the admin application listing endpoint.
  */
@@ -5223,6 +5264,44 @@ declare class AdminService {
     getUserAccess(userId: string): Promise<{
         data: AdminUserAccess;
     } | null>;
+    /**
+     * Lists applications with their entitlements as a global admin. Unlike
+     * {@link listApplications}, which goes through the session-only application
+     * routes, this uses the admin endpoint and so also works with a bearer token.
+     *
+     * @param options - Pagination, ordering, organization filter, search, and member preview options
+     * @returns The application listing with entitlement details
+     */
+    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<{
+        data: null;
+        error: {
+            message?: string | undefined;
+            status: number;
+            statusText: string;
+        };
+    } | {
+        data: ListAdminApplicationsResult;
+        error: null;
+    }>;
+    /**
+     * Lists the users with access to an application as a global admin, one row
+     * per user with every organization that grants them access and the role it
+     * grants.
+     *
+     * @param options - Application ID, organization filter, pagination, and search options
+     * @returns The paginated application member listing
+     */
+    listApplicationMembers(options: ListAdminApplicationMembersOptions): Promise<{
+        data: null;
+        error: {
+            message?: string | undefined;
+            status: number;
+            statusText: string;
+        };
+    } | {
+        data: ListAdminApplicationMembersResult;
+        error: null;
+    }>;
     /**
      * Lists active members for one organization as a global admin.
      *
@@ -6442,4 +6521,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -4914,6 +4914,47 @@ type AdminApplicationMember = {
     email: string;
     image: string | null;
 };
+/**
+ * Options accepted when listing the users with access to an application.
+ */
+type ListAdminApplicationMembersOptions = {
+    /** ID of the application whose members should be listed. */
+    applicationId: string;
+    /** Restricts the listing to users with access through this organization. */
+    organizationId?: string;
+    /** Case-insensitive name or email match. */
+    query?: string;
+    /** Maximum number of users to return. Defaults to 50. */
+    limit?: number;
+    /** Number of users to skip. Defaults to 0. */
+    offset?: number;
+};
+/**
+ * Organization through which a user can access an application, with the role
+ * the first matching entitlement rule grants them there.
+ */
+type AdminApplicationMemberOrganization = {
+    id: string;
+    name: string;
+    role: string;
+    /** User-facing name from the application role catalog. Null when the role is not in the catalog. */
+    roleDisplayName: string | null;
+};
+/**
+ * User row returned by the admin application member listing endpoint.
+ */
+type AdminApplicationMemberRecord = AdminApplicationMember & {
+    organizations: AdminApplicationMemberOrganization[];
+};
+/**
+ * Paginated application member listing response.
+ */
+type ListAdminApplicationMembersResult = {
+    members: AdminApplicationMemberRecord[];
+    total: number;
+    limit: number;
+    offset: number;
+};
 /**
  * Application row returned by the admin application listing endpoint.
  */
@@ -5223,6 +5264,44 @@ declare class AdminService {
     getUserAccess(userId: string): Promise<{
         data: AdminUserAccess;
     } | null>;
+    /**
+     * Lists applications with their entitlements as a global admin. Unlike
+     * {@link listApplications}, which goes through the session-only application
+     * routes, this uses the admin endpoint and so also works with a bearer token.
+     *
+     * @param options - Pagination, ordering, organization filter, search, and member preview options
+     * @returns The application listing with entitlement details
+     */
+    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<{
+        data: null;
+        error: {
+            message?: string | undefined;
+            status: number;
+            statusText: string;
+        };
+    } | {
+        data: ListAdminApplicationsResult;
+        error: null;
+    }>;
+    /**
+     * Lists the users with access to an application as a global admin, one row
+     * per user with every organization that grants them access and the role it
+     * grants.
+     *
+     * @param options - Application ID, organization filter, pagination, and search options
+     * @returns The paginated application member listing
+     */
+    listApplicationMembers(options: ListAdminApplicationMembersOptions): Promise<{
+        data: null;
+        error: {
+            message?: string | undefined;
+            status: number;
+            statusText: string;
+        };
+    } | {
+        data: ListAdminApplicationMembersResult;
+        error: null;
+    }>;
     /**
      * Lists active members for one organization as a global admin.
      *
@@ -6442,4 +6521,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "2.1.0";
+const version = "2.3.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -822,6 +822,47 @@ class AdminService {
     });
     return data;
   }
+  /**
+   * Lists applications with their entitlements as a global admin. Unlike
+   * {@link listApplications}, which goes through the session-only application
+   * routes, this uses the admin endpoint and so also works with a bearer token.
+   *
+   * @param options - Pagination, ordering, organization filter, search, and member preview options
+   * @returns The application listing with entitlement details
+   */
+  async listAdminApplications(options = {}) {
+    return await this.client.$fetch("/admin/applications", {
+      method: "GET",
+      query: {
+        ...options.limit !== void 0 ? { limit: options.limit } : {},
+        ...options.offset !== void 0 ? { offset: options.offset } : {},
+        ...options.search ? { search: options.search } : {},
+        ...options.organizationId ? { organization_id: options.organizationId } : {},
+        ...options.membersPreview !== void 0 ? { members_preview: options.membersPreview } : {},
+        ...options.orderBy ? { sortBy: options.orderBy } : {},
+        ...options.orderDirection ? { sortDirection: options.orderDirection } : {}
+      }
+    });
+  }
+  /**
+   * Lists the users with access to an application as a global admin, one row
+   * per user with every organization that grants them access and the role it
+   * grants.
+   *
+   * @param options - Application ID, organization filter, pagination, and search options
+   * @returns The paginated application member listing
+   */
+  async listApplicationMembers(options) {
+    return await this.client.$fetch(`/admin/applications/${encodeURIComponent(options.applicationId)}/members`, {
+      method: "GET",
+      query: {
+        ...options.limit !== void 0 ? { limit: options.limit } : {},
+        ...options.offset !== void 0 ? { offset: options.offset } : {},
+        ...options.query ? { query: options.query } : {},
+        ...options.organizationId ? { organization_id: options.organizationId } : {}
+      }
+    });
+  }
   /**
    * Lists active members for one organization as a global admin.
    *

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "2.1.0",
+    "version": "2.3.0",
     "type": "module",
     "exports": {
         ".": {