@meistrari/auth-core 3.0.0 → 3.1.0

package/dist/index.d.mts

@@ -275,6 +275,12 @@ declare const invitationAdditionalFields: {
         input: true;
         required: false;
     };
+    /** Application role granted when an application invitation is accepted. */
+    applicationRole: {
+        type: "string";
+        input: true;
+        required: false;
+    };
 };
 /**
  * Zod schema and type for the `user` claim within a JWT payload.
@@ -771,6 +777,17 @@ type DeviceAuthorizationContextResponse = {
     /** Seconds remaining before the device code expires. */
     expiresIn: number;
 };
+/**
+ * Role of the application an application session was issued for.
+ */
+type ApplicationRole = {
+    applicationId: string;
+    name: string;
+    displayName: string;
+    description: string;
+    /** Roles of the same application this role may grant, change, revoke and invite. */
+    manageableRoles: string[];
+};
 /**
  * Response returned when approving or denying a device authorization request.
  */
@@ -1038,6 +1055,12 @@ declare class ApplicationService {
      * @param refreshToken - The refresh token to invalidate
      */
     logout(refreshToken: string): Promise<void>;
+    /**
+     * Lists the roles of the application the current session was issued for.
+     *
+     * @returns The application's roles
+     */
+    listRoles(): Promise<ApplicationRole[]>;
 }
 
 declare const ApiKeyMetadata: zod__default.ZodObject<{
@@ -3561,6 +3584,17 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: void;
                     error: null;
                 }>;
+                listApplicationRoles: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: ApplicationRole[];
+                    error: null;
+                }>;
             };
         };
     } | {
@@ -4316,11 +4350,19 @@ type OrganizationSettings = {
 type ExtendedOrganization = BaseOrganization & {
     settings?: OrganizationSettings;
 };
+/**
+ * A member of a {@link FullOrganization}.
+ */
+type FullOrganizationMember = Member & {
+    /** The member's role in the session's application. Only set for application sessions. */
+    applicationRole?: string | null;
+};
 /**
  * A complete organization object including its members, invitations, and teams.
  */
 type FullOrganization = ExtendedOrganization & {
-    members: Member[];
+    /** With an application session, only members with access to the application. */
+    members: FullOrganizationMember[];
     invitations: Invitation[];
     teams: Team[];
 };
@@ -4379,6 +4421,8 @@ type ListAdminUsersOptions = {
      * admin, whose listing is always pinned to their own organization.
      */
     organizationId?: string;
+    /** Restricts the listing to people with access to this application. Requires organizationId when listing users. */
+    applicationId?: string;
 };
 /**
  * Organization preview returned alongside each admin user row.
@@ -4538,6 +4582,8 @@ type ListAdminOrganizationMembersOptions = {
     sortBy?: 'createdAt' | 'name';
     /** Sort direction for the listing. Defaults to 'desc'. */
     sortDirection?: 'asc' | 'desc';
+    /** Restricts the listing to people with access to this application. */
+    applicationId?: string;
 };
 /**
  * Options accepted when listing teams for a single organization as a global admin.
@@ -4707,20 +4753,6 @@ type AdminUserInvitation = {
     expiresAt: string;
     createdAt: string;
 };
-/**
- * Options accepted when resending an organization invitation as a global admin.
- */
-type ResendAdminInviteOptions = {
-    organizationId: string;
-    email: string;
-    role: string;
-    applicationId?: string;
-    /**
-     * Teams joined when the re-sent invitation is accepted. Resending replaces the
-     * invitation, so these must be provided to preserve the original team assignments.
-     */
-    teamIds?: string[];
-};
 /**
  * User row returned by the admin user listing endpoint.
  */
@@ -4748,6 +4780,8 @@ type AdminUser = {
     organizationCount?: number;
     /** Preview of the first organizations the user belongs to. Present when requested via organizationsPreview. */
     organizations?: AdminUserOrganization[];
+    /** App role. Present when the listing is scoped to an application; null on invitation rows. */
+    applicationRole?: string | null;
 };
 /**
  * Paginated admin user listing response.
@@ -4802,6 +4836,8 @@ type AdminOrganizationMemberRecord = {
     expiresAt?: string;
     teams?: AdminOrganizationMemberTeam[];
     applications?: AdminOrganizationMemberApplication[];
+    /** App role. Present when the listing is scoped to an application; null on invitation rows. */
+    applicationRole?: string | null;
 };
 /**
  * Paginated organization member listing response.
@@ -4908,9 +4944,16 @@ type AdminApplicationRole = {
     name: string;
     displayName: string;
     description: string;
+    /** Roles of the same application this role may grant, change, revoke and invite. */
+    manageableRoles: string[];
+};
+/**
+ * Options accepted when creating an application role. Omitting `manageableRoles`
+ * creates the role with none, and on update keeps the stored list.
+ */
+type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId' | 'manageableRoles'> & {
+    manageableRoles?: string[];
 };
-/** Options accepted when creating an application role. */
-type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId'>;
 /** Options accepted when updating an application role. */
 type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
 /** Kind of matcher an entitlement rule applies. */
@@ -5513,10 +5556,11 @@ declare class AdminService {
      */
     cancelInvite(invitationId: string): Promise<void>;
     /**
-     * Re-sends an organization invitation email as a global admin.
-     * @param options - Organization, email, role, and optional application and teams
+     * Replaces a pending invitation with a new one that keeps its roles and
+     * teams, and emails it, as a global admin.
+     * @param invitationId - The ID of the invitation to resend
      */
-    resendInvite(options: ResendAdminInviteOptions): Promise<void>;
+    resendInvite(invitationId: string): Promise<void>;
     /**
      * Invites several users to an organization in one call, or — with
      * `sendInvite: false` — adds them as members immediately, creating user
@@ -5581,6 +5625,18 @@ type ListMembersOptions = {
     sortBy?: 'createdAt';
     /** Sort direction for the member page. */
     sortDirection?: 'asc' | 'desc';
+    /** With an application session, also lists organization members without access to the application, marked hasAccess: false. Requires permission to grant access. */
+    includeWithoutAccess?: boolean;
+};
+/**
+ * Organization member as returned to an application session, with the member's
+ * role in the application.
+ */
+type ApplicationScopedMember = Member & {
+    /** The member's role in the application, or null without access. */
+    applicationRole?: string | null;
+    /** Present when includeWithoutAccess was requested. */
+    hasAccess?: boolean;
 };
 /**
  * Options for inviting a user to the active organization.
@@ -5594,6 +5650,8 @@ type InviteUserToOrganizationOptions = {
     userEmail: string;
     /** Organization role to assign to the invited user. */
     role: Role;
+    /** Application role granted on acceptance. Required with an application-scoped session. */
+    applicationRole?: string;
     /** Optional team to add the user to upon acceptance. */
     teamId?: string;
     /** Whether to resend the invitation if one already exists for this email. */
@@ -5615,12 +5673,16 @@ type RemoveUserFromOrganizationOptions = {
 };
 /**
  * Options for updating a member's role within the organization.
+ *
+ * With an application-scoped session, `role` is an application role and the
+ * update grants or changes access to that application. The organization role
+ * is left unchanged.
  */
 type UpdateMemberRoleOptions = {
     /** The member ID whose role should be updated. */
     memberId: string;
-    /** The new role to assign. */
-    role: Role;
+    /** The new role to assign: an organization role, or an application role in app mode. */
+    role: Role | (string & {});
 };
 /**
  * Payload for creating a new team.
@@ -5752,29 +5814,10 @@ declare class OrganizationService {
      * @param options - Pagination options
      * @param options.limit - Maximum number of members to return
      * @param options.offset - Number of members to skip
-     * @returns An array of organization members
+     * @param options.includeWithoutAccess - With an application session, also list members without access to the application
+     * @returns An array of organization members, with their application role when the session is an application session
      */
-    listMembers(options?: ListMembersOptions): Promise<({
-        id: string;
-        organizationId: string;
-        role: "org:admin" | "org:member" | "org:reviewer";
-        createdAt: Date;
-        userId: string;
-        teamId?: string | undefined | undefined;
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            image?: string | undefined;
-        };
-    } & {
-        user: {
-            id: string;
-            name: string;
-            email: string;
-            image: string | null | undefined;
-        };
-    })[]>;
+    listMembers(options?: ListMembersOptions): Promise<ApplicationScopedMember[]>;
     /**
      * Gets the currently active organization member for the authenticated user.
      *
@@ -5820,11 +5863,12 @@ declare class OrganizationService {
      * @param options - Invitation configuration
      * @param options.userEmail - Email address of the user to invite
      * @param options.role - Role to assign to the invited user
+     * @param options.applicationRole - Application role granted on acceptance; required with an application-scoped session
      * @param options.teamId - Team ID to add the user to
      * @param options.resend - Whether to resend if invitation already exists
      * @returns The created invitation
      */
-    inviteUserToOrganization({ userEmail, role, teamId, resend }: InviteUserToOrganizationOptions): Promise<NonNullable<{
+    inviteUserToOrganization({ userEmail, role, applicationRole, teamId, resend }: InviteUserToOrganizationOptions): Promise<NonNullable<{
         id: string;
         organizationId: string;
         email: string;
@@ -5885,6 +5929,9 @@ declare class OrganizationService {
     /**
      * Removes a user from the active organization.
      *
+     * With an application-scoped session, revokes the member's access to that
+     * application and keeps the membership.
+     *
      * @param options - Provide either `memberId` or `userEmail` to identify the user
      * @param options.memberId - Membership ID to remove
      * @param options.userEmail - Email address of the member to remove
@@ -5893,6 +5940,10 @@ declare class OrganizationService {
     /**
      * Updates the role of an organization member.
      *
+     * With an application-scoped session, `role` is an application role: the
+     * update grants or changes the member's access to that application and
+     * keeps the organization role.
+     *
      * @param options - Role update configuration
      * @param options.memberId - The member ID to update
      * @param options.role - The new role to assign
@@ -6552,4 +6603,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -275,6 +275,12 @@ declare const invitationAdditionalFields: {
         input: true;
         required: false;
     };
+    /** Application role granted when an application invitation is accepted. */
+    applicationRole: {
+        type: "string";
+        input: true;
+        required: false;
+    };
 };
 /**
  * Zod schema and type for the `user` claim within a JWT payload.
@@ -771,6 +777,17 @@ type DeviceAuthorizationContextResponse = {
     /** Seconds remaining before the device code expires. */
     expiresIn: number;
 };
+/**
+ * Role of the application an application session was issued for.
+ */
+type ApplicationRole = {
+    applicationId: string;
+    name: string;
+    displayName: string;
+    description: string;
+    /** Roles of the same application this role may grant, change, revoke and invite. */
+    manageableRoles: string[];
+};
 /**
  * Response returned when approving or denying a device authorization request.
  */
@@ -1038,6 +1055,12 @@ declare class ApplicationService {
      * @param refreshToken - The refresh token to invalidate
      */
     logout(refreshToken: string): Promise<void>;
+    /**
+     * Lists the roles of the application the current session was issued for.
+     *
+     * @returns The application's roles
+     */
+    listRoles(): Promise<ApplicationRole[]>;
 }
 
 declare const ApiKeyMetadata: zod__default.ZodObject<{
@@ -3561,6 +3584,17 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: void;
                     error: null;
                 }>;
+                listApplicationRoles: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: ApplicationRole[];
+                    error: null;
+                }>;
             };
         };
     } | {
@@ -4316,11 +4350,19 @@ type OrganizationSettings = {
 type ExtendedOrganization = BaseOrganization & {
     settings?: OrganizationSettings;
 };
+/**
+ * A member of a {@link FullOrganization}.
+ */
+type FullOrganizationMember = Member & {
+    /** The member's role in the session's application. Only set for application sessions. */
+    applicationRole?: string | null;
+};
 /**
  * A complete organization object including its members, invitations, and teams.
  */
 type FullOrganization = ExtendedOrganization & {
-    members: Member[];
+    /** With an application session, only members with access to the application. */
+    members: FullOrganizationMember[];
     invitations: Invitation[];
     teams: Team[];
 };
@@ -4379,6 +4421,8 @@ type ListAdminUsersOptions = {
      * admin, whose listing is always pinned to their own organization.
      */
     organizationId?: string;
+    /** Restricts the listing to people with access to this application. Requires organizationId when listing users. */
+    applicationId?: string;
 };
 /**
  * Organization preview returned alongside each admin user row.
@@ -4538,6 +4582,8 @@ type ListAdminOrganizationMembersOptions = {
     sortBy?: 'createdAt' | 'name';
     /** Sort direction for the listing. Defaults to 'desc'. */
     sortDirection?: 'asc' | 'desc';
+    /** Restricts the listing to people with access to this application. */
+    applicationId?: string;
 };
 /**
  * Options accepted when listing teams for a single organization as a global admin.
@@ -4707,20 +4753,6 @@ type AdminUserInvitation = {
     expiresAt: string;
     createdAt: string;
 };
-/**
- * Options accepted when resending an organization invitation as a global admin.
- */
-type ResendAdminInviteOptions = {
-    organizationId: string;
-    email: string;
-    role: string;
-    applicationId?: string;
-    /**
-     * Teams joined when the re-sent invitation is accepted. Resending replaces the
-     * invitation, so these must be provided to preserve the original team assignments.
-     */
-    teamIds?: string[];
-};
 /**
  * User row returned by the admin user listing endpoint.
  */
@@ -4748,6 +4780,8 @@ type AdminUser = {
     organizationCount?: number;
     /** Preview of the first organizations the user belongs to. Present when requested via organizationsPreview. */
     organizations?: AdminUserOrganization[];
+    /** App role. Present when the listing is scoped to an application; null on invitation rows. */
+    applicationRole?: string | null;
 };
 /**
  * Paginated admin user listing response.
@@ -4802,6 +4836,8 @@ type AdminOrganizationMemberRecord = {
     expiresAt?: string;
     teams?: AdminOrganizationMemberTeam[];
     applications?: AdminOrganizationMemberApplication[];
+    /** App role. Present when the listing is scoped to an application; null on invitation rows. */
+    applicationRole?: string | null;
 };
 /**
  * Paginated organization member listing response.
@@ -4908,9 +4944,16 @@ type AdminApplicationRole = {
     name: string;
     displayName: string;
     description: string;
+    /** Roles of the same application this role may grant, change, revoke and invite. */
+    manageableRoles: string[];
+};
+/**
+ * Options accepted when creating an application role. Omitting `manageableRoles`
+ * creates the role with none, and on update keeps the stored list.
+ */
+type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId' | 'manageableRoles'> & {
+    manageableRoles?: string[];
 };
-/** Options accepted when creating an application role. */
-type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId'>;
 /** Options accepted when updating an application role. */
 type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
 /** Kind of matcher an entitlement rule applies. */
@@ -5513,10 +5556,11 @@ declare class AdminService {
      */
     cancelInvite(invitationId: string): Promise<void>;
     /**
-     * Re-sends an organization invitation email as a global admin.
-     * @param options - Organization, email, role, and optional application and teams
+     * Replaces a pending invitation with a new one that keeps its roles and
+     * teams, and emails it, as a global admin.
+     * @param invitationId - The ID of the invitation to resend
      */
-    resendInvite(options: ResendAdminInviteOptions): Promise<void>;
+    resendInvite(invitationId: string): Promise<void>;
     /**
      * Invites several users to an organization in one call, or — with
      * `sendInvite: false` — adds them as members immediately, creating user
@@ -5581,6 +5625,18 @@ type ListMembersOptions = {
     sortBy?: 'createdAt';
     /** Sort direction for the member page. */
     sortDirection?: 'asc' | 'desc';
+    /** With an application session, also lists organization members without access to the application, marked hasAccess: false. Requires permission to grant access. */
+    includeWithoutAccess?: boolean;
+};
+/**
+ * Organization member as returned to an application session, with the member's
+ * role in the application.
+ */
+type ApplicationScopedMember = Member & {
+    /** The member's role in the application, or null without access. */
+    applicationRole?: string | null;
+    /** Present when includeWithoutAccess was requested. */
+    hasAccess?: boolean;
 };
 /**
  * Options for inviting a user to the active organization.
@@ -5594,6 +5650,8 @@ type InviteUserToOrganizationOptions = {
     userEmail: string;
     /** Organization role to assign to the invited user. */
     role: Role;
+    /** Application role granted on acceptance. Required with an application-scoped session. */
+    applicationRole?: string;
     /** Optional team to add the user to upon acceptance. */
     teamId?: string;
     /** Whether to resend the invitation if one already exists for this email. */
@@ -5615,12 +5673,16 @@ type RemoveUserFromOrganizationOptions = {
 };
 /**
  * Options for updating a member's role within the organization.
+ *
+ * With an application-scoped session, `role` is an application role and the
+ * update grants or changes access to that application. The organization role
+ * is left unchanged.
  */
 type UpdateMemberRoleOptions = {
     /** The member ID whose role should be updated. */
     memberId: string;
-    /** The new role to assign. */
-    role: Role;
+    /** The new role to assign: an organization role, or an application role in app mode. */
+    role: Role | (string & {});
 };
 /**
  * Payload for creating a new team.
@@ -5752,29 +5814,10 @@ declare class OrganizationService {
      * @param options - Pagination options
      * @param options.limit - Maximum number of members to return
      * @param options.offset - Number of members to skip
-     * @returns An array of organization members
+     * @param options.includeWithoutAccess - With an application session, also list members without access to the application
+     * @returns An array of organization members, with their application role when the session is an application session
      */
-    listMembers(options?: ListMembersOptions): Promise<({
-        id: string;
-        organizationId: string;
-        role: "org:admin" | "org:member" | "org:reviewer";
-        createdAt: Date;
-        userId: string;
-        teamId?: string | undefined | undefined;
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            image?: string | undefined;
-        };
-    } & {
-        user: {
-            id: string;
-            name: string;
-            email: string;
-            image: string | null | undefined;
-        };
-    })[]>;
+    listMembers(options?: ListMembersOptions): Promise<ApplicationScopedMember[]>;
     /**
      * Gets the currently active organization member for the authenticated user.
      *
@@ -5820,11 +5863,12 @@ declare class OrganizationService {
      * @param options - Invitation configuration
      * @param options.userEmail - Email address of the user to invite
      * @param options.role - Role to assign to the invited user
+     * @param options.applicationRole - Application role granted on acceptance; required with an application-scoped session
      * @param options.teamId - Team ID to add the user to
      * @param options.resend - Whether to resend if invitation already exists
      * @returns The created invitation
      */
-    inviteUserToOrganization({ userEmail, role, teamId, resend }: InviteUserToOrganizationOptions): Promise<NonNullable<{
+    inviteUserToOrganization({ userEmail, role, applicationRole, teamId, resend }: InviteUserToOrganizationOptions): Promise<NonNullable<{
         id: string;
         organizationId: string;
         email: string;
@@ -5885,6 +5929,9 @@ declare class OrganizationService {
     /**
      * Removes a user from the active organization.
      *
+     * With an application-scoped session, revokes the member's access to that
+     * application and keeps the membership.
+     *
      * @param options - Provide either `memberId` or `userEmail` to identify the user
      * @param options.memberId - Membership ID to remove
      * @param options.userEmail - Email address of the member to remove
@@ -5893,6 +5940,10 @@ declare class OrganizationService {
     /**
      * Updates the role of an organization member.
      *
+     * With an application-scoped session, `role` is an application role: the
+     * update grants or changes the member's access to that application and
+     * keeps the organization role.
+     *
      * @param options - Role update configuration
      * @param options.memberId - The member ID to update
      * @param options.role - The new role to assign
@@ -6552,4 +6603,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "3.0.0";
+const version = "3.1.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -178,6 +178,12 @@ const invitationAdditionalFields = {
     type: "string",
     input: true,
     required: false
+  },
+  /** Application role granted when an application invitation is accepted. */
+  applicationRole: {
+    type: "string",
+    input: true,
+    required: false
   }
 };
 const JWTPayloadUser = z$1.object({
@@ -362,6 +368,11 @@ function applicationsPluginClient() {
               method: "POST",
               headers
             });
+          },
+          listApplicationRoles: async () => {
+            return await $fetch("/applications/roles", {
+              method: "GET"
+            });
           }
         }
       };
@@ -730,7 +741,8 @@ class AdminService {
         ...options.query ? { query: options.query } : {},
         ...options.organizationsPreview !== void 0 ? { organizations_preview: options.organizationsPreview } : {},
         ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {},
-        ...options.organizationId ? { organization_id: options.organizationId } : {}
+        ...options.organizationId ? { organization_id: options.organizationId } : {},
+        ...options.applicationId ? { application_id: options.applicationId } : {}
       }
     });
   }
@@ -864,7 +876,8 @@ class AdminService {
         ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {},
         ...options.includeAccess !== void 0 ? { include_access: options.includeAccess } : {},
         ...options.sortBy ? { sortBy: options.sortBy } : {},
-        ...options.sortDirection ? { sortDirection: options.sortDirection } : {}
+        ...options.sortDirection ? { sortDirection: options.sortDirection } : {},
+        ...options.applicationId ? { application_id: options.applicationId } : {}
       }
     });
   }
@@ -1114,14 +1127,12 @@ class AdminService {
     await this.client.$fetch("/admin/invites/cancel", { method: "POST", body: { invitationId } });
   }
   /**
-   * Re-sends an organization invitation email as a global admin.
-   * @param options - Organization, email, role, and optional application and teams
+   * Replaces a pending invitation with a new one that keeps its roles and
+   * teams, and emails it, as a global admin.
+   * @param invitationId - The ID of the invitation to resend
    */
-  async resendInvite(options) {
-    await this.client.$fetch("/admin/organizations/users", {
-      method: "POST",
-      body: { ...options, sendInvite: true, resend: true }
-    });
+  async resendInvite(invitationId) {
+    await this.client.$fetch("/admin/invites/resend", { method: "POST", body: { invitationId } });
   }
   /**
    * Invites several users to an organization in one call, or — with
@@ -1714,6 +1725,18 @@ class ApplicationService {
   async logout(refreshToken) {
     await this.client.applications.logout(refreshToken);
   }
+  /**
+   * Lists the roles of the application the current session was issued for.
+   *
+   * @returns The application's roles
+   */
+  async listRoles() {
+    const response = await this.client.applications.listApplicationRoles();
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data;
+  }
 }
 
 class OrganizationService {
@@ -1776,7 +1799,8 @@ class OrganizationService {
    * @param options - Pagination options
    * @param options.limit - Maximum number of members to return
    * @param options.offset - Number of members to skip
-   * @returns An array of organization members
+   * @param options.includeWithoutAccess - With an application session, also list members without access to the application
+   * @returns An array of organization members, with their application role when the session is an application session
    */
   async listMembers(options) {
     const members = await this.client.organization.listMembers({
@@ -1801,16 +1825,18 @@ class OrganizationService {
    * @param options - Invitation configuration
    * @param options.userEmail - Email address of the user to invite
    * @param options.role - Role to assign to the invited user
+   * @param options.applicationRole - Application role granted on acceptance; required with an application-scoped session
    * @param options.teamId - Team ID to add the user to
    * @param options.resend - Whether to resend if invitation already exists
    * @returns The created invitation
    */
-  async inviteUserToOrganization({ userEmail, role, teamId, resend }) {
+  async inviteUserToOrganization({ userEmail, role, applicationRole, teamId, resend }) {
     return await this.client.organization.inviteMember({
       email: userEmail,
       role,
       teamId,
-      resend: resend ?? false
+      resend: resend ?? false,
+      ...applicationRole ? { applicationRole } : {}
     });
   }
   /**
@@ -1873,6 +1899,9 @@ class OrganizationService {
   /**
    * Removes a user from the active organization.
    *
+   * With an application-scoped session, revokes the member's access to that
+   * application and keeps the membership.
+   *
    * @param options - Provide either `memberId` or `userEmail` to identify the user
    * @param options.memberId - Membership ID to remove
    * @param options.userEmail - Email address of the member to remove
@@ -1885,6 +1914,10 @@ class OrganizationService {
   /**
    * Updates the role of an organization member.
    *
+   * With an application-scoped session, `role` is an application role: the
+   * update grants or changes the member's access to that application and
+   * keeps the organization role.
+   *
    * @param options - Role update configuration
    * @param options.memberId - The member ID to update
    * @param options.role - The new role to assign

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "3.0.0",
+    "version": "3.1.0",
     "type": "module",
     "exports": {
         ".": {