@meistrari/auth-core 3.0.0 → 3.2.0

package/dist/index.d.mts

@@ -275,6 +275,12 @@ declare const invitationAdditionalFields: {
         input: true;
         required: false;
     };
+    /** Application role granted when an application invitation is accepted. */
+    applicationRole: {
+        type: "string";
+        input: true;
+        required: false;
+    };
 };
 /**
  * Zod schema and type for the `user` claim within a JWT payload.
@@ -645,12 +651,22 @@ type ListCandidateOrganizationsResponse = Array<FullOrganization & {
      */
     lastUsed?: boolean;
 }>;
+/**
+ * Whether an application refuses sign-ins, and the notice shown to users who
+ * try to sign in through it.
+ */
+type ApplicationDeprecation = {
+    /** Whether the application is disabled. A disabled application refuses every sign-in. */
+    disabled: boolean;
+    /** Plain-text notice written by an admin, or `null` when the application is enabled or has none. */
+    deprecationNotice: string | null;
+};
 /**
  * Public application context used to preserve continuity during auth redirects.
  */
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
-    application: Pick<Application, 'id' | 'name' | 'config'>;
+    application: Pick<Application, 'id' | 'name' | 'config'> & ApplicationDeprecation;
     /**
      * Login methods usable for this application: the environment allowlist
      * intersected with the application's accepted AMRs.
@@ -751,7 +767,7 @@ type DeviceContextApplication = {
     name: string;
     /** Human-readable description, or `null` if not set. */
     description: string | null;
-};
+} & ApplicationDeprecation;
 /**
  * Context information for a pending device authorization request.
  */
@@ -762,7 +778,7 @@ type DeviceAuthorizationContextResponse = {
     };
     /** The target application the requester wants access to. */
     target: DeviceContextApplication;
-    /** Organizations the user can authorize the device for. */
+    /** Organizations the user can authorize the device for. Empty when the requester or the target is disabled. */
     organizations: FullOrganization[];
     /** Organization pre-selected by the requester, if any. */
     preselectedOrganizationId: string | null;
@@ -771,6 +787,17 @@ type DeviceAuthorizationContextResponse = {
     /** Seconds remaining before the device code expires. */
     expiresIn: number;
 };
+/**
+ * Role of the application an application session was issued for.
+ */
+type ApplicationRole = {
+    applicationId: string;
+    name: string;
+    displayName: string;
+    description: string;
+    /** Roles of the same application this role may grant, change, revoke and invite. */
+    manageableRoles: string[];
+};
 /**
  * Response returned when approving or denying a device authorization request.
  */
@@ -825,6 +852,37 @@ declare class ApplicationSessionAssuranceError extends ApplicationError {
     readonly validStepUps: SessionAssuranceRequiredPayload['validStepUps'];
     constructor(payload?: SessionAssuranceRequiredPayload | null, options?: ErrorOptions);
 }
+/**
+ * Payload the API attaches to an `application_disabled` error.
+ */
+type ApplicationDisabledPayload = {
+    applicationId: string;
+    applicationName: string;
+    deprecationNotice: string | null;
+};
+/**
+ * Reads the {@link ApplicationDisabledPayload} from an error returned by the
+ * API, following `cause` chains. Returns `null` when the error is not an
+ * `application_disabled` error.
+ *
+ * @param error - The caught error value
+ */
+declare function parseApplicationDisabledPayload(error: unknown): ApplicationDisabledPayload | null;
+/**
+ * Thrown when the application was disabled by an admin. Every sign-in, token
+ * exchange and refresh through it fails until it is enabled again, so clients
+ * must not retry or start a new flow.
+ *
+ * The message is the application's deprecation notice when it has one.
+ */
+declare class ApplicationDisabledError extends ApplicationError {
+    readonly applicationId: string | null;
+    readonly applicationName: string | null;
+    readonly deprecationNotice: string | null;
+    constructor(payload?: ApplicationDisabledPayload | null, options?: ErrorOptions & {
+        status?: number;
+    });
+}
 /**
  * Thrown when an operation requires an authenticated user but no session exists.
  */
@@ -976,6 +1034,7 @@ declare class ApplicationService {
      * @throws {DeviceCodeExpiredError} The device code has expired
      * @throws {DeviceTransientServerError} Transient server error — safe to retry
      * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
+     * @throws {ApplicationDisabledError} The requester or target application is disabled — stop polling
      */
     exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
     /**
@@ -1000,6 +1059,7 @@ declare class ApplicationService {
      *
      * @param refreshToken - The refresh token to use for the authentication token refresh
      * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
+     * @throws {ApplicationDisabledError} When the application has been disabled
      * @throws {ApplicationError} For other API errors
      */
     refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse>;
@@ -1038,6 +1098,12 @@ declare class ApplicationService {
      * @param refreshToken - The refresh token to invalidate
      */
     logout(refreshToken: string): Promise<void>;
+    /**
+     * Lists the roles of the application the current session was issued for.
+     *
+     * @returns The application's roles
+     */
+    listRoles(): Promise<ApplicationRole[]>;
 }
 
 declare const ApiKeyMetadata: zod__default.ZodObject<{
@@ -3561,6 +3627,17 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: void;
                     error: null;
                 }>;
+                listApplicationRoles: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: ApplicationRole[];
+                    error: null;
+                }>;
             };
         };
     } | {
@@ -4316,11 +4393,19 @@ type OrganizationSettings = {
 type ExtendedOrganization = BaseOrganization & {
     settings?: OrganizationSettings;
 };
+/**
+ * A member of a {@link FullOrganization}.
+ */
+type FullOrganizationMember = Member & {
+    /** The member's role in the session's application. Only set for application sessions. */
+    applicationRole?: string | null;
+};
 /**
  * A complete organization object including its members, invitations, and teams.
  */
 type FullOrganization = ExtendedOrganization & {
-    members: Member[];
+    /** With an application session, only members with access to the application. */
+    members: FullOrganizationMember[];
     invitations: Invitation[];
     teams: Team[];
 };
@@ -4379,6 +4464,8 @@ type ListAdminUsersOptions = {
      * admin, whose listing is always pinned to their own organization.
      */
     organizationId?: string;
+    /** Restricts the listing to people with access to this application. Requires organizationId when listing users. */
+    applicationId?: string;
 };
 /**
  * Organization preview returned alongside each admin user row.
@@ -4472,6 +4559,13 @@ type CreateAdminApplicationSecretOptions = {
     /** Optional display name for the secret. */
     name?: string;
 };
+/**
+ * Options accepted when disabling an application.
+ */
+type DisableAdminApplicationOptions = {
+    /** Plain-text notice shown to users who try to sign in through the application. Blank or `null` clears it. */
+    deprecationNotice?: string | null;
+};
 /**
  * Client secret metadata returned by application management endpoints.
  */
@@ -4538,6 +4632,8 @@ type ListAdminOrganizationMembersOptions = {
     sortBy?: 'createdAt' | 'name';
     /** Sort direction for the listing. Defaults to 'desc'. */
     sortDirection?: 'asc' | 'desc';
+    /** Restricts the listing to people with access to this application. */
+    applicationId?: string;
 };
 /**
  * Options accepted when listing teams for a single organization as a global admin.
@@ -4707,20 +4803,6 @@ type AdminUserInvitation = {
     expiresAt: string;
     createdAt: string;
 };
-/**
- * Options accepted when resending an organization invitation as a global admin.
- */
-type ResendAdminInviteOptions = {
-    organizationId: string;
-    email: string;
-    role: string;
-    applicationId?: string;
-    /**
-     * Teams joined when the re-sent invitation is accepted. Resending replaces the
-     * invitation, so these must be provided to preserve the original team assignments.
-     */
-    teamIds?: string[];
-};
 /**
  * User row returned by the admin user listing endpoint.
  */
@@ -4748,6 +4830,8 @@ type AdminUser = {
     organizationCount?: number;
     /** Preview of the first organizations the user belongs to. Present when requested via organizationsPreview. */
     organizations?: AdminUserOrganization[];
+    /** App role. Present when the listing is scoped to an application; null on invitation rows. */
+    applicationRole?: string | null;
 };
 /**
  * Paginated admin user listing response.
@@ -4802,6 +4886,8 @@ type AdminOrganizationMemberRecord = {
     expiresAt?: string;
     teams?: AdminOrganizationMemberTeam[];
     applications?: AdminOrganizationMemberApplication[];
+    /** App role. Present when the listing is scoped to an application; null on invitation rows. */
+    applicationRole?: string | null;
 };
 /**
  * Paginated organization member listing response.
@@ -4908,9 +4994,16 @@ type AdminApplicationRole = {
     name: string;
     displayName: string;
     description: string;
+    /** Roles of the same application this role may grant, change, revoke and invite. */
+    manageableRoles: string[];
+};
+/**
+ * Options accepted when creating an application role. Omitting `manageableRoles`
+ * creates the role with none, and on update keeps the stored list.
+ */
+type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId' | 'manageableRoles'> & {
+    manageableRoles?: string[];
 };
-/** Options accepted when creating an application role. */
-type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId'>;
 /** Options accepted when updating an application role. */
 type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
 /** Kind of matcher an entitlement rule applies. */
@@ -5001,6 +5094,12 @@ type AdminApplication = {
     config: ApplicationConfig | null;
     serviceAccountUserId: string | null;
     serviceAccountUser?: AdminApplicationIdentity | null;
+    /** When the application was disabled, or `null` while it is enabled. A disabled application refuses every sign-in. */
+    disabledAt: string | null;
+    /** ID of the admin who disabled the application, or `null`. */
+    disabledBy: string | null;
+    /** Plain-text notice shown to users who try to sign in through the disabled application. */
+    deprecationNotice: string | null;
     createdBy: string;
     updatedBy: string;
     createdAt: string;
@@ -5173,6 +5272,24 @@ declare class AdminService {
      * @returns The updated application
      */
     updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Disables an application. Sign-ins, token exchanges, refreshes and
+     * client-credentials exchanges through it fail with `application_disabled`,
+     * which carries the deprecation notice. Disabling an already disabled
+     * application replaces its notice.
+     *
+     * @param applicationId - ID of the application to disable
+     * @param options - Optional deprecation notice
+     * @returns The updated application
+     */
+    disableApplication(applicationId: string, options?: DisableAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Enables a disabled application and clears its deprecation notice.
+     *
+     * @param applicationId - ID of the application to enable
+     * @returns The updated application
+     */
+    enableApplication(applicationId: string): Promise<AdminApplicationRecord>;
     /** Lists the role catalog for an application. */
     listApplicationRoles(applicationId: string): Promise<AdminApplicationRole[]>;
     /** Creates an application-scoped role definition. */
@@ -5513,10 +5630,11 @@ declare class AdminService {
      */
     cancelInvite(invitationId: string): Promise<void>;
     /**
-     * Re-sends an organization invitation email as a global admin.
-     * @param options - Organization, email, role, and optional application and teams
+     * Replaces a pending invitation with a new one that keeps its roles and
+     * teams, and emails it, as a global admin.
+     * @param invitationId - The ID of the invitation to resend
      */
-    resendInvite(options: ResendAdminInviteOptions): Promise<void>;
+    resendInvite(invitationId: string): Promise<void>;
     /**
      * Invites several users to an organization in one call, or — with
      * `sendInvite: false` — adds them as members immediately, creating user
@@ -5581,6 +5699,18 @@ type ListMembersOptions = {
     sortBy?: 'createdAt';
     /** Sort direction for the member page. */
     sortDirection?: 'asc' | 'desc';
+    /** With an application session, also lists organization members without access to the application, marked hasAccess: false. Requires permission to grant access. */
+    includeWithoutAccess?: boolean;
+};
+/**
+ * Organization member as returned to an application session, with the member's
+ * role in the application.
+ */
+type ApplicationScopedMember = Member & {
+    /** The member's role in the application, or null without access. */
+    applicationRole?: string | null;
+    /** Present when includeWithoutAccess was requested. */
+    hasAccess?: boolean;
 };
 /**
  * Options for inviting a user to the active organization.
@@ -5594,6 +5724,8 @@ type InviteUserToOrganizationOptions = {
     userEmail: string;
     /** Organization role to assign to the invited user. */
     role: Role;
+    /** Application role granted on acceptance. Required with an application-scoped session. */
+    applicationRole?: string;
     /** Optional team to add the user to upon acceptance. */
     teamId?: string;
     /** Whether to resend the invitation if one already exists for this email. */
@@ -5615,12 +5747,16 @@ type RemoveUserFromOrganizationOptions = {
 };
 /**
  * Options for updating a member's role within the organization.
+ *
+ * With an application-scoped session, `role` is an application role and the
+ * update grants or changes access to that application. The organization role
+ * is left unchanged.
  */
 type UpdateMemberRoleOptions = {
     /** The member ID whose role should be updated. */
     memberId: string;
-    /** The new role to assign. */
-    role: Role;
+    /** The new role to assign: an organization role, or an application role in app mode. */
+    role: Role | (string & {});
 };
 /**
  * Payload for creating a new team.
@@ -5752,29 +5888,10 @@ declare class OrganizationService {
      * @param options - Pagination options
      * @param options.limit - Maximum number of members to return
      * @param options.offset - Number of members to skip
-     * @returns An array of organization members
+     * @param options.includeWithoutAccess - With an application session, also list members without access to the application
+     * @returns An array of organization members, with their application role when the session is an application session
      */
-    listMembers(options?: ListMembersOptions): Promise<({
-        id: string;
-        organizationId: string;
-        role: "org:admin" | "org:member" | "org:reviewer";
-        createdAt: Date;
-        userId: string;
-        teamId?: string | undefined | undefined;
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            image?: string | undefined;
-        };
-    } & {
-        user: {
-            id: string;
-            name: string;
-            email: string;
-            image: string | null | undefined;
-        };
-    })[]>;
+    listMembers(options?: ListMembersOptions): Promise<ApplicationScopedMember[]>;
     /**
      * Gets the currently active organization member for the authenticated user.
      *
@@ -5820,11 +5937,12 @@ declare class OrganizationService {
      * @param options - Invitation configuration
      * @param options.userEmail - Email address of the user to invite
      * @param options.role - Role to assign to the invited user
+     * @param options.applicationRole - Application role granted on acceptance; required with an application-scoped session
      * @param options.teamId - Team ID to add the user to
      * @param options.resend - Whether to resend if invitation already exists
      * @returns The created invitation
      */
-    inviteUserToOrganization({ userEmail, role, teamId, resend }: InviteUserToOrganizationOptions): Promise<NonNullable<{
+    inviteUserToOrganization({ userEmail, role, applicationRole, teamId, resend }: InviteUserToOrganizationOptions): Promise<NonNullable<{
         id: string;
         organizationId: string;
         email: string;
@@ -5885,6 +6003,9 @@ declare class OrganizationService {
     /**
      * Removes a user from the active organization.
      *
+     * With an application-scoped session, revokes the member's access to that
+     * application and keeps the membership.
+     *
      * @param options - Provide either `memberId` or `userEmail` to identify the user
      * @param options.memberId - Membership ID to remove
      * @param options.userEmail - Email address of the member to remove
@@ -5893,6 +6014,10 @@ declare class OrganizationService {
     /**
      * Updates the role of an organization member.
      *
+     * With an application-scoped session, `role` is an application role: the
+     * update grants or changes the member's access to that application and
+     * keeps the organization role.
+     *
      * @param options - Role update configuration
      * @param options.memberId - The member ID to update
      * @param options.role - The new role to assign
@@ -6551,5 +6676,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationDeprecation, ApplicationDisabledPayload, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, DisableAdminApplicationOptions, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -275,6 +275,12 @@ declare const invitationAdditionalFields: {
         input: true;
         required: false;
     };
+    /** Application role granted when an application invitation is accepted. */
+    applicationRole: {
+        type: "string";
+        input: true;
+        required: false;
+    };
 };
 /**
  * Zod schema and type for the `user` claim within a JWT payload.
@@ -645,12 +651,22 @@ type ListCandidateOrganizationsResponse = Array<FullOrganization & {
      */
     lastUsed?: boolean;
 }>;
+/**
+ * Whether an application refuses sign-ins, and the notice shown to users who
+ * try to sign in through it.
+ */
+type ApplicationDeprecation = {
+    /** Whether the application is disabled. A disabled application refuses every sign-in. */
+    disabled: boolean;
+    /** Plain-text notice written by an admin, or `null` when the application is enabled or has none. */
+    deprecationNotice: string | null;
+};
 /**
  * Public application context used to preserve continuity during auth redirects.
  */
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
-    application: Pick<Application, 'id' | 'name' | 'config'>;
+    application: Pick<Application, 'id' | 'name' | 'config'> & ApplicationDeprecation;
     /**
      * Login methods usable for this application: the environment allowlist
      * intersected with the application's accepted AMRs.
@@ -751,7 +767,7 @@ type DeviceContextApplication = {
     name: string;
     /** Human-readable description, or `null` if not set. */
     description: string | null;
-};
+} & ApplicationDeprecation;
 /**
  * Context information for a pending device authorization request.
  */
@@ -762,7 +778,7 @@ type DeviceAuthorizationContextResponse = {
     };
     /** The target application the requester wants access to. */
     target: DeviceContextApplication;
-    /** Organizations the user can authorize the device for. */
+    /** Organizations the user can authorize the device for. Empty when the requester or the target is disabled. */
     organizations: FullOrganization[];
     /** Organization pre-selected by the requester, if any. */
     preselectedOrganizationId: string | null;
@@ -771,6 +787,17 @@ type DeviceAuthorizationContextResponse = {
     /** Seconds remaining before the device code expires. */
     expiresIn: number;
 };
+/**
+ * Role of the application an application session was issued for.
+ */
+type ApplicationRole = {
+    applicationId: string;
+    name: string;
+    displayName: string;
+    description: string;
+    /** Roles of the same application this role may grant, change, revoke and invite. */
+    manageableRoles: string[];
+};
 /**
  * Response returned when approving or denying a device authorization request.
  */
@@ -825,6 +852,37 @@ declare class ApplicationSessionAssuranceError extends ApplicationError {
     readonly validStepUps: SessionAssuranceRequiredPayload['validStepUps'];
     constructor(payload?: SessionAssuranceRequiredPayload | null, options?: ErrorOptions);
 }
+/**
+ * Payload the API attaches to an `application_disabled` error.
+ */
+type ApplicationDisabledPayload = {
+    applicationId: string;
+    applicationName: string;
+    deprecationNotice: string | null;
+};
+/**
+ * Reads the {@link ApplicationDisabledPayload} from an error returned by the
+ * API, following `cause` chains. Returns `null` when the error is not an
+ * `application_disabled` error.
+ *
+ * @param error - The caught error value
+ */
+declare function parseApplicationDisabledPayload(error: unknown): ApplicationDisabledPayload | null;
+/**
+ * Thrown when the application was disabled by an admin. Every sign-in, token
+ * exchange and refresh through it fails until it is enabled again, so clients
+ * must not retry or start a new flow.
+ *
+ * The message is the application's deprecation notice when it has one.
+ */
+declare class ApplicationDisabledError extends ApplicationError {
+    readonly applicationId: string | null;
+    readonly applicationName: string | null;
+    readonly deprecationNotice: string | null;
+    constructor(payload?: ApplicationDisabledPayload | null, options?: ErrorOptions & {
+        status?: number;
+    });
+}
 /**
  * Thrown when an operation requires an authenticated user but no session exists.
  */
@@ -976,6 +1034,7 @@ declare class ApplicationService {
      * @throws {DeviceCodeExpiredError} The device code has expired
      * @throws {DeviceTransientServerError} Transient server error — safe to retry
      * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
+     * @throws {ApplicationDisabledError} The requester or target application is disabled — stop polling
      */
     exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
     /**
@@ -1000,6 +1059,7 @@ declare class ApplicationService {
      *
      * @param refreshToken - The refresh token to use for the authentication token refresh
      * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
+     * @throws {ApplicationDisabledError} When the application has been disabled
      * @throws {ApplicationError} For other API errors
      */
     refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse>;
@@ -1038,6 +1098,12 @@ declare class ApplicationService {
      * @param refreshToken - The refresh token to invalidate
      */
     logout(refreshToken: string): Promise<void>;
+    /**
+     * Lists the roles of the application the current session was issued for.
+     *
+     * @returns The application's roles
+     */
+    listRoles(): Promise<ApplicationRole[]>;
 }
 
 declare const ApiKeyMetadata: zod__default.ZodObject<{
@@ -3561,6 +3627,17 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: void;
                     error: null;
                 }>;
+                listApplicationRoles: () => Promise<{
+                    data: null;
+                    error: {
+                        message?: string | undefined;
+                        status: number;
+                        statusText: string;
+                    };
+                } | {
+                    data: ApplicationRole[];
+                    error: null;
+                }>;
             };
         };
     } | {
@@ -4316,11 +4393,19 @@ type OrganizationSettings = {
 type ExtendedOrganization = BaseOrganization & {
     settings?: OrganizationSettings;
 };
+/**
+ * A member of a {@link FullOrganization}.
+ */
+type FullOrganizationMember = Member & {
+    /** The member's role in the session's application. Only set for application sessions. */
+    applicationRole?: string | null;
+};
 /**
  * A complete organization object including its members, invitations, and teams.
  */
 type FullOrganization = ExtendedOrganization & {
-    members: Member[];
+    /** With an application session, only members with access to the application. */
+    members: FullOrganizationMember[];
     invitations: Invitation[];
     teams: Team[];
 };
@@ -4379,6 +4464,8 @@ type ListAdminUsersOptions = {
      * admin, whose listing is always pinned to their own organization.
      */
     organizationId?: string;
+    /** Restricts the listing to people with access to this application. Requires organizationId when listing users. */
+    applicationId?: string;
 };
 /**
  * Organization preview returned alongside each admin user row.
@@ -4472,6 +4559,13 @@ type CreateAdminApplicationSecretOptions = {
     /** Optional display name for the secret. */
     name?: string;
 };
+/**
+ * Options accepted when disabling an application.
+ */
+type DisableAdminApplicationOptions = {
+    /** Plain-text notice shown to users who try to sign in through the application. Blank or `null` clears it. */
+    deprecationNotice?: string | null;
+};
 /**
  * Client secret metadata returned by application management endpoints.
  */
@@ -4538,6 +4632,8 @@ type ListAdminOrganizationMembersOptions = {
     sortBy?: 'createdAt' | 'name';
     /** Sort direction for the listing. Defaults to 'desc'. */
     sortDirection?: 'asc' | 'desc';
+    /** Restricts the listing to people with access to this application. */
+    applicationId?: string;
 };
 /**
  * Options accepted when listing teams for a single organization as a global admin.
@@ -4707,20 +4803,6 @@ type AdminUserInvitation = {
     expiresAt: string;
     createdAt: string;
 };
-/**
- * Options accepted when resending an organization invitation as a global admin.
- */
-type ResendAdminInviteOptions = {
-    organizationId: string;
-    email: string;
-    role: string;
-    applicationId?: string;
-    /**
-     * Teams joined when the re-sent invitation is accepted. Resending replaces the
-     * invitation, so these must be provided to preserve the original team assignments.
-     */
-    teamIds?: string[];
-};
 /**
  * User row returned by the admin user listing endpoint.
  */
@@ -4748,6 +4830,8 @@ type AdminUser = {
     organizationCount?: number;
     /** Preview of the first organizations the user belongs to. Present when requested via organizationsPreview. */
     organizations?: AdminUserOrganization[];
+    /** App role. Present when the listing is scoped to an application; null on invitation rows. */
+    applicationRole?: string | null;
 };
 /**
  * Paginated admin user listing response.
@@ -4802,6 +4886,8 @@ type AdminOrganizationMemberRecord = {
     expiresAt?: string;
     teams?: AdminOrganizationMemberTeam[];
     applications?: AdminOrganizationMemberApplication[];
+    /** App role. Present when the listing is scoped to an application; null on invitation rows. */
+    applicationRole?: string | null;
 };
 /**
  * Paginated organization member listing response.
@@ -4908,9 +4994,16 @@ type AdminApplicationRole = {
     name: string;
     displayName: string;
     description: string;
+    /** Roles of the same application this role may grant, change, revoke and invite. */
+    manageableRoles: string[];
+};
+/**
+ * Options accepted when creating an application role. Omitting `manageableRoles`
+ * creates the role with none, and on update keeps the stored list.
+ */
+type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId' | 'manageableRoles'> & {
+    manageableRoles?: string[];
 };
-/** Options accepted when creating an application role. */
-type CreateAdminApplicationRoleOptions = Omit<AdminApplicationRole, 'applicationId'>;
 /** Options accepted when updating an application role. */
 type UpdateAdminApplicationRoleOptions = CreateAdminApplicationRoleOptions;
 /** Kind of matcher an entitlement rule applies. */
@@ -5001,6 +5094,12 @@ type AdminApplication = {
     config: ApplicationConfig | null;
     serviceAccountUserId: string | null;
     serviceAccountUser?: AdminApplicationIdentity | null;
+    /** When the application was disabled, or `null` while it is enabled. A disabled application refuses every sign-in. */
+    disabledAt: string | null;
+    /** ID of the admin who disabled the application, or `null`. */
+    disabledBy: string | null;
+    /** Plain-text notice shown to users who try to sign in through the disabled application. */
+    deprecationNotice: string | null;
     createdBy: string;
     updatedBy: string;
     createdAt: string;
@@ -5173,6 +5272,24 @@ declare class AdminService {
      * @returns The updated application
      */
     updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Disables an application. Sign-ins, token exchanges, refreshes and
+     * client-credentials exchanges through it fail with `application_disabled`,
+     * which carries the deprecation notice. Disabling an already disabled
+     * application replaces its notice.
+     *
+     * @param applicationId - ID of the application to disable
+     * @param options - Optional deprecation notice
+     * @returns The updated application
+     */
+    disableApplication(applicationId: string, options?: DisableAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Enables a disabled application and clears its deprecation notice.
+     *
+     * @param applicationId - ID of the application to enable
+     * @returns The updated application
+     */
+    enableApplication(applicationId: string): Promise<AdminApplicationRecord>;
     /** Lists the role catalog for an application. */
     listApplicationRoles(applicationId: string): Promise<AdminApplicationRole[]>;
     /** Creates an application-scoped role definition. */
@@ -5513,10 +5630,11 @@ declare class AdminService {
      */
     cancelInvite(invitationId: string): Promise<void>;
     /**
-     * Re-sends an organization invitation email as a global admin.
-     * @param options - Organization, email, role, and optional application and teams
+     * Replaces a pending invitation with a new one that keeps its roles and
+     * teams, and emails it, as a global admin.
+     * @param invitationId - The ID of the invitation to resend
      */
-    resendInvite(options: ResendAdminInviteOptions): Promise<void>;
+    resendInvite(invitationId: string): Promise<void>;
     /**
      * Invites several users to an organization in one call, or — with
      * `sendInvite: false` — adds them as members immediately, creating user
@@ -5581,6 +5699,18 @@ type ListMembersOptions = {
     sortBy?: 'createdAt';
     /** Sort direction for the member page. */
     sortDirection?: 'asc' | 'desc';
+    /** With an application session, also lists organization members without access to the application, marked hasAccess: false. Requires permission to grant access. */
+    includeWithoutAccess?: boolean;
+};
+/**
+ * Organization member as returned to an application session, with the member's
+ * role in the application.
+ */
+type ApplicationScopedMember = Member & {
+    /** The member's role in the application, or null without access. */
+    applicationRole?: string | null;
+    /** Present when includeWithoutAccess was requested. */
+    hasAccess?: boolean;
 };
 /**
  * Options for inviting a user to the active organization.
@@ -5594,6 +5724,8 @@ type InviteUserToOrganizationOptions = {
     userEmail: string;
     /** Organization role to assign to the invited user. */
     role: Role;
+    /** Application role granted on acceptance. Required with an application-scoped session. */
+    applicationRole?: string;
     /** Optional team to add the user to upon acceptance. */
     teamId?: string;
     /** Whether to resend the invitation if one already exists for this email. */
@@ -5615,12 +5747,16 @@ type RemoveUserFromOrganizationOptions = {
 };
 /**
  * Options for updating a member's role within the organization.
+ *
+ * With an application-scoped session, `role` is an application role and the
+ * update grants or changes access to that application. The organization role
+ * is left unchanged.
  */
 type UpdateMemberRoleOptions = {
     /** The member ID whose role should be updated. */
     memberId: string;
-    /** The new role to assign. */
-    role: Role;
+    /** The new role to assign: an organization role, or an application role in app mode. */
+    role: Role | (string & {});
 };
 /**
  * Payload for creating a new team.
@@ -5752,29 +5888,10 @@ declare class OrganizationService {
      * @param options - Pagination options
      * @param options.limit - Maximum number of members to return
      * @param options.offset - Number of members to skip
-     * @returns An array of organization members
+     * @param options.includeWithoutAccess - With an application session, also list members without access to the application
+     * @returns An array of organization members, with their application role when the session is an application session
      */
-    listMembers(options?: ListMembersOptions): Promise<({
-        id: string;
-        organizationId: string;
-        role: "org:admin" | "org:member" | "org:reviewer";
-        createdAt: Date;
-        userId: string;
-        teamId?: string | undefined | undefined;
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            image?: string | undefined;
-        };
-    } & {
-        user: {
-            id: string;
-            name: string;
-            email: string;
-            image: string | null | undefined;
-        };
-    })[]>;
+    listMembers(options?: ListMembersOptions): Promise<ApplicationScopedMember[]>;
     /**
      * Gets the currently active organization member for the authenticated user.
      *
@@ -5820,11 +5937,12 @@ declare class OrganizationService {
      * @param options - Invitation configuration
      * @param options.userEmail - Email address of the user to invite
      * @param options.role - Role to assign to the invited user
+     * @param options.applicationRole - Application role granted on acceptance; required with an application-scoped session
      * @param options.teamId - Team ID to add the user to
      * @param options.resend - Whether to resend if invitation already exists
      * @returns The created invitation
      */
-    inviteUserToOrganization({ userEmail, role, teamId, resend }: InviteUserToOrganizationOptions): Promise<NonNullable<{
+    inviteUserToOrganization({ userEmail, role, applicationRole, teamId, resend }: InviteUserToOrganizationOptions): Promise<NonNullable<{
         id: string;
         organizationId: string;
         email: string;
@@ -5885,6 +6003,9 @@ declare class OrganizationService {
     /**
      * Removes a user from the active organization.
      *
+     * With an application-scoped session, revokes the member's access to that
+     * application and keeps the membership.
+     *
      * @param options - Provide either `memberId` or `userEmail` to identify the user
      * @param options.memberId - Membership ID to remove
      * @param options.userEmail - Email address of the member to remove
@@ -5893,6 +6014,10 @@ declare class OrganizationService {
     /**
      * Updates the role of an organization member.
      *
+     * With an application-scoped session, `role` is an application role: the
+     * update grants or changes the member's access to that application and
+     * keeps the organization role.
+     *
      * @param options - Role update configuration
      * @param options.memberId - The member ID to update
      * @param options.role - The new role to assign
@@ -6551,5 +6676,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationDeprecation, ApplicationDisabledPayload, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, DisableAdminApplicationOptions, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "3.0.0";
+const version = "3.2.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -178,6 +178,12 @@ const invitationAdditionalFields = {
     type: "string",
     input: true,
     required: false
+  },
+  /** Application role granted when an application invitation is accepted. */
+  applicationRole: {
+    type: "string",
+    input: true,
+    required: false
   }
 };
 const JWTPayloadUser = z$1.object({
@@ -362,6 +368,11 @@ function applicationsPluginClient() {
               method: "POST",
               headers
             });
+          },
+          listApplicationRoles: async () => {
+            return await $fetch("/applications/roles", {
+              method: "GET"
+            });
           }
         }
       };
@@ -599,6 +610,35 @@ class AdminService {
       body: options
     });
   }
+  /**
+   * Disables an application. Sign-ins, token exchanges, refreshes and
+   * client-credentials exchanges through it fail with `application_disabled`,
+   * which carries the deprecation notice. Disabling an already disabled
+   * application replaces its notice.
+   *
+   * @param applicationId - ID of the application to disable
+   * @param options - Optional deprecation notice
+   * @returns The updated application
+   */
+  async disableApplication(applicationId, options = {}) {
+    return await this.requestApplicationRoute("applications/:applicationId/disable", {
+      params: { applicationId },
+      method: "POST",
+      body: options
+    });
+  }
+  /**
+   * Enables a disabled application and clears its deprecation notice.
+   *
+   * @param applicationId - ID of the application to enable
+   * @returns The updated application
+   */
+  async enableApplication(applicationId) {
+    return await this.requestApplicationRoute("applications/:applicationId/enable", {
+      params: { applicationId },
+      method: "POST"
+    });
+  }
   /** Lists the role catalog for an application. */
   async listApplicationRoles(applicationId) {
     return await this.requestApplicationRoute(
@@ -730,7 +770,8 @@ class AdminService {
         ...options.query ? { query: options.query } : {},
         ...options.organizationsPreview !== void 0 ? { organizations_preview: options.organizationsPreview } : {},
         ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {},
-        ...options.organizationId ? { organization_id: options.organizationId } : {}
+        ...options.organizationId ? { organization_id: options.organizationId } : {},
+        ...options.applicationId ? { application_id: options.applicationId } : {}
       }
     });
   }
@@ -864,7 +905,8 @@ class AdminService {
         ...options.includeInvitations !== void 0 ? { include_invitations: options.includeInvitations } : {},
         ...options.includeAccess !== void 0 ? { include_access: options.includeAccess } : {},
         ...options.sortBy ? { sortBy: options.sortBy } : {},
-        ...options.sortDirection ? { sortDirection: options.sortDirection } : {}
+        ...options.sortDirection ? { sortDirection: options.sortDirection } : {},
+        ...options.applicationId ? { application_id: options.applicationId } : {}
       }
     });
   }
@@ -1114,14 +1156,12 @@ class AdminService {
     await this.client.$fetch("/admin/invites/cancel", { method: "POST", body: { invitationId } });
   }
   /**
-   * Re-sends an organization invitation email as a global admin.
-   * @param options - Organization, email, role, and optional application and teams
+   * Replaces a pending invitation with a new one that keeps its roles and
+   * teams, and emails it, as a global admin.
+   * @param invitationId - The ID of the invitation to resend
    */
-  async resendInvite(options) {
-    await this.client.$fetch("/admin/organizations/users", {
-      method: "POST",
-      body: { ...options, sendInvite: true, resend: true }
-    });
+  async resendInvite(invitationId) {
+    await this.client.$fetch("/admin/invites/resend", { method: "POST", body: { invitationId } });
   }
   /**
    * Invites several users to an organization in one call, or — with
@@ -1191,6 +1231,41 @@ class ApplicationSessionAssuranceError extends ApplicationError {
     this.validStepUps = payload?.validStepUps ?? [];
   }
 }
+function parseApplicationDisabledPayload(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = error;
+  while (current && typeof current === "object" && !seen.has(current)) {
+    seen.add(current);
+    const candidate = current;
+    for (const details of [candidate.details, candidate.error?.details]) {
+      if (!details || typeof details !== "object") {
+        continue;
+      }
+      const payload = details;
+      if (payload.code === "application_disabled" && typeof payload.applicationId === "string") {
+        return {
+          applicationId: payload.applicationId,
+          applicationName: typeof payload.applicationName === "string" ? payload.applicationName : "",
+          deprecationNotice: typeof payload.deprecationNotice === "string" ? payload.deprecationNotice : null
+        };
+      }
+    }
+    current = candidate.cause;
+  }
+  return null;
+}
+class ApplicationDisabledError extends ApplicationError {
+  applicationId;
+  applicationName;
+  deprecationNotice;
+  constructor(payload = null, options) {
+    super(payload?.deprecationNotice || `${payload?.applicationName || "The application"} has been disabled`, options);
+    this.code = "APPLICATION_DISABLED";
+    this.applicationId = payload?.applicationId ?? null;
+    this.applicationName = payload?.applicationName || null;
+    this.deprecationNotice = payload?.deprecationNotice ?? null;
+  }
+}
 class UserNotLoggedInError extends ApplicationError {
   constructor(message, options) {
     super(message, options);
@@ -1422,8 +1497,17 @@ function parseErrorMessage(error) {
   const nested = typeof candidateError.error === "string" ? candidateError.error : candidateError.error?.message;
   return candidateError.message ?? nested ?? "Failed to exchange device code for tokens";
 }
+function throwIfApplicationDisabled(error) {
+  const payload = parseApplicationDisabledPayload(error);
+  if (payload) {
+    throw new ApplicationDisabledError(payload, { cause: error });
+  }
+}
 function throwDeviceGrantError(error) {
   const code = parseErrorCode(error);
+  if (code === "application_disabled") {
+    throw new ApplicationDisabledError(parseApplicationDisabledPayload(error), { cause: error });
+  }
   if (code === "authorization_pending") {
     throw new DeviceAuthorizationPendingError({ cause: error });
   }
@@ -1501,6 +1585,7 @@ class ApplicationService {
     try {
       const response = await this.client.applications.startAuthorizationFlow(applicationId, redirectUri, codeChallenge, organizationId);
       if (!response.data) {
+        throwIfApplicationDisabled(response.error);
         const payload = parseSessionAssuranceRequiredPayload(response.error);
         if (payload) {
           throw new SessionAssuranceRequiredError(payload, { cause: response.error });
@@ -1509,9 +1594,10 @@ class ApplicationService {
       }
       return response.data;
     } catch (error) {
-      if (error instanceof SessionAssuranceRequiredError) {
+      if (error instanceof SessionAssuranceRequiredError || error instanceof ApplicationDisabledError) {
         throw error;
       }
+      throwIfApplicationDisabled(error);
       const payload = parseSessionAssuranceRequiredPayload(error);
       if (payload) {
         throw new SessionAssuranceRequiredError(payload, { cause: error });
@@ -1594,6 +1680,7 @@ class ApplicationService {
    * @throws {DeviceCodeExpiredError} The device code has expired
    * @throws {DeviceTransientServerError} Transient server error — safe to retry
    * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
+   * @throws {ApplicationDisabledError} The requester or target application is disabled — stop polling
    */
   async exchangeDeviceCodeForTokens(deviceCode) {
     try {
@@ -1618,8 +1705,12 @@ class ApplicationService {
    * @returns A short-lived access token with service-account and organization details
    */
   async exchangeClientCredentialsForToken(credentials) {
-    const response = await this.client.applications.exchangeClientCredentialsForToken(credentials);
+    const response = await this.client.applications.exchangeClientCredentialsForToken(credentials).catch((error) => {
+      throwIfApplicationDisabled(error);
+      throw error;
+    });
     if (!response.data) {
+      throwIfApplicationDisabled(response.error);
       throw new Error("No data returned from the API", { cause: response.error });
     }
     return response.data;
@@ -1631,8 +1722,12 @@ class ApplicationService {
    * @param codeVerifier - The code verifier to use for the authorization flow
    */
   async completeAuthorizationFlow(code, codeVerifier) {
-    const response = await this.client.applications.completeAuthorizationFlow(code, codeVerifier);
+    const response = await this.client.applications.completeAuthorizationFlow(code, codeVerifier).catch((error) => {
+      throwIfApplicationDisabled(error);
+      throw error;
+    });
     if (!response.data) {
+      throwIfApplicationDisabled(response.error);
       throw new Error("No data returned from the API", { cause: response.error });
     }
     return response.data;
@@ -1642,11 +1737,15 @@ class ApplicationService {
    *
    * @param refreshToken - The refresh token to use for the authentication token refresh
    * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
+   * @throws {ApplicationDisabledError} When the application has been disabled
    * @throws {ApplicationError} For other API errors
    */
   async refreshAccessToken(refreshToken) {
     const handleRefreshError = (error) => {
       const status = error?.status;
+      if (parseErrorCode(error) === "application_disabled") {
+        throw new ApplicationDisabledError(parseApplicationDisabledPayload(error), { cause: error, status });
+      }
       if (status === 401 || status === 404) {
         throw new RefreshTokenExpiredError({ cause: error, status });
       }
@@ -1714,6 +1813,18 @@ class ApplicationService {
   async logout(refreshToken) {
     await this.client.applications.logout(refreshToken);
   }
+  /**
+   * Lists the roles of the application the current session was issued for.
+   *
+   * @returns The application's roles
+   */
+  async listRoles() {
+    const response = await this.client.applications.listApplicationRoles();
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data;
+  }
 }
 
 class OrganizationService {
@@ -1776,7 +1887,8 @@ class OrganizationService {
    * @param options - Pagination options
    * @param options.limit - Maximum number of members to return
    * @param options.offset - Number of members to skip
-   * @returns An array of organization members
+   * @param options.includeWithoutAccess - With an application session, also list members without access to the application
+   * @returns An array of organization members, with their application role when the session is an application session
    */
   async listMembers(options) {
     const members = await this.client.organization.listMembers({
@@ -1801,16 +1913,18 @@ class OrganizationService {
    * @param options - Invitation configuration
    * @param options.userEmail - Email address of the user to invite
    * @param options.role - Role to assign to the invited user
+   * @param options.applicationRole - Application role granted on acceptance; required with an application-scoped session
    * @param options.teamId - Team ID to add the user to
    * @param options.resend - Whether to resend if invitation already exists
    * @returns The created invitation
    */
-  async inviteUserToOrganization({ userEmail, role, teamId, resend }) {
+  async inviteUserToOrganization({ userEmail, role, applicationRole, teamId, resend }) {
     return await this.client.organization.inviteMember({
       email: userEmail,
       role,
       teamId,
-      resend: resend ?? false
+      resend: resend ?? false,
+      ...applicationRole ? { applicationRole } : {}
     });
   }
   /**
@@ -1873,6 +1987,9 @@ class OrganizationService {
   /**
    * Removes a user from the active organization.
    *
+   * With an application-scoped session, revokes the member's access to that
+   * application and keeps the membership.
+   *
    * @param options - Provide either `memberId` or `userEmail` to identify the user
    * @param options.memberId - Membership ID to remove
    * @param options.userEmail - Email address of the member to remove
@@ -1885,6 +2002,10 @@ class OrganizationService {
   /**
    * Updates the role of an organization member.
    *
+   * With an application-scoped session, `role` is an application role: the
+   * update grants or changes the member's access to that application and
+   * keeps the organization role.
+   *
    * @param options - Role update configuration
    * @param options.memberId - The member ID to update
    * @param options.role - The new role to assign
@@ -2610,4 +2731,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "3.0.0",
+    "version": "3.2.0",
     "type": "module",
     "exports": {
         ".": {