@meistrari/auth-core 3.1.0 → 3.2.0

package/dist/index.d.mts

@@ -651,12 +651,22 @@ type ListCandidateOrganizationsResponse = Array<FullOrganization & {
      */
     lastUsed?: boolean;
 }>;
+/**
+ * Whether an application refuses sign-ins, and the notice shown to users who
+ * try to sign in through it.
+ */
+type ApplicationDeprecation = {
+    /** Whether the application is disabled. A disabled application refuses every sign-in. */
+    disabled: boolean;
+    /** Plain-text notice written by an admin, or `null` when the application is enabled or has none. */
+    deprecationNotice: string | null;
+};
 /**
  * Public application context used to preserve continuity during auth redirects.
  */
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
-    application: Pick<Application, 'id' | 'name' | 'config'>;
+    application: Pick<Application, 'id' | 'name' | 'config'> & ApplicationDeprecation;
     /**
      * Login methods usable for this application: the environment allowlist
      * intersected with the application's accepted AMRs.
@@ -757,7 +767,7 @@ type DeviceContextApplication = {
     name: string;
     /** Human-readable description, or `null` if not set. */
     description: string | null;
-};
+} & ApplicationDeprecation;
 /**
  * Context information for a pending device authorization request.
  */
@@ -768,7 +778,7 @@ type DeviceAuthorizationContextResponse = {
     };
     /** The target application the requester wants access to. */
     target: DeviceContextApplication;
-    /** Organizations the user can authorize the device for. */
+    /** Organizations the user can authorize the device for. Empty when the requester or the target is disabled. */
     organizations: FullOrganization[];
     /** Organization pre-selected by the requester, if any. */
     preselectedOrganizationId: string | null;
@@ -842,6 +852,37 @@ declare class ApplicationSessionAssuranceError extends ApplicationError {
     readonly validStepUps: SessionAssuranceRequiredPayload['validStepUps'];
     constructor(payload?: SessionAssuranceRequiredPayload | null, options?: ErrorOptions);
 }
+/**
+ * Payload the API attaches to an `application_disabled` error.
+ */
+type ApplicationDisabledPayload = {
+    applicationId: string;
+    applicationName: string;
+    deprecationNotice: string | null;
+};
+/**
+ * Reads the {@link ApplicationDisabledPayload} from an error returned by the
+ * API, following `cause` chains. Returns `null` when the error is not an
+ * `application_disabled` error.
+ *
+ * @param error - The caught error value
+ */
+declare function parseApplicationDisabledPayload(error: unknown): ApplicationDisabledPayload | null;
+/**
+ * Thrown when the application was disabled by an admin. Every sign-in, token
+ * exchange and refresh through it fails until it is enabled again, so clients
+ * must not retry or start a new flow.
+ *
+ * The message is the application's deprecation notice when it has one.
+ */
+declare class ApplicationDisabledError extends ApplicationError {
+    readonly applicationId: string | null;
+    readonly applicationName: string | null;
+    readonly deprecationNotice: string | null;
+    constructor(payload?: ApplicationDisabledPayload | null, options?: ErrorOptions & {
+        status?: number;
+    });
+}
 /**
  * Thrown when an operation requires an authenticated user but no session exists.
  */
@@ -993,6 +1034,7 @@ declare class ApplicationService {
      * @throws {DeviceCodeExpiredError} The device code has expired
      * @throws {DeviceTransientServerError} Transient server error — safe to retry
      * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
+     * @throws {ApplicationDisabledError} The requester or target application is disabled — stop polling
      */
     exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
     /**
@@ -1017,6 +1059,7 @@ declare class ApplicationService {
      *
      * @param refreshToken - The refresh token to use for the authentication token refresh
      * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
+     * @throws {ApplicationDisabledError} When the application has been disabled
      * @throws {ApplicationError} For other API errors
      */
     refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse>;
@@ -4516,6 +4559,13 @@ type CreateAdminApplicationSecretOptions = {
     /** Optional display name for the secret. */
     name?: string;
 };
+/**
+ * Options accepted when disabling an application.
+ */
+type DisableAdminApplicationOptions = {
+    /** Plain-text notice shown to users who try to sign in through the application. Blank or `null` clears it. */
+    deprecationNotice?: string | null;
+};
 /**
  * Client secret metadata returned by application management endpoints.
  */
@@ -5044,6 +5094,12 @@ type AdminApplication = {
     config: ApplicationConfig | null;
     serviceAccountUserId: string | null;
     serviceAccountUser?: AdminApplicationIdentity | null;
+    /** When the application was disabled, or `null` while it is enabled. A disabled application refuses every sign-in. */
+    disabledAt: string | null;
+    /** ID of the admin who disabled the application, or `null`. */
+    disabledBy: string | null;
+    /** Plain-text notice shown to users who try to sign in through the disabled application. */
+    deprecationNotice: string | null;
     createdBy: string;
     updatedBy: string;
     createdAt: string;
@@ -5216,6 +5272,24 @@ declare class AdminService {
      * @returns The updated application
      */
     updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Disables an application. Sign-ins, token exchanges, refreshes and
+     * client-credentials exchanges through it fail with `application_disabled`,
+     * which carries the deprecation notice. Disabling an already disabled
+     * application replaces its notice.
+     *
+     * @param applicationId - ID of the application to disable
+     * @param options - Optional deprecation notice
+     * @returns The updated application
+     */
+    disableApplication(applicationId: string, options?: DisableAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Enables a disabled application and clears its deprecation notice.
+     *
+     * @param applicationId - ID of the application to enable
+     * @returns The updated application
+     */
+    enableApplication(applicationId: string): Promise<AdminApplicationRecord>;
     /** Lists the role catalog for an application. */
     listApplicationRoles(applicationId: string): Promise<AdminApplicationRole[]>;
     /** Creates an application-scoped role definition. */
@@ -6602,5 +6676,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationDeprecation, ApplicationDisabledPayload, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, DisableAdminApplicationOptions, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -651,12 +651,22 @@ type ListCandidateOrganizationsResponse = Array<FullOrganization & {
      */
     lastUsed?: boolean;
 }>;
+/**
+ * Whether an application refuses sign-ins, and the notice shown to users who
+ * try to sign in through it.
+ */
+type ApplicationDeprecation = {
+    /** Whether the application is disabled. A disabled application refuses every sign-in. */
+    disabled: boolean;
+    /** Plain-text notice written by an admin, or `null` when the application is enabled or has none. */
+    deprecationNotice: string | null;
+};
 /**
  * Public application context used to preserve continuity during auth redirects.
  */
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
-    application: Pick<Application, 'id' | 'name' | 'config'>;
+    application: Pick<Application, 'id' | 'name' | 'config'> & ApplicationDeprecation;
     /**
      * Login methods usable for this application: the environment allowlist
      * intersected with the application's accepted AMRs.
@@ -757,7 +767,7 @@ type DeviceContextApplication = {
     name: string;
     /** Human-readable description, or `null` if not set. */
     description: string | null;
-};
+} & ApplicationDeprecation;
 /**
  * Context information for a pending device authorization request.
  */
@@ -768,7 +778,7 @@ type DeviceAuthorizationContextResponse = {
     };
     /** The target application the requester wants access to. */
     target: DeviceContextApplication;
-    /** Organizations the user can authorize the device for. */
+    /** Organizations the user can authorize the device for. Empty when the requester or the target is disabled. */
     organizations: FullOrganization[];
     /** Organization pre-selected by the requester, if any. */
     preselectedOrganizationId: string | null;
@@ -842,6 +852,37 @@ declare class ApplicationSessionAssuranceError extends ApplicationError {
     readonly validStepUps: SessionAssuranceRequiredPayload['validStepUps'];
     constructor(payload?: SessionAssuranceRequiredPayload | null, options?: ErrorOptions);
 }
+/**
+ * Payload the API attaches to an `application_disabled` error.
+ */
+type ApplicationDisabledPayload = {
+    applicationId: string;
+    applicationName: string;
+    deprecationNotice: string | null;
+};
+/**
+ * Reads the {@link ApplicationDisabledPayload} from an error returned by the
+ * API, following `cause` chains. Returns `null` when the error is not an
+ * `application_disabled` error.
+ *
+ * @param error - The caught error value
+ */
+declare function parseApplicationDisabledPayload(error: unknown): ApplicationDisabledPayload | null;
+/**
+ * Thrown when the application was disabled by an admin. Every sign-in, token
+ * exchange and refresh through it fails until it is enabled again, so clients
+ * must not retry or start a new flow.
+ *
+ * The message is the application's deprecation notice when it has one.
+ */
+declare class ApplicationDisabledError extends ApplicationError {
+    readonly applicationId: string | null;
+    readonly applicationName: string | null;
+    readonly deprecationNotice: string | null;
+    constructor(payload?: ApplicationDisabledPayload | null, options?: ErrorOptions & {
+        status?: number;
+    });
+}
 /**
  * Thrown when an operation requires an authenticated user but no session exists.
  */
@@ -993,6 +1034,7 @@ declare class ApplicationService {
      * @throws {DeviceCodeExpiredError} The device code has expired
      * @throws {DeviceTransientServerError} Transient server error — safe to retry
      * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
+     * @throws {ApplicationDisabledError} The requester or target application is disabled — stop polling
      */
     exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
     /**
@@ -1017,6 +1059,7 @@ declare class ApplicationService {
      *
      * @param refreshToken - The refresh token to use for the authentication token refresh
      * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
+     * @throws {ApplicationDisabledError} When the application has been disabled
      * @throws {ApplicationError} For other API errors
      */
     refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse>;
@@ -4516,6 +4559,13 @@ type CreateAdminApplicationSecretOptions = {
     /** Optional display name for the secret. */
     name?: string;
 };
+/**
+ * Options accepted when disabling an application.
+ */
+type DisableAdminApplicationOptions = {
+    /** Plain-text notice shown to users who try to sign in through the application. Blank or `null` clears it. */
+    deprecationNotice?: string | null;
+};
 /**
  * Client secret metadata returned by application management endpoints.
  */
@@ -5044,6 +5094,12 @@ type AdminApplication = {
     config: ApplicationConfig | null;
     serviceAccountUserId: string | null;
     serviceAccountUser?: AdminApplicationIdentity | null;
+    /** When the application was disabled, or `null` while it is enabled. A disabled application refuses every sign-in. */
+    disabledAt: string | null;
+    /** ID of the admin who disabled the application, or `null`. */
+    disabledBy: string | null;
+    /** Plain-text notice shown to users who try to sign in through the disabled application. */
+    deprecationNotice: string | null;
     createdBy: string;
     updatedBy: string;
     createdAt: string;
@@ -5216,6 +5272,24 @@ declare class AdminService {
      * @returns The updated application
      */
     updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Disables an application. Sign-ins, token exchanges, refreshes and
+     * client-credentials exchanges through it fail with `application_disabled`,
+     * which carries the deprecation notice. Disabling an already disabled
+     * application replaces its notice.
+     *
+     * @param applicationId - ID of the application to disable
+     * @param options - Optional deprecation notice
+     * @returns The updated application
+     */
+    disableApplication(applicationId: string, options?: DisableAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Enables a disabled application and clears its deprecation notice.
+     *
+     * @param applicationId - ID of the application to enable
+     * @returns The updated application
+     */
+    enableApplication(applicationId: string): Promise<AdminApplicationRecord>;
     /** Lists the role catalog for an application. */
     listApplicationRoles(applicationId: string): Promise<AdminApplicationRole[]>;
     /** Creates an application-scoped role definition. */
@@ -6602,5 +6676,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationDeprecation, ApplicationDisabledPayload, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, DisableAdminApplicationOptions, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "3.1.0";
+const version = "3.2.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -610,6 +610,35 @@ class AdminService {
       body: options
     });
   }
+  /**
+   * Disables an application. Sign-ins, token exchanges, refreshes and
+   * client-credentials exchanges through it fail with `application_disabled`,
+   * which carries the deprecation notice. Disabling an already disabled
+   * application replaces its notice.
+   *
+   * @param applicationId - ID of the application to disable
+   * @param options - Optional deprecation notice
+   * @returns The updated application
+   */
+  async disableApplication(applicationId, options = {}) {
+    return await this.requestApplicationRoute("applications/:applicationId/disable", {
+      params: { applicationId },
+      method: "POST",
+      body: options
+    });
+  }
+  /**
+   * Enables a disabled application and clears its deprecation notice.
+   *
+   * @param applicationId - ID of the application to enable
+   * @returns The updated application
+   */
+  async enableApplication(applicationId) {
+    return await this.requestApplicationRoute("applications/:applicationId/enable", {
+      params: { applicationId },
+      method: "POST"
+    });
+  }
   /** Lists the role catalog for an application. */
   async listApplicationRoles(applicationId) {
     return await this.requestApplicationRoute(
@@ -1202,6 +1231,41 @@ class ApplicationSessionAssuranceError extends ApplicationError {
     this.validStepUps = payload?.validStepUps ?? [];
   }
 }
+function parseApplicationDisabledPayload(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = error;
+  while (current && typeof current === "object" && !seen.has(current)) {
+    seen.add(current);
+    const candidate = current;
+    for (const details of [candidate.details, candidate.error?.details]) {
+      if (!details || typeof details !== "object") {
+        continue;
+      }
+      const payload = details;
+      if (payload.code === "application_disabled" && typeof payload.applicationId === "string") {
+        return {
+          applicationId: payload.applicationId,
+          applicationName: typeof payload.applicationName === "string" ? payload.applicationName : "",
+          deprecationNotice: typeof payload.deprecationNotice === "string" ? payload.deprecationNotice : null
+        };
+      }
+    }
+    current = candidate.cause;
+  }
+  return null;
+}
+class ApplicationDisabledError extends ApplicationError {
+  applicationId;
+  applicationName;
+  deprecationNotice;
+  constructor(payload = null, options) {
+    super(payload?.deprecationNotice || `${payload?.applicationName || "The application"} has been disabled`, options);
+    this.code = "APPLICATION_DISABLED";
+    this.applicationId = payload?.applicationId ?? null;
+    this.applicationName = payload?.applicationName || null;
+    this.deprecationNotice = payload?.deprecationNotice ?? null;
+  }
+}
 class UserNotLoggedInError extends ApplicationError {
   constructor(message, options) {
     super(message, options);
@@ -1433,8 +1497,17 @@ function parseErrorMessage(error) {
   const nested = typeof candidateError.error === "string" ? candidateError.error : candidateError.error?.message;
   return candidateError.message ?? nested ?? "Failed to exchange device code for tokens";
 }
+function throwIfApplicationDisabled(error) {
+  const payload = parseApplicationDisabledPayload(error);
+  if (payload) {
+    throw new ApplicationDisabledError(payload, { cause: error });
+  }
+}
 function throwDeviceGrantError(error) {
   const code = parseErrorCode(error);
+  if (code === "application_disabled") {
+    throw new ApplicationDisabledError(parseApplicationDisabledPayload(error), { cause: error });
+  }
   if (code === "authorization_pending") {
     throw new DeviceAuthorizationPendingError({ cause: error });
   }
@@ -1512,6 +1585,7 @@ class ApplicationService {
     try {
       const response = await this.client.applications.startAuthorizationFlow(applicationId, redirectUri, codeChallenge, organizationId);
       if (!response.data) {
+        throwIfApplicationDisabled(response.error);
         const payload = parseSessionAssuranceRequiredPayload(response.error);
         if (payload) {
           throw new SessionAssuranceRequiredError(payload, { cause: response.error });
@@ -1520,9 +1594,10 @@ class ApplicationService {
       }
       return response.data;
     } catch (error) {
-      if (error instanceof SessionAssuranceRequiredError) {
+      if (error instanceof SessionAssuranceRequiredError || error instanceof ApplicationDisabledError) {
         throw error;
       }
+      throwIfApplicationDisabled(error);
       const payload = parseSessionAssuranceRequiredPayload(error);
       if (payload) {
         throw new SessionAssuranceRequiredError(payload, { cause: error });
@@ -1605,6 +1680,7 @@ class ApplicationService {
    * @throws {DeviceCodeExpiredError} The device code has expired
    * @throws {DeviceTransientServerError} Transient server error — safe to retry
    * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
+   * @throws {ApplicationDisabledError} The requester or target application is disabled — stop polling
    */
   async exchangeDeviceCodeForTokens(deviceCode) {
     try {
@@ -1629,8 +1705,12 @@ class ApplicationService {
    * @returns A short-lived access token with service-account and organization details
    */
   async exchangeClientCredentialsForToken(credentials) {
-    const response = await this.client.applications.exchangeClientCredentialsForToken(credentials);
+    const response = await this.client.applications.exchangeClientCredentialsForToken(credentials).catch((error) => {
+      throwIfApplicationDisabled(error);
+      throw error;
+    });
     if (!response.data) {
+      throwIfApplicationDisabled(response.error);
       throw new Error("No data returned from the API", { cause: response.error });
     }
     return response.data;
@@ -1642,8 +1722,12 @@ class ApplicationService {
    * @param codeVerifier - The code verifier to use for the authorization flow
    */
   async completeAuthorizationFlow(code, codeVerifier) {
-    const response = await this.client.applications.completeAuthorizationFlow(code, codeVerifier);
+    const response = await this.client.applications.completeAuthorizationFlow(code, codeVerifier).catch((error) => {
+      throwIfApplicationDisabled(error);
+      throw error;
+    });
     if (!response.data) {
+      throwIfApplicationDisabled(response.error);
       throw new Error("No data returned from the API", { cause: response.error });
     }
     return response.data;
@@ -1653,11 +1737,15 @@ class ApplicationService {
    *
    * @param refreshToken - The refresh token to use for the authentication token refresh
    * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
+   * @throws {ApplicationDisabledError} When the application has been disabled
    * @throws {ApplicationError} For other API errors
    */
   async refreshAccessToken(refreshToken) {
     const handleRefreshError = (error) => {
       const status = error?.status;
+      if (parseErrorCode(error) === "application_disabled") {
+        throw new ApplicationDisabledError(parseApplicationDisabledPayload(error), { cause: error, status });
+      }
       if (status === 401 || status === 404) {
         throw new RefreshTokenExpiredError({ cause: error, status });
       }
@@ -2643,4 +2731,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "3.1.0",
+    "version": "3.2.0",
     "type": "module",
     "exports": {
         ".": {