@meistrari/auth-core 3.1.0 → 3.3.0

package/dist/index.d.mts

@@ -651,12 +651,22 @@ type ListCandidateOrganizationsResponse = Array<FullOrganization & {
      */
     lastUsed?: boolean;
 }>;
+/**
+ * Whether an application refuses sign-ins, and the notice shown to users who
+ * try to sign in through it.
+ */
+type ApplicationDeprecation = {
+    /** Whether the application is disabled. A disabled application refuses every sign-in. */
+    disabled: boolean;
+    /** Plain-text notice written by an admin, or `null` when the application is enabled or has none. */
+    deprecationNotice: string | null;
+};
 /**
  * Public application context used to preserve continuity during auth redirects.
  */
 type ApplicationAuthContextResponse = {
     /** Minimal application identity shown in the hosted auth flow. */
-    application: Pick<Application, 'id' | 'name' | 'config'>;
+    application: Pick<Application, 'id' | 'name' | 'config'> & ApplicationDeprecation;
     /**
      * Login methods usable for this application: the environment allowlist
      * intersected with the application's accepted AMRs.
@@ -757,7 +767,7 @@ type DeviceContextApplication = {
     name: string;
     /** Human-readable description, or `null` if not set. */
     description: string | null;
-};
+} & ApplicationDeprecation;
 /**
  * Context information for a pending device authorization request.
  */
@@ -768,7 +778,7 @@ type DeviceAuthorizationContextResponse = {
     };
     /** The target application the requester wants access to. */
     target: DeviceContextApplication;
-    /** Organizations the user can authorize the device for. */
+    /** Organizations the user can authorize the device for. Empty when the requester or the target is disabled. */
     organizations: FullOrganization[];
     /** Organization pre-selected by the requester, if any. */
     preselectedOrganizationId: string | null;
@@ -842,6 +852,37 @@ declare class ApplicationSessionAssuranceError extends ApplicationError {
     readonly validStepUps: SessionAssuranceRequiredPayload['validStepUps'];
     constructor(payload?: SessionAssuranceRequiredPayload | null, options?: ErrorOptions);
 }
+/**
+ * Payload the API attaches to an `application_disabled` error.
+ */
+type ApplicationDisabledPayload = {
+    applicationId: string;
+    applicationName: string;
+    deprecationNotice: string | null;
+};
+/**
+ * Reads the {@link ApplicationDisabledPayload} from an error returned by the
+ * API, following `cause` chains. Returns `null` when the error is not an
+ * `application_disabled` error.
+ *
+ * @param error - The caught error value
+ */
+declare function parseApplicationDisabledPayload(error: unknown): ApplicationDisabledPayload | null;
+/**
+ * Thrown when the application was disabled by an admin. Every sign-in, token
+ * exchange and refresh through it fails until it is enabled again, so clients
+ * must not retry or start a new flow.
+ *
+ * The message is the application's deprecation notice when it has one.
+ */
+declare class ApplicationDisabledError extends ApplicationError {
+    readonly applicationId: string | null;
+    readonly applicationName: string | null;
+    readonly deprecationNotice: string | null;
+    constructor(payload?: ApplicationDisabledPayload | null, options?: ErrorOptions & {
+        status?: number;
+    });
+}
 /**
  * Thrown when an operation requires an authenticated user but no session exists.
  */
@@ -993,6 +1034,7 @@ declare class ApplicationService {
      * @throws {DeviceCodeExpiredError} The device code has expired
      * @throws {DeviceTransientServerError} Transient server error — safe to retry
      * @throws {ApplicationSessionAssuranceError} Assurance policy changed or is no longer met — start a new flow
+     * @throws {ApplicationDisabledError} The requester or target application is disabled — stop polling
      */
     exchangeDeviceCodeForTokens(deviceCode: string): Promise<CompleteAuthorizationFlowResponse>;
     /**
@@ -1017,6 +1059,7 @@ declare class ApplicationService {
      *
      * @param refreshToken - The refresh token to use for the authentication token refresh
      * @throws {RefreshTokenExpiredError} When the refresh token has expired or is invalid
+     * @throws {ApplicationDisabledError} When the application has been disabled
      * @throws {ApplicationError} For other API errors
      */
     refreshAccessToken(refreshToken: string): Promise<CompleteAuthorizationFlowResponse>;
@@ -4516,6 +4559,13 @@ type CreateAdminApplicationSecretOptions = {
     /** Optional display name for the secret. */
     name?: string;
 };
+/**
+ * Options accepted when disabling an application.
+ */
+type DisableAdminApplicationOptions = {
+    /** Plain-text notice shown to users who try to sign in through the application. Blank or `null` clears it. */
+    deprecationNotice?: string | null;
+};
 /**
  * Client secret metadata returned by application management endpoints.
  */
@@ -5044,6 +5094,12 @@ type AdminApplication = {
     config: ApplicationConfig | null;
     serviceAccountUserId: string | null;
     serviceAccountUser?: AdminApplicationIdentity | null;
+    /** When the application was disabled, or `null` while it is enabled. A disabled application refuses every sign-in. */
+    disabledAt: string | null;
+    /** ID of the admin who disabled the application, or `null`. */
+    disabledBy: string | null;
+    /** Plain-text notice shown to users who try to sign in through the disabled application. */
+    deprecationNotice: string | null;
     createdBy: string;
     updatedBy: string;
     createdAt: string;
@@ -5162,6 +5218,97 @@ type InviteAdminOrganizationUsersResult = {
         message?: string;
     }[];
 };
+/**
+ * Entitlement that decides access to an application for one organization: the
+ * organization's own, or global access shared by every organization.
+ */
+type AdminOrganizationApplicationEntitlement = {
+    id: string;
+    type: 'organization' | 'global';
+    enabled: boolean;
+    createdAt: string;
+};
+/**
+ * Application available to one organization, as its admins see it.
+ */
+type AdminOrganizationEntitledApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+    homeUrl: string | null;
+    entitlement: AdminOrganizationApplicationEntitlement;
+    /** Whether the caller can edit the rules here: only global admins, and only on the organization's own entitlement. */
+    editable: boolean;
+    /** When the application was disabled, or `null`. A disabled application refuses every sign-in, whatever its rules. */
+    disabledAt: string | null;
+    /** Rules in evaluation order; the first one that matches a member decides. */
+    rules: Array<AdminEntitlementRule & {
+        /** User-facing name of the role from the application role catalog. Null for denials and unknown roles. */
+        roleDisplayName: string | null;
+    }>;
+    /** Active members the rules grant a role to. Zero while the entitlement or the application is disabled. */
+    memberCount: number;
+    members: AdminApplicationMember[];
+};
+/**
+ * Role an application can grant, from its role catalog.
+ */
+type AdminOrganizationApplicationRole = {
+    name: string;
+    displayName: string;
+    description: string;
+};
+/**
+ * One application of an organization with the roles its rules can grant.
+ */
+type AdminOrganizationApplicationAccess = AdminOrganizationEntitledApplication & {
+    roles: AdminOrganizationApplicationRole[];
+};
+/** Options accepted when listing the applications of an organization. */
+type ListAdminOrganizationApplicationsOptions = {
+    organizationId: string;
+    /** Case-insensitive application name match. */
+    search?: string;
+};
+/** Options accepted when reading or listing members of one application of an organization. */
+type GetAdminOrganizationApplicationOptions = {
+    organizationId: string;
+    applicationId: string;
+};
+/** Options accepted when replacing the rules of an organization's own entitlement. */
+type SetAdminOrganizationApplicationRulesOptions = GetAdminOrganizationApplicationOptions & {
+    /** Rules in evaluation order. Positions are assigned from the order. */
+    rules: Array<Omit<AdminEntitlementRule, 'position'>>;
+};
+/** Options accepted when listing the members of an organization against one application. */
+type ListAdminOrganizationApplicationMembersOptions = GetAdminOrganizationApplicationOptions & {
+    /** Case-insensitive name or email match. */
+    query?: string;
+    /** Maximum number of members to return. Defaults to 50. */
+    limit?: number;
+    /** Number of members to skip. Defaults to 0. */
+    offset?: number;
+};
+/**
+ * Active organization member with the outcome of an application's rules for them.
+ */
+type AdminOrganizationApplicationMember = AdminApplicationMember & {
+    /** Role granted to the member, or null when no rule grants access. */
+    role: string | null;
+    roleDisplayName: string | null;
+    /** First rule that matched the member, or null when none did. A matched rule with a null role denies access. */
+    matchedRule: {
+        type: AdminEntitlementRuleType;
+        position: number;
+    } | null;
+};
+/** Paginated listing of an organization's members against one application. */
+type ListAdminOrganizationApplicationMembersResult = {
+    members: AdminOrganizationApplicationMember[];
+    total: number;
+    limit: number;
+    offset: number;
+};
 
 /**
  * Service for global admin operations.
@@ -5194,6 +5341,12 @@ declare class AdminService {
      * @returns The parsed JSON response
      */
     private requestApplicationRoute;
+    /**
+     * Calls an admin endpoint and returns its JSON body. The client is configured
+     * to throw on error responses, but better-auth types `$fetch` as returning
+     * `{ data, error }`; this narrows the result to the body it actually resolves to.
+     */
+    private fetchAdminRoute;
     /**
      * Lists applications, optionally filtered by organization.
      *
@@ -5216,6 +5369,24 @@ declare class AdminService {
      * @returns The updated application
      */
     updateApplication(applicationId: string, options: CreateAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Disables an application. Sign-ins, token exchanges, refreshes and
+     * client-credentials exchanges through it fail with `application_disabled`,
+     * which carries the deprecation notice. Disabling an already disabled
+     * application replaces its notice.
+     *
+     * @param applicationId - ID of the application to disable
+     * @param options - Optional deprecation notice
+     * @returns The updated application
+     */
+    disableApplication(applicationId: string, options?: DisableAdminApplicationOptions): Promise<AdminApplicationRecord>;
+    /**
+     * Enables a disabled application and clears its deprecation notice.
+     *
+     * @param applicationId - ID of the application to enable
+     * @returns The updated application
+     */
+    enableApplication(applicationId: string): Promise<AdminApplicationRecord>;
     /** Lists the role catalog for an application. */
     listApplicationRoles(applicationId: string): Promise<AdminApplicationRole[]>;
     /** Creates an application-scoped role definition. */
@@ -5269,17 +5440,7 @@ declare class AdminService {
      * @param options - Pagination, ordering, search, and preview options
      * @returns The paginated organization listing
      */
-    listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminOrganizationsResult;
-        error: null;
-    }>;
+    listOrganizations(options?: ListAdminOrganizationsOptions): Promise<ListAdminOrganizationsResult>;
     /**
      * Lists users, optionally with organization previews and totals when a
      * preview size is requested. Global admins list across every organization
@@ -5289,17 +5450,7 @@ declare class AdminService {
      * @param options - Pagination, ordering, search, preview, and organization options
      * @returns The paginated user listing
      */
-    listUsers(options?: ListAdminUsersOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminUsersResult;
-        error: null;
-    }>;
+    listUsers(options?: ListAdminUsersOptions): Promise<ListAdminUsersResult>;
     /**
      * Fetches a single user by ID.
      *
@@ -5314,9 +5465,7 @@ declare class AdminService {
      * @param options - Organization ID and listing adjacency options
      * @returns The organization
      */
-    getOrganization(options: GetAdminOrganizationOptions): Promise<{
-        data: AdminOrganization;
-    } | null>;
+    getOrganization(options: GetAdminOrganizationOptions): Promise<AdminOrganization>;
     /**
      * Fetches minimal identity and branding (id, name, logo) for several
      * organizations at once, for surfaces such as the vault pages that resolve
@@ -5328,7 +5477,7 @@ declare class AdminService {
      * @param options - The workspace (organization) IDs to resolve
      * @returns The organization summaries for the IDs that exist
      */
-    getOrganizationsSummary(options: GetAdminOrganizationsSummaryOptions): Promise<any>;
+    getOrganizationsSummary(options: GetAdminOrganizationsSummaryOptions): Promise<AdminOrganizationSummary[]>;
     /**
      * Fetches the per-organization access report for a single user: their
      * organizations with role, membership ID, and teams, plus each
@@ -5337,9 +5486,7 @@ declare class AdminService {
      * @param userId - The ID of the user to fetch access for
      * @returns The user access report
      */
-    getUserAccess(userId: string): Promise<{
-        data: AdminUserAccess;
-    } | null>;
+    getUserAccess(userId: string): Promise<AdminUserAccess>;
     /**
      * Lists applications with their entitlements as a global admin. Unlike
      * {@link listApplications}, which goes through the session-only application
@@ -5348,17 +5495,7 @@ declare class AdminService {
      * @param options - Pagination, ordering, organization filter, search, and member preview options
      * @returns The application listing with entitlement details
      */
-    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminApplicationsResult;
-        error: null;
-    }>;
+    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<ListAdminApplicationsResult>;
     /**
      * Lists the users with access to an application as a global admin, one row
      * per user with every organization that grants them access and the role it
@@ -5367,34 +5504,47 @@ declare class AdminService {
      * @param options - Application ID, organization filter, pagination, and search options
      * @returns The paginated application member listing
      */
-    listApplicationMembers(options: ListAdminApplicationMembersOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminApplicationMembersResult;
-        error: null;
-    }>;
+    listApplicationMembers(options: ListAdminApplicationMembersOptions): Promise<ListAdminApplicationMembersResult>;
     /**
      * Lists active members for one organization as a global admin.
      *
      * @param options - Organization ID, pagination, and search options
      * @returns The paginated organization member listing
      */
-    listOrganizationMembers(options: ListAdminOrganizationMembersOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminOrganizationMembersResult;
-        error: null;
-    }>;
+    listOrganizationMembers(options: ListAdminOrganizationMembersOptions): Promise<ListAdminOrganizationMembersResult>;
+    /**
+     * Lists the applications available to one organization with the entitlement
+     * that decides their access and its rules. Global admins may list any
+     * organization; an organization admin only their own.
+     *
+     * @param options - Organization ID and search options
+     * @returns The organization's applications
+     */
+    listOrganizationApplications(options: ListAdminOrganizationApplicationsOptions): Promise<AdminOrganizationEntitledApplication[]>;
+    /**
+     * Fetches one application of an organization with its rules and the roles
+     * those rules can grant.
+     *
+     * @param options - Organization and application IDs
+     * @returns The application access
+     */
+    getOrganizationApplication(options: GetAdminOrganizationApplicationOptions): Promise<AdminOrganizationApplicationAccess>;
+    /**
+     * Replaces the rules of an organization's own entitlement to an application,
+     * in the order given, as a global admin. Global access is edited on the application.
+     *
+     * @param options - Organization and application IDs, and the rules in evaluation order
+     * @returns The updated application access
+     */
+    setOrganizationApplicationRules(options: SetAdminOrganizationApplicationRulesOptions): Promise<AdminOrganizationApplicationAccess>;
+    /**
+     * Lists every active member of an organization with the rule that decides
+     * their access to an application and the role it grants.
+     *
+     * @param options - Organization and application IDs, pagination, and search options
+     * @returns The paginated member listing
+     */
+    listOrganizationApplicationMembers(options: ListAdminOrganizationApplicationMembersOptions): Promise<ListAdminOrganizationApplicationMembersResult>;
     /**
      * Lists teams for one organization. Global admins may list any organization;
      * an organization admin only their own.
@@ -5402,26 +5552,14 @@ declare class AdminService {
      * @param options - Organization ID, pagination, search, and ordering options
      * @returns The paginated organization team listing
      */
-    listOrganizationTeams(options: ListAdminOrganizationTeamsOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminOrganizationTeamsResult;
-        error: null;
-    }>;
+    listOrganizationTeams(options: ListAdminOrganizationTeamsOptions): Promise<ListAdminOrganizationTeamsResult>;
     /**
      * Creates a team for one organization as a global admin.
      *
      * @param options - Organization ID, team name, and optional team members
      * @returns The created team
      */
-    createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
-        data: AdminOrganizationTeamRecord;
-    } | null>;
+    createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<AdminOrganizationTeamRecord>;
     /**
      * Updates a team for one organization. Global admins may update any
      * organization; an organization admin only their own.
@@ -5429,9 +5567,7 @@ declare class AdminService {
      * @param options - Organization ID, team ID, new name, and optional replacement member IDs
      * @returns The updated team
      */
-    updateOrganizationTeam(options: UpdateAdminOrganizationTeamOptions): Promise<{
-        data: AdminOrganizationTeamRecord;
-    } | null>;
+    updateOrganizationTeam(options: UpdateAdminOrganizationTeamOptions): Promise<AdminOrganizationTeamRecord>;
     /**
      * Deletes a team for one organization, detaching its members with it.
      * Global admins may delete from any organization; an organization admin
@@ -5476,9 +5612,7 @@ declare class AdminService {
      * @param options - Organization name and optional slug, logo, metadata, and settings
      * @returns The created organization
      */
-    createOrganization(options: CreateAdminOrganizationOptions): Promise<{
-        data: AdminOrganization;
-    } | null>;
+    createOrganization(options: CreateAdminOrganizationOptions): Promise<AdminOrganization>;
     /**
      * Updates an organization's profile and settings. Global admins may update
      * any organization; an organization admin only their own, and only the
@@ -5488,27 +5622,21 @@ declare class AdminService {
      * @param options - Organization ID and the fields to update
      * @returns The updated organization
      */
-    updateOrganization(options: UpdateAdminOrganizationOptions): Promise<{
-        data: AdminOrganization;
-    } | null>;
+    updateOrganization(options: UpdateAdminOrganizationOptions): Promise<AdminOrganization>;
     /**
      * Updates an organization member's role.
      *
      * @param options - Membership ID and the new role
      * @returns The updated membership
      */
-    updateMemberRole(options: UpdateAdminMemberRoleOptions): Promise<{
-        data: AdminMember;
-    } | null>;
+    updateMemberRole(options: UpdateAdminMemberRoleOptions): Promise<AdminMember>;
     /**
      * Removes an organization member.
      *
      * @param options - Membership ID to remove
      * @returns The removed membership
      */
-    removeMember(options: RemoveAdminMemberOptions): Promise<{
-        data: AdminMember;
-    } | null>;
+    removeMember(options: RemoveAdminMemberOptions): Promise<AdminMember>;
     /**
      * Sets a user's effective application role within an organization. A
      * non-null role grants access, a null role denies access (leave
@@ -5570,9 +5698,7 @@ declare class AdminService {
      * @param options - Organization, emails, role, and optional teams/application
      * @returns Per-email invite outcomes
      */
-    inviteOrganizationUsers(options: InviteAdminOrganizationUsersOptions): Promise<{
-        data: InviteAdminOrganizationUsersResult;
-    } | null>;
+    inviteOrganizationUsers(options: InviteAdminOrganizationUsersOptions): Promise<InviteAdminOrganizationUsersResult>;
 }
 
 /**
@@ -5606,8 +5732,8 @@ type AcceptInvitationResult = {
     homeUrl: string | null;
     /** Configured post-acceptance URL for plain organization invitations. */
     inviteAcceptedUrl: string | null;
-    /** The accepted organization membership. This may be an existing membership. */
-    member: Member;
+    /** The accepted organization membership. This may be an existing membership. It does not include the user record. */
+    member: Omit<Member, 'user'>;
 };
 /**
  * Fields that can be updated on an organization.
@@ -6602,5 +6728,5 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
  */
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationApplicationAccess, AdminOrganizationApplicationEntitlement, AdminOrganizationApplicationMember, AdminOrganizationApplicationRole, AdminOrganizationEntitledApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationDeprecation, ApplicationDisabledPayload, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, DisableAdminApplicationOptions, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationApplicationOptions, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationApplicationMembersOptions, ListAdminOrganizationApplicationMembersResult, ListAdminOrganizationApplicationsOptions, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminOrganizationApplicationRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };