@meistrari/auth-core 3.2.0 → 3.3.0

package/dist/index.d.mts

@@ -5218,6 +5218,97 @@ type InviteAdminOrganizationUsersResult = {
         message?: string;
     }[];
 };
+/**
+ * Entitlement that decides access to an application for one organization: the
+ * organization's own, or global access shared by every organization.
+ */
+type AdminOrganizationApplicationEntitlement = {
+    id: string;
+    type: 'organization' | 'global';
+    enabled: boolean;
+    createdAt: string;
+};
+/**
+ * Application available to one organization, as its admins see it.
+ */
+type AdminOrganizationEntitledApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+    homeUrl: string | null;
+    entitlement: AdminOrganizationApplicationEntitlement;
+    /** Whether the caller can edit the rules here: only global admins, and only on the organization's own entitlement. */
+    editable: boolean;
+    /** When the application was disabled, or `null`. A disabled application refuses every sign-in, whatever its rules. */
+    disabledAt: string | null;
+    /** Rules in evaluation order; the first one that matches a member decides. */
+    rules: Array<AdminEntitlementRule & {
+        /** User-facing name of the role from the application role catalog. Null for denials and unknown roles. */
+        roleDisplayName: string | null;
+    }>;
+    /** Active members the rules grant a role to. Zero while the entitlement or the application is disabled. */
+    memberCount: number;
+    members: AdminApplicationMember[];
+};
+/**
+ * Role an application can grant, from its role catalog.
+ */
+type AdminOrganizationApplicationRole = {
+    name: string;
+    displayName: string;
+    description: string;
+};
+/**
+ * One application of an organization with the roles its rules can grant.
+ */
+type AdminOrganizationApplicationAccess = AdminOrganizationEntitledApplication & {
+    roles: AdminOrganizationApplicationRole[];
+};
+/** Options accepted when listing the applications of an organization. */
+type ListAdminOrganizationApplicationsOptions = {
+    organizationId: string;
+    /** Case-insensitive application name match. */
+    search?: string;
+};
+/** Options accepted when reading or listing members of one application of an organization. */
+type GetAdminOrganizationApplicationOptions = {
+    organizationId: string;
+    applicationId: string;
+};
+/** Options accepted when replacing the rules of an organization's own entitlement. */
+type SetAdminOrganizationApplicationRulesOptions = GetAdminOrganizationApplicationOptions & {
+    /** Rules in evaluation order. Positions are assigned from the order. */
+    rules: Array<Omit<AdminEntitlementRule, 'position'>>;
+};
+/** Options accepted when listing the members of an organization against one application. */
+type ListAdminOrganizationApplicationMembersOptions = GetAdminOrganizationApplicationOptions & {
+    /** Case-insensitive name or email match. */
+    query?: string;
+    /** Maximum number of members to return. Defaults to 50. */
+    limit?: number;
+    /** Number of members to skip. Defaults to 0. */
+    offset?: number;
+};
+/**
+ * Active organization member with the outcome of an application's rules for them.
+ */
+type AdminOrganizationApplicationMember = AdminApplicationMember & {
+    /** Role granted to the member, or null when no rule grants access. */
+    role: string | null;
+    roleDisplayName: string | null;
+    /** First rule that matched the member, or null when none did. A matched rule with a null role denies access. */
+    matchedRule: {
+        type: AdminEntitlementRuleType;
+        position: number;
+    } | null;
+};
+/** Paginated listing of an organization's members against one application. */
+type ListAdminOrganizationApplicationMembersResult = {
+    members: AdminOrganizationApplicationMember[];
+    total: number;
+    limit: number;
+    offset: number;
+};
 
 /**
  * Service for global admin operations.
@@ -5250,6 +5341,12 @@ declare class AdminService {
      * @returns The parsed JSON response
      */
     private requestApplicationRoute;
+    /**
+     * Calls an admin endpoint and returns its JSON body. The client is configured
+     * to throw on error responses, but better-auth types `$fetch` as returning
+     * `{ data, error }`; this narrows the result to the body it actually resolves to.
+     */
+    private fetchAdminRoute;
     /**
      * Lists applications, optionally filtered by organization.
      *
@@ -5343,17 +5440,7 @@ declare class AdminService {
      * @param options - Pagination, ordering, search, and preview options
      * @returns The paginated organization listing
      */
-    listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminOrganizationsResult;
-        error: null;
-    }>;
+    listOrganizations(options?: ListAdminOrganizationsOptions): Promise<ListAdminOrganizationsResult>;
     /**
      * Lists users, optionally with organization previews and totals when a
      * preview size is requested. Global admins list across every organization
@@ -5363,17 +5450,7 @@ declare class AdminService {
      * @param options - Pagination, ordering, search, preview, and organization options
      * @returns The paginated user listing
      */
-    listUsers(options?: ListAdminUsersOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminUsersResult;
-        error: null;
-    }>;
+    listUsers(options?: ListAdminUsersOptions): Promise<ListAdminUsersResult>;
     /**
      * Fetches a single user by ID.
      *
@@ -5388,9 +5465,7 @@ declare class AdminService {
      * @param options - Organization ID and listing adjacency options
      * @returns The organization
      */
-    getOrganization(options: GetAdminOrganizationOptions): Promise<{
-        data: AdminOrganization;
-    } | null>;
+    getOrganization(options: GetAdminOrganizationOptions): Promise<AdminOrganization>;
     /**
      * Fetches minimal identity and branding (id, name, logo) for several
      * organizations at once, for surfaces such as the vault pages that resolve
@@ -5402,7 +5477,7 @@ declare class AdminService {
      * @param options - The workspace (organization) IDs to resolve
      * @returns The organization summaries for the IDs that exist
      */
-    getOrganizationsSummary(options: GetAdminOrganizationsSummaryOptions): Promise<any>;
+    getOrganizationsSummary(options: GetAdminOrganizationsSummaryOptions): Promise<AdminOrganizationSummary[]>;
     /**
      * Fetches the per-organization access report for a single user: their
      * organizations with role, membership ID, and teams, plus each
@@ -5411,9 +5486,7 @@ declare class AdminService {
      * @param userId - The ID of the user to fetch access for
      * @returns The user access report
      */
-    getUserAccess(userId: string): Promise<{
-        data: AdminUserAccess;
-    } | null>;
+    getUserAccess(userId: string): Promise<AdminUserAccess>;
     /**
      * Lists applications with their entitlements as a global admin. Unlike
      * {@link listApplications}, which goes through the session-only application
@@ -5422,17 +5495,7 @@ declare class AdminService {
      * @param options - Pagination, ordering, organization filter, search, and member preview options
      * @returns The application listing with entitlement details
      */
-    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminApplicationsResult;
-        error: null;
-    }>;
+    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<ListAdminApplicationsResult>;
     /**
      * Lists the users with access to an application as a global admin, one row
      * per user with every organization that grants them access and the role it
@@ -5441,34 +5504,47 @@ declare class AdminService {
      * @param options - Application ID, organization filter, pagination, and search options
      * @returns The paginated application member listing
      */
-    listApplicationMembers(options: ListAdminApplicationMembersOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminApplicationMembersResult;
-        error: null;
-    }>;
+    listApplicationMembers(options: ListAdminApplicationMembersOptions): Promise<ListAdminApplicationMembersResult>;
     /**
      * Lists active members for one organization as a global admin.
      *
      * @param options - Organization ID, pagination, and search options
      * @returns The paginated organization member listing
      */
-    listOrganizationMembers(options: ListAdminOrganizationMembersOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminOrganizationMembersResult;
-        error: null;
-    }>;
+    listOrganizationMembers(options: ListAdminOrganizationMembersOptions): Promise<ListAdminOrganizationMembersResult>;
+    /**
+     * Lists the applications available to one organization with the entitlement
+     * that decides their access and its rules. Global admins may list any
+     * organization; an organization admin only their own.
+     *
+     * @param options - Organization ID and search options
+     * @returns The organization's applications
+     */
+    listOrganizationApplications(options: ListAdminOrganizationApplicationsOptions): Promise<AdminOrganizationEntitledApplication[]>;
+    /**
+     * Fetches one application of an organization with its rules and the roles
+     * those rules can grant.
+     *
+     * @param options - Organization and application IDs
+     * @returns The application access
+     */
+    getOrganizationApplication(options: GetAdminOrganizationApplicationOptions): Promise<AdminOrganizationApplicationAccess>;
+    /**
+     * Replaces the rules of an organization's own entitlement to an application,
+     * in the order given, as a global admin. Global access is edited on the application.
+     *
+     * @param options - Organization and application IDs, and the rules in evaluation order
+     * @returns The updated application access
+     */
+    setOrganizationApplicationRules(options: SetAdminOrganizationApplicationRulesOptions): Promise<AdminOrganizationApplicationAccess>;
+    /**
+     * Lists every active member of an organization with the rule that decides
+     * their access to an application and the role it grants.
+     *
+     * @param options - Organization and application IDs, pagination, and search options
+     * @returns The paginated member listing
+     */
+    listOrganizationApplicationMembers(options: ListAdminOrganizationApplicationMembersOptions): Promise<ListAdminOrganizationApplicationMembersResult>;
     /**
      * Lists teams for one organization. Global admins may list any organization;
      * an organization admin only their own.
@@ -5476,26 +5552,14 @@ declare class AdminService {
      * @param options - Organization ID, pagination, search, and ordering options
      * @returns The paginated organization team listing
      */
-    listOrganizationTeams(options: ListAdminOrganizationTeamsOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminOrganizationTeamsResult;
-        error: null;
-    }>;
+    listOrganizationTeams(options: ListAdminOrganizationTeamsOptions): Promise<ListAdminOrganizationTeamsResult>;
     /**
      * Creates a team for one organization as a global admin.
      *
      * @param options - Organization ID, team name, and optional team members
      * @returns The created team
      */
-    createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
-        data: AdminOrganizationTeamRecord;
-    } | null>;
+    createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<AdminOrganizationTeamRecord>;
     /**
      * Updates a team for one organization. Global admins may update any
      * organization; an organization admin only their own.
@@ -5503,9 +5567,7 @@ declare class AdminService {
      * @param options - Organization ID, team ID, new name, and optional replacement member IDs
      * @returns The updated team
      */
-    updateOrganizationTeam(options: UpdateAdminOrganizationTeamOptions): Promise<{
-        data: AdminOrganizationTeamRecord;
-    } | null>;
+    updateOrganizationTeam(options: UpdateAdminOrganizationTeamOptions): Promise<AdminOrganizationTeamRecord>;
     /**
      * Deletes a team for one organization, detaching its members with it.
      * Global admins may delete from any organization; an organization admin
@@ -5550,9 +5612,7 @@ declare class AdminService {
      * @param options - Organization name and optional slug, logo, metadata, and settings
      * @returns The created organization
      */
-    createOrganization(options: CreateAdminOrganizationOptions): Promise<{
-        data: AdminOrganization;
-    } | null>;
+    createOrganization(options: CreateAdminOrganizationOptions): Promise<AdminOrganization>;
     /**
      * Updates an organization's profile and settings. Global admins may update
      * any organization; an organization admin only their own, and only the
@@ -5562,27 +5622,21 @@ declare class AdminService {
      * @param options - Organization ID and the fields to update
      * @returns The updated organization
      */
-    updateOrganization(options: UpdateAdminOrganizationOptions): Promise<{
-        data: AdminOrganization;
-    } | null>;
+    updateOrganization(options: UpdateAdminOrganizationOptions): Promise<AdminOrganization>;
     /**
      * Updates an organization member's role.
      *
      * @param options - Membership ID and the new role
      * @returns The updated membership
      */
-    updateMemberRole(options: UpdateAdminMemberRoleOptions): Promise<{
-        data: AdminMember;
-    } | null>;
+    updateMemberRole(options: UpdateAdminMemberRoleOptions): Promise<AdminMember>;
     /**
      * Removes an organization member.
      *
      * @param options - Membership ID to remove
      * @returns The removed membership
      */
-    removeMember(options: RemoveAdminMemberOptions): Promise<{
-        data: AdminMember;
-    } | null>;
+    removeMember(options: RemoveAdminMemberOptions): Promise<AdminMember>;
     /**
      * Sets a user's effective application role within an organization. A
      * non-null role grants access, a null role denies access (leave
@@ -5644,9 +5698,7 @@ declare class AdminService {
      * @param options - Organization, emails, role, and optional teams/application
      * @returns Per-email invite outcomes
      */
-    inviteOrganizationUsers(options: InviteAdminOrganizationUsersOptions): Promise<{
-        data: InviteAdminOrganizationUsersResult;
-    } | null>;
+    inviteOrganizationUsers(options: InviteAdminOrganizationUsersOptions): Promise<InviteAdminOrganizationUsersResult>;
 }
 
 /**
@@ -5680,8 +5732,8 @@ type AcceptInvitationResult = {
     homeUrl: string | null;
     /** Configured post-acceptance URL for plain organization invitations. */
     inviteAcceptedUrl: string | null;
-    /** The accepted organization membership. This may be an existing membership. */
-    member: Member;
+    /** The accepted organization membership. This may be an existing membership. It does not include the user record. */
+    member: Omit<Member, 'user'>;
 };
 /**
  * Fields that can be updated on an organization.
@@ -6677,4 +6729,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationDeprecation, ApplicationDisabledPayload, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, DisableAdminApplicationOptions, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationApplicationAccess, AdminOrganizationApplicationEntitlement, AdminOrganizationApplicationMember, AdminOrganizationApplicationRole, AdminOrganizationEntitledApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationDeprecation, ApplicationDisabledPayload, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, DisableAdminApplicationOptions, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationApplicationOptions, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationApplicationMembersOptions, ListAdminOrganizationApplicationMembersResult, ListAdminOrganizationApplicationsOptions, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminOrganizationApplicationRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -5218,6 +5218,97 @@ type InviteAdminOrganizationUsersResult = {
         message?: string;
     }[];
 };
+/**
+ * Entitlement that decides access to an application for one organization: the
+ * organization's own, or global access shared by every organization.
+ */
+type AdminOrganizationApplicationEntitlement = {
+    id: string;
+    type: 'organization' | 'global';
+    enabled: boolean;
+    createdAt: string;
+};
+/**
+ * Application available to one organization, as its admins see it.
+ */
+type AdminOrganizationEntitledApplication = {
+    id: string;
+    name: string;
+    imageUrl: string | null;
+    homeUrl: string | null;
+    entitlement: AdminOrganizationApplicationEntitlement;
+    /** Whether the caller can edit the rules here: only global admins, and only on the organization's own entitlement. */
+    editable: boolean;
+    /** When the application was disabled, or `null`. A disabled application refuses every sign-in, whatever its rules. */
+    disabledAt: string | null;
+    /** Rules in evaluation order; the first one that matches a member decides. */
+    rules: Array<AdminEntitlementRule & {
+        /** User-facing name of the role from the application role catalog. Null for denials and unknown roles. */
+        roleDisplayName: string | null;
+    }>;
+    /** Active members the rules grant a role to. Zero while the entitlement or the application is disabled. */
+    memberCount: number;
+    members: AdminApplicationMember[];
+};
+/**
+ * Role an application can grant, from its role catalog.
+ */
+type AdminOrganizationApplicationRole = {
+    name: string;
+    displayName: string;
+    description: string;
+};
+/**
+ * One application of an organization with the roles its rules can grant.
+ */
+type AdminOrganizationApplicationAccess = AdminOrganizationEntitledApplication & {
+    roles: AdminOrganizationApplicationRole[];
+};
+/** Options accepted when listing the applications of an organization. */
+type ListAdminOrganizationApplicationsOptions = {
+    organizationId: string;
+    /** Case-insensitive application name match. */
+    search?: string;
+};
+/** Options accepted when reading or listing members of one application of an organization. */
+type GetAdminOrganizationApplicationOptions = {
+    organizationId: string;
+    applicationId: string;
+};
+/** Options accepted when replacing the rules of an organization's own entitlement. */
+type SetAdminOrganizationApplicationRulesOptions = GetAdminOrganizationApplicationOptions & {
+    /** Rules in evaluation order. Positions are assigned from the order. */
+    rules: Array<Omit<AdminEntitlementRule, 'position'>>;
+};
+/** Options accepted when listing the members of an organization against one application. */
+type ListAdminOrganizationApplicationMembersOptions = GetAdminOrganizationApplicationOptions & {
+    /** Case-insensitive name or email match. */
+    query?: string;
+    /** Maximum number of members to return. Defaults to 50. */
+    limit?: number;
+    /** Number of members to skip. Defaults to 0. */
+    offset?: number;
+};
+/**
+ * Active organization member with the outcome of an application's rules for them.
+ */
+type AdminOrganizationApplicationMember = AdminApplicationMember & {
+    /** Role granted to the member, or null when no rule grants access. */
+    role: string | null;
+    roleDisplayName: string | null;
+    /** First rule that matched the member, or null when none did. A matched rule with a null role denies access. */
+    matchedRule: {
+        type: AdminEntitlementRuleType;
+        position: number;
+    } | null;
+};
+/** Paginated listing of an organization's members against one application. */
+type ListAdminOrganizationApplicationMembersResult = {
+    members: AdminOrganizationApplicationMember[];
+    total: number;
+    limit: number;
+    offset: number;
+};
 
 /**
  * Service for global admin operations.
@@ -5250,6 +5341,12 @@ declare class AdminService {
      * @returns The parsed JSON response
      */
     private requestApplicationRoute;
+    /**
+     * Calls an admin endpoint and returns its JSON body. The client is configured
+     * to throw on error responses, but better-auth types `$fetch` as returning
+     * `{ data, error }`; this narrows the result to the body it actually resolves to.
+     */
+    private fetchAdminRoute;
     /**
      * Lists applications, optionally filtered by organization.
      *
@@ -5343,17 +5440,7 @@ declare class AdminService {
      * @param options - Pagination, ordering, search, and preview options
      * @returns The paginated organization listing
      */
-    listOrganizations(options?: ListAdminOrganizationsOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminOrganizationsResult;
-        error: null;
-    }>;
+    listOrganizations(options?: ListAdminOrganizationsOptions): Promise<ListAdminOrganizationsResult>;
     /**
      * Lists users, optionally with organization previews and totals when a
      * preview size is requested. Global admins list across every organization
@@ -5363,17 +5450,7 @@ declare class AdminService {
      * @param options - Pagination, ordering, search, preview, and organization options
      * @returns The paginated user listing
      */
-    listUsers(options?: ListAdminUsersOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminUsersResult;
-        error: null;
-    }>;
+    listUsers(options?: ListAdminUsersOptions): Promise<ListAdminUsersResult>;
     /**
      * Fetches a single user by ID.
      *
@@ -5388,9 +5465,7 @@ declare class AdminService {
      * @param options - Organization ID and listing adjacency options
      * @returns The organization
      */
-    getOrganization(options: GetAdminOrganizationOptions): Promise<{
-        data: AdminOrganization;
-    } | null>;
+    getOrganization(options: GetAdminOrganizationOptions): Promise<AdminOrganization>;
     /**
      * Fetches minimal identity and branding (id, name, logo) for several
      * organizations at once, for surfaces such as the vault pages that resolve
@@ -5402,7 +5477,7 @@ declare class AdminService {
      * @param options - The workspace (organization) IDs to resolve
      * @returns The organization summaries for the IDs that exist
      */
-    getOrganizationsSummary(options: GetAdminOrganizationsSummaryOptions): Promise<any>;
+    getOrganizationsSummary(options: GetAdminOrganizationsSummaryOptions): Promise<AdminOrganizationSummary[]>;
     /**
      * Fetches the per-organization access report for a single user: their
      * organizations with role, membership ID, and teams, plus each
@@ -5411,9 +5486,7 @@ declare class AdminService {
      * @param userId - The ID of the user to fetch access for
      * @returns The user access report
      */
-    getUserAccess(userId: string): Promise<{
-        data: AdminUserAccess;
-    } | null>;
+    getUserAccess(userId: string): Promise<AdminUserAccess>;
     /**
      * Lists applications with their entitlements as a global admin. Unlike
      * {@link listApplications}, which goes through the session-only application
@@ -5422,17 +5495,7 @@ declare class AdminService {
      * @param options - Pagination, ordering, organization filter, search, and member preview options
      * @returns The application listing with entitlement details
      */
-    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminApplicationsResult;
-        error: null;
-    }>;
+    listAdminApplications(options?: ListAdminApplicationsOptions): Promise<ListAdminApplicationsResult>;
     /**
      * Lists the users with access to an application as a global admin, one row
      * per user with every organization that grants them access and the role it
@@ -5441,34 +5504,47 @@ declare class AdminService {
      * @param options - Application ID, organization filter, pagination, and search options
      * @returns The paginated application member listing
      */
-    listApplicationMembers(options: ListAdminApplicationMembersOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminApplicationMembersResult;
-        error: null;
-    }>;
+    listApplicationMembers(options: ListAdminApplicationMembersOptions): Promise<ListAdminApplicationMembersResult>;
     /**
      * Lists active members for one organization as a global admin.
      *
      * @param options - Organization ID, pagination, and search options
      * @returns The paginated organization member listing
      */
-    listOrganizationMembers(options: ListAdminOrganizationMembersOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminOrganizationMembersResult;
-        error: null;
-    }>;
+    listOrganizationMembers(options: ListAdminOrganizationMembersOptions): Promise<ListAdminOrganizationMembersResult>;
+    /**
+     * Lists the applications available to one organization with the entitlement
+     * that decides their access and its rules. Global admins may list any
+     * organization; an organization admin only their own.
+     *
+     * @param options - Organization ID and search options
+     * @returns The organization's applications
+     */
+    listOrganizationApplications(options: ListAdminOrganizationApplicationsOptions): Promise<AdminOrganizationEntitledApplication[]>;
+    /**
+     * Fetches one application of an organization with its rules and the roles
+     * those rules can grant.
+     *
+     * @param options - Organization and application IDs
+     * @returns The application access
+     */
+    getOrganizationApplication(options: GetAdminOrganizationApplicationOptions): Promise<AdminOrganizationApplicationAccess>;
+    /**
+     * Replaces the rules of an organization's own entitlement to an application,
+     * in the order given, as a global admin. Global access is edited on the application.
+     *
+     * @param options - Organization and application IDs, and the rules in evaluation order
+     * @returns The updated application access
+     */
+    setOrganizationApplicationRules(options: SetAdminOrganizationApplicationRulesOptions): Promise<AdminOrganizationApplicationAccess>;
+    /**
+     * Lists every active member of an organization with the rule that decides
+     * their access to an application and the role it grants.
+     *
+     * @param options - Organization and application IDs, pagination, and search options
+     * @returns The paginated member listing
+     */
+    listOrganizationApplicationMembers(options: ListAdminOrganizationApplicationMembersOptions): Promise<ListAdminOrganizationApplicationMembersResult>;
     /**
      * Lists teams for one organization. Global admins may list any organization;
      * an organization admin only their own.
@@ -5476,26 +5552,14 @@ declare class AdminService {
      * @param options - Organization ID, pagination, search, and ordering options
      * @returns The paginated organization team listing
      */
-    listOrganizationTeams(options: ListAdminOrganizationTeamsOptions): Promise<{
-        data: null;
-        error: {
-            message?: string | undefined;
-            status: number;
-            statusText: string;
-        };
-    } | {
-        data: ListAdminOrganizationTeamsResult;
-        error: null;
-    }>;
+    listOrganizationTeams(options: ListAdminOrganizationTeamsOptions): Promise<ListAdminOrganizationTeamsResult>;
     /**
      * Creates a team for one organization as a global admin.
      *
      * @param options - Organization ID, team name, and optional team members
      * @returns The created team
      */
-    createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<{
-        data: AdminOrganizationTeamRecord;
-    } | null>;
+    createOrganizationTeam(options: CreateAdminOrganizationTeamOptions): Promise<AdminOrganizationTeamRecord>;
     /**
      * Updates a team for one organization. Global admins may update any
      * organization; an organization admin only their own.
@@ -5503,9 +5567,7 @@ declare class AdminService {
      * @param options - Organization ID, team ID, new name, and optional replacement member IDs
      * @returns The updated team
      */
-    updateOrganizationTeam(options: UpdateAdminOrganizationTeamOptions): Promise<{
-        data: AdminOrganizationTeamRecord;
-    } | null>;
+    updateOrganizationTeam(options: UpdateAdminOrganizationTeamOptions): Promise<AdminOrganizationTeamRecord>;
     /**
      * Deletes a team for one organization, detaching its members with it.
      * Global admins may delete from any organization; an organization admin
@@ -5550,9 +5612,7 @@ declare class AdminService {
      * @param options - Organization name and optional slug, logo, metadata, and settings
      * @returns The created organization
      */
-    createOrganization(options: CreateAdminOrganizationOptions): Promise<{
-        data: AdminOrganization;
-    } | null>;
+    createOrganization(options: CreateAdminOrganizationOptions): Promise<AdminOrganization>;
     /**
      * Updates an organization's profile and settings. Global admins may update
      * any organization; an organization admin only their own, and only the
@@ -5562,27 +5622,21 @@ declare class AdminService {
      * @param options - Organization ID and the fields to update
      * @returns The updated organization
      */
-    updateOrganization(options: UpdateAdminOrganizationOptions): Promise<{
-        data: AdminOrganization;
-    } | null>;
+    updateOrganization(options: UpdateAdminOrganizationOptions): Promise<AdminOrganization>;
     /**
      * Updates an organization member's role.
      *
      * @param options - Membership ID and the new role
      * @returns The updated membership
      */
-    updateMemberRole(options: UpdateAdminMemberRoleOptions): Promise<{
-        data: AdminMember;
-    } | null>;
+    updateMemberRole(options: UpdateAdminMemberRoleOptions): Promise<AdminMember>;
     /**
      * Removes an organization member.
      *
      * @param options - Membership ID to remove
      * @returns The removed membership
      */
-    removeMember(options: RemoveAdminMemberOptions): Promise<{
-        data: AdminMember;
-    } | null>;
+    removeMember(options: RemoveAdminMemberOptions): Promise<AdminMember>;
     /**
      * Sets a user's effective application role within an organization. A
      * non-null role grants access, a null role denies access (leave
@@ -5644,9 +5698,7 @@ declare class AdminService {
      * @param options - Organization, emails, role, and optional teams/application
      * @returns Per-email invite outcomes
      */
-    inviteOrganizationUsers(options: InviteAdminOrganizationUsersOptions): Promise<{
-        data: InviteAdminOrganizationUsersResult;
-    } | null>;
+    inviteOrganizationUsers(options: InviteAdminOrganizationUsersOptions): Promise<InviteAdminOrganizationUsersResult>;
 }
 
 /**
@@ -5680,8 +5732,8 @@ type AcceptInvitationResult = {
     homeUrl: string | null;
     /** Configured post-acceptance URL for plain organization invitations. */
     inviteAcceptedUrl: string | null;
-    /** The accepted organization membership. This may be an existing membership. */
-    member: Member;
+    /** The accepted organization membership. This may be an existing membership. It does not include the user record. */
+    member: Omit<Member, 'user'>;
 };
 /**
  * Fields that can be updated on an organization.
@@ -6677,4 +6729,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationDisabledError, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseApplicationDisabledPayload, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationDeprecation, ApplicationDisabledPayload, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, DisableAdminApplicationOptions, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationApplicationAccess, AdminOrganizationApplicationEntitlement, AdminOrganizationApplicationMember, AdminOrganizationApplicationRole, AdminOrganizationEntitledApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationDeprecation, ApplicationDisabledPayload, ApplicationRole, ApplicationScopedMember, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, DisableAdminApplicationOptions, EmailOTPSignInOptions, FullOrganization, FullOrganizationMember, GetAdminOrganizationApplicationOptions, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationApplicationMembersOptions, ListAdminOrganizationApplicationMembersResult, ListAdminOrganizationApplicationsOptions, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminOrganizationApplicationRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "3.2.0";
+const version = "3.3.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -548,7 +548,7 @@ class AdminService {
   async requestApplicationRoute(path, request = {}) {
     const base = this.apiUrl.endsWith("/") ? this.apiUrl : `${this.apiUrl}/`;
     const hasBody = request.body !== void 0;
-    const { data, error } = await this.client.$fetch(`${base}${path}`, {
+    const response = await this.client.$fetch(`${base}${path}`, {
       method: request.method ?? "GET",
       params: request.params,
       query: request.query,
@@ -561,10 +561,19 @@ class AdminService {
       jsonParser: (text) => JSON.parse(text),
       throw: false
     });
+    const { data, error } = response;
     if (error)
       throw new ApplicationRouteError(error);
     return data;
   }
+  /**
+   * Calls an admin endpoint and returns its JSON body. The client is configured
+   * to throw on error responses, but better-auth types `$fetch` as returning
+   * `{ data, error }`; this narrows the result to the body it actually resolves to.
+   */
+  async fetchAdminRoute(path, options) {
+    return await this.client.$fetch(path, options);
+  }
   /**
    * Lists applications, optionally filtered by organization.
    *
@@ -737,7 +746,7 @@ class AdminService {
    * @returns The paginated organization listing
    */
   async listOrganizations(options = {}) {
-    return await this.client.$fetch("/admin/organizations", {
+    return await this.fetchAdminRoute("/admin/organizations", {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -760,7 +769,7 @@ class AdminService {
    * @returns The paginated user listing
    */
   async listUsers(options = {}) {
-    return await this.client.$fetch("/admin/users", {
+    return await this.fetchAdminRoute("/admin/users", {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -802,7 +811,7 @@ class AdminService {
    * @returns The organization
    */
   async getOrganization(options) {
-    const { data } = await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}`, {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}`, {
       method: "GET",
       query: {
         ...options.sortBy ? { sortBy: options.sortBy } : {},
@@ -824,7 +833,7 @@ class AdminService {
    * @returns The organization summaries for the IDs that exist
    */
   async getOrganizationsSummary(options) {
-    const { organizations } = await this.client.$fetch("/admin/organizations/summary", {
+    const { organizations } = await this.fetchAdminRoute("/admin/organizations/summary", {
       method: "GET",
       query: {
         ids: options.ids
@@ -841,7 +850,7 @@ class AdminService {
    * @returns The user access report
    */
   async getUserAccess(userId) {
-    const { data } = await this.client.$fetch(`/admin/users/${encodeURIComponent(userId)}/access`, {
+    const { data } = await this.fetchAdminRoute(`/admin/users/${encodeURIComponent(userId)}/access`, {
       method: "GET"
     });
     return data;
@@ -855,7 +864,7 @@ class AdminService {
    * @returns The application listing with entitlement details
    */
   async listAdminApplications(options = {}) {
-    return await this.client.$fetch("/admin/applications", {
+    return await this.fetchAdminRoute("/admin/applications", {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -877,7 +886,7 @@ class AdminService {
    * @returns The paginated application member listing
    */
   async listApplicationMembers(options) {
-    return await this.client.$fetch(`/admin/applications/${encodeURIComponent(options.applicationId)}/members`, {
+    return await this.fetchAdminRoute(`/admin/applications/${encodeURIComponent(options.applicationId)}/members`, {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -894,7 +903,7 @@ class AdminService {
    * @returns The paginated organization member listing
    */
   async listOrganizationMembers(options) {
-    return await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/members`, {
+    return await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/members`, {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -910,6 +919,67 @@ class AdminService {
       }
     });
   }
+  /**
+   * Lists the applications available to one organization with the entitlement
+   * that decides their access and its rules. Global admins may list any
+   * organization; an organization admin only their own.
+   *
+   * @param options - Organization ID and search options
+   * @returns The organization's applications
+   */
+  async listOrganizationApplications(options) {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/applications`, {
+      method: "GET",
+      query: {
+        ...options.search ? { search: options.search } : {}
+      }
+    });
+    return data;
+  }
+  /**
+   * Fetches one application of an organization with its rules and the roles
+   * those rules can grant.
+   *
+   * @param options - Organization and application IDs
+   * @returns The application access
+   */
+  async getOrganizationApplication(options) {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/applications/${encodeURIComponent(options.applicationId)}`, {
+      method: "GET"
+    });
+    return data;
+  }
+  /**
+   * Replaces the rules of an organization's own entitlement to an application,
+   * in the order given, as a global admin. Global access is edited on the application.
+   *
+   * @param options - Organization and application IDs, and the rules in evaluation order
+   * @returns The updated application access
+   */
+  async setOrganizationApplicationRules(options) {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/applications/${encodeURIComponent(options.applicationId)}/rules`, {
+      method: "POST",
+      body: { rules: options.rules }
+    });
+    return data;
+  }
+  /**
+   * Lists every active member of an organization with the rule that decides
+   * their access to an application and the role it grants.
+   *
+   * @param options - Organization and application IDs, pagination, and search options
+   * @returns The paginated member listing
+   */
+  async listOrganizationApplicationMembers(options) {
+    return await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/applications/${encodeURIComponent(options.applicationId)}/members`, {
+      method: "GET",
+      query: {
+        ...options.limit !== void 0 ? { limit: options.limit } : {},
+        ...options.offset !== void 0 ? { offset: options.offset } : {},
+        ...options.query ? { query: options.query } : {}
+      }
+    });
+  }
   /**
    * Lists teams for one organization. Global admins may list any organization;
    * an organization admin only their own.
@@ -918,7 +988,7 @@ class AdminService {
    * @returns The paginated organization team listing
    */
   async listOrganizationTeams(options) {
-    return await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams`, {
+    return await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams`, {
       method: "GET",
       query: {
         ...options.limit !== void 0 ? { limit: options.limit } : {},
@@ -936,7 +1006,7 @@ class AdminService {
    * @returns The created team
    */
   async createOrganizationTeam(options) {
-    const { data } = await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams`, {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams`, {
       method: "POST",
       body: {
         name: options.name,
@@ -953,7 +1023,7 @@ class AdminService {
    * @returns The updated team
    */
   async updateOrganizationTeam(options) {
-    const { data } = await this.client.$fetch(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams/update`, {
+    const { data } = await this.fetchAdminRoute(`/admin/organizations/${encodeURIComponent(options.organizationId)}/teams/update`, {
       method: "POST",
       body: {
         teamId: options.teamId,
@@ -1032,7 +1102,7 @@ class AdminService {
    * @returns The created organization
    */
   async createOrganization(options) {
-    const { data } = await this.client.$fetch("/admin/organizations", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations", {
       method: "POST",
       body: options
     });
@@ -1048,7 +1118,7 @@ class AdminService {
    * @returns The updated organization
    */
   async updateOrganization(options) {
-    const { data } = await this.client.$fetch("/admin/organizations/update", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations/update", {
       method: "POST",
       body: options
     });
@@ -1061,7 +1131,7 @@ class AdminService {
    * @returns The updated membership
    */
   async updateMemberRole(options) {
-    const { data } = await this.client.$fetch("/admin/organizations/members/update-role", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations/members/update-role", {
       method: "POST",
       body: options
     });
@@ -1074,7 +1144,7 @@ class AdminService {
    * @returns The removed membership
    */
   async removeMember(options) {
-    const { data } = await this.client.$fetch("/admin/organizations/members/remove", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations/members/remove", {
       method: "POST",
       body: options
     });
@@ -1173,7 +1243,7 @@ class AdminService {
    * @returns Per-email invite outcomes
    */
   async inviteOrganizationUsers(options) {
-    const { data } = await this.client.$fetch("/admin/organizations/users", {
+    const { data } = await this.fetchAdminRoute("/admin/organizations/users", {
       method: "POST",
       body: { ...options, sendInvite: options.sendInvite ?? true }
     });
@@ -1954,6 +2024,7 @@ class OrganizationService {
       applicationName: responseWithContext.applicationName ?? null,
       homeUrl: responseWithContext.homeUrl ?? null,
       inviteAcceptedUrl: responseWithContext.inviteAcceptedUrl ?? null,
+      // better-auth types the role as a plain string; the organization plugin only stores configured roles.
       member: response.member
     };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "3.2.0",
+    "version": "3.3.0",
     "type": "module",
     "exports": {
         ".": {