@protobase/server 0.6.0 → 0.8.0

package/dist/better-auth/create-auth.d.ts

@@ -1,8 +1,12 @@
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
+import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { OperatorProvider } from "./operator-provider.js";
+import { OrganizationRole } from "./organizations/store.js";
+import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
+import "../index.js";
 import { BetterAuthOptions } from "better-auth";
 //#region src/better-auth/create-auth.d.ts
 export type CreateAuthOptions = {
@@ -16,8 +20,12 @@ export type CreateAuthOptions = {
   secret: string;
   /** Extra origins that may call the auth endpoints. `baseURL` and `https://*.trycloudflare.com` are always trusted. */
   trustedOrigins?: string[];
-  /** The roles users can have, for example `['admin', 'accountant', 'warehouse']`. `admin` is always included; default `['admin', 'user']`. */
-  roles?: string[];
+  /**
+   * The roles users can have, for example `['admin', 'accountant', 'warehouse']`. `admin` is always included; default
+   * `['admin', 'user']`. With `organizations`, give each a label, and optionally the other roles its holders may also
+   * give members: `{ manager: { label: 'Manager', grants: ['sales'] }, sales: 'Sales' }`.
+   */
+  roles?: RolesInput;
   /**
    * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
    * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
@@ -55,18 +63,79 @@ export type CreateAuthOptions = {
    * environment says. Left out when `socialProviders` has a provider with the same id.
    */
   signInProvider?: PlatformSignIn | false;
+  /**
+   * Turns on organizations: people work in one at a time, records of `.tenant` resources are scoped to it, and roles
+   * are held globally (on the user) or per membership. Off by default: the app works as one organization.
+   */
+  organizations?: OrganizationsOptions;
 };
 type UserCreateHooks = NonNullable<NonNullable<NonNullable<BetterAuthOptions['databaseHooks']>['user']>['create']>;
 /** Better Auth's `databaseHooks.user.create.after`: the created user (with its `role`) and the request context, `null` outside a request. */
 export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
+/**
+ * Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
+ * authentication, and the sign-in policy admins set; no public sign-up (every account is created on the host with
+ * `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role` column, 15 minute JWTs
+ * at `/api/auth/token` with the keys at `/api/auth/jwks`.
+ */
 /** The configured roles with `admin` first; `admin` is added when missing. */
-export declare const normalizeRoles: (roles?: string[]) => string[];
+export declare const normalizeRoles: (roles?: RolesInput) => string[];
 export declare const createAuth: (options: CreateAuthOptions) => import("better-auth").Auth<{
+  user: {
+    fields: {
+      emailVerified: string;
+      createdAt: string;
+      updatedAt: string;
+    };
+  } | {
+    additionalFields: {
+      readonly lastOrganizationId: {
+        readonly type: "string";
+        readonly required: false;
+        readonly input: false;
+        readonly fieldName: "last_organization_id";
+      };
+    };
+    fields: {
+      emailVerified: string;
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
+  session: {
+    fields: {
+      expiresAt: string;
+      createdAt: string;
+      updatedAt: string;
+      ipAddress: string;
+      userAgent: string;
+      userId: string;
+    };
+  };
+  verification: {
+    fields: {
+      expiresAt: string;
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
   account: {
     encryptOAuthTokens?: true | undefined;
     accountLinking: {
       allowDifferentEmails: true;
     };
+    fields: {
+      accountId: string;
+      providerId: string;
+      userId: string;
+      accessToken: string;
+      refreshToken: string;
+      idToken: string;
+      accessTokenExpiresAt: string;
+      refreshTokenExpiresAt: string;
+      createdAt: string;
+      updatedAt: string;
+    };
   };
   plugins: [{
     id: "admin";
@@ -954,6 +1023,19 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       };
     };
     options: NoInfer<{
+      schema: {
+        user: {
+          fields: {
+            banReason: string;
+            banExpires: string;
+          };
+        };
+        session: {
+          fields: {
+            impersonatedBy: string;
+          };
+        };
+      };
       defaultRole: string;
       roles: {
         [k: string]: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
@@ -975,17 +1057,45 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
     id: "jwt";
     version: string;
     options: NoInfer<{
+      schema: {
+        jwks: {
+          fields: {
+            publicKey: string;
+            privateKey: string;
+            createdAt: string;
+            expiresAt: string;
+          };
+        };
+      };
       jwt: {
         expirationTime: string;
         issuer: string;
         audience: string;
-        definePayload: ({ user }: {
+        definePayload: ({ user, session }: {
           user: import("better-auth").User & Record<string, any>;
           session: import("better-auth").Session & Record<string, any>;
-        }) => {
+        }) => Promise<{
           email: string;
           role: any;
-        };
+        } | {
+          org?: undefined;
+          org_role?: undefined;
+          app_roles?: undefined;
+          email: string;
+          role: any;
+        } | {
+          org: string;
+          org_role: OrganizationRole;
+          app_roles: string[];
+          email: string;
+          role: any;
+        } | {
+          org: string;
+          org_role?: undefined;
+          app_roles?: undefined;
+          email: string;
+          role: any;
+        }>;
       };
       disableSettingJwtHeader: true;
     }>;
@@ -3017,10 +3127,11 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
       TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
     };
-  })[], {
+  } | {
     id: "protobase-sign-in-policy";
     schema: {
       readonly signInPolicy: {
+        readonly modelName: "sign_in_policy";
         readonly fields: {
           readonly password: {
             readonly type: "string";
@@ -3029,6 +3140,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly emailCode: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "email_code";
           };
           readonly passkey: {
             readonly type: "string";
@@ -3037,24 +3149,29 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly twoFactor: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "two_factor";
           };
           readonly staffAccess: {
             readonly type: "string";
             readonly required: true;
             readonly defaultValue: "allowed";
+            readonly fieldName: "staff_access";
           };
           readonly platformSignIn: {
             readonly type: "string";
             readonly required: true;
             readonly defaultValue: "allowed";
+            readonly fieldName: "platform_sign_in";
           };
           readonly createdAt: {
             readonly type: "date";
             readonly required: true;
+            readonly fieldName: "created_at";
           };
           readonly createdBy: {
             readonly type: "string";
             readonly required: false;
+            readonly fieldName: "created_by";
           };
         };
       };
@@ -3299,7 +3416,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           twoFactor: boolean;
           authenticatorApp: boolean;
         };
-        missing: ("passkey" | "twoFactor")[];
+        missing: ("twoFactor" | "passkey")[];
       }>;
     };
     hooks: {
@@ -3308,18 +3425,21 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
-  }, {
+  } | {
     id: "protobase-staff-sign-in";
     schema: {
       readonly staffSignIn: {
+        readonly modelName: "staff_sign_in";
         readonly fields: {
           readonly userId: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "user_id";
           };
           readonly userEmail: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "user_email";
           };
           readonly staff: {
             readonly type: "string";
@@ -3328,10 +3448,12 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly staffName: {
             readonly type: "string";
             readonly required: false;
+            readonly fieldName: "staff_name";
           };
           readonly staffSubject: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "staff_subject";
           };
           readonly issuer: {
             readonly type: "string";
@@ -3344,18 +3466,22 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           readonly sessionId: {
             readonly type: "string";
             readonly required: true;
+            readonly fieldName: "session_id";
           };
           readonly startedAt: {
             readonly type: "date";
             readonly required: true;
+            readonly fieldName: "started_at";
           };
           readonly expiresAt: {
             readonly type: "date";
             readonly required: true;
+            readonly fieldName: "expires_at";
           };
           readonly endedAt: {
             readonly type: "date";
             readonly required: false;
+            readonly fieldName: "ended_at";
           };
         };
       };
@@ -3537,9 +3663,550 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
-  }];
+  } | import("better-auth/plugins").DefaultOrganizationPlugin<{
+    organizationHooks: {
+      beforeCreateOrganization?: (data: {
+        organization: {
+          name?: string;
+          slug?: string;
+          logo?: string | null;
+          metadata?: Record<string, any>;
+          [key: string]: any;
+        };
+        user: import("better-auth").User & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterCreateOrganization?: (data: {
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+      }) => Promise<void>;
+      beforeUpdateOrganization?: (data: {
+        organization: {
+          name?: string;
+          slug?: string;
+          logo?: string | null;
+          metadata?: Record<string, any>;
+          [key: string]: any;
+        };
+        user: import("better-auth").User & Record<string, any>;
+        member: import("better-auth/plugins").Member & Record<string, any>;
+      }) => Promise<void | {
+        data: {
+          name?: string;
+          slug?: string;
+          logo?: string | null;
+          metadata?: Record<string, any>;
+          [key: string]: any;
+        };
+      }>;
+      afterUpdateOrganization?: (data: {
+        organization: (import("better-auth/plugins").Organization & Record<string, any>) | null;
+        user: import("better-auth").User & Record<string, any>;
+        member: import("better-auth/plugins").Member & Record<string, any>;
+      }) => Promise<void>;
+      beforeDeleteOrganization?: (data: {
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+      }, ctx?: import("better-auth").GenericEndpointContext) => Promise<void>;
+      afterDeleteOrganization?: (data: {
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+      }, ctx?: import("better-auth").GenericEndpointContext) => Promise<void>;
+      beforeAddMember?: (data: {
+        member: {
+          userId: string;
+          organizationId: string;
+          role: string;
+          [key: string]: any;
+        };
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterAddMember?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeRemoveMember?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterRemoveMember?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeUpdateMemberRole?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        newRole: string;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: {
+          role: string;
+          [key: string]: any;
+        };
+      }>;
+      afterUpdateMemberRole?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        previousRole: string;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeCreateInvitation?: (data: {
+        invitation: {
+          email: string;
+          role: string;
+          organizationId: string;
+          inviterId: string;
+          teamId?: string;
+          [key: string]: any;
+        };
+        inviter: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterCreateInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        inviter: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeAcceptInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterAcceptInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeRejectInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterRejectInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeCancelInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        cancelledBy: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterCancelInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        cancelledBy: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeCreateTeam?: (data: {
+        team: {
+          name: string;
+          organizationId: string;
+          [key: string]: any;
+        };
+        user?: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterCreateTeam?: (data: {
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user?: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeUpdateTeam?: (data: {
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        updates: {
+          name?: string;
+          [key: string]: any;
+        };
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterUpdateTeam?: (data: {
+        team: (import("better-auth/plugins").Team & Record<string, any>) | null;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeDeleteTeam?: (data: {
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user?: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterDeleteTeam?: (data: {
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user?: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeAddTeamMember?: (data: {
+        teamMember: {
+          teamId: string;
+          userId: string;
+          [key: string]: any;
+        };
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterAddTeamMember?: (data: {
+        teamMember: import("better-auth/plugins").TeamMember & Record<string, any>;
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeRemoveTeamMember?: (data: {
+        teamMember: import("better-auth/plugins").TeamMember & Record<string, any>;
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterRemoveTeamMember?: (data: {
+        teamMember: import("better-auth/plugins").TeamMember & Record<string, any>;
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+    };
+    sendInvitationEmail?: (({ invitation, organization, inviter }: {
+      id: string;
+      role: string;
+      email: string;
+      organization: import("better-auth/plugins").Organization;
+      invitation: import("better-auth/plugins").Invitation;
+      inviter: import("better-auth/plugins").Member & {
+        user: import("better-auth").User;
+      };
+    }) => Promise<void>) | undefined;
+    creatorRole: string;
+    allowUserToCreateOrganization: (user: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    } & Record<string, any>) => boolean;
+    invitationExpiresIn: number;
+    membershipLimit: number;
+    requireEmailVerificationOnInvitation: true;
+    cancelPendingInvitationsOnReInvite: true;
+    schema: {
+      organization: {
+        fields: {
+          createdAt: string;
+        };
+      };
+      member: {
+        fields: {
+          organizationId: string;
+          userId: string;
+          createdAt: string;
+        };
+        additionalFields: {
+          appRoles: {
+            type: "string[]";
+            required: false;
+            defaultValue: never[];
+            input: false;
+            fieldName: string;
+          };
+        };
+      };
+      invitation: {
+        fields: {
+          organizationId: string;
+          inviterId: string;
+          expiresAt: string;
+          createdAt: string;
+        };
+        additionalFields: {
+          appRoles: {
+            type: "string[]";
+            required: false;
+            defaultValue: never[];
+            input: true;
+            fieldName: string;
+          };
+        };
+      };
+      session: {
+        fields: {
+          activeOrganizationId: string;
+        };
+      };
+    };
+  }> | {
+    id: "protobase-organizations";
+    endpoints: {
+      setAppRoles: import("better-auth").StrictEndpoint<"/organization/set-app-roles", {
+        method: "POST";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          memberId: import("zod").ZodString;
+          appRoles: import("zod").ZodArray<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        member: {
+          appRoles: string[];
+          id: string;
+          organizationId: string;
+          userId: string;
+          role: string;
+          createdAt: Date;
+        };
+      }>;
+      transferOwnership: import("better-auth").StrictEndpoint<"/organization/transfer-ownership", {
+        method: "POST";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          memberId: import("zod").ZodString;
+          keepAs: import("zod").ZodOptional<import("zod").ZodEnum<{
+            admin: "admin";
+            member: "member";
+          }>>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        owner: string;
+      }>;
+      currentOrganization: import("better-auth").StrictEndpoint<"/organization/current", {
+        method: "GET";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        organization: null;
+        globalRoles: string[];
+      } | {
+        globalRoles: string[];
+        role?: OrganizationRole | undefined;
+        appRoles?: string[] | undefined;
+        memberId?: string | undefined;
+        organization: {
+          id: string;
+          name: string;
+          slug: string;
+          logo: string | null;
+        };
+      }>;
+      searchOrganizations: import("better-auth").StrictEndpoint<"/organization/search", {
+        method: "GET";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        query: import("zod").ZodObject<{
+          query: import("zod").ZodDefault<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        organizations: {
+          id: string;
+          name: string;
+          slug: string;
+        }[];
+      }>;
+      getInvitation: import("better-auth").StrictEndpoint<"/invitation", {
+        method: "GET";
+        query: import("zod").ZodObject<{
+          token: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        organization: {
+          id: string;
+          name: string;
+        };
+        inviter: {
+          name: string;
+        };
+        email: string;
+        role: string;
+        appRoles: string[];
+        expiresAt: string;
+        hasAccount: boolean;
+      }>;
+      acceptInvitation: import("better-auth").StrictEndpoint<"/invitation/accept", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          token: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        member: {
+          appRoles: string[];
+          id: string;
+          createdAt: Date;
+          userId: string;
+          role: string;
+          organizationId: string;
+        };
+      }>;
+      signUpFromInvitation: import("better-auth").StrictEndpoint<"/invitation/sign-up", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          token: import("zod").ZodString;
+          name: import("zod").ZodString;
+          password: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        member: {
+          appRoles: string[];
+          id: string;
+          createdAt: Date;
+          userId: string;
+          role: string;
+          organizationId: string;
+        };
+      }>;
+    };
+    hooks: {
+      after: {
+        matcher: (context: {
+          path?: string;
+        }) => boolean;
+        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  })[]];
   disabledPaths: string[];
   databaseHooks: {
+    session?: {
+      create: {
+        before: (session: {
+          userId: string;
+          activeOrganizationId?: string | null;
+        } & Record<string, unknown>) => Promise<{
+          data: {
+            activeOrganizationId: string;
+            userId: string;
+          };
+        } | undefined>;
+      };
+      update: {
+        after: (session: {
+          userId: string;
+          activeOrganizationId?: string | null;
+        }) => Promise<void>;
+      };
+    } | undefined;
     user: {
       create: {
         after?: ((user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>) | undefined;
@@ -3578,6 +4245,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         window: number;
         max: number;
       };
+      '/invitation/sign-up': {
+        window: number;
+        max: number;
+      };
     };
   };
   advanced: {
@@ -3611,6 +4282,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   };
 }> & {
   roles: string[];
+  roleDefinitions: RoleDefinitions;
+  organizations: ResolvedOrganizations | undefined;
   defaultRole: string | undefined;
   mail: boolean;
   passwordReset: boolean;