@protobase/server 0.7.0 → 0.8.0

package/dist/better-auth/create-auth.d.ts

@@ -1,8 +1,12 @@
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
+import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { Mailer } from "../mail/smtp-mailer.js";
 import { OperatorProvider } from "./operator-provider.js";
+import { OrganizationRole } from "./organizations/store.js";
+import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
+import "../index.js";
 import { BetterAuthOptions } from "better-auth";
 //#region src/better-auth/create-auth.d.ts
 export type CreateAuthOptions = {
@@ -16,8 +20,12 @@ export type CreateAuthOptions = {
   secret: string;
   /** Extra origins that may call the auth endpoints. `baseURL` and `https://*.trycloudflare.com` are always trusted. */
   trustedOrigins?: string[];
-  /** The roles users can have, for example `['admin', 'accountant', 'warehouse']`. `admin` is always included; default `['admin', 'user']`. */
-  roles?: string[];
+  /**
+   * The roles users can have, for example `['admin', 'accountant', 'warehouse']`. `admin` is always included; default
+   * `['admin', 'user']`. With `organizations`, give each a label, and optionally the other roles its holders may also
+   * give members: `{ manager: { label: 'Manager', grants: ['sales'] }, sales: 'Sales' }`.
+   */
+  roles?: RolesInput;
   /**
    * The role of a user created without one. Optional: when unset, and more than one role besides `admin` exists,
    * creating a user without a role is an error that asks for one. With exactly one other role, that role is the default.
@@ -55,12 +63,23 @@ export type CreateAuthOptions = {
    * environment says. Left out when `socialProviders` has a provider with the same id.
    */
   signInProvider?: PlatformSignIn | false;
+  /**
+   * Turns on organizations: people work in one at a time, records of `.tenant` resources are scoped to it, and roles
+   * are held globally (on the user) or per membership. Off by default: the app works as one organization.
+   */
+  organizations?: OrganizationsOptions;
 };
 type UserCreateHooks = NonNullable<NonNullable<NonNullable<BetterAuthOptions['databaseHooks']>['user']>['create']>;
 /** Better Auth's `databaseHooks.user.create.after`: the created user (with its `role`) and the request context, `null` outside a request. */
 export type UserCreatedHook = NonNullable<UserCreateHooks['after']>;
+/**
+ * Better Auth for a single-tenant admin: sign-in with a password, an emailed code or a passkey, two-factor
+ * authentication, and the sign-in policy admins set; no public sign-up (every account is created on the host with
+ * `createUser`, or by an admin through the admin plugin), roles from the admin plugin's `role` column, 15 minute JWTs
+ * at `/api/auth/token` with the keys at `/api/auth/jwks`.
+ */
 /** The configured roles with `admin` first; `admin` is added when missing. */
-export declare const normalizeRoles: (roles?: string[]) => string[];
+export declare const normalizeRoles: (roles?: RolesInput) => string[];
 export declare const createAuth: (options: CreateAuthOptions) => import("better-auth").Auth<{
   user: {
     fields: {
@@ -68,6 +87,20 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       createdAt: string;
       updatedAt: string;
     };
+  } | {
+    additionalFields: {
+      readonly lastOrganizationId: {
+        readonly type: "string";
+        readonly required: false;
+        readonly input: false;
+        readonly fieldName: "last_organization_id";
+      };
+    };
+    fields: {
+      emailVerified: string;
+      createdAt: string;
+      updatedAt: string;
+    };
   };
   session: {
     fields: {
@@ -1038,13 +1071,31 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         expirationTime: string;
         issuer: string;
         audience: string;
-        definePayload: ({ user }: {
+        definePayload: ({ user, session }: {
           user: import("better-auth").User & Record<string, any>;
           session: import("better-auth").Session & Record<string, any>;
-        }) => {
+        }) => Promise<{
           email: string;
           role: any;
-        };
+        } | {
+          org?: undefined;
+          org_role?: undefined;
+          app_roles?: undefined;
+          email: string;
+          role: any;
+        } | {
+          org: string;
+          org_role: OrganizationRole;
+          app_roles: string[];
+          email: string;
+          role: any;
+        } | {
+          org: string;
+          org_role?: undefined;
+          app_roles?: undefined;
+          email: string;
+          role: any;
+        }>;
       };
       disableSettingJwtHeader: true;
     }>;
@@ -3076,7 +3127,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
       INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
       TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
     };
-  })[], {
+  } | {
     id: "protobase-sign-in-policy";
     schema: {
       readonly signInPolicy: {
@@ -3139,12 +3190,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent? /**
-                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-                 * environment says. Left out when `socialProviders` has a provider with the same id.
-                 */ : string | null | undefined;
+                userAgent?: string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3168,12 +3214,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent? /**
-                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-                 * environment says. Left out when `socialProviders` has a provider with the same id.
-                 */ : string | null | undefined;
+                userAgent?: string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3196,12 +3237,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /**
-               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-               * environment says. Left out when `socialProviders` has a provider with the same id.
-               */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3256,12 +3292,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent? /**
-                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-                 * environment says. Left out when `socialProviders` has a provider with the same id.
-                 */ : string | null | undefined;
+                userAgent?: string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3285,12 +3316,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent? /**
-                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-                 * environment says. Left out when `socialProviders` has a provider with the same id.
-                 */ : string | null | undefined;
+                userAgent?: string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3313,12 +3339,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /**
-               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-               * environment says. Left out when `socialProviders` has a provider with the same id.
-               */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3373,12 +3394,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /**
-               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-               * environment says. Left out when `socialProviders` has a provider with the same id.
-               */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3409,7 +3425,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
-  }, {
+  } | {
     id: "protobase-staff-sign-in";
     schema: {
       readonly staffSignIn: {
@@ -3483,12 +3499,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /**
-               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-               * environment says. Left out when `socialProviders` has a provider with the same id.
-               */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3516,12 +3527,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /**
-               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-               * environment says. Left out when `socialProviders` has a provider with the same id.
-               */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3550,12 +3556,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent? /**
-                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-                 * environment says. Left out when `socialProviders` has a provider with the same id.
-                 */ : string | null | undefined;
+                userAgent?: string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3579,12 +3580,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
                 expiresAt: Date;
                 token: string;
                 ipAddress?: string | null | undefined;
-                userAgent? /**
-                 * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-                 * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-                 * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-                 * environment says. Left out when `socialProviders` has a provider with the same id.
-                 */ : string | null | undefined;
+                userAgent?: string | null | undefined;
               };
               user: Record<string, any> & {
                 id: string;
@@ -3607,12 +3603,7 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent? /**
-               * A sign-in provider the platform adds for people who already have an account: an OpenID Connect provider that never
-               * signs anyone up. Defaults to the one the platform passes in `PROTOBASE_SIGN_IN_ISSUER`, `PROTOBASE_SIGN_IN_CLIENT_ID`
-               * and `PROTOBASE_SIGN_IN_CLIENT_SECRET` (see `readPlatformSignIn`), when set; `false` turns it off whatever the
-               * environment says. Left out when `socialProviders` has a provider with the same id.
-               */ : string | null | undefined;
+              userAgent?: string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -3672,9 +3663,550 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
-  }];
+  } | import("better-auth/plugins").DefaultOrganizationPlugin<{
+    organizationHooks: {
+      beforeCreateOrganization?: (data: {
+        organization: {
+          name?: string;
+          slug?: string;
+          logo?: string | null;
+          metadata?: Record<string, any>;
+          [key: string]: any;
+        };
+        user: import("better-auth").User & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterCreateOrganization?: (data: {
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+      }) => Promise<void>;
+      beforeUpdateOrganization?: (data: {
+        organization: {
+          name?: string;
+          slug?: string;
+          logo?: string | null;
+          metadata?: Record<string, any>;
+          [key: string]: any;
+        };
+        user: import("better-auth").User & Record<string, any>;
+        member: import("better-auth/plugins").Member & Record<string, any>;
+      }) => Promise<void | {
+        data: {
+          name?: string;
+          slug?: string;
+          logo?: string | null;
+          metadata?: Record<string, any>;
+          [key: string]: any;
+        };
+      }>;
+      afterUpdateOrganization?: (data: {
+        organization: (import("better-auth/plugins").Organization & Record<string, any>) | null;
+        user: import("better-auth").User & Record<string, any>;
+        member: import("better-auth/plugins").Member & Record<string, any>;
+      }) => Promise<void>;
+      beforeDeleteOrganization?: (data: {
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+      }, ctx?: import("better-auth").GenericEndpointContext) => Promise<void>;
+      afterDeleteOrganization?: (data: {
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+      }, ctx?: import("better-auth").GenericEndpointContext) => Promise<void>;
+      beforeAddMember?: (data: {
+        member: {
+          userId: string;
+          organizationId: string;
+          role: string;
+          [key: string]: any;
+        };
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterAddMember?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeRemoveMember?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterRemoveMember?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeUpdateMemberRole?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        newRole: string;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: {
+          role: string;
+          [key: string]: any;
+        };
+      }>;
+      afterUpdateMemberRole?: (data: {
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        previousRole: string;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeCreateInvitation?: (data: {
+        invitation: {
+          email: string;
+          role: string;
+          organizationId: string;
+          inviterId: string;
+          teamId?: string;
+          [key: string]: any;
+        };
+        inviter: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterCreateInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        inviter: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeAcceptInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterAcceptInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        member: import("better-auth/plugins").Member & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeRejectInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterRejectInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeCancelInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        cancelledBy: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterCancelInvitation?: (data: {
+        invitation: import("better-auth/plugins").Invitation & Record<string, any>;
+        cancelledBy: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeCreateTeam?: (data: {
+        team: {
+          name: string;
+          organizationId: string;
+          [key: string]: any;
+        };
+        user?: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterCreateTeam?: (data: {
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user?: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeUpdateTeam?: (data: {
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        updates: {
+          name?: string;
+          [key: string]: any;
+        };
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterUpdateTeam?: (data: {
+        team: (import("better-auth/plugins").Team & Record<string, any>) | null;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeDeleteTeam?: (data: {
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user?: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterDeleteTeam?: (data: {
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user?: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeAddTeamMember?: (data: {
+        teamMember: {
+          teamId: string;
+          userId: string;
+          [key: string]: any;
+        };
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void | {
+        data: Record<string, any>;
+      }>;
+      afterAddTeamMember?: (data: {
+        teamMember: import("better-auth/plugins").TeamMember & Record<string, any>;
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeRemoveTeamMember?: (data: {
+        teamMember: import("better-auth/plugins").TeamMember & Record<string, any>;
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+      afterRemoveTeamMember?: (data: {
+        teamMember: import("better-auth/plugins").TeamMember & Record<string, any>;
+        team: import("better-auth/plugins").Team & Record<string, any>;
+        user: import("better-auth").User & Record<string, any>;
+        organization: import("better-auth/plugins").Organization & Record<string, any>;
+      }) => Promise<void>;
+    };
+    sendInvitationEmail?: (({ invitation, organization, inviter }: {
+      id: string;
+      role: string;
+      email: string;
+      organization: import("better-auth/plugins").Organization;
+      invitation: import("better-auth/plugins").Invitation;
+      inviter: import("better-auth/plugins").Member & {
+        user: import("better-auth").User;
+      };
+    }) => Promise<void>) | undefined;
+    creatorRole: string;
+    allowUserToCreateOrganization: (user: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    } & Record<string, any>) => boolean;
+    invitationExpiresIn: number;
+    membershipLimit: number;
+    requireEmailVerificationOnInvitation: true;
+    cancelPendingInvitationsOnReInvite: true;
+    schema: {
+      organization: {
+        fields: {
+          createdAt: string;
+        };
+      };
+      member: {
+        fields: {
+          organizationId: string;
+          userId: string;
+          createdAt: string;
+        };
+        additionalFields: {
+          appRoles: {
+            type: "string[]";
+            required: false;
+            defaultValue: never[];
+            input: false;
+            fieldName: string;
+          };
+        };
+      };
+      invitation: {
+        fields: {
+          organizationId: string;
+          inviterId: string;
+          expiresAt: string;
+          createdAt: string;
+        };
+        additionalFields: {
+          appRoles: {
+            type: "string[]";
+            required: false;
+            defaultValue: never[];
+            input: true;
+            fieldName: string;
+          };
+        };
+      };
+      session: {
+        fields: {
+          activeOrganizationId: string;
+        };
+      };
+    };
+  }> | {
+    id: "protobase-organizations";
+    endpoints: {
+      setAppRoles: import("better-auth").StrictEndpoint<"/organization/set-app-roles", {
+        method: "POST";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          memberId: import("zod").ZodString;
+          appRoles: import("zod").ZodArray<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        member: {
+          appRoles: string[];
+          id: string;
+          organizationId: string;
+          userId: string;
+          role: string;
+          createdAt: Date;
+        };
+      }>;
+      transferOwnership: import("better-auth").StrictEndpoint<"/organization/transfer-ownership", {
+        method: "POST";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          memberId: import("zod").ZodString;
+          keepAs: import("zod").ZodOptional<import("zod").ZodEnum<{
+            admin: "admin";
+            member: "member";
+          }>>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        owner: string;
+      }>;
+      currentOrganization: import("better-auth").StrictEndpoint<"/organization/current", {
+        method: "GET";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        organization: null;
+        globalRoles: string[];
+      } | {
+        globalRoles: string[];
+        role?: OrganizationRole | undefined;
+        appRoles?: string[] | undefined;
+        memberId?: string | undefined;
+        organization: {
+          id: string;
+          name: string;
+          slug: string;
+          logo: string | null;
+        };
+      }>;
+      searchOrganizations: import("better-auth").StrictEndpoint<"/organization/search", {
+        method: "GET";
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        query: import("zod").ZodObject<{
+          query: import("zod").ZodDefault<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        organizations: {
+          id: string;
+          name: string;
+          slug: string;
+        }[];
+      }>;
+      getInvitation: import("better-auth").StrictEndpoint<"/invitation", {
+        method: "GET";
+        query: import("zod").ZodObject<{
+          token: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        organization: {
+          id: string;
+          name: string;
+        };
+        inviter: {
+          name: string;
+        };
+        email: string;
+        role: string;
+        appRoles: string[];
+        expiresAt: string;
+        hasAccount: boolean;
+      }>;
+      acceptInvitation: import("better-auth").StrictEndpoint<"/invitation/accept", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          token: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+        use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        member: {
+          appRoles: string[];
+          id: string;
+          createdAt: Date;
+          userId: string;
+          role: string;
+          organizationId: string;
+        };
+      }>;
+      signUpFromInvitation: import("better-auth").StrictEndpoint<"/invitation/sign-up", {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          token: import("zod").ZodString;
+          name: import("zod").ZodString;
+          password: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        member: {
+          appRoles: string[];
+          id: string;
+          createdAt: Date;
+          userId: string;
+          role: string;
+          organizationId: string;
+        };
+      }>;
+    };
+    hooks: {
+      after: {
+        matcher: (context: {
+          path?: string;
+        }) => boolean;
+        handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  })[]];
   disabledPaths: string[];
   databaseHooks: {
+    session?: {
+      create: {
+        before: (session: {
+          userId: string;
+          activeOrganizationId?: string | null;
+        } & Record<string, unknown>) => Promise<{
+          data: {
+            activeOrganizationId: string;
+            userId: string;
+          };
+        } | undefined>;
+      };
+      update: {
+        after: (session: {
+          userId: string;
+          activeOrganizationId?: string | null;
+        }) => Promise<void>;
+      };
+    } | undefined;
     user: {
       create: {
         after?: ((user: import("better-auth").User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>) | undefined;
@@ -3713,6 +4245,10 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
         window: number;
         max: number;
       };
+      '/invitation/sign-up': {
+        window: number;
+        max: number;
+      };
     };
   };
   advanced: {
@@ -3746,6 +4282,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   };
 }> & {
   roles: string[];
+  roleDefinitions: RoleDefinitions;
+  organizations: ResolvedOrganizations | undefined;
   defaultRole: string | undefined;
   mail: boolean;
   passwordReset: boolean;