better-auth 1.7.11 → 1.7.13

package/dist/plugins/oauth-proxy/index.mjs

@@ -4,19 +4,17 @@ import { originCheck } from "../../api/middlewares/origin-check.mjs";
 import { parseSetCookieHeader } from "../../cookies/cookie-utils.mjs";
 import { symmetricDecrypt, symmetricEncrypt } from "../../crypto/index.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
-import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { redirectOnError } from "../../oauth2/errors.mjs";
-import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { setOAuthState } from "../../api/state/oauth.mjs";
 import { derivePurposeKey } from "../../crypto/purpose.mjs";
 import { getAuthStateVerificationIdentifier, parseGenericState } from "../../state.mjs";
+import { exchangeOAuthCallback } from "../../oauth2/callback.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
 import { accountSchema, userSchema } from "@better-auth/core/db";
-import { safeJSONParse } from "@better-auth/core/utils/json";
-import { defu } from "defu";
+import { defu as defu$1 } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/plugins/oauth-proxy/index.ts
@@ -63,7 +61,9 @@ const oauthProxyQuerySchema = z.object({
 const oauthCallbackQuerySchema = z.object({
 	code: z.string().optional(),
 	error: z.string().optional(),
-	user: z.string().optional()
+	user: z.string().optional(),
+	iss: z.string().optional(),
+	device_id: z.string().optional()
 });
 const oAuthProxy = (opts) => {
 	const maxAge = opts?.maxAge ?? 60;
@@ -220,15 +220,16 @@ const oAuthProxy = (opts) => {
 					return context.path === "/callback/:id";
 				},
 				handler: createAuthMiddleware(async (ctx) => {
-					const callbackParams = defu(ctx.query, ctx.body);
+					const callbackParams = defu$1(ctx.query, ctx.body);
 					const state = callbackParams.state;
 					if (!state || typeof state !== "string") return;
 					let statePackage;
 					try {
-						statePackage = parseJSON(await symmetricDecrypt({
+						const decryptedPackage = await symmetricDecrypt({
 							key: getEncryptionKey(ctx, "oauth-proxy-package"),
 							data: state
-						}));
+						});
+						statePackage = parseJSON(decryptedPackage);
 					} catch {
 						ctx.context.logger.debug("OAuth proxy: could not decrypt state package, falling back to regular callback");
 						return;
@@ -242,13 +243,14 @@ const oAuthProxy = (opts) => {
 						ctx.context.logger.warn("Invalid OAuth callback query", query.error);
 						return;
 					}
-					const { code, error, user: userData } = query.data;
+					const { code, error, user: userData, iss, device_id: deviceId } = query.data;
 					let stateData;
 					try {
-						stateData = parseJSON(await symmetricDecrypt({
+						const decryptedState = await symmetricDecrypt({
 							key: getEncryptionKey(ctx, "oauth-proxy-state"),
 							data: statePackage.stateCookie
-						}));
+						});
+						stateData = parseJSON(decryptedState);
 					} catch (e) {
 						ctx.context.logger.error("Failed to decrypt OAuth proxy state cookie:", e);
 						return;
@@ -269,47 +271,20 @@ const oAuthProxy = (opts) => {
 						ctx.context.logger.warn("OAuth provider not found", { providerId });
 						throw redirectOnError(ctx, errorURL, "oauth_provider_not_found");
 					}
-					let tokens;
-					try {
-						tokens = await provider.validateAuthorizationCode({
-							code,
-							codeVerifier: stateData.codeVerifier,
-							redirectURI: `${ctx.context.baseURL}${getOAuthCallbackPath(provider)}`
-						});
-					} catch (e) {
-						ctx.context.logger.error("Failed to validate authorization code", e);
-						throw redirectOnError(ctx, errorURL, "invalid_code");
-					}
-					if (!tokens) throw redirectOnError(ctx, errorURL, "invalid_code");
-					const parsedUserData = userData ? safeJSONParse(userData) : null;
-					const userInfoResult = await provider.getUserInfo({
-						...tokens,
-						/**
-						* The user object from the provider
-						* This is only available for some providers like Apple
-						*/
-						user: parsedUserData ?? void 0
+					const exchanged = await exchangeOAuthCallback(ctx, provider, {
+						code,
+						codeVerifier: stateData.codeVerifier,
+						iss,
+						deviceId,
+						user: userData,
+						idTokenNonce: stateData.idTokenNonce
 					});
-					const userInfo = userInfoResult?.user;
-					if (!userInfo) {
-						ctx.context.logger.error("Unable to get user info from provider");
-						throw redirectOnError(ctx, errorURL, "unable_to_get_user_info");
-					}
+					if (exchanged.error) throw redirectOnError(ctx, errorURL, exchanged.error);
+					const { tokens, userInfo, providerProfile, accountKey } = exchanged;
 					if (!userInfo.email) {
 						ctx.context.logger.error("Provider did not return email");
 						throw redirectOnError(ctx, errorURL, "email_not_found");
 					}
-					let accountKey;
-					try {
-						accountKey = await resolveOAuthAccountKey(provider, tokens, userInfoResult.data);
-					} catch (error) {
-						ctx.context.logger.error("Unable to derive provider account identity", {
-							providerId: provider.id,
-							error
-						});
-						throw redirectOnError(ctx, errorURL, "unable_to_get_user_info");
-					}
-					const providerProfile = toOAuthProfileRecord(userInfoResult.data);
 					const proxyCallbackURL = new URL(stateData.callbackURL);
 					const finalCallbackURL = proxyCallbackURL.searchParams.get("callbackURL") || stateData.callbackURL;
 					const payload = {
@@ -404,7 +379,8 @@ const oAuthProxy = (opts) => {
 				handler: createAuthMiddleware(async (ctx) => {
 					const location = ctx.context.responseHeaders?.get("location");
 					if (!location?.includes("/oauth-proxy?callbackURL") && !location?.includes("/oauth-proxy-callback?callbackURL") || !location.startsWith("http")) return;
-					const productionOrigin = getOrigin(opts?.productionURL || (typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : void 0) || ctx.context.baseURL);
+					const productionURL = opts?.productionURL || (typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : void 0) || ctx.context.baseURL;
+					const productionOrigin = getOrigin(productionURL);
 					const locationURL = new URL(location);
 					if (locationURL.origin === productionOrigin) {
 						const newLocation = locationURL.searchParams.get("callbackURL");

package/dist/plugins/one-tap/client.d.mts

@@ -1,14 +1,12 @@
 import { BetterAuthClientOptions, ClientFetchOption, ClientStore } from "@better-auth/core";
-import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 import { BetterFetch } from "@better-fetch/fetch";
-
 //#region src/plugins/one-tap/client.d.ts
 declare global {
   interface Window {
     googleScriptInitialized?: boolean | undefined;
   }
 }
-interface GsiButtonConfiguration {
+export interface GsiButtonConfiguration {
   /**
    * The button type: icon, or standard button.
    */
@@ -69,7 +67,7 @@ interface GsiButtonConfiguration {
    */
   state?: string;
 }
-interface GoogleOneTapOptions {
+export interface GoogleOneTapOptions {
   /**
    * Google client ID
    */
@@ -129,7 +127,7 @@ interface GoogleOneTapOptions {
     fedCM?: boolean | undefined;
   } | undefined;
 }
-interface GoogleOneTapActionOptions extends Omit<GoogleOneTapOptions, "clientId" | "promptOptions"> {
+export interface GoogleOneTapActionOptions extends Omit<GoogleOneTapOptions, "clientId" | "promptOptions"> {
   fetchOptions?: ClientFetchOption | undefined;
   /**
    * Callback URL.
@@ -157,14 +155,14 @@ interface GoogleOneTapActionOptions extends Omit<GoogleOneTapOptions, "clientId"
     config?: GsiButtonConfiguration | undefined;
   } | undefined;
 }
-declare const oneTapClient: (options: GoogleOneTapOptions) => {
+export declare const oneTapClient: (options: GoogleOneTapOptions) => {
   id: "one-tap";
   version: string;
   fetchPlugins: {
     id: string;
     name: string;
     hooks: {
-      onResponse(ctx: _$_better_fetch_fetch0.ResponseContext): Promise<void>;
+      onResponse(ctx: import("@better-fetch/fetch").ResponseContext): Promise<void>;
     };
   }[];
   getActions: ($fetch: BetterFetch, _$store: ClientStore, _options: BetterAuthClientOptions | undefined) => {
@@ -172,5 +170,4 @@ declare const oneTapClient: (options: GoogleOneTapOptions) => {
   };
   getAtoms($fetch: BetterFetch): {};
 };
-//#endregion
-export { GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, oneTapClient };
+//#endregion

package/dist/plugins/one-tap/index.d.mts

@@ -1,6 +1,4 @@
-import * as _$better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/one-tap/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -9,7 +7,7 @@ declare module "@better-auth/core" {
     };
   }
 }
-interface OneTapOptions {
+export interface OneTapOptions {
   /**
    * Disable the signup flow
    *
@@ -24,11 +22,11 @@ interface OneTapOptions {
    */
   clientId?: string | undefined;
 }
-declare const oneTap: (options?: OneTapOptions | undefined) => {
+export declare const oneTap: (options?: OneTapOptions | undefined) => {
   id: "one-tap";
   version: string;
   endpoints: {
-    oneTapCallback: _$better_call0.StrictEndpoint<"/one-tap/callback", {
+    oneTapCallback: import("better-call").StrictEndpoint<"/one-tap/callback", {
       method: "POST";
       body: z.ZodObject<{
         idToken: z.ZodString;
@@ -78,5 +76,4 @@ declare const oneTap: (options?: OneTapOptions | undefined) => {
   };
   options: OneTapOptions | undefined;
 };
-//#endregion
-export { OneTapOptions, oneTap };
+//#endregion

package/dist/plugins/one-time-token/client.d.mts

@@ -1,10 +1,9 @@
 import { OneTimeTokenOptions, oneTimeToken } from "./index.mjs";
-
 //#region src/plugins/one-time-token/client.d.ts
-declare const oneTimeTokenClient: () => {
+export declare const oneTimeTokenClient: () => {
   id: "one-time-token";
   version: string;
   $InferServerPlugin: ReturnType<typeof oneTimeToken>;
 };
 //#endregion
-export { oneTimeTokenClient };
+export type { OneTimeTokenOptions };

package/dist/plugins/one-time-token/index.d.mts

@@ -1,8 +1,7 @@
 import { Session, User } from "../../types/models.mjs";
+import "../../types/index.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
-import * as _$better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/one-time-token/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -11,7 +10,7 @@ declare module "@better-auth/core" {
     };
   }
 }
-interface OneTimeTokenOptions {
+export interface OneTimeTokenOptions {
   /**
    * Expires in minutes
    *
@@ -48,7 +47,7 @@ interface OneTimeTokenOptions {
    */
   setOttHeaderOnNewSession?: boolean;
 }
-declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
+export declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
   id: "one-time-token";
   version: string;
   endpoints: {
@@ -67,9 +66,9 @@ declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-generate)
      */
-    generateOneTimeToken: _$better_call0.StrictEndpoint<"/one-time-token/generate", {
+    generateOneTimeToken: import("better-call").StrictEndpoint<"/one-time-token/generate", {
       method: "GET";
-      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -110,7 +109,7 @@ declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-verify)
      */
-    verifyOneTimeToken: _$better_call0.StrictEndpoint<"/one-time-token/verify", {
+    verifyOneTimeToken: import("better-call").StrictEndpoint<"/one-time-token/verify", {
       method: "POST";
       body: z.ZodObject<{
         token: z.ZodString;
@@ -123,10 +122,9 @@ declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
   hooks: {
     after: {
       matcher: () => true;
-      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+      handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
     }[];
   };
   options: OneTimeTokenOptions | undefined;
 };
-//#endregion
-export { OneTimeTokenOptions, oneTimeToken };
+//#endregion

package/dist/plugins/open-api/generator.d.mts

@@ -1,9 +1,8 @@
 import { AuthContext, BetterAuthOptions } from "@better-auth/core";
 import { DBFieldAttributeConfig, DBFieldType } from "@better-auth/core/db";
 import { OpenAPIParameter, OpenAPISchemaType } from "better-call";
-
 //#region src/plugins/open-api/generator.d.ts
-interface Path {
+export interface Path {
   get?: OpenAPIOperation | undefined;
   post?: OpenAPIOperation | undefined;
   put?: OpenAPIOperation | undefined;
@@ -11,7 +10,7 @@ interface Path {
   delete?: OpenAPIOperation | undefined;
 }
 type OpenAPISchemaPrimitiveType = OpenAPISchemaType | "null";
-type OpenAPISchema = {
+export type OpenAPISchema = {
   type?: OpenAPISchemaPrimitiveType | OpenAPISchemaPrimitiveType[];
   properties?: Record<string, OpenAPISchema>;
   required?: string[];
@@ -70,8 +69,9 @@ type OpenAPIOperation = {
   requestBody?: OpenAPIRequestBody;
   responses?: Record<string, OpenAPIResponse>;
 };
-type FieldSchema = {
-  type: DBFieldType | "array"; /** Element schema for `type: "array"` (JSON Schema / OpenAPI array shape). */
+export type FieldSchema = {
+  type: DBFieldType | "array";
+  /** Element schema for `type: "array"` (JSON Schema / OpenAPI array shape). */
   items?: {
     type: string;
   };
@@ -79,12 +79,12 @@ type FieldSchema = {
   readOnly?: boolean | undefined;
   format?: string;
 };
-type OpenAPIModelSchema = {
+export type OpenAPIModelSchema = {
   type: "object";
   properties: Record<string, FieldSchema>;
   required?: string[] | undefined;
 };
-declare function generator(ctx: AuthContext, options: BetterAuthOptions): Promise<{
+export declare function generator(ctx: AuthContext, options: BetterAuthOptions): Promise<{
   openapi: string;
   info: {
     title: string;
@@ -123,4 +123,4 @@ declare function generator(ctx: AuthContext, options: BetterAuthOptions): Promis
   paths: Record<string, Path>;
 }>;
 //#endregion
-export { FieldSchema, OpenAPIModelSchema, OpenAPIParameter$1 as OpenAPIParameter, OpenAPISchema, Path, generator };
+export { OpenAPIParameter$1 as OpenAPIParameter };

package/dist/plugins/open-api/generator.mjs

@@ -2,7 +2,7 @@ import { db_exports } from "../../db/index.mjs";
 import { getEndpoints } from "../../api/index.mjs";
 import * as z from "zod";
 //#region src/plugins/open-api/generator.ts
-const OPEN_API_SCHEMA_TYPES = new Set([
+const OPEN_API_SCHEMA_TYPES = /* @__PURE__ */ new Set([
 	"string",
 	"number",
 	"boolean",
@@ -51,7 +51,7 @@ function withDescription(schema, zodType) {
 function addNullType(schema) {
 	if (schema.type) {
 		const type = Array.isArray(schema.type) ? schema.type : [schema.type];
-		const nullableType = Array.from(new Set([...type, "null"]));
+		const nullableType = Array.from(/* @__PURE__ */ new Set([...type, "null"]));
 		return {
 			...schema,
 			type: nullableType
@@ -152,7 +152,7 @@ function mergeObjectSchemas(left, right, description) {
 		if (properties[key] !== void 0 && !areSchemasEqual(properties[key], value)) return;
 		properties[key] = value;
 	}
-	const required = Array.from(new Set([...left.required || [], ...right.required || []]));
+	const required = Array.from(/* @__PURE__ */ new Set([...left.required || [], ...right.required || []]));
 	const leftAdditionalProperties = left.additionalProperties;
 	const rightAdditionalProperties = right.additionalProperties;
 	if (!areSchemaMembersCompatible(leftAdditionalProperties, rightAdditionalProperties)) return;
@@ -184,7 +184,7 @@ function getRequestBody(options) {
 * Paths that accept `user.additionalFields` and plugin user schema fields via
 * `parseUserInput`. Their static OpenAPI request bodies need those fields merged in.
 */
-const USER_INPUT_BODY_PATHS = new Set(["/sign-up/email", "/update-user"]);
+const USER_INPUT_BODY_PATHS = /* @__PURE__ */ new Set(["/sign-up/email", "/update-user"]);
 function dbFieldToRequestBodyProperty(field) {
 	if (field.type === "date") return {
 		type: "string",
@@ -414,7 +414,7 @@ async function generator(ctx, options) {
 	const components = { schemas: { ...Object.entries(tables).reduce((acc, [key, value]) => {
 		const modelName = key.charAt(0).toUpperCase() + key.slice(1);
 		const fields = value.fields;
-		const required = new Set(["id"]);
+		const required = /* @__PURE__ */ new Set(["id"]);
 		const properties = { id: {
 			type: "string",
 			readOnly: true

package/dist/plugins/open-api/index.d.mts

@@ -1,7 +1,5 @@
 import { FieldSchema, OpenAPIModelSchema, OpenAPIParameter, OpenAPISchema, Path, generator } from "./generator.mjs";
 import { LiteralString } from "@better-auth/core";
-import * as _$better_call0 from "better-call";
-
 //#region src/plugins/open-api/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -11,7 +9,7 @@ declare module "@better-auth/core" {
   }
 }
 type ScalarTheme = "alternate" | "default" | "moon" | "purple" | "solarized" | "bluePlanet" | "saturn" | "kepler" | "mars" | "deepSpace" | "laserwave" | "none";
-interface OpenAPIOptions {
+export interface OpenAPIOptions {
   /**
    * The path to the OpenAPI reference page
    *
@@ -40,11 +38,11 @@ interface OpenAPIOptions {
    */
   nonce?: string | undefined;
 }
-declare const openAPI: <O extends OpenAPIOptions>(options?: O | undefined) => {
+export declare const openAPI: <O extends OpenAPIOptions>(options?: O | undefined) => {
   id: "open-api";
   version: string;
   endpoints: {
-    generateOpenAPISchema: _$better_call0.StrictEndpoint<"/open-api/generate-schema", {
+    generateOpenAPISchema: import("better-call").StrictEndpoint<"/open-api/generate-schema", {
       method: "GET";
     }, {
       openapi: string;
@@ -84,7 +82,7 @@ declare const openAPI: <O extends OpenAPIOptions>(options?: O | undefined) => {
       }[];
       paths: Record<string, Path>;
     }>;
-    openAPIReference: _$better_call0.StrictEndpoint<LiteralString | "/reference", {
+    openAPIReference: import("better-call").StrictEndpoint<LiteralString | "/reference", {
       method: "GET";
       metadata: {
         readonly scope: "server";
@@ -94,4 +92,4 @@ declare const openAPI: <O extends OpenAPIOptions>(options?: O | undefined) => {
   options: NoInfer<O>;
 };
 //#endregion
-export { type FieldSchema, type OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, type Path, generator, openAPI };
+export type { FieldSchema, OpenAPIModelSchema, OpenAPIParameter, OpenAPISchema, Path, generator };

package/dist/plugins/organization/access/index.mjs

@@ -1,2 +1 @@
-import { adminAc, defaultAc, defaultRoles, defaultStatements, memberAc, ownerAc } from "./statement.mjs";
-export { adminAc, defaultAc, defaultRoles, defaultStatements, memberAc, ownerAc };
+export { adminAc, defaultAc, defaultRoles, defaultStatements, memberAc, ownerAc } from "./statement.mjs";

package/dist/plugins/organization/access/statement.d.mts

@@ -1,13 +1,14 @@
 import { ExactRoleStatements, Role, RoleInput, Statements } from "../../access/types.mjs";
+import "../../index.mjs";
 //#region src/plugins/organization/access/statement.d.ts
-declare const defaultStatements: {
+export declare const defaultStatements: {
   readonly organization: readonly ["update", "delete"];
   readonly member: readonly ["create", "update", "delete"];
   readonly invitation: readonly ["create", "cancel"];
   readonly team: readonly ["create", "update", "delete"];
   readonly ac: readonly ["create", "read", "update", "delete"];
 };
-declare const defaultAc: {
+export declare const defaultAc: {
   newRole<const TRoleStatements extends Statements>(statements: RoleInput<{
     readonly organization: readonly ["update", "delete"];
     readonly member: readonly ["create", "update", "delete"];
@@ -29,7 +30,7 @@ declare const defaultAc: {
     readonly ac: readonly ["create", "read", "update", "delete"];
   };
 };
-declare const adminAc: Role<ExactRoleStatements<{
+export declare const adminAc: Role<ExactRoleStatements<{
   readonly organization: ["update"];
   readonly invitation: ["create", "cancel"];
   readonly member: ["create", "update", "delete"];
@@ -42,7 +43,7 @@ declare const adminAc: Role<ExactRoleStatements<{
   readonly team: readonly ["create", "update", "delete"];
   readonly ac: readonly ["create", "read", "update", "delete"];
 }>;
-declare const ownerAc: Role<ExactRoleStatements<{
+export declare const ownerAc: Role<ExactRoleStatements<{
   readonly organization: ["update", "delete"];
   readonly member: ["create", "update", "delete"];
   readonly invitation: ["create", "cancel"];
@@ -55,7 +56,7 @@ declare const ownerAc: Role<ExactRoleStatements<{
   readonly team: readonly ["create", "update", "delete"];
   readonly ac: readonly ["create", "read", "update", "delete"];
 }>;
-declare const memberAc: Role<ExactRoleStatements<{
+export declare const memberAc: Role<ExactRoleStatements<{
   readonly organization: [];
   readonly member: [];
   readonly invitation: [];
@@ -68,7 +69,7 @@ declare const memberAc: Role<ExactRoleStatements<{
   readonly team: readonly ["create", "update", "delete"];
   readonly ac: readonly ["create", "read", "update", "delete"];
 }>;
-declare const defaultRoles: {
+export declare const defaultRoles: {
   admin: Role<ExactRoleStatements<{
     readonly organization: ["update"];
     readonly invitation: ["create", "cancel"];
@@ -109,5 +110,4 @@ declare const defaultRoles: {
     readonly ac: readonly ["create", "read", "update", "delete"];
   }>;
 };
-//#endregion
-export { adminAc, defaultAc, defaultRoles, defaultStatements, memberAc, ownerAc };
+//#endregion