@meistrari/auth-core 1.39.3 → 1.40.0

package/dist/index.d.mts

@@ -1357,6 +1357,14 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 noncePayload: (nonce: string) => Promise<NoncePayloadResponse>;
             };
         };
+    } | {
+        id: "invitation-signup";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            invitationSignup: {
+                status: (invitationId: string) => Promise<InvitationSignupStatus>;
+                setupPassword: (invitationId: string, password: string) => Promise<InvitationPasswordSetupResult>;
+            };
+        };
     } | {
         id: "sso-client";
         version: string;
@@ -5368,6 +5376,33 @@ type CreateTeamPayload = Pick<Team, 'name'> & {
  */
 type UpdateTeamPayload = Pick<Team, 'name'>;
 
+/**
+ * Status of an invitation as seen by the pre-login invite flow.
+ *
+ * `email` and `requiresAccountSetup` are only present while the invitation is
+ * still pending; other statuses return the status alone.
+ */
+type InvitationSignupStatus = {
+    status: 'pending';
+    email: string;
+    /** True when the invited user has no account yet and has never signed in. */
+    requiresAccountSetup: boolean;
+} | {
+    status: 'accepted' | 'canceled' | 'rejected' | 'expired';
+};
+/**
+ * Result of creating a password from an invitation. The user is signed in
+ * as part of the call; the session cookie is set on the response.
+ */
+type InvitationPasswordSetupResult = {
+    token: string;
+    user: {
+        id: string;
+        email: string;
+        name: string;
+    };
+};
+
 /**
  * Service for managing organizations, members, invitations, and teams.
  *
@@ -5566,6 +5601,29 @@ declare class OrganizationService {
      *   and the configured post-acceptance URL for plain organization invitations.
      */
     acceptInvitation(id: string): Promise<AcceptInvitationResult>;
+    /**
+     * Gets the pre-login signup status for an invitation.
+     *
+     * Public endpoint keyed by the invitation id from the emailed invite link.
+     * While the invitation is pending, the result includes the invited email
+     * and whether the invited user still needs to set up their account.
+     *
+     * @param id - The invitation ID from the invite link
+     * @returns The invitation status with account-setup information
+     */
+    getInvitationSignupStatus(id: string): Promise<InvitationSignupStatus>;
+    /**
+     * Creates a password for an invited user who has no account yet.
+     *
+     * Only available once per invitation, while the invitation is pending and
+     * the invited user has never signed in. The user is signed in as part of
+     * the call; the session cookie is set on the response.
+     *
+     * @param id - The invitation ID from the invite link
+     * @param password - The password to create (minimum 8 characters)
+     * @returns The session token and signed-in user
+     */
+    setupInvitationPassword(id: string, password: string): Promise<InvitationPasswordSetupResult>;
     /**
      * Removes a user from the active organization.
      *
@@ -5671,6 +5729,8 @@ type SocialSignInOptions = {
     callbackURL: string;
     /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
     errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
 };
 /**
  * Options for signing in via SAML Single Sign-On.
@@ -5772,11 +5832,12 @@ declare class SessionService {
      * @param options.provider - The social provider
      * @param options.callbackURL - URL to redirect to after successful authentication
      * @param options.errorCallbackURL - URL to redirect to on error
+     * @param options.loginHint - Email to preselect at the provider
      *
      * @throws {InvalidSocialProvider} When the provider is not 'google' or 'microsoft'
      * @throws {InvalidCallbackURL} When callback URLs are malformed
      */
-    signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, }: SocialSignInOptions): Promise<void>;
+    signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
     /**
      * Initiates SAML-based Single Sign-On authentication flow.
      *
@@ -6275,4 +6336,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -1357,6 +1357,14 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 noncePayload: (nonce: string) => Promise<NoncePayloadResponse>;
             };
         };
+    } | {
+        id: "invitation-signup";
+        getActions: ($fetch: better_auth_client.BetterFetch) => {
+            invitationSignup: {
+                status: (invitationId: string) => Promise<InvitationSignupStatus>;
+                setupPassword: (invitationId: string, password: string) => Promise<InvitationPasswordSetupResult>;
+            };
+        };
     } | {
         id: "sso-client";
         version: string;
@@ -5368,6 +5376,33 @@ type CreateTeamPayload = Pick<Team, 'name'> & {
  */
 type UpdateTeamPayload = Pick<Team, 'name'>;
 
+/**
+ * Status of an invitation as seen by the pre-login invite flow.
+ *
+ * `email` and `requiresAccountSetup` are only present while the invitation is
+ * still pending; other statuses return the status alone.
+ */
+type InvitationSignupStatus = {
+    status: 'pending';
+    email: string;
+    /** True when the invited user has no account yet and has never signed in. */
+    requiresAccountSetup: boolean;
+} | {
+    status: 'accepted' | 'canceled' | 'rejected' | 'expired';
+};
+/**
+ * Result of creating a password from an invitation. The user is signed in
+ * as part of the call; the session cookie is set on the response.
+ */
+type InvitationPasswordSetupResult = {
+    token: string;
+    user: {
+        id: string;
+        email: string;
+        name: string;
+    };
+};
+
 /**
  * Service for managing organizations, members, invitations, and teams.
  *
@@ -5566,6 +5601,29 @@ declare class OrganizationService {
      *   and the configured post-acceptance URL for plain organization invitations.
      */
     acceptInvitation(id: string): Promise<AcceptInvitationResult>;
+    /**
+     * Gets the pre-login signup status for an invitation.
+     *
+     * Public endpoint keyed by the invitation id from the emailed invite link.
+     * While the invitation is pending, the result includes the invited email
+     * and whether the invited user still needs to set up their account.
+     *
+     * @param id - The invitation ID from the invite link
+     * @returns The invitation status with account-setup information
+     */
+    getInvitationSignupStatus(id: string): Promise<InvitationSignupStatus>;
+    /**
+     * Creates a password for an invited user who has no account yet.
+     *
+     * Only available once per invitation, while the invitation is pending and
+     * the invited user has never signed in. The user is signed in as part of
+     * the call; the session cookie is set on the response.
+     *
+     * @param id - The invitation ID from the invite link
+     * @param password - The password to create (minimum 8 characters)
+     * @returns The session token and signed-in user
+     */
+    setupInvitationPassword(id: string, password: string): Promise<InvitationPasswordSetupResult>;
     /**
      * Removes a user from the active organization.
      *
@@ -5671,6 +5729,8 @@ type SocialSignInOptions = {
     callbackURL: string;
     /** URL to redirect to if authentication fails. Falls back to the API's default error page if not provided. */
     errorCallbackURL?: string;
+    /** Email address to preselect at the provider, sent as the `login_hint` authorization parameter. */
+    loginHint?: string;
 };
 /**
  * Options for signing in via SAML Single Sign-On.
@@ -5772,11 +5832,12 @@ declare class SessionService {
      * @param options.provider - The social provider
      * @param options.callbackURL - URL to redirect to after successful authentication
      * @param options.errorCallbackURL - URL to redirect to on error
+     * @param options.loginHint - Email to preselect at the provider
      *
      * @throws {InvalidSocialProvider} When the provider is not 'google' or 'microsoft'
      * @throws {InvalidCallbackURL} When callback URLs are malformed
      */
-    signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, }: SocialSignInOptions): Promise<void>;
+    signInWithSocialProvider({ provider, callbackURL, errorCallbackURL, loginHint, }: SocialSignInOptions): Promise<void>;
     /**
      * Initiates SAML-based Single Sign-On authentication flow.
      *
@@ -6275,4 +6336,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSamlOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "1.39.3";
+const version = "1.40.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -389,6 +389,27 @@ function handshakePluginClient() {
   };
 }
 
+function invitationSignupPluginClient() {
+  return {
+    id: "invitation-signup",
+    getActions: ($fetch) => ({
+      invitationSignup: {
+        status: async (invitationId) => {
+          return await $fetch("/invitation/signup-status", {
+            query: { invitationId }
+          });
+        },
+        setupPassword: async (invitationId, password) => {
+          return await $fetch("/invitation/setup-password", {
+            method: "POST",
+            body: { invitationId, password }
+          });
+        }
+      }
+    })
+  };
+}
+
 function sessionAssurancePluginClient() {
   return {
     id: "session-assurance",
@@ -433,6 +454,7 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
       }),
       customEndpointsPluginClient(),
       handshakePluginClient(),
+      invitationSignupPluginClient(),
       ssoClient(),
       twoFactorClient(),
       jwtClient(),
@@ -1708,6 +1730,33 @@ class OrganizationService {
       member: response.member
     };
   }
+  /**
+   * Gets the pre-login signup status for an invitation.
+   *
+   * Public endpoint keyed by the invitation id from the emailed invite link.
+   * While the invitation is pending, the result includes the invited email
+   * and whether the invited user still needs to set up their account.
+   *
+   * @param id - The invitation ID from the invite link
+   * @returns The invitation status with account-setup information
+   */
+  async getInvitationSignupStatus(id) {
+    return await this.client.invitationSignup.status(id);
+  }
+  /**
+   * Creates a password for an invited user who has no account yet.
+   *
+   * Only available once per invitation, while the invitation is pending and
+   * the invited user has never signed in. The user is signed in as part of
+   * the call; the session cookie is set on the response.
+   *
+   * @param id - The invitation ID from the invite link
+   * @param password - The password to create (minimum 8 characters)
+   * @returns The session token and signed-in user
+   */
+  async setupInvitationPassword(id, password) {
+    return await this.client.invitationSignup.setupPassword(id, password);
+  }
   /**
    * Removes a user from the active organization.
    *
@@ -1874,6 +1923,7 @@ class SessionService {
    * @param options.provider - The social provider
    * @param options.callbackURL - URL to redirect to after successful authentication
    * @param options.errorCallbackURL - URL to redirect to on error
+   * @param options.loginHint - Email to preselect at the provider
    *
    * @throws {InvalidSocialProvider} When the provider is not 'google' or 'microsoft'
    * @throws {InvalidCallbackURL} When callback URLs are malformed
@@ -1881,7 +1931,8 @@ class SessionService {
   async signInWithSocialProvider({
     provider,
     callbackURL,
-    errorCallbackURL
+    errorCallbackURL,
+    loginHint
   }) {
     if (provider !== "google" && provider !== "microsoft") {
       throw new InvalidSocialProvider("Invalid social provider");
@@ -1896,7 +1947,8 @@ class SessionService {
     await this.client.signIn.social({
       provider,
       callbackURL,
-      errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`
+      errorCallbackURL: errorCallbackURL ?? `${this.apiUrl}/error?callbackURL=${appUrl}`,
+      ...loginHint && { loginHint }
     });
   }
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.39.3",
+  "version": "1.40.0",
   "type": "module",
   "exports": {
     ".": {