@meistrari/auth-core 2.8.0 → 2.10.0

package/dist/index.d.mts

@@ -621,10 +621,30 @@ type Application = {
     /** Additional configuration for this application. */
     config?: ApplicationConfig;
 };
+/**
+ * Fields that can be optionally included when listing candidate organizations.
+ */
+type ListCandidateOrganizationsInclude = 'lastUsed';
+/**
+ * Options accepted by the candidate organizations client method.
+ */
+type ListCandidateOrganizationsOptions = {
+    /**
+     * Fields to include on each returned organization. When omitted or empty,
+     * only the base organization fields are returned.
+     */
+    include?: ListCandidateOrganizationsInclude[];
+};
 /**
  * Response returned when listing candidate organizations for an application.
  */
-type ListCandidateOrganizationsResponse = FullOrganization[];
+type ListCandidateOrganizationsResponse = Array<FullOrganization & {
+    /**
+     * Whether this is the organization the user last signed in to the
+     * application with. Only present when `lastUsed` is included.
+     */
+    lastUsed?: boolean;
+}>;
 /**
  * Public application context used to preserve continuity during auth redirects.
  */
@@ -888,10 +908,14 @@ declare class ApplicationService {
      * entitlement is selected first; organization entitlements are considered only
      * when no global entitlement is enabled.
      *
+     * Pass `options.include` with `lastUsed` to flag the organization the user
+     * last signed in to the application with.
+     *
      * @param applicationId - The application ID to get candidate organizations for
+     * @param options - Optional include list controlling which fields are returned
      * @returns The list of candidate organizations
      */
-    listCandidateOrganizations(applicationId: string): Promise<ListCandidateOrganizationsResponse>;
+    listCandidateOrganizations(applicationId: string, options?: ListCandidateOrganizationsOptions): Promise<ListCandidateOrganizationsResponse>;
     /**
      * Starts an authorization flow for a specific application.
      *
@@ -3408,7 +3432,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: ApplicationAuthContextResponse;
                     error: null;
                 }>;
-                listCandidateOrganizations: (applicationId: string) => Promise<{
+                listCandidateOrganizations: (applicationId: string, options?: ListCandidateOrganizationsOptions) => Promise<{
                     data: ListCandidateOrganizationsResponse;
                     error?: unknown;
                 }>;
@@ -5123,14 +5147,14 @@ declare class AdminService {
      * Requests an application management route.
      *
      * These routes are served by the API itself rather than by the Better Auth
-     * handler, so they sit outside the `/api/auth` base path that the Better
-     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
-     * authenticate with the session cookie alone; a bearer token must never be
-     * attached, since the API reads one only as an internal API key and would
-     * reject the request.
+     * handler, so they sit outside the `/api/auth` base path. The request is
+     * sent to an absolute URL resolved against the API root, which better-fetch
+     * uses as-is instead of prefixing the client's base URL, so it still goes
+     * through {@link APIClient.$fetch} and picks up every fetch option the
+     * client was created with (hooks, default headers, custom fetch, cookies).
      *
-     * @param path - Path relative to the API root, without a leading slash
-     * @param request - Method, body, and query parameters
+     * @param path - Path relative to the API root, without a leading slash; `:name` segments are filled from `request.params`
+     * @param request - Method, body, query, and path parameters
      * @returns The parsed JSON response
      */
     private requestApplicationRoute;
@@ -6550,4 +6574,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -621,10 +621,30 @@ type Application = {
     /** Additional configuration for this application. */
     config?: ApplicationConfig;
 };
+/**
+ * Fields that can be optionally included when listing candidate organizations.
+ */
+type ListCandidateOrganizationsInclude = 'lastUsed';
+/**
+ * Options accepted by the candidate organizations client method.
+ */
+type ListCandidateOrganizationsOptions = {
+    /**
+     * Fields to include on each returned organization. When omitted or empty,
+     * only the base organization fields are returned.
+     */
+    include?: ListCandidateOrganizationsInclude[];
+};
 /**
  * Response returned when listing candidate organizations for an application.
  */
-type ListCandidateOrganizationsResponse = FullOrganization[];
+type ListCandidateOrganizationsResponse = Array<FullOrganization & {
+    /**
+     * Whether this is the organization the user last signed in to the
+     * application with. Only present when `lastUsed` is included.
+     */
+    lastUsed?: boolean;
+}>;
 /**
  * Public application context used to preserve continuity during auth redirects.
  */
@@ -888,10 +908,14 @@ declare class ApplicationService {
      * entitlement is selected first; organization entitlements are considered only
      * when no global entitlement is enabled.
      *
+     * Pass `options.include` with `lastUsed` to flag the organization the user
+     * last signed in to the application with.
+     *
      * @param applicationId - The application ID to get candidate organizations for
+     * @param options - Optional include list controlling which fields are returned
      * @returns The list of candidate organizations
      */
-    listCandidateOrganizations(applicationId: string): Promise<ListCandidateOrganizationsResponse>;
+    listCandidateOrganizations(applicationId: string, options?: ListCandidateOrganizationsOptions): Promise<ListCandidateOrganizationsResponse>;
     /**
      * Starts an authorization flow for a specific application.
      *
@@ -3408,7 +3432,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: ApplicationAuthContextResponse;
                     error: null;
                 }>;
-                listCandidateOrganizations: (applicationId: string) => Promise<{
+                listCandidateOrganizations: (applicationId: string, options?: ListCandidateOrganizationsOptions) => Promise<{
                     data: ListCandidateOrganizationsResponse;
                     error?: unknown;
                 }>;
@@ -5123,14 +5147,14 @@ declare class AdminService {
      * Requests an application management route.
      *
      * These routes are served by the API itself rather than by the Better Auth
-     * handler, so they sit outside the `/api/auth` base path that the Better
-     * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
-     * authenticate with the session cookie alone; a bearer token must never be
-     * attached, since the API reads one only as an internal API key and would
-     * reject the request.
+     * handler, so they sit outside the `/api/auth` base path. The request is
+     * sent to an absolute URL resolved against the API root, which better-fetch
+     * uses as-is instead of prefixing the client's base URL, so it still goes
+     * through {@link APIClient.$fetch} and picks up every fetch option the
+     * client was created with (hooks, default headers, custom fetch, cookies).
      *
-     * @param path - Path relative to the API root, without a leading slash
-     * @param request - Method, body, and query parameters
+     * @param path - Path relative to the API root, without a leading slash; `:name` segments are filled from `request.params`
+     * @param request - Method, body, query, and path parameters
      * @returns The parsed JSON response
      */
     private requestApplicationRoute;
@@ -6550,4 +6574,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "2.8.0";
+const version = "2.10.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -239,11 +239,13 @@ function applicationsPluginClient() {
               }
             });
           },
-          listCandidateOrganizations: async (applicationId) => {
+          listCandidateOrganizations: async (applicationId, options = {}) => {
+            const query = { applicationId };
+            if (options.include && options.include.length > 0) {
+              query.include = options.include.join(",");
+            }
             const response = await $fetch("/organization/list", {
-              query: {
-                applicationId
-              }
+              query
             });
             return normalizeOrganizationsResponse(response);
           },
@@ -512,19 +514,12 @@ class ApplicationRouteError extends Error {
   code;
   details;
   status;
-  constructor(response, body) {
-    super(body?.error ?? body?.message ?? response.statusText);
+  constructor(body) {
+    super(body.error ?? body.message ?? body.statusText);
     this.name = "ApplicationRouteError";
-    this.status = response.status;
-    this.code = body?.code;
-    this.details = body?.details;
-  }
-}
-async function readErrorBody(response) {
-  try {
-    return await response.json();
-  } catch {
-    return null;
+    this.status = body.status;
+    this.code = body.code;
+    this.details = body.details;
   }
 }
 class AdminService {
@@ -545,35 +540,35 @@ class AdminService {
    * Requests an application management route.
    *
    * These routes are served by the API itself rather than by the Better Auth
-   * handler, so they sit outside the `/api/auth` base path that the Better
-   * Auth client prepends and cannot go through {@link APIClient.$fetch}. They
-   * authenticate with the session cookie alone; a bearer token must never be
-   * attached, since the API reads one only as an internal API key and would
-   * reject the request.
-   *
-   * @param path - Path relative to the API root, without a leading slash
-   * @param request - Method, body, and query parameters
+   * handler, so they sit outside the `/api/auth` base path. The request is
+   * sent to an absolute URL resolved against the API root, which better-fetch
+   * uses as-is instead of prefixing the client's base URL, so it still goes
+   * through {@link APIClient.$fetch} and picks up every fetch option the
+   * client was created with (hooks, default headers, custom fetch, cookies).
+   *
+   * @param path - Path relative to the API root, without a leading slash; `:name` segments are filled from `request.params`
+   * @param request - Method, body, query, and path parameters
    * @returns The parsed JSON response
    */
   async requestApplicationRoute(path, request = {}) {
     const base = this.apiUrl.endsWith("/") ? this.apiUrl : `${this.apiUrl}/`;
-    const url = new URL(path, base);
-    for (const [key, value] of Object.entries(request.query ?? {})) {
-      if (value !== void 0)
-        url.searchParams.set(key, String(value));
-    }
-    const headers = new Headers({ Accept: "application/json" });
-    if (request.body !== void 0)
-      headers.set("Content-Type", "application/json");
-    const response = await fetch(url, {
+    const hasBody = request.body !== void 0;
+    const { data, error } = await this.client.$fetch(`${base}${path}`, {
       method: request.method ?? "GET",
-      credentials: "include",
-      headers,
-      ...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {}
+      params: request.params,
+      query: request.query,
+      headers: {
+        Accept: "application/json",
+        ...hasBody ? { "Content-Type": "application/json" } : {}
+      },
+      ...hasBody ? { body: JSON.stringify(request.body) } : {},
+      // The client's parser revives ISO strings into Dates; these routes are typed with plain strings
+      jsonParser: (text) => JSON.parse(text),
+      throw: false
     });
-    if (!response.ok)
-      throw new ApplicationRouteError(response, await readErrorBody(response));
-    return await response.json();
+    if (error)
+      throw new ApplicationRouteError(error);
+    return data;
   }
   /**
    * Lists applications, optionally filtered by organization.
@@ -614,7 +609,8 @@ class AdminService {
    * @returns The updated application
    */
   async updateApplication(applicationId, options) {
-    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}`, {
+    return await this.requestApplicationRoute("applications/:applicationId", {
+      params: { applicationId },
       method: "PUT",
       body: options
     });
@@ -622,28 +618,29 @@ class AdminService {
   /** Lists the role catalog for an application. */
   async listApplicationRoles(applicationId) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/roles`
+      "applications/:applicationId/roles",
+      { params: { applicationId } }
     );
   }
   /** Creates an application-scoped role definition. */
   async createApplicationRole(applicationId, options) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/roles`,
-      { method: "POST", body: options }
+      "applications/:applicationId/roles",
+      { params: { applicationId }, method: "POST", body: options }
     );
   }
   /** Updates an application-scoped role definition. */
   async updateApplicationRole(applicationId, currentName, options) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/roles/${encodeURIComponent(currentName)}`,
-      { method: "PUT", body: options }
+      "applications/:applicationId/roles/:currentName",
+      { params: { applicationId, currentName }, method: "PUT", body: options }
     );
   }
   /** Deletes an application-scoped role definition. */
   async deleteApplicationRole(applicationId, name) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/roles/${encodeURIComponent(name)}`,
-      { method: "DELETE" }
+      "applications/:applicationId/roles/:name",
+      { params: { applicationId, name }, method: "DELETE" }
     );
   }
   /**
@@ -654,7 +651,8 @@ class AdminService {
    * @returns The created entitlement
    */
   async createApplicationEntitlement(applicationId, options) {
-    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/entitlements`, {
+    return await this.requestApplicationRoute("applications/:applicationId/entitlements", {
+      params: { applicationId },
       method: "POST",
       body: options
     });
@@ -666,7 +664,7 @@ class AdminService {
    * @returns Secret metadata without plaintext values
    */
   async listApplicationSecrets(applicationId) {
-    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/secrets`);
+    return await this.requestApplicationRoute("applications/:applicationId/secrets", { params: { applicationId } });
   }
   /**
    * Creates a client secret for an application.
@@ -676,7 +674,8 @@ class AdminService {
    * @returns The created secret, including the plaintext value shown only once
    */
   async createApplicationSecret(applicationId, options = {}) {
-    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/secrets`, {
+    return await this.requestApplicationRoute("applications/:applicationId/secrets", {
+      params: { applicationId },
       method: "POST",
       body: options
     });
@@ -690,8 +689,8 @@ class AdminService {
    */
   async deleteApplicationSecret(applicationId, secretId) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/secrets/${encodeURIComponent(secretId)}`,
-      { method: "DELETE" }
+      "applications/:applicationId/secrets/:secretId",
+      { params: { applicationId, secretId }, method: "DELETE" }
     );
   }
   /**
@@ -702,8 +701,8 @@ class AdminService {
    */
   async retireApplicationServiceAccount(applicationId) {
     return await this.requestApplicationRoute(
-      `applications/${encodeURIComponent(applicationId)}/service-account`,
-      { method: "DELETE" }
+      "applications/:applicationId/service-account",
+      { params: { applicationId }, method: "DELETE" }
     );
   }
   /**
@@ -958,7 +957,8 @@ class AdminService {
    */
   async getEntitlement(entitlementId) {
     return await this.requestApplicationRoute(
-      `applications/entitlements/${encodeURIComponent(entitlementId)}`
+      "applications/entitlements/:entitlementId",
+      { params: { entitlementId } }
     );
   }
   /**
@@ -970,8 +970,8 @@ class AdminService {
    */
   async setEntitlementRules(entitlementId, options) {
     return await this.requestApplicationRoute(
-      `applications/entitlements/${encodeURIComponent(entitlementId)}/rules`,
-      { method: "PUT", body: options }
+      "applications/entitlements/:entitlementId/rules",
+      { params: { entitlementId }, method: "PUT", body: options }
     );
   }
   /**
@@ -983,8 +983,8 @@ class AdminService {
    */
   async updateEntitlement(entitlementId, options) {
     return await this.requestApplicationRoute(
-      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
-      { method: "PUT", body: options }
+      "applications/entitlements/:entitlementId",
+      { params: { entitlementId }, method: "PUT", body: options }
     );
   }
   /**
@@ -995,8 +995,8 @@ class AdminService {
    */
   async deleteEntitlement(entitlementId) {
     return await this.requestApplicationRoute(
-      `applications/entitlements/${encodeURIComponent(entitlementId)}`,
-      { method: "DELETE" }
+      "applications/entitlements/:entitlementId",
+      { params: { entitlementId }, method: "DELETE" }
     );
   }
   /**
@@ -1491,11 +1491,15 @@ class ApplicationService {
    * entitlement is selected first; organization entitlements are considered only
    * when no global entitlement is enabled.
    *
+   * Pass `options.include` with `lastUsed` to flag the organization the user
+   * last signed in to the application with.
+   *
    * @param applicationId - The application ID to get candidate organizations for
+   * @param options - Optional include list controlling which fields are returned
    * @returns The list of candidate organizations
    */
-  async listCandidateOrganizations(applicationId) {
-    const response = await this.client.applications.listCandidateOrganizations(applicationId);
+  async listCandidateOrganizations(applicationId, options = {}) {
+    const response = await this.client.applications.listCandidateOrganizations(applicationId, options);
     if (!response.data) {
       throw new Error("No data returned from the API", { cause: response.error });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "2.8.0",
+    "version": "2.10.0",
     "type": "module",
     "exports": {
         ".": {