@meistrari/auth-core 2.9.0 → 3.0.0

package/dist/index.d.mts

@@ -621,10 +621,30 @@ type Application = {
     /** Additional configuration for this application. */
     config?: ApplicationConfig;
 };
+/**
+ * Fields that can be optionally included when listing candidate organizations.
+ */
+type ListCandidateOrganizationsInclude = 'lastUsed';
+/**
+ * Options accepted by the candidate organizations client method.
+ */
+type ListCandidateOrganizationsOptions = {
+    /**
+     * Fields to include on each returned organization. When omitted or empty,
+     * only the base organization fields are returned.
+     */
+    include?: ListCandidateOrganizationsInclude[];
+};
 /**
  * Response returned when listing candidate organizations for an application.
  */
-type ListCandidateOrganizationsResponse = FullOrganization[];
+type ListCandidateOrganizationsResponse = Array<FullOrganization & {
+    /**
+     * Whether this is the organization the user last signed in to the
+     * application with. Only present when `lastUsed` is included.
+     */
+    lastUsed?: boolean;
+}>;
 /**
  * Public application context used to preserve continuity during auth redirects.
  */
@@ -888,10 +908,14 @@ declare class ApplicationService {
      * entitlement is selected first; organization entitlements are considered only
      * when no global entitlement is enabled.
      *
+     * Pass `options.include` with `lastUsed` to flag the organization the user
+     * last signed in to the application with.
+     *
      * @param applicationId - The application ID to get candidate organizations for
+     * @param options - Optional include list controlling which fields are returned
      * @returns The list of candidate organizations
      */
-    listCandidateOrganizations(applicationId: string): Promise<ListCandidateOrganizationsResponse>;
+    listCandidateOrganizations(applicationId: string, options?: ListCandidateOrganizationsOptions): Promise<ListCandidateOrganizationsResponse>;
     /**
      * Starts an authorization flow for a specific application.
      *
@@ -1425,13 +1449,6 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 };
             };
         };
-    } | {
-        id: "handshake";
-        getActions: ($fetch: better_auth_client.BetterFetch) => {
-            handshake: {
-                noncePayload: (nonce: string) => Promise<NoncePayloadResponse>;
-            };
-        };
     } | {
         id: "invitation-signup";
         getActions: ($fetch: better_auth_client.BetterFetch) => {
@@ -3408,7 +3425,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: ApplicationAuthContextResponse;
                     error: null;
                 }>;
-                listCandidateOrganizations: (applicationId: string) => Promise<{
+                listCandidateOrganizations: (applicationId: string, options?: ListCandidateOrganizationsOptions) => Promise<{
                     data: ListCandidateOrganizationsResponse;
                     error?: unknown;
                 }>;
@@ -6092,13 +6109,6 @@ declare class SessionService {
      * @param password - The new password to set
      */
     resetPassword(token: string, password: string): Promise<void>;
-    /**
-     * Retrieves the JWT token for a nonce.
-     *
-     * @param nonce - The nonce to retrieve the token for
-     * @returns The JWT token for the nonce
-     */
-    getNoncePayload(nonce: string): Promise<NoncePayloadResponse>;
 }
 
 /**
@@ -6360,14 +6370,6 @@ type TeamMembersResponse = {
     teamMembers: TeamMember[];
 };
 
-/**
- * Response from exchanging a handshake nonce for a token.
- */
-type NoncePayloadResponse = {
-    /** The JWT issued for the session the nonce was minted against. */
-    token: string;
-};
-
 /**
  * Error thrown when an invalid social provider is specified.
  */
@@ -6550,4 +6552,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.d.ts

@@ -621,10 +621,30 @@ type Application = {
     /** Additional configuration for this application. */
     config?: ApplicationConfig;
 };
+/**
+ * Fields that can be optionally included when listing candidate organizations.
+ */
+type ListCandidateOrganizationsInclude = 'lastUsed';
+/**
+ * Options accepted by the candidate organizations client method.
+ */
+type ListCandidateOrganizationsOptions = {
+    /**
+     * Fields to include on each returned organization. When omitted or empty,
+     * only the base organization fields are returned.
+     */
+    include?: ListCandidateOrganizationsInclude[];
+};
 /**
  * Response returned when listing candidate organizations for an application.
  */
-type ListCandidateOrganizationsResponse = FullOrganization[];
+type ListCandidateOrganizationsResponse = Array<FullOrganization & {
+    /**
+     * Whether this is the organization the user last signed in to the
+     * application with. Only present when `lastUsed` is included.
+     */
+    lastUsed?: boolean;
+}>;
 /**
  * Public application context used to preserve continuity during auth redirects.
  */
@@ -888,10 +908,14 @@ declare class ApplicationService {
      * entitlement is selected first; organization entitlements are considered only
      * when no global entitlement is enabled.
      *
+     * Pass `options.include` with `lastUsed` to flag the organization the user
+     * last signed in to the application with.
+     *
      * @param applicationId - The application ID to get candidate organizations for
+     * @param options - Optional include list controlling which fields are returned
      * @returns The list of candidate organizations
      */
-    listCandidateOrganizations(applicationId: string): Promise<ListCandidateOrganizationsResponse>;
+    listCandidateOrganizations(applicationId: string, options?: ListCandidateOrganizationsOptions): Promise<ListCandidateOrganizationsResponse>;
     /**
      * Starts an authorization flow for a specific application.
      *
@@ -1425,13 +1449,6 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                 };
             };
         };
-    } | {
-        id: "handshake";
-        getActions: ($fetch: better_auth_client.BetterFetch) => {
-            handshake: {
-                noncePayload: (nonce: string) => Promise<NoncePayloadResponse>;
-            };
-        };
     } | {
         id: "invitation-signup";
         getActions: ($fetch: better_auth_client.BetterFetch) => {
@@ -3408,7 +3425,7 @@ declare function createAPIClient(apiUrl: string, fetchOptions?: BetterFetchOptio
                     data: ApplicationAuthContextResponse;
                     error: null;
                 }>;
-                listCandidateOrganizations: (applicationId: string) => Promise<{
+                listCandidateOrganizations: (applicationId: string, options?: ListCandidateOrganizationsOptions) => Promise<{
                     data: ListCandidateOrganizationsResponse;
                     error?: unknown;
                 }>;
@@ -6092,13 +6109,6 @@ declare class SessionService {
      * @param password - The new password to set
      */
     resetPassword(token: string, password: string): Promise<void>;
-    /**
-     * Retrieves the JWT token for a nonce.
-     *
-     * @param nonce - The nonce to retrieve the token for
-     * @returns The JWT token for the nonce
-     */
-    getNoncePayload(nonce: string): Promise<NoncePayloadResponse>;
 }
 
 /**
@@ -6360,14 +6370,6 @@ type TeamMembersResponse = {
     teamMembers: TeamMember[];
 };
 
-/**
- * Response from exchanging a handshake nonce for a token.
- */
-type NoncePayloadResponse = {
-    /** The JWT issued for the session the nonce was minted against. */
-    token: string;
-};
-
 /**
  * Error thrown when an invalid social provider is specified.
  */
@@ -6550,4 +6552,4 @@ declare function validateToken(token: string, apiUrl: string): Promise<boolean>;
 declare function extractTokenPayload(token: string): DecodedJWTPayload;
 
 export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, LOGIN_METHODS, OAuthBeginStepUpResponse, OAuthCompleteStepUpResponse, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SendOtpResponse, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceResponse, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, createAPIClient, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, normalizeAmr, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
-export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, NoncePayloadResponse, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };
+export type { APIClient, AcceptInvitationResult, AdminApplication, AdminApplicationEntitlement, AdminApplicationEntitlementRecord, AdminApplicationIdentity, AdminApplicationMember, AdminApplicationMemberOrganization, AdminApplicationMemberRecord, AdminApplicationOrganization, AdminApplicationRecord, AdminApplicationRole, AdminApplicationSecret, AdminEntitlementRule, AdminEntitlementRuleType, AdminEntitlementWithRules, AdminMember, AdminOrganization, AdminOrganizationApplication, AdminOrganizationMember, AdminOrganizationMemberApplication, AdminOrganizationMemberRecord, AdminOrganizationMemberTeam, AdminOrganizationSummary, AdminOrganizationTeam, AdminOrganizationTeamRecord, AdminUser, AdminUserAccess, AdminUserAccessApplication, AdminUserAccessOrganization, AdminUserAccessTeam, AdminUserInvitation, AdminUserOrganization, ApiKey, ApiKeyWithoutSecret, Application, ApplicationAuthContextResponse, ApplicationTokenStorageOptions, AssuranceFields, BaseOrganization, BeginOAuthStepUpParams, BillingMode, ClientCredentialsGrant, ClientCredentialsTokenResponse, CompleteAuthorizationFlowResponse, CreateAdminApplicationEntitlementOptions, CreateAdminApplicationOptions, CreateAdminApplicationRoleOptions, CreateAdminApplicationSecretOptions, CreateAdminOrganizationOptions, CreateAdminOrganizationTeamOptions, CreateApiKeyPayload, CreateTeamPayload, CreatedAdminApplicationSecret, DecodedJWTPayload, DeleteAdminOrganizationTeamOptions, DeviceAuthorizationActionResponse, DeviceAuthorizationContextResponse, DeviceAuthorizationResponse, DeviceContextApplication, EmailOTPSignInOptions, FullOrganization, GetAdminOrganizationOptions, GetAdminOrganizationsSummaryOptions, GetTokenOptions, Invitation, InvitationPasswordSetupResult, InvitationSignupStatus, InviteAdminOrganizationUsersOptions, InviteAdminOrganizationUsersResult, InviteUserToOrganizationOptions, JWTPayloadData, ListAdminApplicationMembersOptions, ListAdminApplicationMembersResult, ListAdminApplicationsOptions, ListAdminApplicationsResult, ListAdminOrganizationMembersOptions, ListAdminOrganizationMembersResult, ListAdminOrganizationTeamsOptions, ListAdminOrganizationTeamsResult, ListAdminOrganizationsOptions, ListAdminOrganizationsResult, ListAdminUsersOptions, ListAdminUsersResult, ListCandidateOrganizationsInclude, ListCandidateOrganizationsOptions, ListCandidateOrganizationsResponse, ListMembersOptions, ListOrganizationsOptions, ListOrganizationsWithRoleOptions, LoginMethod, LoginMethodsResponse, Member, ExtendedOrganization as Organization, OrganizationSettings, OrganizationWithRole, RemoveAdminMemberOptions, RemoveUserFromOrganizationOptions, ResendAdminInviteOptions, Role, SendVerificationOTPOptions, Session, SessionAssuranceActions, SessionData, SetAdminEntitlementRulesOptions, SetAdminUserApplicationRoleOptions, SetAdminUserPasswordOptions, SetAdminUserTeamOptions, SignInWithEmailAndPasswordOptions, SignInWithSsoOptions, SocialSignInOptions, StartAuthorizationFlowResponse, Strict, Team, TeamMember, TeamMembersResponse, UpdateAdminApplicationRoleOptions, UpdateAdminEntitlementOptions, UpdateAdminMemberRoleOptions, UpdateAdminOrganizationOptions, UpdateAdminOrganizationTeamOptions, UpdateApiKeyPayload, UpdateMemberRoleOptions, UpdateOrganizationPayload, UpdateTeamPayload, User, UserProfile, WhoAmIInclude, WhoAmIOptions, WhoAmIOrganization, WhoAmIResponse };

package/dist/index.mjs

@@ -21,7 +21,7 @@ function isTokenExpired(token, expiresInMs) {
   return nowInSeconds > expirationTime;
 }
 
-const version = "2.9.0";
+const version = "3.0.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -239,11 +239,13 @@ function applicationsPluginClient() {
               }
             });
           },
-          listCandidateOrganizations: async (applicationId) => {
+          listCandidateOrganizations: async (applicationId, options = {}) => {
+            const query = { applicationId };
+            if (options.include && options.include.length > 0) {
+              query.include = options.include.join(",");
+            }
             const response = await $fetch("/organization/list", {
-              query: {
-                applicationId
-              }
+              query
             });
             return normalizeOrganizationsResponse(response);
           },
@@ -387,21 +389,6 @@ function customEndpointsPluginClient() {
   };
 }
 
-function handshakePluginClient() {
-  return {
-    id: "handshake",
-    getActions: ($fetch) => ({
-      handshake: {
-        noncePayload: async (nonce) => {
-          return await $fetch("/handshake/nonce-payload", {
-            query: { nonce }
-          });
-        }
-      }
-    })
-  };
-}
-
 function invitationSignupPluginClient() {
   return {
     id: "invitation-signup",
@@ -481,7 +468,6 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
         schema: inferOrgAdditionalFields()
       }),
       customEndpointsPluginClient(),
-      handshakePluginClient(),
       invitationSignupPluginClient(),
       ssoClient(),
       twoFactorClient(),
@@ -1489,11 +1475,15 @@ class ApplicationService {
    * entitlement is selected first; organization entitlements are considered only
    * when no global entitlement is enabled.
    *
+   * Pass `options.include` with `lastUsed` to flag the organization the user
+   * last signed in to the application with.
+   *
    * @param applicationId - The application ID to get candidate organizations for
+   * @param options - Optional include list controlling which fields are returned
    * @returns The list of candidate organizations
    */
-  async listCandidateOrganizations(applicationId) {
-    const response = await this.client.applications.listCandidateOrganizations(applicationId);
+  async listCandidateOrganizations(applicationId, options = {}) {
+    const response = await this.client.applications.listCandidateOrganizations(applicationId, options);
     if (!response.data) {
       throw new Error("No data returned from the API", { cause: response.error });
     }
@@ -2177,15 +2167,6 @@ class SessionService {
       newPassword: password
     });
   }
-  /**
-   * Retrieves the JWT token for a nonce.
-   *
-   * @param nonce - The nonce to retrieve the token for
-   * @returns The JWT token for the nonce
-   */
-  async getNoncePayload(nonce) {
-    return await this.client.handshake.noncePayload(nonce);
-  }
 }
 
 class ApiKeyService {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/auth-core",
-    "version": "2.9.0",
+    "version": "3.0.0",
     "type": "module",
     "exports": {
         ".": {