Resolved merge conflicts

Author: rmad17

.github/workflows/codeql.yml

@@ -36,7 +36,7 @@ jobs:
         run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/publish.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -61,7 +61,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           fetch-tags: true

.github/workflows/test.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6
@@ -43,7 +43,7 @@ jobs:
 
     - name: Load cached venv
       id: cached-poetry-dependencies
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ./.venv
         key: venv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('**/poetry.lock') }}

.version

@@ -1 +1 @@
-1.0.0b10
+1.0.0b11

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Change Log
 
+## [1.0.0b11](https://github.com/auth0/auth0-server-python/tree/1.0.0b11) (2026-06-25)
+[Full Changelog](https://github.com/auth0/auth0-server-python/compare/1.0.0b10...1.0.0b11)
+
+**Added**
+- feat: Organisations support [\#114](https://github.com/auth0/auth0-server-python/pull/114) ([rmad17](https://github.com/rmad17))
+- feat: validate CTE actor token pairing and surface act claim for delegation/impersonation [\#122](https://github.com/auth0/auth0-server-python/pull/122) ([kishore7snehil](https://github.com/kishore7snehil))
+
 ## [1.0.0b10](https://github.com/auth0/auth0-server-python/tree/1.0.0b10) (2026-04-24)
 [Full Changelog](https://github.com/auth0/auth0-server-python/compare/1.0.0b9...1.0.0b10)
 

examples/CustomTokenExchange.md

@@ -64,7 +64,7 @@ print(f"User logged in: {user['sub']}")
 
 ## 3. Actor Tokens (Delegation)
 
-Enable delegation scenarios where one service acts on behalf of a user.
+Enable delegation scenarios where one party acts on behalf of a user. The acting party is supplied via `actor_token`, and Auth0 records it in the [`act` claim](https://datatracker.ietf.org/doc/html/rfc8693#section-4.1) on the issued tokens.
 
 ```python
 # Service acting on behalf of a user
@@ -77,8 +77,34 @@ response = await auth0.custom_token_exchange(
         audience="https://api.example.com"
     )
 )
+
+# The actor claim is surfaced on the response. It may nest for delegation chains.
+if response.act:
+    print(f"Acting party: {response.act['sub']}")
+```
+
+> **NOTE**: `response.act` is read from the ID token. Auth0 writes the same `act` claim onto the issued access token as well, so they reflect the same acting party. The access token may be opaque, in which case `act` cannot be read off it directly - the ID token is where you read it.
+
+When you establish a session with `login_with_custom_token_exchange()`, the `act` claim is persisted on the session user and can be read back later via `get_user()`:
+
+```python
+result = await auth0.login_with_custom_token_exchange(
+    LoginWithCustomTokenExchangeOptions(
+        subject_token="user-access-token",
+        subject_token_type="urn:ietf:params:oauth:token-type:access_token",
+        actor_token="service-access-token",
+        actor_token_type="urn:ietf:params:oauth:token-type:access_token",
+    ),
+    store_options={"request": request, "response": response}
+)
+
+user = result.state_data["user"]
+if user.get("act"):
+    print(f"Acting party: {user['act']['sub']}")
 ```
 
+> **NOTE**: When an `actor_token` is present, Auth0 does not issue a refresh token (the `offline_access` scope is dropped). A subsequent refresh-token grant therefore cannot re-emit the `act` claim, so the acting party is fixed at exchange time.
+
 ## 4. Custom Authorization Parameters
 
 Pass additional parameters to the token endpoint.
@@ -133,6 +159,7 @@ except CustomTokenExchangeError as e:
 
 - `INVALID_TOKEN_FORMAT`: Token is empty, whitespace-only, or has "Bearer " prefix
 - `MISSING_ACTOR_TOKEN_TYPE`: `actor_token` provided without `actor_token_type`
+- `MISSING_ACTOR_TOKEN`: `actor_token_type` provided without `actor_token`
 - `TOKEN_EXCHANGE_FAILED`: General token exchange failure
 - `INVALID_RESPONSE`: Auth0 returned a non-JSON response