@finueva/auth 0.10.0 → 0.11.0

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, N as SocialIdTokenInput, O as PersonalWorkspaceSelection, P as SocialIdTokenProvider, R as WorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
+import { B as SocialIdTokenInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, G as WorkspaceSelection, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, O as PersonalWorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, _ as OrganizationInvitation, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types-BqpgLkQB.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;

package/dist/server.js

@@ -192,6 +192,9 @@ const messages = {
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
 	identity_authority_unavailable: "Authentication is temporarily unavailable."
 };
 var AuthError = class extends Error {

package/dist/{types-Byw9JQwL.d.ts → types-BqpgLkQB.d.ts}

@@ -1,6 +1,6 @@
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "identity_authority_unavailable";
-type AuthErrorStatus = 400 | 401 | 403 | 409 | 422 | 429 | 503;
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
+type AuthErrorStatus = 400 | 401 | 403 | 404 | 409 | 413 | 415 | 422 | 429 | 503;
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
   readonly status: AuthErrorStatus;
@@ -193,6 +193,38 @@ interface DriveCredentialInput {
   workspace: WorkspaceSelection;
   forceRefresh?: boolean;
 }
+type PlatformRole = "administrator" | "investigator";
+interface PlatformRoleChangeRecentAuthenticationInput {
+  targetUserId: string;
+  requestedRoles: PlatformRole[];
+  expectedTargetRevision: number;
+  expectedGlobalRevision: number;
+  reasonCategory: "initial_bootstrap" | "personnel_change" | "privilege_review" | "quorum_recovery" | "security_response";
+  changeReference: string;
+  idempotencyKey: string;
+}
+interface PlatformBootstrapRoleChangeInput extends Omit<PlatformRoleChangeRecentAuthenticationInput, "reasonCategory" | "requestedRoles"> {
+  requestedRoles: ["administrator"] | ["administrator", "investigator"] | ["investigator", "administrator"];
+  reasonCategory: "initial_bootstrap";
+}
+interface PlatformRoleFirstApproval {
+  status: "awaiting_second_approval";
+  targetUserId: string;
+  targetRevision: number;
+  globalRevision: number;
+  roles: [];
+}
+interface PlatformRoleApplied {
+  status: "applied";
+  targetUserId: string;
+  targetRevision: number;
+  globalRevision: number;
+  roles: PlatformRole[];
+}
+type PlatformRoleApproval = PlatformRoleFirstApproval | PlatformRoleApplied;
+interface RecentAuthenticationStatus {
+  status: "pending" | "ready";
+}
 interface AuthClientOptions {
   authOrigin: string;
   appOrigin: string;
@@ -203,6 +235,11 @@ interface AuthClientOptions {
 }
 interface FinuevaAuthClient {
   readonly _type: "browser";
+  startPlatformRoleChangeRecentAuthentication(input: PlatformRoleChangeRecentAuthenticationInput): Promise<RecentAuthenticationStatus>;
+  approveBootstrapPlatformRoleChange(input: PlatformBootstrapRoleChangeInput): Promise<PlatformRoleApproval>;
+  addPasskey(): Promise<void>;
+  verifyRecentAuthenticationWithPasskey(): Promise<void>;
+  getRecentAuthenticationStatus(): Promise<RecentAuthenticationStatus>;
   acceptInvitation(input: AcceptInvitationInput): Promise<InvitationAcceptance>;
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
@@ -232,4 +269,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { ReceivedOrganizationInvitationPage as A, AuthErrorCode as B, OrganizationTeam as C, OrganizationWorkspaceSelection as D, OrganizationTeamPage as E, UpdateOrganizationDisplayInput as F, UpdateOrganizationTeamDisplayInput as I, UpdateProfileInput as L, SignInInput as M, SocialIdTokenInput as N, PersonalWorkspaceSelection as O, SocialIdTokenProvider as P, WorkspaceSelection as R, OrganizationPageInput as S, OrganizationTeamMemberPage as T, AuthErrorStatus as V, OrganizationInvitation as _, AuthPersistenceDriver as a, OrganizationMemberPage as b, AuthUser as c, CreatedOrganizationTeam as d, DriveCredential as f, OrganizationDisplay as g, InvitationAcceptance as h, AuthPersistence as i, SendVerificationEmailInput as j, ReceivedOrganizationInvitation as k, CreateOrganizationMemberInvitationInput as l, FinuevaAuthClient as m, AuthClientOptions as n, AuthSession as o, DriveCredentialInput as p, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreatedOrganizationMemberInvitation as u, OrganizationInvitationPage as v, OrganizationTeamDisplay as w, OrganizationPage as x, OrganizationMember as y, AuthError as z };
+export { PlatformRole as A, SocialIdTokenInput as B, OrganizationTeam as C, OrganizationWorkspaceSelection as D, OrganizationTeamPage as E, ReceivedOrganizationInvitation as F, WorkspaceSelection as G, UpdateOrganizationDisplayInput as H, ReceivedOrganizationInvitationPage as I, AuthErrorStatus as J, AuthError as K, RecentAuthenticationStatus as L, PlatformRoleApproval as M, PlatformRoleChangeRecentAuthenticationInput as N, PersonalWorkspaceSelection as O, PlatformRoleFirstApproval as P, SendVerificationEmailInput as R, OrganizationPageInput as S, OrganizationTeamMemberPage as T, UpdateOrganizationTeamDisplayInput as U, SocialIdTokenProvider as V, UpdateProfileInput as W, OrganizationInvitation as _, AuthPersistenceDriver as a, OrganizationMemberPage as b, AuthUser as c, CreatedOrganizationTeam as d, DriveCredential as f, OrganizationDisplay as g, InvitationAcceptance as h, AuthPersistence as i, PlatformRoleApplied as j, PlatformBootstrapRoleChangeInput as k, CreateOrganizationMemberInvitationInput as l, FinuevaAuthClient as m, AuthClientOptions as n, AuthSession as o, DriveCredentialInput as p, AuthErrorCode as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreatedOrganizationMemberInvitation as u, OrganizationInvitationPage as v, OrganizationTeamDisplay as w, OrganizationPage as x, OrganizationMember as y, SignInInput as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,
@@ -49,7 +49,9 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@chiballc/utils": "2.5.0",
+    "@better-auth/core": "1.6.22",
+    "@better-auth/passkey": "1.6.22",
+    "@chiballc/utils": "2.5.1",
     "@types/node": "24.13.3",
     "@typescript/native": "npm:typescript@7.0.2",
     "@vitest/coverage-v8": "4.1.10",