@finueva/auth 0.11.0 → 0.11.1

package/README.md

@@ -2,9 +2,9 @@
 
 Use `@finueva/auth` to add Finueva sign-in, organization access, invitations, and Drive credentials to a browser, server, CLI, or native application.
 
-The current published version is `0.10.1`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
+The current published version is `0.11.0`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
 
-The passkey and recent-authentication methods below describe this repository's next package candidate. Published version `0.10.1` does not include them.
+The platform-status and organization-authority methods below describe this repository's next package candidate. Published version `0.11.0` does not include them.
 
 ## Install
 
@@ -92,7 +92,9 @@ The browser owns the session cookie. The SDK does not expose or persist it.
 | Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
 | Accept an invitation          | `acceptInvitation()`                        | `acceptInvitation()`                   | Not available                          |
 | Enroll a passkey              | `addPasskey()`                              | Not available                          | Not available                          |
-| Perform recent authentication | Three `*RecentAuthentication*()` methods    | Not available                          | Not available                          |
+| Perform recent authentication | Platform and organization action methods    | Not available                          | Not available                          |
+| Change manual roles or owners | Organization authority methods              | Not available                          | Not available                          |
+| Read current platform roles   | `getPlatformStatus()`                       | Not available                          | Not available                          |
 | Request Drive access          | `getDriveCredential()`                      | `getDriveCredential()`                 | `getDriveCredential()`                 |
 | End the current session       | `signOut()`                                 | `signOut()`                            | `revokeCurrentDevice()`                |
 
@@ -129,7 +131,11 @@ Start one reviewed platform-role action before invoking passkey authentication:
 await auth.startPlatformRoleChangeRecentAuthentication({
   targetUserId: "user_01J8R7M6N5P4Q3S2T1",
   requestedRoles: ["administrator", "investigator"],
-  expectedRevision: 4,
+  expectedTargetRevision: 0,
+  expectedGlobalRevision: 0,
+  reasonCategory: "initial_bootstrap",
+  changeReference: "change_01J8R7M6N5P4Q3S2T1",
+  idempotencyKey: crypto.randomUUID(),
 });
 
 await auth.verifyRecentAuthenticationWithPasskey();
@@ -140,10 +146,35 @@ if (continuation.status === "ready") {
 }
 ```
 
-The maintained passkey client performs the WebAuthn ceremony for the pending action when a compatible authenticator is present. Auth binds the exact generated challenge to that action. The SDK returns only `pending` or `ready`. It does not expose the challenge, WebAuthn response, session, cookies, proof, or hashes. `ready` does not grant a platform role or reusable administration mode. The tracer has no proof-consumption API. A future exact mutation must add atomic one-use consumption with its state change. No platform mutation is currently implemented.
+The maintained passkey client performs the WebAuthn ceremony for the pending action when a compatible authenticator is present. Auth binds the exact generated challenge to that action. The SDK returns only `pending` or `ready`. It does not expose the challenge, WebAuthn response, session, cookies, proof, or hashes. `ready` does not grant a platform role or reusable administration mode. Bootstrap approval consumes the proof atomically with its state transition.
+
+Organization owner changes use the same ceremony. Pass the same input to the start and submit methods:
+
+```ts
+const change = {
+  requestedManualRole: "owner" as const,
+  expectedActorAuthorityRevision: 3,
+  expectedTargetAuthorityRevision: 1,
+  idempotencyKey: crypto.randomUUID(),
+};
+
+await auth.startOrganizationOwnerRoleChangeRecentAuthentication(organizationId, memberId, change);
+await auth.verifyRecentAuthenticationWithPasskey();
+await auth.changeOrganizationMemberManualRole(organizationId, memberId, change);
+```
+
+Atomic transfer similarly pairs `startOrganizationOwnershipTransferRecentAuthentication()` with `transferOrganizationOwnership()`. The input names distinct outgoing-owner and successor memberships, the outgoing owner's resulting `member` or `admin` role, all exact authority revisions, and one idempotency key. The SDK validates and sends one normalized request and never exposes the consumed proof.
 
 If a start result is unavailable, call `startPlatformRoleChangeRecentAuthentication()` again with the same normalized input. The client reuses the current request nonce. A different start or observed account transition removes this local retry state. Only one start request can be active. An overlapping call returns `state_conflict` before network I/O. The SDK does not retry automatically.
 
+Read the signed-in User's current effective platform roles on the exact Auth Origin:
+
+```ts
+const platform = await auth.getPlatformStatus();
+```
+
+The result contains `eligible`, `roles`, and `globalRevision`. Use it for display and mutation preparation only. Each platform operation checks current authority again. The browser SDK sends Auth-origin cookie credentials and an exact browser-generated `Origin`. It sends no `Authorization` header. Server and device clients do not expose this method.
+
 ## Request A Drive Credential
 
 Request one short-lived credential for one workspace:

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { B as SocialIdTokenInput, C as OrganizationTeam, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, W as UpdateProfileInput, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types-BqpgLkQB.js";
+import { C as OrganizationTeam, E as OrganizationTeamPage, G as UpdateProfileInput, H as SocialIdTokenProvider, I as ReceivedOrganizationInvitation, J as AuthErrorCode, L as ReceivedOrganizationInvitationPage, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationDisplayInput, V as SocialIdTokenInput, W as UpdateOrganizationTeamDisplayInput, Y as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthError, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types--G_Gwf2r.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as PlatformRole, B as SocialIdTokenInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, G as WorkspaceSelection, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, L as RecentAuthenticationStatus, M as PlatformRoleApproval, N as PlatformRoleChangeRecentAuthenticationInput, O as PersonalWorkspaceSelection, P as PlatformRoleFirstApproval, R as SendVerificationEmailInput, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, W as UpdateProfileInput, _ as OrganizationInvitation, a as AuthPersistenceDriver, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, i as AuthPersistence, j as PlatformRoleApplied, k as PlatformBootstrapRoleChangeInput, l as CreateOrganizationMemberInvitationInput, m as FinuevaAuthClient, n as AuthClientOptions, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as SignInInput } from "./types-BqpgLkQB.js";
+import { A as PlatformRole, B as SignInInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as PlatformStatus, G as UpdateProfileInput, H as SocialIdTokenProvider, I as ReceivedOrganizationInvitation, J as AuthErrorCode, K as WorkspaceSelection, L as ReceivedOrganizationInvitationPage, M as PlatformRoleApproval, N as PlatformRoleChangeRecentAuthenticationInput, O as PersonalWorkspaceSelection, P as PlatformRoleFirstApproval, R as RecentAuthenticationStatus, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationDisplayInput, V as SocialIdTokenInput, W as UpdateOrganizationTeamDisplayInput, Y as AuthErrorStatus, _ as OrganizationInvitation, a as AuthPersistenceDriver, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, i as AuthPersistence, j as PlatformRoleApplied, k as PlatformBootstrapRoleChangeInput, l as CreateOrganizationMemberInvitationInput, m as FinuevaAuthClient, n as AuthClientOptions, o as AuthSession, p as DriveCredentialInput, q as AuthError, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as SendVerificationEmailInput } from "./types--G_Gwf2r.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -3322,6 +3322,88 @@ function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
 		idempotencyKey: value.idempotencyKey
 	};
 }
+function normalizeOrganizationManualRoleChangeInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "expectedActorAuthorityRevision,expectedTargetAuthorityRevision,idempotencyKey,requestedManualRole") throw new TypeError("organization manual role input is invalid");
+	if (value.requestedManualRole !== "owner" && value.requestedManualRole !== "admin" && value.requestedManualRole !== "member") throw new TypeError("requestedManualRole is invalid");
+	const expectedActorAuthorityRevision = normalizeAuthorityRevision(value.expectedActorAuthorityRevision, "expectedActorAuthorityRevision");
+	const expectedTargetAuthorityRevision = normalizeAuthorityRevision(value.expectedTargetAuthorityRevision, "expectedTargetAuthorityRevision", true);
+	return {
+		requestedManualRole: value.requestedManualRole,
+		expectedActorAuthorityRevision,
+		expectedTargetAuthorityRevision,
+		idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey)
+	};
+}
+function normalizeOrganizationOwnershipTransferInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "expectedActorAuthorityRevision,expectedOutgoingOwnerAuthorityRevision,expectedSuccessorAuthorityRevision,idempotencyKey,outgoingOwnerMembershipId,outgoingOwnerRole,successorMembershipId") throw new TypeError("organization ownership transfer input is invalid");
+	if (!isId(value.outgoingOwnerMembershipId) || !isId(value.successorMembershipId)) throw new TypeError("ownership transfer membership is invalid");
+	if (value.outgoingOwnerMembershipId === value.successorMembershipId) throw new TypeError("ownership transfer memberships must differ");
+	if (value.outgoingOwnerRole !== "admin" && value.outgoingOwnerRole !== "member") throw new TypeError("outgoingOwnerRole is invalid");
+	return {
+		outgoingOwnerMembershipId: value.outgoingOwnerMembershipId,
+		successorMembershipId: value.successorMembershipId,
+		outgoingOwnerRole: value.outgoingOwnerRole,
+		expectedActorAuthorityRevision: normalizeAuthorityRevision(value.expectedActorAuthorityRevision, "expectedActorAuthorityRevision"),
+		expectedOutgoingOwnerAuthorityRevision: normalizeAuthorityRevision(value.expectedOutgoingOwnerAuthorityRevision, "expectedOutgoingOwnerAuthorityRevision", true),
+		expectedSuccessorAuthorityRevision: normalizeAuthorityRevision(value.expectedSuccessorAuthorityRevision, "expectedSuccessorAuthorityRevision", true),
+		idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey)
+	};
+}
+function normalizeOrganizationManualRoleChangeResult(value) {
+	exact(value, [
+		"status",
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision"
+	]);
+	if (value.status !== "applied") throw authorityUnavailable();
+	return {
+		status: "applied",
+		...normalizeOrganizationAuthorityMemberOutcome(value, true)
+	};
+}
+function normalizeOrganizationOwnershipTransferResult(value) {
+	exact(value, [
+		"status",
+		"outgoingOwner",
+		"successor"
+	]);
+	if (value.status !== "applied") throw authorityUnavailable();
+	return {
+		status: "applied",
+		outgoingOwner: normalizeOrganizationAuthorityMemberOutcome(value.outgoingOwner),
+		successor: normalizeOrganizationAuthorityMemberOutcome(value.successor)
+	};
+}
+function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
+	exact(value, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision",
+		...includesStatus ? ["status"] : []
+	]);
+	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
+	return {
+		memberId: value.memberId,
+		manualRole: value.manualRole,
+		role: value.role,
+		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
+	};
+}
+function normalizeAuthorityRevision(value, name, incremented = false) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER - (incremented ? 1 : 0)) throw new TypeError(`${name} is invalid`);
+	return value;
+}
+function normalizeAuthorityResultRevision(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	return value;
+}
+function normalizeAuthorityIdempotencyKey(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value)) throw new TypeError("idempotencyKey is invalid");
+	return value;
+}
 function normalizePlatformBootstrapRoleChangeInput(value) {
 	const request = normalizePlatformRoleChangeRecentAuthenticationInput(value);
 	if (request.reasonCategory !== "initial_bootstrap" || !request.requestedRoles.includes("administrator")) throw new TypeError("platform first approval input is invalid");
@@ -3354,6 +3436,21 @@ function normalizePlatformRoleApproval(value) {
 		roles: []
 	};
 }
+function normalizePlatformStatus(value) {
+	exact(value, [
+		"eligible",
+		"globalRevision",
+		"roles"
+	]);
+	if (typeof value.eligible !== "boolean") throw authorityUnavailable();
+	if (!Number.isSafeInteger(value.globalRevision) || value.globalRevision < 0 || value.globalRevision >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	if (!Array.isArray(value.roles) || !(value.roles.length === 0 || value.roles.length === 1 && (value.roles[0] === "administrator" || value.roles[0] === "investigator") || value.roles.length === 2 && value.roles[0] === "administrator" && value.roles[1] === "investigator") || !value.eligible && value.roles.length !== 0) throw authorityUnavailable();
+	return {
+		eligible: value.eligible,
+		globalRevision: value.globalRevision,
+		roles: value.roles
+	};
+}
 function normalizeRecentAuthenticationStatus(value) {
 	exact(value, ["status"]);
 	if (value.status !== "pending" && value.status !== "ready") throw authorityUnavailable();
@@ -4354,6 +4451,9 @@ function createAuthClient(options) {
 	let selectedWorkspaceKey;
 	let credentialGeneration = 0;
 	let authorityGeneration = 0;
+	let platformStatusReadEpoch = 0;
+	let sessionAuthorityEpoch = 0;
+	let sessionAuthorityObserved = false;
 	let recentAuthenticationBrowserToken;
 	let recentAuthenticationStartAttempt;
 	let recentAuthenticationStartRequest;
@@ -4479,9 +4579,11 @@ function createAuthClient(options) {
 	}
 	function updateSession(session) {
 		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0);
-		const changedSession = !session || sessionId !== void 0 && (session.id !== sessionId || session.user.id !== sessionUserId);
+		const changedSession = sessionId === void 0 ? !sessionAuthorityObserved || session !== null : !session || session.id !== sessionId || session.user.id !== sessionUserId;
 		if (!session || unboundCredential || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
 		if (changedSession || recentAuthenticationStartAttempt && (recentAuthenticationStartAttempt.sessionId !== session?.id || recentAuthenticationStartAttempt.userId !== session?.user.id)) recentAuthenticationStartAttempt = void 0;
+		if (changedSession) sessionAuthorityEpoch += 1;
+		sessionAuthorityObserved = true;
 		sessionId = session?.id;
 		sessionUserId = session?.user.id;
 		return session;
@@ -4631,52 +4733,89 @@ function createAuthClient(options) {
 	function assertRecentAuthenticationOrigin() {
 		if (appOrigin !== authOrigin) throw new TypeError("recent authentication requires the exact Auth Origin");
 	}
+	function assertPlatformAdministrationOrigin() {
+		if (appOrigin !== authOrigin) throw new TypeError("platform administration requires the exact Auth Origin");
+	}
+	async function startRecentAuthentication(body) {
+		assertRecentAuthenticationOrigin();
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+		if (recentAuthenticationStartRequest) throw new AuthError("state_conflict", 409);
+		const generation = authorityGeneration;
+		recentAuthenticationBrowserToken ??= createOpaqueToken();
+		const normalizedInput = JSON.stringify(body);
+		const attempt = recentAuthenticationStartAttempt?.input === normalizedInput ? recentAuthenticationStartAttempt : {
+			input: normalizedInput,
+			requestToken: createOpaqueToken(),
+			sessionId,
+			userId: sessionUserId
+		};
+		recentAuthenticationStartAttempt = attempt;
+		const request = (async () => {
+			try {
+				const value = await requestJson(joinURL(authOrigin, "api/v1/auth/recent-authentication"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "POST",
+					headers: {
+						"content-type": "application/json",
+						[RECENT_AUTHENTICATION_BROWSER_HEADER]: recentAuthenticationBrowserToken,
+						[RECENT_AUTHENTICATION_REQUEST_HEADER]: attempt.requestToken
+					},
+					body,
+					mapError: fromRecentAuthenticationError
+				});
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				const status = normalizeRecentAuthenticationStatus(value);
+				if (recentAuthenticationStartAttempt === attempt) recentAuthenticationStartAttempt = void 0;
+				return status;
+			} catch (error) {
+				if (recentAuthenticationStartAttempt === attempt && (!(error instanceof AuthError) || error.code !== "identity_authority_unavailable")) recentAuthenticationStartAttempt = void 0;
+				throw error;
+			}
+		})();
+		recentAuthenticationStartRequest = request;
+		try {
+			return await request;
+		} finally {
+			if (recentAuthenticationStartRequest === request) recentAuthenticationStartRequest = void 0;
+		}
+	}
 	return {
 		_type: "browser",
-		async startPlatformRoleChangeRecentAuthentication(input) {
-			assertRecentAuthenticationOrigin();
-			const body = normalizePlatformRoleChangeRecentAuthenticationInput(input);
+		async getPlatformStatus() {
+			assertPlatformAdministrationOrigin();
 			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
-			if (recentAuthenticationStartRequest) throw new AuthError("state_conflict", 409);
 			const generation = authorityGeneration;
-			recentAuthenticationBrowserToken ??= createOpaqueToken();
-			const normalizedInput = JSON.stringify(body);
-			const attempt = recentAuthenticationStartAttempt?.input === normalizedInput ? recentAuthenticationStartAttempt : {
-				input: normalizedInput,
-				requestToken: createOpaqueToken(),
-				sessionId,
-				userId: sessionUserId
-			};
-			recentAuthenticationStartAttempt = attempt;
-			const request = (async () => {
-				try {
-					const value = await requestJson(joinURL(authOrigin, "api/v1/auth/recent-authentication"), {
-						fetch: fetchImpl,
-						timeoutMs,
-						method: "POST",
-						headers: {
-							"content-type": "application/json",
-							[RECENT_AUTHENTICATION_BROWSER_HEADER]: recentAuthenticationBrowserToken,
-							[RECENT_AUTHENTICATION_REQUEST_HEADER]: attempt.requestToken
-						},
-						body,
-						mapError: fromRecentAuthenticationError
-					});
-					if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
-					const status = normalizeRecentAuthenticationStatus(value);
-					if (recentAuthenticationStartAttempt === attempt) recentAuthenticationStartAttempt = void 0;
-					return status;
-				} catch (error) {
-					if (recentAuthenticationStartAttempt === attempt && (!(error instanceof AuthError) || error.code !== "identity_authority_unavailable")) recentAuthenticationStartAttempt = void 0;
-					throw error;
-				}
-			})();
-			recentAuthenticationStartRequest = request;
-			try {
-				return await request;
-			} finally {
-				if (recentAuthenticationStartRequest === request) recentAuthenticationStartRequest = void 0;
-			}
+			const readEpoch = ++platformStatusReadEpoch;
+			const sessionEpoch = sessionAuthorityEpoch;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/platform/status"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: {},
+				mapError: fromPlatformAdministrationError
+			});
+			if (generation !== authorityGeneration || readEpoch !== platformStatusReadEpoch || sessionEpoch !== sessionAuthorityEpoch) throw new AuthError("state_conflict", 409);
+			return normalizePlatformStatus(value);
+		},
+		async startPlatformRoleChangeRecentAuthentication(input) {
+			return startRecentAuthentication(normalizePlatformRoleChangeRecentAuthenticationInput(input));
+		},
+		async startOrganizationOwnerRoleChangeRecentAuthentication(organizationId, targetMembershipId, input) {
+			return startRecentAuthentication({
+				action: "organization_owner_role_change",
+				organizationId: normalizeIdInput(organizationId),
+				targetMembershipId: normalizeIdInput(targetMembershipId),
+				...normalizeOrganizationManualRoleChangeInput(input)
+			});
+		},
+		async startOrganizationOwnershipTransferRecentAuthentication(organizationId, input) {
+			return startRecentAuthentication({
+				action: "organization_ownership_transfer",
+				organizationId: normalizeIdInput(organizationId),
+				...normalizeOrganizationOwnershipTransferInput(input)
+			});
 		},
 		async approveBootstrapPlatformRoleChange(input) {
 			assertRecentAuthenticationOrigin();
@@ -4837,6 +4976,39 @@ function createAuthClient(options) {
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			return normalizeOrganizationTeamDisplay(value);
 		},
+		async changeOrganizationMemberManualRole(organizationId, targetMembershipId, input) {
+			const organization = normalizeIdInput(organizationId);
+			const target = normalizeIdInput(targetMembershipId);
+			const body = normalizeOrganizationManualRoleChangeInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "members", target, "manual-role"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeOrganizationManualRoleChangeResult(value);
+		},
+		async transferOrganizationOwnership(organizationId, input) {
+			const organization = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationOwnershipTransferInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "ownership-transfer"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeOrganizationOwnershipTransferResult(value);
+		},
 		async listOrganizationMembers(organizationId, input) {
 			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers);
 		},

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { B as SocialIdTokenInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, G as WorkspaceSelection, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, O as PersonalWorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, _ as OrganizationInvitation, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types-BqpgLkQB.js";
+import { C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, H as SocialIdTokenProvider, I as ReceivedOrganizationInvitation, J as AuthErrorCode, K as WorkspaceSelection, L as ReceivedOrganizationInvitationPage, O as PersonalWorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationDisplayInput, V as SocialIdTokenInput, W as UpdateOrganizationTeamDisplayInput, Y as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthError, r as AuthOrganization, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types--G_Gwf2r.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;

package/dist/{types-BqpgLkQB.d.ts → types--G_Gwf2r.d.ts}

@@ -194,6 +194,11 @@ interface DriveCredentialInput {
   forceRefresh?: boolean;
 }
 type PlatformRole = "administrator" | "investigator";
+interface PlatformStatus {
+  eligible: boolean;
+  globalRevision: number;
+  roles: PlatformRole[];
+}
 interface PlatformRoleChangeRecentAuthenticationInput {
   targetUserId: string;
   requestedRoles: PlatformRole[];
@@ -225,6 +230,34 @@ type PlatformRoleApproval = PlatformRoleFirstApproval | PlatformRoleApplied;
 interface RecentAuthenticationStatus {
   status: "pending" | "ready";
 }
+type OrganizationManualRole = "owner" | "admin" | "member";
+interface OrganizationManualRoleChangeInput {
+  requestedManualRole: OrganizationManualRole;
+  expectedActorAuthorityRevision: number;
+  expectedTargetAuthorityRevision: number;
+  idempotencyKey: string;
+}
+interface OrganizationManualRoleChangeResult {
+  status: "applied";
+  memberId: string;
+  manualRole: OrganizationManualRole;
+  role: OrganizationManualRole;
+  authorityRevision: number;
+}
+interface OrganizationOwnershipTransferInput {
+  outgoingOwnerMembershipId: string;
+  successorMembershipId: string;
+  outgoingOwnerRole: "admin" | "member";
+  expectedActorAuthorityRevision: number;
+  expectedOutgoingOwnerAuthorityRevision: number;
+  expectedSuccessorAuthorityRevision: number;
+  idempotencyKey: string;
+}
+interface OrganizationOwnershipTransferResult {
+  status: "applied";
+  outgoingOwner: Omit<OrganizationManualRoleChangeResult, "status">;
+  successor: Omit<OrganizationManualRoleChangeResult, "status">;
+}
 interface AuthClientOptions {
   authOrigin: string;
   appOrigin: string;
@@ -235,7 +268,10 @@ interface AuthClientOptions {
 }
 interface FinuevaAuthClient {
   readonly _type: "browser";
+  getPlatformStatus(): Promise<PlatformStatus>;
   startPlatformRoleChangeRecentAuthentication(input: PlatformRoleChangeRecentAuthenticationInput): Promise<RecentAuthenticationStatus>;
+  startOrganizationOwnerRoleChangeRecentAuthentication(organizationId: string, targetMembershipId: string, input: OrganizationManualRoleChangeInput): Promise<RecentAuthenticationStatus>;
+  startOrganizationOwnershipTransferRecentAuthentication(organizationId: string, input: OrganizationOwnershipTransferInput): Promise<RecentAuthenticationStatus>;
   approveBootstrapPlatformRoleChange(input: PlatformBootstrapRoleChangeInput): Promise<PlatformRoleApproval>;
   addPasskey(): Promise<void>;
   verifyRecentAuthenticationWithPasskey(): Promise<void>;
@@ -248,6 +284,8 @@ interface FinuevaAuthClient {
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
+  changeOrganizationMemberManualRole(organizationId: string, targetMembershipId: string, input: OrganizationManualRoleChangeInput): Promise<OrganizationManualRoleChangeResult>;
+  transferOrganizationOwnership(organizationId: string, input: OrganizationOwnershipTransferInput): Promise<OrganizationOwnershipTransferResult>;
   listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
   listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
   listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
@@ -269,4 +307,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { PlatformRole as A, SocialIdTokenInput as B, OrganizationTeam as C, OrganizationWorkspaceSelection as D, OrganizationTeamPage as E, ReceivedOrganizationInvitation as F, WorkspaceSelection as G, UpdateOrganizationDisplayInput as H, ReceivedOrganizationInvitationPage as I, AuthErrorStatus as J, AuthError as K, RecentAuthenticationStatus as L, PlatformRoleApproval as M, PlatformRoleChangeRecentAuthenticationInput as N, PersonalWorkspaceSelection as O, PlatformRoleFirstApproval as P, SendVerificationEmailInput as R, OrganizationPageInput as S, OrganizationTeamMemberPage as T, UpdateOrganizationTeamDisplayInput as U, SocialIdTokenProvider as V, UpdateProfileInput as W, OrganizationInvitation as _, AuthPersistenceDriver as a, OrganizationMemberPage as b, AuthUser as c, CreatedOrganizationTeam as d, DriveCredential as f, OrganizationDisplay as g, InvitationAcceptance as h, AuthPersistence as i, PlatformRoleApplied as j, PlatformBootstrapRoleChangeInput as k, CreateOrganizationMemberInvitationInput as l, FinuevaAuthClient as m, AuthClientOptions as n, AuthSession as o, DriveCredentialInput as p, AuthErrorCode as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreatedOrganizationMemberInvitation as u, OrganizationInvitationPage as v, OrganizationTeamDisplay as w, OrganizationPage as x, OrganizationMember as y, SignInInput as z };
+export { PlatformRole as A, SignInInput as B, OrganizationTeam as C, OrganizationWorkspaceSelection as D, OrganizationTeamPage as E, PlatformStatus as F, UpdateProfileInput as G, SocialIdTokenProvider as H, ReceivedOrganizationInvitation as I, AuthErrorCode as J, WorkspaceSelection as K, ReceivedOrganizationInvitationPage as L, PlatformRoleApproval as M, PlatformRoleChangeRecentAuthenticationInput as N, PersonalWorkspaceSelection as O, PlatformRoleFirstApproval as P, RecentAuthenticationStatus as R, OrganizationPageInput as S, OrganizationTeamMemberPage as T, UpdateOrganizationDisplayInput as U, SocialIdTokenInput as V, UpdateOrganizationTeamDisplayInput as W, AuthErrorStatus as Y, OrganizationInvitation as _, AuthPersistenceDriver as a, OrganizationMemberPage as b, AuthUser as c, CreatedOrganizationTeam as d, DriveCredential as f, OrganizationDisplay as g, InvitationAcceptance as h, AuthPersistence as i, PlatformRoleApplied as j, PlatformBootstrapRoleChangeInput as k, CreateOrganizationMemberInvitationInput as l, FinuevaAuthClient as m, AuthClientOptions as n, AuthSession as o, DriveCredentialInput as p, AuthError as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreatedOrganizationMemberInvitation as u, OrganizationInvitationPage as v, OrganizationTeamDisplay as w, OrganizationPage as x, OrganizationMember as y, SendVerificationEmailInput as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,