@finueva/auth 0.11.0 → 0.12.0

package/README.md

@@ -2,9 +2,9 @@
 
 Use `@finueva/auth` to add Finueva sign-in, organization access, invitations, and Drive credentials to a browser, server, CLI, or native application.
 
-The current published version is `0.10.1`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
+The current published version is `0.11.1`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
 
-The passkey and recent-authentication methods below describe this repository's next package candidate. Published version `0.10.1` does not include them.
+The platform-status, organization-authority, and invitation-administration methods below describe this repository's next package candidate. Published version `0.11.1` does not include them.
 
 ## Install
 
@@ -78,23 +78,27 @@ The browser owns the session cookie. The SDK does not expose or persist it.
 
 ## Common Tasks
 
-| Task                          | Browser                                     | Server                                 | Device                                 |
-| ----------------------------- | ------------------------------------------- | -------------------------------------- | -------------------------------------- |
-| Create an account             | `signUp()`                                  | Not available                          | `signUpWithEmail()`                    |
-| Read the current session      | `getSession()`                              | `getSession()`                         | `getSession()`                         |
-| Observe session state         | `onAuthStateChange()`                       | Not available                          | Not available                          |
-| Update a profile              | `updateProfile()`                           | Not available                          | `updateProfile()`                      |
-| Change a password             | `changePassword()`                          | Not available                          | `changePassword()`                     |
-| Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                          | Not available                          |
-| Verify an email               | `sendVerificationEmail()`                   | Not available                          | Not available                          |
-| List organizations            | `listOrganizations()`                       | `listOrganizations()`                  | `listOrganizations()`                  |
-| Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`             | `createOrganizationTeam()`             |
-| Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
-| Accept an invitation          | `acceptInvitation()`                        | `acceptInvitation()`                   | Not available                          |
-| Enroll a passkey              | `addPasskey()`                              | Not available                          | Not available                          |
-| Perform recent authentication | Three `*RecentAuthentication*()` methods    | Not available                          | Not available                          |
-| Request Drive access          | `getDriveCredential()`                      | `getDriveCredential()`                 | `getDriveCredential()`                 |
-| End the current session       | `signOut()`                                 | `signOut()`                            | `revokeCurrentDevice()`                |
+| Task                          | Browser                                     | Server                                    | Device                                 |
+| ----------------------------- | ------------------------------------------- | ----------------------------------------- | -------------------------------------- |
+| Create an account             | `signUp()`                                  | Not available                             | `signUpWithEmail()`                    |
+| Read the current session      | `getSession()`                              | `getSession()`                            | `getSession()`                         |
+| Observe session state         | `onAuthStateChange()`                       | Not available                             | Not available                          |
+| Update a profile              | `updateProfile()`                           | Not available                             | `updateProfile()`                      |
+| Change a password             | `changePassword()`                          | Not available                             | `changePassword()`                     |
+| Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                             | Not available                          |
+| Verify an email               | `sendVerificationEmail()`                   | Not available                             | Not available                          |
+| List organizations            | `listOrganizations()`                       | `listOrganizations()`                     | `listOrganizations()`                  |
+| Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`                | `createOrganizationTeam()`             |
+| Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()`    | `createOrganizationMemberInvitation()` |
+| Resend a member invitation    | `resendOrganizationInvitation()`            | `resendOrganizationInvitation()` (cookie) | Not available                          |
+| Cancel a member invitation    | `cancelOrganizationInvitation()`            | `cancelOrganizationInvitation()` (cookie) | Not available                          |
+| Accept an invitation          | `acceptInvitation()`                        | `acceptInvitation()`                      | Not available                          |
+| Enroll a passkey              | `addPasskey()`                              | Not available                             | Not available                          |
+| Perform recent authentication | Platform and organization action methods    | Not available                             | Not available                          |
+| Change manual roles or owners | Organization authority methods              | Not available                             | Not available                          |
+| Read current platform roles   | `getPlatformStatus()`                       | Not available                             | Not available                          |
+| Request Drive access          | `getDriveCredential()`                      | `getDriveCredential()`                    | `getDriveCredential()`                 |
+| End the current session       | `signOut()`                                 | `signOut()`                               | `revokeCurrentDevice()`                |
 
 ## Create An Organization Invitation
 
@@ -112,6 +116,15 @@ console.log(invitation.id, invitation.expiresAt);
 
 If the response is lost, repeat the same request with the same key. The SDK does not retry automatically. The result confirms invitation creation. It does not confirm email delivery.
 
+Manual owners and manual administrators can resend or cancel the exact pending invitation through browser-cookie or server-cookie authority:
+
+```ts
+const resent = await auth.resendOrganizationInvitation(organizationId, invitation.id, crypto.randomUUID());
+const canceled = await auth.cancelOrganizationInvitation(organizationId, invitation.id, crypto.randomUUID());
+```
+
+Resend success confirms the committed expiry. It does not confirm email delivery. Repeat an action with the same key only after a lost response. A bearer-backed server client rejects both methods before network I/O.
+
 ## Perform Recent Authentication
 
 The experimental passkey methods run only when the browser page uses the exact Auth Origin. To enroll a passkey, first create a new password-authenticated session on that origin:
@@ -129,7 +142,11 @@ Start one reviewed platform-role action before invoking passkey authentication:
 await auth.startPlatformRoleChangeRecentAuthentication({
   targetUserId: "user_01J8R7M6N5P4Q3S2T1",
   requestedRoles: ["administrator", "investigator"],
-  expectedRevision: 4,
+  expectedTargetRevision: 0,
+  expectedGlobalRevision: 0,
+  reasonCategory: "initial_bootstrap",
+  changeReference: "change_01J8R7M6N5P4Q3S2T1",
+  idempotencyKey: crypto.randomUUID(),
 });
 
 await auth.verifyRecentAuthenticationWithPasskey();
@@ -140,10 +157,35 @@ if (continuation.status === "ready") {
 }
 ```
 
-The maintained passkey client performs the WebAuthn ceremony for the pending action when a compatible authenticator is present. Auth binds the exact generated challenge to that action. The SDK returns only `pending` or `ready`. It does not expose the challenge, WebAuthn response, session, cookies, proof, or hashes. `ready` does not grant a platform role or reusable administration mode. The tracer has no proof-consumption API. A future exact mutation must add atomic one-use consumption with its state change. No platform mutation is currently implemented.
+The maintained passkey client performs the WebAuthn ceremony for the pending action when a compatible authenticator is present. Auth binds the exact generated challenge to that action. The SDK returns only `pending` or `ready`. It does not expose the challenge, WebAuthn response, session, cookies, proof, or hashes. `ready` does not grant a platform role or reusable administration mode. Bootstrap approval consumes the proof atomically with its state transition.
+
+Organization owner changes use the same ceremony. Pass the same input to the start and submit methods:
+
+```ts
+const change = {
+  requestedManualRole: "owner" as const,
+  expectedActorAuthorityRevision: 3,
+  expectedTargetAuthorityRevision: 1,
+  idempotencyKey: crypto.randomUUID(),
+};
+
+await auth.startOrganizationOwnerRoleChangeRecentAuthentication(organizationId, memberId, change);
+await auth.verifyRecentAuthenticationWithPasskey();
+await auth.changeOrganizationMemberManualRole(organizationId, memberId, change);
+```
+
+Atomic transfer similarly pairs `startOrganizationOwnershipTransferRecentAuthentication()` with `transferOrganizationOwnership()`. The input names distinct outgoing-owner and successor memberships, the outgoing owner's resulting `member` or `admin` role, all exact authority revisions, and one idempotency key. The SDK validates and sends one normalized request and never exposes the consumed proof.
 
 If a start result is unavailable, call `startPlatformRoleChangeRecentAuthentication()` again with the same normalized input. The client reuses the current request nonce. A different start or observed account transition removes this local retry state. Only one start request can be active. An overlapping call returns `state_conflict` before network I/O. The SDK does not retry automatically.
 
+Read the signed-in User's current effective platform roles on the exact Auth Origin:
+
+```ts
+const platform = await auth.getPlatformStatus();
+```
+
+The result contains `eligible`, `roles`, and `globalRevision`. Use it for display and mutation preparation only. Each platform operation checks current authority again. The browser SDK sends Auth-origin cookie credentials and an exact browser-generated `Origin`. It sends no `Authorization` header. Server and device clients do not expose this method.
+
 ## Request A Drive Credential
 
 Request one short-lived credential for one workspace:
@@ -284,7 +326,7 @@ Use `error.code` for application behavior. Do not parse `error.message`. Except
 - Organization collections use page sizes from 1 through 100.
 - Organization Drive context supports at most 50 current teams.
 - Invitation creation supports only the `member` role in ordinary organizations.
-- Invitation resend and cancellation are not public SDK methods.
+- Invitation resend and cancellation require browser-cookie or server-cookie authority and a manual owner or manual administrator.
 - Cross-root SSO, custom refresh tokens, and account deletion are not implemented.
 - Production support gates are incomplete. Ask the Auth operator for the current environment status before adoption.
 

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { B as SocialIdTokenInput, C as OrganizationTeam, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, W as UpdateProfileInput, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types-BqpgLkQB.js";
+import { C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, G as UpdateOrganizationDisplayInput, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateProfileInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage } from "./types-Sh23XMKv.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/device.js

@@ -448,6 +448,7 @@ const messages = {
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as PlatformRole, B as SocialIdTokenInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, G as WorkspaceSelection, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, L as RecentAuthenticationStatus, M as PlatformRoleApproval, N as PlatformRoleChangeRecentAuthenticationInput, O as PersonalWorkspaceSelection, P as PlatformRoleFirstApproval, R as SendVerificationEmailInput, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, W as UpdateProfileInput, _ as OrganizationInvitation, a as AuthPersistenceDriver, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, i as AuthPersistence, j as PlatformRoleApplied, k as PlatformBootstrapRoleChangeInput, l as CreateOrganizationMemberInvitationInput, m as FinuevaAuthClient, n as AuthClientOptions, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as SignInInput } from "./types-BqpgLkQB.js";
+import { A as PlatformBootstrapRoleChangeInput, B as ResentOrganizationInvitation, C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, F as PlatformRoleFirstApproval, G as UpdateOrganizationDisplayInput, H as SignInInput, I as PlatformStatus, J as WorkspaceSelection, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, M as PlatformRoleApplied, N as PlatformRoleApproval, O as OrganizationWorkspaceSelection, P as PlatformRoleChangeRecentAuthenticationInput, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, V as SendVerificationEmailInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformRole, k as PersonalWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateProfileInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage, z as RecentAuthenticationStatus } from "./types-Sh23XMKv.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -2544,6 +2544,7 @@ const messages = {
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
@@ -3067,6 +3068,20 @@ function normalizeCreatedOrganizationMemberInvitation(value) {
 		expiresAt: responseDate(value.expiresAt)
 	};
 }
+function normalizeResentOrganizationInvitation(value, invitationId) {
+	const invitation = normalizeCreatedOrganizationMemberInvitation(value);
+	if (invitation.id !== invitationId) throw authorityUnavailable();
+	return invitation;
+}
+function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeCanceledOrganizationInvitation(value) {
+	exact(value, ["status"]);
+	if (value.status !== "canceled") throw authorityUnavailable();
+	return { status: "canceled" };
+}
 function normalizeOrganizations(value) {
 	exact(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -3298,6 +3313,10 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function fromOrganizationInvitationAdministrationError(value, status, retryAfter) {
+	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
 function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== "changeReference,expectedGlobalRevision,expectedTargetRevision,idempotencyKey,reasonCategory,requestedRoles,targetUserId") throw new TypeError("recent authentication input is invalid");
 	if (!isId(value.targetUserId)) throw new TypeError("targetUserId is invalid");
@@ -3322,6 +3341,88 @@ function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
 		idempotencyKey: value.idempotencyKey
 	};
 }
+function normalizeOrganizationManualRoleChangeInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "expectedActorAuthorityRevision,expectedTargetAuthorityRevision,idempotencyKey,requestedManualRole") throw new TypeError("organization manual role input is invalid");
+	if (value.requestedManualRole !== "owner" && value.requestedManualRole !== "admin" && value.requestedManualRole !== "member") throw new TypeError("requestedManualRole is invalid");
+	const expectedActorAuthorityRevision = normalizeAuthorityRevision(value.expectedActorAuthorityRevision, "expectedActorAuthorityRevision");
+	const expectedTargetAuthorityRevision = normalizeAuthorityRevision(value.expectedTargetAuthorityRevision, "expectedTargetAuthorityRevision", true);
+	return {
+		requestedManualRole: value.requestedManualRole,
+		expectedActorAuthorityRevision,
+		expectedTargetAuthorityRevision,
+		idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey)
+	};
+}
+function normalizeOrganizationOwnershipTransferInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "expectedActorAuthorityRevision,expectedOutgoingOwnerAuthorityRevision,expectedSuccessorAuthorityRevision,idempotencyKey,outgoingOwnerMembershipId,outgoingOwnerRole,successorMembershipId") throw new TypeError("organization ownership transfer input is invalid");
+	if (!isId(value.outgoingOwnerMembershipId) || !isId(value.successorMembershipId)) throw new TypeError("ownership transfer membership is invalid");
+	if (value.outgoingOwnerMembershipId === value.successorMembershipId) throw new TypeError("ownership transfer memberships must differ");
+	if (value.outgoingOwnerRole !== "admin" && value.outgoingOwnerRole !== "member") throw new TypeError("outgoingOwnerRole is invalid");
+	return {
+		outgoingOwnerMembershipId: value.outgoingOwnerMembershipId,
+		successorMembershipId: value.successorMembershipId,
+		outgoingOwnerRole: value.outgoingOwnerRole,
+		expectedActorAuthorityRevision: normalizeAuthorityRevision(value.expectedActorAuthorityRevision, "expectedActorAuthorityRevision"),
+		expectedOutgoingOwnerAuthorityRevision: normalizeAuthorityRevision(value.expectedOutgoingOwnerAuthorityRevision, "expectedOutgoingOwnerAuthorityRevision", true),
+		expectedSuccessorAuthorityRevision: normalizeAuthorityRevision(value.expectedSuccessorAuthorityRevision, "expectedSuccessorAuthorityRevision", true),
+		idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey)
+	};
+}
+function normalizeOrganizationManualRoleChangeResult(value) {
+	exact(value, [
+		"status",
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision"
+	]);
+	if (value.status !== "applied") throw authorityUnavailable();
+	return {
+		status: "applied",
+		...normalizeOrganizationAuthorityMemberOutcome(value, true)
+	};
+}
+function normalizeOrganizationOwnershipTransferResult(value) {
+	exact(value, [
+		"status",
+		"outgoingOwner",
+		"successor"
+	]);
+	if (value.status !== "applied") throw authorityUnavailable();
+	return {
+		status: "applied",
+		outgoingOwner: normalizeOrganizationAuthorityMemberOutcome(value.outgoingOwner),
+		successor: normalizeOrganizationAuthorityMemberOutcome(value.successor)
+	};
+}
+function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
+	exact(value, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision",
+		...includesStatus ? ["status"] : []
+	]);
+	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
+	return {
+		memberId: value.memberId,
+		manualRole: value.manualRole,
+		role: value.role,
+		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
+	};
+}
+function normalizeAuthorityRevision(value, name, incremented = false) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER - (incremented ? 1 : 0)) throw new TypeError(`${name} is invalid`);
+	return value;
+}
+function normalizeAuthorityResultRevision(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	return value;
+}
+function normalizeAuthorityIdempotencyKey(value) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value)) throw new TypeError("idempotencyKey is invalid");
+	return value;
+}
 function normalizePlatformBootstrapRoleChangeInput(value) {
 	const request = normalizePlatformRoleChangeRecentAuthenticationInput(value);
 	if (request.reasonCategory !== "initial_bootstrap" || !request.requestedRoles.includes("administrator")) throw new TypeError("platform first approval input is invalid");
@@ -3354,6 +3455,21 @@ function normalizePlatformRoleApproval(value) {
 		roles: []
 	};
 }
+function normalizePlatformStatus(value) {
+	exact(value, [
+		"eligible",
+		"globalRevision",
+		"roles"
+	]);
+	if (typeof value.eligible !== "boolean") throw authorityUnavailable();
+	if (!Number.isSafeInteger(value.globalRevision) || value.globalRevision < 0 || value.globalRevision >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	if (!Array.isArray(value.roles) || !(value.roles.length === 0 || value.roles.length === 1 && (value.roles[0] === "administrator" || value.roles[0] === "investigator") || value.roles.length === 2 && value.roles[0] === "administrator" && value.roles[1] === "investigator") || !value.eligible && value.roles.length !== 0) throw authorityUnavailable();
+	return {
+		eligible: value.eligible,
+		globalRevision: value.globalRevision,
+		roles: value.roles
+	};
+}
 function normalizeRecentAuthenticationStatus(value) {
 	exact(value, ["status"]);
 	if (value.status !== "pending" && value.status !== "ready") throw authorityUnavailable();
@@ -4354,6 +4470,9 @@ function createAuthClient(options) {
 	let selectedWorkspaceKey;
 	let credentialGeneration = 0;
 	let authorityGeneration = 0;
+	let platformStatusReadEpoch = 0;
+	let sessionAuthorityEpoch = 0;
+	let sessionAuthorityObserved = false;
 	let recentAuthenticationBrowserToken;
 	let recentAuthenticationStartAttempt;
 	let recentAuthenticationStartRequest;
@@ -4479,9 +4598,11 @@ function createAuthClient(options) {
 	}
 	function updateSession(session) {
 		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0);
-		const changedSession = !session || sessionId !== void 0 && (session.id !== sessionId || session.user.id !== sessionUserId);
+		const changedSession = sessionId === void 0 ? !sessionAuthorityObserved || session !== null : !session || session.id !== sessionId || session.user.id !== sessionUserId;
 		if (!session || unboundCredential || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
 		if (changedSession || recentAuthenticationStartAttempt && (recentAuthenticationStartAttempt.sessionId !== session?.id || recentAuthenticationStartAttempt.userId !== session?.user.id)) recentAuthenticationStartAttempt = void 0;
+		if (changedSession) sessionAuthorityEpoch += 1;
+		sessionAuthorityObserved = true;
 		sessionId = session?.id;
 		sessionUserId = session?.user.id;
 		return session;
@@ -4631,52 +4752,89 @@ function createAuthClient(options) {
 	function assertRecentAuthenticationOrigin() {
 		if (appOrigin !== authOrigin) throw new TypeError("recent authentication requires the exact Auth Origin");
 	}
+	function assertPlatformAdministrationOrigin() {
+		if (appOrigin !== authOrigin) throw new TypeError("platform administration requires the exact Auth Origin");
+	}
+	async function startRecentAuthentication(body) {
+		assertRecentAuthenticationOrigin();
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+		if (recentAuthenticationStartRequest) throw new AuthError("state_conflict", 409);
+		const generation = authorityGeneration;
+		recentAuthenticationBrowserToken ??= createOpaqueToken();
+		const normalizedInput = JSON.stringify(body);
+		const attempt = recentAuthenticationStartAttempt?.input === normalizedInput ? recentAuthenticationStartAttempt : {
+			input: normalizedInput,
+			requestToken: createOpaqueToken(),
+			sessionId,
+			userId: sessionUserId
+		};
+		recentAuthenticationStartAttempt = attempt;
+		const request = (async () => {
+			try {
+				const value = await requestJson(joinURL(authOrigin, "api/v1/auth/recent-authentication"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "POST",
+					headers: {
+						"content-type": "application/json",
+						[RECENT_AUTHENTICATION_BROWSER_HEADER]: recentAuthenticationBrowserToken,
+						[RECENT_AUTHENTICATION_REQUEST_HEADER]: attempt.requestToken
+					},
+					body,
+					mapError: fromRecentAuthenticationError
+				});
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				const status = normalizeRecentAuthenticationStatus(value);
+				if (recentAuthenticationStartAttempt === attempt) recentAuthenticationStartAttempt = void 0;
+				return status;
+			} catch (error) {
+				if (recentAuthenticationStartAttempt === attempt && (!(error instanceof AuthError) || error.code !== "identity_authority_unavailable")) recentAuthenticationStartAttempt = void 0;
+				throw error;
+			}
+		})();
+		recentAuthenticationStartRequest = request;
+		try {
+			return await request;
+		} finally {
+			if (recentAuthenticationStartRequest === request) recentAuthenticationStartRequest = void 0;
+		}
+	}
 	return {
 		_type: "browser",
-		async startPlatformRoleChangeRecentAuthentication(input) {
-			assertRecentAuthenticationOrigin();
-			const body = normalizePlatformRoleChangeRecentAuthenticationInput(input);
+		async getPlatformStatus() {
+			assertPlatformAdministrationOrigin();
 			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
-			if (recentAuthenticationStartRequest) throw new AuthError("state_conflict", 409);
 			const generation = authorityGeneration;
-			recentAuthenticationBrowserToken ??= createOpaqueToken();
-			const normalizedInput = JSON.stringify(body);
-			const attempt = recentAuthenticationStartAttempt?.input === normalizedInput ? recentAuthenticationStartAttempt : {
-				input: normalizedInput,
-				requestToken: createOpaqueToken(),
-				sessionId,
-				userId: sessionUserId
-			};
-			recentAuthenticationStartAttempt = attempt;
-			const request = (async () => {
-				try {
-					const value = await requestJson(joinURL(authOrigin, "api/v1/auth/recent-authentication"), {
-						fetch: fetchImpl,
-						timeoutMs,
-						method: "POST",
-						headers: {
-							"content-type": "application/json",
-							[RECENT_AUTHENTICATION_BROWSER_HEADER]: recentAuthenticationBrowserToken,
-							[RECENT_AUTHENTICATION_REQUEST_HEADER]: attempt.requestToken
-						},
-						body,
-						mapError: fromRecentAuthenticationError
-					});
-					if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
-					const status = normalizeRecentAuthenticationStatus(value);
-					if (recentAuthenticationStartAttempt === attempt) recentAuthenticationStartAttempt = void 0;
-					return status;
-				} catch (error) {
-					if (recentAuthenticationStartAttempt === attempt && (!(error instanceof AuthError) || error.code !== "identity_authority_unavailable")) recentAuthenticationStartAttempt = void 0;
-					throw error;
-				}
-			})();
-			recentAuthenticationStartRequest = request;
-			try {
-				return await request;
-			} finally {
-				if (recentAuthenticationStartRequest === request) recentAuthenticationStartRequest = void 0;
-			}
+			const readEpoch = ++platformStatusReadEpoch;
+			const sessionEpoch = sessionAuthorityEpoch;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/platform/status"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: {},
+				mapError: fromPlatformAdministrationError
+			});
+			if (generation !== authorityGeneration || readEpoch !== platformStatusReadEpoch || sessionEpoch !== sessionAuthorityEpoch) throw new AuthError("state_conflict", 409);
+			return normalizePlatformStatus(value);
+		},
+		async startPlatformRoleChangeRecentAuthentication(input) {
+			return startRecentAuthentication(normalizePlatformRoleChangeRecentAuthenticationInput(input));
+		},
+		async startOrganizationOwnerRoleChangeRecentAuthentication(organizationId, targetMembershipId, input) {
+			return startRecentAuthentication({
+				action: "organization_owner_role_change",
+				organizationId: normalizeIdInput(organizationId),
+				targetMembershipId: normalizeIdInput(targetMembershipId),
+				...normalizeOrganizationManualRoleChangeInput(input)
+			});
+		},
+		async startOrganizationOwnershipTransferRecentAuthentication(organizationId, input) {
+			return startRecentAuthentication({
+				action: "organization_ownership_transfer",
+				organizationId: normalizeIdInput(organizationId),
+				...normalizeOrganizationOwnershipTransferInput(input)
+			});
 		},
 		async approveBootstrapPlatformRoleChange(input) {
 			assertRecentAuthenticationOrigin();
@@ -4804,6 +4962,40 @@ function createAuthClient(options) {
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			return normalizeCreatedOrganizationMemberInvitation(value);
 		},
+		async resendOrganizationInvitation(organizationId, invitationId, idempotencyKey) {
+			const organization = normalizeIdInput(organizationId);
+			const invitation = normalizeIdInput(invitationId);
+			const body = normalizeOrganizationInvitationAdministrationInput(idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "invitations", invitation, "resend"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationInvitationAdministrationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeResentOrganizationInvitation(value, invitation);
+		},
+		async cancelOrganizationInvitation(organizationId, invitationId, idempotencyKey) {
+			const organization = normalizeIdInput(organizationId);
+			const invitation = normalizeIdInput(invitationId);
+			const body = normalizeOrganizationInvitationAdministrationInput(idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "invitations", invitation, "cancel"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationInvitationAdministrationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeCanceledOrganizationInvitation(value);
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);
@@ -4837,6 +5029,39 @@ function createAuthClient(options) {
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			return normalizeOrganizationTeamDisplay(value);
 		},
+		async changeOrganizationMemberManualRole(organizationId, targetMembershipId, input) {
+			const organization = normalizeIdInput(organizationId);
+			const target = normalizeIdInput(targetMembershipId);
+			const body = normalizeOrganizationManualRoleChangeInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "members", target, "manual-role"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeOrganizationManualRoleChangeResult(value);
+		},
+		async transferOrganizationOwnership(organizationId, input) {
+			const organization = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationOwnershipTransferInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "ownership-transfer"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeOrganizationOwnershipTransferResult(value);
+		},
 		async listOrganizationMembers(organizationId, input) {
 			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers);
 		},

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { B as SocialIdTokenInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as ReceivedOrganizationInvitation, G as WorkspaceSelection, H as UpdateOrganizationDisplayInput, I as ReceivedOrganizationInvitationPage, J as AuthErrorStatus, K as AuthError, O as PersonalWorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationTeamDisplayInput, V as SocialIdTokenProvider, _ as OrganizationInvitation, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthErrorCode, r as AuthOrganization, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types-BqpgLkQB.js";
+import { B as ResentOrganizationInvitation, C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, G as UpdateOrganizationDisplayInput, J as WorkspaceSelection, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, O as OrganizationWorkspaceSelection, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as PersonalWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage } from "./types-Sh23XMKv.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -24,6 +24,8 @@ interface FinuevaServerAuth {
   getOrganization(organizationId: string): Promise<AuthOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
+  resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
+  cancelOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<CanceledOrganizationInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
   listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
@@ -39,4 +41,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createServerAuth };

package/dist/server.js

@@ -185,6 +185,7 @@ const messages = {
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
@@ -673,6 +674,20 @@ function normalizeCreatedOrganizationMemberInvitation(value) {
 		expiresAt: responseDate(value.expiresAt)
 	};
 }
+function normalizeResentOrganizationInvitation(value, invitationId) {
+	const invitation = normalizeCreatedOrganizationMemberInvitation(value);
+	if (invitation.id !== invitationId) throw authorityUnavailable();
+	return invitation;
+}
+function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeCanceledOrganizationInvitation(value) {
+	exact(value, ["status"]);
+	if (value.status !== "canceled") throw authorityUnavailable();
+	return { status: "canceled" };
+}
 function normalizeOrganizations(value) {
 	exact(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -890,6 +905,10 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function fromOrganizationInvitationAdministrationError(value, status, retryAfter) {
+	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -1186,6 +1205,42 @@ function createServerAuth(options) {
 				mapError: fromOrganizationMutationAuthorityError
 			}));
 		},
+		async resendOrganizationInvitation(organizationId, invitationId, idempotencyKey) {
+			if (authorization) throw new AuthError("authentication_required", 401);
+			const organization = normalizeIdInput(organizationId);
+			const invitation = normalizeIdInput(invitationId);
+			const body = normalizeOrganizationInvitationAdministrationInput(idempotencyKey);
+			return normalizeResentOrganizationInvitation(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "invitations", invitation, "resend"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationInvitationAdministrationError
+			}), invitation);
+		},
+		async cancelOrganizationInvitation(organizationId, invitationId, idempotencyKey) {
+			if (authorization) throw new AuthError("authentication_required", 401);
+			const organization = normalizeIdInput(organizationId);
+			const invitation = normalizeIdInput(invitationId);
+			const body = normalizeOrganizationInvitationAdministrationInput(idempotencyKey);
+			return normalizeCanceledOrganizationInvitation(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "invitations", invitation, "cancel"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationInvitationAdministrationError
+			}));
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);

package/dist/{types-BqpgLkQB.d.ts → types-Sh23XMKv.d.ts}

@@ -1,5 +1,5 @@
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
 type AuthErrorStatus = 400 | 401 | 403 | 404 | 409 | 413 | 415 | 422 | 429 | 503;
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
@@ -86,6 +86,13 @@ interface CreatedOrganizationMemberInvitation {
   id: string;
   expiresAt: Date;
 }
+interface ResentOrganizationInvitation {
+  id: string;
+  expiresAt: Date;
+}
+interface CanceledOrganizationInvitation {
+  status: "canceled";
+}
 interface OrganizationTeamPage {
   teams: OrganizationTeam[];
   nextCursor: string | null;
@@ -194,6 +201,11 @@ interface DriveCredentialInput {
   forceRefresh?: boolean;
 }
 type PlatformRole = "administrator" | "investigator";
+interface PlatformStatus {
+  eligible: boolean;
+  globalRevision: number;
+  roles: PlatformRole[];
+}
 interface PlatformRoleChangeRecentAuthenticationInput {
   targetUserId: string;
   requestedRoles: PlatformRole[];
@@ -225,6 +237,34 @@ type PlatformRoleApproval = PlatformRoleFirstApproval | PlatformRoleApplied;
 interface RecentAuthenticationStatus {
   status: "pending" | "ready";
 }
+type OrganizationManualRole = "owner" | "admin" | "member";
+interface OrganizationManualRoleChangeInput {
+  requestedManualRole: OrganizationManualRole;
+  expectedActorAuthorityRevision: number;
+  expectedTargetAuthorityRevision: number;
+  idempotencyKey: string;
+}
+interface OrganizationManualRoleChangeResult {
+  status: "applied";
+  memberId: string;
+  manualRole: OrganizationManualRole;
+  role: OrganizationManualRole;
+  authorityRevision: number;
+}
+interface OrganizationOwnershipTransferInput {
+  outgoingOwnerMembershipId: string;
+  successorMembershipId: string;
+  outgoingOwnerRole: "admin" | "member";
+  expectedActorAuthorityRevision: number;
+  expectedOutgoingOwnerAuthorityRevision: number;
+  expectedSuccessorAuthorityRevision: number;
+  idempotencyKey: string;
+}
+interface OrganizationOwnershipTransferResult {
+  status: "applied";
+  outgoingOwner: Omit<OrganizationManualRoleChangeResult, "status">;
+  successor: Omit<OrganizationManualRoleChangeResult, "status">;
+}
 interface AuthClientOptions {
   authOrigin: string;
   appOrigin: string;
@@ -235,7 +275,10 @@ interface AuthClientOptions {
 }
 interface FinuevaAuthClient {
   readonly _type: "browser";
+  getPlatformStatus(): Promise<PlatformStatus>;
   startPlatformRoleChangeRecentAuthentication(input: PlatformRoleChangeRecentAuthenticationInput): Promise<RecentAuthenticationStatus>;
+  startOrganizationOwnerRoleChangeRecentAuthentication(organizationId: string, targetMembershipId: string, input: OrganizationManualRoleChangeInput): Promise<RecentAuthenticationStatus>;
+  startOrganizationOwnershipTransferRecentAuthentication(organizationId: string, input: OrganizationOwnershipTransferInput): Promise<RecentAuthenticationStatus>;
   approveBootstrapPlatformRoleChange(input: PlatformBootstrapRoleChangeInput): Promise<PlatformRoleApproval>;
   addPasskey(): Promise<void>;
   verifyRecentAuthenticationWithPasskey(): Promise<void>;
@@ -246,8 +289,12 @@ interface FinuevaAuthClient {
   getOrganization(organizationId: string): Promise<AuthOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
+  resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
+  cancelOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<CanceledOrganizationInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
+  changeOrganizationMemberManualRole(organizationId: string, targetMembershipId: string, input: OrganizationManualRoleChangeInput): Promise<OrganizationManualRoleChangeResult>;
+  transferOrganizationOwnership(organizationId: string, input: OrganizationOwnershipTransferInput): Promise<OrganizationOwnershipTransferResult>;
   listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
   listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
   listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
@@ -269,4 +316,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { PlatformRole as A, SocialIdTokenInput as B, OrganizationTeam as C, OrganizationWorkspaceSelection as D, OrganizationTeamPage as E, ReceivedOrganizationInvitation as F, WorkspaceSelection as G, UpdateOrganizationDisplayInput as H, ReceivedOrganizationInvitationPage as I, AuthErrorStatus as J, AuthError as K, RecentAuthenticationStatus as L, PlatformRoleApproval as M, PlatformRoleChangeRecentAuthenticationInput as N, PersonalWorkspaceSelection as O, PlatformRoleFirstApproval as P, SendVerificationEmailInput as R, OrganizationPageInput as S, OrganizationTeamMemberPage as T, UpdateOrganizationTeamDisplayInput as U, SocialIdTokenProvider as V, UpdateProfileInput as W, OrganizationInvitation as _, AuthPersistenceDriver as a, OrganizationMemberPage as b, AuthUser as c, CreatedOrganizationTeam as d, DriveCredential as f, OrganizationDisplay as g, InvitationAcceptance as h, AuthPersistence as i, PlatformRoleApplied as j, PlatformBootstrapRoleChangeInput as k, CreateOrganizationMemberInvitationInput as l, FinuevaAuthClient as m, AuthClientOptions as n, AuthSession as o, DriveCredentialInput as p, AuthErrorCode as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreatedOrganizationMemberInvitation as u, OrganizationInvitationPage as v, OrganizationTeamDisplay as w, OrganizationPage as x, OrganizationMember as y, SignInInput as z };
+export { PlatformBootstrapRoleChangeInput as A, ResentOrganizationInvitation as B, OrganizationPageInput as C, OrganizationTeamPage as D, OrganizationTeamMemberPage as E, PlatformRoleFirstApproval as F, UpdateOrganizationDisplayInput as G, SignInInput as H, PlatformStatus as I, WorkspaceSelection as J, UpdateOrganizationTeamDisplayInput as K, ReceivedOrganizationInvitation as L, PlatformRoleApplied as M, PlatformRoleApproval as N, OrganizationWorkspaceSelection as O, PlatformRoleChangeRecentAuthenticationInput as P, ReceivedOrganizationInvitationPage as R, OrganizationPage as S, OrganizationTeamDisplay as T, SocialIdTokenInput as U, SendVerificationEmailInput as V, SocialIdTokenProvider as W, AuthErrorCode as X, AuthError as Y, AuthErrorStatus as Z, OrganizationDisplay as _, AuthPersistenceDriver as a, OrganizationMember as b, AuthUser as c, CreatedOrganizationMemberInvitation as d, CreatedOrganizationTeam as f, InvitationAcceptance as g, FinuevaAuthClient as h, AuthPersistence as i, PlatformRole as j, PersonalWorkspaceSelection as k, CanceledOrganizationInvitation as l, DriveCredentialInput as m, AuthClientOptions as n, AuthSession as o, DriveCredential as p, UpdateProfileInput as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreateOrganizationMemberInvitationInput as u, OrganizationInvitation as v, OrganizationTeam as w, OrganizationMemberPage as x, OrganizationInvitationPage as y, RecentAuthenticationStatus as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,
@@ -43,8 +43,8 @@
     "lint": "oxlint . --deny-warnings",
     "prepack": "pnpm build",
     "test": "pnpm test:unit && pnpm build && pnpm test:package",
-    "test:composition": "node scripts/test-composition.mjs",
-    "test:package": "node scripts/test-package.mjs",
+    "test:composition": "node scripts/test/composition/runner.mjs",
+    "test:package": "node scripts/test/package.mjs",
     "test:unit": "vitest run",
     "typecheck": "tsc --noEmit"
   },