@finueva/auth 0.11.1 → 0.12.0

package/README.md

@@ -2,9 +2,9 @@
 
 Use `@finueva/auth` to add Finueva sign-in, organization access, invitations, and Drive credentials to a browser, server, CLI, or native application.
 
-The current published version is `0.11.0`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
+The current published version is `0.11.1`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
 
-The platform-status and organization-authority methods below describe this repository's next package candidate. Published version `0.11.0` does not include them.
+The platform-status, organization-authority, and invitation-administration methods below describe this repository's next package candidate. Published version `0.11.1` does not include them.
 
 ## Install
 
@@ -78,25 +78,27 @@ The browser owns the session cookie. The SDK does not expose or persist it.
 
 ## Common Tasks
 
-| Task                          | Browser                                     | Server                                 | Device                                 |
-| ----------------------------- | ------------------------------------------- | -------------------------------------- | -------------------------------------- |
-| Create an account             | `signUp()`                                  | Not available                          | `signUpWithEmail()`                    |
-| Read the current session      | `getSession()`                              | `getSession()`                         | `getSession()`                         |
-| Observe session state         | `onAuthStateChange()`                       | Not available                          | Not available                          |
-| Update a profile              | `updateProfile()`                           | Not available                          | `updateProfile()`                      |
-| Change a password             | `changePassword()`                          | Not available                          | `changePassword()`                     |
-| Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                          | Not available                          |
-| Verify an email               | `sendVerificationEmail()`                   | Not available                          | Not available                          |
-| List organizations            | `listOrganizations()`                       | `listOrganizations()`                  | `listOrganizations()`                  |
-| Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`             | `createOrganizationTeam()`             |
-| Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
-| Accept an invitation          | `acceptInvitation()`                        | `acceptInvitation()`                   | Not available                          |
-| Enroll a passkey              | `addPasskey()`                              | Not available                          | Not available                          |
-| Perform recent authentication | Platform and organization action methods    | Not available                          | Not available                          |
-| Change manual roles or owners | Organization authority methods              | Not available                          | Not available                          |
-| Read current platform roles   | `getPlatformStatus()`                       | Not available                          | Not available                          |
-| Request Drive access          | `getDriveCredential()`                      | `getDriveCredential()`                 | `getDriveCredential()`                 |
-| End the current session       | `signOut()`                                 | `signOut()`                            | `revokeCurrentDevice()`                |
+| Task                          | Browser                                     | Server                                    | Device                                 |
+| ----------------------------- | ------------------------------------------- | ----------------------------------------- | -------------------------------------- |
+| Create an account             | `signUp()`                                  | Not available                             | `signUpWithEmail()`                    |
+| Read the current session      | `getSession()`                              | `getSession()`                            | `getSession()`                         |
+| Observe session state         | `onAuthStateChange()`                       | Not available                             | Not available                          |
+| Update a profile              | `updateProfile()`                           | Not available                             | `updateProfile()`                      |
+| Change a password             | `changePassword()`                          | Not available                             | `changePassword()`                     |
+| Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                             | Not available                          |
+| Verify an email               | `sendVerificationEmail()`                   | Not available                             | Not available                          |
+| List organizations            | `listOrganizations()`                       | `listOrganizations()`                     | `listOrganizations()`                  |
+| Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`                | `createOrganizationTeam()`             |
+| Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()`    | `createOrganizationMemberInvitation()` |
+| Resend a member invitation    | `resendOrganizationInvitation()`            | `resendOrganizationInvitation()` (cookie) | Not available                          |
+| Cancel a member invitation    | `cancelOrganizationInvitation()`            | `cancelOrganizationInvitation()` (cookie) | Not available                          |
+| Accept an invitation          | `acceptInvitation()`                        | `acceptInvitation()`                      | Not available                          |
+| Enroll a passkey              | `addPasskey()`                              | Not available                             | Not available                          |
+| Perform recent authentication | Platform and organization action methods    | Not available                             | Not available                          |
+| Change manual roles or owners | Organization authority methods              | Not available                             | Not available                          |
+| Read current platform roles   | `getPlatformStatus()`                       | Not available                             | Not available                          |
+| Request Drive access          | `getDriveCredential()`                      | `getDriveCredential()`                    | `getDriveCredential()`                 |
+| End the current session       | `signOut()`                                 | `signOut()`                               | `revokeCurrentDevice()`                |
 
 ## Create An Organization Invitation
 
@@ -114,6 +116,15 @@ console.log(invitation.id, invitation.expiresAt);
 
 If the response is lost, repeat the same request with the same key. The SDK does not retry automatically. The result confirms invitation creation. It does not confirm email delivery.
 
+Manual owners and manual administrators can resend or cancel the exact pending invitation through browser-cookie or server-cookie authority:
+
+```ts
+const resent = await auth.resendOrganizationInvitation(organizationId, invitation.id, crypto.randomUUID());
+const canceled = await auth.cancelOrganizationInvitation(organizationId, invitation.id, crypto.randomUUID());
+```
+
+Resend success confirms the committed expiry. It does not confirm email delivery. Repeat an action with the same key only after a lost response. A bearer-backed server client rejects both methods before network I/O.
+
 ## Perform Recent Authentication
 
 The experimental passkey methods run only when the browser page uses the exact Auth Origin. To enroll a passkey, first create a new password-authenticated session on that origin:
@@ -315,7 +326,7 @@ Use `error.code` for application behavior. Do not parse `error.message`. Except
 - Organization collections use page sizes from 1 through 100.
 - Organization Drive context supports at most 50 current teams.
 - Invitation creation supports only the `member` role in ordinary organizations.
-- Invitation resend and cancellation are not public SDK methods.
+- Invitation resend and cancellation require browser-cookie or server-cookie authority and a manual owner or manual administrator.
 - Cross-root SSO, custom refresh tokens, and account deletion are not implemented.
 - Production support gates are incomplete. Ask the Auth operator for the current environment status before adoption.
 

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { C as OrganizationTeam, E as OrganizationTeamPage, G as UpdateProfileInput, H as SocialIdTokenProvider, I as ReceivedOrganizationInvitation, J as AuthErrorCode, L as ReceivedOrganizationInvitationPage, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationDisplayInput, V as SocialIdTokenInput, W as UpdateOrganizationTeamDisplayInput, Y as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthError, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types--G_Gwf2r.js";
+import { C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, G as UpdateOrganizationDisplayInput, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateProfileInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage } from "./types-Sh23XMKv.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/device.js

@@ -448,6 +448,7 @@ const messages = {
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as PlatformRole, B as SignInInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as PlatformStatus, G as UpdateProfileInput, H as SocialIdTokenProvider, I as ReceivedOrganizationInvitation, J as AuthErrorCode, K as WorkspaceSelection, L as ReceivedOrganizationInvitationPage, M as PlatformRoleApproval, N as PlatformRoleChangeRecentAuthenticationInput, O as PersonalWorkspaceSelection, P as PlatformRoleFirstApproval, R as RecentAuthenticationStatus, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationDisplayInput, V as SocialIdTokenInput, W as UpdateOrganizationTeamDisplayInput, Y as AuthErrorStatus, _ as OrganizationInvitation, a as AuthPersistenceDriver, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, i as AuthPersistence, j as PlatformRoleApplied, k as PlatformBootstrapRoleChangeInput, l as CreateOrganizationMemberInvitationInput, m as FinuevaAuthClient, n as AuthClientOptions, o as AuthSession, p as DriveCredentialInput, q as AuthError, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as SendVerificationEmailInput } from "./types--G_Gwf2r.js";
+import { A as PlatformBootstrapRoleChangeInput, B as ResentOrganizationInvitation, C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, F as PlatformRoleFirstApproval, G as UpdateOrganizationDisplayInput, H as SignInInput, I as PlatformStatus, J as WorkspaceSelection, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, M as PlatformRoleApplied, N as PlatformRoleApproval, O as OrganizationWorkspaceSelection, P as PlatformRoleChangeRecentAuthenticationInput, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, V as SendVerificationEmailInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformRole, k as PersonalWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateProfileInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage, z as RecentAuthenticationStatus } from "./types-Sh23XMKv.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -2544,6 +2544,7 @@ const messages = {
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
@@ -3067,6 +3068,20 @@ function normalizeCreatedOrganizationMemberInvitation(value) {
 		expiresAt: responseDate(value.expiresAt)
 	};
 }
+function normalizeResentOrganizationInvitation(value, invitationId) {
+	const invitation = normalizeCreatedOrganizationMemberInvitation(value);
+	if (invitation.id !== invitationId) throw authorityUnavailable();
+	return invitation;
+}
+function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeCanceledOrganizationInvitation(value) {
+	exact(value, ["status"]);
+	if (value.status !== "canceled") throw authorityUnavailable();
+	return { status: "canceled" };
+}
 function normalizeOrganizations(value) {
 	exact(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -3298,6 +3313,10 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function fromOrganizationInvitationAdministrationError(value, status, retryAfter) {
+	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
 function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== "changeReference,expectedGlobalRevision,expectedTargetRevision,idempotencyKey,reasonCategory,requestedRoles,targetUserId") throw new TypeError("recent authentication input is invalid");
 	if (!isId(value.targetUserId)) throw new TypeError("targetUserId is invalid");
@@ -4943,6 +4962,40 @@ function createAuthClient(options) {
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			return normalizeCreatedOrganizationMemberInvitation(value);
 		},
+		async resendOrganizationInvitation(organizationId, invitationId, idempotencyKey) {
+			const organization = normalizeIdInput(organizationId);
+			const invitation = normalizeIdInput(invitationId);
+			const body = normalizeOrganizationInvitationAdministrationInput(idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "invitations", invitation, "resend"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationInvitationAdministrationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeResentOrganizationInvitation(value, invitation);
+		},
+		async cancelOrganizationInvitation(organizationId, invitationId, idempotencyKey) {
+			const organization = normalizeIdInput(organizationId);
+			const invitation = normalizeIdInput(invitationId);
+			const body = normalizeOrganizationInvitationAdministrationInput(idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "invitations", invitation, "cancel"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationInvitationAdministrationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeCanceledOrganizationInvitation(value);
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, H as SocialIdTokenProvider, I as ReceivedOrganizationInvitation, J as AuthErrorCode, K as WorkspaceSelection, L as ReceivedOrganizationInvitationPage, O as PersonalWorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationDisplayInput, V as SocialIdTokenInput, W as UpdateOrganizationTeamDisplayInput, Y as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthError, r as AuthOrganization, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types--G_Gwf2r.js";
+import { B as ResentOrganizationInvitation, C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, G as UpdateOrganizationDisplayInput, J as WorkspaceSelection, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, O as OrganizationWorkspaceSelection, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as PersonalWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage } from "./types-Sh23XMKv.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -24,6 +24,8 @@ interface FinuevaServerAuth {
   getOrganization(organizationId: string): Promise<AuthOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
+  resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
+  cancelOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<CanceledOrganizationInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
   listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
@@ -39,4 +41,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createServerAuth };

package/dist/server.js

@@ -185,6 +185,7 @@ const messages = {
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
@@ -673,6 +674,20 @@ function normalizeCreatedOrganizationMemberInvitation(value) {
 		expiresAt: responseDate(value.expiresAt)
 	};
 }
+function normalizeResentOrganizationInvitation(value, invitationId) {
+	const invitation = normalizeCreatedOrganizationMemberInvitation(value);
+	if (invitation.id !== invitationId) throw authorityUnavailable();
+	return invitation;
+}
+function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeCanceledOrganizationInvitation(value) {
+	exact(value, ["status"]);
+	if (value.status !== "canceled") throw authorityUnavailable();
+	return { status: "canceled" };
+}
 function normalizeOrganizations(value) {
 	exact(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -890,6 +905,10 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function fromOrganizationInvitationAdministrationError(value, status, retryAfter) {
+	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -1186,6 +1205,42 @@ function createServerAuth(options) {
 				mapError: fromOrganizationMutationAuthorityError
 			}));
 		},
+		async resendOrganizationInvitation(organizationId, invitationId, idempotencyKey) {
+			if (authorization) throw new AuthError("authentication_required", 401);
+			const organization = normalizeIdInput(organizationId);
+			const invitation = normalizeIdInput(invitationId);
+			const body = normalizeOrganizationInvitationAdministrationInput(idempotencyKey);
+			return normalizeResentOrganizationInvitation(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "invitations", invitation, "resend"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationInvitationAdministrationError
+			}), invitation);
+		},
+		async cancelOrganizationInvitation(organizationId, invitationId, idempotencyKey) {
+			if (authorization) throw new AuthError("authentication_required", 401);
+			const organization = normalizeIdInput(organizationId);
+			const invitation = normalizeIdInput(invitationId);
+			const body = normalizeOrganizationInvitationAdministrationInput(idempotencyKey);
+			return normalizeCanceledOrganizationInvitation(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "invitations", invitation, "cancel"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationInvitationAdministrationError
+			}));
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);

package/dist/{types--G_Gwf2r.d.ts → types-Sh23XMKv.d.ts}

@@ -1,5 +1,5 @@
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
 type AuthErrorStatus = 400 | 401 | 403 | 404 | 409 | 413 | 415 | 422 | 429 | 503;
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
@@ -86,6 +86,13 @@ interface CreatedOrganizationMemberInvitation {
   id: string;
   expiresAt: Date;
 }
+interface ResentOrganizationInvitation {
+  id: string;
+  expiresAt: Date;
+}
+interface CanceledOrganizationInvitation {
+  status: "canceled";
+}
 interface OrganizationTeamPage {
   teams: OrganizationTeam[];
   nextCursor: string | null;
@@ -282,6 +289,8 @@ interface FinuevaAuthClient {
   getOrganization(organizationId: string): Promise<AuthOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
+  resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
+  cancelOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<CanceledOrganizationInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
   changeOrganizationMemberManualRole(organizationId: string, targetMembershipId: string, input: OrganizationManualRoleChangeInput): Promise<OrganizationManualRoleChangeResult>;
@@ -307,4 +316,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { PlatformRole as A, SignInInput as B, OrganizationTeam as C, OrganizationWorkspaceSelection as D, OrganizationTeamPage as E, PlatformStatus as F, UpdateProfileInput as G, SocialIdTokenProvider as H, ReceivedOrganizationInvitation as I, AuthErrorCode as J, WorkspaceSelection as K, ReceivedOrganizationInvitationPage as L, PlatformRoleApproval as M, PlatformRoleChangeRecentAuthenticationInput as N, PersonalWorkspaceSelection as O, PlatformRoleFirstApproval as P, RecentAuthenticationStatus as R, OrganizationPageInput as S, OrganizationTeamMemberPage as T, UpdateOrganizationDisplayInput as U, SocialIdTokenInput as V, UpdateOrganizationTeamDisplayInput as W, AuthErrorStatus as Y, OrganizationInvitation as _, AuthPersistenceDriver as a, OrganizationMemberPage as b, AuthUser as c, CreatedOrganizationTeam as d, DriveCredential as f, OrganizationDisplay as g, InvitationAcceptance as h, AuthPersistence as i, PlatformRoleApplied as j, PlatformBootstrapRoleChangeInput as k, CreateOrganizationMemberInvitationInput as l, FinuevaAuthClient as m, AuthClientOptions as n, AuthSession as o, DriveCredentialInput as p, AuthError as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreatedOrganizationMemberInvitation as u, OrganizationInvitationPage as v, OrganizationTeamDisplay as w, OrganizationPage as x, OrganizationMember as y, SendVerificationEmailInput as z };
+export { PlatformBootstrapRoleChangeInput as A, ResentOrganizationInvitation as B, OrganizationPageInput as C, OrganizationTeamPage as D, OrganizationTeamMemberPage as E, PlatformRoleFirstApproval as F, UpdateOrganizationDisplayInput as G, SignInInput as H, PlatformStatus as I, WorkspaceSelection as J, UpdateOrganizationTeamDisplayInput as K, ReceivedOrganizationInvitation as L, PlatformRoleApplied as M, PlatformRoleApproval as N, OrganizationWorkspaceSelection as O, PlatformRoleChangeRecentAuthenticationInput as P, ReceivedOrganizationInvitationPage as R, OrganizationPage as S, OrganizationTeamDisplay as T, SocialIdTokenInput as U, SendVerificationEmailInput as V, SocialIdTokenProvider as W, AuthErrorCode as X, AuthError as Y, AuthErrorStatus as Z, OrganizationDisplay as _, AuthPersistenceDriver as a, OrganizationMember as b, AuthUser as c, CreatedOrganizationMemberInvitation as d, CreatedOrganizationTeam as f, InvitationAcceptance as g, FinuevaAuthClient as h, AuthPersistence as i, PlatformRole as j, PersonalWorkspaceSelection as k, CanceledOrganizationInvitation as l, DriveCredentialInput as m, AuthClientOptions as n, AuthSession as o, DriveCredential as p, UpdateProfileInput as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreateOrganizationMemberInvitationInput as u, OrganizationInvitation as v, OrganizationTeam as w, OrganizationMemberPage as x, OrganizationInvitationPage as y, RecentAuthenticationStatus as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,
@@ -43,8 +43,8 @@
     "lint": "oxlint . --deny-warnings",
     "prepack": "pnpm build",
     "test": "pnpm test:unit && pnpm build && pnpm test:package",
-    "test:composition": "node scripts/test-composition.mjs",
-    "test:package": "node scripts/test-package.mjs",
+    "test:composition": "node scripts/test/composition/runner.mjs",
+    "test:package": "node scripts/test/package.mjs",
     "test:unit": "vitest run",
     "typecheck": "tsc --noEmit"
   },