@finueva/auth 0.12.0 → 0.13.0

package/README.md

@@ -88,6 +88,7 @@ The browser owns the session cookie. The SDK does not expose or persist it.
 | Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                             | Not available                          |
 | Verify an email               | `sendVerificationEmail()`                   | Not available                             | Not available                          |
 | List organizations            | `listOrganizations()`                       | `listOrganizations()`                     | `listOrganizations()`                  |
+| Read member authority         | `getOrganizationMemberAuthority()`          | `getOrganizationMemberAuthority()`        | `getOrganizationMemberAuthority()`     |
 | Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`                | `createOrganizationTeam()`             |
 | Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()`    | `createOrganizationMemberInvitation()` |
 | Resend a member invitation    | `resendOrganizationInvitation()`            | `resendOrganizationInvitation()` (cookie) | Not available                          |
@@ -225,7 +226,7 @@ import { createServerAuth } from "@finueva/auth/server";
 export async function handleRequest(request: Request): Promise<Response> {
   const auth = createServerAuth({
     authOrigin: "https://auth.finueva.com",
-    appOrigin: "https://files.finueva.com",
+    appOrigin: "https://app.heylomeet.com",
     request,
   });
 

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, G as UpdateOrganizationDisplayInput, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateProfileInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage } from "./types-Sh23XMKv.js";
+import { C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, W as SocialIdTokenInput, X as AuthError, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -45,6 +45,7 @@ interface DeviceAuthClient {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
@@ -68,4 +69,4 @@ interface DeviceAuthClient {
 }
 declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, createDeviceAuth };
+export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, createDeviceAuth };

package/dist/device.js

@@ -897,6 +897,44 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
+	exact(value, [
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
+	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
+	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
+	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
+	return {
+		organizationId: value.organizationId,
+		actor,
+		target
+	};
+}
+function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
+	exact(value, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision",
+		...includesStatus ? ["status"] : []
+	]);
+	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
+	return {
+		memberId: value.memberId,
+		manualRole: value.manualRole,
+		role: value.role,
+		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
+	};
+}
+function normalizeAuthorityResultRevision(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	return value;
+}
 function mapError(code, status) {
 	if (code === "authentication_required") return {
 		code,
@@ -1476,6 +1514,11 @@ function createDeviceAuth(options) {
 				return Promise.reject(error);
 			}
 		},
+		async getOrganizationMemberAuthority(organizationId, memberId) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			return serializeAuthority(() => organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member)));
+		},
 		createOrganizationTeam(organizationId, name, idempotencyKey) {
 			let id;
 			let body;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as PlatformBootstrapRoleChangeInput, B as ResentOrganizationInvitation, C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, F as PlatformRoleFirstApproval, G as UpdateOrganizationDisplayInput, H as SignInInput, I as PlatformStatus, J as WorkspaceSelection, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, M as PlatformRoleApplied, N as PlatformRoleApproval, O as OrganizationWorkspaceSelection, P as PlatformRoleChangeRecentAuthenticationInput, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, V as SendVerificationEmailInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformRole, k as PersonalWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateProfileInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage, z as RecentAuthenticationStatus } from "./types-Sh23XMKv.js";
+import { A as PersonalWorkspaceSelection, B as RecentAuthenticationStatus, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, F as PlatformRoleChangeRecentAuthenticationInput, G as SocialIdTokenProvider, H as SendVerificationEmailInput, I as PlatformRoleFirstApproval, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, L as PlatformStatus, M as PlatformRole, N as PlatformRoleApplied, O as OrganizationTeamPage, P as PlatformRoleApproval, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, U as SignInInput, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformBootstrapRoleChangeInput, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -3382,6 +3382,24 @@ function normalizeOrganizationManualRoleChangeResult(value) {
 		...normalizeOrganizationAuthorityMemberOutcome(value, true)
 	};
 }
+function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
+	exact(value, [
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
+	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
+	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
+	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
+	return {
+		organizationId: value.organizationId,
+		actor,
+		target
+	};
+}
 function normalizeOrganizationOwnershipTransferResult(value) {
 	exact(value, [
 		"status",
@@ -4930,6 +4948,11 @@ function createAuthClient(options) {
 		async getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		async getOrganizationMemberAuthority(organizationId, memberId) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
+		},
 		async createOrganizationTeam(organizationId, name, idempotencyKey) {
 			const id = normalizeIdInput(organizationId);
 			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { B as ResentOrganizationInvitation, C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, G as UpdateOrganizationDisplayInput, J as WorkspaceSelection, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, O as OrganizationWorkspaceSelection, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as PersonalWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage } from "./types-Sh23XMKv.js";
+import { A as PersonalWorkspaceSelection, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -22,6 +22,7 @@ interface FinuevaServerAuth {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
@@ -41,4 +42,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createServerAuth };

package/dist/server.js

@@ -909,6 +909,44 @@ function fromOrganizationInvitationAdministrationError(value, status, retryAfter
 	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
+function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
+	exact(value, [
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
+	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
+	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
+	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
+	return {
+		organizationId: value.organizationId,
+		actor,
+		target
+	};
+}
+function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
+	exact(value, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision",
+		...includesStatus ? ["status"] : []
+	]);
+	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
+	return {
+		memberId: value.memberId,
+		manualRole: value.manualRole,
+		role: value.role,
+		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
+	};
+}
+function normalizeAuthorityResultRevision(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	return value;
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -1173,6 +1211,11 @@ function createServerAuth(options) {
 		getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		async getOrganizationMemberAuthority(organizationId, memberId) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
+		},
 		async createOrganizationTeam(organizationId, name, idempotencyKey) {
 			const id = normalizeIdInput(organizationId);
 			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);

package/dist/{types-Sh23XMKv.d.ts → types-Dsu3nEaN.d.ts}

@@ -251,6 +251,11 @@ interface OrganizationManualRoleChangeResult {
   role: OrganizationManualRole;
   authorityRevision: number;
 }
+interface OrganizationMemberAuthority {
+  organizationId: string;
+  actor: Omit<OrganizationManualRoleChangeResult, "status">;
+  target: Omit<OrganizationManualRoleChangeResult, "status">;
+}
 interface OrganizationOwnershipTransferInput {
   outgoingOwnerMembershipId: string;
   successorMembershipId: string;
@@ -287,6 +292,7 @@ interface FinuevaAuthClient {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
@@ -316,4 +322,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { PlatformBootstrapRoleChangeInput as A, ResentOrganizationInvitation as B, OrganizationPageInput as C, OrganizationTeamPage as D, OrganizationTeamMemberPage as E, PlatformRoleFirstApproval as F, UpdateOrganizationDisplayInput as G, SignInInput as H, PlatformStatus as I, WorkspaceSelection as J, UpdateOrganizationTeamDisplayInput as K, ReceivedOrganizationInvitation as L, PlatformRoleApplied as M, PlatformRoleApproval as N, OrganizationWorkspaceSelection as O, PlatformRoleChangeRecentAuthenticationInput as P, ReceivedOrganizationInvitationPage as R, OrganizationPage as S, OrganizationTeamDisplay as T, SocialIdTokenInput as U, SendVerificationEmailInput as V, SocialIdTokenProvider as W, AuthErrorCode as X, AuthError as Y, AuthErrorStatus as Z, OrganizationDisplay as _, AuthPersistenceDriver as a, OrganizationMember as b, AuthUser as c, CreatedOrganizationMemberInvitation as d, CreatedOrganizationTeam as f, InvitationAcceptance as g, FinuevaAuthClient as h, AuthPersistence as i, PlatformRole as j, PersonalWorkspaceSelection as k, CanceledOrganizationInvitation as l, DriveCredentialInput as m, AuthClientOptions as n, AuthSession as o, DriveCredential as p, UpdateProfileInput as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreateOrganizationMemberInvitationInput as u, OrganizationInvitation as v, OrganizationTeam as w, OrganizationMemberPage as x, OrganizationInvitationPage as y, RecentAuthenticationStatus as z };
+export { PersonalWorkspaceSelection as A, RecentAuthenticationStatus as B, OrganizationPage as C, OrganizationTeamMemberPage as D, OrganizationTeamDisplay as E, PlatformRoleChangeRecentAuthenticationInput as F, SocialIdTokenProvider as G, SendVerificationEmailInput as H, PlatformRoleFirstApproval as I, UpdateProfileInput as J, UpdateOrganizationDisplayInput as K, PlatformStatus as L, PlatformRole as M, PlatformRoleApplied as N, OrganizationTeamPage as O, PlatformRoleApproval as P, AuthErrorStatus as Q, ReceivedOrganizationInvitation as R, OrganizationMemberPage as S, OrganizationTeam as T, SignInInput as U, ResentOrganizationInvitation as V, SocialIdTokenInput as W, AuthError as X, WorkspaceSelection as Y, AuthErrorCode as Z, OrganizationDisplay as _, AuthPersistenceDriver as a, OrganizationMember as b, AuthUser as c, CreatedOrganizationMemberInvitation as d, CreatedOrganizationTeam as f, InvitationAcceptance as g, FinuevaAuthClient as h, AuthPersistence as i, PlatformBootstrapRoleChangeInput as j, OrganizationWorkspaceSelection as k, CanceledOrganizationInvitation as l, DriveCredentialInput as m, AuthClientOptions as n, AuthSession as o, DriveCredential as p, UpdateOrganizationTeamDisplayInput as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreateOrganizationMemberInvitationInput as u, OrganizationInvitation as v, OrganizationPageInput as w, OrganizationMemberAuthority as x, OrganizationInvitationPage as y, ReceivedOrganizationInvitationPage as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,