@finueva/auth 0.12.0 → 0.14.0

package/README.md

@@ -88,6 +88,7 @@ The browser owns the session cookie. The SDK does not expose or persist it.
 | Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                             | Not available                          |
 | Verify an email               | `sendVerificationEmail()`                   | Not available                             | Not available                          |
 | List organizations            | `listOrganizations()`                       | `listOrganizations()`                     | `listOrganizations()`                  |
+| Read member authority         | `getOrganizationMemberAuthority()`          | `getOrganizationMemberAuthority()`        | `getOrganizationMemberAuthority()`     |
 | Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`                | `createOrganizationTeam()`             |
 | Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()`    | `createOrganizationMemberInvitation()` |
 | Resend a member invitation    | `resendOrganizationInvitation()`            | `resendOrganizationInvitation()` (cookie) | Not available                          |
@@ -225,7 +226,7 @@ import { createServerAuth } from "@finueva/auth/server";
 export async function handleRequest(request: Request): Promise<Response> {
   const auth = createServerAuth({
     authOrigin: "https://auth.finueva.com",
-    appOrigin: "https://files.finueva.com",
+    appOrigin: "https://app.heylomeet.com",
     request,
   });
 

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, G as UpdateOrganizationDisplayInput, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateProfileInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage } from "./types-Sh23XMKv.js";
+import { C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, W as SocialIdTokenInput, X as AuthError, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -45,6 +45,7 @@ interface DeviceAuthClient {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
@@ -68,4 +69,4 @@ interface DeviceAuthClient {
 }
 declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, createDeviceAuth };
+export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, createDeviceAuth };

package/dist/device.js

@@ -897,6 +897,44 @@ function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
 	return fromOrganizationReadAuthorityError(value, status);
 }
+function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
+	exact(value, [
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
+	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
+	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
+	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
+	return {
+		organizationId: value.organizationId,
+		actor,
+		target
+	};
+}
+function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
+	exact(value, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision",
+		...includesStatus ? ["status"] : []
+	]);
+	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
+	return {
+		memberId: value.memberId,
+		manualRole: value.manualRole,
+		role: value.role,
+		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
+	};
+}
+function normalizeAuthorityResultRevision(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	return value;
+}
 function mapError(code, status) {
 	if (code === "authentication_required") return {
 		code,
@@ -1476,6 +1514,11 @@ function createDeviceAuth(options) {
 				return Promise.reject(error);
 			}
 		},
+		async getOrganizationMemberAuthority(organizationId, memberId) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			return serializeAuthority(() => organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member)));
+		},
 		createOrganizationTeam(organizationId, name, idempotencyKey) {
 			let id;
 			let body;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as PlatformBootstrapRoleChangeInput, B as ResentOrganizationInvitation, C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, F as PlatformRoleFirstApproval, G as UpdateOrganizationDisplayInput, H as SignInInput, I as PlatformStatus, J as WorkspaceSelection, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, M as PlatformRoleApplied, N as PlatformRoleApproval, O as OrganizationWorkspaceSelection, P as PlatformRoleChangeRecentAuthenticationInput, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, V as SendVerificationEmailInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformRole, k as PersonalWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateProfileInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage, z as RecentAuthenticationStatus } from "./types-Sh23XMKv.js";
+import { A as PersonalWorkspaceSelection, B as RecentAuthenticationStatus, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, F as PlatformRoleChangeRecentAuthenticationInput, G as SocialIdTokenProvider, H as SendVerificationEmailInput, I as PlatformRoleFirstApproval, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, L as PlatformStatus, M as PlatformRole, N as PlatformRoleApplied, O as OrganizationTeamPage, P as PlatformRoleApproval, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, U as SignInInput, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformBootstrapRoleChangeInput, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -3382,6 +3382,24 @@ function normalizeOrganizationManualRoleChangeResult(value) {
 		...normalizeOrganizationAuthorityMemberOutcome(value, true)
 	};
 }
+function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
+	exact(value, [
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
+	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
+	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
+	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
+	return {
+		organizationId: value.organizationId,
+		actor,
+		target
+	};
+}
 function normalizeOrganizationOwnershipTransferResult(value) {
 	exact(value, [
 		"status",
@@ -4930,6 +4948,11 @@ function createAuthClient(options) {
 		async getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		async getOrganizationMemberAuthority(organizationId, memberId) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
+		},
 		async createOrganizationTeam(organizationId, name, idempotencyKey) {
 			const id = normalizeIdInput(organizationId);
 			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);

package/dist/server.d.ts

@@ -1,4 +1,22 @@
-import { B as ResentOrganizationInvitation, C as OrganizationPageInput, D as OrganizationTeamPage, E as OrganizationTeamMemberPage, G as UpdateOrganizationDisplayInput, J as WorkspaceSelection, K as UpdateOrganizationTeamDisplayInput, L as ReceivedOrganizationInvitation, O as OrganizationWorkspaceSelection, R as ReceivedOrganizationInvitationPage, S as OrganizationPage, T as OrganizationTeamDisplay, U as SocialIdTokenInput, W as SocialIdTokenProvider, X as AuthErrorCode, Y as AuthError, Z as AuthErrorStatus, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as PersonalWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationTeam, x as OrganizationMemberPage, y as OrganizationInvitationPage } from "./types-Sh23XMKv.js";
+import { A as PersonalWorkspaceSelection, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
+//#region src/provisioning.d.ts
+interface DriveProvisioningAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  now?: () => number;
+  timeoutMs?: number;
+}
+interface DriveProvisioningCredential {
+  tokenType: "Bearer";
+  token: string;
+  expiresAt: Date;
+}
+interface FinuevaDriveProvisioningAuth {
+  getDriveProvisioningCredential(clientAssertion: string): Promise<DriveProvisioningCredential>;
+}
+/** Service authority only. Never pass an incoming User request or session to this client. */
+declare function createDriveProvisioningAuth(options: DriveProvisioningAuthOptions): FinuevaDriveProvisioningAuth;
+//#endregion
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -22,6 +40,7 @@ interface FinuevaServerAuth {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
@@ -41,4 +60,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type FinuevaDriveProvisioningAuth, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createDriveProvisioningAuth, createServerAuth };

package/dist/server.js

@@ -211,269 +211,6 @@ var AuthError = class extends Error {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
-const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
-const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
-const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
-function jsonParseTransform(key, value) {
-	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
-		warnKeyDropped(key);
-		return;
-	}
-	return value;
-}
-function warnKeyDropped(key) {
-	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
-}
-function destr(value, options = {}) {
-	if (typeof value !== "string") return value;
-	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
-	const _value = value.trim();
-	if (_value.length <= 9) switch (_value.toLowerCase()) {
-		case "true": return true;
-		case "false": return false;
-		case "undefined": return;
-		case "null": return null;
-		case "nan": return NaN;
-		case "infinity": return Number.POSITIVE_INFINITY;
-		case "-infinity": return Number.NEGATIVE_INFINITY;
-	}
-	if (!JsonSigRx.test(value)) {
-		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
-		return value;
-	}
-	try {
-		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
-			if (options.strict) throw new Error("[destr] Possible prototype pollution");
-			return JSON.parse(value, jsonParseTransform);
-		}
-		return JSON.parse(value);
-	} catch (error) {
-		if (options.strict) throw error;
-		return value;
-	}
-}
-//#endregion
-//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
-var FetchError = class extends Error {
-	constructor(message, opts) {
-		super(message, opts);
-		this.name = "FetchError";
-		if (opts?.cause && !this.cause) this.cause = opts.cause;
-	}
-};
-function createFetchError(ctx) {
-	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
-	const method = ctx.request?.method || ctx.options?.method || "GET";
-	const url = ctx.request?.url || String(ctx.request) || "/";
-	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
-	for (const key of [
-		"request",
-		"options",
-		"response"
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx[key];
-	} });
-	for (const [key, refKey] of [
-		["data", "_data"],
-		["status", "status"],
-		["statusCode", "status"],
-		["statusText", "statusText"],
-		["statusMessage", "statusText"]
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx.response && ctx.response[refKey];
-	} });
-	return fetchError;
-}
-const payloadMethods = new Set(Object.freeze([
-	"PATCH",
-	"POST",
-	"PUT",
-	"DELETE"
-]));
-function isPayloadMethod(method = "GET") {
-	return payloadMethods.has(method.toUpperCase());
-}
-function isJSONSerializable(value) {
-	if (value === void 0) return false;
-	const t = typeof value;
-	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
-	if (t !== "object") return false;
-	if (Array.isArray(value)) return true;
-	if (value.buffer) return false;
-	if (value instanceof FormData || value instanceof URLSearchParams) return false;
-	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
-}
-const textTypes = new Set([
-	"image/svg",
-	"application/xml",
-	"application/xhtml",
-	"application/html"
-]);
-const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
-function detectResponseType(_contentType = "") {
-	if (!_contentType) return "json";
-	const contentType = _contentType.split(";").shift() || "";
-	if (JSON_RE.test(contentType)) return "json";
-	if (contentType === "text/event-stream") return "stream";
-	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
-	return "blob";
-}
-function resolveFetchOptions(request, input, defaults, Headers) {
-	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
-	let query;
-	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
-		...defaults?.params,
-		...defaults?.query,
-		...input?.params,
-		...input?.query
-	};
-	return {
-		...defaults,
-		...input,
-		query,
-		params: query,
-		headers
-	};
-}
-function mergeHeaders(input, defaults, Headers) {
-	if (!defaults) return new Headers(input);
-	const headers = new Headers(defaults);
-	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
-	return headers;
-}
-async function callHooks(context, hooks) {
-	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
-	else await hooks(context);
-}
-const retryStatusCodes = new Set([
-	408,
-	409,
-	425,
-	429,
-	500,
-	502,
-	503,
-	504
-]);
-const nullBodyResponses = new Set([
-	101,
-	204,
-	205,
-	304
-]);
-function createFetch(globalOptions = {}) {
-	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
-	async function onError(context) {
-		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
-		if (context.options.retry !== false && !isAbort) {
-			let retries;
-			if (typeof context.options.retry === "number") retries = context.options.retry;
-			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
-			const responseCode = context.response && context.response.status || 500;
-			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
-				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
-				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
-				return $fetchRaw(context.request, {
-					...context.options,
-					retry: retries - 1
-				});
-			}
-		}
-		const error = createFetchError(context);
-		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
-		throw error;
-	}
-	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
-		const context = {
-			request: _request,
-			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
-			response: void 0,
-			error: void 0
-		};
-		if (context.options.method) context.options.method = context.options.method.toUpperCase();
-		if (context.options.onRequest) {
-			await callHooks(context, context.options.onRequest);
-			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
-		}
-		if (typeof context.request === "string") {
-			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
-			if (context.options.query) {
-				context.request = withQuery(context.request, context.options.query);
-				delete context.options.query;
-			}
-			if ("query" in context.options) delete context.options.query;
-			if ("params" in context.options) delete context.options.params;
-		}
-		if (context.options.body && isPayloadMethod(context.options.method)) {
-			if (isJSONSerializable(context.options.body)) {
-				const contentType = context.options.headers.get("content-type");
-				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
-				if (!contentType) context.options.headers.set("content-type", "application/json");
-				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
-			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
-				if (!("duplex" in context.options)) context.options.duplex = "half";
-			}
-		}
-		let abortTimeout;
-		if (!context.options.signal && context.options.timeout) {
-			const controller = new AbortController();
-			abortTimeout = setTimeout(() => {
-				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
-				error.name = "TimeoutError";
-				error.code = 23;
-				controller.abort(error);
-			}, context.options.timeout);
-			context.options.signal = controller.signal;
-		}
-		try {
-			context.response = await fetch(context.request, context.options);
-		} catch (error) {
-			context.error = error;
-			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
-			return await onError(context);
-		} finally {
-			if (abortTimeout) clearTimeout(abortTimeout);
-		}
-		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
-			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
-			switch (responseType) {
-				case "json": {
-					const data = await context.response.text();
-					const parseFunction = context.options.parseResponse || destr;
-					context.response._data = parseFunction(data);
-					break;
-				}
-				case "stream":
-					context.response._data = context.response.body || context.response._bodyInit;
-					break;
-				default: context.response._data = await context.response[responseType]();
-			}
-		}
-		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
-		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
-			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
-			return await onError(context);
-		}
-		return context.response;
-	};
-	const $fetch = async function $fetch2(request, options) {
-		return (await $fetchRaw(request, options))._data;
-	};
-	$fetch.raw = $fetchRaw;
-	$fetch.native = (...args) => fetch(...args);
-	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
-		...globalOptions,
-		...customGlobalOptions,
-		defaults: {
-			...globalOptions.defaults,
-			...customGlobalOptions.defaults,
-			...defaultOptions
-		}
-	});
-	return $fetch;
-}
-//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
@@ -909,6 +646,44 @@ function fromOrganizationInvitationAdministrationError(value, status, retryAfter
 	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
+function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
+	exact(value, [
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (!isId(value.organizationId) || value.organizationId !== organizationId) throw authorityUnavailable();
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	const target = normalizeOrganizationAuthorityMemberOutcome(value.target);
+	if (target.memberId !== memberId || actor.manualRole !== "owner" && actor.manualRole !== "admin") throw authorityUnavailable();
+	for (const member of [actor, target]) if (member.manualRole === "member" ? member.role === "owner" : member.role !== member.manualRole) throw authorityUnavailable();
+	if (actor.memberId === target.memberId && (actor.manualRole !== target.manualRole || actor.role !== target.role || actor.authorityRevision !== target.authorityRevision)) throw authorityUnavailable();
+	return {
+		organizationId: value.organizationId,
+		actor,
+		target
+	};
+}
+function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
+	exact(value, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision",
+		...includesStatus ? ["status"] : []
+	]);
+	if (!isId(value.memberId) || value.manualRole !== "owner" && value.manualRole !== "admin" && value.manualRole !== "member" || value.role !== "owner" && value.role !== "admin" && value.role !== "member") throw authorityUnavailable();
+	return {
+		memberId: value.memberId,
+		manualRole: value.manualRole,
+		role: value.role,
+		authorityRevision: normalizeAuthorityResultRevision(value.authorityRevision)
+	};
+}
+function normalizeAuthorityResultRevision(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value >= Number.MAX_SAFE_INTEGER) throw authorityUnavailable();
+	return value;
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -986,45 +761,412 @@ function isId(value) {
 function exact(value, keys) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
-function boundedString(value, maximum) {
-	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+function boundedString(value, maximum) {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+}
+function role(value) {
+	return value === "owner" || value === "admin" || value === "member";
+}
+function nullableHttpsUrl(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
+	return value;
+}
+function responseDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const date = new Date(value);
+	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
+	return date;
+}
+function nullableCursor(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
+	return value;
+}
+function normalizeResponseId(value) {
+	if (!isId(value)) throw authorityUnavailable();
+	return value;
+}
+function unique(items, key) {
+	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
+	return items;
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/provisioning.ts
+const MAX_BYTES = 16 * 1024;
+const compactJwt = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function isCompactCredential(value) {
+	return typeof value === "string" && value.length + 7 <= MAX_BYTES && compactJwt.test(value);
+}
+function createDriveProvisioningAuth(options) {
+	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/drive-provisioning-credential");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	const now = options.now ?? Date.now;
+	let inFlight = false;
+	return { async getDriveProvisioningCredential(clientAssertion) {
+		if (!isCompactCredential(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight) throw new AuthError("state_conflict", 409);
+		inFlight = true;
+		const controller = new AbortController();
+		let reader;
+		let timer;
+		let exchangeStarted = false;
+		let authorityError;
+		try {
+			const startedAt = now();
+			if (!Number.isSafeInteger(startedAt) || startedAt < 0 || startedAt > 86399999997e5) throw authorityUnavailable();
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(authorityUnavailable());
+					controller.abort();
+					reader?.cancel().catch(() => {});
+				}, timeoutMs);
+			});
+			const exchange = async () => {
+				const response = await fetchImpl(url, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${clientAssertion}`,
+						accept: "application/json"
+					},
+					credentials: "omit",
+					cache: "no-store",
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					response.body?.cancel().catch(() => {});
+					throw authorityUnavailable();
+				}
+				if (!response.body) throw authorityUnavailable();
+				reader = response.body.getReader();
+				const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+				const length = response.headers.get("content-length");
+				if (contentType !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > MAX_BYTES)) throw authorityUnavailable();
+				const bytes = new Uint8Array(MAX_BYTES);
+				let size = 0;
+				while (true) {
+					const chunk = await reader.read();
+					if (chunk.done) break;
+					if (controller.signal.aborted || size + chunk.value.byteLength > MAX_BYTES) throw authorityUnavailable();
+					bytes.set(chunk.value, size);
+					size += chunk.value.byteLength;
+				}
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+				if (!value || typeof value !== "object" || Array.isArray(value)) throw authorityUnavailable();
+				const record = value;
+				if (response.status !== 200) {
+					if (Object.keys(record).length !== 2 || !("code" in record) || !("message" in record)) throw authorityUnavailable();
+					if (response.status === 401 && record.code === "UNAUTHORIZED" && record.message === "The ecosystem client assertion is invalid.") {
+						authorityError = new AuthError("authentication_required", 401);
+						throw authorityError;
+					}
+					const retryAfter = response.headers.get("retry-after");
+					if (response.status === 429 && record.code === "TOO_MANY_REQUESTS" && record.message === "Ecosystem credential exchanges are temporarily limited." && retryAfter !== null && /^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) {
+						authorityError = new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
+						throw authorityError;
+					}
+					throw authorityUnavailable();
+				}
+				if (Object.keys(record).length !== 3 || record.tokenType !== "Bearer" || record.expiresIn !== 300 || !isCompactCredential(record.token)) throw authorityUnavailable();
+				const expiresAt = new Date(Math.floor(startedAt / 1e3) * 1e3 + 3e5);
+				const completedAt = now();
+				if (!Number.isSafeInteger(completedAt) || completedAt < 0 || completedAt >= expiresAt.getTime()) throw authorityUnavailable();
+				return {
+					tokenType: "Bearer",
+					token: record.token,
+					expiresAt
+				};
+			};
+			exchangeStarted = true;
+			return await Promise.race([exchange().finally(() => {
+				inFlight = false;
+			}), deadline]);
+		} catch (error) {
+			if (authorityError && error === authorityError) throw authorityError;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+			reader?.cancel().catch(() => {});
+			if (!exchangeStarted) inFlight = false;
+		}
+	} };
+}
+//#endregion
+//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
+const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
+const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+function jsonParseTransform(key, value) {
+	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+		warnKeyDropped(key);
+		return;
+	}
+	return value;
+}
+function warnKeyDropped(key) {
+	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
+}
+function destr(value, options = {}) {
+	if (typeof value !== "string") return value;
+	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
+	const _value = value.trim();
+	if (_value.length <= 9) switch (_value.toLowerCase()) {
+		case "true": return true;
+		case "false": return false;
+		case "undefined": return;
+		case "null": return null;
+		case "nan": return NaN;
+		case "infinity": return Number.POSITIVE_INFINITY;
+		case "-infinity": return Number.NEGATIVE_INFINITY;
+	}
+	if (!JsonSigRx.test(value)) {
+		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
+		return value;
+	}
+	try {
+		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
+			if (options.strict) throw new Error("[destr] Possible prototype pollution");
+			return JSON.parse(value, jsonParseTransform);
+		}
+		return JSON.parse(value);
+	} catch (error) {
+		if (options.strict) throw error;
+		return value;
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
+var FetchError = class extends Error {
+	constructor(message, opts) {
+		super(message, opts);
+		this.name = "FetchError";
+		if (opts?.cause && !this.cause) this.cause = opts.cause;
+	}
+};
+function createFetchError(ctx) {
+	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
+	const method = ctx.request?.method || ctx.options?.method || "GET";
+	const url = ctx.request?.url || String(ctx.request) || "/";
+	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
+	for (const key of [
+		"request",
+		"options",
+		"response"
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx[key];
+	} });
+	for (const [key, refKey] of [
+		["data", "_data"],
+		["status", "status"],
+		["statusCode", "status"],
+		["statusText", "statusText"],
+		["statusMessage", "statusText"]
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx.response && ctx.response[refKey];
+	} });
+	return fetchError;
 }
-function role(value) {
-	return value === "owner" || value === "admin" || value === "member";
+const payloadMethods = new Set(Object.freeze([
+	"PATCH",
+	"POST",
+	"PUT",
+	"DELETE"
+]));
+function isPayloadMethod(method = "GET") {
+	return payloadMethods.has(method.toUpperCase());
 }
-function nullableHttpsUrl(value) {
-	if (value === null) return null;
-	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		throw authorityUnavailable();
-	}
-	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
-	return value;
+function isJSONSerializable(value) {
+	if (value === void 0) return false;
+	const t = typeof value;
+	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
+	if (t !== "object") return false;
+	if (Array.isArray(value)) return true;
+	if (value.buffer) return false;
+	if (value instanceof FormData || value instanceof URLSearchParams) return false;
+	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
 }
-function responseDate(value) {
-	if (typeof value !== "string") throw authorityUnavailable();
-	const date = new Date(value);
-	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
-	return date;
+const textTypes = new Set([
+	"image/svg",
+	"application/xml",
+	"application/xhtml",
+	"application/html"
+]);
+const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
+function detectResponseType(_contentType = "") {
+	if (!_contentType) return "json";
+	const contentType = _contentType.split(";").shift() || "";
+	if (JSON_RE.test(contentType)) return "json";
+	if (contentType === "text/event-stream") return "stream";
+	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
+	return "blob";
 }
-function nullableCursor(value) {
-	if (value === null) return null;
-	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
-	return value;
+function resolveFetchOptions(request, input, defaults, Headers) {
+	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
+	let query;
+	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
+		...defaults?.params,
+		...defaults?.query,
+		...input?.params,
+		...input?.query
+	};
+	return {
+		...defaults,
+		...input,
+		query,
+		params: query,
+		headers
+	};
 }
-function normalizeResponseId(value) {
-	if (!isId(value)) throw authorityUnavailable();
-	return value;
+function mergeHeaders(input, defaults, Headers) {
+	if (!defaults) return new Headers(input);
+	const headers = new Headers(defaults);
+	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
+	return headers;
 }
-function unique(items, key) {
-	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
-	return items;
+async function callHooks(context, hooks) {
+	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+	else await hooks(context);
 }
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+const retryStatusCodes = new Set([
+	408,
+	409,
+	425,
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+const nullBodyResponses = new Set([
+	101,
+	204,
+	205,
+	304
+]);
+function createFetch(globalOptions = {}) {
+	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
+	async function onError(context) {
+		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
+		if (context.options.retry !== false && !isAbort) {
+			let retries;
+			if (typeof context.options.retry === "number") retries = context.options.retry;
+			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
+			const responseCode = context.response && context.response.status || 500;
+			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
+				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
+				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
+				return $fetchRaw(context.request, {
+					...context.options,
+					retry: retries - 1
+				});
+			}
+		}
+		const error = createFetchError(context);
+		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
+		throw error;
+	}
+	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
+		const context = {
+			request: _request,
+			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
+			response: void 0,
+			error: void 0
+		};
+		if (context.options.method) context.options.method = context.options.method.toUpperCase();
+		if (context.options.onRequest) {
+			await callHooks(context, context.options.onRequest);
+			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
+		}
+		if (typeof context.request === "string") {
+			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
+			if (context.options.query) {
+				context.request = withQuery(context.request, context.options.query);
+				delete context.options.query;
+			}
+			if ("query" in context.options) delete context.options.query;
+			if ("params" in context.options) delete context.options.params;
+		}
+		if (context.options.body && isPayloadMethod(context.options.method)) {
+			if (isJSONSerializable(context.options.body)) {
+				const contentType = context.options.headers.get("content-type");
+				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
+				if (!contentType) context.options.headers.set("content-type", "application/json");
+				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
+			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
+				if (!("duplex" in context.options)) context.options.duplex = "half";
+			}
+		}
+		let abortTimeout;
+		if (!context.options.signal && context.options.timeout) {
+			const controller = new AbortController();
+			abortTimeout = setTimeout(() => {
+				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
+				error.name = "TimeoutError";
+				error.code = 23;
+				controller.abort(error);
+			}, context.options.timeout);
+			context.options.signal = controller.signal;
+		}
+		try {
+			context.response = await fetch(context.request, context.options);
+		} catch (error) {
+			context.error = error;
+			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
+			return await onError(context);
+		} finally {
+			if (abortTimeout) clearTimeout(abortTimeout);
+		}
+		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
+			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
+			switch (responseType) {
+				case "json": {
+					const data = await context.response.text();
+					const parseFunction = context.options.parseResponse || destr;
+					context.response._data = parseFunction(data);
+					break;
+				}
+				case "stream":
+					context.response._data = context.response.body || context.response._bodyInit;
+					break;
+				default: context.response._data = await context.response[responseType]();
+			}
+		}
+		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
+		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
+			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
+			return await onError(context);
+		}
+		return context.response;
+	};
+	const $fetch = async function $fetch2(request, options) {
+		return (await $fetchRaw(request, options))._data;
+	};
+	$fetch.raw = $fetchRaw;
+	$fetch.native = (...args) => fetch(...args);
+	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
+		...globalOptions,
+		...customGlobalOptions,
+		defaults: {
+			...globalOptions.defaults,
+			...customGlobalOptions.defaults,
+			...defaultOptions
+		}
+	});
+	return $fetch;
 }
 //#endregion
 //#region src/http.ts
@@ -1173,6 +1315,11 @@ function createServerAuth(options) {
 		getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		async getOrganizationMemberAuthority(organizationId, memberId) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
+		},
 		async createOrganizationTeam(organizationId, name, idempotencyKey) {
 			const id = normalizeIdInput(organizationId);
 			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);
@@ -1388,4 +1535,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createServerAuth };
+export { AuthError, createDriveProvisioningAuth, createServerAuth };

package/dist/{types-Sh23XMKv.d.ts → types-Dsu3nEaN.d.ts}

@@ -251,6 +251,11 @@ interface OrganizationManualRoleChangeResult {
   role: OrganizationManualRole;
   authorityRevision: number;
 }
+interface OrganizationMemberAuthority {
+  organizationId: string;
+  actor: Omit<OrganizationManualRoleChangeResult, "status">;
+  target: Omit<OrganizationManualRoleChangeResult, "status">;
+}
 interface OrganizationOwnershipTransferInput {
   outgoingOwnerMembershipId: string;
   successorMembershipId: string;
@@ -287,6 +292,7 @@ interface FinuevaAuthClient {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
@@ -316,4 +322,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { PlatformBootstrapRoleChangeInput as A, ResentOrganizationInvitation as B, OrganizationPageInput as C, OrganizationTeamPage as D, OrganizationTeamMemberPage as E, PlatformRoleFirstApproval as F, UpdateOrganizationDisplayInput as G, SignInInput as H, PlatformStatus as I, WorkspaceSelection as J, UpdateOrganizationTeamDisplayInput as K, ReceivedOrganizationInvitation as L, PlatformRoleApplied as M, PlatformRoleApproval as N, OrganizationWorkspaceSelection as O, PlatformRoleChangeRecentAuthenticationInput as P, ReceivedOrganizationInvitationPage as R, OrganizationPage as S, OrganizationTeamDisplay as T, SocialIdTokenInput as U, SendVerificationEmailInput as V, SocialIdTokenProvider as W, AuthErrorCode as X, AuthError as Y, AuthErrorStatus as Z, OrganizationDisplay as _, AuthPersistenceDriver as a, OrganizationMember as b, AuthUser as c, CreatedOrganizationMemberInvitation as d, CreatedOrganizationTeam as f, InvitationAcceptance as g, FinuevaAuthClient as h, AuthPersistence as i, PlatformRole as j, PersonalWorkspaceSelection as k, CanceledOrganizationInvitation as l, DriveCredentialInput as m, AuthClientOptions as n, AuthSession as o, DriveCredential as p, UpdateProfileInput as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreateOrganizationMemberInvitationInput as u, OrganizationInvitation as v, OrganizationTeam as w, OrganizationMemberPage as x, OrganizationInvitationPage as y, RecentAuthenticationStatus as z };
+export { PersonalWorkspaceSelection as A, RecentAuthenticationStatus as B, OrganizationPage as C, OrganizationTeamMemberPage as D, OrganizationTeamDisplay as E, PlatformRoleChangeRecentAuthenticationInput as F, SocialIdTokenProvider as G, SendVerificationEmailInput as H, PlatformRoleFirstApproval as I, UpdateProfileInput as J, UpdateOrganizationDisplayInput as K, PlatformStatus as L, PlatformRole as M, PlatformRoleApplied as N, OrganizationTeamPage as O, PlatformRoleApproval as P, AuthErrorStatus as Q, ReceivedOrganizationInvitation as R, OrganizationMemberPage as S, OrganizationTeam as T, SignInInput as U, ResentOrganizationInvitation as V, SocialIdTokenInput as W, AuthError as X, WorkspaceSelection as Y, AuthErrorCode as Z, OrganizationDisplay as _, AuthPersistenceDriver as a, OrganizationMember as b, AuthUser as c, CreatedOrganizationMemberInvitation as d, CreatedOrganizationTeam as f, InvitationAcceptance as g, FinuevaAuthClient as h, AuthPersistence as i, PlatformBootstrapRoleChangeInput as j, OrganizationWorkspaceSelection as k, CanceledOrganizationInvitation as l, DriveCredentialInput as m, AuthClientOptions as n, AuthSession as o, DriveCredential as p, UpdateOrganizationTeamDisplayInput as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreateOrganizationMemberInvitationInput as u, OrganizationInvitation as v, OrganizationPageInput as w, OrganizationMemberAuthority as x, OrganizationInvitationPage as y, ReceivedOrganizationInvitationPage as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,