@finueva/auth 0.13.0 → 0.14.1

package/dist/server.d.ts

@@ -1,4 +1,22 @@
 import { A as PersonalWorkspaceSelection, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
+//#region src/provisioning.d.ts
+interface DriveProvisioningAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  now?: () => number;
+  timeoutMs?: number;
+}
+interface DriveProvisioningCredential {
+  tokenType: "Bearer";
+  token: string;
+  expiresAt: Date;
+}
+interface FinuevaDriveProvisioningAuth {
+  getDriveProvisioningCredential(clientAssertion: string): Promise<DriveProvisioningCredential>;
+}
+/** Service authority only. Never pass an incoming User request or session to this client. */
+declare function createDriveProvisioningAuth(options: DriveProvisioningAuthOptions): FinuevaDriveProvisioningAuth;
+//#endregion
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -42,4 +60,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type FinuevaDriveProvisioningAuth, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createDriveProvisioningAuth, createServerAuth };

package/dist/server.js

@@ -211,269 +211,6 @@ var AuthError = class extends Error {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
-const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
-const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
-const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
-function jsonParseTransform(key, value) {
-	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
-		warnKeyDropped(key);
-		return;
-	}
-	return value;
-}
-function warnKeyDropped(key) {
-	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
-}
-function destr(value, options = {}) {
-	if (typeof value !== "string") return value;
-	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
-	const _value = value.trim();
-	if (_value.length <= 9) switch (_value.toLowerCase()) {
-		case "true": return true;
-		case "false": return false;
-		case "undefined": return;
-		case "null": return null;
-		case "nan": return NaN;
-		case "infinity": return Number.POSITIVE_INFINITY;
-		case "-infinity": return Number.NEGATIVE_INFINITY;
-	}
-	if (!JsonSigRx.test(value)) {
-		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
-		return value;
-	}
-	try {
-		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
-			if (options.strict) throw new Error("[destr] Possible prototype pollution");
-			return JSON.parse(value, jsonParseTransform);
-		}
-		return JSON.parse(value);
-	} catch (error) {
-		if (options.strict) throw error;
-		return value;
-	}
-}
-//#endregion
-//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
-var FetchError = class extends Error {
-	constructor(message, opts) {
-		super(message, opts);
-		this.name = "FetchError";
-		if (opts?.cause && !this.cause) this.cause = opts.cause;
-	}
-};
-function createFetchError(ctx) {
-	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
-	const method = ctx.request?.method || ctx.options?.method || "GET";
-	const url = ctx.request?.url || String(ctx.request) || "/";
-	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
-	for (const key of [
-		"request",
-		"options",
-		"response"
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx[key];
-	} });
-	for (const [key, refKey] of [
-		["data", "_data"],
-		["status", "status"],
-		["statusCode", "status"],
-		["statusText", "statusText"],
-		["statusMessage", "statusText"]
-	]) Object.defineProperty(fetchError, key, { get() {
-		return ctx.response && ctx.response[refKey];
-	} });
-	return fetchError;
-}
-const payloadMethods = new Set(Object.freeze([
-	"PATCH",
-	"POST",
-	"PUT",
-	"DELETE"
-]));
-function isPayloadMethod(method = "GET") {
-	return payloadMethods.has(method.toUpperCase());
-}
-function isJSONSerializable(value) {
-	if (value === void 0) return false;
-	const t = typeof value;
-	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
-	if (t !== "object") return false;
-	if (Array.isArray(value)) return true;
-	if (value.buffer) return false;
-	if (value instanceof FormData || value instanceof URLSearchParams) return false;
-	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
-}
-const textTypes = new Set([
-	"image/svg",
-	"application/xml",
-	"application/xhtml",
-	"application/html"
-]);
-const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
-function detectResponseType(_contentType = "") {
-	if (!_contentType) return "json";
-	const contentType = _contentType.split(";").shift() || "";
-	if (JSON_RE.test(contentType)) return "json";
-	if (contentType === "text/event-stream") return "stream";
-	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
-	return "blob";
-}
-function resolveFetchOptions(request, input, defaults, Headers) {
-	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
-	let query;
-	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
-		...defaults?.params,
-		...defaults?.query,
-		...input?.params,
-		...input?.query
-	};
-	return {
-		...defaults,
-		...input,
-		query,
-		params: query,
-		headers
-	};
-}
-function mergeHeaders(input, defaults, Headers) {
-	if (!defaults) return new Headers(input);
-	const headers = new Headers(defaults);
-	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
-	return headers;
-}
-async function callHooks(context, hooks) {
-	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
-	else await hooks(context);
-}
-const retryStatusCodes = new Set([
-	408,
-	409,
-	425,
-	429,
-	500,
-	502,
-	503,
-	504
-]);
-const nullBodyResponses = new Set([
-	101,
-	204,
-	205,
-	304
-]);
-function createFetch(globalOptions = {}) {
-	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
-	async function onError(context) {
-		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
-		if (context.options.retry !== false && !isAbort) {
-			let retries;
-			if (typeof context.options.retry === "number") retries = context.options.retry;
-			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
-			const responseCode = context.response && context.response.status || 500;
-			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
-				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
-				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
-				return $fetchRaw(context.request, {
-					...context.options,
-					retry: retries - 1
-				});
-			}
-		}
-		const error = createFetchError(context);
-		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
-		throw error;
-	}
-	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
-		const context = {
-			request: _request,
-			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
-			response: void 0,
-			error: void 0
-		};
-		if (context.options.method) context.options.method = context.options.method.toUpperCase();
-		if (context.options.onRequest) {
-			await callHooks(context, context.options.onRequest);
-			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
-		}
-		if (typeof context.request === "string") {
-			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
-			if (context.options.query) {
-				context.request = withQuery(context.request, context.options.query);
-				delete context.options.query;
-			}
-			if ("query" in context.options) delete context.options.query;
-			if ("params" in context.options) delete context.options.params;
-		}
-		if (context.options.body && isPayloadMethod(context.options.method)) {
-			if (isJSONSerializable(context.options.body)) {
-				const contentType = context.options.headers.get("content-type");
-				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
-				if (!contentType) context.options.headers.set("content-type", "application/json");
-				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
-			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
-				if (!("duplex" in context.options)) context.options.duplex = "half";
-			}
-		}
-		let abortTimeout;
-		if (!context.options.signal && context.options.timeout) {
-			const controller = new AbortController();
-			abortTimeout = setTimeout(() => {
-				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
-				error.name = "TimeoutError";
-				error.code = 23;
-				controller.abort(error);
-			}, context.options.timeout);
-			context.options.signal = controller.signal;
-		}
-		try {
-			context.response = await fetch(context.request, context.options);
-		} catch (error) {
-			context.error = error;
-			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
-			return await onError(context);
-		} finally {
-			if (abortTimeout) clearTimeout(abortTimeout);
-		}
-		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
-			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
-			switch (responseType) {
-				case "json": {
-					const data = await context.response.text();
-					const parseFunction = context.options.parseResponse || destr;
-					context.response._data = parseFunction(data);
-					break;
-				}
-				case "stream":
-					context.response._data = context.response.body || context.response._bodyInit;
-					break;
-				default: context.response._data = await context.response[responseType]();
-			}
-		}
-		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
-		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
-			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
-			return await onError(context);
-		}
-		return context.response;
-	};
-	const $fetch = async function $fetch2(request, options) {
-		return (await $fetchRaw(request, options))._data;
-	};
-	$fetch.raw = $fetchRaw;
-	$fetch.native = (...args) => fetch(...args);
-	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
-		...globalOptions,
-		...customGlobalOptions,
-		defaults: {
-			...globalOptions.defaults,
-			...customGlobalOptions.defaults,
-			...defaultOptions
-		}
-	});
-	return $fetch;
-}
-//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
@@ -1024,45 +761,412 @@ function isId(value) {
 function exact(value, keys) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
-function boundedString(value, maximum) {
-	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+function boundedString(value, maximum) {
+	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= maximum;
+}
+function role(value) {
+	return value === "owner" || value === "admin" || value === "member";
+}
+function nullableHttpsUrl(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
+	return value;
+}
+function responseDate(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const date = new Date(value);
+	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
+	return date;
+}
+function nullableCursor(value) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
+	return value;
+}
+function normalizeResponseId(value) {
+	if (!isId(value)) throw authorityUnavailable();
+	return value;
+}
+function unique(items, key) {
+	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
+	return items;
+}
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/provisioning.ts
+const MAX_BYTES = 16 * 1024;
+const compactJwt = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function isCompactCredential(value) {
+	return typeof value === "string" && value.length + 7 <= MAX_BYTES && compactJwt.test(value);
+}
+function createDriveProvisioningAuth(options) {
+	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/drive-provisioning-credential");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	const now = options.now ?? Date.now;
+	let inFlight = false;
+	return { async getDriveProvisioningCredential(clientAssertion) {
+		if (!isCompactCredential(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight) throw new AuthError("state_conflict", 409);
+		inFlight = true;
+		const controller = new AbortController();
+		let reader;
+		let timer;
+		let exchangeStarted = false;
+		let authorityError;
+		try {
+			const startedAt = now();
+			if (!Number.isSafeInteger(startedAt) || startedAt < 0 || startedAt > 86399999997e5) throw authorityUnavailable();
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(authorityUnavailable());
+					controller.abort();
+					reader?.cancel().catch(() => {});
+				}, timeoutMs);
+			});
+			const exchange = async () => {
+				const response = await fetchImpl(url, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${clientAssertion}`,
+						accept: "application/json"
+					},
+					credentials: "omit",
+					cache: "no-store",
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					response.body?.cancel().catch(() => {});
+					throw authorityUnavailable();
+				}
+				if (!response.body) throw authorityUnavailable();
+				reader = response.body.getReader();
+				const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+				const length = response.headers.get("content-length");
+				if (contentType !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > MAX_BYTES)) throw authorityUnavailable();
+				const bytes = new Uint8Array(MAX_BYTES);
+				let size = 0;
+				while (true) {
+					const chunk = await reader.read();
+					if (chunk.done) break;
+					if (controller.signal.aborted || size + chunk.value.byteLength > MAX_BYTES) throw authorityUnavailable();
+					bytes.set(chunk.value, size);
+					size += chunk.value.byteLength;
+				}
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+				if (!value || typeof value !== "object" || Array.isArray(value)) throw authorityUnavailable();
+				const record = value;
+				if (response.status !== 200) {
+					if (Object.keys(record).length !== 2 || !("code" in record) || !("message" in record)) throw authorityUnavailable();
+					if (response.status === 401 && record.code === "UNAUTHORIZED" && record.message === "The ecosystem client assertion is invalid.") {
+						authorityError = new AuthError("authentication_required", 401);
+						throw authorityError;
+					}
+					const retryAfter = response.headers.get("retry-after");
+					if (response.status === 429 && record.code === "TOO_MANY_REQUESTS" && record.message === "Ecosystem credential exchanges are temporarily limited." && retryAfter !== null && /^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) {
+						authorityError = new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
+						throw authorityError;
+					}
+					throw authorityUnavailable();
+				}
+				if (Object.keys(record).length !== 3 || record.tokenType !== "Bearer" || record.expiresIn !== 300 || !isCompactCredential(record.token)) throw authorityUnavailable();
+				const expiresAt = new Date(Math.floor(startedAt / 1e3) * 1e3 + 3e5);
+				const completedAt = now();
+				if (!Number.isSafeInteger(completedAt) || completedAt < 0 || completedAt >= expiresAt.getTime()) throw authorityUnavailable();
+				return {
+					tokenType: "Bearer",
+					token: record.token,
+					expiresAt
+				};
+			};
+			exchangeStarted = true;
+			return await Promise.race([exchange().finally(() => {
+				inFlight = false;
+			}), deadline]);
+		} catch (error) {
+			if (authorityError && error === authorityError) throw authorityError;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+			reader?.cancel().catch(() => {});
+			if (!exchangeStarted) inFlight = false;
+		}
+	} };
+}
+//#endregion
+//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
+const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
+const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+function jsonParseTransform(key, value) {
+	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+		warnKeyDropped(key);
+		return;
+	}
+	return value;
+}
+function warnKeyDropped(key) {
+	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
+}
+function destr(value, options = {}) {
+	if (typeof value !== "string") return value;
+	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
+	const _value = value.trim();
+	if (_value.length <= 9) switch (_value.toLowerCase()) {
+		case "true": return true;
+		case "false": return false;
+		case "undefined": return;
+		case "null": return null;
+		case "nan": return NaN;
+		case "infinity": return Number.POSITIVE_INFINITY;
+		case "-infinity": return Number.NEGATIVE_INFINITY;
+	}
+	if (!JsonSigRx.test(value)) {
+		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
+		return value;
+	}
+	try {
+		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
+			if (options.strict) throw new Error("[destr] Possible prototype pollution");
+			return JSON.parse(value, jsonParseTransform);
+		}
+		return JSON.parse(value);
+	} catch (error) {
+		if (options.strict) throw error;
+		return value;
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/shared/ofetch.CWycOUEr.mjs
+var FetchError = class extends Error {
+	constructor(message, opts) {
+		super(message, opts);
+		this.name = "FetchError";
+		if (opts?.cause && !this.cause) this.cause = opts.cause;
+	}
+};
+function createFetchError(ctx) {
+	const errorMessage = ctx.error?.message || ctx.error?.toString() || "";
+	const method = ctx.request?.method || ctx.options?.method || "GET";
+	const url = ctx.request?.url || String(ctx.request) || "/";
+	const fetchError = new FetchError(`${`[${method}] ${JSON.stringify(url)}`}: ${ctx.response ? `${ctx.response.status} ${ctx.response.statusText}` : "<no response>"}${errorMessage ? ` ${errorMessage}` : ""}`, ctx.error ? { cause: ctx.error } : void 0);
+	for (const key of [
+		"request",
+		"options",
+		"response"
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx[key];
+	} });
+	for (const [key, refKey] of [
+		["data", "_data"],
+		["status", "status"],
+		["statusCode", "status"],
+		["statusText", "statusText"],
+		["statusMessage", "statusText"]
+	]) Object.defineProperty(fetchError, key, { get() {
+		return ctx.response && ctx.response[refKey];
+	} });
+	return fetchError;
 }
-function role(value) {
-	return value === "owner" || value === "admin" || value === "member";
+const payloadMethods = new Set(Object.freeze([
+	"PATCH",
+	"POST",
+	"PUT",
+	"DELETE"
+]));
+function isPayloadMethod(method = "GET") {
+	return payloadMethods.has(method.toUpperCase());
 }
-function nullableHttpsUrl(value) {
-	if (value === null) return null;
-	if (typeof value !== "string" || value.length > 2048) throw authorityUnavailable();
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		throw authorityUnavailable();
-	}
-	if (url.protocol !== "https:" || url.username || url.password || url.toString() !== value) throw authorityUnavailable();
-	return value;
+function isJSONSerializable(value) {
+	if (value === void 0) return false;
+	const t = typeof value;
+	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
+	if (t !== "object") return false;
+	if (Array.isArray(value)) return true;
+	if (value.buffer) return false;
+	if (value instanceof FormData || value instanceof URLSearchParams) return false;
+	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
 }
-function responseDate(value) {
-	if (typeof value !== "string") throw authorityUnavailable();
-	const date = new Date(value);
-	if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) throw authorityUnavailable();
-	return date;
+const textTypes = new Set([
+	"image/svg",
+	"application/xml",
+	"application/xhtml",
+	"application/html"
+]);
+const JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
+function detectResponseType(_contentType = "") {
+	if (!_contentType) return "json";
+	const contentType = _contentType.split(";").shift() || "";
+	if (JSON_RE.test(contentType)) return "json";
+	if (contentType === "text/event-stream") return "stream";
+	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
+	return "blob";
 }
-function nullableCursor(value) {
-	if (value === null) return null;
-	if (typeof value !== "string" || value.length < 1 || value.length > 820 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) throw authorityUnavailable();
-	return value;
+function resolveFetchOptions(request, input, defaults, Headers) {
+	const headers = mergeHeaders(input?.headers ?? request?.headers, defaults?.headers, Headers);
+	let query;
+	if (defaults?.query || defaults?.params || input?.params || input?.query) query = {
+		...defaults?.params,
+		...defaults?.query,
+		...input?.params,
+		...input?.query
+	};
+	return {
+		...defaults,
+		...input,
+		query,
+		params: query,
+		headers
+	};
 }
-function normalizeResponseId(value) {
-	if (!isId(value)) throw authorityUnavailable();
-	return value;
+function mergeHeaders(input, defaults, Headers) {
+	if (!defaults) return new Headers(input);
+	const headers = new Headers(defaults);
+	if (input) for (const [key, value] of Symbol.iterator in input || Array.isArray(input) ? input : new Headers(input)) headers.set(key, value);
+	return headers;
 }
-function unique(items, key) {
-	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
-	return items;
+async function callHooks(context, hooks) {
+	if (hooks) if (Array.isArray(hooks)) for (const hook of hooks) await hook(context);
+	else await hooks(context);
 }
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+const retryStatusCodes = new Set([
+	408,
+	409,
+	425,
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+const nullBodyResponses = new Set([
+	101,
+	204,
+	205,
+	304
+]);
+function createFetch(globalOptions = {}) {
+	const { fetch = globalThis.fetch, Headers = globalThis.Headers, AbortController = globalThis.AbortController } = globalOptions;
+	async function onError(context) {
+		const isAbort = context.error && context.error.name === "AbortError" && !context.options.timeout || false;
+		if (context.options.retry !== false && !isAbort) {
+			let retries;
+			if (typeof context.options.retry === "number") retries = context.options.retry;
+			else retries = isPayloadMethod(context.options.method) ? 0 : 1;
+			const responseCode = context.response && context.response.status || 500;
+			if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
+				const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
+				if (retryDelay > 0) await new Promise((resolve) => setTimeout(resolve, retryDelay));
+				return $fetchRaw(context.request, {
+					...context.options,
+					retry: retries - 1
+				});
+			}
+		}
+		const error = createFetchError(context);
+		if (Error.captureStackTrace) Error.captureStackTrace(error, $fetchRaw);
+		throw error;
+	}
+	const $fetchRaw = async function $fetchRaw2(_request, _options = {}) {
+		const context = {
+			request: _request,
+			options: resolveFetchOptions(_request, _options, globalOptions.defaults, Headers),
+			response: void 0,
+			error: void 0
+		};
+		if (context.options.method) context.options.method = context.options.method.toUpperCase();
+		if (context.options.onRequest) {
+			await callHooks(context, context.options.onRequest);
+			if (!(context.options.headers instanceof Headers)) context.options.headers = new Headers(context.options.headers || {});
+		}
+		if (typeof context.request === "string") {
+			if (context.options.baseURL) context.request = withBase(context.request, context.options.baseURL);
+			if (context.options.query) {
+				context.request = withQuery(context.request, context.options.query);
+				delete context.options.query;
+			}
+			if ("query" in context.options) delete context.options.query;
+			if ("params" in context.options) delete context.options.params;
+		}
+		if (context.options.body && isPayloadMethod(context.options.method)) {
+			if (isJSONSerializable(context.options.body)) {
+				const contentType = context.options.headers.get("content-type");
+				if (typeof context.options.body !== "string") context.options.body = contentType === "application/x-www-form-urlencoded" ? new URLSearchParams(context.options.body).toString() : JSON.stringify(context.options.body);
+				if (!contentType) context.options.headers.set("content-type", "application/json");
+				if (!context.options.headers.has("accept")) context.options.headers.set("accept", "application/json");
+			} else if ("pipeTo" in context.options.body && typeof context.options.body.pipeTo === "function" || typeof context.options.body.pipe === "function") {
+				if (!("duplex" in context.options)) context.options.duplex = "half";
+			}
+		}
+		let abortTimeout;
+		if (!context.options.signal && context.options.timeout) {
+			const controller = new AbortController();
+			abortTimeout = setTimeout(() => {
+				const error = new Error("[TimeoutError]: The operation was aborted due to timeout");
+				error.name = "TimeoutError";
+				error.code = 23;
+				controller.abort(error);
+			}, context.options.timeout);
+			context.options.signal = controller.signal;
+		}
+		try {
+			context.response = await fetch(context.request, context.options);
+		} catch (error) {
+			context.error = error;
+			if (context.options.onRequestError) await callHooks(context, context.options.onRequestError);
+			return await onError(context);
+		} finally {
+			if (abortTimeout) clearTimeout(abortTimeout);
+		}
+		if ((context.response.body || context.response._bodyInit) && !nullBodyResponses.has(context.response.status) && context.options.method !== "HEAD") {
+			const responseType = (context.options.parseResponse ? "json" : context.options.responseType) || detectResponseType(context.response.headers.get("content-type") || "");
+			switch (responseType) {
+				case "json": {
+					const data = await context.response.text();
+					const parseFunction = context.options.parseResponse || destr;
+					context.response._data = parseFunction(data);
+					break;
+				}
+				case "stream":
+					context.response._data = context.response.body || context.response._bodyInit;
+					break;
+				default: context.response._data = await context.response[responseType]();
+			}
+		}
+		if (context.options.onResponse) await callHooks(context, context.options.onResponse);
+		if (!context.options.ignoreResponseError && context.response.status >= 400 && context.response.status < 600) {
+			if (context.options.onResponseError) await callHooks(context, context.options.onResponseError);
+			return await onError(context);
+		}
+		return context.response;
+	};
+	const $fetch = async function $fetch2(request, options) {
+		return (await $fetchRaw(request, options))._data;
+	};
+	$fetch.raw = $fetchRaw;
+	$fetch.native = (...args) => fetch(...args);
+	$fetch.create = (defaultOptions = {}, customGlobalOptions = {}) => createFetch({
+		...globalOptions,
+		...customGlobalOptions,
+		defaults: {
+			...globalOptions.defaults,
+			...customGlobalOptions.defaults,
+			...defaultOptions
+		}
+	});
+	return $fetch;
 }
 //#endregion
 //#region src/http.ts
@@ -1390,7 +1494,11 @@ function createServerAuth(options) {
 				response = await fetchImpl(joinURL(authOrigin, "api/v1/auth/sign-out"), {
 					method: "POST",
 					credentials,
-					headers: authHeaders(),
+					headers: {
+						...authHeaders(),
+						"content-type": "application/json; charset=utf-8"
+					},
+					body: "{}",
 					redirect: "manual",
 					signal: AbortSignal.timeout(timeoutMs)
 				});
@@ -1431,4 +1539,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createServerAuth };
+export { AuthError, createDriveProvisioningAuth, createServerAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,