@finueva/auth 0.14.0 → 0.15.0

package/README.md

@@ -254,6 +254,36 @@ return new Response(null, { status: 303, headers });
 
 Call `applyCookies()` after server `signOut()`, `acceptInvitation()`, and `signInWithSocialIdToken()`.
 
+## Resolve A Drive Recipient
+
+Use the separate server client. Before lookup, Drive must check the caller's current permission to manage the item's shares. Recipient resolution does not grant file access.
+
+```ts
+import { createDriveRecipientAuth } from "@finueva/auth/server";
+
+const recipients = createDriveRecipientAuth({
+  authOrigin: "https://auth.finueva.com",
+  timeoutMs: 10_000,
+});
+
+const recipient = await recipients.resolveRecipient(
+  { email: "ada@example.com" },
+  clientAssertion, // Generate a new service assertion for this request.
+);
+```
+
+The result contains only `{ userId, name, email }`. The SDK trims and lowercases the exact email input. It accepts no additional input fields. Email has a 320-byte UTF-8 limit. The JSON request has a 1024-byte limit. The response has a 4096-byte limit. The canonical ID contains 1 to 128 URL-safe characters. The nonempty name has a 1024-byte UTF-8 limit. A response email must be normalized and match the requested email.
+
+The caller generates one Ed25519 assertion with `typ: "finueva-drive-recipient-assertion+jwt"` and the registered JWK-thumbprint `kid`. Set `aud` to the exact Auth endpoint, such as `https://auth.finueva.com/api/v1/auth/drive-share-recipients/resolve`. Set `iss` and `sub` to the same registered service ID. Include the registered `environment`, `ver: 1`, `principal_type: "ecosystem-service"`, a new bounded `jti`, and `exp = iat + 60` in seconds. Auth permits 30 seconds of clock tolerance. A provisioning assertion cannot replace this assertion. The SDK accepts no keys. Auth verifies the assertion; the SDK checks only its compact syntax and the 16 KiB bearer-header limit.
+
+This client sends no cookies or Origin. It follows no redirects, retains no recipient cache, and makes no automatic retries. It permits one active request per client and no queue. The default deadline is 10 seconds. `timeoutMs` accepts an integer from 1 to 60000. If a custom transport ignores abort, the client rejects new calls until that transport settles. A custom `fetch` must preserve the request's credential and redirect restrictions.
+
+After a lost response or failure, use a new assertion for an explicit retry. Auth can consume an assertion even when the request fails. Missing or ineligible recipients return `AuthError` with `recipient_unavailable` and status 404. Exact invalid-request responses map to `invalid_request` with status 400 or 413. Invalid assertions map to `authentication_required` with status 401. Rate limits map to `auth_request_rate_limited` with status 429 and `retryAfterSeconds` from 1 to 60. Invalid responses, transport failures, and service failures map to `identity_authority_unavailable` with status 503. An overlapping call returns `state_conflict` with status 409. Error messages contain no request values.
+
+Malformed assertion syntax fails locally with `invalid_request` and status 400. An exact `405 METHOD_NOT_ALLOWED` response with message `METHOD_NOT_ALLOWED` maps to `invalid_request` with status 405. Other non-contract errors fail closed with status 503. The SDK does not expose raw Auth error messages.
+
+The factory and recipient types exist only in `@finueva/auth/server`. The cookie and session client from `createServerAuth()` does not expose recipient resolution.
+
 ## Device Quick Start
 
 Use the device flow for a CLI or native application that can open a system browser:

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, W as SocialIdTokenInput, X as AuthError, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
+import { C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, W as SocialIdTokenInput, X as AuthError, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dpy17xNC.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/device.js

@@ -447,6 +447,7 @@ const messages = {
 	invalid_request: "The request is invalid.",
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
+	recipient_unavailable: "The recipient is unavailable.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
 	invitation_recovery_required: "Invitation administration requires separate recovery.",
 	email_verification_required: "Email verification is required.",

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { A as PersonalWorkspaceSelection, B as RecentAuthenticationStatus, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, F as PlatformRoleChangeRecentAuthenticationInput, G as SocialIdTokenProvider, H as SendVerificationEmailInput, I as PlatformRoleFirstApproval, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, L as PlatformStatus, M as PlatformRole, N as PlatformRoleApplied, O as OrganizationTeamPage, P as PlatformRoleApproval, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, U as SignInInput, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformBootstrapRoleChangeInput, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
+import { A as PersonalWorkspaceSelection, B as RecentAuthenticationStatus, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, F as PlatformRoleChangeRecentAuthenticationInput, G as SocialIdTokenProvider, H as SendVerificationEmailInput, I as PlatformRoleFirstApproval, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, L as PlatformStatus, M as PlatformRole, N as PlatformRoleApplied, O as OrganizationTeamPage, P as PlatformRoleApproval, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, U as SignInInput, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformBootstrapRoleChangeInput, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dpy17xNC.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion

package/dist/index.js

@@ -2543,6 +2543,7 @@ const messages = {
 	invalid_request: "The request is invalid.",
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
+	recipient_unavailable: "The recipient is unavailable.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
 	invitation_recovery_required: "Invitation administration requires separate recovery.",
 	email_verification_required: "Email verification is required.",

package/dist/server.d.ts

@@ -1,4 +1,24 @@
-import { A as PersonalWorkspaceSelection, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dsu3nEaN.js";
+import { A as PersonalWorkspaceSelection, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dpy17xNC.js";
+//#region src/drive-recipients.d.ts
+interface DriveRecipientAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}
+interface ResolveDriveRecipientInput {
+  email: string;
+}
+interface DriveRecipient {
+  userId: string;
+  name: string;
+  email: string;
+}
+interface FinuevaDriveRecipientAuth {
+  resolveRecipient(input: ResolveDriveRecipientInput, clientAssertion: string): Promise<DriveRecipient>;
+}
+/** Service authority only. The caller signs assertions; Auth verifies their claims and signature. */
+declare function createDriveRecipientAuth(options: DriveRecipientAuthOptions): FinuevaDriveRecipientAuth;
+//#endregion
 //#region src/provisioning.d.ts
 interface DriveProvisioningAuthOptions {
   authOrigin: string;
@@ -60,4 +80,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type FinuevaDriveProvisioningAuth, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createDriveProvisioningAuth, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createServerAuth };

package/dist/server.js

@@ -184,6 +184,7 @@ const messages = {
 	invalid_request: "The request is invalid.",
 	invalid_invitation: "The invitation is invalid.",
 	invitation_unavailable: "The invitation is not available.",
+	recipient_unavailable: "The recipient is unavailable.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
 	invitation_recovery_required: "Invitation administration requires separate recovery.",
 	email_verification_required: "Email verification is required.",
@@ -306,7 +307,7 @@ function normalizeIdInput(value) {
 	return value;
 }
 function normalizeOrganization(value) {
-	exact(value, [
+	exact$1(value, [
 		"capabilities",
 		"id",
 		"lifecycle",
@@ -316,7 +317,7 @@ function normalizeOrganization(value) {
 		"slug"
 	]);
 	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
-	exact(value.capabilities, [
+	exact$1(value.capabilities, [
 		"readInvitations",
 		"readMembers",
 		"readTeams"
@@ -377,7 +378,7 @@ function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganizationTeam(value) {
-	exact(value, ["id", "name"]);
+	exact$1(value, ["id", "name"]);
 	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -404,7 +405,7 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 	};
 }
 function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact(value, ["expiresAt", "id"]);
+	exact$1(value, ["expiresAt", "id"]);
 	if (!isId(value.id)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -421,12 +422,12 @@ function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeCanceledOrganizationInvitation(value) {
-	exact(value, ["status"]);
+	exact$1(value, ["status"]);
 	if (value.status !== "canceled") throw authorityUnavailable();
 	return { status: "canceled" };
 }
 function normalizeOrganizations(value) {
-	exact(value, ["nextCursor", "organizations"]);
+	exact$1(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
 		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
@@ -434,11 +435,11 @@ function normalizeOrganizations(value) {
 	};
 }
 function normalizeOrganizationMembers(value) {
-	exact(value, ["members", "nextCursor"]);
+	exact$1(value, ["members", "nextCursor"]);
 	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
 	return {
 		members: unique(value.members.map((member) => {
-			exact(member, [
+			exact$1(member, [
 				"email",
 				"id",
 				"image",
@@ -467,11 +468,11 @@ function normalizeOrganizationMembers(value) {
 	};
 }
 function normalizeOrganizationTeams(value) {
-	exact(value, ["nextCursor", "teams"]);
+	exact$1(value, ["nextCursor", "teams"]);
 	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
 	return {
 		teams: unique(value.teams.map((team) => {
-			exact(team, [
+			exact$1(team, [
 				"category",
 				"createdAt",
 				"id",
@@ -489,7 +490,7 @@ function normalizeOrganizationTeams(value) {
 	};
 }
 function normalizeOrganizationTeamMembers(value) {
-	exact(value, ["memberIds", "nextCursor"]);
+	exact$1(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
 		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
@@ -497,7 +498,7 @@ function normalizeOrganizationTeamMembers(value) {
 	};
 }
 function normalizeOrganizationInvitation(value) {
-	exact(value, [
+	exact$1(value, [
 		"createdAt",
 		"email",
 		"expiresAt",
@@ -508,7 +509,7 @@ function normalizeOrganizationInvitation(value) {
 		"teamIds"
 	]);
 	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
-	exact(value.inviter, ["membershipId", "name"]);
+	exact$1(value.inviter, ["membershipId", "name"]);
 	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -525,7 +526,7 @@ function normalizeOrganizationInvitation(value) {
 	};
 }
 function normalizeOrganizationInvitations(value) {
-	exact(value, ["invitations", "nextCursor"]);
+	exact$1(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
@@ -533,7 +534,7 @@ function normalizeOrganizationInvitations(value) {
 	};
 }
 function normalizeReceivedInvitation(value) {
-	exact(value, [
+	exact$1(value, [
 		"expiresAt",
 		"id",
 		"inviterName",
@@ -542,7 +543,7 @@ function normalizeReceivedInvitation(value) {
 		"teams"
 	]);
 	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
-	exact(value.organization, [
+	exact$1(value.organization, [
 		"id",
 		"logo",
 		"name",
@@ -559,7 +560,7 @@ function normalizeReceivedInvitation(value) {
 		},
 		role: value.role,
 		teams: unique(value.teams.map((team) => {
-			exact(team, ["id", "name"]);
+			exact$1(team, ["id", "name"]);
 			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
 			return {
 				id: team.id,
@@ -571,7 +572,7 @@ function normalizeReceivedInvitation(value) {
 	};
 }
 function normalizeReceivedInvitations(value) {
-	exact(value, ["invitations", "nextCursor"]);
+	exact$1(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
@@ -647,7 +648,7 @@ function fromOrganizationInvitationAdministrationError(value, status, retryAfter
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
 function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact(value, [
+	exact$1(value, [
 		"organizationId",
 		"actor",
 		"target"
@@ -665,7 +666,7 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 	};
 }
 function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact(value, [
+	exact$1(value, [
 		"memberId",
 		"manualRole",
 		"role",
@@ -758,7 +759,7 @@ function toDate(value) {
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
-function exact(value, keys) {
+function exact$1(value, keys) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
 function boundedString(value, maximum) {
@@ -802,6 +803,159 @@ function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
+//#region src/drive-recipients.ts
+const encoder = new TextEncoder();
+const emailPattern = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$/;
+function validEmail(value) {
+	return typeof value === "string" && encoder.encode(value).byteLength <= 320 && emailPattern.test(value);
+}
+function exact(value, keys) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+const failures = {
+	400: [
+		"BAD_REQUEST",
+		"The recipient request is invalid.",
+		"invalid_request"
+	],
+	401: [
+		"UNAUTHORIZED",
+		"The recipient service assertion is invalid.",
+		"authentication_required"
+	],
+	404: [
+		"NOT_FOUND",
+		"The recipient is unavailable.",
+		"recipient_unavailable"
+	],
+	405: [
+		"METHOD_NOT_ALLOWED",
+		"METHOD_NOT_ALLOWED",
+		"invalid_request"
+	],
+	413: [
+		"REQUEST_TOO_LONG",
+		"The recipient request is too large.",
+		"invalid_request"
+	],
+	429: [
+		"TOO_MANY_REQUESTS",
+		"Recipient requests are temporarily limited.",
+		"auth_request_rate_limited"
+	],
+	503: [
+		"SERVICE_UNAVAILABLE",
+		"Recipient resolution is temporarily unavailable.",
+		"identity_authority_unavailable"
+	]
+};
+function createDriveRecipientAuth(options) {
+	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/drive-share-recipients/resolve");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = false;
+	return { async resolveRecipient(input, clientAssertion) {
+		let body;
+		let email;
+		try {
+			if (!exact(input, ["email"]) || typeof input.email !== "string") throw new Error();
+			email = input.email.trim().toLowerCase();
+			if (!validEmail(email)) throw new Error();
+			body = JSON.stringify({ email });
+		} catch {
+			throw new AuthError("invalid_request", 400);
+		}
+		if (encoder.encode(body).byteLength > 1024) throw new AuthError("invalid_request", 413);
+		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight) throw new AuthError("state_conflict", 409);
+		inFlight = true;
+		const controller = new AbortController();
+		let reader;
+		let timer;
+		let authorityError;
+		try {
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(authorityUnavailable());
+					controller.abort();
+					reader?.cancel().catch(() => {});
+				}, timeoutMs);
+			});
+			const exchange = async () => {
+				const response = await fetchImpl(url, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${clientAssertion}`,
+						accept: "application/json",
+						"content-type": "application/json"
+					},
+					body,
+					credentials: "omit",
+					cache: "no-store",
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					response.body?.cancel().catch(() => {});
+					throw authorityUnavailable();
+				}
+				if (!response.body) throw authorityUnavailable();
+				reader = response.body.getReader();
+				const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+				const length = response.headers.get("content-length");
+				if (response.redirected || contentType !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > 4096)) throw authorityUnavailable();
+				const bytes = new Uint8Array(4096);
+				let size = 0;
+				while (true) {
+					const chunk = await reader.read();
+					if (controller.signal.aborted) throw authorityUnavailable();
+					if (chunk.done) break;
+					if (size + chunk.value.byteLength > bytes.byteLength) throw authorityUnavailable();
+					bytes.set(chunk.value, size);
+					size += chunk.value.byteLength;
+				}
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+				if (response.status !== 200) {
+					const status = response.status;
+					const failure = failures[status];
+					if (!failure || !exact(value, ["code", "message"]) || value.code !== failure[0] || value.message !== failure[1]) throw authorityUnavailable();
+					let retryAfterSeconds;
+					if (status === 429) {
+						const retryAfter = response.headers.get("retry-after");
+						if (retryAfter === null || !/^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) throw authorityUnavailable();
+						retryAfterSeconds = Number(retryAfter);
+					}
+					authorityError = new AuthError(failure[2], status, retryAfterSeconds);
+					throw authorityError;
+				}
+				if (!exact(value, ["recipient"]) || !exact(value.recipient, [
+					"userId",
+					"name",
+					"email"
+				])) throw authorityUnavailable();
+				const recipient = value.recipient;
+				if (typeof recipient.userId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(recipient.userId) || typeof recipient.name !== "string" || recipient.name.length === 0 || encoder.encode(recipient.name).byteLength > 1024 || !validEmail(recipient.email) || recipient.email !== recipient.email.trim().toLowerCase() || recipient.email !== email) throw authorityUnavailable();
+				return {
+					userId: recipient.userId,
+					name: recipient.name,
+					email: recipient.email
+				};
+			};
+			return await Promise.race([exchange().finally(() => {
+				inFlight = false;
+			}), deadline]);
+		} catch (error) {
+			if (authorityError && error === authorityError) throw authorityError;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+			reader?.cancel().catch(() => {});
+		}
+	} };
+}
+//#endregion
 //#region src/provisioning.ts
 const MAX_BYTES = 16 * 1024;
 const compactJwt = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
@@ -1494,7 +1648,11 @@ function createServerAuth(options) {
 				response = await fetchImpl(joinURL(authOrigin, "api/v1/auth/sign-out"), {
 					method: "POST",
 					credentials,
-					headers: authHeaders(),
+					headers: {
+						...authHeaders(),
+						"content-type": "application/json; charset=utf-8"
+					},
+					body: "{}",
 					redirect: "manual",
 					signal: AbortSignal.timeout(timeoutMs)
 				});
@@ -1535,4 +1693,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createDriveProvisioningAuth, createServerAuth };
+export { AuthError, createDriveProvisioningAuth, createDriveRecipientAuth, createServerAuth };

package/dist/{types-Dsu3nEaN.d.ts → types-Dpy17xNC.d.ts}

@@ -1,6 +1,6 @@
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
-type AuthErrorStatus = 400 | 401 | 403 | 404 | 409 | 413 | 415 | 422 | 429 | 503;
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
+type AuthErrorStatus = 400 | 401 | 403 | 404 | 405 | 409 | 413 | 415 | 422 | 429 | 503;
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
   readonly status: AuthErrorStatus;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,