@finueva/auth 0.16.0 → 0.17.0

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, W as SocialIdTokenInput, X as AuthError, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dpy17xNC.js";
+import { $ as UserApiCredential, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, W as SocialIdTokenInput, X as AuthError, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, et as UserApiCredentialInput, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-CqFT4G95.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -64,9 +64,10 @@ interface DeviceAuthClient {
   updateProfile(input: UpdateProfileInput): Promise<AuthSession>;
   changePassword(currentPassword: string, newPassword: string, revokeOtherSessions?: boolean): Promise<AuthSession>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
+  getUserApiCredential(input: UserApiCredentialInput): Promise<UserApiCredential>;
   revokeCurrentDevice(): Promise<void>;
   revokeAllSessions(): Promise<void>;
 }
 declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, createDeviceAuth };
+export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };

package/dist/device.js

@@ -173,6 +173,109 @@ function stringifyParsedURL(parsed) {
 	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
 }
 //#endregion
+//#region src/errors.ts
+const messages = {
+	invalid_credentials: "The credentials are invalid.",
+	invalid_auth_input: "The authentication input is invalid.",
+	account_conflict: "The account is not available.",
+	password_reset_invalid: "The password reset request is invalid.",
+	authentication_required: "Authentication is required.",
+	request_origin_denied: "The request origin is not allowed.",
+	invalid_request: "The request is invalid.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	recipient_unavailable: "The recipient is unavailable.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	email_verification_required: "Email verification is required.",
+	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
+	credential_rate_limited: "Credential requests are temporarily limited.",
+	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	state_conflict: "The authentication state conflicts with the request.",
+	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	constructor(code, status, retryAfterSeconds) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+//#endregion
+//#region src/user-api/credential.ts
+function userApiApplication(input) {
+	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
+	return input.applicationId;
+}
+function normalizeUserApiCredential(value, startedAt) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
+	};
+}
+function createUserApiCredentialCache(issue, now) {
+	let generation = 0;
+	let cached;
+	let pending;
+	const copy = (value) => ({
+		...value,
+		expiresAt: new Date(value.expiresAt)
+	});
+	return {
+		hasAuthority: () => Boolean(cached || pending),
+		clear() {
+			generation += 1;
+			cached = void 0;
+			pending = void 0;
+		},
+		async get(input) {
+			const applicationId = userApiApplication(input);
+			if (pending) {
+				if (pending.applicationId !== applicationId) throw new AuthError("state_conflict", 409);
+				return copy(await pending.request);
+			}
+			const startedAt = now();
+			if (!input.forceRefresh && cached?.applicationId === applicationId && cached.expiresAt - startedAt > 12e4) return {
+				tokenType: "Bearer",
+				token: cached.token,
+				expiresAt: new Date(cached.expiresAt)
+			};
+			cached = void 0;
+			const epoch = generation;
+			const request = (async () => {
+				const value = normalizeUserApiCredential(await issue(applicationId), startedAt);
+				if (epoch !== generation) throw new AuthError("state_conflict", 409);
+				if (now() < startedAt || value.expiresAt.getTime() <= now()) throw new AuthError("authentication_required", 401);
+				cached = {
+					applicationId,
+					token: value.token,
+					expiresAt: value.expiresAt.getTime()
+				};
+				return value;
+			})().finally(() => {
+				if (pending?.request === request) pending = void 0;
+			});
+			pending = {
+				applicationId,
+				request
+			};
+			return copy(await request);
+		}
+	};
+}
+//#endregion
 //#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
 const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
 const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
@@ -436,45 +539,6 @@ function createFetch(globalOptions = {}) {
 	return $fetch;
 }
 //#endregion
-//#region src/errors.ts
-const messages = {
-	invalid_credentials: "The credentials are invalid.",
-	invalid_auth_input: "The authentication input is invalid.",
-	account_conflict: "The account is not available.",
-	password_reset_invalid: "The password reset request is invalid.",
-	authentication_required: "Authentication is required.",
-	request_origin_denied: "The request origin is not allowed.",
-	invalid_request: "The request is invalid.",
-	invalid_invitation: "The invitation is invalid.",
-	invitation_unavailable: "The invitation is not available.",
-	recipient_unavailable: "The recipient is unavailable.",
-	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
-	invitation_recovery_required: "Invitation administration requires separate recovery.",
-	email_verification_required: "Email verification is required.",
-	invalid_workspace_selection: "The workspace selection is invalid.",
-	organization_context_too_large: "The organization context is too large.",
-	credential_rate_limited: "Credential requests are temporarily limited.",
-	auth_request_rate_limited: "Authentication requests are temporarily limited.",
-	state_conflict: "The authentication state conflicts with the request.",
-	access_denied: "Access is denied.",
-	platform_target_unavailable: "The platform administration target is unavailable.",
-	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
-	platform_recovery_required: "Platform administration requires separate recovery.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable."
-};
-var AuthError = class extends Error {
-	code;
-	status;
-	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
-		super(messages[code]);
-		this.name = "AuthError";
-		this.code = code;
-		this.status = status;
-		this.retryAfterSeconds = retryAfterSeconds;
-	}
-};
-//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
@@ -1165,7 +1229,18 @@ function createDeviceAuth(options) {
 	let authorityTail = Promise.resolve();
 	let persistenceTail = Promise.resolve();
 	let persistencePending = 0;
+	const userApiCredentials = createUserApiCredentialCache(async (applicationId) => {
+		const authority = await serializeAuthority(async () => ({
+			current: await readToken(),
+			generation: authorityGeneration
+		}));
+		if (!authority.current) throw new AuthError("authentication_required", 401);
+		const response = await authenticated("user-api-credential", authority.current, { applicationId });
+		if (authority.generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		return response.value;
+	}, now);
 	function clearCredential() {
+		userApiCredentials.clear();
 		credential = void 0;
 		selectedWorkspaceKey = void 0;
 		credentialGeneration += 1;
@@ -1782,6 +1857,9 @@ function createDeviceAuth(options) {
 				return session;
 			}, true);
 		},
+		getUserApiCredential(input) {
+			return userApiCredentials.get(input);
+		},
 		getDriveCredential(input) {
 			let workspace;
 			let forceRefresh;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as PersonalWorkspaceSelection, B as RecentAuthenticationStatus, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, F as PlatformRoleChangeRecentAuthenticationInput, G as SocialIdTokenProvider, H as SendVerificationEmailInput, I as PlatformRoleFirstApproval, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, L as PlatformStatus, M as PlatformRole, N as PlatformRoleApplied, O as OrganizationTeamPage, P as PlatformRoleApproval, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, U as SignInInput, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformBootstrapRoleChangeInput, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dpy17xNC.js";
+import { $ as UserApiCredential, A as PersonalWorkspaceSelection, B as RecentAuthenticationStatus, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, F as PlatformRoleChangeRecentAuthenticationInput, G as SocialIdTokenProvider, H as SendVerificationEmailInput, I as PlatformRoleFirstApproval, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, L as PlatformStatus, M as PlatformRole, N as PlatformRoleApplied, O as OrganizationTeamPage, P as PlatformRoleApproval, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, U as SignInInput, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, et as UserApiCredentialInput, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformBootstrapRoleChangeInput, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-CqFT4G95.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -4456,6 +4456,70 @@ function byteLength(value) {
 	return new TextEncoder().encode(value).byteLength;
 }
 //#endregion
+//#region src/user-api/credential.ts
+function userApiApplication(input) {
+	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
+	return input.applicationId;
+}
+function normalizeUserApiCredential(value, startedAt) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
+	};
+}
+function createUserApiCredentialCache(issue, now) {
+	let generation = 0;
+	let cached;
+	let pending;
+	const copy = (value) => ({
+		...value,
+		expiresAt: new Date(value.expiresAt)
+	});
+	return {
+		hasAuthority: () => Boolean(cached || pending),
+		clear() {
+			generation += 1;
+			cached = void 0;
+			pending = void 0;
+		},
+		async get(input) {
+			const applicationId = userApiApplication(input);
+			if (pending) {
+				if (pending.applicationId !== applicationId) throw new AuthError("state_conflict", 409);
+				return copy(await pending.request);
+			}
+			const startedAt = now();
+			if (!input.forceRefresh && cached?.applicationId === applicationId && cached.expiresAt - startedAt > 12e4) return {
+				tokenType: "Bearer",
+				token: cached.token,
+				expiresAt: new Date(cached.expiresAt)
+			};
+			cached = void 0;
+			const epoch = generation;
+			const request = (async () => {
+				const value = normalizeUserApiCredential(await issue(applicationId), startedAt);
+				if (epoch !== generation) throw new AuthError("state_conflict", 409);
+				if (now() < startedAt || value.expiresAt.getTime() <= now()) throw new AuthError("authentication_required", 401);
+				cached = {
+					applicationId,
+					token: value.token,
+					expiresAt: value.expiresAt.getTime()
+				};
+				return value;
+			})().finally(() => {
+				if (pending?.request === request) pending = void 0;
+			});
+			pending = {
+				applicationId,
+				request
+			};
+			return copy(await request);
+		}
+	};
+}
+//#endregion
 //#region src/client.ts
 const REFRESH_WINDOW_MS = 120 * 1e3;
 const RECENT_AUTHENTICATION_BROWSER_HEADER = "x-finueva-recent-auth-browser";
@@ -4468,11 +4532,18 @@ function createAuthClient(options) {
 	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
 	const now = options.now ?? Date.now;
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	const userApiCredentials = createUserApiCredentialCache((applicationId) => requestJson(joinURL(authOrigin, "api/v1/auth/user-api-credential"), {
+		fetch: fetchImpl,
+		timeoutMs,
+		method: "POST",
+		headers: { "content-type": "application/json; charset=utf-8" },
+		body: { applicationId }
+	}), now);
 	const betterAuth = createAuthClient$1({
 		baseURL: authOrigin,
 		basePath: "/api/v1/auth",
 		fetchOptions: {
-			customFetchImpl: fetchImpl,
+			customFetchImpl: fetchBetterAuth,
 			credentials: "include",
 			retry: 0,
 			timeout: timeoutMs
@@ -4508,6 +4579,15 @@ function createAuthClient(options) {
 	let signalRefreshPending = false;
 	let signalRefreshScheduled = false;
 	let signalRefreshRequest;
+	let betterAuthTransportSequence = 0;
+	async function fetchBetterAuth(input, init) {
+		const request = new Request(input, init);
+		const url = new URL(request.url);
+		if (!authStateStarted || request.method !== "GET" || url.origin !== authOrigin || url.pathname !== "/api/v1/auth/get-session" || signOutRequest || activeAccountMutationGeneration !== void 0) return fetchImpl(input, init);
+		betterAuthTransportSequence += 1;
+		const response = await readAuthoritySession(authorityGeneration, request);
+		return new Response(JSON.stringify(response.value), { headers: { "content-type": "application/json" } });
+	}
 	function advanceAuthorityGeneration() {
 		recentAuthenticationStartAttempt = void 0;
 		return ++authorityGeneration;
@@ -4569,12 +4649,13 @@ function createAuthClient(options) {
 				authoritative: false
 			});
 		});
-		getSession().catch(() => void 0);
+		if (typeof window === "undefined") getSession().catch(() => void 0);
 	}
 	function subscribeToSessionSignals() {
 		if (sessionSignalSubscribed) return;
 		sessionSignalSubscribed = true;
 		let initialized = false;
+		let transportSequence = betterAuthTransportSequence;
 		betterAuth.useSession.subscribe((state) => {
 			const refetching = state.isRefetching === true;
 			if (!initialized) {
@@ -4583,6 +4664,7 @@ function createAuthClient(options) {
 				return;
 			}
 			const settled = betterAuthRefetching && !refetching;
+			if (refetching && !betterAuthRefetching) transportSequence = betterAuthTransportSequence;
 			betterAuthRefetching = refetching;
 			if (refetching && signOutRequest) suppressBetterAuthSettlement = true;
 			if (!settled) return;
@@ -4590,6 +4672,7 @@ function createAuthClient(options) {
 				suppressBetterAuthSettlement = false;
 				return;
 			}
+			if (transportSequence !== betterAuthTransportSequence) return;
 			queueSignalRefresh();
 		});
 	}
@@ -4610,13 +4693,14 @@ function createAuthClient(options) {
 		signalRefreshRequest = request;
 	}
 	function clearCredential() {
+		userApiCredentials.clear();
 		credential = void 0;
 		credentialRequests.clear();
 		selectedWorkspaceKey = void 0;
 		credentialGeneration += 1;
 	}
 	function updateSession(session) {
-		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0);
+		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0 || userApiCredentials.hasAuthority());
 		const changedSession = sessionId === void 0 ? !sessionAuthorityObserved || session !== null : !session || session.id !== sessionId || session.user.id !== sessionUserId;
 		if (!session || unboundCredential || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
 		if (changedSession || recentAuthenticationStartAttempt && (recentAuthenticationStartAttempt.sessionId !== session?.id || recentAuthenticationStartAttempt.userId !== session?.user.id)) recentAuthenticationStartAttempt = void 0;
@@ -4626,24 +4710,35 @@ function createAuthClient(options) {
 		sessionUserId = session?.user.id;
 		return session;
 	}
-	async function refreshAuthoritySession(generation) {
+	async function readAuthoritySession(generation, request) {
 		const readEpoch = ++sessionReadEpoch;
 		try {
-			const response = await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/get-session"), {
+			const response = await requestJsonResponse(request?.url ?? joinURL(authOrigin, "api/v1/auth/get-session"), {
 				fetch: fetchImpl,
 				timeoutMs,
-				method: "GET"
+				method: "GET",
+				...request ? {
+					headers: request.headers,
+					signal: request.signal
+				} : {}
 			});
 			if (generation !== authorityGeneration || readEpoch !== sessionReadEpoch) throw new AuthError("state_conflict", 409);
-			return acceptAuthoritySession(normalizeSession(response.value), generation);
+			return {
+				...response,
+				session: acceptAuthoritySession(normalizeSession(response.value), generation)
+			};
 		} catch (error) {
 			if (generation !== authorityGeneration || readEpoch !== sessionReadEpoch) throw new AuthError("state_conflict", 409);
 			if (error instanceof AuthError && error.code === "state_conflict") throw error;
-			unavailable();
+			if (error instanceof AuthError && error.status === 401) acceptAuthoritySession(null, generation);
+			else unavailable();
 			if (error instanceof AuthError) throw error;
 			throw authorityUnavailable();
 		}
 	}
+	async function refreshAuthoritySession(generation) {
+		return (await readAuthoritySession(generation)).session;
+	}
 	function getSession() {
 		if (signOutRequest || activeAccountMutationGeneration !== void 0) return Promise.reject(new AuthError("state_conflict", 409));
 		return refreshAuthoritySession(authorityGeneration);
@@ -5174,6 +5269,10 @@ function createAuthClient(options) {
 			}));
 		},
 		signOut,
+		getUserApiCredential(input) {
+			if (invitationRequest || signOutRequest || activeAccountMutationGeneration !== void 0) return Promise.reject(new AuthError("state_conflict", 409));
+			return userApiCredentials.get(input);
+		},
 		getDriveCredential(input) {
 			let workspace;
 			try {

package/dist/server.d.ts

@@ -1,4 +1,27 @@
-import { A as PersonalWorkspaceSelection, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dpy17xNC.js";
+import { $ as UserApiCredential, A as PersonalWorkspaceSelection, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, et as UserApiCredentialInput, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-CqFT4G95.js";
+//#region src/user-api/verifier.d.ts
+interface UserApiIdentity {
+  userId: string;
+  sessionId: string;
+  applicationId: string;
+  issuedAt: Date;
+  expiresAt: Date;
+  user: AuthUser;
+}
+interface UserApiVerifierOptions {
+  issuer: string;
+  jwksUrl: string;
+  audience: string;
+  applicationId: string;
+  environment: "local" | "development" | "staging" | "production";
+  fetch?: typeof globalThis.fetch;
+  now?: () => number;
+}
+/** One configured verifier can be shared. It retains public keys, never user authority. */
+declare function createUserApiVerifier(options: UserApiVerifierOptions): {
+  verify(token: string): Promise<UserApiIdentity>;
+};
+//#endregion
 //#region src/identity-resolution.d.ts
 interface IdentityResolverAuthOptions {
   authOrigin: string;
@@ -94,8 +117,9 @@ interface FinuevaServerAuth {
   getReceivedInvitation(invitationId: string): Promise<ReceivedOrganizationInvitation>;
   signInWithSocialIdToken(input: SocialIdTokenInput): Promise<ServerSocialIdTokenSession>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
+  getUserApiCredential(input: UserApiCredentialInput): Promise<UserApiCredential>;
   signOut(): Promise<ServerSignOutResult>;
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, FinuevaServerAuth, type IdentityResolverAuthOptions, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolvedIdentity, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, FinuevaServerAuth, type IdentityResolverAuthOptions, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolvedIdentity, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createServerAuth, createUserApiVerifier };