@finueva/auth 0.16.1 → 0.18.0

package/README.md

@@ -94,28 +94,31 @@ The browser owns the session cookie. The SDK does not expose or persist it.
 
 ## Common Tasks
 
-| Task                          | Browser                                     | Server                                    | Device                                 |
-| ----------------------------- | ------------------------------------------- | ----------------------------------------- | -------------------------------------- |
-| Create an account             | `signUp()`                                  | Not available                             | `signUpWithEmail()`                    |
-| Read the current session      | `getSession()`                              | `getSession()`                            | `getSession()`                         |
-| Observe session state         | `onAuthStateChange()`                       | Not available                             | Not available                          |
-| Update a profile              | `updateProfile()`                           | Not available                             | `updateProfile()`                      |
-| Change a password             | `changePassword()`                          | Not available                             | `changePassword()`                     |
-| Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                             | Not available                          |
-| Verify an email               | `sendVerificationEmail()`                   | Not available                             | Not available                          |
-| List organizations            | `listOrganizations()`                       | `listOrganizations()`                     | `listOrganizations()`                  |
-| Read member authority         | `getOrganizationMemberAuthority()`          | `getOrganizationMemberAuthority()`        | `getOrganizationMemberAuthority()`     |
-| Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`                | `createOrganizationTeam()`             |
-| Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()`    | `createOrganizationMemberInvitation()` |
-| Resend a member invitation    | `resendOrganizationInvitation()`            | `resendOrganizationInvitation()` (cookie) | Not available                          |
-| Cancel a member invitation    | `cancelOrganizationInvitation()`            | `cancelOrganizationInvitation()` (cookie) | Not available                          |
-| Accept an invitation          | `acceptInvitation()`                        | `acceptInvitation()`                      | Not available                          |
-| Enroll a passkey              | `addPasskey()`                              | Not available                             | Not available                          |
-| Perform recent authentication | Platform and organization action methods    | Not available                             | Not available                          |
-| Change manual roles or owners | Organization authority methods              | Not available                             | Not available                          |
-| Read current platform roles   | `getPlatformStatus()`                       | Not available                             | Not available                          |
-| Request Drive access          | `getDriveCredential()`                      | `getDriveCredential()`                    | `getDriveCredential()`                 |
-| End the current session       | `signOut()`                                 | `signOut()`                               | `revokeCurrentDevice()`                |
+| Task                            | Browser                                     | Server                                    | Device                                 |
+| ------------------------------- | ------------------------------------------- | ----------------------------------------- | -------------------------------------- |
+| Create an account               | `signUp()`                                  | Not available                             | `signUpWithEmail()`                    |
+| Read the current session        | `getSession()`                              | `getSession()`                            | `getSession()`                         |
+| Observe session state           | `onAuthStateChange()`                       | Not available                             | Not available                          |
+| Update a profile                | `updateProfile()`                           | Not available                             | `updateProfile()`                      |
+| Change a password               | `changePassword()`                          | Not available                             | `changePassword()`                     |
+| Reset a password                | `requestPasswordReset()`, `resetPassword()` | Not available                             | Not available                          |
+| Verify an email                 | `sendVerificationEmail()`                   | Not available                             | Not available                          |
+| List organizations              | `listOrganizations()`                       | `listOrganizations()`                     | `listOrganizations()`                  |
+| Read member authority           | `getOrganizationMemberAuthority()`          | `getOrganizationMemberAuthority()`        | `getOrganizationMemberAuthority()`     |
+| Create an ordinary organization | `createOrganization()`                      | `createOrganization()`                    | `createOrganization()`                 |
+| Create an ordinary team         | `createOrganizationTeam()`                  | `createOrganizationTeam()`                | `createOrganizationTeam()`             |
+| Invite an ordinary member       | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()`    | `createOrganizationMemberInvitation()` |
+| Resend a member invitation      | `resendOrganizationInvitation()`            | `resendOrganizationInvitation()` (cookie) | Not available                          |
+| Cancel a member invitation      | `cancelOrganizationInvitation()`            | `cancelOrganizationInvitation()` (cookie) | Not available                          |
+| Remove an ordinary member       | `removeOrganizationMember()`                | `removeOrganizationMember()` (cookie)     | Not available                          |
+| Leave an organization           | `leaveOrganization()`                       | `leaveOrganization()` (cookie)            | Not available                          |
+| Accept an invitation            | `acceptInvitation()`                        | `acceptInvitation()`                      | Not available                          |
+| Enroll a passkey                | `addPasskey()`                              | Not available                             | Not available                          |
+| Perform recent authentication   | Platform and organization action methods    | Not available                             | Not available                          |
+| Change manual roles or owners   | Organization authority methods              | Not available                             | Not available                          |
+| Read current platform roles     | `getPlatformStatus()`                       | Not available                             | Not available                          |
+| Request Drive access            | `getDriveCredential()`                      | `getDriveCredential()`                    | `getDriveCredential()`                 |
+| End the current session         | `signOut()`                                 | `signOut()`                               | `revokeCurrentDevice()`                |
 
 ## Create An Organization Invitation
 
@@ -142,6 +145,17 @@ const canceled = await auth.cancelOrganizationInvitation(organizationId, invitat
 
 Resend success confirms the committed expiry. It does not confirm email delivery. Repeat an action with the same key only after a lost response. A bearer-backed server client rejects both methods before network I/O.
 
+## Remove An Organization Member
+
+Manual owners and manual administrators remove one other member. Every current member can leave. Both operations use browser-cookie or server-cookie authority:
+
+```ts
+const removed = await auth.removeOrganizationMember(organizationId, memberId, crypto.randomUUID());
+const left = await auth.leaveOrganization(organizationId, crypto.randomUUID());
+```
+
+An owner target is refused. Transfer ownership first. Repeat a removal with the same key only after a lost response; a membership that is already gone under that key replays the same result. A bearer-backed server client rejects both methods before network I/O.
+
 ## Perform Recent Authentication
 
 The experimental passkey methods run only when the browser page uses the exact Auth Origin. To enroll a passkey, first create a new password-authenticated session on that origin:

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, W as SocialIdTokenInput, X as AuthError, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dpy17xNC.js";
+import { $ as AuthError, A as OrganizationTeamPage, B as ReceivedOrganizationInvitation, C as OrganizationMemberAuthority, D as OrganizationTeam, E as OrganizationPageInput, J as SocialIdTokenProvider, O as OrganizationTeamDisplay, S as OrganizationMember, T as OrganizationPage, V as ReceivedOrganizationInvitationPage, X as UpdateOrganizationTeamDisplayInput, Y as UpdateOrganizationDisplayInput, Z as UpdateProfileInput, b as OrganizationInvitation, d as CreatedOrganization, et as AuthErrorCode, f as CreatedOrganizationMemberInvitation, h as DriveCredentialInput, k as OrganizationTeamMemberPage, m as DriveCredential, nt as UserApiCredential, o as AuthSession, p as CreatedOrganizationTeam, q as SocialIdTokenInput, r as AuthOrganization, rt as UserApiCredentialInput, tt as AuthErrorStatus, u as CreateOrganizationMemberInvitationInput, w as OrganizationMemberPage, x as OrganizationInvitationPage, y as OrganizationDisplay } from "./types-CrdIcEJ3.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -46,6 +46,7 @@ interface DeviceAuthClient {
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
   getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
+  createOrganization(name: string, slug: string, idempotencyKey: string): Promise<CreatedOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
@@ -64,9 +65,10 @@ interface DeviceAuthClient {
   updateProfile(input: UpdateProfileInput): Promise<AuthSession>;
   changePassword(currentPassword: string, newPassword: string, revokeOtherSessions?: boolean): Promise<AuthSession>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
+  getUserApiCredential(input: UserApiCredentialInput): Promise<UserApiCredential>;
   revokeCurrentDevice(): Promise<void>;
   revokeAllSessions(): Promise<void>;
 }
 declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, createDeviceAuth };
+export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };

package/dist/device.js

@@ -173,6 +173,110 @@ function stringifyParsedURL(parsed) {
 	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
 }
 //#endregion
+//#region src/errors.ts
+const messages = {
+	invalid_credentials: "The credentials are invalid.",
+	invalid_auth_input: "The authentication input is invalid.",
+	account_conflict: "The account is not available.",
+	password_reset_invalid: "The password reset request is invalid.",
+	authentication_required: "Authentication is required.",
+	request_origin_denied: "The request origin is not allowed.",
+	invalid_request: "The request is invalid.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	recipient_unavailable: "The recipient is unavailable.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	membership_removal_recovery_required: "Membership removal requires separate recovery.",
+	email_verification_required: "Email verification is required.",
+	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
+	credential_rate_limited: "Credential requests are temporarily limited.",
+	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	state_conflict: "The authentication state conflicts with the request.",
+	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	constructor(code, status, retryAfterSeconds) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+//#endregion
+//#region src/user-api/credential.ts
+function userApiApplication(input) {
+	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
+	return input.applicationId;
+}
+function normalizeUserApiCredential(value, startedAt) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
+	};
+}
+function createUserApiCredentialCache(issue, now) {
+	let generation = 0;
+	let cached;
+	let pending;
+	const copy = (value) => ({
+		...value,
+		expiresAt: new Date(value.expiresAt)
+	});
+	return {
+		hasAuthority: () => Boolean(cached || pending),
+		clear() {
+			generation += 1;
+			cached = void 0;
+			pending = void 0;
+		},
+		async get(input) {
+			const applicationId = userApiApplication(input);
+			if (pending) {
+				if (pending.applicationId !== applicationId) throw new AuthError("state_conflict", 409);
+				return copy(await pending.request);
+			}
+			const startedAt = now();
+			if (!input.forceRefresh && cached?.applicationId === applicationId && cached.expiresAt - startedAt > 12e4) return {
+				tokenType: "Bearer",
+				token: cached.token,
+				expiresAt: new Date(cached.expiresAt)
+			};
+			cached = void 0;
+			const epoch = generation;
+			const request = (async () => {
+				const value = normalizeUserApiCredential(await issue(applicationId), startedAt);
+				if (epoch !== generation) throw new AuthError("state_conflict", 409);
+				if (now() < startedAt || value.expiresAt.getTime() <= now()) throw new AuthError("authentication_required", 401);
+				cached = {
+					applicationId,
+					token: value.token,
+					expiresAt: value.expiresAt.getTime()
+				};
+				return value;
+			})().finally(() => {
+				if (pending?.request === request) pending = void 0;
+			});
+			pending = {
+				applicationId,
+				request
+			};
+			return copy(await request);
+		}
+	};
+}
+//#endregion
 //#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
 const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
 const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
@@ -436,45 +540,6 @@ function createFetch(globalOptions = {}) {
 	return $fetch;
 }
 //#endregion
-//#region src/errors.ts
-const messages = {
-	invalid_credentials: "The credentials are invalid.",
-	invalid_auth_input: "The authentication input is invalid.",
-	account_conflict: "The account is not available.",
-	password_reset_invalid: "The password reset request is invalid.",
-	authentication_required: "Authentication is required.",
-	request_origin_denied: "The request origin is not allowed.",
-	invalid_request: "The request is invalid.",
-	invalid_invitation: "The invitation is invalid.",
-	invitation_unavailable: "The invitation is not available.",
-	recipient_unavailable: "The recipient is unavailable.",
-	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
-	invitation_recovery_required: "Invitation administration requires separate recovery.",
-	email_verification_required: "Email verification is required.",
-	invalid_workspace_selection: "The workspace selection is invalid.",
-	organization_context_too_large: "The organization context is too large.",
-	credential_rate_limited: "Credential requests are temporarily limited.",
-	auth_request_rate_limited: "Authentication requests are temporarily limited.",
-	state_conflict: "The authentication state conflicts with the request.",
-	access_denied: "Access is denied.",
-	platform_target_unavailable: "The platform administration target is unavailable.",
-	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
-	platform_recovery_required: "Platform administration requires separate recovery.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable."
-};
-var AuthError = class extends Error {
-	code;
-	status;
-	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
-		super(messages[code]);
-		this.name = "AuthError";
-		this.code = code;
-		this.status = status;
-		this.retryAfterSeconds = retryAfterSeconds;
-	}
-};
-//#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
@@ -652,6 +717,27 @@ function normalizeOrganizationTeamDisplay(value) {
 		throw authorityUnavailable();
 	}
 }
+function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255) || typeof slug !== "string" || !/^[a-z0-9-]{1,128}$/.test(slug)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		slug,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganization(value) {
+	exact(value, [
+		"id",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 128)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
 function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
 	return {
@@ -1165,7 +1251,18 @@ function createDeviceAuth(options) {
 	let authorityTail = Promise.resolve();
 	let persistenceTail = Promise.resolve();
 	let persistencePending = 0;
+	const userApiCredentials = createUserApiCredentialCache(async (applicationId) => {
+		const authority = await serializeAuthority(async () => ({
+			current: await readToken(),
+			generation: authorityGeneration
+		}));
+		if (!authority.current) throw new AuthError("authentication_required", 401);
+		const response = await authenticated("user-api-credential", authority.current, { applicationId });
+		if (authority.generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		return response.value;
+	}, now);
 	function clearCredential() {
+		userApiCredentials.clear();
 		credential = void 0;
 		selectedWorkspaceKey = void 0;
 		credentialGeneration += 1;
@@ -1520,6 +1617,30 @@ function createDeviceAuth(options) {
 			const member = normalizeIdInput(memberId);
 			return serializeAuthority(() => organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member)));
 		},
+		createOrganization(name, slug, idempotencyKey) {
+			let body;
+			try {
+				body = normalizeOrganizationCreationInput(name, slug, idempotencyKey);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				return normalizeCreatedOrganization((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/organizations"), {
+					fetch: requestFetch,
+					timeoutMs,
+					method: "POST",
+					credentials: "omit",
+					headers: {
+						authorization: `Bearer ${current.accessToken}`,
+						"content-type": "application/json"
+					},
+					body,
+					mapError: fromOrganizationMutationAuthorityError
+				})).value);
+			});
+		},
 		createOrganizationTeam(organizationId, name, idempotencyKey) {
 			let id;
 			let body;
@@ -1782,6 +1903,9 @@ function createDeviceAuth(options) {
 				return session;
 			}, true);
 		},
+		getUserApiCredential(input) {
+			return userApiCredentials.get(input);
+		},
 		getDriveCredential(input) {
 			let workspace;
 			let forceRefresh;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as PersonalWorkspaceSelection, B as RecentAuthenticationStatus, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, F as PlatformRoleChangeRecentAuthenticationInput, G as SocialIdTokenProvider, H as SendVerificationEmailInput, I as PlatformRoleFirstApproval, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, L as PlatformStatus, M as PlatformRole, N as PlatformRoleApplied, O as OrganizationTeamPage, P as PlatformRoleApproval, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, U as SignInInput, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformBootstrapRoleChangeInput, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dpy17xNC.js";
+import { $ as AuthError, A as OrganizationTeamPage, B as ReceivedOrganizationInvitation, C as OrganizationMemberAuthority, D as OrganizationTeam, E as OrganizationPageInput, F as PlatformRoleApplied, G as SendVerificationEmailInput, H as RecentAuthenticationStatus, I as PlatformRoleApproval, J as SocialIdTokenProvider, K as SignInInput, L as PlatformRoleChangeRecentAuthenticationInput, M as PersonalWorkspaceSelection, N as PlatformBootstrapRoleChangeInput, O as OrganizationTeamDisplay, P as PlatformRole, Q as WorkspaceSelection, R as PlatformRoleFirstApproval, S as OrganizationMember, T as OrganizationPage, U as RemovedOrganizationMember, V as ReceivedOrganizationInvitationPage, W as ResentOrganizationInvitation, X as UpdateOrganizationTeamDisplayInput, Y as UpdateOrganizationDisplayInput, Z as UpdateProfileInput, _ as InvitationAcceptance, a as AuthPersistenceDriver, b as OrganizationInvitation, c as AuthUser, d as CreatedOrganization, et as AuthErrorCode, f as CreatedOrganizationMemberInvitation, g as FinuevaAuthClient, h as DriveCredentialInput, i as AuthPersistence, j as OrganizationWorkspaceSelection, k as OrganizationTeamMemberPage, l as CanceledOrganizationInvitation, m as DriveCredential, n as AuthClientOptions, nt as UserApiCredential, o as AuthSession, p as CreatedOrganizationTeam, q as SocialIdTokenInput, r as AuthOrganization, rt as UserApiCredentialInput, s as AuthState, t as AcceptInvitationInput, tt as AuthErrorStatus, u as CreateOrganizationMemberInvitationInput, v as OrganizationDeparture, w as OrganizationMemberPage, x as OrganizationInvitationPage, y as OrganizationDisplay, z as PlatformStatus } from "./types-CrdIcEJ3.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -2546,6 +2546,7 @@ const messages = {
 	recipient_unavailable: "The recipient is unavailable.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
 	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	membership_removal_recovery_required: "Membership removal requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
@@ -3027,6 +3028,27 @@ function normalizeOrganizationTeamDisplay(value) {
 		throw authorityUnavailable();
 	}
 }
+function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255) || typeof slug !== "string" || !/^[a-z0-9-]{1,128}$/.test(slug)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		slug,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganization(value) {
+	exact(value, [
+		"id",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 128)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
 function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
 	return {
@@ -3083,6 +3105,20 @@ function normalizeCanceledOrganizationInvitation(value) {
 	if (value.status !== "canceled") throw authorityUnavailable();
 	return { status: "canceled" };
 }
+function normalizeOrganizationMembershipRemovalInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeRemovedOrganizationMember(value) {
+	exact(value, ["status"]);
+	if (value.status !== "removed") throw authorityUnavailable();
+	return { status: "removed" };
+}
+function normalizeOrganizationDeparture(value) {
+	exact(value, ["status"]);
+	if (value.status !== "left") throw authorityUnavailable();
+	return { status: "left" };
+}
 function normalizeOrganizations(value) {
 	exact(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -3318,6 +3354,10 @@ function fromOrganizationInvitationAdministrationError(value, status, retryAfter
 	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
+function fromOrganizationMembershipRemovalError(value, status, retryAfter) {
+	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("membership_removal_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
 function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== "changeReference,expectedGlobalRevision,expectedTargetRevision,idempotencyKey,reasonCategory,requestedRoles,targetUserId") throw new TypeError("recent authentication input is invalid");
 	if (!isId(value.targetUserId)) throw new TypeError("targetUserId is invalid");
@@ -4456,6 +4496,70 @@ function byteLength(value) {
 	return new TextEncoder().encode(value).byteLength;
 }
 //#endregion
+//#region src/user-api/credential.ts
+function userApiApplication(input) {
+	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
+	return input.applicationId;
+}
+function normalizeUserApiCredential(value, startedAt) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
+	};
+}
+function createUserApiCredentialCache(issue, now) {
+	let generation = 0;
+	let cached;
+	let pending;
+	const copy = (value) => ({
+		...value,
+		expiresAt: new Date(value.expiresAt)
+	});
+	return {
+		hasAuthority: () => Boolean(cached || pending),
+		clear() {
+			generation += 1;
+			cached = void 0;
+			pending = void 0;
+		},
+		async get(input) {
+			const applicationId = userApiApplication(input);
+			if (pending) {
+				if (pending.applicationId !== applicationId) throw new AuthError("state_conflict", 409);
+				return copy(await pending.request);
+			}
+			const startedAt = now();
+			if (!input.forceRefresh && cached?.applicationId === applicationId && cached.expiresAt - startedAt > 12e4) return {
+				tokenType: "Bearer",
+				token: cached.token,
+				expiresAt: new Date(cached.expiresAt)
+			};
+			cached = void 0;
+			const epoch = generation;
+			const request = (async () => {
+				const value = normalizeUserApiCredential(await issue(applicationId), startedAt);
+				if (epoch !== generation) throw new AuthError("state_conflict", 409);
+				if (now() < startedAt || value.expiresAt.getTime() <= now()) throw new AuthError("authentication_required", 401);
+				cached = {
+					applicationId,
+					token: value.token,
+					expiresAt: value.expiresAt.getTime()
+				};
+				return value;
+			})().finally(() => {
+				if (pending?.request === request) pending = void 0;
+			});
+			pending = {
+				applicationId,
+				request
+			};
+			return copy(await request);
+		}
+	};
+}
+//#endregion
 //#region src/client.ts
 const REFRESH_WINDOW_MS = 120 * 1e3;
 const RECENT_AUTHENTICATION_BROWSER_HEADER = "x-finueva-recent-auth-browser";
@@ -4468,6 +4572,13 @@ function createAuthClient(options) {
 	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
 	const now = options.now ?? Date.now;
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	const userApiCredentials = createUserApiCredentialCache((applicationId) => requestJson(joinURL(authOrigin, "api/v1/auth/user-api-credential"), {
+		fetch: fetchImpl,
+		timeoutMs,
+		method: "POST",
+		headers: { "content-type": "application/json; charset=utf-8" },
+		body: { applicationId }
+	}), now);
 	const betterAuth = createAuthClient$1({
 		baseURL: authOrigin,
 		basePath: "/api/v1/auth",
@@ -4622,13 +4733,14 @@ function createAuthClient(options) {
 		signalRefreshRequest = request;
 	}
 	function clearCredential() {
+		userApiCredentials.clear();
 		credential = void 0;
 		credentialRequests.clear();
 		selectedWorkspaceKey = void 0;
 		credentialGeneration += 1;
 	}
 	function updateSession(session) {
-		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0);
+		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0 || userApiCredentials.hasAuthority());
 		const changedSession = sessionId === void 0 ? !sessionAuthorityObserved || session !== null : !session || session.id !== sessionId || session.user.id !== sessionUserId;
 		if (!session || unboundCredential || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
 		if (changedSession || recentAuthenticationStartAttempt && (recentAuthenticationStartAttempt.sessionId !== session?.id || recentAuthenticationStartAttempt.userId !== session?.user.id)) recentAuthenticationStartAttempt = void 0;
@@ -4977,6 +5089,21 @@ function createAuthClient(options) {
 			const member = normalizeIdInput(memberId);
 			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
 		},
+		async createOrganization(name, slug, idempotencyKey) {
+			const body = normalizeOrganizationCreationInput(name, slug, idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeCreatedOrganization(value);
+		},
 		async createOrganizationTeam(organizationId, name, idempotencyKey) {
 			const id = normalizeIdInput(organizationId);
 			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);
@@ -5043,6 +5170,39 @@ function createAuthClient(options) {
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			return normalizeCanceledOrganizationInvitation(value);
 		},
+		async removeOrganizationMember(organizationId, memberId, idempotencyKey) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "members", member, "remove"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMembershipRemovalError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeRemovedOrganizationMember(value);
+		},
+		async leaveOrganization(organizationId, idempotencyKey) {
+			const organization = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "leave"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMembershipRemovalError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeOrganizationDeparture(value);
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);
@@ -5197,6 +5357,10 @@ function createAuthClient(options) {
 			}));
 		},
 		signOut,
+		getUserApiCredential(input) {
+			if (invitationRequest || signOutRequest || activeAccountMutationGeneration !== void 0) return Promise.reject(new AuthError("state_conflict", 409));
+			return userApiCredentials.get(input);
+		},
 		getDriveCredential(input) {
 			let workspace;
 			try {