@finueva/auth 0.17.0 → 0.18.0

package/README.md

@@ -94,28 +94,31 @@ The browser owns the session cookie. The SDK does not expose or persist it.
 
 ## Common Tasks
 
-| Task                          | Browser                                     | Server                                    | Device                                 |
-| ----------------------------- | ------------------------------------------- | ----------------------------------------- | -------------------------------------- |
-| Create an account             | `signUp()`                                  | Not available                             | `signUpWithEmail()`                    |
-| Read the current session      | `getSession()`                              | `getSession()`                            | `getSession()`                         |
-| Observe session state         | `onAuthStateChange()`                       | Not available                             | Not available                          |
-| Update a profile              | `updateProfile()`                           | Not available                             | `updateProfile()`                      |
-| Change a password             | `changePassword()`                          | Not available                             | `changePassword()`                     |
-| Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                             | Not available                          |
-| Verify an email               | `sendVerificationEmail()`                   | Not available                             | Not available                          |
-| List organizations            | `listOrganizations()`                       | `listOrganizations()`                     | `listOrganizations()`                  |
-| Read member authority         | `getOrganizationMemberAuthority()`          | `getOrganizationMemberAuthority()`        | `getOrganizationMemberAuthority()`     |
-| Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`                | `createOrganizationTeam()`             |
-| Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()`    | `createOrganizationMemberInvitation()` |
-| Resend a member invitation    | `resendOrganizationInvitation()`            | `resendOrganizationInvitation()` (cookie) | Not available                          |
-| Cancel a member invitation    | `cancelOrganizationInvitation()`            | `cancelOrganizationInvitation()` (cookie) | Not available                          |
-| Accept an invitation          | `acceptInvitation()`                        | `acceptInvitation()`                      | Not available                          |
-| Enroll a passkey              | `addPasskey()`                              | Not available                             | Not available                          |
-| Perform recent authentication | Platform and organization action methods    | Not available                             | Not available                          |
-| Change manual roles or owners | Organization authority methods              | Not available                             | Not available                          |
-| Read current platform roles   | `getPlatformStatus()`                       | Not available                             | Not available                          |
-| Request Drive access          | `getDriveCredential()`                      | `getDriveCredential()`                    | `getDriveCredential()`                 |
-| End the current session       | `signOut()`                                 | `signOut()`                               | `revokeCurrentDevice()`                |
+| Task                            | Browser                                     | Server                                    | Device                                 |
+| ------------------------------- | ------------------------------------------- | ----------------------------------------- | -------------------------------------- |
+| Create an account               | `signUp()`                                  | Not available                             | `signUpWithEmail()`                    |
+| Read the current session        | `getSession()`                              | `getSession()`                            | `getSession()`                         |
+| Observe session state           | `onAuthStateChange()`                       | Not available                             | Not available                          |
+| Update a profile                | `updateProfile()`                           | Not available                             | `updateProfile()`                      |
+| Change a password               | `changePassword()`                          | Not available                             | `changePassword()`                     |
+| Reset a password                | `requestPasswordReset()`, `resetPassword()` | Not available                             | Not available                          |
+| Verify an email                 | `sendVerificationEmail()`                   | Not available                             | Not available                          |
+| List organizations              | `listOrganizations()`                       | `listOrganizations()`                     | `listOrganizations()`                  |
+| Read member authority           | `getOrganizationMemberAuthority()`          | `getOrganizationMemberAuthority()`        | `getOrganizationMemberAuthority()`     |
+| Create an ordinary organization | `createOrganization()`                      | `createOrganization()`                    | `createOrganization()`                 |
+| Create an ordinary team         | `createOrganizationTeam()`                  | `createOrganizationTeam()`                | `createOrganizationTeam()`             |
+| Invite an ordinary member       | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()`    | `createOrganizationMemberInvitation()` |
+| Resend a member invitation      | `resendOrganizationInvitation()`            | `resendOrganizationInvitation()` (cookie) | Not available                          |
+| Cancel a member invitation      | `cancelOrganizationInvitation()`            | `cancelOrganizationInvitation()` (cookie) | Not available                          |
+| Remove an ordinary member       | `removeOrganizationMember()`                | `removeOrganizationMember()` (cookie)     | Not available                          |
+| Leave an organization           | `leaveOrganization()`                       | `leaveOrganization()` (cookie)            | Not available                          |
+| Accept an invitation            | `acceptInvitation()`                        | `acceptInvitation()`                      | Not available                          |
+| Enroll a passkey                | `addPasskey()`                              | Not available                             | Not available                          |
+| Perform recent authentication   | Platform and organization action methods    | Not available                             | Not available                          |
+| Change manual roles or owners   | Organization authority methods              | Not available                             | Not available                          |
+| Read current platform roles     | `getPlatformStatus()`                       | Not available                             | Not available                          |
+| Request Drive access            | `getDriveCredential()`                      | `getDriveCredential()`                    | `getDriveCredential()`                 |
+| End the current session         | `signOut()`                                 | `signOut()`                               | `revokeCurrentDevice()`                |
 
 ## Create An Organization Invitation
 
@@ -142,6 +145,17 @@ const canceled = await auth.cancelOrganizationInvitation(organizationId, invitat
 
 Resend success confirms the committed expiry. It does not confirm email delivery. Repeat an action with the same key only after a lost response. A bearer-backed server client rejects both methods before network I/O.
 
+## Remove An Organization Member
+
+Manual owners and manual administrators remove one other member. Every current member can leave. Both operations use browser-cookie or server-cookie authority:
+
+```ts
+const removed = await auth.removeOrganizationMember(organizationId, memberId, crypto.randomUUID());
+const left = await auth.leaveOrganization(organizationId, crypto.randomUUID());
+```
+
+An owner target is refused. Transfer ownership first. Repeat a removal with the same key only after a lost response; a membership that is already gone under that key replays the same result. A bearer-backed server client rejects both methods before network I/O.
+
 ## Perform Recent Authentication
 
 The experimental passkey methods run only when the browser page uses the exact Auth Origin. To enroll a passkey, first create a new password-authenticated session on that origin:

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { $ as UserApiCredential, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, W as SocialIdTokenInput, X as AuthError, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, d as CreatedOrganizationMemberInvitation, et as UserApiCredentialInput, f as CreatedOrganizationTeam, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-CqFT4G95.js";
+import { $ as AuthError, A as OrganizationTeamPage, B as ReceivedOrganizationInvitation, C as OrganizationMemberAuthority, D as OrganizationTeam, E as OrganizationPageInput, J as SocialIdTokenProvider, O as OrganizationTeamDisplay, S as OrganizationMember, T as OrganizationPage, V as ReceivedOrganizationInvitationPage, X as UpdateOrganizationTeamDisplayInput, Y as UpdateOrganizationDisplayInput, Z as UpdateProfileInput, b as OrganizationInvitation, d as CreatedOrganization, et as AuthErrorCode, f as CreatedOrganizationMemberInvitation, h as DriveCredentialInput, k as OrganizationTeamMemberPage, m as DriveCredential, nt as UserApiCredential, o as AuthSession, p as CreatedOrganizationTeam, q as SocialIdTokenInput, r as AuthOrganization, rt as UserApiCredentialInput, tt as AuthErrorStatus, u as CreateOrganizationMemberInvitationInput, w as OrganizationMemberPage, x as OrganizationInvitationPage, y as OrganizationDisplay } from "./types-CrdIcEJ3.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -46,6 +46,7 @@ interface DeviceAuthClient {
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
   getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
+  createOrganization(name: string, slug: string, idempotencyKey: string): Promise<CreatedOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
@@ -70,4 +71,4 @@ interface DeviceAuthClient {
 }
 declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };
+export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };

package/dist/device.js

@@ -187,6 +187,7 @@ const messages = {
 	recipient_unavailable: "The recipient is unavailable.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
 	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	membership_removal_recovery_required: "Membership removal requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
@@ -716,6 +717,27 @@ function normalizeOrganizationTeamDisplay(value) {
 		throw authorityUnavailable();
 	}
 }
+function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255) || typeof slug !== "string" || !/^[a-z0-9-]{1,128}$/.test(slug)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		slug,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganization(value) {
+	exact(value, [
+		"id",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 128)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
 function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
 	return {
@@ -1595,6 +1617,30 @@ function createDeviceAuth(options) {
 			const member = normalizeIdInput(memberId);
 			return serializeAuthority(() => organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member)));
 		},
+		createOrganization(name, slug, idempotencyKey) {
+			let body;
+			try {
+				body = normalizeOrganizationCreationInput(name, slug, idempotencyKey);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				return normalizeCreatedOrganization((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/organizations"), {
+					fetch: requestFetch,
+					timeoutMs,
+					method: "POST",
+					credentials: "omit",
+					headers: {
+						authorization: `Bearer ${current.accessToken}`,
+						"content-type": "application/json"
+					},
+					body,
+					mapError: fromOrganizationMutationAuthorityError
+				})).value);
+			});
+		},
 		createOrganizationTeam(organizationId, name, idempotencyKey) {
 			let id;
 			let body;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { $ as UserApiCredential, A as PersonalWorkspaceSelection, B as RecentAuthenticationStatus, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, F as PlatformRoleChangeRecentAuthenticationInput, G as SocialIdTokenProvider, H as SendVerificationEmailInput, I as PlatformRoleFirstApproval, J as UpdateProfileInput, K as UpdateOrganizationDisplayInput, L as PlatformStatus, M as PlatformRole, N as PlatformRoleApplied, O as OrganizationTeamPage, P as PlatformRoleApproval, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, U as SignInInput, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, a as AuthPersistenceDriver, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, et as UserApiCredentialInput, f as CreatedOrganizationTeam, g as InvitationAcceptance, h as FinuevaAuthClient, i as AuthPersistence, j as PlatformBootstrapRoleChangeInput, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, n as AuthClientOptions, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-CqFT4G95.js";
+import { $ as AuthError, A as OrganizationTeamPage, B as ReceivedOrganizationInvitation, C as OrganizationMemberAuthority, D as OrganizationTeam, E as OrganizationPageInput, F as PlatformRoleApplied, G as SendVerificationEmailInput, H as RecentAuthenticationStatus, I as PlatformRoleApproval, J as SocialIdTokenProvider, K as SignInInput, L as PlatformRoleChangeRecentAuthenticationInput, M as PersonalWorkspaceSelection, N as PlatformBootstrapRoleChangeInput, O as OrganizationTeamDisplay, P as PlatformRole, Q as WorkspaceSelection, R as PlatformRoleFirstApproval, S as OrganizationMember, T as OrganizationPage, U as RemovedOrganizationMember, V as ReceivedOrganizationInvitationPage, W as ResentOrganizationInvitation, X as UpdateOrganizationTeamDisplayInput, Y as UpdateOrganizationDisplayInput, Z as UpdateProfileInput, _ as InvitationAcceptance, a as AuthPersistenceDriver, b as OrganizationInvitation, c as AuthUser, d as CreatedOrganization, et as AuthErrorCode, f as CreatedOrganizationMemberInvitation, g as FinuevaAuthClient, h as DriveCredentialInput, i as AuthPersistence, j as OrganizationWorkspaceSelection, k as OrganizationTeamMemberPage, l as CanceledOrganizationInvitation, m as DriveCredential, n as AuthClientOptions, nt as UserApiCredential, o as AuthSession, p as CreatedOrganizationTeam, q as SocialIdTokenInput, r as AuthOrganization, rt as UserApiCredentialInput, s as AuthState, t as AcceptInvitationInput, tt as AuthErrorStatus, u as CreateOrganizationMemberInvitationInput, v as OrganizationDeparture, w as OrganizationMemberPage, x as OrganizationInvitationPage, y as OrganizationDisplay, z as PlatformStatus } from "./types-CrdIcEJ3.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type ResentOrganizationInvitation, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -2546,6 +2546,7 @@ const messages = {
 	recipient_unavailable: "The recipient is unavailable.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
 	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	membership_removal_recovery_required: "Membership removal requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
@@ -3027,6 +3028,27 @@ function normalizeOrganizationTeamDisplay(value) {
 		throw authorityUnavailable();
 	}
 }
+function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255) || typeof slug !== "string" || !/^[a-z0-9-]{1,128}$/.test(slug)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		slug,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganization(value) {
+	exact(value, [
+		"id",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 128)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
 function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
 	return {
@@ -3083,6 +3105,20 @@ function normalizeCanceledOrganizationInvitation(value) {
 	if (value.status !== "canceled") throw authorityUnavailable();
 	return { status: "canceled" };
 }
+function normalizeOrganizationMembershipRemovalInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeRemovedOrganizationMember(value) {
+	exact(value, ["status"]);
+	if (value.status !== "removed") throw authorityUnavailable();
+	return { status: "removed" };
+}
+function normalizeOrganizationDeparture(value) {
+	exact(value, ["status"]);
+	if (value.status !== "left") throw authorityUnavailable();
+	return { status: "left" };
+}
 function normalizeOrganizations(value) {
 	exact(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -3318,6 +3354,10 @@ function fromOrganizationInvitationAdministrationError(value, status, retryAfter
 	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
+function fromOrganizationMembershipRemovalError(value, status, retryAfter) {
+	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("membership_removal_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
 function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== "changeReference,expectedGlobalRevision,expectedTargetRevision,idempotencyKey,reasonCategory,requestedRoles,targetUserId") throw new TypeError("recent authentication input is invalid");
 	if (!isId(value.targetUserId)) throw new TypeError("targetUserId is invalid");
@@ -5049,6 +5089,21 @@ function createAuthClient(options) {
 			const member = normalizeIdInput(memberId);
 			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
 		},
+		async createOrganization(name, slug, idempotencyKey) {
+			const body = normalizeOrganizationCreationInput(name, slug, idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeCreatedOrganization(value);
+		},
 		async createOrganizationTeam(organizationId, name, idempotencyKey) {
 			const id = normalizeIdInput(organizationId);
 			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);
@@ -5115,6 +5170,39 @@ function createAuthClient(options) {
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			return normalizeCanceledOrganizationInvitation(value);
 		},
+		async removeOrganizationMember(organizationId, memberId, idempotencyKey) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "members", member, "remove"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMembershipRemovalError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeRemovedOrganizationMember(value);
+		},
+		async leaveOrganization(organizationId, idempotencyKey) {
+			const organization = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "leave"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMembershipRemovalError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeOrganizationDeparture(value);
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { $ as UserApiCredential, A as PersonalWorkspaceSelection, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, et as UserApiCredentialInput, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-CqFT4G95.js";
+import { $ as AuthError, A as OrganizationTeamPage, B as ReceivedOrganizationInvitation, C as OrganizationMemberAuthority, D as OrganizationTeam, E as OrganizationPageInput, J as SocialIdTokenProvider, M as PersonalWorkspaceSelection, O as OrganizationTeamDisplay, Q as WorkspaceSelection, S as OrganizationMember, T as OrganizationPage, U as RemovedOrganizationMember, V as ReceivedOrganizationInvitationPage, W as ResentOrganizationInvitation, X as UpdateOrganizationTeamDisplayInput, Y as UpdateOrganizationDisplayInput, _ as InvitationAcceptance, b as OrganizationInvitation, c as AuthUser, d as CreatedOrganization, et as AuthErrorCode, f as CreatedOrganizationMemberInvitation, h as DriveCredentialInput, j as OrganizationWorkspaceSelection, k as OrganizationTeamMemberPage, l as CanceledOrganizationInvitation, m as DriveCredential, nt as UserApiCredential, o as AuthSession, p as CreatedOrganizationTeam, q as SocialIdTokenInput, r as AuthOrganization, rt as UserApiCredentialInput, t as AcceptInvitationInput, tt as AuthErrorStatus, u as CreateOrganizationMemberInvitationInput, v as OrganizationDeparture, w as OrganizationMemberPage, x as OrganizationInvitationPage, y as OrganizationDisplay } from "./types-CrdIcEJ3.js";
 //#region src/user-api/verifier.d.ts
 interface UserApiIdentity {
   userId: string;
@@ -40,6 +40,33 @@ interface FinuevaIdentityResolverAuth {
 /** Server-only identity resolution. Keep results private; they grant no product authority. */
 declare function createIdentityResolverAuth(options: IdentityResolverAuthOptions): FinuevaIdentityResolverAuth;
 //#endregion
+//#region src/membership-resolution.d.ts
+interface MembershipResolverAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}
+interface ResolveMembershipInput {
+  organizationId: string;
+  userId: string;
+}
+type ResolvedMembershipRole = "admin" | "member" | "owner";
+interface ResolvedMembership {
+  checkedAt: string;
+  manualRole: ResolvedMembershipRole;
+  memberCount: number;
+  memberId: string;
+  organizationId: string;
+  owner: boolean;
+  role: ResolvedMembershipRole;
+  userId: string;
+}
+interface FinuevaMembershipResolverAuth {
+  resolveMembership(input: ResolveMembershipInput, clientAssertion: string): Promise<ResolvedMembership | null>;
+}
+/** Server-only organization membership resolution. Keep results private; they are Auth authority, not product authority. */
+declare function createMembershipResolverAuth(options: MembershipResolverAuthOptions): FinuevaMembershipResolverAuth;
+//#endregion
 //#region src/drive-recipients.d.ts
 interface DriveRecipientAuthOptions {
   authOrigin: string;
@@ -102,10 +129,13 @@ interface FinuevaServerAuth {
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
   getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
+  createOrganization(name: string, slug: string, idempotencyKey: string): Promise<CreatedOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
   cancelOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<CanceledOrganizationInvitation>;
+  removeOrganizationMember(organizationId: string, memberId: string, idempotencyKey: string): Promise<RemovedOrganizationMember>;
+  leaveOrganization(organizationId: string, idempotencyKey: string): Promise<OrganizationDeparture>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
   listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
@@ -122,4 +152,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, FinuevaServerAuth, type IdentityResolverAuthOptions, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolvedIdentity, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createServerAuth, createUserApiVerifier };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type IdentityResolverAuthOptions, type InvitationAcceptance, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };

package/dist/server.js

@@ -187,6 +187,7 @@ const messages = {
 	recipient_unavailable: "The recipient is unavailable.",
 	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
 	invitation_recovery_required: "Invitation administration requires separate recovery.",
+	membership_removal_recovery_required: "Membership removal requires separate recovery.",
 	email_verification_required: "Email verification is required.",
 	invalid_workspace_selection: "The workspace selection is invalid.",
 	organization_context_too_large: "The organization context is too large.",
@@ -1632,7 +1633,7 @@ function normalizeIdInput(value) {
 	return value;
 }
 function normalizeOrganization(value) {
-	exact$2(value, [
+	exact$3(value, [
 		"capabilities",
 		"id",
 		"lifecycle",
@@ -1642,7 +1643,7 @@ function normalizeOrganization(value) {
 		"slug"
 	]);
 	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
-	exact$2(value.capabilities, [
+	exact$3(value.capabilities, [
 		"readInvitations",
 		"readMembers",
 		"readTeams"
@@ -1695,6 +1696,27 @@ function normalizeOrganizationTeamDisplay(value) {
 		throw authorityUnavailable();
 	}
 }
+function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255) || typeof slug !== "string" || !/^[a-z0-9-]{1,128}$/.test(slug)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		slug,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganization(value) {
+	exact$3(value, [
+		"id",
+		"name",
+		"slug"
+	]);
+	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 128)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		slug: value.slug
+	};
+}
 function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
 	return {
@@ -1703,7 +1725,7 @@ function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganizationTeam(value) {
-	exact$2(value, ["id", "name"]);
+	exact$3(value, ["id", "name"]);
 	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -1730,7 +1752,7 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 	};
 }
 function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact$2(value, ["expiresAt", "id"]);
+	exact$3(value, ["expiresAt", "id"]);
 	if (!isId(value.id)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -1747,12 +1769,26 @@ function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeCanceledOrganizationInvitation(value) {
-	exact$2(value, ["status"]);
+	exact$3(value, ["status"]);
 	if (value.status !== "canceled") throw authorityUnavailable();
 	return { status: "canceled" };
 }
+function normalizeOrganizationMembershipRemovalInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeRemovedOrganizationMember(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "removed") throw authorityUnavailable();
+	return { status: "removed" };
+}
+function normalizeOrganizationDeparture(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "left") throw authorityUnavailable();
+	return { status: "left" };
+}
 function normalizeOrganizations(value) {
-	exact$2(value, ["nextCursor", "organizations"]);
+	exact$3(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
 		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
@@ -1760,11 +1796,11 @@ function normalizeOrganizations(value) {
 	};
 }
 function normalizeOrganizationMembers(value) {
-	exact$2(value, ["members", "nextCursor"]);
+	exact$3(value, ["members", "nextCursor"]);
 	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
 	return {
 		members: unique(value.members.map((member) => {
-			exact$2(member, [
+			exact$3(member, [
 				"email",
 				"id",
 				"image",
@@ -1793,11 +1829,11 @@ function normalizeOrganizationMembers(value) {
 	};
 }
 function normalizeOrganizationTeams(value) {
-	exact$2(value, ["nextCursor", "teams"]);
+	exact$3(value, ["nextCursor", "teams"]);
 	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
 	return {
 		teams: unique(value.teams.map((team) => {
-			exact$2(team, [
+			exact$3(team, [
 				"category",
 				"createdAt",
 				"id",
@@ -1815,7 +1851,7 @@ function normalizeOrganizationTeams(value) {
 	};
 }
 function normalizeOrganizationTeamMembers(value) {
-	exact$2(value, ["memberIds", "nextCursor"]);
+	exact$3(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
 		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
@@ -1823,7 +1859,7 @@ function normalizeOrganizationTeamMembers(value) {
 	};
 }
 function normalizeOrganizationInvitation(value) {
-	exact$2(value, [
+	exact$3(value, [
 		"createdAt",
 		"email",
 		"expiresAt",
@@ -1834,7 +1870,7 @@ function normalizeOrganizationInvitation(value) {
 		"teamIds"
 	]);
 	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
-	exact$2(value.inviter, ["membershipId", "name"]);
+	exact$3(value.inviter, ["membershipId", "name"]);
 	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -1851,7 +1887,7 @@ function normalizeOrganizationInvitation(value) {
 	};
 }
 function normalizeOrganizationInvitations(value) {
-	exact$2(value, ["invitations", "nextCursor"]);
+	exact$3(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
@@ -1859,7 +1895,7 @@ function normalizeOrganizationInvitations(value) {
 	};
 }
 function normalizeReceivedInvitation(value) {
-	exact$2(value, [
+	exact$3(value, [
 		"expiresAt",
 		"id",
 		"inviterName",
@@ -1868,7 +1904,7 @@ function normalizeReceivedInvitation(value) {
 		"teams"
 	]);
 	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
-	exact$2(value.organization, [
+	exact$3(value.organization, [
 		"id",
 		"logo",
 		"name",
@@ -1885,7 +1921,7 @@ function normalizeReceivedInvitation(value) {
 		},
 		role: value.role,
 		teams: unique(value.teams.map((team) => {
-			exact$2(team, ["id", "name"]);
+			exact$3(team, ["id", "name"]);
 			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
 			return {
 				id: team.id,
@@ -1897,7 +1933,7 @@ function normalizeReceivedInvitation(value) {
 	};
 }
 function normalizeReceivedInvitations(value) {
-	exact$2(value, ["invitations", "nextCursor"]);
+	exact$3(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
@@ -1972,8 +2008,12 @@ function fromOrganizationInvitationAdministrationError(value, status, retryAfter
 	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("invitation_recovery_required", 422);
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
+function fromOrganizationMembershipRemovalError(value, status, retryAfter) {
+	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("membership_removal_recovery_required", 422);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
 function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact$2(value, [
+	exact$3(value, [
 		"organizationId",
 		"actor",
 		"target"
@@ -1991,7 +2031,7 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 	};
 }
 function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact$2(value, [
+	exact$3(value, [
 		"memberId",
 		"manualRole",
 		"role",
@@ -2084,7 +2124,7 @@ function toDate(value) {
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
-function exact$2(value, keys) {
+function exact$3(value, keys) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
 function boundedString(value, maximum) {
@@ -2383,7 +2423,7 @@ function createUserApiVerifier(options) {
 //#endregion
 //#region src/identity-resolution.ts
 const emailPattern$1 = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$(?![\s\S])/;
-function exact$1(value, keys) {
+function exact$2(value, keys) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
 }
 function createIdentityResolverAuth(options) {
@@ -2393,7 +2433,7 @@ function createIdentityResolverAuth(options) {
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
 	let inFlight = false;
 	return { async resolveIdentity(input, clientAssertion) {
-		if (!exact$1(input, ["identifier"]) || typeof input.identifier !== "string" || input.identifier.length > 324) throw new AuthError("invalid_request", 400);
+		if (!exact$2(input, ["identifier"]) || typeof input.identifier !== "string" || input.identifier.length > 324) throw new AuthError("invalid_request", 400);
 		const identifier = input.identifier.trim().toLowerCase();
 		if (!(identifier.length <= 320 && emailPattern$1.test(identifier)) && !/^[a-z0-9_.]{3,30}$(?![\s\S])/.test(identifier)) throw new AuthError("invalid_request", 400);
 		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
@@ -2445,7 +2485,7 @@ function createIdentityResolverAuth(options) {
 				}
 				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
 				if (response.status !== 200) {
-					if (!exact$1(value, ["code", "message"])) throw authorityUnavailable();
+					if (!exact$2(value, ["code", "message"])) throw authorityUnavailable();
 					if (response.status === 401 && value.code === "UNAUTHORIZED" && value.message === "The identity resolution assertion is invalid.") mappedError = new AuthError("authentication_required", 401);
 					if (response.status === 429 && value.code === "TOO_MANY_REQUESTS" && value.message === "Identity resolution requests are temporarily limited.") {
 						const retryAfter = response.headers.get("retry-after");
@@ -2454,9 +2494,9 @@ function createIdentityResolverAuth(options) {
 					}
 					throw mappedError ?? authorityUnavailable();
 				}
-				if (!exact$1(value, ["identity"])) throw authorityUnavailable();
+				if (!exact$2(value, ["identity"])) throw authorityUnavailable();
 				if (value.identity === null) return null;
-				if (!exact$1(value.identity, ["userId"]) || typeof value.identity.userId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(value.identity.userId)) throw authorityUnavailable();
+				if (!exact$2(value.identity, ["userId"]) || typeof value.identity.userId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(value.identity.userId)) throw authorityUnavailable();
 				return { userId: value.identity.userId };
 			};
 			return await Promise.race([exchange().finally(() => {
@@ -2473,6 +2513,127 @@ function createIdentityResolverAuth(options) {
 	} };
 }
 //#endregion
+//#region src/membership-resolution.ts
+const idPattern = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const isoPattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$(?![\s\S])/;
+const roles = [
+	"admin",
+	"member",
+	"owner"
+];
+const membershipKeys = [
+	"checkedAt",
+	"manualRole",
+	"memberCount",
+	"memberId",
+	"organizationId",
+	"owner",
+	"role",
+	"userId"
+];
+function exact$1(value, keys) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function createMembershipResolverAuth(options) {
+	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/memberships/resolve");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = false;
+	return { async resolveMembership(input, clientAssertion) {
+		if (!exact$1(input, ["organizationId", "userId"]) || typeof input.organizationId !== "string" || typeof input.userId !== "string" || !idPattern.test(input.organizationId) || !idPattern.test(input.userId)) throw new AuthError("invalid_request", 400);
+		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight) throw new AuthError("state_conflict", 409);
+		inFlight = true;
+		const organizationId = input.organizationId;
+		const userId = input.userId;
+		const controller = new AbortController();
+		let reader;
+		let timer;
+		let mappedError;
+		try {
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(authorityUnavailable());
+					controller.abort();
+					reader?.cancel().catch(() => {});
+				}, timeoutMs);
+			});
+			const exchange = async () => {
+				const response = await fetchImpl(url, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${clientAssertion}`,
+						accept: "application/json",
+						"content-type": "application/json"
+					},
+					body: JSON.stringify({
+						organizationId,
+						userId
+					}),
+					credentials: "omit",
+					cache: "no-store",
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					response.body?.cancel().catch(() => {});
+					throw authorityUnavailable();
+				}
+				if (!response.body) throw authorityUnavailable();
+				reader = response.body.getReader();
+				const length = response.headers.get("content-length");
+				if (response.redirected || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > 1024)) throw authorityUnavailable();
+				const bytes = new Uint8Array(1024);
+				let size = 0;
+				while (true) {
+					const chunk = await reader.read();
+					if (controller.signal.aborted) throw authorityUnavailable();
+					if (chunk.done) break;
+					if (size + chunk.value.byteLength > bytes.length) throw authorityUnavailable();
+					bytes.set(chunk.value, size);
+					size += chunk.value.byteLength;
+				}
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+				if (response.status !== 200) {
+					if (!exact$1(value, ["code", "message"])) throw authorityUnavailable();
+					if (response.status === 401 && value.code === "UNAUTHORIZED" && value.message === "The membership resolution assertion is invalid.") mappedError = new AuthError("authentication_required", 401);
+					if (response.status === 429 && value.code === "TOO_MANY_REQUESTS" && value.message === "Membership resolution requests are temporarily limited.") {
+						const retryAfter = response.headers.get("retry-after");
+						if (retryAfter === null || !/^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) throw authorityUnavailable();
+						mappedError = new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
+					}
+					throw mappedError ?? authorityUnavailable();
+				}
+				if (!exact$1(value, ["membership"])) throw authorityUnavailable();
+				if (value.membership === null) return null;
+				const membership = value.membership;
+				if (!exact$1(membership, membershipKeys) || typeof membership.checkedAt !== "string" || !isoPattern.test(membership.checkedAt) || Number.isNaN(Date.parse(membership.checkedAt)) || typeof membership.manualRole !== "string" || !roles.includes(membership.manualRole) || typeof membership.role !== "string" || !roles.includes(membership.role) || typeof membership.memberCount !== "number" || !Number.isSafeInteger(membership.memberCount) || membership.memberCount < 0 || typeof membership.memberId !== "string" || !idPattern.test(membership.memberId) || typeof membership.owner !== "boolean" || membership.organizationId !== organizationId || membership.userId !== userId) throw authorityUnavailable();
+				return {
+					checkedAt: membership.checkedAt,
+					manualRole: membership.manualRole,
+					memberCount: membership.memberCount,
+					memberId: membership.memberId,
+					organizationId,
+					owner: membership.owner,
+					role: membership.role,
+					userId
+				};
+			};
+			return await Promise.race([exchange().finally(() => {
+				inFlight = false;
+			}), deadline]);
+		} catch (error) {
+			if (mappedError && mappedError === error) throw mappedError;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+			reader?.cancel().catch(() => {});
+		}
+	} };
+}
+//#endregion
 //#region src/drive-recipients.ts
 const encoder = new TextEncoder();
 const emailPattern = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$/;
@@ -2810,6 +2971,21 @@ function createServerAuth(options) {
 			const member = normalizeIdInput(memberId);
 			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
 		},
+		async createOrganization(name, slug, idempotencyKey) {
+			const body = normalizeOrganizationCreationInput(name, slug, idempotencyKey);
+			return normalizeCreatedOrganization(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
 		async createOrganizationTeam(organizationId, name, idempotencyKey) {
 			const id = normalizeIdInput(organizationId);
 			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);
@@ -2878,6 +3054,41 @@ function createServerAuth(options) {
 				mapError: fromOrganizationInvitationAdministrationError
 			}));
 		},
+		async removeOrganizationMember(organizationId, memberId, idempotencyKey) {
+			if (authorization) throw new AuthError("authentication_required", 401);
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+			return normalizeRemovedOrganizationMember(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "members", member, "remove"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMembershipRemovalError
+			}));
+		},
+		async leaveOrganization(organizationId, idempotencyKey) {
+			if (authorization) throw new AuthError("authentication_required", 401);
+			const organization = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+			return normalizeOrganizationDeparture(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "leave"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMembershipRemovalError
+			}));
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);
@@ -3044,4 +3255,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createServerAuth, createUserApiVerifier };
+export { AuthError, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };

package/dist/{types-CqFT4G95.d.ts → types-CrdIcEJ3.d.ts}

@@ -10,7 +10,7 @@ interface UserApiCredential {
 }
 //#endregion
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable";
 type AuthErrorStatus = 400 | 401 | 403 | 404 | 405 | 409 | 413 | 415 | 422 | 429 | 503;
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
@@ -84,6 +84,11 @@ interface OrganizationTeam {
   category: "manual" | "managed";
   createdAt: Date;
 }
+interface CreatedOrganization {
+  id: string;
+  name: string;
+  slug: string;
+}
 interface CreatedOrganizationTeam {
   id: string;
   name: string;
@@ -104,6 +109,12 @@ interface ResentOrganizationInvitation {
 interface CanceledOrganizationInvitation {
   status: "canceled";
 }
+interface RemovedOrganizationMember {
+  status: "removed";
+}
+interface OrganizationDeparture {
+  status: "left";
+}
 interface OrganizationTeamPage {
   teams: OrganizationTeam[];
   nextCursor: string | null;
@@ -304,10 +315,13 @@ interface FinuevaAuthClient {
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
   getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
+  createOrganization(name: string, slug: string, idempotencyKey: string): Promise<CreatedOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   resendOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<ResentOrganizationInvitation>;
   cancelOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<CanceledOrganizationInvitation>;
+  removeOrganizationMember(organizationId: string, memberId: string, idempotencyKey: string): Promise<RemovedOrganizationMember>;
+  leaveOrganization(organizationId: string, idempotencyKey: string): Promise<OrganizationDeparture>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
   changeOrganizationMemberManualRole(organizationId: string, targetMembershipId: string, input: OrganizationManualRoleChangeInput): Promise<OrganizationManualRoleChangeResult>;
@@ -334,4 +348,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { UserApiCredential as $, PersonalWorkspaceSelection as A, RecentAuthenticationStatus as B, OrganizationPage as C, OrganizationTeamMemberPage as D, OrganizationTeamDisplay as E, PlatformRoleChangeRecentAuthenticationInput as F, SocialIdTokenProvider as G, SendVerificationEmailInput as H, PlatformRoleFirstApproval as I, UpdateProfileInput as J, UpdateOrganizationDisplayInput as K, PlatformStatus as L, PlatformRole as M, PlatformRoleApplied as N, OrganizationTeamPage as O, PlatformRoleApproval as P, AuthErrorStatus as Q, ReceivedOrganizationInvitation as R, OrganizationMemberPage as S, OrganizationTeam as T, SignInInput as U, ResentOrganizationInvitation as V, SocialIdTokenInput as W, AuthError as X, WorkspaceSelection as Y, AuthErrorCode as Z, OrganizationDisplay as _, AuthPersistenceDriver as a, OrganizationMember as b, AuthUser as c, CreatedOrganizationMemberInvitation as d, UserApiCredentialInput as et, CreatedOrganizationTeam as f, InvitationAcceptance as g, FinuevaAuthClient as h, AuthPersistence as i, PlatformBootstrapRoleChangeInput as j, OrganizationWorkspaceSelection as k, CanceledOrganizationInvitation as l, DriveCredentialInput as m, AuthClientOptions as n, AuthSession as o, DriveCredential as p, UpdateOrganizationTeamDisplayInput as q, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreateOrganizationMemberInvitationInput as u, OrganizationInvitation as v, OrganizationPageInput as w, OrganizationMemberAuthority as x, OrganizationInvitationPage as y, ReceivedOrganizationInvitationPage as z };
+export { AuthError as $, OrganizationTeamPage as A, ReceivedOrganizationInvitation as B, OrganizationMemberAuthority as C, OrganizationTeam as D, OrganizationPageInput as E, PlatformRoleApplied as F, SendVerificationEmailInput as G, RecentAuthenticationStatus as H, PlatformRoleApproval as I, SocialIdTokenProvider as J, SignInInput as K, PlatformRoleChangeRecentAuthenticationInput as L, PersonalWorkspaceSelection as M, PlatformBootstrapRoleChangeInput as N, OrganizationTeamDisplay as O, PlatformRole as P, WorkspaceSelection as Q, PlatformRoleFirstApproval as R, OrganizationMember as S, OrganizationPage as T, RemovedOrganizationMember as U, ReceivedOrganizationInvitationPage as V, ResentOrganizationInvitation as W, UpdateOrganizationTeamDisplayInput as X, UpdateOrganizationDisplayInput as Y, UpdateProfileInput as Z, InvitationAcceptance as _, AuthPersistenceDriver as a, OrganizationInvitation as b, AuthUser as c, CreatedOrganization as d, AuthErrorCode as et, CreatedOrganizationMemberInvitation as f, FinuevaAuthClient as g, DriveCredentialInput as h, AuthPersistence as i, OrganizationWorkspaceSelection as j, OrganizationTeamMemberPage as k, CanceledOrganizationInvitation as l, DriveCredential as m, AuthClientOptions as n, UserApiCredential as nt, AuthSession as o, CreatedOrganizationTeam as p, SocialIdTokenInput as q, AuthOrganization as r, UserApiCredentialInput as rt, AuthState as s, AcceptInvitationInput as t, AuthErrorStatus as tt, CreateOrganizationMemberInvitationInput as u, OrganizationDeparture as v, OrganizationMemberPage as w, OrganizationInvitationPage as x, OrganizationDisplay as y, PlatformStatus as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,