@finueva/auth 0.18.0 → 0.19.0

package/dist/index.js

@@ -2291,7 +2291,7 @@ const passkeyClient = () => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.1_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_dfcdb59639d9fe73412dad0223379a88/node_modules/@chiballc/utils/dist/index.mjs
+//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.1_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_80fa16dd1813631ddeb36d2ee29b8660/node_modules/@chiballc/utils/dist/index.mjs
 function isPromise(arg) {
 	return arg && typeof arg.then === "function";
 }
@@ -2557,7 +2557,18 @@ const messages = {
 	platform_target_unavailable: "The platform administration target is unavailable.",
 	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
 	platform_recovery_required: "Platform administration requires separate recovery.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable."
+	identity_authority_unavailable: "Authentication is temporarily unavailable.",
+	two_factor_required: "A second authentication factor is required.",
+	two_factor_code_invalid: "The verification code is invalid.",
+	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
+	two_factor_locked: "Second-factor verification is temporarily locked.",
+	recent_sign_in_required: "A recent sign-in is required.",
+	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
+	recent_authentication_required: "A ready recent-authentication action is required.",
+	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
+	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
+	ceremony_return_refused: "The return address is not registered for this application.",
+	password_sign_in_required: "A password sign-in method is required for this passkey change."
 };
 var AuthError = class extends Error {
 	code;
@@ -2965,7 +2976,7 @@ function normalizeIdInput(value) {
 	return value;
 }
 function normalizeOrganization(value) {
-	exact(value, [
+	exact$3(value, [
 		"capabilities",
 		"id",
 		"lifecycle",
@@ -2975,7 +2986,7 @@ function normalizeOrganization(value) {
 		"slug"
 	]);
 	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
-	exact(value.capabilities, [
+	exact$3(value.capabilities, [
 		"readInvitations",
 		"readMembers",
 		"readTeams"
@@ -3037,7 +3048,7 @@ function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganization(value) {
-	exact(value, [
+	exact$3(value, [
 		"id",
 		"name",
 		"slug"
@@ -3057,7 +3068,7 @@ function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganizationTeam(value) {
-	exact(value, ["id", "name"]);
+	exact$3(value, ["id", "name"]);
 	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -3084,7 +3095,7 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 	};
 }
 function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact(value, ["expiresAt", "id"]);
+	exact$3(value, ["expiresAt", "id"]);
 	if (!isId(value.id)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -3101,7 +3112,7 @@ function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeCanceledOrganizationInvitation(value) {
-	exact(value, ["status"]);
+	exact$3(value, ["status"]);
 	if (value.status !== "canceled") throw authorityUnavailable();
 	return { status: "canceled" };
 }
@@ -3110,17 +3121,106 @@ function normalizeOrganizationMembershipRemovalInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeRemovedOrganizationMember(value) {
-	exact(value, ["status"]);
+	exact$3(value, ["status"]);
 	if (value.status !== "removed") throw authorityUnavailable();
 	return { status: "removed" };
 }
+function normalizeSuspendedOrganizationMemberStatus(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "suspended") throw authorityUnavailable();
+	return { status: "suspended" };
+}
+function normalizeRestoredOrganizationMember(value) {
+	exact$3(value, ["memberId", "status"]);
+	if (value.status !== "restored" || !isId(value.memberId)) throw authorityUnavailable();
+	return {
+		status: "restored",
+		memberId: value.memberId
+	};
+}
+const suspensionIdPattern = /^organization_membership_suspension_v1_[A-Za-z0-9_-]{43}$/;
+function normalizeSuspendedOrganizationMembers(value) {
+	exact$3(value, ["members", "nextCursor"]);
+	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
+	return {
+		members: unique(value.members.map((member) => {
+			exact$3(member, [
+				"email",
+				"id",
+				"image",
+				"name",
+				"role",
+				"suspendedAt",
+				"teamIds",
+				"userId"
+			]);
+			if (typeof member.id !== "string" || !suspensionIdPattern.test(member.id) || !isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || member.role !== "admin" && member.role !== "member" || !Array.isArray(member.teamIds) || member.teamIds.length > 100) throw authorityUnavailable();
+			return {
+				id: member.id,
+				userId: member.userId,
+				name: member.name,
+				email: member.email,
+				image: nullableHttpsUrl(member.image),
+				role: member.role,
+				teamIds: unique(member.teamIds.map((teamId) => normalizeResponseId(teamId)), (item) => item),
+				suspendedAt: responseDate(member.suspendedAt)
+			};
+		}), (item) => item.id),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
+function normalizeDepartedOrganizationMembers(value) {
+	exact$3(value, ["members", "nextCursor"]);
+	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
+	return {
+		members: unique(value.members.map((member) => {
+			exact$3(member, [
+				"departedAt",
+				"departure",
+				"email",
+				"image",
+				"name",
+				"userId"
+			]);
+			if (!isId(member.userId) || !boundedString(member.name, 255) || typeof member.email !== "string" || member.email.length > 320 || !email.test(member.email) || member.departure !== "removed" && member.departure !== "left") throw authorityUnavailable();
+			return {
+				userId: member.userId,
+				name: member.name,
+				email: member.email,
+				image: nullableHttpsUrl(member.image),
+				departure: member.departure,
+				departedAt: responseDate(member.departedAt)
+			};
+		}), (item) => item.userId),
+		nextCursor: nullableCursor(value.nextCursor)
+	};
+}
 function normalizeOrganizationDeparture(value) {
-	exact(value, ["status"]);
+	exact$3(value, ["status"]);
 	if (value.status !== "left") throw authorityUnavailable();
 	return { status: "left" };
 }
+function normalizeOrganizationTeamMembershipInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeAddedOrganizationTeamMember(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "added") throw authorityUnavailable();
+	return { status: "added" };
+}
+function normalizeRemovedOrganizationTeamMember(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "removed") throw authorityUnavailable();
+	return { status: "removed" };
+}
+function normalizeDeletedOrganizationTeam(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "deleted") throw authorityUnavailable();
+	return { status: "deleted" };
+}
 function normalizeOrganizations(value) {
-	exact(value, ["nextCursor", "organizations"]);
+	exact$3(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
 		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
@@ -3128,11 +3228,11 @@ function normalizeOrganizations(value) {
 	};
 }
 function normalizeOrganizationMembers(value) {
-	exact(value, ["members", "nextCursor"]);
+	exact$3(value, ["members", "nextCursor"]);
 	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
 	return {
 		members: unique(value.members.map((member) => {
-			exact(member, [
+			exact$3(member, [
 				"email",
 				"id",
 				"image",
@@ -3161,11 +3261,11 @@ function normalizeOrganizationMembers(value) {
 	};
 }
 function normalizeOrganizationTeams(value) {
-	exact(value, ["nextCursor", "teams"]);
+	exact$3(value, ["nextCursor", "teams"]);
 	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
 	return {
 		teams: unique(value.teams.map((team) => {
-			exact(team, [
+			exact$3(team, [
 				"category",
 				"createdAt",
 				"id",
@@ -3183,7 +3283,7 @@ function normalizeOrganizationTeams(value) {
 	};
 }
 function normalizeOrganizationTeamMembers(value) {
-	exact(value, ["memberIds", "nextCursor"]);
+	exact$3(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
 		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
@@ -3191,7 +3291,7 @@ function normalizeOrganizationTeamMembers(value) {
 	};
 }
 function normalizeOrganizationInvitation(value) {
-	exact(value, [
+	exact$3(value, [
 		"createdAt",
 		"email",
 		"expiresAt",
@@ -3202,7 +3302,7 @@ function normalizeOrganizationInvitation(value) {
 		"teamIds"
 	]);
 	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
-	exact(value.inviter, ["membershipId", "name"]);
+	exact$3(value.inviter, ["membershipId", "name"]);
 	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -3219,7 +3319,7 @@ function normalizeOrganizationInvitation(value) {
 	};
 }
 function normalizeOrganizationInvitations(value) {
-	exact(value, ["invitations", "nextCursor"]);
+	exact$3(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
@@ -3227,7 +3327,7 @@ function normalizeOrganizationInvitations(value) {
 	};
 }
 function normalizeReceivedInvitation(value) {
-	exact(value, [
+	exact$3(value, [
 		"expiresAt",
 		"id",
 		"inviterName",
@@ -3236,7 +3336,7 @@ function normalizeReceivedInvitation(value) {
 		"teams"
 	]);
 	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
-	exact(value.organization, [
+	exact$3(value.organization, [
 		"id",
 		"logo",
 		"name",
@@ -3253,7 +3353,7 @@ function normalizeReceivedInvitation(value) {
 		},
 		role: value.role,
 		teams: unique(value.teams.map((team) => {
-			exact(team, ["id", "name"]);
+			exact$3(team, ["id", "name"]);
 			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
 			return {
 				id: team.id,
@@ -3265,7 +3365,7 @@ function normalizeReceivedInvitation(value) {
 	};
 }
 function normalizeReceivedInvitations(value) {
-	exact(value, ["invitations", "nextCursor"]);
+	exact$3(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
@@ -3294,6 +3394,10 @@ function normalizeInvitationAcceptance(value, invitationId) {
 	if (!isObject(value) || !isObject(value.invitation) || !isObject(value.member) || value.invitation.id !== invitationId || value.invitation.status !== "accepted" || !isId(value.invitation.organizationId) || value.member.organizationId !== value.invitation.organizationId) throw authorityUnavailable();
 	return { organizationId: value.invitation.organizationId };
 }
+function normalizeInvitationDecline(value, invitationId) {
+	if (!isObject(value) || !isObject(value.invitation) || value.invitation.id !== invitationId || value.invitation.status !== "rejected" || value.member !== null) throw authorityUnavailable();
+	return { status: "declined" };
+}
 function normalizeWorkspaceSelection(value) {
 	if (!isObject(value)) throw new AuthError("invalid_workspace_selection", 422);
 	const keys = Object.keys(value);
@@ -3358,6 +3462,73 @@ function fromOrganizationMembershipRemovalError(value, status, retryAfter) {
 	if (status === 422 && isObject(value) && value.code === "RECOVERY_REQUIRED") return new AuthError("membership_removal_recovery_required", 422);
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
+function fromOrganizationClosureError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 409 && code === "CONFIRMATION_MISMATCH") return new AuthError("organization_closure_confirmation_mismatch", 409);
+	if (status === 409 && code === "RECENT_AUTHENTICATION_REQUIRED") return new AuthError("recent_authentication_required", 409);
+	if (status === 409 && code === "CANCELLATION_WINDOW_ENDED") return new AuthError("organization_closure_cancellation_ended", 409);
+	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
+}
+function normalizeOrganizationClosureStartInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "confirmationName,idempotencyKey") throw new TypeError("organization closure input is invalid");
+	if (!boundedString(value.confirmationName, 255)) throw new TypeError("confirmationName is invalid");
+	return {
+		confirmationName: value.confirmationName,
+		idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey)
+	};
+}
+function normalizeOrganizationClosureCancelInput(value) {
+	if (!isObject(value) || Object.keys(value).join(",") !== "idempotencyKey") throw new TypeError("organization closure cancellation input is invalid");
+	return { idempotencyKey: normalizeAuthorityIdempotencyKey(value.idempotencyKey) };
+}
+function closureWindow(value) {
+	const startedAt = responseDate(value.startedAt);
+	const cancelUntil = responseDate(value.cancelUntil);
+	if (cancelUntil.getTime() - startedAt.getTime() !== 720 * 60 * 60 * 1e3 || typeof value.canCancel !== "boolean") throw authorityUnavailable();
+	return {
+		startedAt: startedAt.toISOString(),
+		cancelUntil: cancelUntil.toISOString(),
+		canCancel: value.canCancel
+	};
+}
+function normalizeOrganizationClosure(value) {
+	exact$3(value, [
+		"cancelUntil",
+		"canCancel",
+		"organizationId",
+		"startedAt",
+		"state"
+	]);
+	if (!isId(value.organizationId) || value.state !== "closing" && value.state !== "cancelled") throw authorityUnavailable();
+	const window = closureWindow(value);
+	if (value.state === "cancelled" && window.canCancel) throw authorityUnavailable();
+	return {
+		organizationId: value.organizationId,
+		state: value.state,
+		...window
+	};
+}
+function normalizeClosingOrganizations(value) {
+	exact$3(value, ["organizations"]);
+	if (!Array.isArray(value.organizations) || value.organizations.length > 20) throw authorityUnavailable();
+	return { organizations: unique(value.organizations.map((item) => {
+		exact$3(item, [
+			"cancelUntil",
+			"canCancel",
+			"id",
+			"name",
+			"slug",
+			"startedAt"
+		]);
+		if (!isId(item.id) || !boundedString(item.name, 255) || item.slug !== null && !boundedString(item.slug, 255)) throw authorityUnavailable();
+		return {
+			id: item.id,
+			name: item.name,
+			slug: item.slug,
+			...closureWindow(item)
+		};
+	}), (item) => item.id) };
+}
 function normalizePlatformRoleChangeRecentAuthenticationInput(value) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== "changeReference,expectedGlobalRevision,expectedTargetRevision,idempotencyKey,reasonCategory,requestedRoles,targetUserId") throw new TypeError("recent authentication input is invalid");
 	if (!isId(value.targetUserId)) throw new TypeError("targetUserId is invalid");
@@ -3410,7 +3581,7 @@ function normalizeOrganizationOwnershipTransferInput(value) {
 	};
 }
 function normalizeOrganizationManualRoleChangeResult(value) {
-	exact(value, [
+	exact$3(value, [
 		"status",
 		"memberId",
 		"manualRole",
@@ -3424,7 +3595,7 @@ function normalizeOrganizationManualRoleChangeResult(value) {
 	};
 }
 function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact(value, [
+	exact$3(value, [
 		"organizationId",
 		"actor",
 		"target"
@@ -3442,7 +3613,7 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 	};
 }
 function normalizeOrganizationOwnershipTransferResult(value) {
-	exact(value, [
+	exact$3(value, [
 		"status",
 		"outgoingOwner",
 		"successor"
@@ -3455,7 +3626,7 @@ function normalizeOrganizationOwnershipTransferResult(value) {
 	};
 }
 function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact(value, [
+	exact$3(value, [
 		"memberId",
 		"manualRole",
 		"role",
@@ -3488,7 +3659,7 @@ function normalizePlatformBootstrapRoleChangeInput(value) {
 	return request;
 }
 function normalizePlatformRoleApproval(value) {
-	exact(value, [
+	exact$3(value, [
 		"status",
 		"targetUserId",
 		"targetRevision",
@@ -3515,7 +3686,7 @@ function normalizePlatformRoleApproval(value) {
 	};
 }
 function normalizePlatformStatus(value) {
-	exact(value, [
+	exact$3(value, [
 		"eligible",
 		"globalRevision",
 		"roles"
@@ -3530,7 +3701,7 @@ function normalizePlatformStatus(value) {
 	};
 }
 function normalizeRecentAuthenticationStatus(value) {
-	exact(value, ["status"]);
+	exact$3(value, ["status"]);
 	if (value.status !== "pending" && value.status !== "ready") throw authorityUnavailable();
 	return { status: value.status };
 }
@@ -3643,7 +3814,7 @@ function normalizeProfileImage(value) {
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
-function exact(value, keys) {
+function exact$3(value, keys) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
 function boundedString(value, maximum) {
@@ -3683,6 +3854,18 @@ function unique(items, key) {
 	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
 	return items;
 }
+function credentialSessionId(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return void 0;
+	try {
+		const base64 = parts[1].replaceAll("-", "+").replaceAll("_", "/");
+		const decoded = atob(base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "="));
+		const payload = JSON.parse(decoded);
+		return isObject(payload) && typeof payload.sid === "string" && payload.sid.length > 0 ? payload.sid : void 0;
+	} catch {
+		return;
+	}
+}
 function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -4496,6 +4679,406 @@ function byteLength(value) {
 	return new TextEncoder().encode(value).byteLength;
 }
 //#endregion
+//#region src/sessions.ts
+const idPattern$2 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const MAX_SESSIONS = 50;
+const itemKeys$1 = [
+	"createdAt",
+	"current",
+	"expiresAt",
+	"id",
+	"ipAddress",
+	"updatedAt",
+	"userAgent"
+];
+function exact$2(value, keys) {
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function date$2(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable();
+	return parsed;
+}
+function text(value, maximum) {
+	if (value === null) return null;
+	if (typeof value !== "string" || value.length === 0 || value.length > maximum || /[^\x20-\x7e]/.test(value)) throw authorityUnavailable();
+	return value;
+}
+function normalizeSessionId(value) {
+	if (typeof value !== "string" || !idPattern$2.test(value)) throw new TypeError("sessionId is invalid");
+	return value;
+}
+function normalizeSessionSummary(value) {
+	if (!exact$2(value, itemKeys$1) || typeof value.id !== "string" || !idPattern$2.test(value.id)) throw authorityUnavailable();
+	if (typeof value.current !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		current: value.current,
+		createdAt: date$2(value.createdAt),
+		updatedAt: date$2(value.updatedAt),
+		expiresAt: date$2(value.expiresAt),
+		userAgent: text(value.userAgent, 512),
+		ipAddress: text(value.ipAddress, 64)
+	};
+}
+function normalizeSessionInventory(value) {
+	if (!exact$2(value, ["sessions", "truncated"]) || !Array.isArray(value.sessions) || value.sessions.length > MAX_SESSIONS || typeof value.truncated !== "boolean") throw authorityUnavailable();
+	const sessions = value.sessions.map(normalizeSessionSummary);
+	if (new Set(sessions.map((session) => session.id)).size !== sessions.length) throw authorityUnavailable();
+	if (sessions.filter((session) => session.current).length !== 1) throw authorityUnavailable();
+	return {
+		sessions,
+		truncated: value.truncated
+	};
+}
+function normalizeSessionRevocation(value) {
+	if (!exact$2(value, ["status"]) || value.status !== "revoked") throw authorityUnavailable();
+}
+function normalizeOtherSessionRevocation(value) {
+	if (!exact$2(value, ["revoked"]) || !Number.isSafeInteger(value.revoked) || value.revoked < 0) throw authorityUnavailable();
+	return { revoked: value.revoked };
+}
+function fromSessionInventoryError(_value, status, retryAfter) {
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404 || status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+//#endregion
+//#region src/passkeys.ts
+const idPattern$1 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const MAX_PASSKEYS = 50;
+const MAX_RETURN_BYTES = 2048;
+const PASSKEY_NAME_MAX_LENGTH = 64;
+const itemKeys = [
+	"backedUp",
+	"createdAt",
+	"deviceType",
+	"id",
+	"name"
+];
+function exact$1(value, keys) {
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function date$1(value) {
+	if (typeof value !== "string") throw authorityUnavailable();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) throw authorityUnavailable();
+	return parsed;
+}
+function returnInput(value) {
+	if (!isObject(value)) throw new TypeError("ceremony input is invalid");
+	const { applicationId, returnTo } = value;
+	if (typeof applicationId !== "string" || !idPattern$1.test(applicationId)) throw new TypeError("applicationId is invalid");
+	if (typeof returnTo !== "string" || new TextEncoder().encode(returnTo).byteLength > MAX_RETURN_BYTES || !URL.canParse(returnTo) || new URL(returnTo).toString() !== returnTo) throw new TypeError("returnTo is invalid");
+	return {
+		applicationId,
+		returnTo
+	};
+}
+function normalizeCeremonyHandoffInput(value) {
+	const base = returnInput(value);
+	const input = value;
+	switch (input.purpose) {
+		case "passkey_enrollment": return {
+			purpose: input.purpose,
+			...base
+		};
+		case "passkey_removal": return {
+			purpose: input.purpose,
+			...base,
+			passkeyId: normalizePasskeyId(input.passkeyId)
+		};
+		case "recent_authentication": {
+			const request = input.request;
+			if (!isObject(request)) throw new TypeError("request is invalid");
+			const organizationId = normalizeIdInput(request.organizationId);
+			if (request.action === "organization_ownership_transfer") {
+				const { action: _action, organizationId: _organizationId, ...transfer } = request;
+				return {
+					purpose: input.purpose,
+					...base,
+					request: {
+						action: request.action,
+						organizationId,
+						...normalizeOrganizationOwnershipTransferInput(transfer)
+					}
+				};
+			}
+			if (request.action === "organization_closure_start") {
+				const { action: _action, organizationId: _organizationId, ...closure } = request;
+				return {
+					purpose: input.purpose,
+					...base,
+					request: {
+						action: request.action,
+						organizationId,
+						...normalizeOrganizationClosureStartInput(closure)
+					}
+				};
+			}
+			if (request.action === "organization_closure_cancel") {
+				const { action: _action, organizationId: _organizationId, ...closure } = request;
+				return {
+					purpose: input.purpose,
+					...base,
+					request: {
+						action: request.action,
+						organizationId,
+						...normalizeOrganizationClosureCancelInput(closure)
+					}
+				};
+			}
+			throw new TypeError("request action is invalid");
+		}
+		default: throw new TypeError("purpose is invalid");
+	}
+}
+function normalizeCeremonyHandoff(value) {
+	if (!exact$1(value, ["expiresAt", "url"]) || typeof value.url !== "string") throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value.url);
+	} catch {
+		throw authorityUnavailable();
+	}
+	const local = url.hostname === "localhost" || url.hostname.endsWith(".localhost");
+	if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.pathname !== "/api/v1/auth/ceremony/start" || url.search || !/^#code=[A-Za-z0-9_-]{43}$/.test(url.hash)) throw authorityUnavailable();
+	return {
+		url: url.toString(),
+		expiresAt: date$1(value.expiresAt)
+	};
+}
+function normalizePasskeyId(value) {
+	if (typeof value !== "string" || !idPattern$1.test(value)) throw new TypeError("passkeyId is invalid");
+	return value;
+}
+function normalizePasskeyName(value) {
+	if (typeof value !== "string") throw new TypeError("name is invalid");
+	const name = value.trim();
+	if (!name || name.length > PASSKEY_NAME_MAX_LENGTH || /[\p{Cc}\p{Cf}]/u.test(name)) throw new TypeError("name is invalid");
+	return name;
+}
+function normalizePasskeySummary(value) {
+	if (!exact$1(value, itemKeys) || typeof value.id !== "string" || !idPattern$1.test(value.id)) throw authorityUnavailable();
+	if (value.name !== null && (typeof value.name !== "string" || value.name.length > PASSKEY_NAME_MAX_LENGTH)) throw authorityUnavailable();
+	if (value.deviceType !== "singleDevice" && value.deviceType !== "multiDevice") throw authorityUnavailable();
+	if (typeof value.backedUp !== "boolean") throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name,
+		createdAt: value.createdAt === null ? null : date$1(value.createdAt),
+		deviceType: value.deviceType,
+		backedUp: value.backedUp
+	};
+}
+function normalizePasskeyInventory(value) {
+	if (!exact$1(value, ["passkeys", "truncated"]) || !Array.isArray(value.passkeys) || value.passkeys.length > MAX_PASSKEYS || typeof value.truncated !== "boolean") throw authorityUnavailable();
+	const passkeys = value.passkeys.map(normalizePasskeySummary);
+	if (new Set(passkeys.map((passkey) => passkey.id)).size !== passkeys.length) throw authorityUnavailable();
+	return {
+		passkeys,
+		truncated: value.truncated
+	};
+}
+function normalizePasskeyRename(value) {
+	if (!exact$1(value, ["status"]) || value.status !== "renamed") throw authorityUnavailable();
+}
+function fromCeremonyHandoffError(value, status, retryAfter) {
+	const code = isObject(value) ? value.code : void 0;
+	if (status === 400 && code === "RETURN_ADDRESS_REFUSED") return new AuthError("ceremony_return_refused", 400);
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("request_origin_denied", 403);
+	if (status === 404) return new AuthError("state_conflict", 409);
+	if (status === 409 && code === "PASSWORD_REQUIRED") return new AuthError("password_sign_in_required", 409);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+//#endregion
+//#region src/two-factor.ts
+const totpCode = /^[0-9]{6}$(?![\s\S])/;
+const backupCode = /^[A-Za-z0-9]{5}-[A-Za-z0-9]{5}$(?![\s\S])/;
+const base32Secret = /^[A-Z2-7]{16,128}=*$(?![\s\S])/;
+const BACKUP_CODE_COUNT = 10;
+const MAX_TOTP_URI_LENGTH = 1024;
+function normalizeTwoFactorCode(value, name = "code") {
+	if (typeof value !== "string" || value.length > 32) throw new TypeError(`${name} is invalid`);
+	const code = value.replace(/\s+/g, "");
+	if (totpCode.test(code)) return {
+		route: "two-factor/verify-totp",
+		code
+	};
+	if (backupCode.test(code)) return {
+		route: "two-factor/verify-backup-code",
+		code
+	};
+	throw new TypeError(`${name} is invalid`);
+}
+function normalizeTotpCode(value) {
+	const normalized = normalizeTwoFactorCode(value);
+	if (normalized.route !== "two-factor/verify-totp") throw new TypeError("code is invalid");
+	return normalized.code;
+}
+function normalizeTwoFactorStepUp(value) {
+	if (!isObject(value)) throw new TypeError("two-factor step-up input is invalid");
+	const keys = Object.keys(value);
+	if (keys.length !== 2 || !keys.includes("password") || !keys.includes("code")) throw new TypeError("two-factor step-up input is invalid");
+	const input = value;
+	return {
+		password: normalizePassword(input.password),
+		code: normalizeTwoFactorCode(input.code).code
+	};
+}
+function isTwoFactorChallenge(value) {
+	return isObject(value) && value.twoFactorRedirect === true;
+}
+function normalizeBackupCodes(value) {
+	if (!Array.isArray(value) || value.length !== BACKUP_CODE_COUNT || value.some((code) => typeof code !== "string" || !backupCode.test(code)) || new Set(value).size !== value.length) throw authorityUnavailable();
+	return [...value];
+}
+function normalizeRegeneratedBackupCodes(value) {
+	if (!isObject(value) || value.status !== true) throw authorityUnavailable();
+	return normalizeBackupCodes(value.backupCodes);
+}
+function normalizeTwoFactorEnrollment(value) {
+	if (!isObject(value) || typeof value.totpURI !== "string" || value.totpURI.length > MAX_TOTP_URI_LENGTH) throw authorityUnavailable();
+	let uri;
+	try {
+		uri = new URL(value.totpURI);
+	} catch {
+		throw authorityUnavailable();
+	}
+	const secret = uri.searchParams.get("secret");
+	if (uri.protocol !== "otpauth:" || uri.host !== "totp" || !secret || !base32Secret.test(secret) || (uri.searchParams.get("digits") ?? "6") !== "6" || (uri.searchParams.get("period") ?? "30") !== "30") throw authorityUnavailable();
+	return {
+		totpUri: uri.toString(),
+		secret,
+		backupCodes: normalizeBackupCodes(value.backupCodes)
+	};
+}
+function normalizeTwoFactorStatus(value) {
+	if (value === null) throw new AuthError("authentication_required", 401);
+	if (!isObject(value) || !isObject(value.user) || typeof value.user.twoFactorEnabled !== "boolean") throw authorityUnavailable();
+	return { enabled: value.user.twoFactorEnabled };
+}
+function fromTwoFactorAuthorityError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (code === "INVALID_CODE" || code === "INVALID_BACKUP_CODE") return new AuthError("two_factor_code_invalid", 401);
+	if (code === "INVALID_TWO_FACTOR_COOKIE" || code === "TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE") return new AuthError("two_factor_challenge_expired", 401);
+	if (code === "ACCOUNT_TEMPORARILY_LOCKED") return new AuthError("two_factor_locked", 429, parseRetryAfter(retryAfter));
+	if (code === "SESSION_NOT_FRESH") return new AuthError("recent_sign_in_required", 403);
+	if (code === "TWO_FACTOR_ALREADY_ENABLED" || code === "TWO_FACTOR_NOT_ENABLED" || code === "TOTP_NOT_ENABLED" || code === "TWO_FACTOR_SIGN_IN_ONLY") return new AuthError("state_conflict", 409);
+	if (status === 413) return new AuthError("invalid_auth_input", 422);
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
+//#endregion
+//#region src/enterprise.ts
+const idPattern = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const credentialPattern = /^[A-Za-z0-9_-]{16,64}\.[A-Za-z0-9_-]{43}$(?![\s\S])/;
+const connectionKeys = [
+	"capability",
+	"clientId",
+	"domainVerified",
+	"enabled",
+	"id",
+	"issuer",
+	"memberJit",
+	"requireVerifiedEmail",
+	"roleMappingConfigured",
+	"updatedAt",
+	"validatedAt"
+];
+const stateKeys = [
+	"currentCredentialId",
+	"retiringExpiresAt",
+	"revision",
+	"revokedAt",
+	"status"
+];
+function exact(value, keys) {
+	return isObject(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function date(value, nullable) {
+	if (value === null && nullable) return null;
+	if (typeof value !== "string") throw authorityUnavailable();
+	const parsed = new Date(value);
+	if (!Number.isFinite(parsed.getTime())) throw authorityUnavailable();
+	return parsed;
+}
+function bool(value) {
+	if (typeof value !== "boolean") throw authorityUnavailable();
+	return value;
+}
+function normalizeEnterpriseConnections(value) {
+	if (!exact(value, ["connections"]) || !Array.isArray(value.connections) || value.connections.length > 10) throw authorityUnavailable();
+	return value.connections.map((item) => {
+		if (!exact(item, connectionKeys)) throw authorityUnavailable();
+		if (typeof item.id !== "string" || !idPattern.test(item.id) || typeof item.issuer !== "string" || !item.issuer.startsWith("https://") || item.issuer.length > 2048 || typeof item.clientId !== "string" || item.clientId.length === 0 || item.clientId.length > 256 || item.capability !== "federated_sign_in" && item.capability !== "managed_lifecycle") throw authorityUnavailable();
+		return {
+			id: item.id,
+			issuer: item.issuer,
+			clientId: item.clientId,
+			capability: item.capability,
+			enabled: bool(item.enabled),
+			domainVerified: bool(item.domainVerified),
+			validatedAt: date(item.validatedAt, true),
+			memberJit: bool(item.memberJit),
+			requireVerifiedEmail: bool(item.requireVerifiedEmail),
+			roleMappingConfigured: bool(item.roleMappingConfigured),
+			updatedAt: date(item.updatedAt, false)
+		};
+	});
+}
+function normalizeScimCredentialState(value, extraKeys = []) {
+	if (!exact(value, [...stateKeys, ...extraKeys])) throw authorityUnavailable();
+	const status = value.status;
+	if (status !== "active" && status !== "revoked" && status !== "unissued") throw authorityUnavailable();
+	const revision = value.revision;
+	if (revision !== null && (!Number.isSafeInteger(revision) || revision < 0)) throw authorityUnavailable();
+	const currentCredentialId = value.currentCredentialId;
+	if (currentCredentialId !== null && (typeof currentCredentialId !== "string" || !idPattern.test(currentCredentialId))) throw authorityUnavailable();
+	if (status === "unissued" !== (revision === null)) throw authorityUnavailable();
+	return {
+		status,
+		revision,
+		currentCredentialId,
+		retiringExpiresAt: date(value.retiringExpiresAt, true),
+		revokedAt: date(value.revokedAt, true)
+	};
+}
+function normalizeScimCredentialIssuance(value) {
+	const state = normalizeScimCredentialState(value, ["credential"]);
+	const credential = value.credential;
+	if (state.status !== "active" || typeof credential !== "string" || !credentialPattern.test(credential)) throw authorityUnavailable();
+	return {
+		...state,
+		credential
+	};
+}
+function normalizeRevision(value) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new TypeError("expectedRevision is invalid");
+	return value;
+}
+function normalizeOverlapSeconds(value) {
+	if (!Number.isSafeInteger(value) || value < 0 || value > 86400) throw new TypeError("overlapSeconds is invalid");
+	return value;
+}
+function fromEnterpriseAdministrationError(value, status, retryAfter) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 401) return new AuthError("authentication_required", 401);
+	if (status === 403) return new AuthError("access_denied", 403);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 422 || code === "RECOVERY_REQUIRED") return new AuthError("enterprise_recovery_required", 422);
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+//#endregion
 //#region src/user-api/credential.ts
 function userApiApplication(input) {
 	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
@@ -4509,7 +5092,7 @@ function normalizeUserApiCredential(value, startedAt) {
 		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
 	};
 }
-function createUserApiCredentialCache(issue, now) {
+function createUserApiCredentialCache(issue, now, currentSessionId = () => void 0) {
 	let generation = 0;
 	let cached;
 	let pending;
@@ -4519,6 +5102,12 @@ function createUserApiCredentialCache(issue, now) {
 	});
 	return {
 		hasAuthority: () => Boolean(cached || pending),
+		retainSession(sessionId) {
+			if (cached?.sessionId === sessionId && !pending) return;
+			generation += 1;
+			cached = void 0;
+			pending = void 0;
+		},
 		clear() {
 			generation += 1;
 			cached = void 0;
@@ -4542,10 +5131,14 @@ function createUserApiCredentialCache(issue, now) {
 				const value = normalizeUserApiCredential(await issue(applicationId), startedAt);
 				if (epoch !== generation) throw new AuthError("state_conflict", 409);
 				if (now() < startedAt || value.expiresAt.getTime() <= now()) throw new AuthError("authentication_required", 401);
+				const sessionId = credentialSessionId(value.token);
+				const observed = currentSessionId();
+				if (observed !== void 0 && sessionId !== void 0 && sessionId !== observed) throw new AuthError("authentication_required", 401);
 				cached = {
 					applicationId,
 					token: value.token,
-					expiresAt: value.expiresAt.getTime()
+					expiresAt: value.expiresAt.getTime(),
+					sessionId
 				};
 				return value;
 			})().finally(() => {
@@ -4578,7 +5171,7 @@ function createAuthClient(options) {
 		method: "POST",
 		headers: { "content-type": "application/json; charset=utf-8" },
 		body: { applicationId }
-	}), now);
+	}), now, () => sessionId);
 	const betterAuth = createAuthClient$1({
 		baseURL: authOrigin,
 		basePath: "/api/v1/auth",
@@ -4740,9 +5333,12 @@ function createAuthClient(options) {
 		credentialGeneration += 1;
 	}
 	function updateSession(session) {
-		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0 || userApiCredentials.hasAuthority());
 		const changedSession = sessionId === void 0 ? !sessionAuthorityObserved || session !== null : !session || session.id !== sessionId || session.user.id !== sessionUserId;
-		if (!session || unboundCredential || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
+		if (!session || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
+		else if (!sessionId) {
+			if (credential && credential.sessionId !== session.id) credential = void 0;
+			userApiCredentials.retainSession(session.id);
+		}
 		if (changedSession || recentAuthenticationStartAttempt && (recentAuthenticationStartAttempt.sessionId !== session?.id || recentAuthenticationStartAttempt.userId !== session?.user.id)) recentAuthenticationStartAttempt = void 0;
 		if (changedSession) sessionAuthorityEpoch += 1;
 		sessionAuthorityObserved = true;
@@ -4884,6 +5480,39 @@ function createAuthClient(options) {
 			mapError
 		})).value;
 	}
+	async function resolveSuspension(organizationId, suspensionId, idempotencyKey, resolution) {
+		const organization = normalizeIdInput(organizationId);
+		const suspension = normalizeIdInput(suspensionId);
+		const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+		const generation = authorityGeneration;
+		const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "suspended-members", suspension, resolution), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body,
+			mapError: fromOrganizationMembershipRemovalError
+		});
+		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		return value;
+	}
+	async function teamMembershipMutation(ids, idempotencyKey, url) {
+		const [organization, team, member] = ids.map(normalizeIdInput);
+		const body = normalizeOrganizationTeamMembershipInput(idempotencyKey);
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+		const generation = authorityGeneration;
+		const value = await requestJson(url(organization, team, member), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body,
+			mapError: fromOrganizationMutationAuthorityError
+		});
+		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		return value;
+	}
 	async function organizationRead(path, input, normalize) {
 		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
 		const generation = authorityGeneration;
@@ -4903,6 +5532,71 @@ function createAuthClient(options) {
 			throw error;
 		}
 	}
+	async function sessionInventoryRequest(method, path, normalize) {
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+		const generation = authorityGeneration;
+		const value = await requestJson(joinURL(authOrigin, "api/v1/auth/sessions", path), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method,
+			...method === "POST" ? {
+				headers: { "content-type": "application/json; charset=utf-8" },
+				body: {}
+			} : {},
+			mapError: fromSessionInventoryError
+		});
+		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		return normalize(value);
+	}
+	async function ceremonyRequest(method, path, body, normalize) {
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+		const generation = authorityGeneration;
+		const value = await requestJson(joinURL(authOrigin, "api/v1/auth", path), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method,
+			...body ? {
+				headers: { "content-type": "application/json" },
+				body
+			} : {},
+			mapError: fromCeremonyHandoffError
+		});
+		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		return normalize(value);
+	}
+	function scimCredentialPath(organizationId, connectionId) {
+		return `${normalizeIdInput(organizationId)}/connections/${normalizeIdInput(connectionId)}/scim-credential`;
+	}
+	async function enterpriseRequest(method, path, body, normalize) {
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+		const generation = authorityGeneration;
+		const value = await requestJson(joinURL(authOrigin, "api/v1/auth/enterprise/organizations", path), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method,
+			...body ? {
+				headers: { "content-type": "application/json" },
+				body
+			} : {},
+			mapError: fromEnterpriseAdministrationError
+		});
+		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		return normalize(value);
+	}
+	async function closureMutation(organizationId, operation, body) {
+		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+		const generation = authorityGeneration;
+		const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organizationId, "closure", operation), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body,
+			mapError: fromOrganizationClosureError
+		});
+		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+		return normalizeOrganizationClosure(value);
+	}
 	function assertRecentAuthenticationOrigin() {
 		if (appOrigin !== authOrigin) throw new TypeError("recent authentication requires the exact Auth Origin");
 	}
@@ -4990,6 +5684,20 @@ function createAuthClient(options) {
 				...normalizeOrganizationOwnershipTransferInput(input)
 			});
 		},
+		async startOrganizationClosureRecentAuthentication(organizationId, input) {
+			return startRecentAuthentication({
+				action: "organization_closure_start",
+				organizationId: normalizeIdInput(organizationId),
+				...normalizeOrganizationClosureStartInput(input)
+			});
+		},
+		async startOrganizationClosureCancellationRecentAuthentication(organizationId, input) {
+			return startRecentAuthentication({
+				action: "organization_closure_cancel",
+				organizationId: normalizeIdInput(organizationId),
+				...normalizeOrganizationClosureCancelInput(input)
+			});
+		},
 		async approveBootstrapPlatformRoleChange(input) {
 			assertRecentAuthenticationOrigin();
 			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
@@ -5073,6 +5781,26 @@ function createAuthClient(options) {
 			invitationRequest = request;
 			return request;
 		},
+		async declineInvitation(input) {
+			const invitation = normalizeInvitationInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest || recentAuthenticationStartRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			try {
+				const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organization/reject-invitation"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "POST",
+					headers: { "content-type": "application/json; charset=utf-8" },
+					body: invitation,
+					mapError: fromInvitationAuthorityError
+				});
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				return normalizeInvitationDecline(value, invitation.invitationId);
+			} catch (error) {
+				if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+				throw fromInvitationError(error);
+			}
+		},
 		getSession,
 		async listOrganizations(input) {
 			try {
@@ -5187,6 +5915,35 @@ function createAuthClient(options) {
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			return normalizeRemovedOrganizationMember(value);
 		},
+		async suspendOrganizationMember(organizationId, memberId, idempotencyKey) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "members", member, "suspend"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMembershipRemovalError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeSuspendedOrganizationMemberStatus(value);
+		},
+		async listSuspendedOrganizationMembers(organizationId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/suspended-members`, input, normalizeSuspendedOrganizationMembers);
+		},
+		async listRemovedOrganizationMembers(organizationId, input) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/removed-members`, input, normalizeDepartedOrganizationMembers);
+		},
+		async restoreSuspendedOrganizationMember(organizationId, suspensionId, idempotencyKey) {
+			return normalizeRestoredOrganizationMember(await resolveSuspension(organizationId, suspensionId, idempotencyKey, "restore"));
+		},
+		async removeSuspendedOrganizationMember(organizationId, suspensionId, idempotencyKey) {
+			return normalizeRemovedOrganizationMember(await resolveSuspension(organizationId, suspensionId, idempotencyKey, "remove"));
+		},
 		async leaveOrganization(organizationId, idempotencyKey) {
 			const organization = normalizeIdInput(organizationId);
 			const body = normalizeOrganizationMembershipRemovalInput(idempotencyKey);
@@ -5203,6 +5960,23 @@ function createAuthClient(options) {
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			return normalizeOrganizationDeparture(value);
 		},
+		async addOrganizationTeamMember(organizationId, teamId, memberId, idempotencyKey) {
+			return normalizeAddedOrganizationTeamMember(await teamMembershipMutation([
+				organizationId,
+				teamId,
+				memberId
+			], idempotencyKey, (organization, team, member) => joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "members", member, "add")));
+		},
+		async removeOrganizationTeamMember(organizationId, teamId, memberId, idempotencyKey) {
+			return normalizeRemovedOrganizationTeamMember(await teamMembershipMutation([
+				organizationId,
+				teamId,
+				memberId
+			], idempotencyKey, (organization, team, member) => joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "members", member, "remove")));
+		},
+		async deleteOrganizationTeam(organizationId, teamId, idempotencyKey) {
+			return normalizeDeletedOrganizationTeam(await teamMembershipMutation([organizationId, teamId], idempotencyKey, (organization, team) => joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "delete")));
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);
@@ -5269,6 +6043,18 @@ function createAuthClient(options) {
 			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 			return normalizeOrganizationOwnershipTransferResult(value);
 		},
+		async startOrganizationClosure(organizationId, input) {
+			return closureMutation(normalizeIdInput(organizationId), "", normalizeOrganizationClosureStartInput(input));
+		},
+		async cancelOrganizationClosure(organizationId, input) {
+			return closureMutation(normalizeIdInput(organizationId), "cancel", normalizeOrganizationClosureCancelInput(input));
+		},
+		async getOrganizationClosure(organizationId) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/closure`, void 0, normalizeOrganizationClosure);
+		},
+		async listClosingOrganizations() {
+			return organizationRead("closing", void 0, normalizeClosingOrganizations);
+		},
 		async listOrganizationMembers(organizationId, input) {
 			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers);
 		},
@@ -5290,15 +6076,105 @@ function createAuthClient(options) {
 		async getReceivedInvitation(invitationId) {
 			return organizationRead(`received-invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeReceivedInvitation);
 		},
+		async listEnterpriseConnections(organizationId) {
+			return enterpriseRequest("GET", `${normalizeIdInput(organizationId)}/connections`, void 0, normalizeEnterpriseConnections);
+		},
+		async getScimCredential(organizationId, connectionId) {
+			return enterpriseRequest("GET", scimCredentialPath(organizationId, connectionId), void 0, (value) => normalizeScimCredentialState(value));
+		},
+		async issueScimCredential(organizationId, connectionId) {
+			return enterpriseRequest("POST", scimCredentialPath(organizationId, connectionId), {}, normalizeScimCredentialIssuance);
+		},
+		async rotateScimCredential(organizationId, connectionId, input) {
+			const body = {
+				expectedRevision: normalizeRevision(input?.expectedRevision),
+				overlapSeconds: normalizeOverlapSeconds(input?.overlapSeconds)
+			};
+			return enterpriseRequest("POST", `${scimCredentialPath(organizationId, connectionId)}/rotate`, body, normalizeScimCredentialIssuance);
+		},
+		async revokeScimCredential(organizationId, connectionId, input) {
+			const body = { expectedRevision: normalizeRevision(input?.expectedRevision) };
+			return enterpriseRequest("POST", `${scimCredentialPath(organizationId, connectionId)}/revoke`, body, (value) => normalizeScimCredentialState(value));
+		},
 		async signIn(input) {
 			const body = {
 				email: normalizeEmail(input?.email),
 				password: normalizePassword(input?.password)
 			};
-			const result = await runAccountMutation(() => accountRequest("sign-in/email", body));
+			const result = await runAccountMutation(async () => {
+				const value = await accountRequest("sign-in/email", body);
+				if (isTwoFactorChallenge(value)) throw new AuthError("two_factor_required", 401);
+				return value;
+			});
+			if (!result.session) throw new AuthError("authentication_required", 401);
+			return result.session;
+		},
+		async verifyTwoFactor(code) {
+			const normalized = normalizeTwoFactorCode(code);
+			const result = await runAccountMutation(() => accountRequest(normalized.route, { code: normalized.code }, fromTwoFactorAuthorityError));
+			if (!result.session) throw new AuthError("authentication_required", 401);
+			return result.session;
+		},
+		async getTwoFactorStatus() {
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/get-session"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "GET",
+				headers: { "cache-control": "no-store" }
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeTwoFactorStatus(value);
+		},
+		async startTwoFactorEnrollment(password) {
+			const body = { password: normalizePassword(password) };
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await accountRequest("two-factor/enable", body, fromTwoFactorAuthorityError);
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeTwoFactorEnrollment(value);
+		},
+		async confirmTwoFactorEnrollment(code) {
+			const body = { code: normalizeTotpCode(code) };
+			const result = await runAccountMutation(() => accountRequest("two-factor/verify-totp", body, fromTwoFactorAuthorityError));
+			if (!result.session) throw new AuthError("authentication_required", 401);
+			return result.session;
+		},
+		async disableTwoFactor(input) {
+			const body = normalizeTwoFactorStepUp(input);
+			const result = await runAccountMutation(() => accountRequest("two-factor/disable", body, fromTwoFactorAuthorityError));
 			if (!result.session) throw new AuthError("authentication_required", 401);
 			return result.session;
 		},
+		async regenerateTwoFactorBackupCodes(input) {
+			const body = normalizeTwoFactorStepUp(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await accountRequest("two-factor/generate-backup-codes", body, fromTwoFactorAuthorityError);
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeRegeneratedBackupCodes(value);
+		},
+		async listSessions() {
+			return sessionInventoryRequest("GET", "", normalizeSessionInventory);
+		},
+		async revokeSession(sessionId) {
+			await sessionInventoryRequest("POST", `${normalizeSessionId(sessionId)}/revoke`, normalizeSessionRevocation);
+		},
+		async revokeOtherSessions() {
+			return sessionInventoryRequest("POST", "revoke-others", normalizeOtherSessionRevocation);
+		},
+		async createCeremonyHandoff(input) {
+			return ceremonyRequest("POST", "ceremony-handoffs", normalizeCeremonyHandoffInput(input), normalizeCeremonyHandoff);
+		},
+		async listPasskeys() {
+			return ceremonyRequest("GET", "passkeys", void 0, normalizePasskeyInventory);
+		},
+		async renamePasskey(passkeyId, name) {
+			const id = normalizePasskeyId(passkeyId);
+			const body = { name: normalizePasskeyName(name) };
+			await ceremonyRequest("POST", `passkeys/${id}/name`, body, normalizePasskeyRename);
+		},
 		async signInWithSocialIdToken(input) {
 			const body = socialIdTokenRequest(normalizeSocialIdTokenInput(input));
 			const result = await runAccountMutation(() => accountRequest("sign-in/social", body, fromSocialIdTokenAuthorityError));
@@ -5390,9 +6266,12 @@ function createAuthClient(options) {
 					if (error) throw error;
 					const nextCredential = normalizeDriveCredential(result, now());
 					if (generation !== credentialGeneration) throw new AuthError("authentication_required", 401);
+					const issuedFor = credentialSessionId(nextCredential.token);
+					if (sessionId !== void 0 && issuedFor !== void 0 && issuedFor !== sessionId) throw new AuthError("authentication_required", 401);
 					if (selectedWorkspaceKey === workspaceKey) credential = {
 						key: workspaceKey,
-						value: nextCredential
+						value: nextCredential,
+						sessionId: issuedFor
 					};
 					return nextCredential;
 				})().finally(() => {