@finueva/auth 0.18.1 → 0.20.0

package/dist/server.d.ts

@@ -1,4 +1,19 @@
-import { $ as AuthError, A as OrganizationTeamPage, B as ReceivedOrganizationInvitation, C as OrganizationMemberAuthority, D as OrganizationTeam, E as OrganizationPageInput, J as SocialIdTokenProvider, M as PersonalWorkspaceSelection, O as OrganizationTeamDisplay, Q as WorkspaceSelection, S as OrganizationMember, T as OrganizationPage, U as RemovedOrganizationMember, V as ReceivedOrganizationInvitationPage, W as ResentOrganizationInvitation, X as UpdateOrganizationTeamDisplayInput, Y as UpdateOrganizationDisplayInput, _ as InvitationAcceptance, b as OrganizationInvitation, c as AuthUser, d as CreatedOrganization, et as AuthErrorCode, f as CreatedOrganizationMemberInvitation, h as DriveCredentialInput, j as OrganizationWorkspaceSelection, k as OrganizationTeamMemberPage, l as CanceledOrganizationInvitation, m as DriveCredential, nt as UserApiCredential, o as AuthSession, p as CreatedOrganizationTeam, q as SocialIdTokenInput, r as AuthOrganization, rt as UserApiCredentialInput, t as AcceptInvitationInput, tt as AuthErrorStatus, u as CreateOrganizationMemberInvitationInput, v as OrganizationDeparture, w as OrganizationMemberPage, x as OrganizationInvitationPage, y as OrganizationDisplay } from "./types-CrdIcEJ3.js";
+import { At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, Y as OrganizationWorkspaceSelection, b as CreatedOrganization, d as AuthUser, dt as ResentOrganizationInvitation, f as CanceledOrganizationInvitation, i as AuthOrganization, j as InvitationAcceptance, jt as AuthErrorCode, kt as WorkspaceSelection, lt as RemovedOrganizationMember, n as AddedOrganizationTeamMember, ot as ReceivedOrganizationInvitation, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, ut as RemovedOrganizationTeamMember, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-Cv_qxcBP.js";
+//#region src/google-recovery.d.ts
+interface GoogleAccountRecoveryInput {
+  idToken: {
+    token: string;
+    nonce?: string;
+  };
+}
+interface CompleteGoogleAccountRecoveryInput extends GoogleAccountRecoveryInput {
+  recoveryToken: string;
+}
+interface GoogleAccountRecovery {
+  recoveryToken: string;
+  expiresAt: string;
+}
+//#endregion
 //#region src/user-api/verifier.d.ts
 interface UserApiIdentity {
   userId: string;
@@ -125,6 +140,7 @@ interface ServerSocialIdTokenSession extends AuthSession {
 }
 interface FinuevaServerAuth {
   acceptInvitation(input: AcceptInvitationInput): Promise<ServerInvitationAcceptance>;
+  declineInvitation(input: DeclineInvitationInput): Promise<InvitationDecline>;
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
@@ -136,6 +152,9 @@ interface FinuevaServerAuth {
   cancelOrganizationInvitation(organizationId: string, invitationId: string, idempotencyKey: string): Promise<CanceledOrganizationInvitation>;
   removeOrganizationMember(organizationId: string, memberId: string, idempotencyKey: string): Promise<RemovedOrganizationMember>;
   leaveOrganization(organizationId: string, idempotencyKey: string): Promise<OrganizationDeparture>;
+  addOrganizationTeamMember(organizationId: string, teamId: string, memberId: string, idempotencyKey: string): Promise<AddedOrganizationTeamMember>;
+  removeOrganizationTeamMember(organizationId: string, teamId: string, memberId: string, idempotencyKey: string): Promise<RemovedOrganizationTeamMember>;
+  deleteOrganizationTeam(organizationId: string, teamId: string, idempotencyKey: string): Promise<DeletedOrganizationTeam>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
   listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
@@ -146,10 +165,14 @@ interface FinuevaServerAuth {
   listReceivedInvitations(input?: OrganizationPageInput): Promise<ReceivedOrganizationInvitationPage>;
   getReceivedInvitation(invitationId: string): Promise<ReceivedOrganizationInvitation>;
   signInWithSocialIdToken(input: SocialIdTokenInput): Promise<ServerSocialIdTokenSession>;
+  startGoogleAccountRecovery(input: GoogleAccountRecoveryInput): Promise<GoogleAccountRecovery>;
+  completeGoogleAccountRecovery(input: CompleteGoogleAccountRecoveryInput): Promise<{
+    linked: true;
+  }>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
   getUserApiCredential(input: UserApiCredentialInput): Promise<UserApiCredential>;
   signOut(): Promise<ServerSignOutResult>;
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type IdentityResolverAuthOptions, type InvitationAcceptance, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };
+export { type AcceptInvitationInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };

package/dist/server.js

@@ -1,183 +1,13 @@
-String.fromCharCode;
-const HASH_RE = /#/g;
-const AMPERSAND_RE = /&/g;
-const SLASH_RE = /\//g;
-const EQUAL_RE = /=/g;
-const PLUS_RE = /\+/g;
-const ENC_CARET_RE = /%5e/gi;
-const ENC_BACKTICK_RE = /%60/gi;
-const ENC_PIPE_RE = /%7c/gi;
-const ENC_SPACE_RE = /%20/gi;
-function encode$2(text) {
-	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
-}
-function encodeQueryValue(input) {
-	return encode$2(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
-}
-function encodeQueryKey(text) {
-	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
-}
-function decode$1(text = "") {
-	try {
-		return decodeURIComponent("" + text);
-	} catch {
-		return "" + text;
-	}
-}
-function decodeQueryKey(text) {
-	return decode$1(text.replace(PLUS_RE, " "));
-}
-function decodeQueryValue(text) {
-	return decode$1(text.replace(PLUS_RE, " "));
-}
-function parseQuery(parametersString = "") {
-	const object = Object.create(null);
-	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
-	for (const parameter of parametersString.split("&")) {
-		const s = parameter.match(/([^=]+)=?(.*)/) || [];
-		if (s.length < 2) continue;
-		const key = decodeQueryKey(s[1]);
-		if (key === "__proto__" || key === "constructor") continue;
-		const value = decodeQueryValue(s[2] || "");
-		if (object[key] === void 0) object[key] = value;
-		else if (Array.isArray(object[key])) object[key].push(value);
-		else object[key] = [object[key], value];
-	}
-	return object;
-}
-function encodeQueryItem(key, value) {
-	if (typeof value === "number" || typeof value === "boolean") value = String(value);
-	if (!value) return encodeQueryKey(key);
-	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
-	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
-}
-function stringifyQuery(query) {
-	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
-}
-const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
-const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
-const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
-const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
-const JOIN_LEADING_SLASH_RE = /^\.?\//;
-function hasProtocol(inputString, opts = {}) {
-	if (typeof opts === "boolean") opts = { acceptRelative: opts };
-	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
-	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
-}
-function hasTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return input.endsWith("/");
-	return TRAILING_SLASH_RE.test(input);
-}
-function withoutTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
-	if (!hasTrailingSlash(input, true)) return input || "/";
-	let path = input;
-	let fragment = "";
-	const fragmentIndex = input.indexOf("#");
-	if (fragmentIndex !== -1) {
-		path = input.slice(0, fragmentIndex);
-		fragment = input.slice(fragmentIndex);
-	}
-	const [s0, ...s] = path.split("?");
-	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
-}
-function withTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
-	if (hasTrailingSlash(input, true)) return input || "/";
-	let path = input;
-	let fragment = "";
-	const fragmentIndex = input.indexOf("#");
-	if (fragmentIndex !== -1) {
-		path = input.slice(0, fragmentIndex);
-		fragment = input.slice(fragmentIndex);
-		if (!path) return fragment;
-	}
-	const [s0, ...s] = path.split("?");
-	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
-}
-function withBase(input, base) {
-	if (isEmptyURL(base) || hasProtocol(input)) return input;
-	const _base = withoutTrailingSlash(base);
-	if (input.startsWith(_base)) {
-		const nextChar = input[_base.length];
-		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
-	}
-	return joinURL(_base, input);
-}
-function withQuery(input, query) {
-	const parsed = parseURL(input);
-	parsed.search = stringifyQuery({
-		...parseQuery(parsed.search),
-		...query
-	});
-	return stringifyParsedURL(parsed);
-}
-function isEmptyURL(url) {
-	return !url || url === "/";
-}
-function isNonEmptyURL(url) {
-	return url && url !== "/";
-}
-function joinURL(base, ...input) {
-	let url = base || "";
-	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
-		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
-		url = withTrailingSlash(url) + _segment;
-	} else url = segment;
-	return url;
-}
-const protocolRelative = Symbol.for("ufo:protocolRelative");
-function parseURL(input = "", defaultProto) {
-	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
-	if (_specialProtoMatch) {
-		const [, _proto, _pathname = ""] = _specialProtoMatch;
-		return {
-			protocol: _proto.toLowerCase(),
-			pathname: _pathname,
-			href: _proto + _pathname,
-			auth: "",
-			host: "",
-			search: "",
-			hash: ""
-		};
-	}
-	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
-	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
-	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
-	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
-	const { pathname, search, hash } = parsePath(path);
-	return {
-		protocol: protocol.toLowerCase(),
-		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
-		host,
-		pathname,
-		search,
-		hash,
-		[protocolRelative]: !protocol
-	};
-}
-function parsePath(input = "") {
-	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
-	return {
-		pathname,
-		search,
-		hash
-	};
-}
-function stringifyParsedURL(parsed) {
-	const pathname = parsed.pathname || "";
-	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
-	const hash = parsed.hash || "";
-	const auth = parsed.auth ? parsed.auth + "@" : "";
-	const host = parsed.host || "";
-	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
-}
-//#endregion
 //#region src/errors.ts
 const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
@@ -198,7 +28,18 @@ const messages = {
 	platform_target_unavailable: "The platform administration target is unavailable.",
 	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
 	platform_recovery_required: "Platform administration requires separate recovery.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable."
+	identity_authority_unavailable: "Authentication is temporarily unavailable.",
+	two_factor_required: "A second authentication factor is required.",
+	two_factor_code_invalid: "The verification code is invalid.",
+	two_factor_challenge_expired: "The second-factor challenge has ended. Sign in again.",
+	two_factor_locked: "Second-factor verification is temporarily locked.",
+	recent_sign_in_required: "A recent sign-in is required.",
+	enterprise_recovery_required: "Enterprise administration evidence requires operator recovery.",
+	recent_authentication_required: "A ready recent-authentication action is required.",
+	organization_closure_confirmation_mismatch: "The confirmation does not match the organization.",
+	organization_closure_cancellation_ended: "The closure cancellation period has ended.",
+	ceremony_return_refused: "The return address is not registered for this application.",
+	password_sign_in_required: "A password sign-in method is required for this passkey change."
 };
 var AuthError = class extends Error {
 	code;
@@ -462,6 +303,25 @@ function normalizeOrganizationDeparture(value) {
 	if (value.status !== "left") throw authorityUnavailable();
 	return { status: "left" };
 }
+function normalizeOrganizationTeamMembershipInput(idempotencyKey) {
+	if (!boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return { idempotencyKey };
+}
+function normalizeAddedOrganizationTeamMember(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "added") throw authorityUnavailable();
+	return { status: "added" };
+}
+function normalizeRemovedOrganizationTeamMember(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "removed") throw authorityUnavailable();
+	return { status: "removed" };
+}
+function normalizeDeletedOrganizationTeam(value) {
+	exact$3(value, ["status"]);
+	if (value.status !== "deleted") throw authorityUnavailable();
+	return { status: "deleted" };
+}
 function normalizeOrganizations(value) {
 	exact$3(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -623,6 +483,10 @@ function normalizeInvitationAcceptance(value, invitationId) {
 	if (!isObject$1(value) || !isObject$1(value.invitation) || !isObject$1(value.member) || value.invitation.id !== invitationId || value.invitation.status !== "accepted" || !isId(value.invitation.organizationId) || value.member.organizationId !== value.invitation.organizationId) throw authorityUnavailable();
 	return { organizationId: value.invitation.organizationId };
 }
+function normalizeInvitationDecline(value, invitationId) {
+	if (!isObject$1(value) || !isObject$1(value.invitation) || value.invitation.id !== invitationId || value.invitation.status !== "rejected" || value.member !== null) throw authorityUnavailable();
+	return { status: "declined" };
+}
 function normalizeWorkspaceSelection(value) {
 	if (!isObject$1(value)) throw new AuthError("invalid_workspace_selection", 422);
 	const keys = Object.keys(value);
@@ -843,6 +707,229 @@ function isObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
+//#region src/google-recovery.ts
+function object(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validTicket(value) {
+	return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+function googleRecoveryInput(value, complete) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== (complete ? "idToken,recoveryToken" : "idToken") || !object(value.idToken) || Object.keys(value.idToken).some((key) => key !== "token" && key !== "nonce") || complete && !validTicket(value.recoveryToken)) throw new AuthError("invalid_request", 400);
+	const social = normalizeSocialIdTokenInput({
+		provider: "google",
+		idToken: value.idToken.token,
+		signUp: false,
+		...value.idToken.nonce === void 0 ? {} : { nonce: value.idToken.nonce }
+	});
+	return {
+		idToken: {
+			token: social.idToken,
+			...social.nonce === void 0 ? {} : { nonce: social.nonce }
+		},
+		...complete ? { recoveryToken: value.recoveryToken } : {}
+	};
+}
+function normalizeGoogleRecovery(value, now) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== "expiresAt,recoveryToken" || !validTicket(value.recoveryToken) || typeof value.expiresAt !== "string") throw authorityUnavailable();
+	const expiresAt = Date.parse(value.expiresAt);
+	if (!Number.isFinite(expiresAt) || expiresAt <= now || expiresAt > now + 10 * 6e4) throw authorityUnavailable();
+	return {
+		recoveryToken: value.recoveryToken,
+		expiresAt: value.expiresAt
+	};
+}
+function normalizeGoogleRecoveryCompletion(value) {
+	if (!object(value) || Object.keys(value).join(",") !== "linked" || value.linked !== true) throw authorityUnavailable();
+	return { linked: true };
+}
+function fromGoogleRecoveryError(value, status, retryAfter) {
+	const code = object(value) ? value.code : void 0;
+	if (status === 409 && code === "GOOGLE_RECOVERY_IN_PROGRESS") return new AuthError("google_recovery_in_progress", 409);
+	if (status === 409 && code === "GOOGLE_RECOVERY_NOT_REQUIRED") return new AuthError("google_recovery_not_required", 409);
+	if (status === 403 && code === "GOOGLE_RECOVERY_EMAIL_VERIFICATION_REQUIRED") return new AuthError("email_verification_required", 403);
+	if (status === 400 && code === "GOOGLE_RECOVERY_INVALID") return new AuthError("google_recovery_invalid", 400);
+	if (status === 410 && code === "GOOGLE_RECOVERY_EXPIRED") return new AuthError("google_recovery_expired", 410);
+	if (status === 403 && code === "GOOGLE_RECOVERY_ACCOUNT_MISMATCH") return new AuthError("google_recovery_account_mismatch", 403);
+	if (status === 401 && code === "GOOGLE_RECOVERY_FRESH_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 401);
+	if (code === "GOOGLE_RECOVERY_UNAVAILABLE") return authorityUnavailable();
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
+String.fromCharCode;
+const HASH_RE = /#/g;
+const AMPERSAND_RE = /&/g;
+const SLASH_RE = /\//g;
+const EQUAL_RE = /=/g;
+const PLUS_RE = /\+/g;
+const ENC_CARET_RE = /%5e/gi;
+const ENC_BACKTICK_RE = /%60/gi;
+const ENC_PIPE_RE = /%7c/gi;
+const ENC_SPACE_RE = /%20/gi;
+function encode$2(text) {
+	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
+}
+function encodeQueryValue(input) {
+	return encode$2(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
+}
+function encodeQueryKey(text) {
+	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
+}
+function decode$1(text = "") {
+	try {
+		return decodeURIComponent("" + text);
+	} catch {
+		return "" + text;
+	}
+}
+function decodeQueryKey(text) {
+	return decode$1(text.replace(PLUS_RE, " "));
+}
+function decodeQueryValue(text) {
+	return decode$1(text.replace(PLUS_RE, " "));
+}
+function parseQuery(parametersString = "") {
+	const object = Object.create(null);
+	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
+	for (const parameter of parametersString.split("&")) {
+		const s = parameter.match(/([^=]+)=?(.*)/) || [];
+		if (s.length < 2) continue;
+		const key = decodeQueryKey(s[1]);
+		if (key === "__proto__" || key === "constructor") continue;
+		const value = decodeQueryValue(s[2] || "");
+		if (object[key] === void 0) object[key] = value;
+		else if (Array.isArray(object[key])) object[key].push(value);
+		else object[key] = [object[key], value];
+	}
+	return object;
+}
+function encodeQueryItem(key, value) {
+	if (typeof value === "number" || typeof value === "boolean") value = String(value);
+	if (!value) return encodeQueryKey(key);
+	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
+	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
+}
+function stringifyQuery(query) {
+	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
+}
+const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
+const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
+const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
+const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
+const JOIN_LEADING_SLASH_RE = /^\.?\//;
+function hasProtocol(inputString, opts = {}) {
+	if (typeof opts === "boolean") opts = { acceptRelative: opts };
+	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
+	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
+}
+function hasTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/");
+	return TRAILING_SLASH_RE.test(input);
+}
+function withoutTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
+	if (!hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+	}
+	const [s0, ...s] = path.split("?");
+	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
+	if (hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+		if (!path) return fragment;
+	}
+	const [s0, ...s] = path.split("?");
+	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withBase(input, base) {
+	if (isEmptyURL(base) || hasProtocol(input)) return input;
+	const _base = withoutTrailingSlash(base);
+	if (input.startsWith(_base)) {
+		const nextChar = input[_base.length];
+		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
+	}
+	return joinURL(_base, input);
+}
+function withQuery(input, query) {
+	const parsed = parseURL(input);
+	parsed.search = stringifyQuery({
+		...parseQuery(parsed.search),
+		...query
+	});
+	return stringifyParsedURL(parsed);
+}
+function isEmptyURL(url) {
+	return !url || url === "/";
+}
+function isNonEmptyURL(url) {
+	return url && url !== "/";
+}
+function joinURL(base, ...input) {
+	let url = base || "";
+	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
+		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
+		url = withTrailingSlash(url) + _segment;
+	} else url = segment;
+	return url;
+}
+const protocolRelative = Symbol.for("ufo:protocolRelative");
+function parseURL(input = "", defaultProto) {
+	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
+	if (_specialProtoMatch) {
+		const [, _proto, _pathname = ""] = _specialProtoMatch;
+		return {
+			protocol: _proto.toLowerCase(),
+			pathname: _pathname,
+			href: _proto + _pathname,
+			auth: "",
+			host: "",
+			search: "",
+			hash: ""
+		};
+	}
+	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
+	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
+	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
+	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
+	const { pathname, search, hash } = parsePath(path);
+	return {
+		protocol: protocol.toLowerCase(),
+		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
+		host,
+		pathname,
+		search,
+		hash,
+		[protocolRelative]: !protocol
+	};
+}
+function parsePath(input = "") {
+	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
+	return {
+		pathname,
+		search,
+		hash
+	};
+}
+function stringifyParsedURL(parsed) {
+	const pathname = parsed.pathname || "";
+	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
+	const hash = parsed.hash || "";
+	const auth = parsed.auth ? parsed.auth + "@" : "";
+	const host = parsed.host || "";
+	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
+}
+//#endregion
 //#region src/user-api/credential.ts
 function userApiApplication(input) {
 	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
@@ -2907,6 +2994,23 @@ function createServerAuth(options) {
 		...authorization ? { authorization } : { cookie },
 		...includeOrigin ? { origin: appOrigin } : {}
 	});
+	async function teamMembershipMutation(ids, idempotencyKey, action) {
+		if (authorization) throw new AuthError("authentication_required", 401);
+		const [organization, team, member] = ids.map(normalizeIdInput);
+		const body = normalizeOrganizationTeamMembershipInput(idempotencyKey);
+		return requestJson(action === "delete" ? joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "delete") : joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "members", member, action), {
+			fetch: fetchImpl,
+			timeoutMs,
+			method: "POST",
+			credentials,
+			headers: {
+				...authHeaders(),
+				"content-type": "application/json"
+			},
+			body,
+			mapError: fromOrganizationMutationAuthorityError
+		});
+	}
 	async function organizationRead(path, input, normalize) {
 		const query = normalizeOrganizationPageInput(input);
 		return normalize(await requestJson(`${joinURL(authOrigin, "api/v1/auth/organizations", path)}${query.size ? `?${query}` : ""}`, {
@@ -2947,6 +3051,25 @@ function createServerAuth(options) {
 				throw fromInvitationError(error);
 			}
 		},
+		async declineInvitation(input) {
+			const invitation = normalizeInvitationInput(input);
+			try {
+				return normalizeInvitationDecline(await requestJson(joinURL(authOrigin, "api/v1/auth/organization/reject-invitation"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "POST",
+					credentials,
+					headers: {
+						...authHeaders(),
+						"content-type": "application/json; charset=utf-8"
+					},
+					body: invitation,
+					mapError: fromInvitationAuthorityError
+				}), invitation.invitationId);
+			} catch (error) {
+				throw fromInvitationError(error);
+			}
+		},
 		async getSession() {
 			return normalizeSession(await requestJson(joinURL(authOrigin, "api/v1/auth/get-session"), {
 				fetch: fetchImpl,
@@ -3089,6 +3212,23 @@ function createServerAuth(options) {
 				mapError: fromOrganizationMembershipRemovalError
 			}));
 		},
+		async addOrganizationTeamMember(organizationId, teamId, memberId, idempotencyKey) {
+			return normalizeAddedOrganizationTeamMember(await teamMembershipMutation([
+				organizationId,
+				teamId,
+				memberId
+			], idempotencyKey, "add"));
+		},
+		async removeOrganizationTeamMember(organizationId, teamId, memberId, idempotencyKey) {
+			return normalizeRemovedOrganizationTeamMember(await teamMembershipMutation([
+				organizationId,
+				teamId,
+				memberId
+			], idempotencyKey, "remove"));
+		},
+		async deleteOrganizationTeam(organizationId, teamId, idempotencyKey) {
+			return normalizeDeletedOrganizationTeam(await teamMembershipMutation([organizationId, teamId], idempotencyKey, "delete"));
+		},
 		async updateOrganizationDisplay(organizationId, input) {
 			const id = normalizeIdInput(organizationId);
 			const desired = normalizeOrganizationDisplayInput(input);
@@ -3143,6 +3283,39 @@ function createServerAuth(options) {
 		getReceivedInvitation(invitationId) {
 			return organizationRead(`received-invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeReceivedInvitation);
 		},
+		async startGoogleAccountRecovery(input) {
+			if (authorization) throw new AuthError("state_conflict", 409);
+			const body = googleRecoveryInput(input, false);
+			return normalizeGoogleRecovery(await requestJson(joinURL(authOrigin, "api/v1/auth/google-account-recovery/start"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "include",
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json; charset=utf-8"
+				},
+				body,
+				mapError: fromGoogleRecoveryError
+			}), now());
+		},
+		async completeGoogleAccountRecovery(input) {
+			if (authorization) throw new AuthError("state_conflict", 409);
+			if (!cookie) throw new AuthError("authentication_required", 401);
+			const body = googleRecoveryInput(input, true);
+			return normalizeGoogleRecoveryCompletion(await requestJson(joinURL(authOrigin, "api/v1/auth/google-account-recovery/complete"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "include",
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json; charset=utf-8"
+				},
+				body,
+				mapError: fromGoogleRecoveryError
+			}));
+		},
 		async signInWithSocialIdToken(input) {
 			if (authorization) throw new AuthError("state_conflict", 409);
 			const body = socialIdTokenRequest(normalizeSocialIdTokenInput(input));