@finueva/auth 0.19.0 → 0.20.0

package/README.md

@@ -307,6 +307,18 @@ return new Response(null, { status: 303, headers });
 
 Call `applyCookies()` after server `signOut()`, `acceptInvitation()`, and `signInWithSocialIdToken()`.
 
+## Recover A Google Account Conflict
+
+Use the request-scoped server client. If Google sign-in reports an account conflict, call `startGoogleAccountRecovery({ idToken: { token, nonce } })`. Auth verifies the Google identity and confirms that an existing verified password account requires linking. A generic sign-in error alone does not authorize recovery.
+
+The result contains an opaque `recoveryToken` and an ISO `expiresAt`. Keep the result and Google ID token in short-lived encrypted server-managed state. Do not put them in URLs, logs, or browser storage.
+
+Ask the user to sign in to the existing account with its password. Complete the configured second factor. Then create a new request-scoped client with that session and call `completeGoogleAccountRecovery({ recoveryToken, idToken: { token, nonce } })`. Auth requires a fresh password authentication after the recovery request. An old session or a different account cannot complete recovery. The result is `{ linked: true }`; the current session remains in use.
+
+If completion returns `google_recovery_in_progress`, retain the current session and recovery state. A retry can confirm a committed link. Auth does not repeat an uncertain linking mutation. If the original attempt cannot finish, wait for its ten-minute expiry before restarting.
+
+Recovery is cookie-only and bound to the registered app origin. It does not enable implicit linking or link users by an email match alone. If recovery expires, restart Google sign-in. If email verification is required, complete the existing account's verification first.
+
 ## Resolve A Drive Recipient
 
 Use the separate server client. Before lookup, Drive must check the caller's current permission to manage the item's shares. Recipient resolution does not grant file access.

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { At as AuthError, B as OrganizationMember, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, Pt as UserApiCredentialInput, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, b as CreatedOrganization, c as AuthSessionInventory, i as AuthOrganization, jt as AuthErrorCode, m as CeremonyHandoffInput, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, vt as SocialIdTokenInput, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-BEgD_Js1.js";
+import { At as AuthError, B as OrganizationMember, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, Pt as UserApiCredentialInput, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, b as CreatedOrganization, c as AuthSessionInventory, i as AuthOrganization, jt as AuthErrorCode, m as CeremonyHandoffInput, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, vt as SocialIdTokenInput, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-Cv_qxcBP.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/device.js

@@ -178,6 +178,11 @@ const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as PlatformBootstrapRoleChangeInput, A as FinuevaAuthClient, At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, Ct as TwoFactorEnrollment, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, E as DepartedOrganizationMemberPage, Et as UpdateOrganizationDisplayInput, F as OrganizationClosureStartInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, N as OrganizationClosure, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, P as OrganizationClosureCancelInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, St as SuspendedOrganizationMemberStatus, T as DepartedOrganizationMember, Tt as TwoFactorStepUpInput, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, Y as OrganizationWorkspaceSelection, Z as PasskeySummary, _ as ClosingOrganization, _t as SignInInput, a as AuthPersistence, at as PlatformStatus, b as CreatedOrganization, bt as SuspendedOrganizationMember, c as AuthSessionInventory, ct as RecentAuthenticationStatus, d as AuthUser, dt as ResentOrganizationInvitation, et as PlatformRole, f as CanceledOrganizationInvitation, ft as RestoredOrganizationMember, g as CeremonyReturnInput, gt as SendVerificationEmailInput, h as CeremonyRecentAuthenticationRequest, ht as ScimCredentialState, i as AuthOrganization, it as PlatformRoleFirstApproval, j as InvitationAcceptance, jt as AuthErrorCode, k as EnterpriseConnection, kt as WorkspaceSelection, l as AuthSessionSummary, lt as RemovedOrganizationMember, m as CeremonyHandoffInput, mt as ScimCredentialIssuance, n as AddedOrganizationTeamMember, nt as PlatformRoleApproval, o as AuthPersistenceDriver, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, pt as RotateScimCredentialInput, q as OrganizationTeamMemberPage, r as AuthClientOptions, rt as PlatformRoleChangeRecentAuthenticationInput, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, tt as PlatformRoleApplied, u as AuthState, ut as RemovedOrganizationTeamMember, v as ClosingOrganizationList, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, xt as SuspendedOrganizationMemberPage, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-BEgD_Js1.js";
+import { $ as PlatformBootstrapRoleChangeInput, A as FinuevaAuthClient, At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, Ct as TwoFactorEnrollment, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, E as DepartedOrganizationMemberPage, Et as UpdateOrganizationDisplayInput, F as OrganizationClosureStartInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, N as OrganizationClosure, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, P as OrganizationClosureCancelInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, St as SuspendedOrganizationMemberStatus, T as DepartedOrganizationMember, Tt as TwoFactorStepUpInput, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, Y as OrganizationWorkspaceSelection, Z as PasskeySummary, _ as ClosingOrganization, _t as SignInInput, a as AuthPersistence, at as PlatformStatus, b as CreatedOrganization, bt as SuspendedOrganizationMember, c as AuthSessionInventory, ct as RecentAuthenticationStatus, d as AuthUser, dt as ResentOrganizationInvitation, et as PlatformRole, f as CanceledOrganizationInvitation, ft as RestoredOrganizationMember, g as CeremonyReturnInput, gt as SendVerificationEmailInput, h as CeremonyRecentAuthenticationRequest, ht as ScimCredentialState, i as AuthOrganization, it as PlatformRoleFirstApproval, j as InvitationAcceptance, jt as AuthErrorCode, k as EnterpriseConnection, kt as WorkspaceSelection, l as AuthSessionSummary, lt as RemovedOrganizationMember, m as CeremonyHandoffInput, mt as ScimCredentialIssuance, n as AddedOrganizationTeamMember, nt as PlatformRoleApproval, o as AuthPersistenceDriver, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, pt as RotateScimCredentialInput, q as OrganizationTeamMemberPage, r as AuthClientOptions, rt as PlatformRoleChangeRecentAuthenticationInput, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, tt as PlatformRoleApplied, u as AuthState, ut as RemovedOrganizationTeamMember, v as ClosingOrganizationList, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, xt as SuspendedOrganizationMemberPage, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-Cv_qxcBP.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion

package/dist/index.js

@@ -2537,6 +2537,11 @@ const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",

package/dist/server.d.ts

@@ -1,4 +1,19 @@
-import { At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, Y as OrganizationWorkspaceSelection, b as CreatedOrganization, d as AuthUser, dt as ResentOrganizationInvitation, f as CanceledOrganizationInvitation, i as AuthOrganization, j as InvitationAcceptance, jt as AuthErrorCode, kt as WorkspaceSelection, lt as RemovedOrganizationMember, n as AddedOrganizationTeamMember, ot as ReceivedOrganizationInvitation, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, ut as RemovedOrganizationTeamMember, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-BEgD_Js1.js";
+import { At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, Y as OrganizationWorkspaceSelection, b as CreatedOrganization, d as AuthUser, dt as ResentOrganizationInvitation, f as CanceledOrganizationInvitation, i as AuthOrganization, j as InvitationAcceptance, jt as AuthErrorCode, kt as WorkspaceSelection, lt as RemovedOrganizationMember, n as AddedOrganizationTeamMember, ot as ReceivedOrganizationInvitation, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, ut as RemovedOrganizationTeamMember, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-Cv_qxcBP.js";
+//#region src/google-recovery.d.ts
+interface GoogleAccountRecoveryInput {
+  idToken: {
+    token: string;
+    nonce?: string;
+  };
+}
+interface CompleteGoogleAccountRecoveryInput extends GoogleAccountRecoveryInput {
+  recoveryToken: string;
+}
+interface GoogleAccountRecovery {
+  recoveryToken: string;
+  expiresAt: string;
+}
+//#endregion
 //#region src/user-api/verifier.d.ts
 interface UserApiIdentity {
   userId: string;
@@ -150,10 +165,14 @@ interface FinuevaServerAuth {
   listReceivedInvitations(input?: OrganizationPageInput): Promise<ReceivedOrganizationInvitationPage>;
   getReceivedInvitation(invitationId: string): Promise<ReceivedOrganizationInvitation>;
   signInWithSocialIdToken(input: SocialIdTokenInput): Promise<ServerSocialIdTokenSession>;
+  startGoogleAccountRecovery(input: GoogleAccountRecoveryInput): Promise<GoogleAccountRecovery>;
+  completeGoogleAccountRecovery(input: CompleteGoogleAccountRecoveryInput): Promise<{
+    linked: true;
+  }>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
   getUserApiCredential(input: UserApiCredentialInput): Promise<UserApiCredential>;
   signOut(): Promise<ServerSignOutResult>;
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };
+export { type AcceptInvitationInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };

package/dist/server.js

@@ -1,183 +1,13 @@
-String.fromCharCode;
-const HASH_RE = /#/g;
-const AMPERSAND_RE = /&/g;
-const SLASH_RE = /\//g;
-const EQUAL_RE = /=/g;
-const PLUS_RE = /\+/g;
-const ENC_CARET_RE = /%5e/gi;
-const ENC_BACKTICK_RE = /%60/gi;
-const ENC_PIPE_RE = /%7c/gi;
-const ENC_SPACE_RE = /%20/gi;
-function encode$2(text) {
-	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
-}
-function encodeQueryValue(input) {
-	return encode$2(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
-}
-function encodeQueryKey(text) {
-	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
-}
-function decode$1(text = "") {
-	try {
-		return decodeURIComponent("" + text);
-	} catch {
-		return "" + text;
-	}
-}
-function decodeQueryKey(text) {
-	return decode$1(text.replace(PLUS_RE, " "));
-}
-function decodeQueryValue(text) {
-	return decode$1(text.replace(PLUS_RE, " "));
-}
-function parseQuery(parametersString = "") {
-	const object = Object.create(null);
-	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
-	for (const parameter of parametersString.split("&")) {
-		const s = parameter.match(/([^=]+)=?(.*)/) || [];
-		if (s.length < 2) continue;
-		const key = decodeQueryKey(s[1]);
-		if (key === "__proto__" || key === "constructor") continue;
-		const value = decodeQueryValue(s[2] || "");
-		if (object[key] === void 0) object[key] = value;
-		else if (Array.isArray(object[key])) object[key].push(value);
-		else object[key] = [object[key], value];
-	}
-	return object;
-}
-function encodeQueryItem(key, value) {
-	if (typeof value === "number" || typeof value === "boolean") value = String(value);
-	if (!value) return encodeQueryKey(key);
-	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
-	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
-}
-function stringifyQuery(query) {
-	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
-}
-const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
-const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
-const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
-const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
-const JOIN_LEADING_SLASH_RE = /^\.?\//;
-function hasProtocol(inputString, opts = {}) {
-	if (typeof opts === "boolean") opts = { acceptRelative: opts };
-	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
-	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
-}
-function hasTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return input.endsWith("/");
-	return TRAILING_SLASH_RE.test(input);
-}
-function withoutTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
-	if (!hasTrailingSlash(input, true)) return input || "/";
-	let path = input;
-	let fragment = "";
-	const fragmentIndex = input.indexOf("#");
-	if (fragmentIndex !== -1) {
-		path = input.slice(0, fragmentIndex);
-		fragment = input.slice(fragmentIndex);
-	}
-	const [s0, ...s] = path.split("?");
-	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
-}
-function withTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
-	if (hasTrailingSlash(input, true)) return input || "/";
-	let path = input;
-	let fragment = "";
-	const fragmentIndex = input.indexOf("#");
-	if (fragmentIndex !== -1) {
-		path = input.slice(0, fragmentIndex);
-		fragment = input.slice(fragmentIndex);
-		if (!path) return fragment;
-	}
-	const [s0, ...s] = path.split("?");
-	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
-}
-function withBase(input, base) {
-	if (isEmptyURL(base) || hasProtocol(input)) return input;
-	const _base = withoutTrailingSlash(base);
-	if (input.startsWith(_base)) {
-		const nextChar = input[_base.length];
-		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
-	}
-	return joinURL(_base, input);
-}
-function withQuery(input, query) {
-	const parsed = parseURL(input);
-	parsed.search = stringifyQuery({
-		...parseQuery(parsed.search),
-		...query
-	});
-	return stringifyParsedURL(parsed);
-}
-function isEmptyURL(url) {
-	return !url || url === "/";
-}
-function isNonEmptyURL(url) {
-	return url && url !== "/";
-}
-function joinURL(base, ...input) {
-	let url = base || "";
-	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
-		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
-		url = withTrailingSlash(url) + _segment;
-	} else url = segment;
-	return url;
-}
-const protocolRelative = Symbol.for("ufo:protocolRelative");
-function parseURL(input = "", defaultProto) {
-	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
-	if (_specialProtoMatch) {
-		const [, _proto, _pathname = ""] = _specialProtoMatch;
-		return {
-			protocol: _proto.toLowerCase(),
-			pathname: _pathname,
-			href: _proto + _pathname,
-			auth: "",
-			host: "",
-			search: "",
-			hash: ""
-		};
-	}
-	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
-	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
-	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
-	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
-	const { pathname, search, hash } = parsePath(path);
-	return {
-		protocol: protocol.toLowerCase(),
-		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
-		host,
-		pathname,
-		search,
-		hash,
-		[protocolRelative]: !protocol
-	};
-}
-function parsePath(input = "") {
-	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
-	return {
-		pathname,
-		search,
-		hash
-	};
-}
-function stringifyParsedURL(parsed) {
-	const pathname = parsed.pathname || "";
-	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
-	const hash = parsed.hash || "";
-	const auth = parsed.auth ? parsed.auth + "@" : "";
-	const host = parsed.host || "";
-	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
-}
-//#endregion
 //#region src/errors.ts
 const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
@@ -877,6 +707,229 @@ function isObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
+//#region src/google-recovery.ts
+function object(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validTicket(value) {
+	return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+function googleRecoveryInput(value, complete) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== (complete ? "idToken,recoveryToken" : "idToken") || !object(value.idToken) || Object.keys(value.idToken).some((key) => key !== "token" && key !== "nonce") || complete && !validTicket(value.recoveryToken)) throw new AuthError("invalid_request", 400);
+	const social = normalizeSocialIdTokenInput({
+		provider: "google",
+		idToken: value.idToken.token,
+		signUp: false,
+		...value.idToken.nonce === void 0 ? {} : { nonce: value.idToken.nonce }
+	});
+	return {
+		idToken: {
+			token: social.idToken,
+			...social.nonce === void 0 ? {} : { nonce: social.nonce }
+		},
+		...complete ? { recoveryToken: value.recoveryToken } : {}
+	};
+}
+function normalizeGoogleRecovery(value, now) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== "expiresAt,recoveryToken" || !validTicket(value.recoveryToken) || typeof value.expiresAt !== "string") throw authorityUnavailable();
+	const expiresAt = Date.parse(value.expiresAt);
+	if (!Number.isFinite(expiresAt) || expiresAt <= now || expiresAt > now + 10 * 6e4) throw authorityUnavailable();
+	return {
+		recoveryToken: value.recoveryToken,
+		expiresAt: value.expiresAt
+	};
+}
+function normalizeGoogleRecoveryCompletion(value) {
+	if (!object(value) || Object.keys(value).join(",") !== "linked" || value.linked !== true) throw authorityUnavailable();
+	return { linked: true };
+}
+function fromGoogleRecoveryError(value, status, retryAfter) {
+	const code = object(value) ? value.code : void 0;
+	if (status === 409 && code === "GOOGLE_RECOVERY_IN_PROGRESS") return new AuthError("google_recovery_in_progress", 409);
+	if (status === 409 && code === "GOOGLE_RECOVERY_NOT_REQUIRED") return new AuthError("google_recovery_not_required", 409);
+	if (status === 403 && code === "GOOGLE_RECOVERY_EMAIL_VERIFICATION_REQUIRED") return new AuthError("email_verification_required", 403);
+	if (status === 400 && code === "GOOGLE_RECOVERY_INVALID") return new AuthError("google_recovery_invalid", 400);
+	if (status === 410 && code === "GOOGLE_RECOVERY_EXPIRED") return new AuthError("google_recovery_expired", 410);
+	if (status === 403 && code === "GOOGLE_RECOVERY_ACCOUNT_MISMATCH") return new AuthError("google_recovery_account_mismatch", 403);
+	if (status === 401 && code === "GOOGLE_RECOVERY_FRESH_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 401);
+	if (code === "GOOGLE_RECOVERY_UNAVAILABLE") return authorityUnavailable();
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
+String.fromCharCode;
+const HASH_RE = /#/g;
+const AMPERSAND_RE = /&/g;
+const SLASH_RE = /\//g;
+const EQUAL_RE = /=/g;
+const PLUS_RE = /\+/g;
+const ENC_CARET_RE = /%5e/gi;
+const ENC_BACKTICK_RE = /%60/gi;
+const ENC_PIPE_RE = /%7c/gi;
+const ENC_SPACE_RE = /%20/gi;
+function encode$2(text) {
+	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
+}
+function encodeQueryValue(input) {
+	return encode$2(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
+}
+function encodeQueryKey(text) {
+	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
+}
+function decode$1(text = "") {
+	try {
+		return decodeURIComponent("" + text);
+	} catch {
+		return "" + text;
+	}
+}
+function decodeQueryKey(text) {
+	return decode$1(text.replace(PLUS_RE, " "));
+}
+function decodeQueryValue(text) {
+	return decode$1(text.replace(PLUS_RE, " "));
+}
+function parseQuery(parametersString = "") {
+	const object = Object.create(null);
+	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
+	for (const parameter of parametersString.split("&")) {
+		const s = parameter.match(/([^=]+)=?(.*)/) || [];
+		if (s.length < 2) continue;
+		const key = decodeQueryKey(s[1]);
+		if (key === "__proto__" || key === "constructor") continue;
+		const value = decodeQueryValue(s[2] || "");
+		if (object[key] === void 0) object[key] = value;
+		else if (Array.isArray(object[key])) object[key].push(value);
+		else object[key] = [object[key], value];
+	}
+	return object;
+}
+function encodeQueryItem(key, value) {
+	if (typeof value === "number" || typeof value === "boolean") value = String(value);
+	if (!value) return encodeQueryKey(key);
+	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
+	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
+}
+function stringifyQuery(query) {
+	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
+}
+const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
+const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
+const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
+const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
+const JOIN_LEADING_SLASH_RE = /^\.?\//;
+function hasProtocol(inputString, opts = {}) {
+	if (typeof opts === "boolean") opts = { acceptRelative: opts };
+	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
+	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
+}
+function hasTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/");
+	return TRAILING_SLASH_RE.test(input);
+}
+function withoutTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
+	if (!hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+	}
+	const [s0, ...s] = path.split("?");
+	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
+	if (hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+		if (!path) return fragment;
+	}
+	const [s0, ...s] = path.split("?");
+	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withBase(input, base) {
+	if (isEmptyURL(base) || hasProtocol(input)) return input;
+	const _base = withoutTrailingSlash(base);
+	if (input.startsWith(_base)) {
+		const nextChar = input[_base.length];
+		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
+	}
+	return joinURL(_base, input);
+}
+function withQuery(input, query) {
+	const parsed = parseURL(input);
+	parsed.search = stringifyQuery({
+		...parseQuery(parsed.search),
+		...query
+	});
+	return stringifyParsedURL(parsed);
+}
+function isEmptyURL(url) {
+	return !url || url === "/";
+}
+function isNonEmptyURL(url) {
+	return url && url !== "/";
+}
+function joinURL(base, ...input) {
+	let url = base || "";
+	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
+		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
+		url = withTrailingSlash(url) + _segment;
+	} else url = segment;
+	return url;
+}
+const protocolRelative = Symbol.for("ufo:protocolRelative");
+function parseURL(input = "", defaultProto) {
+	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
+	if (_specialProtoMatch) {
+		const [, _proto, _pathname = ""] = _specialProtoMatch;
+		return {
+			protocol: _proto.toLowerCase(),
+			pathname: _pathname,
+			href: _proto + _pathname,
+			auth: "",
+			host: "",
+			search: "",
+			hash: ""
+		};
+	}
+	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
+	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
+	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
+	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
+	const { pathname, search, hash } = parsePath(path);
+	return {
+		protocol: protocol.toLowerCase(),
+		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
+		host,
+		pathname,
+		search,
+		hash,
+		[protocolRelative]: !protocol
+	};
+}
+function parsePath(input = "") {
+	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
+	return {
+		pathname,
+		search,
+		hash
+	};
+}
+function stringifyParsedURL(parsed) {
+	const pathname = parsed.pathname || "";
+	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
+	const hash = parsed.hash || "";
+	const auth = parsed.auth ? parsed.auth + "@" : "";
+	const host = parsed.host || "";
+	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
+}
+//#endregion
 //#region src/user-api/credential.ts
 function userApiApplication(input) {
 	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
@@ -3230,6 +3283,39 @@ function createServerAuth(options) {
 		getReceivedInvitation(invitationId) {
 			return organizationRead(`received-invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeReceivedInvitation);
 		},
+		async startGoogleAccountRecovery(input) {
+			if (authorization) throw new AuthError("state_conflict", 409);
+			const body = googleRecoveryInput(input, false);
+			return normalizeGoogleRecovery(await requestJson(joinURL(authOrigin, "api/v1/auth/google-account-recovery/start"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "include",
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json; charset=utf-8"
+				},
+				body,
+				mapError: fromGoogleRecoveryError
+			}), now());
+		},
+		async completeGoogleAccountRecovery(input) {
+			if (authorization) throw new AuthError("state_conflict", 409);
+			if (!cookie) throw new AuthError("authentication_required", 401);
+			const body = googleRecoveryInput(input, true);
+			return normalizeGoogleRecoveryCompletion(await requestJson(joinURL(authOrigin, "api/v1/auth/google-account-recovery/complete"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "include",
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json; charset=utf-8"
+				},
+				body,
+				mapError: fromGoogleRecoveryError
+			}));
+		},
 		async signInWithSocialIdToken(input) {
 			if (authorization) throw new AuthError("state_conflict", 409);
 			const body = socialIdTokenRequest(normalizeSocialIdTokenInput(input));

package/dist/{types-BEgD_Js1.d.ts → types-Cv_qxcBP.d.ts}

@@ -10,8 +10,8 @@ interface UserApiCredential {
 }
 //#endregion
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required";
-type AuthErrorStatus = 400 | 401 | 403 | 404 | 405 | 409 | 413 | 415 | 422 | 429 | 503;
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "google_recovery_in_progress" | "google_recovery_not_required" | "google_recovery_invalid" | "google_recovery_expired" | "google_recovery_account_mismatch" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required";
+type AuthErrorStatus = 400 | 401 | 403 | 404 | 405 | 409 | 410 | 413 | 415 | 422 | 429 | 503;
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
   readonly status: AuthErrorStatus;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,