@finueva/auth 0.19.0 → 0.21.0

package/README.md

@@ -307,6 +307,18 @@ return new Response(null, { status: 303, headers });
 
 Call `applyCookies()` after server `signOut()`, `acceptInvitation()`, and `signInWithSocialIdToken()`.
 
+## Recover A Google Account Conflict
+
+Use the request-scoped server client. If Google sign-in reports an account conflict, call `startGoogleAccountRecovery({ idToken: { token, nonce } })`. Auth verifies the Google identity and confirms that an existing verified password account requires linking. A generic sign-in error alone does not authorize recovery.
+
+The result contains an opaque `recoveryToken` and an ISO `expiresAt`. Keep the result and Google ID token in short-lived encrypted server-managed state. Do not put them in URLs, logs, or browser storage.
+
+Ask the user to sign in to the existing account with its password. Complete the configured second factor. Then create a new request-scoped client with that session and call `completeGoogleAccountRecovery({ recoveryToken, idToken: { token, nonce } })`. Auth requires a fresh password authentication after the recovery request. An old session or a different account cannot complete recovery. The result is `{ linked: true }`; the current session remains in use.
+
+If completion returns `google_recovery_in_progress`, retain the current session and recovery state. A retry can confirm a committed link. Auth does not repeat an uncertain linking mutation. If the original attempt cannot finish, wait for its ten-minute expiry before restarting.
+
+Recovery is cookie-only and bound to the registered app origin. It does not enable implicit linking or link users by an email match alone. If recovery expires, restart Google sign-in. If email verification is required, complete the existing account's verification first.
+
 ## Resolve A Drive Recipient
 
 Use the separate server client. Before lookup, Drive must check the caller's current permission to manage the item's shares. Recipient resolution does not grant file access.

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { At as AuthError, B as OrganizationMember, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, Pt as UserApiCredentialInput, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, b as CreatedOrganization, c as AuthSessionInventory, i as AuthOrganization, jt as AuthErrorCode, m as CeremonyHandoffInput, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, vt as SocialIdTokenInput, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-BEgD_Js1.js";
+import { $ as PasskeyInventory, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Dt as TwoFactorStatus, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Mt as UpdateProfileInput, O as DriveCredential, Pt as AuthError, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, c as AuthSessionInventory, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, p as CeremonyHandoff, q as OrganizationPageInput, s as AuthSession, ut as ReceivedOrganizationInvitationPage, x as CreatedOrganization, xt as SocialIdTokenInput } from "./types-sJ_vACZ3.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/device.js

@@ -178,6 +178,12 @@ const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
@@ -193,6 +199,7 @@ const messages = {
 	organization_context_too_large: "The organization context is too large.",
 	credential_rate_limited: "Credential requests are temporarily limited.",
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	organization_slug_unavailable: "The organization address is unavailable.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
 	platform_target_unavailable: "The platform administration target is unavailable.",
@@ -648,7 +655,12 @@ function fromAccountAuthorityError(value, status, retryAfter) {
 function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
-	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	if (code === "OAUTH_LINK_ERROR") {
+		const message = isObject(value) && typeof value.message === "string" ? value.message : void 0;
+		if (message === "account not linked") return new AuthError("account_conflict", 409);
+		if (message === "signup disabled") return new AuthError("social_signup_required", 409);
+		return authorityUnavailable();
+	}
 	return fromAccountAuthorityError(value, status, retryAfter);
 }
 function authorityUnavailable() {
@@ -662,6 +674,7 @@ function fromOrganizationReadAuthorityError(value, status) {
 }
 function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409 && isObject(value) && value.code === "ORGANIZATION_SLUG_UNAVAILABLE") return new AuthError("organization_slug_unavailable", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { $ as PlatformBootstrapRoleChangeInput, A as FinuevaAuthClient, At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, Ct as TwoFactorEnrollment, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, E as DepartedOrganizationMemberPage, Et as UpdateOrganizationDisplayInput, F as OrganizationClosureStartInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, N as OrganizationClosure, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, P as OrganizationClosureCancelInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, St as SuspendedOrganizationMemberStatus, T as DepartedOrganizationMember, Tt as TwoFactorStepUpInput, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, Y as OrganizationWorkspaceSelection, Z as PasskeySummary, _ as ClosingOrganization, _t as SignInInput, a as AuthPersistence, at as PlatformStatus, b as CreatedOrganization, bt as SuspendedOrganizationMember, c as AuthSessionInventory, ct as RecentAuthenticationStatus, d as AuthUser, dt as ResentOrganizationInvitation, et as PlatformRole, f as CanceledOrganizationInvitation, ft as RestoredOrganizationMember, g as CeremonyReturnInput, gt as SendVerificationEmailInput, h as CeremonyRecentAuthenticationRequest, ht as ScimCredentialState, i as AuthOrganization, it as PlatformRoleFirstApproval, j as InvitationAcceptance, jt as AuthErrorCode, k as EnterpriseConnection, kt as WorkspaceSelection, l as AuthSessionSummary, lt as RemovedOrganizationMember, m as CeremonyHandoffInput, mt as ScimCredentialIssuance, n as AddedOrganizationTeamMember, nt as PlatformRoleApproval, o as AuthPersistenceDriver, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, pt as RotateScimCredentialInput, q as OrganizationTeamMemberPage, r as AuthClientOptions, rt as PlatformRoleChangeRecentAuthenticationInput, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, tt as PlatformRoleApplied, u as AuthState, ut as RemovedOrganizationTeamMember, v as ClosingOrganizationList, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, xt as SuspendedOrganizationMemberPage, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-BEgD_Js1.js";
+import { $ as PasskeyInventory, A as EnterpriseConnection, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Ct as SuspendedOrganizationMember, D as DepartedOrganizationMemberPage, Dt as TwoFactorStatus, E as DepartedOrganizationMember, Et as TwoFactorEnrollment, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, I as OrganizationClosure, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, L as OrganizationClosureCancelInput, Lt as UserApiCredential, M as EnterpriseConnectionSetup, Mt as UpdateProfileInput, N as FinuevaAuthClient, Nt as WorkspaceSelection, O as DriveCredential, Ot as TwoFactorStepUpInput, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, R as OrganizationClosureStartInput, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, Tt as SuspendedOrganizationMemberStatus, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, _ as ClosingOrganization, _t as ScimCredentialIssuance, a as AuthPersistence, at as PlatformRoleApproval, b as CreateOrganizationMemberInvitationInput, bt as SignInInput, c as AuthSessionInventory, ct as PlatformStatus, d as AuthUser, dt as RecentAuthenticationStatus, et as PasskeySummary, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, g as CeremonyReturnInput, gt as RotateScimCredentialInput, h as CeremonyRecentAuthenticationRequest, ht as RestoredOrganizationMember, i as AuthOrganization, it as PlatformRoleApplied, j as EnterpriseConnectionAction, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, kt as UpdateEnterpriseConnectionInput, l as AuthSessionSummary, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, nt as PlatformBootstrapRoleChangeInput, o as AuthPersistenceDriver, ot as PlatformRoleChangeRecentAuthenticationInput, p as CeremonyHandoff, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, r as AuthClientOptions, rt as PlatformRole, s as AuthSession, st as PlatformRoleFirstApproval, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, u as AuthState, ut as ReceivedOrganizationInvitationPage, v as ClosingOrganizationList, vt as ScimCredentialState, w as DeclineInvitationInput, wt as SuspendedOrganizationMemberPage, x as CreatedOrganization, xt as SocialIdTokenInput, y as CreateEnterpriseConnectionInput, yt as SendVerificationEmailInput, z as OrganizationDeparture } from "./types-sJ_vACZ3.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateEnterpriseConnectionInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type EnterpriseConnectionAction, type EnterpriseConnectionSetup, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateEnterpriseConnectionInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -2537,6 +2537,12 @@ const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
@@ -2552,6 +2558,7 @@ const messages = {
 	organization_context_too_large: "The organization context is too large.",
 	credential_rate_limited: "Credential requests are temporarily limited.",
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	organization_slug_unavailable: "The organization address is unavailable.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
 	platform_target_unavailable: "The platform administration target is unavailable.",
@@ -3429,7 +3436,12 @@ function fromAccountAuthorityError(value, status, retryAfter) {
 function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
-	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	if (code === "OAUTH_LINK_ERROR") {
+		const message = isObject(value) && typeof value.message === "string" ? value.message : void 0;
+		if (message === "account not linked") return new AuthError("account_conflict", 409);
+		if (message === "signup disabled") return new AuthError("social_signup_required", 409);
+		return authorityUnavailable();
+	}
 	return fromAccountAuthorityError(value, status, retryAfter);
 }
 function authorityUnavailable() {
@@ -3448,6 +3460,7 @@ function fromOrganizationReadAuthorityError(value, status) {
 }
 function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409 && isObject(value) && value.code === "ORGANIZATION_SLUG_UNAVAILABLE") return new AuthError("organization_slug_unavailable", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
@@ -5078,6 +5091,75 @@ function fromEnterpriseAdministrationError(value, status, retryAfter) {
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	return authorityUnavailable();
 }
+const setupKeys = [
+	"id",
+	"revision",
+	"issuer",
+	"clientId",
+	"enabled",
+	"memberJit",
+	"domain",
+	"domainVerified",
+	"validatedAt",
+	"testedAt",
+	"dnsRecordName",
+	"dnsRecordValue",
+	"challengeExpiresAt",
+	"redirectUri"
+];
+function normalizeEnterpriseConnectionSetup(value) {
+	if (!exact(value, setupKeys) || typeof value.id !== "string" || !idPattern.test(value.id) || typeof value.issuer !== "string" || value.issuer.length > 2048 || !value.issuer.startsWith("https://") || typeof value.clientId !== "string" || value.clientId.length < 1 || value.clientId.length > 256 || typeof value.domain !== "string" || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(value.domain) || value.domain.length > 253 || value.dnsRecordName !== `_finueva-sso.${value.domain}` || typeof value.dnsRecordValue !== "string" || !/^finueva-sso=[A-Za-z0-9_-]{43}$/.test(value.dnsRecordValue) || typeof value.redirectUri !== "string" || value.redirectUri.length > 2048 || !Number.isSafeInteger(value.revision) || value.revision < 0) throw authorityUnavailable();
+	let redirect;
+	try {
+		redirect = new URL(value.redirectUri);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (redirect.protocol !== "https:" || redirect.username || redirect.password || redirect.search || redirect.hash || !redirect.pathname.endsWith(`/enterprise/callback/${value.id}`)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		revision: value.revision,
+		issuer: value.issuer,
+		clientId: value.clientId,
+		enabled: bool(value.enabled),
+		memberJit: bool(value.memberJit),
+		domain: value.domain,
+		domainVerified: bool(value.domainVerified),
+		validatedAt: date(value.validatedAt, true),
+		testedAt: date(value.testedAt, true),
+		dnsRecordName: value.dnsRecordName,
+		dnsRecordValue: value.dnsRecordValue,
+		challengeExpiresAt: date(value.challengeExpiresAt, false),
+		redirectUri: value.redirectUri
+	};
+}
+function normalizeEnterpriseConnectionSetups(value) {
+	if (!exact(value, ["connections"]) || !Array.isArray(value.connections) || value.connections.length > 10) throw authorityUnavailable();
+	return value.connections.map(normalizeEnterpriseConnectionSetup);
+}
+function normalizeEnterpriseConnectionAction(value) {
+	if (exact(value, ["removed"]) && value.removed === true) return { removed: true };
+	return normalizeEnterpriseConnectionSetup(value);
+}
+function enterpriseInputString(value, max) {
+	if (typeof value !== "string" || value.length < 1 || value.length > max) throw new TypeError("Enterprise configuration is invalid");
+	return value;
+}
+function enterpriseInputBoolean(value) {
+	if (typeof value !== "boolean") throw new TypeError("Enterprise configuration is invalid");
+	return value;
+}
+function normalizeEnterpriseTestAuthorization(value) {
+	if (!exact(value, ["url"]) || typeof value.url !== "string" || value.url.length > 16384) throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value.url);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.hash || !url.searchParams.get("state") || url.searchParams.get("response_type") !== "code") throw authorityUnavailable();
+	return { url: value.url };
+}
 //#endregion
 //#region src/user-api/credential.ts
 function userApiApplication(input) {
@@ -6079,6 +6161,65 @@ function createAuthClient(options) {
 		async listEnterpriseConnections(organizationId) {
 			return enterpriseRequest("GET", `${normalizeIdInput(organizationId)}/connections`, void 0, normalizeEnterpriseConnections);
 		},
+		async startEnterpriseConnectionTest(organizationId, connectionId, input) {
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/enterprise/test-sign-in"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: {
+					organizationId: normalizeIdInput(organizationId),
+					connectionId: normalizeIdInput(connectionId),
+					expectedRevision: normalizeRevision(input?.expectedRevision),
+					applicationId: normalizeIdInput(input?.applicationId),
+					returnTo: enterpriseInputString(input?.returnTo, 2048)
+				},
+				mapError: fromEnterpriseAdministrationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeEnterpriseTestAuthorization(value);
+		},
+		async listEnterpriseConnectionSetups(organizationId) {
+			return enterpriseRequest("GET", `${normalizeIdInput(organizationId)}/connection-setup`, void 0, normalizeEnterpriseConnectionSetups);
+		},
+		async createEnterpriseConnection(organizationId, input) {
+			const body = {
+				requestId: enterpriseInputString(input?.requestId, 36),
+				issuer: enterpriseInputString(input?.issuer, 2048),
+				clientId: enterpriseInputString(input?.clientId, 256),
+				clientSecret: enterpriseInputString(input?.clientSecret, 512),
+				domain: enterpriseInputString(input?.domain, 253),
+				memberJit: enterpriseInputBoolean(input?.memberJit)
+			};
+			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup`, body, normalizeEnterpriseConnectionSetup);
+		},
+		async updateEnterpriseConnection(organizationId, connectionId, input) {
+			const body = {
+				expectedRevision: normalizeRevision(input?.expectedRevision),
+				issuer: enterpriseInputString(input?.issuer, 2048),
+				clientId: enterpriseInputString(input?.clientId, 256),
+				memberJit: enterpriseInputBoolean(input?.memberJit),
+				...input?.clientSecret === void 0 ? {} : { clientSecret: enterpriseInputString(input.clientSecret, 512) }
+			};
+			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup/${normalizeIdInput(connectionId)}`, body, normalizeEnterpriseConnectionSetup);
+		},
+		async actOnEnterpriseConnection(organizationId, connectionId, input) {
+			if (![
+				"challenge",
+				"verify",
+				"validate",
+				"enable",
+				"disable",
+				"archive"
+			].includes(input?.action)) throw new TypeError("Enterprise action is invalid");
+			const body = {
+				expectedRevision: normalizeRevision(input?.expectedRevision),
+				action: input.action
+			};
+			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup/${normalizeIdInput(connectionId)}/actions`, body, normalizeEnterpriseConnectionAction);
+		},
 		async getScimCredential(organizationId, connectionId) {
 			return enterpriseRequest("GET", scimCredentialPath(organizationId, connectionId), void 0, (value) => normalizeScimCredentialState(value));
 		},

package/dist/server.d.ts

@@ -1,4 +1,19 @@
-import { At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, Y as OrganizationWorkspaceSelection, b as CreatedOrganization, d as AuthUser, dt as ResentOrganizationInvitation, f as CanceledOrganizationInvitation, i as AuthOrganization, j as InvitationAcceptance, jt as AuthErrorCode, kt as WorkspaceSelection, lt as RemovedOrganizationMember, n as AddedOrganizationTeamMember, ot as ReceivedOrganizationInvitation, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, ut as RemovedOrganizationTeamMember, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-BEgD_Js1.js";
+import { At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Nt as WorkspaceSelection, O as DriveCredential, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, d as AuthUser, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, s as AuthSession, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, ut as ReceivedOrganizationInvitationPage, w as DeclineInvitationInput, x as CreatedOrganization, xt as SocialIdTokenInput, z as OrganizationDeparture } from "./types-sJ_vACZ3.js";
+//#region src/google-recovery.d.ts
+interface GoogleAccountRecoveryInput {
+  idToken: {
+    token: string;
+    nonce?: string;
+  };
+}
+interface CompleteGoogleAccountRecoveryInput extends GoogleAccountRecoveryInput {
+  recoveryToken: string;
+}
+interface GoogleAccountRecovery {
+  recoveryToken: string;
+  expiresAt: string;
+}
+//#endregion
 //#region src/user-api/verifier.d.ts
 interface UserApiIdentity {
   userId: string;
@@ -150,10 +165,14 @@ interface FinuevaServerAuth {
   listReceivedInvitations(input?: OrganizationPageInput): Promise<ReceivedOrganizationInvitationPage>;
   getReceivedInvitation(invitationId: string): Promise<ReceivedOrganizationInvitation>;
   signInWithSocialIdToken(input: SocialIdTokenInput): Promise<ServerSocialIdTokenSession>;
+  startGoogleAccountRecovery(input: GoogleAccountRecoveryInput): Promise<GoogleAccountRecovery>;
+  completeGoogleAccountRecovery(input: CompleteGoogleAccountRecoveryInput): Promise<{
+    linked: true;
+  }>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
   getUserApiCredential(input: UserApiCredentialInput): Promise<UserApiCredential>;
   signOut(): Promise<ServerSignOutResult>;
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };
+export { type AcceptInvitationInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };

package/dist/server.js

@@ -1,183 +1,14 @@
-String.fromCharCode;
-const HASH_RE = /#/g;
-const AMPERSAND_RE = /&/g;
-const SLASH_RE = /\//g;
-const EQUAL_RE = /=/g;
-const PLUS_RE = /\+/g;
-const ENC_CARET_RE = /%5e/gi;
-const ENC_BACKTICK_RE = /%60/gi;
-const ENC_PIPE_RE = /%7c/gi;
-const ENC_SPACE_RE = /%20/gi;
-function encode$2(text) {
-	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
-}
-function encodeQueryValue(input) {
-	return encode$2(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
-}
-function encodeQueryKey(text) {
-	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
-}
-function decode$1(text = "") {
-	try {
-		return decodeURIComponent("" + text);
-	} catch {
-		return "" + text;
-	}
-}
-function decodeQueryKey(text) {
-	return decode$1(text.replace(PLUS_RE, " "));
-}
-function decodeQueryValue(text) {
-	return decode$1(text.replace(PLUS_RE, " "));
-}
-function parseQuery(parametersString = "") {
-	const object = Object.create(null);
-	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
-	for (const parameter of parametersString.split("&")) {
-		const s = parameter.match(/([^=]+)=?(.*)/) || [];
-		if (s.length < 2) continue;
-		const key = decodeQueryKey(s[1]);
-		if (key === "__proto__" || key === "constructor") continue;
-		const value = decodeQueryValue(s[2] || "");
-		if (object[key] === void 0) object[key] = value;
-		else if (Array.isArray(object[key])) object[key].push(value);
-		else object[key] = [object[key], value];
-	}
-	return object;
-}
-function encodeQueryItem(key, value) {
-	if (typeof value === "number" || typeof value === "boolean") value = String(value);
-	if (!value) return encodeQueryKey(key);
-	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
-	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
-}
-function stringifyQuery(query) {
-	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
-}
-const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
-const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
-const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
-const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
-const JOIN_LEADING_SLASH_RE = /^\.?\//;
-function hasProtocol(inputString, opts = {}) {
-	if (typeof opts === "boolean") opts = { acceptRelative: opts };
-	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
-	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
-}
-function hasTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return input.endsWith("/");
-	return TRAILING_SLASH_RE.test(input);
-}
-function withoutTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
-	if (!hasTrailingSlash(input, true)) return input || "/";
-	let path = input;
-	let fragment = "";
-	const fragmentIndex = input.indexOf("#");
-	if (fragmentIndex !== -1) {
-		path = input.slice(0, fragmentIndex);
-		fragment = input.slice(fragmentIndex);
-	}
-	const [s0, ...s] = path.split("?");
-	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
-}
-function withTrailingSlash(input = "", respectQueryAndFragment) {
-	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
-	if (hasTrailingSlash(input, true)) return input || "/";
-	let path = input;
-	let fragment = "";
-	const fragmentIndex = input.indexOf("#");
-	if (fragmentIndex !== -1) {
-		path = input.slice(0, fragmentIndex);
-		fragment = input.slice(fragmentIndex);
-		if (!path) return fragment;
-	}
-	const [s0, ...s] = path.split("?");
-	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
-}
-function withBase(input, base) {
-	if (isEmptyURL(base) || hasProtocol(input)) return input;
-	const _base = withoutTrailingSlash(base);
-	if (input.startsWith(_base)) {
-		const nextChar = input[_base.length];
-		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
-	}
-	return joinURL(_base, input);
-}
-function withQuery(input, query) {
-	const parsed = parseURL(input);
-	parsed.search = stringifyQuery({
-		...parseQuery(parsed.search),
-		...query
-	});
-	return stringifyParsedURL(parsed);
-}
-function isEmptyURL(url) {
-	return !url || url === "/";
-}
-function isNonEmptyURL(url) {
-	return url && url !== "/";
-}
-function joinURL(base, ...input) {
-	let url = base || "";
-	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
-		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
-		url = withTrailingSlash(url) + _segment;
-	} else url = segment;
-	return url;
-}
-const protocolRelative = Symbol.for("ufo:protocolRelative");
-function parseURL(input = "", defaultProto) {
-	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
-	if (_specialProtoMatch) {
-		const [, _proto, _pathname = ""] = _specialProtoMatch;
-		return {
-			protocol: _proto.toLowerCase(),
-			pathname: _pathname,
-			href: _proto + _pathname,
-			auth: "",
-			host: "",
-			search: "",
-			hash: ""
-		};
-	}
-	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
-	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
-	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
-	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
-	const { pathname, search, hash } = parsePath(path);
-	return {
-		protocol: protocol.toLowerCase(),
-		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
-		host,
-		pathname,
-		search,
-		hash,
-		[protocolRelative]: !protocol
-	};
-}
-function parsePath(input = "") {
-	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
-	return {
-		pathname,
-		search,
-		hash
-	};
-}
-function stringifyParsedURL(parsed) {
-	const pathname = parsed.pathname || "";
-	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
-	const hash = parsed.hash || "";
-	const auth = parsed.auth ? parsed.auth + "@" : "";
-	const host = parsed.host || "";
-	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
-}
-//#endregion
 //#region src/errors.ts
 const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
+	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
+	google_recovery_not_required: "Google account recovery is not required.",
+	google_recovery_invalid: "The Google account recovery request is invalid.",
+	google_recovery_expired: "Google account recovery has expired. Start Google sign-in again.",
+	google_recovery_account_mismatch: "Sign in to the existing account associated with this Google identity.",
 	password_reset_invalid: "The password reset request is invalid.",
 	authentication_required: "Authentication is required.",
 	request_origin_denied: "The request origin is not allowed.",
@@ -193,6 +24,7 @@ const messages = {
 	organization_context_too_large: "The organization context is too large.",
 	credential_rate_limited: "Credential requests are temporarily limited.",
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	organization_slug_unavailable: "The organization address is unavailable.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
 	platform_target_unavailable: "The platform administration target is unavailable.",
@@ -688,7 +520,12 @@ function fromAccountAuthorityError(value, status, retryAfter) {
 function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
 	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
 	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
-	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	if (code === "OAUTH_LINK_ERROR") {
+		const message = isObject$1(value) && typeof value.message === "string" ? value.message : void 0;
+		if (message === "account not linked") return new AuthError("account_conflict", 409);
+		if (message === "signup disabled") return new AuthError("social_signup_required", 409);
+		return authorityUnavailable();
+	}
 	return fromAccountAuthorityError(value, status, retryAfter);
 }
 function authorityUnavailable() {
@@ -707,6 +544,7 @@ function fromOrganizationReadAuthorityError(value, status) {
 }
 function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409 && isObject$1(value) && value.code === "ORGANIZATION_SLUG_UNAVAILABLE") return new AuthError("organization_slug_unavailable", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
@@ -877,6 +715,229 @@ function isObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
+//#region src/google-recovery.ts
+function object(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validTicket(value) {
+	return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+function googleRecoveryInput(value, complete) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== (complete ? "idToken,recoveryToken" : "idToken") || !object(value.idToken) || Object.keys(value.idToken).some((key) => key !== "token" && key !== "nonce") || complete && !validTicket(value.recoveryToken)) throw new AuthError("invalid_request", 400);
+	const social = normalizeSocialIdTokenInput({
+		provider: "google",
+		idToken: value.idToken.token,
+		signUp: false,
+		...value.idToken.nonce === void 0 ? {} : { nonce: value.idToken.nonce }
+	});
+	return {
+		idToken: {
+			token: social.idToken,
+			...social.nonce === void 0 ? {} : { nonce: social.nonce }
+		},
+		...complete ? { recoveryToken: value.recoveryToken } : {}
+	};
+}
+function normalizeGoogleRecovery(value, now) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== "expiresAt,recoveryToken" || !validTicket(value.recoveryToken) || typeof value.expiresAt !== "string") throw authorityUnavailable();
+	const expiresAt = Date.parse(value.expiresAt);
+	if (!Number.isFinite(expiresAt) || expiresAt <= now || expiresAt > now + 10 * 6e4) throw authorityUnavailable();
+	return {
+		recoveryToken: value.recoveryToken,
+		expiresAt: value.expiresAt
+	};
+}
+function normalizeGoogleRecoveryCompletion(value) {
+	if (!object(value) || Object.keys(value).join(",") !== "linked" || value.linked !== true) throw authorityUnavailable();
+	return { linked: true };
+}
+function fromGoogleRecoveryError(value, status, retryAfter) {
+	const code = object(value) ? value.code : void 0;
+	if (status === 409 && code === "GOOGLE_RECOVERY_IN_PROGRESS") return new AuthError("google_recovery_in_progress", 409);
+	if (status === 409 && code === "GOOGLE_RECOVERY_NOT_REQUIRED") return new AuthError("google_recovery_not_required", 409);
+	if (status === 403 && code === "GOOGLE_RECOVERY_EMAIL_VERIFICATION_REQUIRED") return new AuthError("email_verification_required", 403);
+	if (status === 400 && code === "GOOGLE_RECOVERY_INVALID") return new AuthError("google_recovery_invalid", 400);
+	if (status === 410 && code === "GOOGLE_RECOVERY_EXPIRED") return new AuthError("google_recovery_expired", 410);
+	if (status === 403 && code === "GOOGLE_RECOVERY_ACCOUNT_MISMATCH") return new AuthError("google_recovery_account_mismatch", 403);
+	if (status === 401 && code === "GOOGLE_RECOVERY_FRESH_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 401);
+	if (code === "GOOGLE_RECOVERY_UNAVAILABLE") return authorityUnavailable();
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
+String.fromCharCode;
+const HASH_RE = /#/g;
+const AMPERSAND_RE = /&/g;
+const SLASH_RE = /\//g;
+const EQUAL_RE = /=/g;
+const PLUS_RE = /\+/g;
+const ENC_CARET_RE = /%5e/gi;
+const ENC_BACKTICK_RE = /%60/gi;
+const ENC_PIPE_RE = /%7c/gi;
+const ENC_SPACE_RE = /%20/gi;
+function encode$2(text) {
+	return encodeURI("" + text).replace(ENC_PIPE_RE, "|");
+}
+function encodeQueryValue(input) {
+	return encode$2(typeof input === "string" ? input : JSON.stringify(input)).replace(PLUS_RE, "%2B").replace(ENC_SPACE_RE, "+").replace(HASH_RE, "%23").replace(AMPERSAND_RE, "%26").replace(ENC_BACKTICK_RE, "`").replace(ENC_CARET_RE, "^").replace(SLASH_RE, "%2F");
+}
+function encodeQueryKey(text) {
+	return encodeQueryValue(text).replace(EQUAL_RE, "%3D");
+}
+function decode$1(text = "") {
+	try {
+		return decodeURIComponent("" + text);
+	} catch {
+		return "" + text;
+	}
+}
+function decodeQueryKey(text) {
+	return decode$1(text.replace(PLUS_RE, " "));
+}
+function decodeQueryValue(text) {
+	return decode$1(text.replace(PLUS_RE, " "));
+}
+function parseQuery(parametersString = "") {
+	const object = Object.create(null);
+	if (parametersString[0] === "?") parametersString = parametersString.slice(1);
+	for (const parameter of parametersString.split("&")) {
+		const s = parameter.match(/([^=]+)=?(.*)/) || [];
+		if (s.length < 2) continue;
+		const key = decodeQueryKey(s[1]);
+		if (key === "__proto__" || key === "constructor") continue;
+		const value = decodeQueryValue(s[2] || "");
+		if (object[key] === void 0) object[key] = value;
+		else if (Array.isArray(object[key])) object[key].push(value);
+		else object[key] = [object[key], value];
+	}
+	return object;
+}
+function encodeQueryItem(key, value) {
+	if (typeof value === "number" || typeof value === "boolean") value = String(value);
+	if (!value) return encodeQueryKey(key);
+	if (Array.isArray(value)) return value.map((_value) => `${encodeQueryKey(key)}=${encodeQueryValue(_value)}`).join("&");
+	return `${encodeQueryKey(key)}=${encodeQueryValue(value)}`;
+}
+function stringifyQuery(query) {
+	return Object.keys(query).filter((k) => query[k] !== void 0).map((k) => encodeQueryItem(k, query[k])).filter(Boolean).join("&");
+}
+const PROTOCOL_STRICT_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{1,2})/;
+const PROTOCOL_REGEX = /^[\s\w\0+.-]{2,}:([/\\]{2})?/;
+const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
+const TRAILING_SLASH_RE = /\/$|\/\?|\/#/;
+const JOIN_LEADING_SLASH_RE = /^\.?\//;
+function hasProtocol(inputString, opts = {}) {
+	if (typeof opts === "boolean") opts = { acceptRelative: opts };
+	if (opts.strict) return PROTOCOL_STRICT_REGEX.test(inputString);
+	return PROTOCOL_REGEX.test(inputString) || (opts.acceptRelative ? PROTOCOL_RELATIVE_REGEX.test(inputString) : false);
+}
+function hasTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/");
+	return TRAILING_SLASH_RE.test(input);
+}
+function withoutTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
+	if (!hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+	}
+	const [s0, ...s] = path.split("?");
+	return ((s0.endsWith("/") ? s0.slice(0, -1) : s0) || "/") + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withTrailingSlash(input = "", respectQueryAndFragment) {
+	if (!respectQueryAndFragment) return input.endsWith("/") ? input : input + "/";
+	if (hasTrailingSlash(input, true)) return input || "/";
+	let path = input;
+	let fragment = "";
+	const fragmentIndex = input.indexOf("#");
+	if (fragmentIndex !== -1) {
+		path = input.slice(0, fragmentIndex);
+		fragment = input.slice(fragmentIndex);
+		if (!path) return fragment;
+	}
+	const [s0, ...s] = path.split("?");
+	return s0 + "/" + (s.length > 0 ? `?${s.join("?")}` : "") + fragment;
+}
+function withBase(input, base) {
+	if (isEmptyURL(base) || hasProtocol(input)) return input;
+	const _base = withoutTrailingSlash(base);
+	if (input.startsWith(_base)) {
+		const nextChar = input[_base.length];
+		if (!nextChar || nextChar === "/" || nextChar === "?") return input;
+	}
+	return joinURL(_base, input);
+}
+function withQuery(input, query) {
+	const parsed = parseURL(input);
+	parsed.search = stringifyQuery({
+		...parseQuery(parsed.search),
+		...query
+	});
+	return stringifyParsedURL(parsed);
+}
+function isEmptyURL(url) {
+	return !url || url === "/";
+}
+function isNonEmptyURL(url) {
+	return url && url !== "/";
+}
+function joinURL(base, ...input) {
+	let url = base || "";
+	for (const segment of input.filter((url2) => isNonEmptyURL(url2))) if (url) {
+		const _segment = segment.replace(JOIN_LEADING_SLASH_RE, "");
+		url = withTrailingSlash(url) + _segment;
+	} else url = segment;
+	return url;
+}
+const protocolRelative = Symbol.for("ufo:protocolRelative");
+function parseURL(input = "", defaultProto) {
+	const _specialProtoMatch = input.match(/^[\s\0]*(blob:|data:|javascript:|vbscript:)(.*)/i);
+	if (_specialProtoMatch) {
+		const [, _proto, _pathname = ""] = _specialProtoMatch;
+		return {
+			protocol: _proto.toLowerCase(),
+			pathname: _pathname,
+			href: _proto + _pathname,
+			auth: "",
+			host: "",
+			search: "",
+			hash: ""
+		};
+	}
+	if (!hasProtocol(input, { acceptRelative: true })) return defaultProto ? parseURL(defaultProto + input) : parsePath(input);
+	const [, protocol = "", auth, hostAndPath = ""] = input.replace(/\\/g, "/").match(/^[\s\0]*([\w+.-]{2,}:)?\/\/([^/@]+@)?(.*)/) || [];
+	let [, host = "", path = ""] = hostAndPath.match(/([^#/?]*)(.*)?/) || [];
+	if (protocol === "file:") path = path.replace(/\/(?=[A-Za-z]:)/, "");
+	const { pathname, search, hash } = parsePath(path);
+	return {
+		protocol: protocol.toLowerCase(),
+		auth: auth ? auth.slice(0, Math.max(0, auth.length - 1)) : "",
+		host,
+		pathname,
+		search,
+		hash,
+		[protocolRelative]: !protocol
+	};
+}
+function parsePath(input = "") {
+	const [pathname = "", search = "", hash = ""] = (input.match(/([^#?]*)(\?[^#]*)?(#.*)?/) || []).splice(1);
+	return {
+		pathname,
+		search,
+		hash
+	};
+}
+function stringifyParsedURL(parsed) {
+	const pathname = parsed.pathname || "";
+	const search = parsed.search ? (parsed.search.startsWith("?") ? "" : "?") + parsed.search : "";
+	const hash = parsed.hash || "";
+	const auth = parsed.auth ? parsed.auth + "@" : "";
+	const host = parsed.host || "";
+	return (parsed.protocol || parsed[protocolRelative] ? (parsed.protocol || "") + "//" : "") + auth + host + pathname + search + hash;
+}
+//#endregion
 //#region src/user-api/credential.ts
 function userApiApplication(input) {
 	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
@@ -3230,6 +3291,39 @@ function createServerAuth(options) {
 		getReceivedInvitation(invitationId) {
 			return organizationRead(`received-invitations/${normalizeIdInput(invitationId)}`, void 0, normalizeReceivedInvitation);
 		},
+		async startGoogleAccountRecovery(input) {
+			if (authorization) throw new AuthError("state_conflict", 409);
+			const body = googleRecoveryInput(input, false);
+			return normalizeGoogleRecovery(await requestJson(joinURL(authOrigin, "api/v1/auth/google-account-recovery/start"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "include",
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json; charset=utf-8"
+				},
+				body,
+				mapError: fromGoogleRecoveryError
+			}), now());
+		},
+		async completeGoogleAccountRecovery(input) {
+			if (authorization) throw new AuthError("state_conflict", 409);
+			if (!cookie) throw new AuthError("authentication_required", 401);
+			const body = googleRecoveryInput(input, true);
+			return normalizeGoogleRecoveryCompletion(await requestJson(joinURL(authOrigin, "api/v1/auth/google-account-recovery/complete"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "include",
+				headers: {
+					...authHeaders(),
+					"content-type": "application/json; charset=utf-8"
+				},
+				body,
+				mapError: fromGoogleRecoveryError
+			}));
+		},
 		async signInWithSocialIdToken(input) {
 			if (authorization) throw new AuthError("state_conflict", 409);
 			const body = socialIdTokenRequest(normalizeSocialIdTokenInput(input));

package/dist/{types-BEgD_Js1.d.ts → types-sJ_vACZ3.d.ts}

@@ -10,8 +10,8 @@ interface UserApiCredential {
 }
 //#endregion
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required";
-type AuthErrorStatus = 400 | 401 | 403 | 404 | 405 | 409 | 413 | 415 | 422 | 429 | 503;
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "social_signup_required" | "google_recovery_in_progress" | "google_recovery_not_required" | "google_recovery_invalid" | "google_recovery_expired" | "google_recovery_account_mismatch" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "organization_slug_unavailable" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required";
+type AuthErrorStatus = 400 | 401 | 403 | 404 | 405 | 409 | 410 | 413 | 415 | 422 | 429 | 503;
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
   readonly status: AuthErrorStatus;
@@ -346,6 +346,41 @@ interface EnterpriseConnection {
   roleMappingConfigured: boolean;
   updatedAt: Date;
 }
+/** OIDC self-service configuration. Client secrets are write-only. */
+interface EnterpriseConnectionSetup {
+  id: string;
+  revision: number;
+  issuer: string;
+  clientId: string;
+  enabled: boolean;
+  memberJit: boolean;
+  domain: string;
+  domainVerified: boolean;
+  validatedAt: Date | null;
+  testedAt: Date | null;
+  dnsRecordName: string;
+  dnsRecordValue: string;
+  challengeExpiresAt: Date;
+  redirectUri: string;
+}
+interface CreateEnterpriseConnectionInput {
+  /** Keep this UUID unchanged when retrying the same creation attempt. */
+  requestId: string;
+  issuer: string;
+  clientId: string;
+  clientSecret: string;
+  domain: string;
+  memberJit: boolean;
+}
+interface UpdateEnterpriseConnectionInput {
+  expectedRevision: number;
+  issuer: string;
+  clientId: string;
+  /** Omit to keep the current secret. It cannot be read back. */
+  clientSecret?: string;
+  memberJit: boolean;
+}
+type EnterpriseConnectionAction = "challenge" | "verify" | "validate" | "enable" | "disable" | "archive";
 interface ScimCredentialState {
   status: "active" | "revoked" | "unissued";
   revision: number | null;
@@ -545,6 +580,23 @@ interface FinuevaAuthClient {
   signIn(input: SignInInput): Promise<AuthSession>;
   /** Cookie-only. A manual owner or admin reads the organization's enterprise connection status. */
   listEnterpriseConnections(organizationId: string): Promise<EnterpriseConnection[]>;
+  listEnterpriseConnectionSetups(organizationId: string): Promise<EnterpriseConnectionSetup[]>;
+  /** Test OIDC without changing the admin's session or creating membership. Navigate to the returned HTTPS URL. */
+  startEnterpriseConnectionTest(organizationId: string, connectionId: string, input: {
+    expectedRevision: number;
+    applicationId: string;
+    returnTo: string;
+  }): Promise<{
+    url: string;
+  }>;
+  createEnterpriseConnection(organizationId: string, input: CreateEnterpriseConnectionInput): Promise<EnterpriseConnectionSetup>;
+  updateEnterpriseConnection(organizationId: string, connectionId: string, input: UpdateEnterpriseConnectionInput): Promise<EnterpriseConnectionSetup>;
+  actOnEnterpriseConnection(organizationId: string, connectionId: string, input: {
+    expectedRevision: number;
+    action: EnterpriseConnectionAction;
+  }): Promise<EnterpriseConnectionSetup | {
+    removed: true;
+  }>;
   /** Cookie-only. Reads SCIM credential state for an eligible managed-lifecycle connection. */
   getScimCredential(organizationId: string, connectionId: string): Promise<ScimCredentialState>;
   issueScimCredential(organizationId: string, connectionId: string): Promise<ScimCredentialIssuance>;
@@ -588,4 +640,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { PlatformBootstrapRoleChangeInput as $, FinuevaAuthClient as A, AuthError as At, OrganizationMember as B, DeclineInvitationInput as C, TwoFactorEnrollment as Ct, DriveCredential as D, UpdateOrganizationTeamDisplayInput as Dt, DepartedOrganizationMemberPage as E, UpdateOrganizationDisplayInput as Et, OrganizationClosureStartInput as F, OrganizationTeam as G, OrganizationMemberPage as H, OrganizationDeparture as I, OrganizationTeamPage as J, OrganizationTeamDisplay as K, OrganizationDisplay as L, InvitationDecline as M, AuthErrorStatus as Mt, OrganizationClosure as N, UserApiCredential as Nt, DriveCredentialInput as O, UpdateProfileInput as Ot, OrganizationClosureCancelInput as P, UserApiCredentialInput as Pt, PersonalWorkspaceSelection as Q, OrganizationInvitation as R, CreatedOrganizationTeam as S, SuspendedOrganizationMemberStatus as St, DepartedOrganizationMember as T, TwoFactorStepUpInput as Tt, OrganizationPage as U, OrganizationMemberAuthority as V, OrganizationPageInput as W, PasskeyInventory as X, OrganizationWorkspaceSelection as Y, PasskeySummary as Z, ClosingOrganization as _, SignInInput as _t, AuthPersistence as a, PlatformStatus as at, CreatedOrganization as b, SuspendedOrganizationMember as bt, AuthSessionInventory as c, RecentAuthenticationStatus as ct, AuthUser as d, ResentOrganizationInvitation as dt, PlatformRole as et, CanceledOrganizationInvitation as f, RestoredOrganizationMember as ft, CeremonyReturnInput as g, SendVerificationEmailInput as gt, CeremonyRecentAuthenticationRequest as h, ScimCredentialState as ht, AuthOrganization as i, PlatformRoleFirstApproval as it, InvitationAcceptance as j, AuthErrorCode as jt, EnterpriseConnection as k, WorkspaceSelection as kt, AuthSessionSummary as l, RemovedOrganizationMember as lt, CeremonyHandoffInput as m, ScimCredentialIssuance as mt, AddedOrganizationTeamMember as n, PlatformRoleApproval as nt, AuthPersistenceDriver as o, ReceivedOrganizationInvitation as ot, CeremonyHandoff as p, RotateScimCredentialInput as pt, OrganizationTeamMemberPage as q, AuthClientOptions as r, PlatformRoleChangeRecentAuthenticationInput as rt, AuthSession as s, ReceivedOrganizationInvitationPage as st, AcceptInvitationInput as t, PlatformRoleApplied as tt, AuthState as u, RemovedOrganizationTeamMember as ut, ClosingOrganizationList as v, SocialIdTokenInput as vt, DeletedOrganizationTeam as w, TwoFactorStatus as wt, CreatedOrganizationMemberInvitation as x, SuspendedOrganizationMemberPage as xt, CreateOrganizationMemberInvitationInput as y, SocialIdTokenProvider as yt, OrganizationInvitationPage as z };
+export { PasskeyInventory as $, EnterpriseConnection as A, UpdateOrganizationDisplayInput as At, OrganizationDisplay as B, CreatedOrganizationTeam as C, SuspendedOrganizationMember as Ct, DepartedOrganizationMemberPage as D, TwoFactorStatus as Dt, DepartedOrganizationMember as E, TwoFactorEnrollment as Et, InvitationDecline as F, AuthErrorCode as Ft, OrganizationMemberPage as G, OrganizationInvitationPage as H, OrganizationClosure as I, AuthErrorStatus as It, OrganizationTeam as J, OrganizationPage as K, OrganizationClosureCancelInput as L, UserApiCredential as Lt, EnterpriseConnectionSetup as M, UpdateProfileInput as Mt, FinuevaAuthClient as N, WorkspaceSelection as Nt, DriveCredential as O, TwoFactorStepUpInput as Ot, InvitationAcceptance as P, AuthError as Pt, OrganizationWorkspaceSelection as Q, OrganizationClosureStartInput as R, UserApiCredentialInput as Rt, CreatedOrganizationMemberInvitation as S, SocialIdTokenProvider as St, DeletedOrganizationTeam as T, SuspendedOrganizationMemberStatus as Tt, OrganizationMember as U, OrganizationInvitation as V, OrganizationMemberAuthority as W, OrganizationTeamMemberPage as X, OrganizationTeamDisplay as Y, OrganizationTeamPage as Z, ClosingOrganization as _, ScimCredentialIssuance as _t, AuthPersistence as a, PlatformRoleApproval as at, CreateOrganizationMemberInvitationInput as b, SignInInput as bt, AuthSessionInventory as c, PlatformStatus as ct, AuthUser as d, RecentAuthenticationStatus as dt, PasskeySummary as et, CanceledOrganizationInvitation as f, RemovedOrganizationMember as ft, CeremonyReturnInput as g, RotateScimCredentialInput as gt, CeremonyRecentAuthenticationRequest as h, RestoredOrganizationMember as ht, AuthOrganization as i, PlatformRoleApplied as it, EnterpriseConnectionAction as j, UpdateOrganizationTeamDisplayInput as jt, DriveCredentialInput as k, UpdateEnterpriseConnectionInput as kt, AuthSessionSummary as l, ReceivedOrganizationInvitation as lt, CeremonyHandoffInput as m, ResentOrganizationInvitation as mt, AddedOrganizationTeamMember as n, PlatformBootstrapRoleChangeInput as nt, AuthPersistenceDriver as o, PlatformRoleChangeRecentAuthenticationInput as ot, CeremonyHandoff as p, RemovedOrganizationTeamMember as pt, OrganizationPageInput as q, AuthClientOptions as r, PlatformRole as rt, AuthSession as s, PlatformRoleFirstApproval as st, AcceptInvitationInput as t, PersonalWorkspaceSelection as tt, AuthState as u, ReceivedOrganizationInvitationPage as ut, ClosingOrganizationList as v, ScimCredentialState as vt, DeclineInvitationInput as w, SuspendedOrganizationMemberPage as wt, CreatedOrganization as x, SocialIdTokenInput as xt, CreateEnterpriseConnectionInput as y, SendVerificationEmailInput as yt, OrganizationDeparture as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,