@finueva/auth 0.20.0 → 0.21.0

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { At as AuthError, B as OrganizationMember, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, Pt as UserApiCredentialInput, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, b as CreatedOrganization, c as AuthSessionInventory, i as AuthOrganization, jt as AuthErrorCode, m as CeremonyHandoffInput, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, vt as SocialIdTokenInput, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-Cv_qxcBP.js";
+import { $ as PasskeyInventory, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Dt as TwoFactorStatus, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Mt as UpdateProfileInput, O as DriveCredential, Pt as AuthError, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, c as AuthSessionInventory, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, p as CeremonyHandoff, q as OrganizationPageInput, s as AuthSession, ut as ReceivedOrganizationInvitationPage, x as CreatedOrganization, xt as SocialIdTokenInput } from "./types-sJ_vACZ3.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/device.js

@@ -178,6 +178,7 @@ const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
 	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
 	google_recovery_not_required: "Google account recovery is not required.",
 	google_recovery_invalid: "The Google account recovery request is invalid.",
@@ -198,6 +199,7 @@ const messages = {
 	organization_context_too_large: "The organization context is too large.",
 	credential_rate_limited: "Credential requests are temporarily limited.",
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	organization_slug_unavailable: "The organization address is unavailable.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
 	platform_target_unavailable: "The platform administration target is unavailable.",
@@ -653,7 +655,12 @@ function fromAccountAuthorityError(value, status, retryAfter) {
 function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
-	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	if (code === "OAUTH_LINK_ERROR") {
+		const message = isObject(value) && typeof value.message === "string" ? value.message : void 0;
+		if (message === "account not linked") return new AuthError("account_conflict", 409);
+		if (message === "signup disabled") return new AuthError("social_signup_required", 409);
+		return authorityUnavailable();
+	}
 	return fromAccountAuthorityError(value, status, retryAfter);
 }
 function authorityUnavailable() {
@@ -667,6 +674,7 @@ function fromOrganizationReadAuthorityError(value, status) {
 }
 function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409 && isObject(value) && value.code === "ORGANIZATION_SLUG_UNAVAILABLE") return new AuthError("organization_slug_unavailable", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { $ as PlatformBootstrapRoleChangeInput, A as FinuevaAuthClient, At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, Ct as TwoFactorEnrollment, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, E as DepartedOrganizationMemberPage, Et as UpdateOrganizationDisplayInput, F as OrganizationClosureStartInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, N as OrganizationClosure, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, P as OrganizationClosureCancelInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, St as SuspendedOrganizationMemberStatus, T as DepartedOrganizationMember, Tt as TwoFactorStepUpInput, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, Y as OrganizationWorkspaceSelection, Z as PasskeySummary, _ as ClosingOrganization, _t as SignInInput, a as AuthPersistence, at as PlatformStatus, b as CreatedOrganization, bt as SuspendedOrganizationMember, c as AuthSessionInventory, ct as RecentAuthenticationStatus, d as AuthUser, dt as ResentOrganizationInvitation, et as PlatformRole, f as CanceledOrganizationInvitation, ft as RestoredOrganizationMember, g as CeremonyReturnInput, gt as SendVerificationEmailInput, h as CeremonyRecentAuthenticationRequest, ht as ScimCredentialState, i as AuthOrganization, it as PlatformRoleFirstApproval, j as InvitationAcceptance, jt as AuthErrorCode, k as EnterpriseConnection, kt as WorkspaceSelection, l as AuthSessionSummary, lt as RemovedOrganizationMember, m as CeremonyHandoffInput, mt as ScimCredentialIssuance, n as AddedOrganizationTeamMember, nt as PlatformRoleApproval, o as AuthPersistenceDriver, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, pt as RotateScimCredentialInput, q as OrganizationTeamMemberPage, r as AuthClientOptions, rt as PlatformRoleChangeRecentAuthenticationInput, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, tt as PlatformRoleApplied, u as AuthState, ut as RemovedOrganizationTeamMember, v as ClosingOrganizationList, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, xt as SuspendedOrganizationMemberPage, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-Cv_qxcBP.js";
+import { $ as PasskeyInventory, A as EnterpriseConnection, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Ct as SuspendedOrganizationMember, D as DepartedOrganizationMemberPage, Dt as TwoFactorStatus, E as DepartedOrganizationMember, Et as TwoFactorEnrollment, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, I as OrganizationClosure, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, L as OrganizationClosureCancelInput, Lt as UserApiCredential, M as EnterpriseConnectionSetup, Mt as UpdateProfileInput, N as FinuevaAuthClient, Nt as WorkspaceSelection, O as DriveCredential, Ot as TwoFactorStepUpInput, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, R as OrganizationClosureStartInput, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, Tt as SuspendedOrganizationMemberStatus, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, _ as ClosingOrganization, _t as ScimCredentialIssuance, a as AuthPersistence, at as PlatformRoleApproval, b as CreateOrganizationMemberInvitationInput, bt as SignInInput, c as AuthSessionInventory, ct as PlatformStatus, d as AuthUser, dt as RecentAuthenticationStatus, et as PasskeySummary, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, g as CeremonyReturnInput, gt as RotateScimCredentialInput, h as CeremonyRecentAuthenticationRequest, ht as RestoredOrganizationMember, i as AuthOrganization, it as PlatformRoleApplied, j as EnterpriseConnectionAction, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, kt as UpdateEnterpriseConnectionInput, l as AuthSessionSummary, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, nt as PlatformBootstrapRoleChangeInput, o as AuthPersistenceDriver, ot as PlatformRoleChangeRecentAuthenticationInput, p as CeremonyHandoff, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, r as AuthClientOptions, rt as PlatformRole, s as AuthSession, st as PlatformRoleFirstApproval, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, u as AuthState, ut as ReceivedOrganizationInvitationPage, v as ClosingOrganizationList, vt as ScimCredentialState, w as DeclineInvitationInput, wt as SuspendedOrganizationMemberPage, x as CreatedOrganization, xt as SocialIdTokenInput, y as CreateEnterpriseConnectionInput, yt as SendVerificationEmailInput, z as OrganizationDeparture } from "./types-sJ_vACZ3.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateEnterpriseConnectionInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type EnterpriseConnectionAction, type EnterpriseConnectionSetup, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateEnterpriseConnectionInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -2537,6 +2537,7 @@ const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
 	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
 	google_recovery_not_required: "Google account recovery is not required.",
 	google_recovery_invalid: "The Google account recovery request is invalid.",
@@ -2557,6 +2558,7 @@ const messages = {
 	organization_context_too_large: "The organization context is too large.",
 	credential_rate_limited: "Credential requests are temporarily limited.",
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	organization_slug_unavailable: "The organization address is unavailable.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
 	platform_target_unavailable: "The platform administration target is unavailable.",
@@ -3434,7 +3436,12 @@ function fromAccountAuthorityError(value, status, retryAfter) {
 function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
-	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	if (code === "OAUTH_LINK_ERROR") {
+		const message = isObject(value) && typeof value.message === "string" ? value.message : void 0;
+		if (message === "account not linked") return new AuthError("account_conflict", 409);
+		if (message === "signup disabled") return new AuthError("social_signup_required", 409);
+		return authorityUnavailable();
+	}
 	return fromAccountAuthorityError(value, status, retryAfter);
 }
 function authorityUnavailable() {
@@ -3453,6 +3460,7 @@ function fromOrganizationReadAuthorityError(value, status) {
 }
 function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409 && isObject(value) && value.code === "ORGANIZATION_SLUG_UNAVAILABLE") return new AuthError("organization_slug_unavailable", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
@@ -5083,6 +5091,75 @@ function fromEnterpriseAdministrationError(value, status, retryAfter) {
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	return authorityUnavailable();
 }
+const setupKeys = [
+	"id",
+	"revision",
+	"issuer",
+	"clientId",
+	"enabled",
+	"memberJit",
+	"domain",
+	"domainVerified",
+	"validatedAt",
+	"testedAt",
+	"dnsRecordName",
+	"dnsRecordValue",
+	"challengeExpiresAt",
+	"redirectUri"
+];
+function normalizeEnterpriseConnectionSetup(value) {
+	if (!exact(value, setupKeys) || typeof value.id !== "string" || !idPattern.test(value.id) || typeof value.issuer !== "string" || value.issuer.length > 2048 || !value.issuer.startsWith("https://") || typeof value.clientId !== "string" || value.clientId.length < 1 || value.clientId.length > 256 || typeof value.domain !== "string" || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(value.domain) || value.domain.length > 253 || value.dnsRecordName !== `_finueva-sso.${value.domain}` || typeof value.dnsRecordValue !== "string" || !/^finueva-sso=[A-Za-z0-9_-]{43}$/.test(value.dnsRecordValue) || typeof value.redirectUri !== "string" || value.redirectUri.length > 2048 || !Number.isSafeInteger(value.revision) || value.revision < 0) throw authorityUnavailable();
+	let redirect;
+	try {
+		redirect = new URL(value.redirectUri);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (redirect.protocol !== "https:" || redirect.username || redirect.password || redirect.search || redirect.hash || !redirect.pathname.endsWith(`/enterprise/callback/${value.id}`)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		revision: value.revision,
+		issuer: value.issuer,
+		clientId: value.clientId,
+		enabled: bool(value.enabled),
+		memberJit: bool(value.memberJit),
+		domain: value.domain,
+		domainVerified: bool(value.domainVerified),
+		validatedAt: date(value.validatedAt, true),
+		testedAt: date(value.testedAt, true),
+		dnsRecordName: value.dnsRecordName,
+		dnsRecordValue: value.dnsRecordValue,
+		challengeExpiresAt: date(value.challengeExpiresAt, false),
+		redirectUri: value.redirectUri
+	};
+}
+function normalizeEnterpriseConnectionSetups(value) {
+	if (!exact(value, ["connections"]) || !Array.isArray(value.connections) || value.connections.length > 10) throw authorityUnavailable();
+	return value.connections.map(normalizeEnterpriseConnectionSetup);
+}
+function normalizeEnterpriseConnectionAction(value) {
+	if (exact(value, ["removed"]) && value.removed === true) return { removed: true };
+	return normalizeEnterpriseConnectionSetup(value);
+}
+function enterpriseInputString(value, max) {
+	if (typeof value !== "string" || value.length < 1 || value.length > max) throw new TypeError("Enterprise configuration is invalid");
+	return value;
+}
+function enterpriseInputBoolean(value) {
+	if (typeof value !== "boolean") throw new TypeError("Enterprise configuration is invalid");
+	return value;
+}
+function normalizeEnterpriseTestAuthorization(value) {
+	if (!exact(value, ["url"]) || typeof value.url !== "string" || value.url.length > 16384) throw authorityUnavailable();
+	let url;
+	try {
+		url = new URL(value.url);
+	} catch {
+		throw authorityUnavailable();
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.hash || !url.searchParams.get("state") || url.searchParams.get("response_type") !== "code") throw authorityUnavailable();
+	return { url: value.url };
+}
 //#endregion
 //#region src/user-api/credential.ts
 function userApiApplication(input) {
@@ -6084,6 +6161,65 @@ function createAuthClient(options) {
 		async listEnterpriseConnections(organizationId) {
 			return enterpriseRequest("GET", `${normalizeIdInput(organizationId)}/connections`, void 0, normalizeEnterpriseConnections);
 		},
+		async startEnterpriseConnectionTest(organizationId, connectionId, input) {
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/enterprise/test-sign-in"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: {
+					organizationId: normalizeIdInput(organizationId),
+					connectionId: normalizeIdInput(connectionId),
+					expectedRevision: normalizeRevision(input?.expectedRevision),
+					applicationId: normalizeIdInput(input?.applicationId),
+					returnTo: enterpriseInputString(input?.returnTo, 2048)
+				},
+				mapError: fromEnterpriseAdministrationError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeEnterpriseTestAuthorization(value);
+		},
+		async listEnterpriseConnectionSetups(organizationId) {
+			return enterpriseRequest("GET", `${normalizeIdInput(organizationId)}/connection-setup`, void 0, normalizeEnterpriseConnectionSetups);
+		},
+		async createEnterpriseConnection(organizationId, input) {
+			const body = {
+				requestId: enterpriseInputString(input?.requestId, 36),
+				issuer: enterpriseInputString(input?.issuer, 2048),
+				clientId: enterpriseInputString(input?.clientId, 256),
+				clientSecret: enterpriseInputString(input?.clientSecret, 512),
+				domain: enterpriseInputString(input?.domain, 253),
+				memberJit: enterpriseInputBoolean(input?.memberJit)
+			};
+			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup`, body, normalizeEnterpriseConnectionSetup);
+		},
+		async updateEnterpriseConnection(organizationId, connectionId, input) {
+			const body = {
+				expectedRevision: normalizeRevision(input?.expectedRevision),
+				issuer: enterpriseInputString(input?.issuer, 2048),
+				clientId: enterpriseInputString(input?.clientId, 256),
+				memberJit: enterpriseInputBoolean(input?.memberJit),
+				...input?.clientSecret === void 0 ? {} : { clientSecret: enterpriseInputString(input.clientSecret, 512) }
+			};
+			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup/${normalizeIdInput(connectionId)}`, body, normalizeEnterpriseConnectionSetup);
+		},
+		async actOnEnterpriseConnection(organizationId, connectionId, input) {
+			if (![
+				"challenge",
+				"verify",
+				"validate",
+				"enable",
+				"disable",
+				"archive"
+			].includes(input?.action)) throw new TypeError("Enterprise action is invalid");
+			const body = {
+				expectedRevision: normalizeRevision(input?.expectedRevision),
+				action: input.action
+			};
+			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup/${normalizeIdInput(connectionId)}/actions`, body, normalizeEnterpriseConnectionAction);
+		},
 		async getScimCredential(organizationId, connectionId) {
 			return enterpriseRequest("GET", scimCredentialPath(organizationId, connectionId), void 0, (value) => normalizeScimCredentialState(value));
 		},

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { At as AuthError, B as OrganizationMember, C as DeclineInvitationInput, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, I as OrganizationDeparture, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, M as InvitationDecline, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Pt as UserApiCredentialInput, Q as PersonalWorkspaceSelection, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, Y as OrganizationWorkspaceSelection, b as CreatedOrganization, d as AuthUser, dt as ResentOrganizationInvitation, f as CanceledOrganizationInvitation, i as AuthOrganization, j as InvitationAcceptance, jt as AuthErrorCode, kt as WorkspaceSelection, lt as RemovedOrganizationMember, n as AddedOrganizationTeamMember, ot as ReceivedOrganizationInvitation, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, t as AcceptInvitationInput, ut as RemovedOrganizationTeamMember, vt as SocialIdTokenInput, w as DeletedOrganizationTeam, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-Cv_qxcBP.js";
+import { At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Nt as WorkspaceSelection, O as DriveCredential, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, d as AuthUser, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, s as AuthSession, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, ut as ReceivedOrganizationInvitationPage, w as DeclineInvitationInput, x as CreatedOrganization, xt as SocialIdTokenInput, z as OrganizationDeparture } from "./types-sJ_vACZ3.js";
 //#region src/google-recovery.d.ts
 interface GoogleAccountRecoveryInput {
   idToken: {

package/dist/server.js

@@ -3,6 +3,7 @@ const messages = {
 	invalid_credentials: "The credentials are invalid.",
 	invalid_auth_input: "The authentication input is invalid.",
 	account_conflict: "The account is not available.",
+	social_signup_required: "No account is available for this social sign-in. Start sign-up to create one.",
 	google_recovery_in_progress: "A Google connection is already being completed. Return to that sign-in, or wait up to ten minutes and restart.",
 	google_recovery_not_required: "Google account recovery is not required.",
 	google_recovery_invalid: "The Google account recovery request is invalid.",
@@ -23,6 +24,7 @@ const messages = {
 	organization_context_too_large: "The organization context is too large.",
 	credential_rate_limited: "Credential requests are temporarily limited.",
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
+	organization_slug_unavailable: "The organization address is unavailable.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
 	platform_target_unavailable: "The platform administration target is unavailable.",
@@ -518,7 +520,12 @@ function fromAccountAuthorityError(value, status, retryAfter) {
 function fromSocialIdTokenAuthorityError(value, status, retryAfter) {
 	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;
 	if (code === "INVALID_TOKEN" || code === "FAILED_TO_GET_USER_INFO" || code === "USER_EMAIL_NOT_FOUND") return new AuthError("invalid_credentials", 401);
-	if (code === "OAUTH_LINK_ERROR") return new AuthError("account_conflict", 409);
+	if (code === "OAUTH_LINK_ERROR") {
+		const message = isObject$1(value) && typeof value.message === "string" ? value.message : void 0;
+		if (message === "account not linked") return new AuthError("account_conflict", 409);
+		if (message === "signup disabled") return new AuthError("social_signup_required", 409);
+		return authorityUnavailable();
+	}
 	return fromAccountAuthorityError(value, status, retryAfter);
 }
 function authorityUnavailable() {
@@ -537,6 +544,7 @@ function fromOrganizationReadAuthorityError(value, status) {
 }
 function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
 	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409 && isObject$1(value) && value.code === "ORGANIZATION_SLUG_UNAVAILABLE") return new AuthError("organization_slug_unavailable", 409);
 	if (status === 409) return new AuthError("state_conflict", 409);
 	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
 	const code = isObject$1(value) && typeof value.code === "string" ? value.code : void 0;

package/dist/{types-Cv_qxcBP.d.ts → types-sJ_vACZ3.d.ts}

@@ -10,7 +10,7 @@ interface UserApiCredential {
 }
 //#endregion
 //#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "google_recovery_in_progress" | "google_recovery_not_required" | "google_recovery_invalid" | "google_recovery_expired" | "google_recovery_account_mismatch" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required";
+type AuthErrorCode = "invalid_credentials" | "invalid_auth_input" | "account_conflict" | "social_signup_required" | "google_recovery_in_progress" | "google_recovery_not_required" | "google_recovery_invalid" | "google_recovery_expired" | "google_recovery_account_mismatch" | "password_reset_invalid" | "authentication_required" | "request_origin_denied" | "invalid_request" | "invalid_invitation" | "invitation_unavailable" | "recipient_unavailable" | "invitation_recipient_mismatch" | "invitation_recovery_required" | "membership_removal_recovery_required" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "auth_request_rate_limited" | "organization_slug_unavailable" | "state_conflict" | "access_denied" | "platform_target_unavailable" | "platform_quorum_unavailable" | "platform_recovery_required" | "identity_authority_unavailable" | "two_factor_required" | "two_factor_code_invalid" | "two_factor_challenge_expired" | "two_factor_locked" | "recent_sign_in_required" | "enterprise_recovery_required" | "recent_authentication_required" | "organization_closure_confirmation_mismatch" | "organization_closure_cancellation_ended" | "ceremony_return_refused" | "password_sign_in_required";
 type AuthErrorStatus = 400 | 401 | 403 | 404 | 405 | 409 | 410 | 413 | 415 | 422 | 429 | 503;
 declare class AuthError extends Error {
   readonly code: AuthErrorCode;
@@ -346,6 +346,41 @@ interface EnterpriseConnection {
   roleMappingConfigured: boolean;
   updatedAt: Date;
 }
+/** OIDC self-service configuration. Client secrets are write-only. */
+interface EnterpriseConnectionSetup {
+  id: string;
+  revision: number;
+  issuer: string;
+  clientId: string;
+  enabled: boolean;
+  memberJit: boolean;
+  domain: string;
+  domainVerified: boolean;
+  validatedAt: Date | null;
+  testedAt: Date | null;
+  dnsRecordName: string;
+  dnsRecordValue: string;
+  challengeExpiresAt: Date;
+  redirectUri: string;
+}
+interface CreateEnterpriseConnectionInput {
+  /** Keep this UUID unchanged when retrying the same creation attempt. */
+  requestId: string;
+  issuer: string;
+  clientId: string;
+  clientSecret: string;
+  domain: string;
+  memberJit: boolean;
+}
+interface UpdateEnterpriseConnectionInput {
+  expectedRevision: number;
+  issuer: string;
+  clientId: string;
+  /** Omit to keep the current secret. It cannot be read back. */
+  clientSecret?: string;
+  memberJit: boolean;
+}
+type EnterpriseConnectionAction = "challenge" | "verify" | "validate" | "enable" | "disable" | "archive";
 interface ScimCredentialState {
   status: "active" | "revoked" | "unissued";
   revision: number | null;
@@ -545,6 +580,23 @@ interface FinuevaAuthClient {
   signIn(input: SignInInput): Promise<AuthSession>;
   /** Cookie-only. A manual owner or admin reads the organization's enterprise connection status. */
   listEnterpriseConnections(organizationId: string): Promise<EnterpriseConnection[]>;
+  listEnterpriseConnectionSetups(organizationId: string): Promise<EnterpriseConnectionSetup[]>;
+  /** Test OIDC without changing the admin's session or creating membership. Navigate to the returned HTTPS URL. */
+  startEnterpriseConnectionTest(organizationId: string, connectionId: string, input: {
+    expectedRevision: number;
+    applicationId: string;
+    returnTo: string;
+  }): Promise<{
+    url: string;
+  }>;
+  createEnterpriseConnection(organizationId: string, input: CreateEnterpriseConnectionInput): Promise<EnterpriseConnectionSetup>;
+  updateEnterpriseConnection(organizationId: string, connectionId: string, input: UpdateEnterpriseConnectionInput): Promise<EnterpriseConnectionSetup>;
+  actOnEnterpriseConnection(organizationId: string, connectionId: string, input: {
+    expectedRevision: number;
+    action: EnterpriseConnectionAction;
+  }): Promise<EnterpriseConnectionSetup | {
+    removed: true;
+  }>;
   /** Cookie-only. Reads SCIM credential state for an eligible managed-lifecycle connection. */
   getScimCredential(organizationId: string, connectionId: string): Promise<ScimCredentialState>;
   issueScimCredential(organizationId: string, connectionId: string): Promise<ScimCredentialIssuance>;
@@ -588,4 +640,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { PlatformBootstrapRoleChangeInput as $, FinuevaAuthClient as A, AuthError as At, OrganizationMember as B, DeclineInvitationInput as C, TwoFactorEnrollment as Ct, DriveCredential as D, UpdateOrganizationTeamDisplayInput as Dt, DepartedOrganizationMemberPage as E, UpdateOrganizationDisplayInput as Et, OrganizationClosureStartInput as F, OrganizationTeam as G, OrganizationMemberPage as H, OrganizationDeparture as I, OrganizationTeamPage as J, OrganizationTeamDisplay as K, OrganizationDisplay as L, InvitationDecline as M, AuthErrorStatus as Mt, OrganizationClosure as N, UserApiCredential as Nt, DriveCredentialInput as O, UpdateProfileInput as Ot, OrganizationClosureCancelInput as P, UserApiCredentialInput as Pt, PersonalWorkspaceSelection as Q, OrganizationInvitation as R, CreatedOrganizationTeam as S, SuspendedOrganizationMemberStatus as St, DepartedOrganizationMember as T, TwoFactorStepUpInput as Tt, OrganizationPage as U, OrganizationMemberAuthority as V, OrganizationPageInput as W, PasskeyInventory as X, OrganizationWorkspaceSelection as Y, PasskeySummary as Z, ClosingOrganization as _, SignInInput as _t, AuthPersistence as a, PlatformStatus as at, CreatedOrganization as b, SuspendedOrganizationMember as bt, AuthSessionInventory as c, RecentAuthenticationStatus as ct, AuthUser as d, ResentOrganizationInvitation as dt, PlatformRole as et, CanceledOrganizationInvitation as f, RestoredOrganizationMember as ft, CeremonyReturnInput as g, SendVerificationEmailInput as gt, CeremonyRecentAuthenticationRequest as h, ScimCredentialState as ht, AuthOrganization as i, PlatformRoleFirstApproval as it, InvitationAcceptance as j, AuthErrorCode as jt, EnterpriseConnection as k, WorkspaceSelection as kt, AuthSessionSummary as l, RemovedOrganizationMember as lt, CeremonyHandoffInput as m, ScimCredentialIssuance as mt, AddedOrganizationTeamMember as n, PlatformRoleApproval as nt, AuthPersistenceDriver as o, ReceivedOrganizationInvitation as ot, CeremonyHandoff as p, RotateScimCredentialInput as pt, OrganizationTeamMemberPage as q, AuthClientOptions as r, PlatformRoleChangeRecentAuthenticationInput as rt, AuthSession as s, ReceivedOrganizationInvitationPage as st, AcceptInvitationInput as t, PlatformRoleApplied as tt, AuthState as u, RemovedOrganizationTeamMember as ut, ClosingOrganizationList as v, SocialIdTokenInput as vt, DeletedOrganizationTeam as w, TwoFactorStatus as wt, CreatedOrganizationMemberInvitation as x, SuspendedOrganizationMemberPage as xt, CreateOrganizationMemberInvitationInput as y, SocialIdTokenProvider as yt, OrganizationInvitationPage as z };
+export { PasskeyInventory as $, EnterpriseConnection as A, UpdateOrganizationDisplayInput as At, OrganizationDisplay as B, CreatedOrganizationTeam as C, SuspendedOrganizationMember as Ct, DepartedOrganizationMemberPage as D, TwoFactorStatus as Dt, DepartedOrganizationMember as E, TwoFactorEnrollment as Et, InvitationDecline as F, AuthErrorCode as Ft, OrganizationMemberPage as G, OrganizationInvitationPage as H, OrganizationClosure as I, AuthErrorStatus as It, OrganizationTeam as J, OrganizationPage as K, OrganizationClosureCancelInput as L, UserApiCredential as Lt, EnterpriseConnectionSetup as M, UpdateProfileInput as Mt, FinuevaAuthClient as N, WorkspaceSelection as Nt, DriveCredential as O, TwoFactorStepUpInput as Ot, InvitationAcceptance as P, AuthError as Pt, OrganizationWorkspaceSelection as Q, OrganizationClosureStartInput as R, UserApiCredentialInput as Rt, CreatedOrganizationMemberInvitation as S, SocialIdTokenProvider as St, DeletedOrganizationTeam as T, SuspendedOrganizationMemberStatus as Tt, OrganizationMember as U, OrganizationInvitation as V, OrganizationMemberAuthority as W, OrganizationTeamMemberPage as X, OrganizationTeamDisplay as Y, OrganizationTeamPage as Z, ClosingOrganization as _, ScimCredentialIssuance as _t, AuthPersistence as a, PlatformRoleApproval as at, CreateOrganizationMemberInvitationInput as b, SignInInput as bt, AuthSessionInventory as c, PlatformStatus as ct, AuthUser as d, RecentAuthenticationStatus as dt, PasskeySummary as et, CanceledOrganizationInvitation as f, RemovedOrganizationMember as ft, CeremonyReturnInput as g, RotateScimCredentialInput as gt, CeremonyRecentAuthenticationRequest as h, RestoredOrganizationMember as ht, AuthOrganization as i, PlatformRoleApplied as it, EnterpriseConnectionAction as j, UpdateOrganizationTeamDisplayInput as jt, DriveCredentialInput as k, UpdateEnterpriseConnectionInput as kt, AuthSessionSummary as l, ReceivedOrganizationInvitation as lt, CeremonyHandoffInput as m, ResentOrganizationInvitation as mt, AddedOrganizationTeamMember as n, PlatformBootstrapRoleChangeInput as nt, AuthPersistenceDriver as o, PlatformRoleChangeRecentAuthenticationInput as ot, CeremonyHandoff as p, RemovedOrganizationTeamMember as pt, OrganizationPageInput as q, AuthClientOptions as r, PlatformRole as rt, AuthSession as s, PlatformRoleFirstApproval as st, AcceptInvitationInput as t, PersonalWorkspaceSelection as tt, AuthState as u, ReceivedOrganizationInvitationPage as ut, ClosingOrganizationList as v, ScimCredentialState as vt, DeclineInvitationInput as w, SuspendedOrganizationMemberPage as wt, CreatedOrganization as x, SocialIdTokenInput as xt, CreateEnterpriseConnectionInput as y, SendVerificationEmailInput as yt, OrganizationDeparture as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,