@finueva/auth 0.21.0 → 0.23.0

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { $ as PasskeyInventory, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Dt as TwoFactorStatus, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Mt as UpdateProfileInput, O as DriveCredential, Pt as AuthError, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, c as AuthSessionInventory, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, p as CeremonyHandoff, q as OrganizationPageInput, s as AuthSession, ut as ReceivedOrganizationInvitationPage, x as CreatedOrganization, xt as SocialIdTokenInput } from "./types-sJ_vACZ3.js";
+import { $ as PasskeyInventory, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Dt as TwoFactorStatus, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Mt as UpdateProfileInput, O as DriveCredential, Pt as AuthError, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, c as AuthSessionInventory, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, p as CeremonyHandoff, q as OrganizationPageInput, s as AuthSession, ut as ReceivedOrganizationInvitationPage, x as CreatedOrganization, xt as SocialIdTokenInput } from "./types-CgtPkDeO.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as PasskeyInventory, A as EnterpriseConnection, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Ct as SuspendedOrganizationMember, D as DepartedOrganizationMemberPage, Dt as TwoFactorStatus, E as DepartedOrganizationMember, Et as TwoFactorEnrollment, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, I as OrganizationClosure, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, L as OrganizationClosureCancelInput, Lt as UserApiCredential, M as EnterpriseConnectionSetup, Mt as UpdateProfileInput, N as FinuevaAuthClient, Nt as WorkspaceSelection, O as DriveCredential, Ot as TwoFactorStepUpInput, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, R as OrganizationClosureStartInput, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, Tt as SuspendedOrganizationMemberStatus, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, _ as ClosingOrganization, _t as ScimCredentialIssuance, a as AuthPersistence, at as PlatformRoleApproval, b as CreateOrganizationMemberInvitationInput, bt as SignInInput, c as AuthSessionInventory, ct as PlatformStatus, d as AuthUser, dt as RecentAuthenticationStatus, et as PasskeySummary, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, g as CeremonyReturnInput, gt as RotateScimCredentialInput, h as CeremonyRecentAuthenticationRequest, ht as RestoredOrganizationMember, i as AuthOrganization, it as PlatformRoleApplied, j as EnterpriseConnectionAction, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, kt as UpdateEnterpriseConnectionInput, l as AuthSessionSummary, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, nt as PlatformBootstrapRoleChangeInput, o as AuthPersistenceDriver, ot as PlatformRoleChangeRecentAuthenticationInput, p as CeremonyHandoff, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, r as AuthClientOptions, rt as PlatformRole, s as AuthSession, st as PlatformRoleFirstApproval, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, u as AuthState, ut as ReceivedOrganizationInvitationPage, v as ClosingOrganizationList, vt as ScimCredentialState, w as DeclineInvitationInput, wt as SuspendedOrganizationMemberPage, x as CreatedOrganization, xt as SocialIdTokenInput, y as CreateEnterpriseConnectionInput, yt as SendVerificationEmailInput, z as OrganizationDeparture } from "./types-sJ_vACZ3.js";
+import { $ as PasskeyInventory, A as EnterpriseConnection, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Ct as SuspendedOrganizationMember, D as DepartedOrganizationMemberPage, Dt as TwoFactorStatus, E as DepartedOrganizationMember, Et as TwoFactorEnrollment, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, I as OrganizationClosure, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, L as OrganizationClosureCancelInput, Lt as UserApiCredential, M as EnterpriseConnectionSetup, Mt as UpdateProfileInput, N as FinuevaAuthClient, Nt as WorkspaceSelection, O as DriveCredential, Ot as TwoFactorStepUpInput, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, R as OrganizationClosureStartInput, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, Tt as SuspendedOrganizationMemberStatus, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, _ as ClosingOrganization, _t as ScimCredentialIssuance, a as AuthPersistence, at as PlatformRoleApproval, b as CreateOrganizationMemberInvitationInput, bt as SignInInput, c as AuthSessionInventory, ct as PlatformStatus, d as AuthUser, dt as RecentAuthenticationStatus, et as PasskeySummary, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, g as CeremonyReturnInput, gt as RotateScimCredentialInput, h as CeremonyRecentAuthenticationRequest, ht as RestoredOrganizationMember, i as AuthOrganization, it as PlatformRoleApplied, j as EnterpriseConnectionAction, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, kt as UpdateEnterpriseConnectionInput, l as AuthSessionSummary, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, nt as PlatformBootstrapRoleChangeInput, o as AuthPersistenceDriver, ot as PlatformRoleChangeRecentAuthenticationInput, p as CeremonyHandoff, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, r as AuthClientOptions, rt as PlatformRole, s as AuthSession, st as PlatformRoleFirstApproval, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, u as AuthState, ut as ReceivedOrganizationInvitationPage, v as ClosingOrganizationList, vt as ScimCredentialState, w as DeclineInvitationInput, wt as SuspendedOrganizationMemberPage, x as CreatedOrganization, xt as SocialIdTokenInput, y as CreateEnterpriseConnectionInput, yt as SendVerificationEmailInput, z as OrganizationDeparture } from "./types-CgtPkDeO.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion

package/dist/index.js

@@ -6250,6 +6250,16 @@ function createAuthClient(options) {
 			if (!result.session) throw new AuthError("authentication_required", 401);
 			return result.session;
 		},
+		async approveEnterpriseLink(password) {
+			const body = { password: normalizePassword(password, "password", 8) };
+			const result = await runAccountMutation(async () => {
+				const value = await accountRequest("enterprise/link/approve", body);
+				if (!value || typeof value !== "object" || !("linked" in value) || value.linked !== true) throw new AuthError("identity_authority_unavailable", 503);
+				return value;
+			});
+			if (!result.session) throw new AuthError("authentication_required", 401);
+			return result.session;
+		},
 		async verifyTwoFactor(code) {
 			const normalized = normalizeTwoFactorCode(code);
 			const result = await runAccountMutation(() => accountRequest(normalized.route, { code: normalized.code }, fromTwoFactorAuthorityError));

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Nt as WorkspaceSelection, O as DriveCredential, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, d as AuthUser, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, s as AuthSession, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, ut as ReceivedOrganizationInvitationPage, w as DeclineInvitationInput, x as CreatedOrganization, xt as SocialIdTokenInput, z as OrganizationDeparture } from "./types-sJ_vACZ3.js";
+import { At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Nt as WorkspaceSelection, O as DriveCredential, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, d as AuthUser, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, s as AuthSession, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, ut as ReceivedOrganizationInvitationPage, w as DeclineInvitationInput, x as CreatedOrganization, xt as SocialIdTokenInput, z as OrganizationDeparture } from "./types-CgtPkDeO.js";
 //#region src/google-recovery.d.ts
 interface GoogleAccountRecoveryInput {
   idToken: {
@@ -65,6 +65,20 @@ interface ResolveMembershipInput {
   organizationId: string;
   userId: string;
 }
+interface ResolveMembershipBatchInput {
+  organizationId: string;
+  userIds: string[];
+  /** Only membership in these known teams is returned. Omitted teams are not evaluated. */
+  teamIds?: string[];
+}
+interface ResolvedMembershipBatch {
+  organizationId: string;
+  memberships: Array<{
+    userId: string;
+    membership: ResolvedMembership | null;
+    matchingTeamIds: string[];
+  }>;
+}
 type ResolvedMembershipRole = "admin" | "member" | "owner";
 interface ResolvedMembership {
   checkedAt: string;
@@ -78,6 +92,7 @@ interface ResolvedMembership {
 }
 interface FinuevaMembershipResolverAuth {
   resolveMembership(input: ResolveMembershipInput, clientAssertion: string): Promise<ResolvedMembership | null>;
+  resolveMembershipBatch(input: ResolveMembershipBatchInput, clientAssertion: string): Promise<ResolvedMembershipBatch>;
 }
 /** Server-only organization membership resolution. Keep results private; they are Auth authority, not product authority. */
 declare function createMembershipResolverAuth(options: MembershipResolverAuthOptions): FinuevaMembershipResolverAuth;
@@ -175,4 +190,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };
+export { type AcceptInvitationInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };

package/dist/server.js

@@ -2629,19 +2629,34 @@ const membershipKeys = [
 function exact$1(value, keys) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
 }
+function parseMembership(value, organizationId, userId) {
+	if (!exact$1(value, ["membership"])) throw authorityUnavailable();
+	if (value.membership === null) return null;
+	const membership = value.membership;
+	if (!exact$1(membership, membershipKeys) || typeof membership.checkedAt !== "string" || !isoPattern.test(membership.checkedAt) || Number.isNaN(Date.parse(membership.checkedAt)) || typeof membership.manualRole !== "string" || !roles.includes(membership.manualRole) || typeof membership.role !== "string" || !roles.includes(membership.role) || typeof membership.memberCount !== "number" || !Number.isSafeInteger(membership.memberCount) || membership.memberCount < 0 || typeof membership.memberId !== "string" || !idPattern.test(membership.memberId) || typeof membership.owner !== "boolean" || membership.organizationId !== organizationId || membership.userId !== userId) throw authorityUnavailable();
+	return {
+		checkedAt: membership.checkedAt,
+		manualRole: membership.manualRole,
+		memberCount: membership.memberCount,
+		memberId: membership.memberId,
+		organizationId,
+		owner: membership.owner,
+		role: membership.role,
+		userId
+	};
+}
 function createMembershipResolverAuth(options) {
-	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/memberships/resolve");
+	const origin = normalizeOrigin(options.authOrigin, "authOrigin");
 	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
 	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
 	const timeoutMs = normalizeTimeout(options.timeoutMs);
 	let inFlight = false;
-	return { async resolveMembership(input, clientAssertion) {
-		if (!exact$1(input, ["organizationId", "userId"]) || typeof input.organizationId !== "string" || typeof input.userId !== "string" || !idPattern.test(input.organizationId) || !idPattern.test(input.userId)) throw new AuthError("invalid_request", 400);
+	async function exchange(body, clientAssertion, batch, parseResult) {
+		const url = joinURL(origin, batch ? "api/v1/auth/memberships/resolve-batch" : "api/v1/auth/memberships/resolve");
+		const maxBytes = batch ? 512 * 1024 : 1024;
 		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
 		if (inFlight) throw new AuthError("state_conflict", 409);
 		inFlight = true;
-		const organizationId = input.organizationId;
-		const userId = input.userId;
 		const controller = new AbortController();
 		let reader;
 		let timer;
@@ -2662,10 +2677,7 @@ function createMembershipResolverAuth(options) {
 						accept: "application/json",
 						"content-type": "application/json"
 					},
-					body: JSON.stringify({
-						organizationId,
-						userId
-					}),
+					body: JSON.stringify(body),
 					credentials: "omit",
 					cache: "no-store",
 					redirect: "manual",
@@ -2678,8 +2690,8 @@ function createMembershipResolverAuth(options) {
 				if (!response.body) throw authorityUnavailable();
 				reader = response.body.getReader();
 				const length = response.headers.get("content-length");
-				if (response.redirected || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > 1024)) throw authorityUnavailable();
-				const bytes = new Uint8Array(1024);
+				if (response.redirected || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > maxBytes)) throw authorityUnavailable();
+				const bytes = new Uint8Array(maxBytes);
 				let size = 0;
 				while (true) {
 					const chunk = await reader.read();
@@ -2700,20 +2712,7 @@ function createMembershipResolverAuth(options) {
 					}
 					throw mappedError ?? authorityUnavailable();
 				}
-				if (!exact$1(value, ["membership"])) throw authorityUnavailable();
-				if (value.membership === null) return null;
-				const membership = value.membership;
-				if (!exact$1(membership, membershipKeys) || typeof membership.checkedAt !== "string" || !isoPattern.test(membership.checkedAt) || Number.isNaN(Date.parse(membership.checkedAt)) || typeof membership.manualRole !== "string" || !roles.includes(membership.manualRole) || typeof membership.role !== "string" || !roles.includes(membership.role) || typeof membership.memberCount !== "number" || !Number.isSafeInteger(membership.memberCount) || membership.memberCount < 0 || typeof membership.memberId !== "string" || !idPattern.test(membership.memberId) || typeof membership.owner !== "boolean" || membership.organizationId !== organizationId || membership.userId !== userId) throw authorityUnavailable();
-				return {
-					checkedAt: membership.checkedAt,
-					manualRole: membership.manualRole,
-					memberCount: membership.memberCount,
-					memberId: membership.memberId,
-					organizationId,
-					owner: membership.owner,
-					role: membership.role,
-					userId
-				};
+				return parseResult(value);
 			};
 			return await Promise.race([exchange().finally(() => {
 				inFlight = false;
@@ -2726,7 +2725,53 @@ function createMembershipResolverAuth(options) {
 			controller.abort();
 			reader?.cancel().catch(() => {});
 		}
-	} };
+	}
+	return {
+		async resolveMembership(input, assertion) {
+			if (!exact$1(input, ["organizationId", "userId"]) || typeof input.organizationId !== "string" || typeof input.userId !== "string" || !idPattern.test(input.organizationId) || !idPattern.test(input.userId)) throw new AuthError("invalid_request", 400);
+			const { organizationId, userId } = input;
+			return exchange({
+				organizationId,
+				userId
+			}, assertion, false, (value) => parseMembership(value, organizationId, userId));
+		},
+		async resolveMembershipBatch(input, assertion) {
+			if (!input || typeof input !== "object" || Array.isArray(input) || !exact$1(input, Object.hasOwn(input, "teamIds") ? [
+				"organizationId",
+				"userIds",
+				"teamIds"
+			] : ["organizationId", "userIds"]) || typeof input.organizationId !== "string" || !idPattern.test(input.organizationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 100 || input.userIds.some((id) => typeof id !== "string" || !idPattern.test(id)) || new Set(input.userIds).size !== input.userIds.length || input.teamIds !== void 0 && (!Array.isArray(input.teamIds) || input.teamIds.length > 32 || input.teamIds.some((id) => typeof id !== "string" || !idPattern.test(id)) || new Set(input.teamIds).size !== input.teamIds.length)) throw new AuthError("invalid_request", 400);
+			const organizationId = input.organizationId;
+			const userIds = [...input.userIds];
+			const teamIds = [...input.teamIds ?? []];
+			return exchange({
+				organizationId,
+				userIds,
+				teamIds
+			}, assertion, true, (value) => {
+				if (!exact$1(value, ["organizationId", "memberships"]) || value.organizationId !== organizationId || !Array.isArray(value.memberships) || value.memberships.length !== userIds.length) throw authorityUnavailable();
+				const memberships = value.memberships.map((entry, index) => {
+					const userId = userIds[index];
+					if (!exact$1(entry, [
+						"userId",
+						"membership",
+						"matchingTeamIds"
+					]) || entry.userId !== userId || !Array.isArray(entry.matchingTeamIds) || entry.matchingTeamIds.length > teamIds.length || entry.matchingTeamIds.some((id) => typeof id !== "string" || !teamIds.includes(id)) || new Set(entry.matchingTeamIds).size !== entry.matchingTeamIds.length) throw authorityUnavailable();
+					const membership = parseMembership({ membership: entry.membership }, organizationId, userId);
+					if (!membership && entry.matchingTeamIds.length) throw authorityUnavailable();
+					return {
+						userId,
+						membership,
+						matchingTeamIds: [...entry.matchingTeamIds]
+					};
+				});
+				return {
+					organizationId,
+					memberships
+				};
+			});
+		}
+	};
 }
 //#endregion
 //#region src/drive-recipients.ts

package/dist/{types-sJ_vACZ3.d.ts → types-CgtPkDeO.d.ts}

@@ -578,6 +578,8 @@ interface FinuevaAuthClient {
   sendVerificationEmail(input: SendVerificationEmailInput): Promise<void>;
   signUp(email: string, password: string, name: string): Promise<AuthSession>;
   signIn(input: SignInInput): Promise<AuthSession>;
+  /** Confirm a pending enterprise identity link with the current account password. Cookie-only. */
+  approveEnterpriseLink(password: string): Promise<AuthSession>;
   /** Cookie-only. A manual owner or admin reads the organization's enterprise connection status. */
   listEnterpriseConnections(organizationId: string): Promise<EnterpriseConnection[]>;
   listEnterpriseConnectionSetups(organizationId: string): Promise<EnterpriseConnectionSetup[]>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,