@finueva/auth 0.23.0 → 0.25.0

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { $ as PasskeyInventory, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Dt as TwoFactorStatus, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Mt as UpdateProfileInput, O as DriveCredential, Pt as AuthError, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, c as AuthSessionInventory, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, p as CeremonyHandoff, q as OrganizationPageInput, s as AuthSession, ut as ReceivedOrganizationInvitationPage, x as CreatedOrganization, xt as SocialIdTokenInput } from "./types-CgtPkDeO.js";
+import { B as OrganizationDisplay, C as CreatedOrganizationTeam, Ct as SocialIdTokenProvider, Ft as AuthError, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorCode, J as OrganizationPageInput, K as OrganizationMemberPageInput, Lt as AuthErrorStatus, Mt as UpdateOrganizationTeamDisplayInput, Nt as UpdateProfileInput, O as DriveCredential, Ot as TwoFactorStatus, Q as OrganizationTeamPage, Rt as UserApiCredential, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenInput, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamDisplay, Y as OrganizationTeam, Z as OrganizationTeamMemberPage, b as CreateOrganizationMemberInvitationInput, c as AuthSessionInventory, dt as ReceivedOrganizationInvitationPage, et as PasskeyInventory, i as AuthOrganization, jt as UpdateOrganizationDisplayInput, k as DriveCredentialInput, m as CeremonyHandoffInput, p as CeremonyHandoff, q as OrganizationPage, s as AuthSession, ut as ReceivedOrganizationInvitation, x as CreatedOrganization, zt as UserApiCredentialInput } from "./types-rx4YxsoH.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -51,7 +51,7 @@ interface DeviceAuthClient {
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
-  listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
+  listOrganizationMembers(organizationId: string, input?: OrganizationMemberPageInput): Promise<OrganizationMemberPage>;
   listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
   listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
   listOrganizationInvitations(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationInvitationPage>;
@@ -91,4 +91,4 @@ interface DeviceAuthClient {
 }
 declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type TwoFactorStatus, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };
+export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type TwoFactorStatus, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };

package/dist/device.js

@@ -340,6 +340,23 @@ function normalizeOrganizationPageInput(value) {
 	}
 	return query;
 }
+function normalizeOrganizationMemberPageInput(value) {
+	if (value === void 0) return new URLSearchParams();
+	if (!isObject(value) || Object.keys(value).some((key) => ![
+		"limit",
+		"cursor",
+		"search"
+	].includes(key))) throw new AuthError("invalid_request", 400);
+	const { search, ...page } = value;
+	const query = normalizeOrganizationPageInput(page);
+	if (search !== void 0) {
+		if (typeof search !== "string") throw new AuthError("invalid_request", 400);
+		const prefix = search.trim().replace(/[A-Z]/g, (character) => character.toLowerCase());
+		if (!prefix || prefix.length > 128 || Array.from(prefix).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw new AuthError("invalid_request", 400);
+		query.set("search", prefix);
+	}
+	return query;
+}
 function normalizeIdInput(value) {
 	if (!isId(value)) throw new AuthError("invalid_request", 400);
 	return value;
@@ -1231,6 +1248,7 @@ async function requestJsonResponse(url, options) {
 			headers: options.headers,
 			body: options.body,
 			credentials: options.credentials ?? "include",
+			cache: options.cache,
 			retry: 0,
 			timeout: options.timeoutMs,
 			redirect: "manual",
@@ -1243,37 +1261,47 @@ async function requestJsonResponse(url, options) {
 	}
 	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
-		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes) : void 0;
-		await response.body?.cancel();
+		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes, options.signal) : void 0;
+		response.body?.cancel().catch(() => void 0);
 		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
 	return {
-		value: await readJson(response, options.maxResponseBytes),
+		value: await readJson(response, options.maxResponseBytes, options.signal),
 		headers: response.headers
 	};
 }
-async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
+async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 	const length = response.headers.get("content-length");
 	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
-		await response.body?.cancel();
+		response.body?.cancel().catch(() => void 0);
 		throw authorityUnavailable();
 	}
 	if (!response.body) throw authorityUnavailable();
+	if (signal?.aborted) {
+		response.body.cancel().catch(() => void 0);
+		throw authorityUnavailable();
+	}
 	const reader = response.body.getReader();
+	const cancel = () => {
+		reader.cancel().catch(() => void 0);
+	};
+	signal?.addEventListener("abort", cancel, { once: true });
 	const chunks = [];
 	let size = 0;
 	try {
 		while (true) {
 			const { done, value } = await reader.read();
+			if (signal?.aborted) throw authorityUnavailable();
 			if (done) break;
 			size += value.byteLength;
 			if (size > maximum) throw authorityUnavailable();
 			chunks.push(value);
 		}
 	} catch (error) {
-		await reader.cancel();
+		reader.cancel().catch(() => void 0);
 		throw error;
 	} finally {
+		signal?.removeEventListener("abort", cancel);
 		reader.releaseLock();
 	}
 	const bytes = new Uint8Array(size);
@@ -1905,8 +1933,8 @@ function createDeviceAuth(options) {
 		}
 		return session;
 	}
-	async function organizationRead(path, input, normalize) {
-		const query = normalizeOrganizationPageInput(input);
+	async function organizationRead(path, input, normalize, queryInput = normalizeOrganizationPageInput) {
+		const query = queryInput(input);
 		const current = await readToken();
 		if (!current) throw new AuthError("authentication_required", 401);
 		return normalize((await requestJsonResponse(`${joinURL(authOrigin, "api/v1/auth/organizations", path)}${query.size ? `?${query}` : ""}`, {
@@ -2089,7 +2117,7 @@ function createDeviceAuth(options) {
 		},
 		listOrganizationMembers(organizationId, input) {
 			try {
-				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers));
+				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers, normalizeOrganizationMemberPageInput));
 			} catch (error) {
 				return Promise.reject(error);
 			}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { $ as PasskeyInventory, A as EnterpriseConnection, At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Ct as SuspendedOrganizationMember, D as DepartedOrganizationMemberPage, Dt as TwoFactorStatus, E as DepartedOrganizationMember, Et as TwoFactorEnrollment, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, I as OrganizationClosure, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, L as OrganizationClosureCancelInput, Lt as UserApiCredential, M as EnterpriseConnectionSetup, Mt as UpdateProfileInput, N as FinuevaAuthClient, Nt as WorkspaceSelection, O as DriveCredential, Ot as TwoFactorStepUpInput, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, R as OrganizationClosureStartInput, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, Tt as SuspendedOrganizationMemberStatus, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, _ as ClosingOrganization, _t as ScimCredentialIssuance, a as AuthPersistence, at as PlatformRoleApproval, b as CreateOrganizationMemberInvitationInput, bt as SignInInput, c as AuthSessionInventory, ct as PlatformStatus, d as AuthUser, dt as RecentAuthenticationStatus, et as PasskeySummary, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, g as CeremonyReturnInput, gt as RotateScimCredentialInput, h as CeremonyRecentAuthenticationRequest, ht as RestoredOrganizationMember, i as AuthOrganization, it as PlatformRoleApplied, j as EnterpriseConnectionAction, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, kt as UpdateEnterpriseConnectionInput, l as AuthSessionSummary, lt as ReceivedOrganizationInvitation, m as CeremonyHandoffInput, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, nt as PlatformBootstrapRoleChangeInput, o as AuthPersistenceDriver, ot as PlatformRoleChangeRecentAuthenticationInput, p as CeremonyHandoff, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, r as AuthClientOptions, rt as PlatformRole, s as AuthSession, st as PlatformRoleFirstApproval, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, u as AuthState, ut as ReceivedOrganizationInvitationPage, v as ClosingOrganizationList, vt as ScimCredentialState, w as DeclineInvitationInput, wt as SuspendedOrganizationMemberPage, x as CreatedOrganization, xt as SocialIdTokenInput, y as CreateEnterpriseConnectionInput, yt as SendVerificationEmailInput, z as OrganizationDeparture } from "./types-CgtPkDeO.js";
+import { $ as OrganizationWorkspaceSelection, A as EnterpriseConnection, At as UpdateEnterpriseConnectionInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, Ct as SocialIdTokenProvider, D as DepartedOrganizationMemberPage, Dt as TwoFactorEnrollment, E as DepartedOrganizationMember, Et as SuspendedOrganizationMemberStatus, F as InvitationDecline, Ft as AuthError, G as OrganizationMemberPage, H as OrganizationInvitationPage, I as OrganizationClosure, It as AuthErrorCode, J as OrganizationPageInput, K as OrganizationMemberPageInput, L as OrganizationClosureCancelInput, Lt as AuthErrorStatus, M as EnterpriseConnectionSetup, Mt as UpdateOrganizationTeamDisplayInput, N as FinuevaAuthClient, Nt as UpdateProfileInput, O as DriveCredential, Ot as TwoFactorStatus, P as InvitationAcceptance, Pt as WorkspaceSelection, Q as OrganizationTeamPage, R as OrganizationClosureStartInput, Rt as UserApiCredential, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenInput, T as DeletedOrganizationTeam, Tt as SuspendedOrganizationMemberPage, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamDisplay, Y as OrganizationTeam, Z as OrganizationTeamMemberPage, _ as ClosingOrganization, _t as RotateScimCredentialInput, a as AuthPersistence, at as PlatformRoleApplied, b as CreateOrganizationMemberInvitationInput, bt as SendVerificationEmailInput, c as AuthSessionInventory, ct as PlatformRoleFirstApproval, d as AuthUser, dt as ReceivedOrganizationInvitationPage, et as PasskeyInventory, f as CanceledOrganizationInvitation, ft as RecentAuthenticationStatus, g as CeremonyReturnInput, gt as RestoredOrganizationMember, h as CeremonyRecentAuthenticationRequest, ht as ResentOrganizationInvitation, i as AuthOrganization, it as PlatformRole, j as EnterpriseConnectionAction, jt as UpdateOrganizationDisplayInput, k as DriveCredentialInput, kt as TwoFactorStepUpInput, l as AuthSessionSummary, lt as PlatformStatus, m as CeremonyHandoffInput, mt as RemovedOrganizationTeamMember, n as AddedOrganizationTeamMember, nt as PersonalWorkspaceSelection, o as AuthPersistenceDriver, ot as PlatformRoleApproval, p as CeremonyHandoff, pt as RemovedOrganizationMember, q as OrganizationPage, r as AuthClientOptions, rt as PlatformBootstrapRoleChangeInput, s as AuthSession, st as PlatformRoleChangeRecentAuthenticationInput, t as AcceptInvitationInput, tt as PasskeySummary, u as AuthState, ut as ReceivedOrganizationInvitation, v as ClosingOrganizationList, vt as ScimCredentialIssuance, w as DeclineInvitationInput, wt as SuspendedOrganizationMember, x as CreatedOrganization, xt as SignInInput, y as CreateEnterpriseConnectionInput, yt as ScimCredentialState, z as OrganizationDeparture, zt as UserApiCredentialInput } from "./types-rx4YxsoH.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateEnterpriseConnectionInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type EnterpriseConnectionAction, type EnterpriseConnectionSetup, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateEnterpriseConnectionInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateEnterpriseConnectionInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type EnterpriseConnectionAction, type EnterpriseConnectionSetup, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateEnterpriseConnectionInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -2978,6 +2978,23 @@ function normalizeOrganizationPageInput(value) {
 	}
 	return query;
 }
+function normalizeOrganizationMemberPageInput(value) {
+	if (value === void 0) return new URLSearchParams();
+	if (!isObject(value) || Object.keys(value).some((key) => ![
+		"limit",
+		"cursor",
+		"search"
+	].includes(key))) throw new AuthError("invalid_request", 400);
+	const { search, ...page } = value;
+	const query = normalizeOrganizationPageInput(page);
+	if (search !== void 0) {
+		if (typeof search !== "string") throw new AuthError("invalid_request", 400);
+		const prefix = search.trim().replace(/[A-Z]/g, (character) => character.toLowerCase());
+		if (!prefix || prefix.length > 128 || Array.from(prefix).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw new AuthError("invalid_request", 400);
+		query.set("search", prefix);
+	}
+	return query;
+}
 function normalizeIdInput(value) {
 	if (!isId(value)) throw new AuthError("invalid_request", 400);
 	return value;
@@ -3896,6 +3913,7 @@ async function requestJsonResponse(url, options) {
 			headers: options.headers,
 			body: options.body,
 			credentials: options.credentials ?? "include",
+			cache: options.cache,
 			retry: 0,
 			timeout: options.timeoutMs,
 			redirect: "manual",
@@ -3908,37 +3926,47 @@ async function requestJsonResponse(url, options) {
 	}
 	const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
-		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes) : void 0;
-		await response.body?.cancel();
+		const body = contentType === "application/json" ? await readJson(response, options.maxResponseBytes, options.signal) : void 0;
+		response.body?.cancel().catch(() => void 0);
 		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
 	return {
-		value: await readJson(response, options.maxResponseBytes),
+		value: await readJson(response, options.maxResponseBytes, options.signal),
 		headers: response.headers
 	};
 }
-async function readJson(response, maximum = MAX_RESPONSE_BYTES) {
+async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 	const length = response.headers.get("content-length");
 	if (length && (!/^\d+$/.test(length) || Number(length) > maximum)) {
-		await response.body?.cancel();
+		response.body?.cancel().catch(() => void 0);
 		throw authorityUnavailable();
 	}
 	if (!response.body) throw authorityUnavailable();
+	if (signal?.aborted) {
+		response.body.cancel().catch(() => void 0);
+		throw authorityUnavailable();
+	}
 	const reader = response.body.getReader();
+	const cancel = () => {
+		reader.cancel().catch(() => void 0);
+	};
+	signal?.addEventListener("abort", cancel, { once: true });
 	const chunks = [];
 	let size = 0;
 	try {
 		while (true) {
 			const { done, value } = await reader.read();
+			if (signal?.aborted) throw authorityUnavailable();
 			if (done) break;
 			size += value.byteLength;
 			if (size > maximum) throw authorityUnavailable();
 			chunks.push(value);
 		}
 	} catch (error) {
-		await reader.cancel();
+		reader.cancel().catch(() => void 0);
 		throw error;
 	} finally {
+		signal?.removeEventListener("abort", cancel);
 		reader.releaseLock();
 	}
 	const bytes = new Uint8Array(size);
@@ -5098,6 +5126,9 @@ const setupKeys = [
 	"clientId",
 	"enabled",
 	"memberJit",
+	"requireVerifiedEmail",
+	"capability",
+	"groupsSync",
 	"domain",
 	"domainVerified",
 	"validatedAt",
@@ -5108,7 +5139,7 @@ const setupKeys = [
 	"redirectUri"
 ];
 function normalizeEnterpriseConnectionSetup(value) {
-	if (!exact(value, setupKeys) || typeof value.id !== "string" || !idPattern.test(value.id) || typeof value.issuer !== "string" || value.issuer.length > 2048 || !value.issuer.startsWith("https://") || typeof value.clientId !== "string" || value.clientId.length < 1 || value.clientId.length > 256 || typeof value.domain !== "string" || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(value.domain) || value.domain.length > 253 || value.dnsRecordName !== `_finueva-sso.${value.domain}` || typeof value.dnsRecordValue !== "string" || !/^finueva-sso=[A-Za-z0-9_-]{43}$/.test(value.dnsRecordValue) || typeof value.redirectUri !== "string" || value.redirectUri.length > 2048 || !Number.isSafeInteger(value.revision) || value.revision < 0) throw authorityUnavailable();
+	if (!exact(value, setupKeys) || value.capability !== "federated_sign_in" && value.capability !== "managed_lifecycle" || typeof value.id !== "string" || !idPattern.test(value.id) || typeof value.issuer !== "string" || value.issuer.length > 2048 || !value.issuer.startsWith("https://") || typeof value.clientId !== "string" || value.clientId.length < 1 || value.clientId.length > 256 || typeof value.domain !== "string" || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(value.domain) || value.domain.length > 253 || value.dnsRecordName !== `_finueva-sso.${value.domain}` || typeof value.dnsRecordValue !== "string" || !/^finueva-sso=[A-Za-z0-9_-]{43}$/.test(value.dnsRecordValue) || typeof value.redirectUri !== "string" || value.redirectUri.length > 2048 || !Number.isSafeInteger(value.revision) || value.revision < 0) throw authorityUnavailable();
 	let redirect;
 	try {
 		redirect = new URL(value.redirectUri);
@@ -5123,6 +5154,9 @@ function normalizeEnterpriseConnectionSetup(value) {
 		clientId: value.clientId,
 		enabled: bool(value.enabled),
 		memberJit: bool(value.memberJit),
+		requireVerifiedEmail: bool(value.requireVerifiedEmail),
+		capability: value.capability,
+		groupsSync: bool(value.groupsSync),
 		domain: value.domain,
 		domainVerified: bool(value.domainVerified),
 		validatedAt: date(value.validatedAt, true),
@@ -5595,10 +5629,10 @@ function createAuthClient(options) {
 		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
 		return value;
 	}
-	async function organizationRead(path, input, normalize) {
+	async function organizationRead(path, input, normalize, queryInput = normalizeOrganizationPageInput) {
 		if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
 		const generation = authorityGeneration;
-		const query = normalizeOrganizationPageInput(input);
+		const query = queryInput(input);
 		const value = await requestJson(`${joinURL(authOrigin, "api/v1/auth/organizations", path)}${query.size ? `?${query}` : ""}`, {
 			fetch: fetchImpl,
 			timeoutMs,
@@ -5656,10 +5690,11 @@ function createAuthClient(options) {
 			fetch: fetchImpl,
 			timeoutMs,
 			method,
-			...body ? {
-				headers: { "content-type": "application/json" },
-				body
-			} : {},
+			headers: {
+				...body ? { "content-type": "application/json" } : {},
+				...path.includes("/connection-setup") ? { "x-finueva-connection-setup": "policy" } : {}
+			},
+			...body ? { body } : {},
 			mapError: fromEnterpriseAdministrationError
 		});
 		if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
@@ -6138,7 +6173,7 @@ function createAuthClient(options) {
 			return organizationRead("closing", void 0, normalizeClosingOrganizations);
 		},
 		async listOrganizationMembers(organizationId, input) {
-			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers);
+			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers, normalizeOrganizationMemberPageInput);
 		},
 		async listOrganizationTeams(organizationId, input) {
 			return organizationRead(`${normalizeIdInput(organizationId)}/teams`, input, normalizeOrganizationTeams);
@@ -6191,7 +6226,10 @@ function createAuthClient(options) {
 				clientId: enterpriseInputString(input?.clientId, 256),
 				clientSecret: enterpriseInputString(input?.clientSecret, 512),
 				domain: enterpriseInputString(input?.domain, 253),
-				memberJit: enterpriseInputBoolean(input?.memberJit)
+				memberJit: enterpriseInputBoolean(input?.memberJit),
+				...input?.requireVerifiedEmail === void 0 ? {} : { requireVerifiedEmail: enterpriseInputBoolean(input.requireVerifiedEmail) },
+				...input?.provisioning === void 0 ? {} : { provisioning: enterpriseInputBoolean(input.provisioning) },
+				...input?.groupsSync === void 0 ? {} : { groupsSync: enterpriseInputBoolean(input.groupsSync) }
 			};
 			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup`, body, normalizeEnterpriseConnectionSetup);
 		},
@@ -6201,6 +6239,9 @@ function createAuthClient(options) {
 				issuer: enterpriseInputString(input?.issuer, 2048),
 				clientId: enterpriseInputString(input?.clientId, 256),
 				memberJit: enterpriseInputBoolean(input?.memberJit),
+				...input?.requireVerifiedEmail === void 0 ? {} : { requireVerifiedEmail: enterpriseInputBoolean(input.requireVerifiedEmail) },
+				...input?.provisioning === void 0 ? {} : { provisioning: enterpriseInputBoolean(input.provisioning) },
+				...input?.groupsSync === void 0 ? {} : { groupsSync: enterpriseInputBoolean(input.groupsSync) },
 				...input?.clientSecret === void 0 ? {} : { clientSecret: enterpriseInputString(input.clientSecret, 512) }
 			};
 			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup/${normalizeIdInput(connectionId)}`, body, normalizeEnterpriseConnectionSetup);
@@ -6212,7 +6253,9 @@ function createAuthClient(options) {
 				"validate",
 				"enable",
 				"disable",
-				"archive"
+				"archive",
+				"enable-groups",
+				"disable-groups"
 			].includes(input?.action)) throw new TypeError("Enterprise action is invalid");
 			const body = {
 				expectedRevision: normalizeRevision(input?.expectedRevision),

package/dist/server.d.ts

@@ -1,4 +1,77 @@
-import { At as UpdateOrganizationDisplayInput, B as OrganizationDisplay, C as CreatedOrganizationTeam, F as InvitationDecline, Ft as AuthErrorCode, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorStatus, J as OrganizationTeam, K as OrganizationPage, Lt as UserApiCredential, Nt as WorkspaceSelection, O as DriveCredential, P as InvitationAcceptance, Pt as AuthError, Q as OrganizationWorkspaceSelection, Rt as UserApiCredentialInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenProvider, T as DeletedOrganizationTeam, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamMemberPage, Y as OrganizationTeamDisplay, Z as OrganizationTeamPage, b as CreateOrganizationMemberInvitationInput, d as AuthUser, f as CanceledOrganizationInvitation, ft as RemovedOrganizationMember, i as AuthOrganization, jt as UpdateOrganizationTeamDisplayInput, k as DriveCredentialInput, lt as ReceivedOrganizationInvitation, mt as ResentOrganizationInvitation, n as AddedOrganizationTeamMember, pt as RemovedOrganizationTeamMember, q as OrganizationPageInput, s as AuthSession, t as AcceptInvitationInput, tt as PersonalWorkspaceSelection, ut as ReceivedOrganizationInvitationPage, w as DeclineInvitationInput, x as CreatedOrganization, xt as SocialIdTokenInput, z as OrganizationDeparture } from "./types-CgtPkDeO.js";
+import { $ as OrganizationWorkspaceSelection, B as OrganizationDisplay, C as CreatedOrganizationTeam, Ct as SocialIdTokenProvider, F as InvitationDecline, Ft as AuthError, G as OrganizationMemberPage, H as OrganizationInvitationPage, It as AuthErrorCode, J as OrganizationPageInput, K as OrganizationMemberPageInput, Lt as AuthErrorStatus, Mt as UpdateOrganizationTeamDisplayInput, O as DriveCredential, P as InvitationAcceptance, Pt as WorkspaceSelection, Q as OrganizationTeamPage, Rt as UserApiCredential, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenInput, T as DeletedOrganizationTeam, U as OrganizationMember, V as OrganizationInvitation, W as OrganizationMemberAuthority, X as OrganizationTeamDisplay, Y as OrganizationTeam, Z as OrganizationTeamMemberPage, b as CreateOrganizationMemberInvitationInput, d as AuthUser, dt as ReceivedOrganizationInvitationPage, f as CanceledOrganizationInvitation, ht as ResentOrganizationInvitation, i as AuthOrganization, jt as UpdateOrganizationDisplayInput, k as DriveCredentialInput, mt as RemovedOrganizationTeamMember, n as AddedOrganizationTeamMember, nt as PersonalWorkspaceSelection, pt as RemovedOrganizationMember, q as OrganizationPage, s as AuthSession, t as AcceptInvitationInput, ut as ReceivedOrganizationInvitation, w as DeclineInvitationInput, x as CreatedOrganization, z as OrganizationDeparture, zt as UserApiCredentialInput } from "./types-rx4YxsoH.js";
+//#region src/product-operations/types.d.ts
+type AccountProductOperationPhase = "snapshot" | "consume" | "receipt";
+interface AccountProductOperationProof {
+  applicationCredential: string;
+  serviceAssertion: string;
+  /** Expected verified product identity and registered service; these fields are never sent as authority. */
+  actorUserId: string;
+  actorSessionId: string;
+  serviceId: string;
+  environment: "local" | "development" | "staging" | "production";
+}
+interface AccountProductOperationSnapshotInput {
+  applicationId: string;
+  participantUserUids: string[];
+}
+interface AccountProductOperationInput {
+  applicationId: string;
+  snapshotId: string;
+  operationHash: string;
+  nonce: string;
+}
+interface AccountProductOperationSnapshot {
+  snapshotId: string;
+  actorUserId: string;
+  actorSessionId: string;
+  issuedAt: number;
+  expiresAt: number;
+}
+/** Immutable historical decision. Its original expiry never grants permission for a new commit. */
+interface AccountProductOperationReceipt extends AccountProductOperationSnapshot {
+  serviceId: string;
+  applicationId: string;
+  actorAccountCreatedAt: number;
+  environment: "local" | "development" | "staging" | "production";
+  scopeKind: "account";
+  organizationId: null;
+  nonce: string;
+  operationHash: string;
+  consumedAt: number;
+}
+interface AccountProductOperationConsumer {
+  captureAccountOperation(input: AccountProductOperationSnapshotInput, proof: AccountProductOperationProof): Promise<AccountProductOperationSnapshot>;
+  consumeAccountOperation(input: AccountProductOperationInput, proof: AccountProductOperationProof): Promise<{
+    receipt: AccountProductOperationReceipt;
+    replayed: boolean;
+  }>;
+  retrieveAccountOperationReceipt(input: AccountProductOperationInput, proof: AccountProductOperationProof): Promise<AccountProductOperationReceipt>;
+}
+//#endregion
+//#region src/product-operations/index.d.ts
+interface AccountProductOperationAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}
+/** Server-only. Every call needs a fresh assertion for its exact phase audience. No call retries automatically. */
+declare function createAccountProductOperationAuth(options: AccountProductOperationAuthOptions): AccountProductOperationConsumer & {
+  audience(phase: AccountProductOperationPhase): string;
+};
+//#endregion
+//#region src/application-access.d.ts
+interface OrganizationMemberApplicationAccessInput {
+  applicationId: string;
+  userIds: string[];
+}
+interface OrganizationMemberApplicationAccess {
+  members: Array<{
+    userId: string;
+    latestAppSessionAdmittedAt: string | null;
+    activeAppSessionCount: number;
+  }>;
+}
+//#endregion
 //#region src/google-recovery.d.ts
 interface GoogleAccountRecoveryInput {
   idToken: {
@@ -159,6 +232,9 @@ interface FinuevaServerAuth {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  getOrganizationMemberApplicationAccess(organizationId: string, input: OrganizationMemberApplicationAccessInput, serviceAssertion: string, options?: {
+    applicationCredential: string;
+  }): Promise<OrganizationMemberApplicationAccess>;
   getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
   createOrganization(name: string, slug: string, idempotencyKey: string): Promise<CreatedOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
@@ -172,7 +248,7 @@ interface FinuevaServerAuth {
   deleteOrganizationTeam(organizationId: string, teamId: string, idempotencyKey: string): Promise<DeletedOrganizationTeam>;
   updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
   updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
-  listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
+  listOrganizationMembers(organizationId: string, input?: OrganizationMemberPageInput): Promise<OrganizationMemberPage>;
   listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
   listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
   listOrganizationInvitations(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationInvitationPage>;
@@ -190,4 +266,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };
+export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };