@finueva/auth 0.25.0 → 0.26.0

package/README.md

@@ -450,3 +450,7 @@ Long-form task guides are maintained with the Auth source:
 - [Errors and recovery](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/errors-and-recovery.md)
 
 These links track current source and can describe a newer SDK version. Check the version at the start of the guide. Repository access is required until these guides have a public, versioned documentation deployment.
+
+### Organization presence authorization candidate
+
+The request-scoped server method `authorizeOrganizationPresence(organizationId, { applicationId, userIds }, serviceAssertion, { applicationCredential })` forwards fresh actor, application and registered service proofs. The exact ordered selection contains 1 to 50 Auth User IDs. The supplied application credential remains untrusted proof. Auth checks its signature and exact current actor session. The result binds the actor, organization, application and selected IDs; its observation time is not an authority lease. Your application must enforce its own disclosure and visibility policies. Browser and device clients have no direct service facade. This source candidate requires release and registration qualification before use.

package/dist/server.d.ts

@@ -59,6 +59,23 @@ declare function createAccountProductOperationAuth(options: AccountProductOperat
   audience(phase: AccountProductOperationPhase): string;
 };
 //#endregion
+//#region src/organization-presence.d.ts
+interface OrganizationPresenceInput {
+  applicationId: string;
+  userIds: string[];
+}
+interface OrganizationPresenceAuthorization {
+  organizationId: string;
+  applicationId: string;
+  actor: {
+    userId: string;
+    sessionId: string;
+  };
+  userIds: string[];
+  /** Observation time only. This is not an authority lease or application privacy decision. */
+  checkedAt: Date;
+}
+//#endregion
 //#region src/application-access.d.ts
 interface OrganizationMemberApplicationAccessInput {
   applicationId: string;
@@ -232,6 +249,9 @@ interface FinuevaServerAuth {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  authorizeOrganizationPresence(organizationId: string, input: OrganizationPresenceInput, serviceAssertion: string, options?: {
+    applicationCredential: string;
+  }): Promise<OrganizationPresenceAuthorization>;
   getOrganizationMemberApplicationAccess(organizationId: string, input: OrganizationMemberApplicationAccessInput, serviceAssertion: string, options?: {
     applicationCredential: string;
   }): Promise<OrganizationMemberApplicationAccess>;
@@ -266,4 +286,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };
+export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, FinuevaServerAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationPresenceAuthorization, type OrganizationPresenceInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type WorkspaceSelection, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createServerAuth, createUserApiVerifier };

package/dist/server.js

@@ -496,7 +496,7 @@ var AuthError = class extends Error {
 //#endregion
 //#region src/shared.ts
 const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
-const id$2 = /^[A-Za-z0-9_-]{1,128}$/;
+const id$3 = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
 const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
 function normalizeEmail(value) {
@@ -606,7 +606,7 @@ function normalizeIdInput(value) {
 	return value;
 }
 function normalizeOrganization(value) {
-	exact$5(value, [
+	exact$6(value, [
 		"capabilities",
 		"id",
 		"lifecycle",
@@ -616,7 +616,7 @@ function normalizeOrganization(value) {
 		"slug"
 	]);
 	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject$1(value.capabilities)) throw authorityUnavailable();
-	exact$5(value.capabilities, [
+	exact$6(value.capabilities, [
 		"readInvitations",
 		"readMembers",
 		"readTeams"
@@ -678,7 +678,7 @@ function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganization(value) {
-	exact$5(value, [
+	exact$6(value, [
 		"id",
 		"name",
 		"slug"
@@ -698,7 +698,7 @@ function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganizationTeam(value) {
-	exact$5(value, ["id", "name"]);
+	exact$6(value, ["id", "name"]);
 	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -725,7 +725,7 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 	};
 }
 function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact$5(value, ["expiresAt", "id"]);
+	exact$6(value, ["expiresAt", "id"]);
 	if (!isId(value.id)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -742,7 +742,7 @@ function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeCanceledOrganizationInvitation(value) {
-	exact$5(value, ["status"]);
+	exact$6(value, ["status"]);
 	if (value.status !== "canceled") throw authorityUnavailable();
 	return { status: "canceled" };
 }
@@ -751,12 +751,12 @@ function normalizeOrganizationMembershipRemovalInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeRemovedOrganizationMember(value) {
-	exact$5(value, ["status"]);
+	exact$6(value, ["status"]);
 	if (value.status !== "removed") throw authorityUnavailable();
 	return { status: "removed" };
 }
 function normalizeOrganizationDeparture(value) {
-	exact$5(value, ["status"]);
+	exact$6(value, ["status"]);
 	if (value.status !== "left") throw authorityUnavailable();
 	return { status: "left" };
 }
@@ -765,22 +765,22 @@ function normalizeOrganizationTeamMembershipInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeAddedOrganizationTeamMember(value) {
-	exact$5(value, ["status"]);
+	exact$6(value, ["status"]);
 	if (value.status !== "added") throw authorityUnavailable();
 	return { status: "added" };
 }
 function normalizeRemovedOrganizationTeamMember(value) {
-	exact$5(value, ["status"]);
+	exact$6(value, ["status"]);
 	if (value.status !== "removed") throw authorityUnavailable();
 	return { status: "removed" };
 }
 function normalizeDeletedOrganizationTeam(value) {
-	exact$5(value, ["status"]);
+	exact$6(value, ["status"]);
 	if (value.status !== "deleted") throw authorityUnavailable();
 	return { status: "deleted" };
 }
 function normalizeOrganizations(value) {
-	exact$5(value, ["nextCursor", "organizations"]);
+	exact$6(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
 		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
@@ -788,11 +788,11 @@ function normalizeOrganizations(value) {
 	};
 }
 function normalizeOrganizationMembers(value) {
-	exact$5(value, ["members", "nextCursor"]);
+	exact$6(value, ["members", "nextCursor"]);
 	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
 	return {
 		members: unique(value.members.map((member) => {
-			exact$5(member, [
+			exact$6(member, [
 				"email",
 				"id",
 				"image",
@@ -821,11 +821,11 @@ function normalizeOrganizationMembers(value) {
 	};
 }
 function normalizeOrganizationTeams(value) {
-	exact$5(value, ["nextCursor", "teams"]);
+	exact$6(value, ["nextCursor", "teams"]);
 	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
 	return {
 		teams: unique(value.teams.map((team) => {
-			exact$5(team, [
+			exact$6(team, [
 				"category",
 				"createdAt",
 				"id",
@@ -843,7 +843,7 @@ function normalizeOrganizationTeams(value) {
 	};
 }
 function normalizeOrganizationTeamMembers(value) {
-	exact$5(value, ["memberIds", "nextCursor"]);
+	exact$6(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
 		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
@@ -851,7 +851,7 @@ function normalizeOrganizationTeamMembers(value) {
 	};
 }
 function normalizeOrganizationInvitation(value) {
-	exact$5(value, [
+	exact$6(value, [
 		"createdAt",
 		"email",
 		"expiresAt",
@@ -862,7 +862,7 @@ function normalizeOrganizationInvitation(value) {
 		"teamIds"
 	]);
 	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject$1(value.inviter)) throw authorityUnavailable();
-	exact$5(value.inviter, ["membershipId", "name"]);
+	exact$6(value.inviter, ["membershipId", "name"]);
 	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -879,7 +879,7 @@ function normalizeOrganizationInvitation(value) {
 	};
 }
 function normalizeOrganizationInvitations(value) {
-	exact$5(value, ["invitations", "nextCursor"]);
+	exact$6(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
@@ -887,7 +887,7 @@ function normalizeOrganizationInvitations(value) {
 	};
 }
 function normalizeReceivedInvitation(value) {
-	exact$5(value, [
+	exact$6(value, [
 		"expiresAt",
 		"id",
 		"inviterName",
@@ -896,7 +896,7 @@ function normalizeReceivedInvitation(value) {
 		"teams"
 	]);
 	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject$1(value.organization)) throw authorityUnavailable();
-	exact$5(value.organization, [
+	exact$6(value.organization, [
 		"id",
 		"logo",
 		"name",
@@ -913,7 +913,7 @@ function normalizeReceivedInvitation(value) {
 		},
 		role: value.role,
 		teams: unique(value.teams.map((team) => {
-			exact$5(team, ["id", "name"]);
+			exact$6(team, ["id", "name"]);
 			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
 			return {
 				id: team.id,
@@ -925,7 +925,7 @@ function normalizeReceivedInvitation(value) {
 	};
 }
 function normalizeReceivedInvitations(value) {
-	exact$5(value, ["invitations", "nextCursor"]);
+	exact$6(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
@@ -948,7 +948,7 @@ function normalizeWorkspaceSelection(value) {
 	if (!isObject$1(value)) throw new AuthError("invalid_workspace_selection", 422);
 	const keys = Object.keys(value);
 	if (value.type === "personal" && keys.length === 1 && keys[0] === "type") return { type: "personal" };
-	if (value.type === "organization" && keys.length === 2 && keys.includes("type") && keys.includes("organizationId") && typeof value.organizationId === "string" && id$2.test(value.organizationId)) return {
+	if (value.type === "organization" && keys.length === 2 && keys.includes("type") && keys.includes("organizationId") && typeof value.organizationId === "string" && id$3.test(value.organizationId)) return {
 		type: "organization",
 		organizationId: value.organizationId
 	};
@@ -1015,7 +1015,7 @@ function fromOrganizationMembershipRemovalError(value, status, retryAfter) {
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
 function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact$5(value, [
+	exact$6(value, [
 		"organizationId",
 		"actor",
 		"target"
@@ -1033,7 +1033,7 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 	};
 }
 function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact$5(value, [
+	exact$6(value, [
 		"memberId",
 		"manualRole",
 		"role",
@@ -1124,9 +1124,9 @@ function toDate(value) {
 	return result && Number.isFinite(result.getTime()) ? result : void 0;
 }
 function isId(value) {
-	return typeof value === "string" && id$2.test(value);
+	return typeof value === "string" && id$3.test(value);
 }
-function exact$5(value, keys) {
+function exact$6(value, keys) {
 	if (!isObject$1(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
 function boundedString(value, maximum) {
@@ -1253,20 +1253,20 @@ async function readJson(response, maximum = MAX_RESPONSE_BYTES, signal) {
 }
 //#endregion
 //#region src/product-operations/contract.ts
-const id$1 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+const id$2 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 const digest$1 = /^[a-f0-9]{64}$(?![\s\S])/;
 const credential = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/;
-function exact$4(value, keys) {
+function exact$5(value, keys) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
 }
 function identifier(value) {
-	return typeof value === "string" && id$1.test(value);
+	return typeof value === "string" && id$2.test(value);
 }
 function timestamp(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= 864e13;
 }
 function operationProof(value) {
-	if (!exact$4(value, [
+	if (!exact$5(value, [
 		"applicationCredential",
 		"serviceAssertion",
 		"actorUserId",
@@ -1289,14 +1289,14 @@ function operationProof(value) {
 	};
 }
 function snapshotInput(value) {
-	if (!exact$4(value, ["applicationId", "participantUserUids"]) || !identifier(value.applicationId) || !Array.isArray(value.participantUserUids) || value.participantUserUids.length < 1 || value.participantUserUids.length > 100 || !value.participantUserUids.every((uid, index, all) => identifier(uid) && (index === 0 || all[index - 1] < uid))) throw new AuthError("invalid_request", 400);
+	if (!exact$5(value, ["applicationId", "participantUserUids"]) || !identifier(value.applicationId) || !Array.isArray(value.participantUserUids) || value.participantUserUids.length < 1 || value.participantUserUids.length > 100 || !value.participantUserUids.every((uid, index, all) => identifier(uid) && (index === 0 || all[index - 1] < uid))) throw new AuthError("invalid_request", 400);
 	return {
 		applicationId: value.applicationId,
 		participantUserUids: [...value.participantUserUids]
 	};
 }
 function operationInput(value) {
-	if (!exact$4(value, [
+	if (!exact$5(value, [
 		"applicationId",
 		"snapshotId",
 		"operationHash",
@@ -1327,13 +1327,13 @@ function snapshotFields(value) {
 	};
 }
 function snapshotOutput(value, participants, proof) {
-	if (!exact$4(value, snapshotKeys)) throw authorityUnavailable();
+	if (!exact$5(value, snapshotKeys)) throw authorityUnavailable();
 	const result = snapshotFields(value);
 	if (!participants.includes(result.actorUserId) || result.actorUserId !== proof.actorUserId || result.actorSessionId !== proof.actorSessionId) throw authorityUnavailable();
 	return result;
 }
 function receiptOutput(value, input, proof, phase) {
-	if (!exact$4(value, [
+	if (!exact$5(value, [
 		...snapshotKeys,
 		"serviceId",
 		"applicationId",
@@ -1431,7 +1431,7 @@ function createAccountProductOperationAuth(options) {
 			const expected = operationProof(proof);
 			const { applicationId, ...body } = validated;
 			const value = await exchange("consume", applicationId, body, expected);
-			if (!exact$4(value, ["receipt", "replayed"]) || typeof value.replayed !== "boolean") throw authorityUnavailable();
+			if (!exact$5(value, ["receipt", "replayed"]) || typeof value.replayed !== "boolean") throw authorityUnavailable();
 			return {
 				receipt: receiptOutput(value.receipt, validated, expected, "consume"),
 				replayed: value.replayed
@@ -1446,98 +1446,6 @@ function createAccountProductOperationAuth(options) {
 	};
 }
 //#endregion
-//#region src/application-access.ts
-const id = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
-function applicationAccessInput(input) {
-	if (!input || typeof input.applicationId !== "string" || !id.test(input.applicationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 50 || input.userIds.some((value) => typeof value !== "string" || !id.test(value)) || new Set(input.userIds).size !== input.userIds.length) throw new TypeError("Application access input is invalid");
-	return {
-		applicationId: input.applicationId,
-		userIds: [...input.userIds]
-	};
-}
-function exact$3(value, keys) {
-	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
-}
-function normalizeApplicationAccess(value, userIds) {
-	const invalid = () => new AuthError("identity_authority_unavailable", 503);
-	if (!exact$3(value, ["members"]) || !Array.isArray(value.members) || value.members.length !== userIds.length) throw invalid();
-	return { members: value.members.map((member, index) => {
-		if (!exact$3(member, [
-			"userId",
-			"latestAppSessionAdmittedAt",
-			"activeAppSessionCount"
-		]) || member.userId !== userIds[index] || typeof member.activeAppSessionCount !== "number" || !Number.isSafeInteger(member.activeAppSessionCount) || member.activeAppSessionCount < 0 || member.latestAppSessionAdmittedAt !== null && (typeof member.latestAppSessionAdmittedAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$(?![\s\S])/.test(member.latestAppSessionAdmittedAt) || Number.isNaN(Date.parse(member.latestAppSessionAdmittedAt)) || new Date(member.latestAppSessionAdmittedAt).toISOString() !== member.latestAppSessionAdmittedAt)) throw invalid();
-		return {
-			userId: member.userId,
-			latestAppSessionAdmittedAt: member.latestAppSessionAdmittedAt,
-			activeAppSessionCount: member.activeAppSessionCount
-		};
-	}) };
-}
-//#endregion
-//#region src/google-recovery.ts
-function object(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function validTicket(value) {
-	return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
-}
-function googleRecoveryInput(value, complete) {
-	if (!object(value) || Object.keys(value).sort().join(",") !== (complete ? "idToken,recoveryToken" : "idToken") || !object(value.idToken) || Object.keys(value.idToken).some((key) => key !== "token" && key !== "nonce") || complete && !validTicket(value.recoveryToken)) throw new AuthError("invalid_request", 400);
-	const social = normalizeSocialIdTokenInput({
-		provider: "google",
-		idToken: value.idToken.token,
-		signUp: false,
-		...value.idToken.nonce === void 0 ? {} : { nonce: value.idToken.nonce }
-	});
-	return {
-		idToken: {
-			token: social.idToken,
-			...social.nonce === void 0 ? {} : { nonce: social.nonce }
-		},
-		...complete ? { recoveryToken: value.recoveryToken } : {}
-	};
-}
-function normalizeGoogleRecovery(value, now) {
-	if (!object(value) || Object.keys(value).sort().join(",") !== "expiresAt,recoveryToken" || !validTicket(value.recoveryToken) || typeof value.expiresAt !== "string") throw authorityUnavailable();
-	const expiresAt = Date.parse(value.expiresAt);
-	if (!Number.isFinite(expiresAt) || expiresAt <= now || expiresAt > now + 10 * 6e4) throw authorityUnavailable();
-	return {
-		recoveryToken: value.recoveryToken,
-		expiresAt: value.expiresAt
-	};
-}
-function normalizeGoogleRecoveryCompletion(value) {
-	if (!object(value) || Object.keys(value).join(",") !== "linked" || value.linked !== true) throw authorityUnavailable();
-	return { linked: true };
-}
-function fromGoogleRecoveryError(value, status, retryAfter) {
-	const code = object(value) ? value.code : void 0;
-	if (status === 409 && code === "GOOGLE_RECOVERY_IN_PROGRESS") return new AuthError("google_recovery_in_progress", 409);
-	if (status === 409 && code === "GOOGLE_RECOVERY_NOT_REQUIRED") return new AuthError("google_recovery_not_required", 409);
-	if (status === 403 && code === "GOOGLE_RECOVERY_EMAIL_VERIFICATION_REQUIRED") return new AuthError("email_verification_required", 403);
-	if (status === 400 && code === "GOOGLE_RECOVERY_INVALID") return new AuthError("google_recovery_invalid", 400);
-	if (status === 410 && code === "GOOGLE_RECOVERY_EXPIRED") return new AuthError("google_recovery_expired", 410);
-	if (status === 403 && code === "GOOGLE_RECOVERY_ACCOUNT_MISMATCH") return new AuthError("google_recovery_account_mismatch", 403);
-	if (status === 401 && code === "GOOGLE_RECOVERY_FRESH_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 401);
-	if (code === "GOOGLE_RECOVERY_UNAVAILABLE") return authorityUnavailable();
-	return fromAccountAuthorityError(value, status, retryAfter);
-}
-//#endregion
-//#region src/user-api/credential.ts
-function userApiApplication(input) {
-	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
-	return input.applicationId;
-}
-function normalizeUserApiCredential(value, startedAt) {
-	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
-	return {
-		tokenType: "Bearer",
-		token: value.token,
-		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
-	};
-}
-//#endregion
 //#region ../../node_modules/.pnpm/jose@6.2.4/node_modules/jose/dist/webapi/lib/buffer_utils.js
 const encoder$1 = new TextEncoder();
 const decoder = new TextDecoder();
@@ -2586,6 +2494,139 @@ function decodeJwt(jwt) {
 	return result;
 }
 //#endregion
+//#region src/organization-presence.ts
+const id$1 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+function presenceInput(input) {
+	if (!input || typeof input.applicationId !== "string" || !id$1.test(input.applicationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 50 || input.userIds.some((value) => typeof value !== "string" || !id$1.test(value)) || new Set(input.userIds).size !== input.userIds.length) throw new TypeError("Organization presence selection is invalid");
+	return {
+		applicationId: input.applicationId,
+		userIds: [...input.userIds]
+	};
+}
+function presenceProofActor(token, applicationId) {
+	try {
+		const claims = decodeJwt(token);
+		if (typeof claims.sub !== "string" || !id$1.test(claims.sub) || typeof claims.sid !== "string" || !id$1.test(claims.sid) || claims.app !== applicationId) throw new Error("Invalid projection");
+		return {
+			userId: claims.sub,
+			sessionId: claims.sid
+		};
+	} catch {
+		throw new TypeError("Organization presence credential is invalid");
+	}
+}
+function exact$4(value, keys) {
+	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function normalizePresence(value, organizationId, input, actor) {
+	if (!exact$4(value, [
+		"organizationId",
+		"applicationId",
+		"actor",
+		"userIds",
+		"checkedAt"
+	]) || value.organizationId !== organizationId || value.applicationId !== input.applicationId || !exact$4(value.actor, ["userId", "sessionId"]) || value.actor.userId !== actor.userId || value.actor.sessionId !== actor.sessionId || !Array.isArray(value.userIds) || value.userIds.length !== input.userIds.length || value.userIds.some((userId, index) => userId !== input.userIds[index]) || typeof value.checkedAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$(?![\s\S])/.test(value.checkedAt) || Number.isNaN(Date.parse(value.checkedAt)) || new Date(value.checkedAt).toISOString() !== value.checkedAt) throw new AuthError("identity_authority_unavailable", 503);
+	return {
+		organizationId,
+		applicationId: input.applicationId,
+		actor: { ...actor },
+		userIds: [...input.userIds],
+		checkedAt: new Date(value.checkedAt)
+	};
+}
+//#endregion
+//#region src/application-access.ts
+const id = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+function applicationAccessInput(input) {
+	if (!input || typeof input.applicationId !== "string" || !id.test(input.applicationId) || !Array.isArray(input.userIds) || input.userIds.length < 1 || input.userIds.length > 50 || input.userIds.some((value) => typeof value !== "string" || !id.test(value)) || new Set(input.userIds).size !== input.userIds.length) throw new TypeError("Application access input is invalid");
+	return {
+		applicationId: input.applicationId,
+		userIds: [...input.userIds]
+	};
+}
+function exact$3(value, keys) {
+	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function normalizeApplicationAccess(value, userIds) {
+	const invalid = () => new AuthError("identity_authority_unavailable", 503);
+	if (!exact$3(value, ["members"]) || !Array.isArray(value.members) || value.members.length !== userIds.length) throw invalid();
+	return { members: value.members.map((member, index) => {
+		if (!exact$3(member, [
+			"userId",
+			"latestAppSessionAdmittedAt",
+			"activeAppSessionCount"
+		]) || member.userId !== userIds[index] || typeof member.activeAppSessionCount !== "number" || !Number.isSafeInteger(member.activeAppSessionCount) || member.activeAppSessionCount < 0 || member.latestAppSessionAdmittedAt !== null && (typeof member.latestAppSessionAdmittedAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$(?![\s\S])/.test(member.latestAppSessionAdmittedAt) || Number.isNaN(Date.parse(member.latestAppSessionAdmittedAt)) || new Date(member.latestAppSessionAdmittedAt).toISOString() !== member.latestAppSessionAdmittedAt)) throw invalid();
+		return {
+			userId: member.userId,
+			latestAppSessionAdmittedAt: member.latestAppSessionAdmittedAt,
+			activeAppSessionCount: member.activeAppSessionCount
+		};
+	}) };
+}
+//#endregion
+//#region src/google-recovery.ts
+function object(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validTicket(value) {
+	return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+function googleRecoveryInput(value, complete) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== (complete ? "idToken,recoveryToken" : "idToken") || !object(value.idToken) || Object.keys(value.idToken).some((key) => key !== "token" && key !== "nonce") || complete && !validTicket(value.recoveryToken)) throw new AuthError("invalid_request", 400);
+	const social = normalizeSocialIdTokenInput({
+		provider: "google",
+		idToken: value.idToken.token,
+		signUp: false,
+		...value.idToken.nonce === void 0 ? {} : { nonce: value.idToken.nonce }
+	});
+	return {
+		idToken: {
+			token: social.idToken,
+			...social.nonce === void 0 ? {} : { nonce: social.nonce }
+		},
+		...complete ? { recoveryToken: value.recoveryToken } : {}
+	};
+}
+function normalizeGoogleRecovery(value, now) {
+	if (!object(value) || Object.keys(value).sort().join(",") !== "expiresAt,recoveryToken" || !validTicket(value.recoveryToken) || typeof value.expiresAt !== "string") throw authorityUnavailable();
+	const expiresAt = Date.parse(value.expiresAt);
+	if (!Number.isFinite(expiresAt) || expiresAt <= now || expiresAt > now + 10 * 6e4) throw authorityUnavailable();
+	return {
+		recoveryToken: value.recoveryToken,
+		expiresAt: value.expiresAt
+	};
+}
+function normalizeGoogleRecoveryCompletion(value) {
+	if (!object(value) || Object.keys(value).join(",") !== "linked" || value.linked !== true) throw authorityUnavailable();
+	return { linked: true };
+}
+function fromGoogleRecoveryError(value, status, retryAfter) {
+	const code = object(value) ? value.code : void 0;
+	if (status === 409 && code === "GOOGLE_RECOVERY_IN_PROGRESS") return new AuthError("google_recovery_in_progress", 409);
+	if (status === 409 && code === "GOOGLE_RECOVERY_NOT_REQUIRED") return new AuthError("google_recovery_not_required", 409);
+	if (status === 403 && code === "GOOGLE_RECOVERY_EMAIL_VERIFICATION_REQUIRED") return new AuthError("email_verification_required", 403);
+	if (status === 400 && code === "GOOGLE_RECOVERY_INVALID") return new AuthError("google_recovery_invalid", 400);
+	if (status === 410 && code === "GOOGLE_RECOVERY_EXPIRED") return new AuthError("google_recovery_expired", 410);
+	if (status === 403 && code === "GOOGLE_RECOVERY_ACCOUNT_MISMATCH") return new AuthError("google_recovery_account_mismatch", 403);
+	if (status === 401 && code === "GOOGLE_RECOVERY_FRESH_SIGN_IN_REQUIRED") return new AuthError("recent_sign_in_required", 401);
+	if (code === "GOOGLE_RECOVERY_UNAVAILABLE") return authorityUnavailable();
+	return fromAccountAuthorityError(value, status, retryAfter);
+}
+//#endregion
+//#region src/user-api/credential.ts
+function userApiApplication(input) {
+	if (!input || typeof input.applicationId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(input.applicationId) || input.forceRefresh !== void 0 && typeof input.forceRefresh !== "boolean") throw new TypeError("User API credential input is invalid");
+	return input.applicationId;
+}
+function normalizeUserApiCredential(value, startedAt) {
+	if (!value || typeof value !== "object" || Array.isArray(value) || !("tokenType" in value) || value.tokenType !== "Bearer" || !("token" in value) || typeof value.token !== "string" || value.token.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value.token) || !("expiresIn" in value) || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn < 1 || value.expiresIn > 840 || Object.keys(value).sort().join(",") !== "expiresIn,token,tokenType") throw new AuthError("identity_authority_unavailable", 503);
+	return {
+		tokenType: "Bearer",
+		token: value.token,
+		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
+	};
+}
+//#endregion
 //#region src/user-api/verifier.ts
 const ID = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 const KID = /^[A-Za-z0-9_-]{43}$(?![\s\S])/;
@@ -3394,6 +3435,46 @@ function createServerAuth(options) {
 		getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		async authorizeOrganizationPresence(organizationId, input, serviceAssertion, options) {
+			if (typeof serviceAssertion !== "string" || serviceAssertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(serviceAssertion)) throw new TypeError("Organization presence service assertion is invalid");
+			const organization = normalizeIdInput(organizationId);
+			const body = presenceInput(input);
+			let applicationCredential;
+			if (options !== void 0) {
+				const supplied = options?.applicationCredential;
+				if (typeof supplied !== "string" || supplied.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(supplied)) throw new TypeError("Organization presence credential is invalid");
+				applicationCredential = supplied;
+			} else {
+				const startedAt = now();
+				applicationCredential = normalizeUserApiCredential(await requestJson(joinURL(authOrigin, "api/v1/auth/user-api-credential"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "POST",
+					credentials,
+					headers: {
+						...authHeaders(),
+						"content-type": "application/json"
+					},
+					body: { applicationId: body.applicationId }
+				}), startedAt).token;
+			}
+			const actor = presenceProofActor(applicationCredential, body.applicationId);
+			return normalizePresence(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "presence/authorize"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				maxResponseBytes: 16 * 1024,
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json",
+					"x-finueva-application-credential": applicationCredential,
+					"x-finueva-service-assertion": serviceAssertion
+				},
+				body,
+				mapError: fromOrganizationReadAuthorityError
+			}), organization, body, actor);
+		},
 		async getOrganizationMemberApplicationAccess(organizationId, input, serviceAssertion, options) {
 			if (typeof serviceAssertion !== "string" || serviceAssertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(serviceAssertion)) throw new TypeError("Application access service assertion is invalid");
 			const organization = normalizeIdInput(organizationId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,