@finueva/auth 0.30.0 → 0.31.0

package/dist/server.d.ts

@@ -505,6 +505,73 @@ interface FinuevaUserDirectoryAuth {
 /** Server-only service assertions. This client has no session authority and performs no automatic retry. */
 declare function createUserDirectoryAuth(options: UserDirectoryAuthOptions): FinuevaUserDirectoryAuth;
 //#endregion
+//#region src/organization-role-events/index.d.ts
+type Role = "owner" | "admin" | "member";
+type OrganizationRoleEventReason = "manual_role_change" | "ownership_transferred_out" | "ownership_transferred_in";
+interface OrganizationRoleEventRoles {
+  manualRole: Role;
+  effectiveRole: Role;
+}
+/** The application-scoped pseudonymous pair of the User Directory. It is not the canonical Auth User ID. */
+interface OrganizationRoleEventUser {
+  userId: string;
+  userGeneration: string;
+}
+interface OrganizationRoleEvent {
+  /** Immutable. A consumer applies each event identifier once. */
+  eventId: string;
+  /** Decimal commit order within the feed. Gaps are normal. Compare as numbers. */
+  sequence: string;
+  occurredAt: number;
+  organization: {
+    id: string;
+    generation: string;
+    name: string;
+  };
+  reason: OrganizationRoleEventReason;
+  /** Equal on the two events of one ownership transfer. */
+  correlationId: string;
+  subject: OrganizationRoleEventUser;
+  /** Null when the actor can no longer be addressed. */
+  actor: OrganizationRoleEventUser | null;
+  before: OrganizationRoleEventRoles;
+  after: OrganizationRoleEventRoles;
+}
+interface OrganizationRoleEventsInput {
+  applicationId: string;
+  /** The last checkpoint the consumer stored. Omit it to start at the retained beginning. */
+  after?: string;
+  limit?: number;
+}
+interface OrganizationRoleEventsPage {
+  version: 1;
+  applicationId: string;
+  events: OrganizationRoleEvent[];
+  /** The highest sequence Auth examined. Store it, even when `events` is empty. */
+  checkpoint: string;
+  /** Only `false` means the feed reached its head. */
+  hasMore: boolean;
+}
+interface OrganizationRoleEventsAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}
+interface FinuevaOrganizationRoleEventsAuth {
+  listRoleEvents(input: OrganizationRoleEventsInput, assertion: string): Promise<OrganizationRoleEventsPage>;
+}
+/** The stored checkpoint is older than the history Auth retains. Events between it and `earliest` are gone. */
+declare class OrganizationRoleEventCheckpointExpiredError extends AuthError {
+  readonly earliest: string;
+  constructor(earliest: string);
+}
+/**
+ * Server-only service assertions. The client has no session authority and performs no automatic retry.
+ * Each page is checked against the request: the application, an ordered and unique event list, and a checkpoint
+ * that never moves backwards.
+ */
+declare function createOrganizationRoleEventsAuth(options: OrganizationRoleEventsAuthOptions): FinuevaOrganizationRoleEventsAuth;
+//#endregion
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -569,4 +636,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, type AmendOrganizationAdmissionInput, type AttestOrganizationAdmissionInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type CurrentOrganizationAdmissionInput, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinalizeOrganizationAdmissionInput, type FinalizedOrganizationAdmission, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, type FinuevaOrganizationAdmissionAuth, type FinuevaOrganizationAdmissionBillingAuth, type FinuevaOrganizationAdmissionDirectoryAuth, type FinuevaOrganizationDirectoryAuth, FinuevaServerAuth, type FinuevaUserDirectoryAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationAdmission, type OrganizationAdmissionActorOperation, type OrganizationAdmissionActorProof, type OrganizationAdmissionAuthOptions, type OrganizationAdmissionBillingSetup, type OrganizationAdmissionCreator, type OrganizationAdmissionIdentity, type OrganizationAdmissionIdentityInput, type OrganizationAdmissionInputs, type OrganizationAdmissionOperation, type OrganizationAdmissionPage, type OrganizationAdmissionPageInput, type OrganizationAdmissionReceipt, type OrganizationAdmissionSelection, type OrganizationAdmissionSetup, type OrganizationAdmissionSetupInput, type OrganizationApplicationRegistration, type OrganizationDeparture, type OrganizationDirectoryAuthOptions, type OrganizationDirectoryEntry, type OrganizationDirectoryLookupInput, type OrganizationDirectoryPage, type OrganizationDirectorySearchInput, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationPresenceAuthorization, type OrganizationPresenceInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ReserveOrganizationAdmissionInput, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type UserDirectoryAuthOptions, type UserDirectoryBinding, type UserDirectoryEntry, type UserDirectoryListInput, type UserDirectoryLookupInput, type UserDirectoryMember, type UserDirectoryMembersInput, type UserDirectoryMembersPage, type UserDirectoryPage, type UserDirectoryResolveInput, type WithdrawOrganizationAdmissionInput, type WorkspaceSelection, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationAdmissionAuth, createOrganizationAdmissionBillingAuth, createOrganizationAdmissionDirectoryAuth, createOrganizationDirectoryAuth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth, organizationAdmissionBodyDigest };
+export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, type AmendOrganizationAdmissionInput, type AttestOrganizationAdmissionInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type CurrentOrganizationAdmissionInput, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinalizeOrganizationAdmissionInput, type FinalizedOrganizationAdmission, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, type FinuevaOrganizationAdmissionAuth, type FinuevaOrganizationAdmissionBillingAuth, type FinuevaOrganizationAdmissionDirectoryAuth, type FinuevaOrganizationDirectoryAuth, type FinuevaOrganizationRoleEventsAuth, FinuevaServerAuth, type FinuevaUserDirectoryAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationAdmission, type OrganizationAdmissionActorOperation, type OrganizationAdmissionActorProof, type OrganizationAdmissionAuthOptions, type OrganizationAdmissionBillingSetup, type OrganizationAdmissionCreator, type OrganizationAdmissionIdentity, type OrganizationAdmissionIdentityInput, type OrganizationAdmissionInputs, type OrganizationAdmissionOperation, type OrganizationAdmissionPage, type OrganizationAdmissionPageInput, type OrganizationAdmissionReceipt, type OrganizationAdmissionSelection, type OrganizationAdmissionSetup, type OrganizationAdmissionSetupInput, type OrganizationApplicationRegistration, type OrganizationDeparture, type OrganizationDirectoryAuthOptions, type OrganizationDirectoryEntry, type OrganizationDirectoryLookupInput, type OrganizationDirectoryPage, type OrganizationDirectorySearchInput, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationPresenceAuthorization, type OrganizationPresenceInput, type OrganizationRoleEvent, OrganizationRoleEventCheckpointExpiredError, type OrganizationRoleEventReason, type OrganizationRoleEventRoles, type OrganizationRoleEventUser, type OrganizationRoleEventsAuthOptions, type OrganizationRoleEventsInput, type OrganizationRoleEventsPage, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ReserveOrganizationAdmissionInput, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type UserDirectoryAuthOptions, type UserDirectoryBinding, type UserDirectoryEntry, type UserDirectoryListInput, type UserDirectoryLookupInput, type UserDirectoryMember, type UserDirectoryMembersInput, type UserDirectoryMembersPage, type UserDirectoryPage, type UserDirectoryResolveInput, type WithdrawOrganizationAdmissionInput, type WorkspaceSelection, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationAdmissionAuth, createOrganizationAdmissionBillingAuth, createOrganizationAdmissionDirectoryAuth, createOrganizationDirectoryAuth, createOrganizationRoleEventsAuth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth, organizationAdmissionBodyDigest };

package/dist/server.js

@@ -517,7 +517,7 @@ function normalizeWorkspaceSelection(value) {
 	throw new AuthError("invalid_workspace_selection", 422);
 }
 function fromAuthorityError(value, fallbackStatus, retryAfter) {
-	const mapped = mapError(isObject$1(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
+	const mapped = mapError$1(isObject$1(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
 	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
 }
 function fromAccountAuthorityError(value, status, retryAfter) {
@@ -626,7 +626,7 @@ function fromInvitationAuthorityError(value, status) {
 function fromInvitationError(error) {
 	return error instanceof AuthError ? error : authorityUnavailable();
 }
-function mapError(code, status) {
+function mapError$1(code, status) {
 	if (code === "authentication_required") return {
 		code,
 		status: 401
@@ -3443,7 +3443,7 @@ function createIdentityResolverAuth(options) {
 //#region src/membership-resolution.ts
 const idPattern = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 const isoPattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$(?![\s\S])/;
-const roles = [
+const roles$1 = [
 	"admin",
 	"member",
 	"owner"
@@ -3465,7 +3465,7 @@ function parseMembership(value, organizationId, userId) {
 	if (!exact$1(value, ["membership"])) throw authorityUnavailable();
 	if (value.membership === null) return null;
 	const membership = value.membership;
-	if (!exact$1(membership, membershipKeys) || typeof membership.checkedAt !== "string" || !isoPattern.test(membership.checkedAt) || Number.isNaN(Date.parse(membership.checkedAt)) || typeof membership.manualRole !== "string" || !roles.includes(membership.manualRole) || typeof membership.role !== "string" || !roles.includes(membership.role) || typeof membership.memberCount !== "number" || !Number.isSafeInteger(membership.memberCount) || membership.memberCount < 0 || typeof membership.memberId !== "string" || !idPattern.test(membership.memberId) || typeof membership.owner !== "boolean" || membership.organizationId !== organizationId || membership.userId !== userId) throw authorityUnavailable();
+	if (!exact$1(membership, membershipKeys) || typeof membership.checkedAt !== "string" || !isoPattern.test(membership.checkedAt) || Number.isNaN(Date.parse(membership.checkedAt)) || typeof membership.manualRole !== "string" || !roles$1.includes(membership.manualRole) || typeof membership.role !== "string" || !roles$1.includes(membership.role) || typeof membership.memberCount !== "number" || !Number.isSafeInteger(membership.memberCount) || membership.memberCount < 0 || typeof membership.memberId !== "string" || !idPattern.test(membership.memberId) || typeof membership.owner !== "boolean" || membership.organizationId !== organizationId || membership.userId !== userId) throw authorityUnavailable();
 	return {
 		checkedAt: membership.checkedAt,
 		manualRole: membership.manualRole,
@@ -3870,7 +3870,7 @@ function createDriveProvisioningAuth(options) {
 }
 //#endregion
 //#region src/user-directory.ts
-function user(value, applicationId) {
+function user$1(value, applicationId) {
 	if (!exact$6(value, [
 		"applicationId",
 		"userId",
@@ -3908,7 +3908,7 @@ function nextCursor(value) {
 	return value;
 }
 function selectedUser(value, input) {
-	const normalized = user(value, input.applicationId);
+	const normalized = user$1(value, input.applicationId);
 	if (normalized.userId !== input.userId || normalized.userGeneration !== input.userGeneration) throw authorityUnavailable();
 	return normalized;
 }
@@ -3961,7 +3961,7 @@ function createUserDirectoryAuth(options) {
 			pageInput(input);
 			const value = await exchange("list", input, assertion);
 			if (!exact$6(value, ["users", "nextCursor"]) || !Array.isArray(value.users) || value.users.length > (input.limit ?? 50)) throw authorityUnavailable();
-			const users = value.users.map((item) => user(item, input.applicationId));
+			const users = value.users.map((item) => user$1(item, input.applicationId));
 			if (users.some((item) => item.lifecycle === "deleted") || new Set(users.map((item) => item.userId)).size !== users.length) throw authorityUnavailable();
 			return {
 				users,
@@ -3990,7 +3990,7 @@ function createUserDirectoryAuth(options) {
 					"role",
 					"membershipStatus"
 				]) || item.role !== "owner" && item.role !== "admin" && item.role !== "member" || item.membershipStatus !== "active" && item.membershipStatus !== "suspended") throw authorityUnavailable();
-				const normalized = user(item.user, input.applicationId);
+				const normalized = user$1(item.user, input.applicationId);
 				if (normalized.lifecycle === "deleted") throw authorityUnavailable();
 				return {
 					user: normalized,
@@ -4011,7 +4011,7 @@ function createUserDirectoryAuth(options) {
 			if (!exact$6(input, ["applicationId", "authUserId"]) || !directoryId(input.applicationId) || !directoryId(input.authUserId)) throw new AuthError("invalid_request", 400);
 			const value = await exchange("resolve", input, assertion);
 			if (!exact$6(value, ["user"])) throw authorityUnavailable();
-			const result = value.user === null ? null : user(value.user, input.applicationId);
+			const result = value.user === null ? null : user$1(value.user, input.applicationId);
 			if (result?.lifecycle === "deleted") throw authorityUnavailable();
 			return result;
 		},
@@ -4031,6 +4031,169 @@ function createUserDirectoryAuth(options) {
 	};
 }
 //#endregion
+//#region src/organization-role-events/index.ts
+var OrganizationRoleEventCheckpointExpiredError = class extends AuthError {
+	earliest;
+	constructor(earliest) {
+		super("state_conflict", 409);
+		this.name = "OrganizationRoleEventCheckpointExpiredError";
+		this.earliest = earliest;
+	}
+};
+const checkpointPattern = /^(?:0|[1-9][0-9]{0,15})$(?![\s\S])/;
+const roles = new Set([
+	"owner",
+	"admin",
+	"member"
+]);
+const reasons = new Set([
+	"manual_role_change",
+	"ownership_transferred_out",
+	"ownership_transferred_in"
+]);
+function checkpoint(value) {
+	return typeof value === "string" && checkpointPattern.test(value) && Number.isSafeInteger(Number(value));
+}
+function user(value) {
+	if (!exact$6(value, ["userId", "userGeneration"]) || !directoryGeneration(value.userId) || !directoryGeneration(value.userGeneration)) throw authorityUnavailable();
+	return {
+		userId: value.userId,
+		userGeneration: value.userGeneration
+	};
+}
+function roleSet(value) {
+	if (!exact$6(value, ["manualRole", "effectiveRole"]) || !roles.has(value.manualRole) || !roles.has(value.effectiveRole)) throw authorityUnavailable();
+	return {
+		manualRole: value.manualRole,
+		effectiveRole: value.effectiveRole
+	};
+}
+function event(value) {
+	if (!exact$6(value, [
+		"eventId",
+		"sequence",
+		"occurredAt",
+		"organization",
+		"reason",
+		"correlationId",
+		"subject",
+		"actor",
+		"before",
+		"after"
+	]) || typeof value.eventId !== "string" || !/^rle_[a-f0-9]{32}$(?![\s\S])/.test(value.eventId) || !checkpoint(value.sequence) || value.sequence === "0" || !Number.isSafeInteger(value.occurredAt) || value.occurredAt < 0 || typeof value.correlationId !== "string" || !/^[A-Za-z0-9_-]{43}$(?![\s\S])/.test(value.correlationId) || !reasons.has(value.reason) || !exact$6(value.organization, [
+		"id",
+		"generation",
+		"name"
+	]) || !directoryId(value.organization.id) || !directoryGeneration(value.organization.generation) || typeof value.organization.name !== "string" || value.organization.name.length < 1 || new TextEncoder().encode(value.organization.name).byteLength > 255) throw authorityUnavailable();
+	const organization = value.organization;
+	return {
+		eventId: value.eventId,
+		sequence: value.sequence,
+		occurredAt: value.occurredAt,
+		organization: {
+			id: organization.id,
+			generation: organization.generation,
+			name: organization.name
+		},
+		reason: value.reason,
+		correlationId: value.correlationId,
+		subject: user(value.subject),
+		actor: value.actor === null ? null : user(value.actor),
+		before: roleSet(value.before),
+		after: roleSet(value.after)
+	};
+}
+function listInput(input) {
+	if (!record$1(input) || Object.keys(input).some((key) => ![
+		"applicationId",
+		"after",
+		"limit"
+	].includes(key)) || !directoryId(input.applicationId) || input.after !== void 0 && !checkpoint(input.after) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100)) throw new AuthError("invalid_request", 400);
+}
+function mapError(value, status, retryAfter) {
+	if (status === 409 && exact$6(value, [
+		"code",
+		"message",
+		"earliest"
+	]) && value.code === "CHECKPOINT_EXPIRED" && checkpoint(value.earliest)) return new OrganizationRoleEventCheckpointExpiredError(value.earliest);
+	return fromAuthorityError(value, status, retryAfter);
+}
+function createOrganizationRoleEventsAuth(options) {
+	const origin = normalizeOrigin(options.authOrigin, "authOrigin");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = 0;
+	async function exchange(body, assertion) {
+		if (typeof assertion !== "string" || assertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight >= 4) throw new AuthError("state_conflict", 409);
+		inFlight += 1;
+		const controller = new AbortController();
+		let timer;
+		const deadline = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(authorityUnavailable());
+				controller.abort();
+			}, timeoutMs);
+		});
+		try {
+			return await Promise.race([requestJson(joinURL(origin, "api/v1/auth/organization-role-events/list"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "omit",
+				cache: "no-store",
+				headers: {
+					"x-finueva-service-assertion": assertion,
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body,
+				maxResponseBytes: 256 * 1024,
+				signal: controller.signal,
+				mapError
+			}).finally(() => {
+				inFlight -= 1;
+			}), deadline]);
+		} catch (cause) {
+			if (cause instanceof AuthError) throw cause;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+		}
+	}
+	return { async listRoleEvents(input, assertion) {
+		listInput(input);
+		const value = await exchange(input, assertion);
+		if (!exact$6(value, [
+			"version",
+			"applicationId",
+			"events",
+			"checkpoint",
+			"hasMore"
+		]) || value.version !== 1 || value.applicationId !== input.applicationId || !Array.isArray(value.events) || value.events.length > (input.limit ?? 50) || !checkpoint(value.checkpoint) || typeof value.hasMore !== "boolean") throw authorityUnavailable();
+		const events = value.events.map(event);
+		const floor = Number(input.after ?? "0");
+		let previous = floor;
+		const seen = new Set();
+		for (const item of events) {
+			const sequence = Number(item.sequence);
+			if (sequence <= previous || sequence > Number(value.checkpoint) || seen.has(item.eventId)) throw authorityUnavailable();
+			previous = sequence;
+			seen.add(item.eventId);
+		}
+		if (Number(value.checkpoint) < floor || value.hasMore && Number(value.checkpoint) <= floor) throw authorityUnavailable();
+		return {
+			version: 1,
+			applicationId: input.applicationId,
+			events,
+			checkpoint: value.checkpoint,
+			hasMore: value.hasMore
+		};
+	} };
+}
+//#endregion
 //#region src/server.ts
 const MAX_AUTHORIZATION_BYTES = 16 * 1024;
 function createServerAuth(options) {
@@ -4591,4 +4754,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationAdmissionAuth, createOrganizationAdmissionBillingAuth, createOrganizationAdmissionDirectoryAuth, createOrganizationDirectoryAuth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth, organizationAdmissionBodyDigest };
+export { AuthError, OrganizationRoleEventCheckpointExpiredError, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationAdmissionAuth, createOrganizationAdmissionBillingAuth, createOrganizationAdmissionDirectoryAuth, createOrganizationDirectoryAuth, createOrganizationRoleEventsAuth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth, organizationAdmissionBodyDigest };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,