@finueva/auth 0.30.0 → 0.32.0

package/README.md

@@ -339,7 +339,7 @@ const recipient = await recipients.resolveRecipient(
 
 The result contains only `{ userId, name, email }`. The SDK trims and lowercases the exact email input. It accepts no additional input fields. Email has a 320-byte UTF-8 limit. The JSON request has a 1024-byte limit. The response has a 4096-byte limit. The canonical ID contains 1 to 128 URL-safe characters. The nonempty name has a 1024-byte UTF-8 limit. A response email must be normalized and match the requested email.
 
-The caller generates one Ed25519 assertion with `typ: "finueva-drive-recipient-assertion+jwt"` and the registered JWK-thumbprint `kid`. Set `aud` to the exact Auth endpoint, such as `https://auth.finueva.com/api/v1/auth/drive-share-recipients/resolve`. Set `iss` and `sub` to the same registered service ID. Include the registered `environment`, `ver: 1`, `principal_type: "ecosystem-service"`, a new bounded `jti`, and `exp = iat + 60` in seconds. Auth permits 30 seconds of clock tolerance. A provisioning assertion cannot replace this assertion. The SDK accepts no keys. Auth verifies the assertion; the SDK checks only its compact syntax and the 16 KiB bearer-header limit.
+The caller generates one Ed25519 assertion with `typ: "finueva-drive-recipient-assertion+jwt"` and the registered JWK-thumbprint `kid`. Set `aud` to the exact Auth endpoint, such as `https://auth.finueva.com/api/v1/auth/drive-share-recipients/resolve`. Set `iss` and `sub` to the same registered service ID. Include the registered `environment`, `ver: 1`, `principal_type: "ecosystem-service"`, a new bounded `jti`, and `exp = iat + 60` in seconds. Optionally include `actorUserId`, the canonical Auth User ID of the User for whom the server resolves the recipient. Take it from the server's verified session, not from request values. It contains 1 to 128 URL-safe characters. Auth limits each actor to 30 resolutions per 60 seconds and rejects an invalid `actorUserId` with status 401. Without `actorUserId`, all requests from the service share 10 resolutions per 60 seconds. Auth permits 30 seconds of clock tolerance. A provisioning assertion cannot replace this assertion. The SDK accepts no keys. Auth verifies the assertion; the SDK checks only its compact syntax and the 16 KiB bearer-header limit.
 
 This client sends no cookies or Origin. It follows no redirects, retains no recipient cache, and makes no automatic retries. It permits one active request per client and no queue. The default deadline is 10 seconds. `timeoutMs` accepts an integer from 1 to 60000. If a custom transport ignores abort, the client rejects new calls until that transport settles. A custom `fetch` must preserve the request's credential and redirect restrictions.
 
@@ -458,4 +458,4 @@ The request-scoped server method `authorizeOrganizationPresence(organizationId,
 
 ### Organization admission candidate
 
-Import `createOrganizationAdmissionAuth`, `createOrganizationAdmissionBillingAuth`, and `createOrganizationAdmissionDirectoryAuth` from `@finueva/auth/server`. These separate clients expose actor setup operations, private billing attestations, and the pending setup directory. Actor operations require a current incoming request and a separate service assertion. Use `organizationAdmissionBodyDigest(operation, input)` and the client's `audience(operation)` when signing each fresh assertion. A pending setup grants no organization membership or Drive authority. This source candidate requires release and hosted qualification before use.
+Import `createOrganizationAdmissionAuth`, `createOrganizationAdmissionBillingAuth`, and `createOrganizationAdmissionDirectoryAuth` from `@finueva/auth/server`. These separate clients expose actor setup operations, private billing attestations, and the pending setup directory. Actor operations require a current incoming request and a separate service assertion. Use `organizationAdmissionBodyDigest(operation, input)` and the client's `audience(operation)` when signing each fresh assertion. A pending setup grants no organization membership or Drive authority. `getCurrentAdmission` returns `null` or an admission whose `state` is `pending` or `active`. Auth keeps no admission policy, cohort, or seal. This source candidate requires release and hosted qualification before use.

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { B as OrganizationDisplay, Bt as AuthErrorCode, C as CreatedOrganizationTeam, Ct as SocialIdTokenProvider, G as OrganizationMemberPage, H as OrganizationInvitationPage, Ht as UserApiCredential, J as OrganizationPageInput, K as OrganizationMemberPageInput, Mt as UpdateOrganizationTeamDisplayInput, Nt as UpdateProfileInput, O as DriveCredential, Ot as TwoFactorStatus, Q as OrganizationTeamPage, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenInput, U as OrganizationMember, Ut as UserApiCredentialInput, V as OrganizationInvitation, Vt as AuthErrorStatus, W as OrganizationMemberAuthority, X as OrganizationTeamDisplay, Y as OrganizationTeam, Z as OrganizationTeamMemberPage, b as CreateOrganizationMemberInvitationInput, c as AuthSessionInventory, dt as ReceivedOrganizationInvitationPage, et as PasskeyInventory, i as AuthOrganization, jt as UpdateOrganizationDisplayInput, k as DriveCredentialInput, m as CeremonyHandoffInput, p as CeremonyHandoff, q as OrganizationPage, s as AuthSession, ut as ReceivedOrganizationInvitation, x as CreatedOrganization, zt as AuthError } from "./types-B_5eALVZ.js";
+import { $ as OrganizationTeam, C as CreatedOrganizationTeam, Dt as SocialIdTokenProvider, Et as SocialIdTokenInput, Ft as UpdateOrganizationDisplayInput, G as OrganizationMemberAuthority, Gt as AuthErrorStatus, H as OrganizationInvitation, It as UpdateOrganizationTeamDisplayInput, J as OrganizationMemberPageInput, K as OrganizationMemberAuthorityV2, Kt as UserApiCredential, Lt as UpdateProfileInput, Mt as TwoFactorStatus, O as DriveCredential, S as CreatedOrganizationMemberInvitation, U as OrganizationInvitationPage, Ut as AuthError, V as OrganizationDisplay, W as OrganizationMember, Wt as AuthErrorCode, X as OrganizationPageInput, Y as OrganizationPage, b as CreateOrganizationMemberInvitationInput, c as AuthSessionInventory, et as OrganizationTeamDisplay, ht as ReceivedOrganizationInvitationPage, i as AuthOrganization, it as PasskeyInventory, k as DriveCredentialInput, m as CeremonyHandoffInput, mt as ReceivedOrganizationInvitation, nt as OrganizationTeamPage, p as CeremonyHandoff, q as OrganizationMemberPage, qt as UserApiCredentialInput, s as AuthSession, tt as OrganizationTeamMemberPage, x as CreatedOrganization } from "./types-BU8vZrhF.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -46,6 +46,7 @@ interface DeviceAuthClient {
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
   getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
+  getOrganizationMemberAuthorityV2(organizationId: string, memberId: string): Promise<OrganizationMemberAuthorityV2>;
   createOrganization(name: string, slug: string, idempotencyKey: string): Promise<CreatedOrganization>;
   createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
   createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
@@ -91,4 +92,4 @@ interface DeviceAuthClient {
 }
 declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type TwoFactorStatus, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };
+export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberAuthorityV2, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type TwoFactorStatus, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };

package/dist/device.js

@@ -743,6 +743,43 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 		target
 	};
 }
+function normalizeOrganizationMemberAuthorityV2(value, organizationId, memberId) {
+	exact$2(value, [
+		"version",
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (value.version !== 2 || value.organizationId !== organizationId || !isId(value.organizationId)) throw authorityUnavailable();
+	const target = value.target;
+	exact$2(target, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision"
+	]);
+	if (target.manualRole !== null) return {
+		version: 2,
+		...normalizeOrganizationMemberAuthority({
+			organizationId: value.organizationId,
+			actor: value.actor,
+			target
+		}, organizationId, memberId)
+	};
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	if (actor.manualRole !== "owner" && actor.manualRole !== "admin" || actor.role !== actor.manualRole || !isId(target.memberId) || target.memberId !== memberId || target.memberId === actor.memberId || target.role !== "member" && target.role !== "admin") throw authorityUnavailable();
+	return {
+		version: 2,
+		organizationId: value.organizationId,
+		actor,
+		target: {
+			memberId: target.memberId,
+			manualRole: null,
+			role: target.role,
+			authorityRevision: normalizeAuthorityResultRevision(target.authorityRevision)
+		}
+	};
+}
 function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
 	exact$2(value, [
 		"memberId",
@@ -1985,6 +2022,11 @@ function createDeviceAuth(options) {
 			const member = normalizeIdInput(memberId);
 			return serializeAuthority(() => organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member)));
 		},
+		async getOrganizationMemberAuthorityV2(organizationId, memberId) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			return serializeAuthority(() => organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthorityV2(value, organization, member), () => new URLSearchParams({ version: "2" })));
+		},
 		createOrganization(name, slug, idempotencyKey) {
 			let body;
 			try {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { $ as OrganizationWorkspaceSelection, A as EnterpriseConnection, At as UpdateEnterpriseConnectionInput, B as OrganizationDisplay, Bt as AuthErrorCode, C as CreatedOrganizationTeam, Ct as SocialIdTokenProvider, D as DepartedOrganizationMemberPage, Dt as TwoFactorEnrollment, E as DepartedOrganizationMember, Et as SuspendedOrganizationMemberStatus, F as InvitationDecline, Ft as OrganizationApplicationRegistration, G as OrganizationMemberPage, H as OrganizationInvitationPage, Ht as UserApiCredential, I as OrganizationClosure, It as RegisterOrganizationApplicationInput, J as OrganizationPageInput, K as OrganizationMemberPageInput, L as OrganizationClosureCancelInput, Lt as RegisteredOrganizationApplication, M as EnterpriseConnectionSetup, Mt as UpdateOrganizationTeamDisplayInput, N as FinuevaAuthClient, Nt as UpdateProfileInput, O as DriveCredential, Ot as TwoFactorStatus, P as InvitationAcceptance, Pt as WorkspaceSelection, Q as OrganizationTeamPage, R as OrganizationClosureStartInput, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenInput, T as DeletedOrganizationTeam, Tt as SuspendedOrganizationMemberPage, U as OrganizationMember, Ut as UserApiCredentialInput, V as OrganizationInvitation, Vt as AuthErrorStatus, W as OrganizationMemberAuthority, X as OrganizationTeamDisplay, Y as OrganizationTeam, Z as OrganizationTeamMemberPage, _ as ClosingOrganization, _t as RotateScimCredentialInput, a as AuthPersistence, at as PlatformRoleApplied, b as CreateOrganizationMemberInvitationInput, bt as SendVerificationEmailInput, c as AuthSessionInventory, ct as PlatformRoleFirstApproval, d as AuthUser, dt as ReceivedOrganizationInvitationPage, et as PasskeyInventory, f as CanceledOrganizationInvitation, ft as RecentAuthenticationStatus, g as CeremonyReturnInput, gt as RestoredOrganizationMember, h as CeremonyRecentAuthenticationRequest, ht as ResentOrganizationInvitation, i as AuthOrganization, it as PlatformRole, j as EnterpriseConnectionAction, jt as UpdateOrganizationDisplayInput, k as DriveCredentialInput, kt as TwoFactorStepUpInput, l as AuthSessionSummary, lt as PlatformStatus, m as CeremonyHandoffInput, mt as RemovedOrganizationTeamMember, n as AddedOrganizationTeamMember, nt as PersonalWorkspaceSelection, o as AuthPersistenceDriver, ot as PlatformRoleApproval, p as CeremonyHandoff, pt as RemovedOrganizationMember, q as OrganizationPage, r as AuthClientOptions, rt as PlatformBootstrapRoleChangeInput, s as AuthSession, st as PlatformRoleChangeRecentAuthenticationInput, t as AcceptInvitationInput, tt as PasskeySummary, u as AuthState, ut as ReceivedOrganizationInvitation, v as ClosingOrganizationList, vt as ScimCredentialIssuance, w as DeclineInvitationInput, wt as SuspendedOrganizationMember, x as CreatedOrganization, xt as SignInInput, y as CreateEnterpriseConnectionInput, yt as ScimCredentialState, z as OrganizationDeparture, zt as AuthError } from "./types-B_5eALVZ.js";
+import { $ as OrganizationTeam, A as EnterpriseConnection, At as SuspendedOrganizationMemberStatus, B as OrganizationDeparture, Bt as RegisterOrganizationApplicationInput, C as CreatedOrganizationTeam, Ct as ScimCredentialState, D as DepartedOrganizationMemberPage, Dt as SocialIdTokenProvider, E as DepartedOrganizationMember, Et as SocialIdTokenInput, F as InvitationAcceptance, Ft as UpdateOrganizationDisplayInput, G as OrganizationMemberAuthority, Gt as AuthErrorStatus, H as OrganizationInvitation, I as InvitationDecline, It as UpdateOrganizationTeamDisplayInput, J as OrganizationMemberPageInput, K as OrganizationMemberAuthorityV2, Kt as UserApiCredential, L as OrganizationClosure, Lt as UpdateProfileInput, M as EnterpriseConnectionDomain, Mt as TwoFactorStatus, N as EnterpriseConnectionSetup, Nt as TwoFactorStepUpInput, O as DriveCredential, Ot as SuspendedOrganizationMember, P as FinuevaAuthClient, Pt as UpdateEnterpriseConnectionInput, Q as OrganizationSignInStates, R as OrganizationClosureCancelInput, Rt as WorkspaceSelection, S as CreatedOrganizationMemberInvitation, St as ScimCredentialIssuance, T as DeletedOrganizationTeam, Tt as SignInInput, U as OrganizationInvitationPage, Ut as AuthError, V as OrganizationDisplay, Vt as RegisteredOrganizationApplication, W as OrganizationMember, Wt as AuthErrorCode, X as OrganizationPageInput, Y as OrganizationPage, Z as OrganizationSignInState, _ as ClosingOrganization, _t as RemovedOrganizationMember, a as AuthPersistence, at as PasskeySummary, b as CreateOrganizationMemberInvitationInput, bt as RestoredOrganizationMember, c as AuthSessionInventory, ct as PlatformRole, d as AuthUser, dt as PlatformRoleChangeRecentAuthenticationInput, et as OrganizationTeamDisplay, f as CanceledOrganizationInvitation, ft as PlatformRoleFirstApproval, g as CeremonyReturnInput, gt as RecentAuthenticationStatus, h as CeremonyRecentAuthenticationRequest, ht as ReceivedOrganizationInvitationPage, i as AuthOrganization, it as PasskeyInventory, j as EnterpriseConnectionAction, jt as TwoFactorEnrollment, k as DriveCredentialInput, kt as SuspendedOrganizationMemberPage, l as AuthSessionSummary, lt as PlatformRoleApplied, m as CeremonyHandoffInput, mt as ReceivedOrganizationInvitation, n as AddedOrganizationTeamMember, nt as OrganizationTeamPage, o as AuthPersistenceDriver, ot as PersonalWorkspaceSelection, p as CeremonyHandoff, pt as PlatformStatus, q as OrganizationMemberPage, qt as UserApiCredentialInput, r as AuthClientOptions, rt as OrganizationWorkspaceSelection, s as AuthSession, st as PlatformBootstrapRoleChangeInput, t as AcceptInvitationInput, tt as OrganizationTeamMemberPage, u as AuthState, ut as PlatformRoleApproval, v as ClosingOrganizationList, vt as RemovedOrganizationTeamMember, w as DeclineInvitationInput, wt as SendVerificationEmailInput, x as CreatedOrganization, xt as RotateScimCredentialInput, y as CreateEnterpriseConnectionInput, yt as ResentOrganizationInvitation, z as OrganizationClosureStartInput, zt as OrganizationApplicationRegistration } from "./types-BU8vZrhF.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateEnterpriseConnectionInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type EnterpriseConnectionAction, type EnterpriseConnectionSetup, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationApplicationRegistration, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateEnterpriseConnectionInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AddedOrganizationTeamMember, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthSessionInventory, type AuthSessionSummary, type AuthState, type AuthUser, type CanceledOrganizationInvitation, type CeremonyHandoff, type CeremonyHandoffInput, type CeremonyRecentAuthenticationRequest, type CeremonyReturnInput, type ClosingOrganization, type ClosingOrganizationList, type CreateEnterpriseConnectionInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DeclineInvitationInput, type DeletedOrganizationTeam, type DepartedOrganizationMember, type DepartedOrganizationMemberPage, type DriveCredential, type DriveCredentialInput, type EnterpriseConnection, type EnterpriseConnectionAction, type EnterpriseConnectionDomain, type EnterpriseConnectionSetup, type FinuevaAuthClient, type InvitationAcceptance, type InvitationDecline, type OrganizationApplicationRegistration, type OrganizationClosure, type OrganizationClosureCancelInput, type OrganizationClosureStartInput, type OrganizationDeparture, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberAuthorityV2, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationSignInState, type OrganizationSignInStates, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PasskeyInventory, type PasskeySummary, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type RestoredOrganizationMember, type RotateScimCredentialInput, type ScimCredentialIssuance, type ScimCredentialState, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type SuspendedOrganizationMember, type SuspendedOrganizationMemberPage, type SuspendedOrganizationMemberStatus, type TwoFactorEnrollment, type TwoFactorStatus, type TwoFactorStepUpInput, type UpdateEnterpriseConnectionInput, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type UserApiCredential, type UserApiCredentialInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -865,6 +865,43 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 		target
 	};
 }
+function normalizeOrganizationMemberAuthorityV2(value, organizationId, memberId) {
+	exact$4(value, [
+		"version",
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (value.version !== 2 || value.organizationId !== organizationId || !isId(value.organizationId)) throw authorityUnavailable();
+	const target = value.target;
+	exact$4(target, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision"
+	]);
+	if (target.manualRole !== null) return {
+		version: 2,
+		...normalizeOrganizationMemberAuthority({
+			organizationId: value.organizationId,
+			actor: value.actor,
+			target
+		}, organizationId, memberId)
+	};
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	if (actor.manualRole !== "owner" && actor.manualRole !== "admin" || actor.role !== actor.manualRole || !isId(target.memberId) || target.memberId !== memberId || target.memberId === actor.memberId || target.role !== "member" && target.role !== "admin") throw authorityUnavailable();
+	return {
+		version: 2,
+		organizationId: value.organizationId,
+		actor,
+		target: {
+			memberId: target.memberId,
+			manualRole: null,
+			role: target.role,
+			authorityRevision: normalizeAuthorityResultRevision(target.authorityRevision)
+		}
+	};
+}
 function normalizeOrganizationOwnershipTransferResult(value) {
 	exact$4(value, [
 		"status",
@@ -5197,9 +5234,11 @@ const setupKeys = [
 	"enabled",
 	"memberJit",
 	"requireVerifiedEmail",
+	"requireOrganizationSignIn",
 	"capability",
 	"groupsSync",
 	"domain",
+	"domains",
 	"domainVerified",
 	"validatedAt",
 	"testedAt",
@@ -5208,8 +5247,37 @@ const setupKeys = [
 	"challengeExpiresAt",
 	"redirectUri"
 ];
+const domainPattern = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
+function normalizeConnectionDomain(value) {
+	if (!exact(value, [
+		"domain",
+		"revision",
+		"primary",
+		"verified",
+		"dnsRecordName",
+		"dnsRecordValue",
+		"challengeExpiresAt"
+	]) || typeof value.domain !== "string" || value.domain.length > 253 || !domainPattern.test(value.domain) || !Number.isSafeInteger(value.revision) || value.revision < 0 || value.dnsRecordName !== `_finueva-sso.${value.domain}` || typeof value.dnsRecordValue !== "string" || !/^finueva-sso=[A-Za-z0-9_-]{43}$/.test(value.dnsRecordValue)) throw authorityUnavailable();
+	return {
+		domain: value.domain,
+		revision: value.revision,
+		primary: bool(value.primary),
+		verified: bool(value.verified),
+		dnsRecordName: value.dnsRecordName,
+		dnsRecordValue: value.dnsRecordValue,
+		challengeExpiresAt: date(value.challengeExpiresAt, false)
+	};
+}
+function enterpriseDomainInput(value) {
+	if (typeof value !== "string" || value.length > 253 || !domainPattern.test(value)) throw new TypeError("Enterprise domain is invalid");
+	return value;
+}
 function normalizeEnterpriseConnectionSetup(value) {
-	if (!exact(value, setupKeys) || value.capability !== "federated_sign_in" && value.capability !== "managed_lifecycle" || typeof value.id !== "string" || !idPattern.test(value.id) || typeof value.issuer !== "string" || value.issuer.length > 2048 || !value.issuer.startsWith("https://") || typeof value.clientId !== "string" || value.clientId.length < 1 || value.clientId.length > 256 || typeof value.domain !== "string" || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(value.domain) || value.domain.length > 253 || value.dnsRecordName !== `_finueva-sso.${value.domain}` || typeof value.dnsRecordValue !== "string" || !/^finueva-sso=[A-Za-z0-9_-]{43}$/.test(value.dnsRecordValue) || typeof value.redirectUri !== "string" || value.redirectUri.length > 2048 || !Number.isSafeInteger(value.revision) || value.revision < 0) throw authorityUnavailable();
+	if (!exact(value, setupKeys) || value.capability !== "federated_sign_in" && value.capability !== "managed_lifecycle" || typeof value.id !== "string" || !idPattern.test(value.id) || typeof value.issuer !== "string" || value.issuer.length > 2048 || !value.issuer.startsWith("https://") || typeof value.clientId !== "string" || value.clientId.length < 1 || value.clientId.length > 256 || value.domain !== null && (typeof value.domain !== "string" || !domainPattern.test(value.domain) || value.domain.length > 253 || value.dnsRecordName !== `_finueva-sso.${value.domain}` || typeof value.dnsRecordValue !== "string" || !/^finueva-sso=[A-Za-z0-9_-]{43}$/.test(value.dnsRecordValue)) || value.domain === null && (value.dnsRecordName !== null || value.dnsRecordValue !== null || value.challengeExpiresAt !== null || value.domainVerified !== false) || !Array.isArray(value.domains) || value.domains.length > 10 || typeof value.redirectUri !== "string" || value.redirectUri.length > 2048 || !Number.isSafeInteger(value.revision) || value.revision < 0) throw authorityUnavailable();
+	const domains = value.domains.map(normalizeConnectionDomain);
+	const primary = domains.filter((domain) => domain.primary);
+	const challengeExpiresAt = date(value.challengeExpiresAt, value.domain === null);
+	if (new Set(domains.map((domain) => domain.domain)).size !== domains.length || (value.domain === null ? primary.length !== 0 : primary.length !== 1 || primary[0].domain !== value.domain || primary[0].dnsRecordName !== value.dnsRecordName || primary[0].dnsRecordValue !== value.dnsRecordValue || primary[0].verified !== value.domainVerified || primary[0].challengeExpiresAt.getTime() !== challengeExpiresAt?.getTime())) throw authorityUnavailable();
 	let redirect;
 	try {
 		redirect = new URL(value.redirectUri);
@@ -5225,15 +5293,17 @@ function normalizeEnterpriseConnectionSetup(value) {
 		enabled: bool(value.enabled),
 		memberJit: bool(value.memberJit),
 		requireVerifiedEmail: bool(value.requireVerifiedEmail),
+		requireOrganizationSignIn: bool(value.requireOrganizationSignIn),
 		capability: value.capability,
 		groupsSync: bool(value.groupsSync),
 		domain: value.domain,
+		domains,
 		domainVerified: bool(value.domainVerified),
 		validatedAt: date(value.validatedAt, true),
 		testedAt: date(value.testedAt, true),
 		dnsRecordName: value.dnsRecordName,
 		dnsRecordValue: value.dnsRecordValue,
-		challengeExpiresAt: date(value.challengeExpiresAt, false),
+		challengeExpiresAt,
 		redirectUri: value.redirectUri
 	};
 }
@@ -5264,6 +5334,17 @@ function normalizeEnterpriseTestAuthorization(value) {
 	if (url.protocol !== "https:" || url.username || url.password || url.hash || !url.searchParams.get("state") || url.searchParams.get("response_type") !== "code") throw authorityUnavailable();
 	return { url: value.url };
 }
+function normalizeOrganizationSignInState(value) {
+	if (exact(value, ["status", "mode"]) && value.status === "available" && (value.mode === "membership" || value.mode === "provider")) return {
+		status: value.status,
+		mode: value.mode
+	};
+	if (exact(value, ["status", "connectionId"]) && value.status === "sign_in_required" && typeof value.connectionId === "string" && idPattern.test(value.connectionId)) return {
+		status: value.status,
+		connectionId: value.connectionId
+	};
+	throw authorityUnavailable();
+}
 //#endregion
 //#region src/user-api/credential.ts
 function userApiApplication(input) {
@@ -5762,7 +5843,7 @@ function createAuthClient(options) {
 			method,
 			headers: {
 				...body ? { "content-type": "application/json" } : {},
-				...path.includes("/connection-setup") ? { "x-finueva-connection-setup": "policy" } : {}
+				...path.includes("/connection-setup") ? { "x-finueva-connection-setup": "domains" } : {}
 			},
 			...body ? { body } : {},
 			mapError: fromEnterpriseAdministrationError
@@ -5999,11 +6080,19 @@ function createAuthClient(options) {
 		async getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		async getOrganizationSignInState(organizationId) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/sign-in-state`, void 0, normalizeOrganizationSignInState);
+		},
 		async getOrganizationMemberAuthority(organizationId, memberId) {
 			const organization = normalizeIdInput(organizationId);
 			const member = normalizeIdInput(memberId);
 			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
 		},
+		async getOrganizationMemberAuthorityV2(organizationId, memberId) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthorityV2(value, organization, member), () => new URLSearchParams({ version: "2" }));
+		},
 		getOrganizationApplicationRegistration(organizationId, applicationId) {
 			return organizationRead(registrationTarget(organizationId, applicationId), void 0, (value) => normalizeOrganizationApplicationRegistration(value, organizationId, applicationId));
 		},
@@ -6315,12 +6404,14 @@ function createAuthClient(options) {
 				issuer: enterpriseInputString(input?.issuer, 2048),
 				clientId: enterpriseInputString(input?.clientId, 256),
 				clientSecret: enterpriseInputString(input?.clientSecret, 512),
-				domain: enterpriseInputString(input?.domain, 253),
+				domain: input?.domain === null ? null : enterpriseDomainInput(input?.domain),
 				memberJit: enterpriseInputBoolean(input?.memberJit),
 				...input?.requireVerifiedEmail === void 0 ? {} : { requireVerifiedEmail: enterpriseInputBoolean(input.requireVerifiedEmail) },
+				...input?.requireOrganizationSignIn === void 0 ? {} : { requireOrganizationSignIn: enterpriseInputBoolean(input.requireOrganizationSignIn) },
 				...input?.provisioning === void 0 ? {} : { provisioning: enterpriseInputBoolean(input.provisioning) },
 				...input?.groupsSync === void 0 ? {} : { groupsSync: enterpriseInputBoolean(input.groupsSync) }
 			};
+			if (body.domain === null && body.memberJit) throw new TypeError("Automatic membership requires an enterprise domain");
 			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup`, body, normalizeEnterpriseConnectionSetup);
 		},
 		async updateEnterpriseConnection(organizationId, connectionId, input) {
@@ -6330,6 +6421,7 @@ function createAuthClient(options) {
 				clientId: enterpriseInputString(input?.clientId, 256),
 				memberJit: enterpriseInputBoolean(input?.memberJit),
 				...input?.requireVerifiedEmail === void 0 ? {} : { requireVerifiedEmail: enterpriseInputBoolean(input.requireVerifiedEmail) },
+				...input?.requireOrganizationSignIn === void 0 ? {} : { requireOrganizationSignIn: enterpriseInputBoolean(input.requireOrganizationSignIn) },
 				...input?.provisioning === void 0 ? {} : { provisioning: enterpriseInputBoolean(input.provisioning) },
 				...input?.groupsSync === void 0 ? {} : { groupsSync: enterpriseInputBoolean(input.groupsSync) },
 				...input?.clientSecret === void 0 ? {} : { clientSecret: enterpriseInputString(input.clientSecret, 512) }
@@ -6353,6 +6445,24 @@ function createAuthClient(options) {
 			};
 			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup/${normalizeIdInput(connectionId)}/actions`, body, normalizeEnterpriseConnectionAction);
 		},
+		async addEnterpriseConnectionDomain(organizationId, connectionId, input) {
+			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup/${normalizeIdInput(connectionId)}/domains`, {
+				expectedRevision: normalizeRevision(input?.expectedRevision),
+				domain: enterpriseDomainInput(input?.domain)
+			}, normalizeEnterpriseConnectionSetup);
+		},
+		async actOnEnterpriseConnectionDomain(organizationId, connectionId, domain, input) {
+			if (![
+				"challenge",
+				"verify",
+				"remove"
+			].includes(input?.action)) throw new TypeError("Enterprise domain action is invalid");
+			return enterpriseRequest("POST", `${normalizeIdInput(organizationId)}/connection-setup/${normalizeIdInput(connectionId)}/domains/${encodeURIComponent(enterpriseDomainInput(domain))}/actions`, {
+				expectedRevision: normalizeRevision(input?.expectedRevision),
+				expectedDomainRevision: normalizeRevision(input?.expectedDomainRevision),
+				action: input.action
+			}, normalizeEnterpriseConnectionSetup);
+		},
 		async getScimCredential(organizationId, connectionId) {
 			return enterpriseRequest("GET", scimCredentialPath(organizationId, connectionId), void 0, (value) => normalizeScimCredentialState(value));
 		},

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { $ as OrganizationWorkspaceSelection, B as OrganizationDisplay, Bt as AuthErrorCode, C as CreatedOrganizationTeam, Ct as SocialIdTokenProvider, F as InvitationDecline, Ft as OrganizationApplicationRegistration, G as OrganizationMemberPage, H as OrganizationInvitationPage, Ht as UserApiCredential, It as RegisterOrganizationApplicationInput, J as OrganizationPageInput, K as OrganizationMemberPageInput, Lt as RegisteredOrganizationApplication, Mt as UpdateOrganizationTeamDisplayInput, O as DriveCredential, P as InvitationAcceptance, Pt as WorkspaceSelection, Q as OrganizationTeamPage, Rt as OrganizationDirectoryEntry, S as CreatedOrganizationMemberInvitation, St as SocialIdTokenInput, T as DeletedOrganizationTeam, U as OrganizationMember, Ut as UserApiCredentialInput, V as OrganizationInvitation, Vt as AuthErrorStatus, W as OrganizationMemberAuthority, X as OrganizationTeamDisplay, Y as OrganizationTeam, Z as OrganizationTeamMemberPage, b as CreateOrganizationMemberInvitationInput, d as AuthUser, dt as ReceivedOrganizationInvitationPage, f as CanceledOrganizationInvitation, ht as ResentOrganizationInvitation, i as AuthOrganization, jt as UpdateOrganizationDisplayInput, k as DriveCredentialInput, mt as RemovedOrganizationTeamMember, n as AddedOrganizationTeamMember, nt as PersonalWorkspaceSelection, pt as RemovedOrganizationMember, q as OrganizationPage, s as AuthSession, t as AcceptInvitationInput, ut as ReceivedOrganizationInvitation, w as DeclineInvitationInput, x as CreatedOrganization, z as OrganizationDeparture, zt as AuthError } from "./types-B_5eALVZ.js";
+import { $ as OrganizationTeam, B as OrganizationDeparture, Bt as RegisterOrganizationApplicationInput, C as CreatedOrganizationTeam, Dt as SocialIdTokenProvider, Et as SocialIdTokenInput, F as InvitationAcceptance, Ft as UpdateOrganizationDisplayInput, G as OrganizationMemberAuthority, Gt as AuthErrorStatus, H as OrganizationInvitation, Ht as OrganizationDirectoryEntry, I as InvitationDecline, It as UpdateOrganizationTeamDisplayInput, J as OrganizationMemberPageInput, K as OrganizationMemberAuthorityV2, Kt as UserApiCredential, O as DriveCredential, Q as OrganizationSignInStates, Rt as WorkspaceSelection, S as CreatedOrganizationMemberInvitation, T as DeletedOrganizationTeam, U as OrganizationInvitationPage, Ut as AuthError, V as OrganizationDisplay, Vt as RegisteredOrganizationApplication, W as OrganizationMember, Wt as AuthErrorCode, X as OrganizationPageInput, Y as OrganizationPage, Z as OrganizationSignInState, _t as RemovedOrganizationMember, b as CreateOrganizationMemberInvitationInput, d as AuthUser, et as OrganizationTeamDisplay, f as CanceledOrganizationInvitation, ht as ReceivedOrganizationInvitationPage, i as AuthOrganization, k as DriveCredentialInput, mt as ReceivedOrganizationInvitation, n as AddedOrganizationTeamMember, nt as OrganizationTeamPage, ot as PersonalWorkspaceSelection, q as OrganizationMemberPage, qt as UserApiCredentialInput, rt as OrganizationWorkspaceSelection, s as AuthSession, t as AcceptInvitationInput, tt as OrganizationTeamMemberPage, vt as RemovedOrganizationTeamMember, w as DeclineInvitationInput, x as CreatedOrganization, yt as ResentOrganizationInvitation, zt as OrganizationApplicationRegistration } from "./types-BU8vZrhF.js";
 //#region src/organization-directory/service.d.ts
 interface OrganizationDirectoryLookupInput {
   organizationId: string;
@@ -203,6 +203,8 @@ interface OrganizationAdmissionInputs {
   withdraw: WithdrawOrganizationAdmissionInput;
   finalize: FinalizeOrganizationAdmissionInput;
 }
+/** Sorted-key JSON. Auth hashes the same form before it compares a signed `bodyDigest` claim. */
+declare function canonical(value: unknown): string;
 /** Hash the strict normalized operation input before signing its bodyDigest claim. No authority is created. */
 declare function organizationAdmissionBodyDigest<Operation extends OrganizationAdmissionOperation>(operation: Operation, input: OrganizationAdmissionInputs[Operation]): Promise<string>;
 /** Server-only actor and current-admission client. Each call needs a fresh exact-body service assertion. */
@@ -505,6 +507,165 @@ interface FinuevaUserDirectoryAuth {
 /** Server-only service assertions. This client has no session authority and performs no automatic retry. */
 declare function createUserDirectoryAuth(options: UserDirectoryAuthOptions): FinuevaUserDirectoryAuth;
 //#endregion
+//#region src/organization-role-events/index.d.ts
+type Role = "owner" | "admin" | "member";
+type OrganizationRoleEventReason = "manual_role_change" | "ownership_transferred_out" | "ownership_transferred_in";
+interface OrganizationRoleEventRoles {
+  manualRole: Role;
+  effectiveRole: Role;
+}
+interface OrganizationRoleEventPriorRoles {
+  /** Null means that no manual contribution existed before the change. */
+  manualRole: Role | null;
+  effectiveRole: Role;
+}
+/** The application-scoped pseudonymous pair of the User Directory. It is not the canonical Auth User ID. */
+interface OrganizationRoleEventUser {
+  userId: string;
+  userGeneration: string;
+}
+interface OrganizationRoleEvent {
+  /** Immutable. A consumer applies each event identifier once. */
+  eventId: string;
+  /** Decimal commit order within the feed. Gaps are normal. Compare as numbers. */
+  sequence: string;
+  occurredAt: number;
+  organization: {
+    id: string;
+    generation: string;
+    name: string;
+  };
+  reason: OrganizationRoleEventReason;
+  /** Equal on the two events of one ownership transfer. */
+  correlationId: string;
+  subject: OrganizationRoleEventUser;
+  /** Null when the actor can no longer be addressed. */
+  actor: OrganizationRoleEventUser | null;
+  before: OrganizationRoleEventRoles;
+  after: OrganizationRoleEventRoles;
+}
+interface OrganizationRoleEventV2 extends Omit<OrganizationRoleEvent, "before"> {
+  before: OrganizationRoleEventPriorRoles;
+}
+interface OrganizationRoleEventsInput {
+  applicationId: string;
+  /** The last checkpoint the consumer stored. Omit it to start at the retained beginning. */
+  after?: string;
+  limit?: number;
+}
+interface OrganizationRoleEventsPage {
+  version: 1;
+  applicationId: string;
+  events: OrganizationRoleEvent[];
+  /** The highest sequence Auth examined. Store it, even when `events` is empty. */
+  checkpoint: string;
+  /** Only `false` means the feed reached its head. */
+  hasMore: boolean;
+}
+interface OrganizationRoleEventsV2Page extends Omit<OrganizationRoleEventsPage, "version" | "events"> {
+  version: 2;
+  events: OrganizationRoleEventV2[];
+}
+interface OrganizationRoleEventsAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}
+interface FinuevaOrganizationRoleEventsAuth {
+  listRoleEvents(input: OrganizationRoleEventsInput, assertion: string): Promise<OrganizationRoleEventsPage>;
+}
+interface FinuevaOrganizationRoleEventsV2Auth {
+  listRoleEvents(input: OrganizationRoleEventsInput, assertion: string): Promise<OrganizationRoleEventsV2Page>;
+}
+/** The stored checkpoint is older than the history Auth retains. Events between it and `earliest` are gone. */
+declare class OrganizationRoleEventCheckpointExpiredError extends AuthError {
+  readonly earliest: string;
+  constructor(earliest: string);
+}
+/**
+ * Server-only service assertions. The client has no session authority and performs no automatic retry.
+ * Each page is checked against the request: the application, an ordered and unique event list, and a checkpoint
+ * that never moves backwards.
+ */
+declare function createOrganizationRoleEventsAuth(options: OrganizationRoleEventsAuthOptions): FinuevaOrganizationRoleEventsAuth;
+/** Explicit version 2. Never downgrades or retries a version 1 response. */
+declare function createOrganizationRoleEventsV2Auth(options: OrganizationRoleEventsAuthOptions): FinuevaOrganizationRoleEventsV2Auth;
+//#endregion
+//#region src/organization-lifecycle/index.d.ts
+/** The only reason Auth accepts. Auth records it; Auth does not verify billing state. */
+type OrganizationServiceClosureReason = "plan_lapsed_retention_expired";
+interface OrganizationServiceClosureInput {
+  applicationId: string;
+  organizationId: string;
+  /** The exact generation the application knows. A recreated organization has another generation. */
+  organizationGeneration: string;
+  reason: OrganizationServiceClosureReason;
+  /** One key for one intended closure. A retry with the same key and request replays the result. */
+  idempotencyKey: string;
+}
+type OrganizationServiceClosure = {
+  /** `started` for this key, also on replay. `already_closing` when another closure is live. */
+  outcome: "started" | "already_closing";
+  organizationId: string;
+  organizationGeneration: string;
+  state: "closing" | "cancelled";
+  startedAt: string;
+  cancelUntil: string;
+  /** The organization's owner can cancel the closure until `cancelUntil`. */
+  canCancel: boolean;
+} |
+/** Auth has no such organization generation registered for the application. */
+{
+  outcome: "not_found";
+} |
+/** The organization cannot enter ordinary closure, for example because it has an enterprise connection. */
+{
+  outcome: "not_eligible";
+};
+interface OrganizationAdminContactsInput {
+  applicationId: string;
+  organizationId: string;
+  organizationGeneration: string;
+}
+interface OrganizationAdminContact {
+  /** The canonical Auth User ID. */
+  userId: string;
+  role: "owner" | "admin";
+  /** A verified address. */
+  email: string;
+  name: string;
+}
+interface OrganizationAdminContacts {
+  applicationId: string;
+  organizationId: string;
+  organizationGeneration: string;
+  /** Owners first. At most 100. */
+  contacts: OrganizationAdminContact[];
+  /** False when the organization has more than 100 owners and administrators with a verified address. */
+  complete: boolean;
+}
+interface OrganizationLifecycleAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}
+interface FinuevaOrganizationLifecycleAuth {
+  /** Needs `organizations:close-lapsed` and an assertion whose `bodyDigest` signs this exact input. */
+  closeOrganization(input: OrganizationServiceClosureInput, assertion: string): Promise<OrganizationServiceClosure>;
+  /** Needs `organizations:admin-contacts`. Null when the active generation is not registered for the application. */
+  listAdminContacts(input: OrganizationAdminContactsInput, assertion: string): Promise<OrganizationAdminContacts | null>;
+}
+/**
+ * Hash the strict closure input before signing it as the assertion's `bodyDigest` claim, with `applicationId` as a
+ * claim too. Auth refuses an assertion whose digest does not match the request it receives. No authority is created.
+ */
+declare function organizationServiceClosureBodyDigest(input: OrganizationServiceClosureInput): Promise<string>;
+/**
+ * Server-only service assertions for an application's organization lifecycle work. The client has no session
+ * authority and performs no automatic retry. Each answer is checked against its request.
+ */
+declare function createOrganizationLifecycleAuth(options: OrganizationLifecycleAuthOptions): FinuevaOrganizationLifecycleAuth;
+//#endregion
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -529,6 +690,8 @@ interface FinuevaServerAuth {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  getOrganizationSignInState(organizationId: string): Promise<OrganizationSignInState>;
+  getOrganizationSignInStates(organizationIds: string[]): Promise<OrganizationSignInStates>;
   authorizeOrganizationPresence(organizationId: string, input: OrganizationPresenceInput, serviceAssertion: string, options?: {
     applicationCredential: string;
   }): Promise<OrganizationPresenceAuthorization>;
@@ -536,6 +699,7 @@ interface FinuevaServerAuth {
     applicationCredential: string;
   }): Promise<OrganizationMemberApplicationAccess>;
   getOrganizationMemberAuthority(organizationId: string, memberId: string): Promise<OrganizationMemberAuthority>;
+  getOrganizationMemberAuthorityV2(organizationId: string, memberId: string): Promise<OrganizationMemberAuthorityV2>;
   /** Browser cookie session and exact registered app Origin required. Native bearer setup is not supported. */
   getOrganizationApplicationRegistration(organizationId: string, applicationId: string): Promise<OrganizationApplicationRegistration>;
   registerOrganizationApplication(organizationId: string, applicationId: string, input: RegisterOrganizationApplicationInput): Promise<RegisteredOrganizationApplication>;
@@ -569,4 +733,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, type AmendOrganizationAdmissionInput, type AttestOrganizationAdmissionInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type CurrentOrganizationAdmissionInput, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinalizeOrganizationAdmissionInput, type FinalizedOrganizationAdmission, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, type FinuevaOrganizationAdmissionAuth, type FinuevaOrganizationAdmissionBillingAuth, type FinuevaOrganizationAdmissionDirectoryAuth, type FinuevaOrganizationDirectoryAuth, FinuevaServerAuth, type FinuevaUserDirectoryAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationAdmission, type OrganizationAdmissionActorOperation, type OrganizationAdmissionActorProof, type OrganizationAdmissionAuthOptions, type OrganizationAdmissionBillingSetup, type OrganizationAdmissionCreator, type OrganizationAdmissionIdentity, type OrganizationAdmissionIdentityInput, type OrganizationAdmissionInputs, type OrganizationAdmissionOperation, type OrganizationAdmissionPage, type OrganizationAdmissionPageInput, type OrganizationAdmissionReceipt, type OrganizationAdmissionSelection, type OrganizationAdmissionSetup, type OrganizationAdmissionSetupInput, type OrganizationApplicationRegistration, type OrganizationDeparture, type OrganizationDirectoryAuthOptions, type OrganizationDirectoryEntry, type OrganizationDirectoryLookupInput, type OrganizationDirectoryPage, type OrganizationDirectorySearchInput, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationPresenceAuthorization, type OrganizationPresenceInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ReserveOrganizationAdmissionInput, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type UserDirectoryAuthOptions, type UserDirectoryBinding, type UserDirectoryEntry, type UserDirectoryListInput, type UserDirectoryLookupInput, type UserDirectoryMember, type UserDirectoryMembersInput, type UserDirectoryMembersPage, type UserDirectoryPage, type UserDirectoryResolveInput, type WithdrawOrganizationAdmissionInput, type WorkspaceSelection, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationAdmissionAuth, createOrganizationAdmissionBillingAuth, createOrganizationAdmissionDirectoryAuth, createOrganizationDirectoryAuth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth, organizationAdmissionBodyDigest };
+export { type AcceptInvitationInput, type AccountProductOperationAuthOptions, type AccountProductOperationConsumer, type AccountProductOperationInput, type AccountProductOperationPhase, type AccountProductOperationProof, type AccountProductOperationReceipt, type AccountProductOperationSnapshot, type AccountProductOperationSnapshotInput, type AddedOrganizationTeamMember, type AmendOrganizationAdmissionInput, type AttestOrganizationAdmissionInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CompleteGoogleAccountRecoveryInput, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type CurrentOrganizationAdmissionInput, type DeclineInvitationInput, type DeletedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinalizeOrganizationAdmissionInput, type FinalizedOrganizationAdmission, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, type FinuevaMembershipResolverAuth, type FinuevaOrganizationAdmissionAuth, type FinuevaOrganizationAdmissionBillingAuth, type FinuevaOrganizationAdmissionDirectoryAuth, type FinuevaOrganizationDirectoryAuth, type FinuevaOrganizationLifecycleAuth, type FinuevaOrganizationRoleEventsAuth, type FinuevaOrganizationRoleEventsV2Auth, FinuevaServerAuth, type FinuevaUserDirectoryAuth, type GoogleAccountRecovery, type GoogleAccountRecoveryInput, type IdentityResolverAuthOptions, type InvitationAcceptance, type InvitationDecline, type MembershipResolverAuthOptions, type OrganizationAdminContact, type OrganizationAdminContacts, type OrganizationAdminContactsInput, type OrganizationAdmission, type OrganizationAdmissionActorOperation, type OrganizationAdmissionActorProof, type OrganizationAdmissionAuthOptions, type OrganizationAdmissionBillingSetup, type OrganizationAdmissionCreator, type OrganizationAdmissionIdentity, type OrganizationAdmissionIdentityInput, type OrganizationAdmissionInputs, type OrganizationAdmissionOperation, type OrganizationAdmissionPage, type OrganizationAdmissionPageInput, type OrganizationAdmissionReceipt, type OrganizationAdmissionSelection, type OrganizationAdmissionSetup, type OrganizationAdmissionSetupInput, type OrganizationApplicationRegistration, type OrganizationDeparture, type OrganizationDirectoryAuthOptions, type OrganizationDirectoryEntry, type OrganizationDirectoryLookupInput, type OrganizationDirectoryPage, type OrganizationDirectorySearchInput, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationLifecycleAuthOptions, type OrganizationMember, type OrganizationMemberApplicationAccess, type OrganizationMemberApplicationAccessInput, type OrganizationMemberAuthority, type OrganizationMemberAuthorityV2, type OrganizationMemberPage, type OrganizationMemberPageInput, type OrganizationPage, type OrganizationPageInput, type OrganizationPresenceAuthorization, type OrganizationPresenceInput, type OrganizationRoleEvent, OrganizationRoleEventCheckpointExpiredError, type OrganizationRoleEventPriorRoles, type OrganizationRoleEventReason, type OrganizationRoleEventRoles, type OrganizationRoleEventUser, type OrganizationRoleEventV2, type OrganizationRoleEventsAuthOptions, type OrganizationRoleEventsInput, type OrganizationRoleEventsPage, type OrganizationRoleEventsV2Page, type OrganizationServiceClosure, type OrganizationServiceClosureInput, type OrganizationServiceClosureReason, type OrganizationSignInState, type OrganizationSignInStates, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RegisterOrganizationApplicationInput, type RegisteredOrganizationApplication, type RemovedOrganizationMember, type RemovedOrganizationTeamMember, type ResentOrganizationInvitation, type ReserveOrganizationAdmissionInput, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolveMembershipBatchInput, type ResolveMembershipInput, type ResolvedIdentity, type ResolvedMembership, type ResolvedMembershipBatch, type ResolvedMembershipRole, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, type UserApiIdentity, type UserApiVerifierOptions, type UserDirectoryAuthOptions, type UserDirectoryBinding, type UserDirectoryEntry, type UserDirectoryListInput, type UserDirectoryLookupInput, type UserDirectoryMember, type UserDirectoryMembersInput, type UserDirectoryMembersPage, type UserDirectoryPage, type UserDirectoryResolveInput, type WithdrawOrganizationAdmissionInput, type WorkspaceSelection, type canonical, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationAdmissionAuth, createOrganizationAdmissionBillingAuth, createOrganizationAdmissionDirectoryAuth, createOrganizationDirectoryAuth, createOrganizationLifecycleAuth, createOrganizationRoleEventsAuth, createOrganizationRoleEventsV2Auth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth, organizationAdmissionBodyDigest, organizationServiceClosureBodyDigest };