@finueva/auth 0.30.0 → 0.32.0

package/dist/server.js

@@ -168,7 +168,7 @@ function normalizeIdInput(value) {
 	return value;
 }
 function normalizeOrganization(value) {
-	exact$7(value, [
+	exact$8(value, [
 		"capabilities",
 		"id",
 		"lifecycle",
@@ -178,7 +178,7 @@ function normalizeOrganization(value) {
 		"slug"
 	]);
 	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject$1(value.capabilities)) throw authorityUnavailable();
-	exact$7(value.capabilities, [
+	exact$8(value.capabilities, [
 		"readInvitations",
 		"readMembers",
 		"readTeams"
@@ -240,7 +240,7 @@ function normalizeOrganizationCreationInput(name, slug, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganization(value) {
-	exact$7(value, [
+	exact$8(value, [
 		"id",
 		"name",
 		"slug"
@@ -260,7 +260,7 @@ function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganizationTeam(value) {
-	exact$7(value, ["id", "name"]);
+	exact$8(value, ["id", "name"]);
 	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -287,7 +287,7 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 	};
 }
 function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact$7(value, ["expiresAt", "id"]);
+	exact$8(value, ["expiresAt", "id"]);
 	if (!isId(value.id)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -304,7 +304,7 @@ function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeCanceledOrganizationInvitation(value) {
-	exact$7(value, ["status"]);
+	exact$8(value, ["status"]);
 	if (value.status !== "canceled") throw authorityUnavailable();
 	return { status: "canceled" };
 }
@@ -313,12 +313,12 @@ function normalizeOrganizationMembershipRemovalInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeRemovedOrganizationMember(value) {
-	exact$7(value, ["status"]);
+	exact$8(value, ["status"]);
 	if (value.status !== "removed") throw authorityUnavailable();
 	return { status: "removed" };
 }
 function normalizeOrganizationDeparture(value) {
-	exact$7(value, ["status"]);
+	exact$8(value, ["status"]);
 	if (value.status !== "left") throw authorityUnavailable();
 	return { status: "left" };
 }
@@ -327,22 +327,22 @@ function normalizeOrganizationTeamMembershipInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeAddedOrganizationTeamMember(value) {
-	exact$7(value, ["status"]);
+	exact$8(value, ["status"]);
 	if (value.status !== "added") throw authorityUnavailable();
 	return { status: "added" };
 }
 function normalizeRemovedOrganizationTeamMember(value) {
-	exact$7(value, ["status"]);
+	exact$8(value, ["status"]);
 	if (value.status !== "removed") throw authorityUnavailable();
 	return { status: "removed" };
 }
 function normalizeDeletedOrganizationTeam(value) {
-	exact$7(value, ["status"]);
+	exact$8(value, ["status"]);
 	if (value.status !== "deleted") throw authorityUnavailable();
 	return { status: "deleted" };
 }
 function normalizeOrganizations(value) {
-	exact$7(value, ["nextCursor", "organizations"]);
+	exact$8(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
 		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
@@ -350,11 +350,11 @@ function normalizeOrganizations(value) {
 	};
 }
 function normalizeOrganizationMembers(value) {
-	exact$7(value, ["members", "nextCursor"]);
+	exact$8(value, ["members", "nextCursor"]);
 	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
 	return {
 		members: unique(value.members.map((member) => {
-			exact$7(member, [
+			exact$8(member, [
 				"email",
 				"id",
 				"image",
@@ -383,11 +383,11 @@ function normalizeOrganizationMembers(value) {
 	};
 }
 function normalizeOrganizationTeams(value) {
-	exact$7(value, ["nextCursor", "teams"]);
+	exact$8(value, ["nextCursor", "teams"]);
 	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
 	return {
 		teams: unique(value.teams.map((team) => {
-			exact$7(team, [
+			exact$8(team, [
 				"category",
 				"createdAt",
 				"id",
@@ -405,7 +405,7 @@ function normalizeOrganizationTeams(value) {
 	};
 }
 function normalizeOrganizationTeamMembers(value) {
-	exact$7(value, ["memberIds", "nextCursor"]);
+	exact$8(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
 		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
@@ -413,7 +413,7 @@ function normalizeOrganizationTeamMembers(value) {
 	};
 }
 function normalizeOrganizationInvitation(value) {
-	exact$7(value, [
+	exact$8(value, [
 		"createdAt",
 		"email",
 		"expiresAt",
@@ -424,7 +424,7 @@ function normalizeOrganizationInvitation(value) {
 		"teamIds"
 	]);
 	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject$1(value.inviter)) throw authorityUnavailable();
-	exact$7(value.inviter, ["membershipId", "name"]);
+	exact$8(value.inviter, ["membershipId", "name"]);
 	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -441,7 +441,7 @@ function normalizeOrganizationInvitation(value) {
 	};
 }
 function normalizeOrganizationInvitations(value) {
-	exact$7(value, ["invitations", "nextCursor"]);
+	exact$8(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
@@ -449,7 +449,7 @@ function normalizeOrganizationInvitations(value) {
 	};
 }
 function normalizeReceivedInvitation(value) {
-	exact$7(value, [
+	exact$8(value, [
 		"expiresAt",
 		"id",
 		"inviterName",
@@ -458,7 +458,7 @@ function normalizeReceivedInvitation(value) {
 		"teams"
 	]);
 	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject$1(value.organization)) throw authorityUnavailable();
-	exact$7(value.organization, [
+	exact$8(value.organization, [
 		"id",
 		"logo",
 		"name",
@@ -475,7 +475,7 @@ function normalizeReceivedInvitation(value) {
 		},
 		role: value.role,
 		teams: unique(value.teams.map((team) => {
-			exact$7(team, ["id", "name"]);
+			exact$8(team, ["id", "name"]);
 			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
 			return {
 				id: team.id,
@@ -487,7 +487,7 @@ function normalizeReceivedInvitation(value) {
 	};
 }
 function normalizeReceivedInvitations(value) {
-	exact$7(value, ["invitations", "nextCursor"]);
+	exact$8(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
@@ -517,7 +517,7 @@ function normalizeWorkspaceSelection(value) {
 	throw new AuthError("invalid_workspace_selection", 422);
 }
 function fromAuthorityError(value, fallbackStatus, retryAfter) {
-	const mapped = mapError(isObject$1(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
+	const mapped = mapError$2(isObject$1(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
 	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
 }
 function fromAccountAuthorityError(value, status, retryAfter) {
@@ -577,7 +577,7 @@ function fromOrganizationMembershipRemovalError(value, status, retryAfter) {
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
 function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact$7(value, [
+	exact$8(value, [
 		"organizationId",
 		"actor",
 		"target"
@@ -594,8 +594,45 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 		target
 	};
 }
+function normalizeOrganizationMemberAuthorityV2(value, organizationId, memberId) {
+	exact$8(value, [
+		"version",
+		"organizationId",
+		"actor",
+		"target"
+	]);
+	if (value.version !== 2 || value.organizationId !== organizationId || !isId(value.organizationId)) throw authorityUnavailable();
+	const target = value.target;
+	exact$8(target, [
+		"memberId",
+		"manualRole",
+		"role",
+		"authorityRevision"
+	]);
+	if (target.manualRole !== null) return {
+		version: 2,
+		...normalizeOrganizationMemberAuthority({
+			organizationId: value.organizationId,
+			actor: value.actor,
+			target
+		}, organizationId, memberId)
+	};
+	const actor = normalizeOrganizationAuthorityMemberOutcome(value.actor);
+	if (actor.manualRole !== "owner" && actor.manualRole !== "admin" || actor.role !== actor.manualRole || !isId(target.memberId) || target.memberId !== memberId || target.memberId === actor.memberId || target.role !== "member" && target.role !== "admin") throw authorityUnavailable();
+	return {
+		version: 2,
+		organizationId: value.organizationId,
+		actor,
+		target: {
+			memberId: target.memberId,
+			manualRole: null,
+			role: target.role,
+			authorityRevision: normalizeAuthorityResultRevision(target.authorityRevision)
+		}
+	};
+}
 function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact$7(value, [
+	exact$8(value, [
 		"memberId",
 		"manualRole",
 		"role",
@@ -626,7 +663,7 @@ function fromInvitationAuthorityError(value, status) {
 function fromInvitationError(error) {
 	return error instanceof AuthError ? error : authorityUnavailable();
 }
-function mapError(code, status) {
+function mapError$2(code, status) {
 	if (code === "authentication_required") return {
 		code,
 		status: 401
@@ -688,7 +725,7 @@ function toDate(value) {
 function isId(value) {
 	return typeof value === "string" && id$3.test(value);
 }
-function exact$7(value, keys) {
+function exact$8(value, keys) {
 	if (!isObject$1(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
 function boundedString(value, maximum) {
@@ -736,7 +773,7 @@ function isObject$1(value) {
 function record$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function exact$6(value, keys) {
+function exact$7(value, keys) {
 	return record$1(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
 }
 function directoryId(value) {
@@ -746,7 +783,7 @@ function directoryGeneration(value) {
 	return typeof value === "string" && /^[a-f0-9]{32}$(?![\s\S])/.test(value);
 }
 function normalizeDirectoryEntry(value, applicationId) {
-	if (!exact$6(value, [
+	if (!exact$7(value, [
 		"organizationId",
 		"applicationId",
 		"organizationGeneration",
@@ -770,14 +807,14 @@ function registrationTarget(organizationId, applicationId) {
 	return `${organizationId}/applications/${applicationId}/registration`;
 }
 function registrationInput(input) {
-	if (!exact$6(input, ["organizationGeneration", "idempotencyKey"]) || !directoryGeneration(input.organizationGeneration) || typeof input.idempotencyKey !== "string" || !/^[A-Za-z0-9_-]{16,128}$(?![\s\S])/.test(input.idempotencyKey)) throw new AuthError("invalid_request", 400);
+	if (!exact$7(input, ["organizationGeneration", "idempotencyKey"]) || !directoryGeneration(input.organizationGeneration) || typeof input.idempotencyKey !== "string" || !/^[A-Za-z0-9_-]{16,128}$(?![\s\S])/.test(input.idempotencyKey)) throw new AuthError("invalid_request", 400);
 	return {
 		organizationGeneration: input.organizationGeneration,
 		idempotencyKey: input.idempotencyKey
 	};
 }
 function normalizeOrganizationApplicationRegistration(value, organizationId, applicationId) {
-	if (!exact$6(value, [
+	if (!exact$7(value, [
 		"organizationId",
 		"applicationId",
 		"organizationGeneration",
@@ -793,7 +830,7 @@ function normalizeOrganizationApplicationRegistration(value, organizationId, app
 	};
 }
 function normalizeRegisteredOrganizationApplication(value, organizationId, applicationId, generation) {
-	if (!exact$6(value, ["organization", "outcome"]) || value.outcome !== "registered" && value.outcome !== "replayed") throw authorityUnavailable();
+	if (!exact$7(value, ["organization", "outcome"]) || value.outcome !== "registered" && value.outcome !== "replayed") throw authorityUnavailable();
 	const organization = normalizeDirectoryEntry(value.organization, applicationId);
 	if (organization.organizationId !== organizationId || organization.organizationGeneration !== generation || organization.lifecycle !== "active") throw authorityUnavailable();
 	return {
@@ -1365,13 +1402,13 @@ function createOrganizationDirectoryAuth(options) {
 	}
 	return {
 		async lookupOrganization(input, assertion) {
-			if (!exact$6(input, [
+			if (!exact$7(input, [
 				"organizationId",
 				"applicationId",
 				"organizationGeneration"
 			]) || !directoryId(input.organizationId) || !directoryId(input.applicationId) || !directoryGeneration(input.organizationGeneration)) throw new AuthError("invalid_request", 400);
 			const value = await exchange("lookup", input, assertion);
-			if (!exact$6(value, ["organization"])) throw authorityUnavailable();
+			if (!exact$7(value, ["organization"])) throw authorityUnavailable();
 			if (value.organization === null) return null;
 			const organization = normalizeDirectoryEntry(value.organization, input.applicationId);
 			if (organization.organizationId !== input.organizationId || organization.organizationGeneration !== input.organizationGeneration) throw authorityUnavailable();
@@ -1386,7 +1423,7 @@ function createOrganizationDirectoryAuth(options) {
 			].includes(key)) || !directoryId(input.applicationId) || input.query !== void 0 && (typeof input.query !== "string" || input.query.length < 1 || input.query.length > 128 || Array.from(input.query).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100) || input.cursor !== void 0 && (typeof input.cursor !== "string" || input.cursor.length > 2048)) throw new AuthError("invalid_request", 400);
 			const limit = input.limit ?? 50;
 			const value = await exchange("search", input, assertion);
-			if (!exact$6(value, ["organizations", "nextCursor"]) || !Array.isArray(value.organizations) || value.organizations.length > limit || value.nextCursor !== null && (typeof value.nextCursor !== "string" || !value.nextCursor.length || value.nextCursor.length > 2048)) throw authorityUnavailable();
+			if (!exact$7(value, ["organizations", "nextCursor"]) || !Array.isArray(value.organizations) || value.organizations.length > limit || value.nextCursor !== null && (typeof value.nextCursor !== "string" || !value.nextCursor.length || value.nextCursor.length > 2048)) throw authorityUnavailable();
 			const organizations = value.organizations.map((item) => normalizeDirectoryEntry(item, input.applicationId));
 			if (organizations.some((organization) => organization.lifecycle === "deleted") || new Set(organizations.map((organization) => `${organization.organizationId}:${organization.organizationGeneration}`)).size !== organizations.length) throw authorityUnavailable();
 			return {
@@ -1405,7 +1442,7 @@ const digest$2 = (value) => typeof value === "string" && /^[a-f0-9]{64}$(?![\s\S
 const text = (value) => typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= 255;
 const slug = (value) => typeof value === "string" && /^[a-z0-9-]{1,128}$(?![\s\S])/.test(value);
 function setupInput(input, additional = []) {
-	if (!exact$6(input, [
+	if (!exact$7(input, [
 		"applicationId",
 		"setupId",
 		...additional
@@ -1433,7 +1470,7 @@ const setupKeys = [
 	"amendable"
 ];
 function setup(value, applicationId, setupId) {
-	if (!exact$6(value, setupKeys) || !directoryGeneration(value.setupId) || setupId !== void 0 && value.setupId !== setupId || value.applicationId !== applicationId || !directoryId(value.organizationId) || !directoryGeneration(value.organizationGeneration) || value.kind !== "new" && value.kind !== "existing" || ![
+	if (!exact$7(value, setupKeys) || !directoryGeneration(value.setupId) || setupId !== void 0 && value.setupId !== setupId || value.applicationId !== applicationId || !directoryId(value.organizationId) || !directoryGeneration(value.organizationGeneration) || value.kind !== "new" && value.kind !== "existing" || ![
 		"reserved",
 		"activating",
 		"activated",
@@ -1455,7 +1492,7 @@ function setup(value, applicationId, setupId) {
 	};
 }
 function billingSetup(value, applicationId, setupId) {
-	if (!exact$6(value, [...setupKeys, "creator"]) || !exact$6(value.creator, ["userId", "userGeneration"]) || !directoryGeneration(value.creator.userId) || !directoryGeneration(value.creator.userGeneration)) throw authorityUnavailable();
+	if (!exact$7(value, [...setupKeys, "creator"]) || !exact$7(value.creator, ["userId", "userGeneration"]) || !directoryGeneration(value.creator.userId) || !directoryGeneration(value.creator.userGeneration)) throw authorityUnavailable();
 	const { creator: _creator, ...projection } = value;
 	return {
 		...setup(projection, applicationId, setupId),
@@ -1466,7 +1503,7 @@ function billingSetup(value, applicationId, setupId) {
 	};
 }
 function page(value, input, pending = false) {
-	if (!exact$6(value, ["setups", "nextCursor"]) || !Array.isArray(value.setups) || value.setups.length > (input.limit ?? 25) || value.nextCursor !== null && (typeof value.nextCursor !== "string" || !value.nextCursor.length || value.nextCursor.length > 2048 || value.nextCursor === input.cursor)) throw authorityUnavailable();
+	if (!exact$7(value, ["setups", "nextCursor"]) || !Array.isArray(value.setups) || value.setups.length > (input.limit ?? 25) || value.nextCursor !== null && (typeof value.nextCursor !== "string" || !value.nextCursor.length || value.nextCursor.length > 2048 || value.nextCursor === input.cursor)) throw authorityUnavailable();
 	const setups = value.setups.map((item) => setup(item, input.applicationId));
 	if (new Set(setups.map((item) => item.setupId)).size !== setups.length || pending && setups.some((item) => item.status === "activated")) throw authorityUnavailable();
 	return {
@@ -1475,7 +1512,7 @@ function page(value, input, pending = false) {
 	};
 }
 function admission(value, applicationId, organizationId, generation) {
-	if (!exact$6(value, [
+	if (!exact$7(value, [
 		"applicationId",
 		"organizationId",
 		"organizationGeneration",
@@ -1495,7 +1532,7 @@ function admission(value, applicationId, organizationId, generation) {
 //#endregion
 //#region src/organization-admission/transport.ts
 function actorHeaders(proof) {
-	if (!exact$6(proof, [
+	if (!exact$7(proof, [
 		"serviceAssertion",
 		"request",
 		"appOrigin"
@@ -1583,17 +1620,17 @@ function transport(options, operations) {
 //#region src/organization-admission/index.ts
 function validate(operation, input) {
 	if (operation === "reserve") {
-		if (!exact$6(input, [
+		if (!exact$7(input, [
 			"applicationId",
 			"idempotencyKey",
 			"target"
 		]) || !directoryId(input.applicationId) || typeof input.idempotencyKey !== "string" || !/^[A-Za-z0-9_-]{16,128}$(?![\s\S])/.test(input.idempotencyKey) || !record$1(input.target)) throw invalid$1();
 		const target = input.target;
-		if (target.kind === "new" ? !exact$6(target, [
+		if (target.kind === "new" ? !exact$7(target, [
 			"kind",
 			"name",
 			"slug"
-		]) || !text(target.name) || !slug(target.slug) : target.kind !== "existing" || !exact$6(target, [
+		]) || !text(target.name) || !slug(target.slug) : target.kind !== "existing" || !exact$7(target, [
 			"kind",
 			"organizationId",
 			"organizationGeneration"
@@ -1605,7 +1642,7 @@ function validate(operation, input) {
 			limit: input.limit ?? 25
 		};
 	} else if (operation === "identity") {
-		if (!exact$6(input, ["applicationId", "organizationId"]) || !directoryId(input.applicationId) || !directoryId(input.organizationId)) throw invalid$1();
+		if (!exact$7(input, ["applicationId", "organizationId"]) || !directoryId(input.applicationId) || !directoryId(input.organizationId)) throw invalid$1();
 	} else if (operation === "current") {
 		if (!record$1(input) || Object.keys(input).some((key) => ![
 			"applicationId",
@@ -1636,13 +1673,13 @@ function validate(operation, input) {
 			"receipt"
 		]);
 		const { creator, selection, receipt } = input;
-		if (!directoryId(input.organizationId) || !directoryGeneration(input.organizationGeneration) || !exact$6(creator, ["userId", "userGeneration"]) || !directoryGeneration(creator.userId) || !directoryGeneration(creator.userGeneration) || !exact$6(selection, [
+		if (!directoryId(input.organizationId) || !directoryGeneration(input.organizationGeneration) || !exact$7(creator, ["userId", "userGeneration"]) || !directoryGeneration(creator.userId) || !directoryGeneration(creator.userGeneration) || !exact$7(selection, [
 			"revision",
 			"digest",
 			"planId",
 			"priceId",
 			"seats"
-		]) || !positive(selection.revision) || !digest$2(selection.digest) || !directoryId(selection.planId) || !directoryId(selection.priceId) || !positive(selection.seats) || selection.seats > 1e4 || !exact$6(receipt, [
+		]) || !positive(selection.revision) || !digest$2(selection.digest) || !directoryId(selection.planId) || !directoryId(selection.priceId) || !positive(selection.seats) || selection.seats > 1e4 || !exact$7(receipt, [
 			"id",
 			"revision",
 			"source",
@@ -1681,9 +1718,9 @@ function createOrganizationAdmissionAuth(options) {
 		audience,
 		async getOrganizationIdentity(input, assertion) {
 			const value = await exchange("identity", validate("identity", input), assertion);
-			if (!exact$6(value, ["organization"])) throw authorityUnavailable();
+			if (!exact$7(value, ["organization"])) throw authorityUnavailable();
 			if (value.organization === null) return null;
-			if (!exact$6(value.organization, ["organizationId", "organizationGeneration"]) || value.organization.organizationId !== input.organizationId || !directoryGeneration(value.organization.organizationGeneration)) throw authorityUnavailable();
+			if (!exact$7(value.organization, ["organizationId", "organizationGeneration"]) || value.organization.organizationId !== input.organizationId || !directoryGeneration(value.organization.organizationGeneration)) throw authorityUnavailable();
 			return {
 				organizationId: input.organizationId,
 				organizationGeneration: value.organization.organizationGeneration
@@ -1691,7 +1728,7 @@ function createOrganizationAdmissionAuth(options) {
 		},
 		async amendSetup(input, proof) {
 			const value = await exchange("amend", validate("amend", input), proof.serviceAssertion, proof);
-			if (!exact$6(value, ["setup"])) throw authorityUnavailable();
+			if (!exact$7(value, ["setup"])) throw authorityUnavailable();
 			const result = setup(value.setup, input.applicationId, input.setupId);
 			if (result.kind !== "new" || result.name !== input.name || result.slug !== input.slug || result.displayRevision !== input.expectedDisplayRevision + 1) throw authorityUnavailable();
 			return result;
@@ -1699,14 +1736,14 @@ function createOrganizationAdmissionAuth(options) {
 		async reserveSetup(input, proof) {
 			const body = validate("reserve", input);
 			const value = await exchange("reserve", body, proof.serviceAssertion, proof);
-			if (!exact$6(value, ["setup"])) throw authorityUnavailable();
+			if (!exact$7(value, ["setup"])) throw authorityUnavailable();
 			const result = setup(value.setup, input.applicationId);
 			if (result.kind !== input.target.kind || (input.target.kind === "new" ? result.displayRevision === 1 && (result.name !== input.target.name || result.slug !== input.target.slug) : result.organizationId !== input.target.organizationId || result.organizationGeneration !== input.target.organizationGeneration)) throw authorityUnavailable();
 			return result;
 		},
 		async readSetup(input, proof) {
 			const value = await exchange("read", validate("read", input), proof.serviceAssertion, proof);
-			if (!exact$6(value, ["setup"])) throw authorityUnavailable();
+			if (!exact$7(value, ["setup"])) throw authorityUnavailable();
 			return value.setup === null ? null : setup(value.setup, input.applicationId, input.setupId);
 		},
 		async listSetups(input, proof) {
@@ -1714,12 +1751,12 @@ function createOrganizationAdmissionAuth(options) {
 		},
 		async getCurrentAdmission(input, assertion) {
 			const value = await exchange("current", validate("current", input), assertion);
-			if (!exact$6(value, ["admission"])) throw authorityUnavailable();
+			if (!exact$7(value, ["admission"])) throw authorityUnavailable();
 			return value.admission === null ? null : admission(value.admission, input.applicationId, input.organizationId, input.organizationGeneration);
 		},
 		async finalizeSetup(input, proof) {
 			const value = await exchange("finalize", validate("finalize", input), proof.serviceAssertion, proof);
-			if (!exact$6(value, ["setup", "admission"])) throw authorityUnavailable();
+			if (!exact$7(value, ["setup", "admission"])) throw authorityUnavailable();
 			const result = setup(value.setup, input.applicationId, input.setupId);
 			const active = admission(value.admission, input.applicationId, result.organizationId, result.organizationGeneration);
 			if (result.status !== "activated" || active.state !== "active" || active.basis !== "coverage") throw authorityUnavailable();
@@ -1744,12 +1781,12 @@ function createOrganizationAdmissionBillingAuth(options) {
 		audience,
 		async lookupSetup(input, assertion) {
 			const value = await exchange("lookup", validate("lookup", input), assertion);
-			if (!exact$6(value, ["setup"])) throw authorityUnavailable();
+			if (!exact$7(value, ["setup"])) throw authorityUnavailable();
 			return value.setup === null ? null : billingSetup(value.setup, input.applicationId, input.setupId);
 		},
 		async attestCoverage(input, assertion) {
 			const value = await exchange("attest", validate("attest", input), assertion);
-			if (!exact$6(value, ["setup", "receipt"]) || !exact$6(value.receipt, [
+			if (!exact$7(value, ["setup", "receipt"]) || !exact$7(value.receipt, [
 				"id",
 				"revision",
 				"state"
@@ -1771,7 +1808,7 @@ function createOrganizationAdmissionBillingAuth(options) {
 		},
 		async withdrawCoverage(input, assertion) {
 			const value = await exchange("withdraw", validate("withdraw", input), assertion);
-			if (!exact$6(value, ["setup", "outcome"]) || value.outcome !== "withdrawn" && value.outcome !== "already_activated") throw authorityUnavailable();
+			if (!exact$7(value, ["setup", "outcome"]) || value.outcome !== "withdrawn" && value.outcome !== "already_activated") throw authorityUnavailable();
 			const result = setup(value.setup, input.applicationId, input.setupId);
 			if (value.outcome === "already_activated" !== (result.status === "activated")) throw authorityUnavailable();
 			return {
@@ -1795,7 +1832,7 @@ function createOrganizationAdmissionDirectoryAuth(options) {
 const id$2 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 const digest$1 = /^[a-f0-9]{64}$(?![\s\S])/;
 const credential = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/;
-function exact$5(value, keys) {
+function exact$6(value, keys) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
 }
 function identifier(value) {
@@ -1805,7 +1842,7 @@ function timestamp(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= 864e13;
 }
 function operationProof(value) {
-	if (!exact$5(value, [
+	if (!exact$6(value, [
 		"applicationCredential",
 		"serviceAssertion",
 		"actorUserId",
@@ -1828,14 +1865,14 @@ function operationProof(value) {
 	};
 }
 function snapshotInput(value) {
-	if (!exact$5(value, ["applicationId", "participantUserUids"]) || !identifier(value.applicationId) || !Array.isArray(value.participantUserUids) || value.participantUserUids.length < 1 || value.participantUserUids.length > 100 || !value.participantUserUids.every((uid, index, all) => identifier(uid) && (index === 0 || all[index - 1] < uid))) throw new AuthError("invalid_request", 400);
+	if (!exact$6(value, ["applicationId", "participantUserUids"]) || !identifier(value.applicationId) || !Array.isArray(value.participantUserUids) || value.participantUserUids.length < 1 || value.participantUserUids.length > 100 || !value.participantUserUids.every((uid, index, all) => identifier(uid) && (index === 0 || all[index - 1] < uid))) throw new AuthError("invalid_request", 400);
 	return {
 		applicationId: value.applicationId,
 		participantUserUids: [...value.participantUserUids]
 	};
 }
 function operationInput(value) {
-	if (!exact$5(value, [
+	if (!exact$6(value, [
 		"applicationId",
 		"snapshotId",
 		"operationHash",
@@ -1866,13 +1903,13 @@ function snapshotFields(value) {
 	};
 }
 function snapshotOutput(value, participants, proof) {
-	if (!exact$5(value, snapshotKeys)) throw authorityUnavailable();
+	if (!exact$6(value, snapshotKeys)) throw authorityUnavailable();
 	const result = snapshotFields(value);
 	if (!participants.includes(result.actorUserId) || result.actorUserId !== proof.actorUserId || result.actorSessionId !== proof.actorSessionId) throw authorityUnavailable();
 	return result;
 }
 function receiptOutput(value, input, proof, phase) {
-	if (!exact$5(value, [
+	if (!exact$6(value, [
 		...snapshotKeys,
 		"serviceId",
 		"applicationId",
@@ -1970,7 +2007,7 @@ function createAccountProductOperationAuth(options) {
 			const expected = operationProof(proof);
 			const { applicationId, ...body } = validated;
 			const value = await exchange("consume", applicationId, body, expected);
-			if (!exact$5(value, ["receipt", "replayed"]) || typeof value.replayed !== "boolean") throw authorityUnavailable();
+			if (!exact$6(value, ["receipt", "replayed"]) || typeof value.replayed !== "boolean") throw authorityUnavailable();
 			return {
 				receipt: receiptOutput(value.receipt, validated, expected, "consume"),
 				replayed: value.replayed
@@ -3054,17 +3091,17 @@ function presenceProofActor(token, applicationId) {
 		throw new TypeError("Organization presence credential is invalid");
 	}
 }
-function exact$4(value, keys) {
+function exact$5(value, keys) {
 	return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
 }
 function normalizePresence(value, organizationId, input, actor) {
-	if (!exact$4(value, [
+	if (!exact$5(value, [
 		"organizationId",
 		"applicationId",
 		"actor",
 		"userIds",
 		"checkedAt"
-	]) || value.organizationId !== organizationId || value.applicationId !== input.applicationId || !exact$4(value.actor, ["userId", "sessionId"]) || value.actor.userId !== actor.userId || value.actor.sessionId !== actor.sessionId || !Array.isArray(value.userIds) || value.userIds.length !== input.userIds.length || value.userIds.some((userId, index) => userId !== input.userIds[index]) || typeof value.checkedAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$(?![\s\S])/.test(value.checkedAt) || Number.isNaN(Date.parse(value.checkedAt)) || new Date(value.checkedAt).toISOString() !== value.checkedAt) throw new AuthError("identity_authority_unavailable", 503);
+	]) || value.organizationId !== organizationId || value.applicationId !== input.applicationId || !exact$5(value.actor, ["userId", "sessionId"]) || value.actor.userId !== actor.userId || value.actor.sessionId !== actor.sessionId || !Array.isArray(value.userIds) || value.userIds.length !== input.userIds.length || value.userIds.some((userId, index) => userId !== input.userIds[index]) || typeof value.checkedAt !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$(?![\s\S])/.test(value.checkedAt) || Number.isNaN(Date.parse(value.checkedAt)) || new Date(value.checkedAt).toISOString() !== value.checkedAt) throw new AuthError("identity_authority_unavailable", 503);
 	return {
 		organizationId,
 		applicationId: input.applicationId,
@@ -3074,6 +3111,34 @@ function normalizePresence(value, organizationId, input, actor) {
 	};
 }
 //#endregion
+//#region src/enterprise.ts
+const idPattern$1 = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
+function exact$4(value, keys) {
+	return isObject$1(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function normalizeOrganizationSignInState(value) {
+	if (exact$4(value, ["status", "mode"]) && value.status === "available" && (value.mode === "membership" || value.mode === "provider")) return {
+		status: value.status,
+		mode: value.mode
+	};
+	if (exact$4(value, ["status", "connectionId"]) && value.status === "sign_in_required" && typeof value.connectionId === "string" && idPattern$1.test(value.connectionId)) return {
+		status: value.status,
+		connectionId: value.connectionId
+	};
+	throw authorityUnavailable();
+}
+function normalizeOrganizationSignInStates(value, requestedIds) {
+	if (!exact$4(value, ["organizations"]) || !Array.isArray(value.organizations) || value.organizations.length !== requestedIds.length) throw authorityUnavailable();
+	return { organizations: value.organizations.map((entry, index) => {
+		if (!exact$4(entry, ["organizationId", "state"]) || entry.organizationId !== requestedIds[index]) throw authorityUnavailable();
+		const state = exact$4(entry.state, ["status"]) && entry.state.status === "forbidden" ? { status: "forbidden" } : normalizeOrganizationSignInState(entry.state);
+		return {
+			organizationId: entry.organizationId,
+			state
+		};
+	}) };
+}
+//#endregion
 //#region src/application-access.ts
 const id = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 function applicationAccessInput(input) {
@@ -3443,7 +3508,7 @@ function createIdentityResolverAuth(options) {
 //#region src/membership-resolution.ts
 const idPattern = /^[A-Za-z0-9_-]{1,128}$(?![\s\S])/;
 const isoPattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$(?![\s\S])/;
-const roles = [
+const roles$1 = [
 	"admin",
 	"member",
 	"owner"
@@ -3465,7 +3530,7 @@ function parseMembership(value, organizationId, userId) {
 	if (!exact$1(value, ["membership"])) throw authorityUnavailable();
 	if (value.membership === null) return null;
 	const membership = value.membership;
-	if (!exact$1(membership, membershipKeys) || typeof membership.checkedAt !== "string" || !isoPattern.test(membership.checkedAt) || Number.isNaN(Date.parse(membership.checkedAt)) || typeof membership.manualRole !== "string" || !roles.includes(membership.manualRole) || typeof membership.role !== "string" || !roles.includes(membership.role) || typeof membership.memberCount !== "number" || !Number.isSafeInteger(membership.memberCount) || membership.memberCount < 0 || typeof membership.memberId !== "string" || !idPattern.test(membership.memberId) || typeof membership.owner !== "boolean" || membership.organizationId !== organizationId || membership.userId !== userId) throw authorityUnavailable();
+	if (!exact$1(membership, membershipKeys) || typeof membership.checkedAt !== "string" || !isoPattern.test(membership.checkedAt) || Number.isNaN(Date.parse(membership.checkedAt)) || typeof membership.manualRole !== "string" || !roles$1.includes(membership.manualRole) || typeof membership.role !== "string" || !roles$1.includes(membership.role) || typeof membership.memberCount !== "number" || !Number.isSafeInteger(membership.memberCount) || membership.memberCount < 0 || typeof membership.memberId !== "string" || !idPattern.test(membership.memberId) || typeof membership.owner !== "boolean" || membership.organizationId !== organizationId || membership.userId !== userId) throw authorityUnavailable();
 	return {
 		checkedAt: membership.checkedAt,
 		manualRole: membership.manualRole,
@@ -3870,8 +3935,8 @@ function createDriveProvisioningAuth(options) {
 }
 //#endregion
 //#region src/user-directory.ts
-function user(value, applicationId) {
-	if (!exact$6(value, [
+function user$1(value, applicationId) {
+	if (!exact$7(value, [
 		"applicationId",
 		"userId",
 		"userGeneration",
@@ -3889,7 +3954,7 @@ function user(value, applicationId) {
 	};
 }
 function exactInput(input) {
-	if (!exact$6(input, [
+	if (!exact$7(input, [
 		"applicationId",
 		"userId",
 		"userGeneration"
@@ -3908,7 +3973,7 @@ function nextCursor(value) {
 	return value;
 }
 function selectedUser(value, input) {
-	const normalized = user(value, input.applicationId);
+	const normalized = user$1(value, input.applicationId);
 	if (normalized.userId !== input.userId || normalized.userGeneration !== input.userGeneration) throw authorityUnavailable();
 	return normalized;
 }
@@ -3960,8 +4025,8 @@ function createUserDirectoryAuth(options) {
 		async listUsers(input, assertion) {
 			pageInput(input);
 			const value = await exchange("list", input, assertion);
-			if (!exact$6(value, ["users", "nextCursor"]) || !Array.isArray(value.users) || value.users.length > (input.limit ?? 50)) throw authorityUnavailable();
-			const users = value.users.map((item) => user(item, input.applicationId));
+			if (!exact$7(value, ["users", "nextCursor"]) || !Array.isArray(value.users) || value.users.length > (input.limit ?? 50)) throw authorityUnavailable();
+			const users = value.users.map((item) => user$1(item, input.applicationId));
 			if (users.some((item) => item.lifecycle === "deleted") || new Set(users.map((item) => item.userId)).size !== users.length) throw authorityUnavailable();
 			return {
 				users,
@@ -3971,13 +4036,13 @@ function createUserDirectoryAuth(options) {
 		async lookupUser(input, assertion) {
 			exactInput(input);
 			const value = await exchange("lookup", input, assertion);
-			if (!exact$6(value, ["user"])) throw authorityUnavailable();
+			if (!exact$7(value, ["user"])) throw authorityUnavailable();
 			return value.user === null ? null : selectedUser(value.user, input);
 		},
 		async listOrganizationMembers(input, assertion) {
 			pageInput(input, true);
 			const value = await exchange("members", input, assertion);
-			if (!exact$6(value, [
+			if (!exact$7(value, [
 				"applicationId",
 				"organizationId",
 				"organizationGeneration",
@@ -3985,12 +4050,12 @@ function createUserDirectoryAuth(options) {
 				"nextCursor"
 			]) || value.applicationId !== input.applicationId || value.organizationId !== input.organizationId || value.organizationGeneration !== input.organizationGeneration || !Array.isArray(value.members) || value.members.length > (input.limit ?? 50)) throw authorityUnavailable();
 			const members = value.members.map((item) => {
-				if (!exact$6(item, [
+				if (!exact$7(item, [
 					"user",
 					"role",
 					"membershipStatus"
 				]) || item.role !== "owner" && item.role !== "admin" && item.role !== "member" || item.membershipStatus !== "active" && item.membershipStatus !== "suspended") throw authorityUnavailable();
-				const normalized = user(item.user, input.applicationId);
+				const normalized = user$1(item.user, input.applicationId);
 				if (normalized.lifecycle === "deleted") throw authorityUnavailable();
 				return {
 					user: normalized,
@@ -4008,19 +4073,19 @@ function createUserDirectoryAuth(options) {
 			};
 		},
 		async resolveUser(input, assertion) {
-			if (!exact$6(input, ["applicationId", "authUserId"]) || !directoryId(input.applicationId) || !directoryId(input.authUserId)) throw new AuthError("invalid_request", 400);
+			if (!exact$7(input, ["applicationId", "authUserId"]) || !directoryId(input.applicationId) || !directoryId(input.authUserId)) throw new AuthError("invalid_request", 400);
 			const value = await exchange("resolve", input, assertion);
-			if (!exact$6(value, ["user"])) throw authorityUnavailable();
-			const result = value.user === null ? null : user(value.user, input.applicationId);
+			if (!exact$7(value, ["user"])) throw authorityUnavailable();
+			const result = value.user === null ? null : user$1(value.user, input.applicationId);
 			if (result?.lifecycle === "deleted") throw authorityUnavailable();
 			return result;
 		},
 		async resolveUserBinding(input, assertion) {
 			exactInput(input);
 			const value = await exchange("binding", input, assertion);
-			if (!exact$6(value, ["binding"])) throw authorityUnavailable();
+			if (!exact$7(value, ["binding"])) throw authorityUnavailable();
 			if (value.binding === null) return null;
-			if (!exact$6(value.binding, ["user", "authUserId"]) || !directoryId(value.binding.authUserId)) throw authorityUnavailable();
+			if (!exact$7(value.binding, ["user", "authUserId"]) || !directoryId(value.binding.authUserId)) throw authorityUnavailable();
 			const result = selectedUser(value.binding.user, input);
 			if (result.lifecycle === "deleted") throw authorityUnavailable();
 			return {
@@ -4031,6 +4096,357 @@ function createUserDirectoryAuth(options) {
 	};
 }
 //#endregion
+//#region src/organization-role-events/index.ts
+var OrganizationRoleEventCheckpointExpiredError = class extends AuthError {
+	earliest;
+	constructor(earliest) {
+		super("state_conflict", 409);
+		this.name = "OrganizationRoleEventCheckpointExpiredError";
+		this.earliest = earliest;
+	}
+};
+const checkpointPattern = /^(?:0|[1-9][0-9]{0,15})$(?![\s\S])/;
+const roles = new Set([
+	"owner",
+	"admin",
+	"member"
+]);
+const reasons = new Set([
+	"manual_role_change",
+	"ownership_transferred_out",
+	"ownership_transferred_in"
+]);
+function checkpoint(value) {
+	return typeof value === "string" && checkpointPattern.test(value) && Number.isSafeInteger(Number(value));
+}
+function user(value) {
+	if (!exact$7(value, ["userId", "userGeneration"]) || !directoryGeneration(value.userId) || !directoryGeneration(value.userGeneration)) throw authorityUnavailable();
+	return {
+		userId: value.userId,
+		userGeneration: value.userGeneration
+	};
+}
+function roleSet(value) {
+	if (!exact$7(value, ["manualRole", "effectiveRole"]) || !roles.has(value.manualRole) || !roles.has(value.effectiveRole)) throw authorityUnavailable();
+	return {
+		manualRole: value.manualRole,
+		effectiveRole: value.effectiveRole
+	};
+}
+function priorRoleSet(value) {
+	if (!exact$7(value, ["manualRole", "effectiveRole"]) || value.manualRole !== null && !roles.has(value.manualRole) || !roles.has(value.effectiveRole) || value.manualRole === null && value.effectiveRole === "owner") throw authorityUnavailable();
+	return {
+		manualRole: value.manualRole,
+		effectiveRole: value.effectiveRole
+	};
+}
+function event(value, version) {
+	if (!exact$7(value, [
+		"eventId",
+		"sequence",
+		"occurredAt",
+		"organization",
+		"reason",
+		"correlationId",
+		"subject",
+		"actor",
+		"before",
+		"after"
+	]) || typeof value.eventId !== "string" || !/^rle_[a-f0-9]{32}$(?![\s\S])/.test(value.eventId) || !checkpoint(value.sequence) || value.sequence === "0" || !Number.isSafeInteger(value.occurredAt) || value.occurredAt < 0 || typeof value.correlationId !== "string" || !/^[A-Za-z0-9_-]{43}$(?![\s\S])/.test(value.correlationId) || !reasons.has(value.reason) || !exact$7(value.organization, [
+		"id",
+		"generation",
+		"name"
+	]) || !directoryId(value.organization.id) || !directoryGeneration(value.organization.generation) || typeof value.organization.name !== "string" || value.organization.name.length < 1 || new TextEncoder().encode(value.organization.name).byteLength > 255) throw authorityUnavailable();
+	const organization = value.organization;
+	const before = version === 2 ? priorRoleSet(value.before) : roleSet(value.before);
+	const after = roleSet(value.after);
+	if (before.manualRole === null && (value.reason === "ownership_transferred_out" || value.reason === "ownership_transferred_in" && (after.manualRole !== "owner" || after.effectiveRole !== "owner"))) throw authorityUnavailable();
+	return {
+		eventId: value.eventId,
+		sequence: value.sequence,
+		occurredAt: value.occurredAt,
+		organization: {
+			id: organization.id,
+			generation: organization.generation,
+			name: organization.name
+		},
+		reason: value.reason,
+		correlationId: value.correlationId,
+		subject: user(value.subject),
+		actor: value.actor === null ? null : user(value.actor),
+		before,
+		after
+	};
+}
+function listInput(input) {
+	if (!record$1(input) || Object.keys(input).some((key) => ![
+		"applicationId",
+		"after",
+		"limit"
+	].includes(key)) || !directoryId(input.applicationId) || input.after !== void 0 && !checkpoint(input.after) || input.limit !== void 0 && (!Number.isInteger(input.limit) || input.limit < 1 || input.limit > 100)) throw new AuthError("invalid_request", 400);
+}
+function mapError$1(value, status, retryAfter) {
+	if (status === 409 && exact$7(value, [
+		"code",
+		"message",
+		"earliest"
+	]) && value.code === "CHECKPOINT_EXPIRED" && checkpoint(value.earliest)) return new OrganizationRoleEventCheckpointExpiredError(value.earliest);
+	return fromAuthorityError(value, status, retryAfter);
+}
+function createOrganizationRoleEventsAuth(options) {
+	return createRoleEventsClient(options, 1, (value) => event(value, 1));
+}
+function createOrganizationRoleEventsV2Auth(options) {
+	return createRoleEventsClient(options, 2, (value) => event(value, 2));
+}
+function createRoleEventsClient(options, version, normalizeEvent) {
+	const origin = normalizeOrigin(options.authOrigin, "authOrigin");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = 0;
+	async function exchange(body, assertion) {
+		if (typeof assertion !== "string" || assertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight >= 4) throw new AuthError("state_conflict", 409);
+		inFlight += 1;
+		const controller = new AbortController();
+		let timer;
+		const deadline = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(authorityUnavailable());
+				controller.abort();
+			}, timeoutMs);
+		});
+		try {
+			return await Promise.race([requestJson(joinURL(origin, "api/v1/auth/organization-role-events/list"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "omit",
+				cache: "no-store",
+				headers: {
+					"x-finueva-service-assertion": assertion,
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body,
+				maxResponseBytes: 256 * 1024,
+				signal: controller.signal,
+				mapError: mapError$1
+			}).finally(() => {
+				inFlight -= 1;
+			}), deadline]);
+		} catch (cause) {
+			if (cause instanceof AuthError) throw cause;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+		}
+	}
+	return { async listRoleEvents(input, assertion) {
+		listInput(input);
+		const value = await exchange(version === 2 ? {
+			...input,
+			version: 2
+		} : input, assertion);
+		if (!exact$7(value, [
+			"version",
+			"applicationId",
+			"events",
+			"checkpoint",
+			"hasMore"
+		]) || value.version !== version || value.applicationId !== input.applicationId || !Array.isArray(value.events) || value.events.length > (input.limit ?? 50) || !checkpoint(value.checkpoint) || typeof value.hasMore !== "boolean") throw authorityUnavailable();
+		const events = value.events.map(normalizeEvent);
+		const floor = Number(input.after ?? "0");
+		let previous = floor;
+		const seen = new Set();
+		for (const item of events) {
+			const sequence = Number(item.sequence);
+			if (sequence <= previous || sequence > Number(value.checkpoint) || seen.has(item.eventId)) throw authorityUnavailable();
+			previous = sequence;
+			seen.add(item.eventId);
+		}
+		if (Number(value.checkpoint) < floor || value.hasMore && Number(value.checkpoint) <= floor) throw authorityUnavailable();
+		return {
+			version,
+			applicationId: input.applicationId,
+			events,
+			checkpoint: value.checkpoint,
+			hasMore: value.hasMore
+		};
+	} };
+}
+//#endregion
+//#region src/organization-lifecycle/index.ts
+const keyPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$(?![\s\S])/;
+const timePattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$(?![\s\S])/;
+function closureInput(input) {
+	if (!exact$7(input, [
+		"applicationId",
+		"organizationId",
+		"organizationGeneration",
+		"reason",
+		"idempotencyKey"
+	]) || !directoryId(input.applicationId) || !directoryId(input.organizationId) || !directoryGeneration(input.organizationGeneration) || input.reason !== "plan_lapsed_retention_expired" || typeof input.idempotencyKey !== "string" || !keyPattern.test(input.idempotencyKey)) throw new AuthError("invalid_request", 400);
+	return {
+		applicationId: input.applicationId,
+		organizationId: input.organizationId,
+		organizationGeneration: input.organizationGeneration,
+		reason: input.reason,
+		idempotencyKey: input.idempotencyKey
+	};
+}
+function contactsInput(input) {
+	if (!exact$7(input, [
+		"applicationId",
+		"organizationId",
+		"organizationGeneration"
+	]) || !directoryId(input.applicationId) || !directoryId(input.organizationId) || !directoryGeneration(input.organizationGeneration)) throw new AuthError("invalid_request", 400);
+	return {
+		applicationId: input.applicationId,
+		organizationId: input.organizationId,
+		organizationGeneration: input.organizationGeneration
+	};
+}
+async function organizationServiceClosureBodyDigest(input) {
+	const bytes = new TextEncoder().encode(canonical(closureInput(input)));
+	return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+var Outcome = class extends Error {
+	outcome;
+	constructor(outcome) {
+		super(outcome);
+		this.outcome = outcome;
+	}
+};
+function mapError(value, status, retryAfter) {
+	const code = exact$7(value, ["code", "message"]) ? value.code : void 0;
+	if (status === 404 && code === "NOT_FOUND") return new Outcome("not_found");
+	if (status === 412 && code === "PRECONDITION_FAILED") return new Outcome("not_eligible");
+	if (status === 400) return new AuthError("invalid_request", 400);
+	if (status === 403) return new AuthError("access_denied", 403);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	return authorityUnavailable();
+}
+function createOrganizationLifecycleAuth(options) {
+	const origin = normalizeOrigin(options.authOrigin, "authOrigin");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = 0;
+	async function exchange(operation, body, assertion) {
+		if (typeof assertion !== "string" || assertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(assertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight >= 4) throw new AuthError("state_conflict", 409);
+		inFlight += 1;
+		const controller = new AbortController();
+		let timer;
+		const deadline = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(authorityUnavailable());
+				controller.abort();
+			}, timeoutMs);
+		});
+		try {
+			return await Promise.race([requestJson(joinURL(origin, "api/v1/auth/organization-lifecycle", operation), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials: "omit",
+				cache: "no-store",
+				headers: {
+					"x-finueva-service-assertion": assertion,
+					"content-type": "application/json",
+					accept: "application/json"
+				},
+				body,
+				maxResponseBytes: 128 * 1024,
+				signal: controller.signal,
+				mapError
+			}).finally(() => {
+				inFlight -= 1;
+			}), deadline]);
+		} catch (cause) {
+			if (cause instanceof AuthError || cause instanceof Outcome) throw cause;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+		}
+	}
+	return {
+		async closeOrganization(input, assertion) {
+			const selected = closureInput(input);
+			let value;
+			try {
+				value = await exchange("close", selected, assertion);
+			} catch (cause) {
+				if (cause instanceof Outcome) return { outcome: cause.outcome };
+				throw cause;
+			}
+			if (!exact$7(value, [
+				"organizationId",
+				"organizationGeneration",
+				"closure",
+				"state",
+				"startedAt",
+				"cancelUntil",
+				"canCancel"
+			]) || value.organizationId !== selected.organizationId || value.organizationGeneration !== selected.organizationGeneration || value.closure !== "started" && value.closure !== "already_closing" || value.state !== "closing" && value.state !== "cancelled" || typeof value.startedAt !== "string" || !timePattern.test(value.startedAt) || typeof value.cancelUntil !== "string" || !timePattern.test(value.cancelUntil) || Date.parse(value.cancelUntil) <= Date.parse(value.startedAt) || typeof value.canCancel !== "boolean") throw authorityUnavailable();
+			return {
+				outcome: value.closure,
+				organizationId: selected.organizationId,
+				organizationGeneration: selected.organizationGeneration,
+				state: value.state,
+				startedAt: value.startedAt,
+				cancelUntil: value.cancelUntil,
+				canCancel: value.canCancel
+			};
+		},
+		async listAdminContacts(input, assertion) {
+			const selected = contactsInput(input);
+			let value;
+			try {
+				value = await exchange("admin-contacts", selected, assertion);
+			} catch (cause) {
+				if (cause instanceof Outcome) {
+					if (cause.outcome === "not_found") return null;
+					throw authorityUnavailable();
+				}
+				throw cause;
+			}
+			if (!exact$7(value, [
+				"applicationId",
+				"organizationId",
+				"organizationGeneration",
+				"contacts",
+				"complete"
+			]) || value.applicationId !== selected.applicationId || value.organizationId !== selected.organizationId || value.organizationGeneration !== selected.organizationGeneration || !Array.isArray(value.contacts) || value.contacts.length > 100 || typeof value.complete !== "boolean") throw authorityUnavailable();
+			const contacts = value.contacts.map((item) => {
+				if (!exact$7(item, [
+					"userId",
+					"role",
+					"email",
+					"name"
+				]) || !directoryId(item.userId) || item.role !== "owner" && item.role !== "admin" || typeof item.email !== "string" || item.email.length < 3 || item.email.length > 320 || !item.email.includes("@") || typeof item.name !== "string" || item.name.length > 1024) throw authorityUnavailable();
+				return {
+					userId: item.userId,
+					role: item.role,
+					email: item.email,
+					name: item.name
+				};
+			});
+			if (new Set(contacts.map((contact) => contact.userId)).size !== contacts.length) throw authorityUnavailable();
+			return {
+				...selected,
+				contacts,
+				complete: value.complete
+			};
+		}
+	};
+}
+//#endregion
 //#region src/server.ts
 const MAX_AUTHORIZATION_BYTES = 16 * 1024;
 function createServerAuth(options) {
@@ -4142,6 +4558,14 @@ function createServerAuth(options) {
 		getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		getOrganizationSignInState(organizationId) {
+			return organizationRead(`${normalizeIdInput(organizationId)}/sign-in-state`, void 0, normalizeOrganizationSignInState);
+		},
+		getOrganizationSignInStates(organizationIds) {
+			if (!Array.isArray(organizationIds) || !organizationIds.length || organizationIds.length > 50 || new Set(organizationIds).size !== organizationIds.length) throw new AuthError("invalid_request", 400);
+			const ids = organizationIds.map(normalizeIdInput);
+			return organizationRead("sign-in-states", void 0, (value) => normalizeOrganizationSignInStates(value, ids), () => new URLSearchParams({ organizationIds: ids.join(",") }));
+		},
 		async authorizeOrganizationPresence(organizationId, input, serviceAssertion, options) {
 			if (typeof serviceAssertion !== "string" || serviceAssertion.length > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(serviceAssertion)) throw new TypeError("Organization presence service assertion is invalid");
 			const organization = normalizeIdInput(organizationId);
@@ -4226,6 +4650,11 @@ function createServerAuth(options) {
 			const member = normalizeIdInput(memberId);
 			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthority(value, organization, member));
 		},
+		async getOrganizationMemberAuthorityV2(organizationId, memberId) {
+			const organization = normalizeIdInput(organizationId);
+			const member = normalizeIdInput(memberId);
+			return organizationRead(`${organization}/members/${member}/authority`, void 0, (value) => normalizeOrganizationMemberAuthorityV2(value, organization, member), () => new URLSearchParams({ version: "2" }));
+		},
 		async getOrganizationApplicationRegistration(organizationId, applicationId) {
 			if (authorization) throw new AuthError("state_conflict", 409);
 			const path = registrationTarget(organizationId, applicationId);
@@ -4591,4 +5020,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationAdmissionAuth, createOrganizationAdmissionBillingAuth, createOrganizationAdmissionDirectoryAuth, createOrganizationDirectoryAuth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth, organizationAdmissionBodyDigest };
+export { AuthError, OrganizationRoleEventCheckpointExpiredError, createAccountProductOperationAuth, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createMembershipResolverAuth, createOrganizationAdmissionAuth, createOrganizationAdmissionBillingAuth, createOrganizationAdmissionDirectoryAuth, createOrganizationDirectoryAuth, createOrganizationLifecycleAuth, createOrganizationRoleEventsAuth, createOrganizationRoleEventsV2Auth, createServerAuth, createUserApiVerifier, createUserDirectoryAuth, organizationAdmissionBodyDigest, organizationServiceClosureBodyDigest };