@finueva/auth 0.8.1 → 0.10.0

package/README.md

@@ -7,12 +7,14 @@ Use it to:
 - sign users in with email and password;
 - read the current session;
 - manage profile and password details;
-- list organizations and accept invitations;
+- read organizations, create ordinary teams, replace display data, and accept invitations;
 - request short-lived Drive credentials;
 - authenticate CLIs and native applications.
 
 The package is ESM-only and has no runtime dependencies. Its API is experimental while the package is below `1.0.0`.
 
+Sections marked **Unreleased** describe repository source and are not available in the currently published `@finueva/auth@0.9.0` package.
+
 ## Install
 
 ```sh
@@ -181,13 +183,67 @@ The callback must use the application's exact origin. Omit it to use the default
 ### List Organizations
 
 ```ts
-const organizations = await auth.listOrganizations();
+let page = await auth.listOrganizations({ limit: 50 });
 
-for (const organization of organizations) {
+for (const organization of page.organizations) {
   console.log(organization.id, organization.name, organization.slug);
 }
+
+if (page.nextCursor) {
+  page = await auth.listOrganizations({ limit: 50, cursor: page.nextCursor });
+}
+```
+
+All organization collections use an opaque cursor and a page size from 1 through 100. Use
+`getOrganization()`, `listOrganizationMembers()`, `listOrganizationTeams()`, and
+`listOrganizationTeamMembers()` with an explicit organization ID. Manual owners and admins can use
+`listOrganizationInvitations()` and `getOrganizationInvitation()`. A verified recipient can use
+`listReceivedInvitations()` and `getReceivedInvitation()`.
+
+Pagination is deterministic while a collection does not change. During concurrent mutation, an
+insert at or before the cursor can be absent, an insert after it can appear once, and a delete,
+update, status change, or expiry can change later pages. Restart pagination when you need a current
+view.
+
+### Create A Team
+
+**Unreleased:** this method will ship in a later package version and is not in `@finueva/auth@0.9.0`.
+
+```ts
+const idempotencyKey = crypto.randomUUID();
+const team = await auth.createOrganizationTeam("org_01J8R7M6N5P4Q3S2T1", "Platform Engineering", idempotencyKey);
+```
+
+The name and caller-owned idempotency key must each contain from 1 through 255 UTF-8 bytes. Use a
+new key for each intended team. If a response is lost, send the same organization ID, name, and key
+again. Auth returns the original creation result for a completed same-key request, even if a later
+operation changed the team display. A conflicting or unresolved same-key request returns
+`state_conflict`. The SDK never retries automatically.
+
+For an ordinary organization, a current effective owner or administrator can use the cookie or
+bearer lane. For a managed organization, a current manual owner or manual administrator must use the
+cookie lane. The method creates only an ordinary team.
+
+### Create A Member Invitation
+
+**Unreleased:** this method will ship in a later package version and is not in `@finueva/auth@0.9.0`.
+
+```ts
+const invitation = await auth.createOrganizationMemberInvitation("org_01J8R7M6N5P4Q3S2T1", {
+  email: "member@example.com",
+  teamIds: ["team_01J8R7M6N5P4Q3S2T1"],
+  idempotencyKey: crypto.randomUUID(),
+});
+
+console.log(invitation.id, invitation.expiresAt);
 ```
 
+The SDK trims and lowercases the email address. The email address can contain no more than 320 UTF-8 bytes. `teamIds` is optional and can contain no more than 100 unique ordinary team IDs. The caller-owned idempotency key must contain from 1 through 255 UTF-8 bytes.
+
+Use a new key for each intended invitation. If a response is lost, send the same organization ID and input again. The method returns only the invitation ID and expiry. It does not report email delivery. The SDK never retries automatically.
+
+For an ordinary organization, a current effective owner or administrator can use the cookie or bearer lane. Managed organizations are denied.
+
 ### Accept An Invitation
 
 ```ts
@@ -198,6 +254,36 @@ const result = await auth.acceptInvitation({
 console.log(result.organizationId);
 ```
 
+### Replace Organization Display
+
+```ts
+const display = await auth.updateOrganizationDisplay("org_01J8R7M6N5P4Q3S2T1", {
+  name: "Example Group",
+  slug: "example-group",
+  logo: null,
+});
+```
+
+Send all three fields. `name` and `slug` can contain no more than 255 UTF-8 bytes. Use `logo: null` to remove the logo. A non-null logo must be an exact canonical HTTPS URL of no more than 2048 UTF-8 bytes. The method supports manual owners and manual administrators of ordinary organizations. Provider-only administrators are denied. It does not update metadata, lifecycle, membership, teams, invitations, or active-organization state.
+
+Browser and cookie-based server calls require the exact configured application Origin. The SDK reports a denied or missing Origin as `request_origin_denied`. Other organization authority denials use `access_denied`.
+
+The method does not retry. If a response is lost, submit the same complete desired state again. Concurrent different updates use last-write-wins behavior.
+
+### Replace Team Display
+
+**Unreleased:** this method will ship in a later package version and is not in `@finueva/auth@0.9.0`.
+
+```ts
+const display = await auth.updateOrganizationTeamDisplay("org_01J8R7M6N5P4Q3S2T1", "team_01J8R7M6N5P4Q3S2T1", {
+  name: "Platform Engineering",
+});
+```
+
+Send the complete `name`. It can contain no more than 255 UTF-8 bytes. For an ordinary organization, a current effective owner or administrator can use the cookie or bearer lane. For a managed organization, a current manual owner or manual administrator must use the cookie lane. Managed teams are denied.
+
+The method does not retry. If a response is lost, submit the same complete desired name again. Concurrent different updates use last-write-wins behavior.
+
 ### Sign Out
 
 ```ts
@@ -454,7 +540,7 @@ The SDK does not automatically retry requests.
 - Browser snapshots and bearer authorization values are limited to 16 KiB.
 - Organization lists fail closed at 100 records.
 - Organization Drive context supports at most 50 current teams.
-- Account deletion and organization management are not exposed.
+- Ordinary-organization display replacement is the only organization mutation in `@finueva/auth@0.9.0`. Unreleased source also exposes ordinary-team creation and display replacement. Account deletion and other organization management are not exposed.
 - Cross-root SSO and custom refresh tokens are not implemented.
 - Hosted mobile transport and operating-system vault qualification are incomplete.
 - Production support gates are not complete.

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { C as AuthErrorStatus, S as AuthErrorCode, _ as SocialIdTokenInput, l as DriveCredential, o as AuthSession, u as DriveCredentialInput, v as SocialIdTokenProvider, x as AuthError, y as UpdateProfileInput } from "./types-DDopQNZR.js";
+import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, L as UpdateProfileInput, N as SocialIdTokenInput, P as SocialIdTokenProvider, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -43,6 +43,19 @@ interface DeviceAuthClient {
   }): Promise<DeviceAuthorization>;
   pollForToken(authorization: DeviceAuthorization, options?: PollDeviceOptions): Promise<DeviceToken>;
   getSession(): Promise<AuthSession | null>;
+  listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
+  getOrganization(organizationId: string): Promise<AuthOrganization>;
+  createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
+  createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
+  updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
+  updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
+  listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
+  listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
+  listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
+  listOrganizationInvitations(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationInvitationPage>;
+  getOrganizationInvitation(organizationId: string, invitationId: string): Promise<OrganizationInvitation>;
+  listReceivedInvitations(input?: OrganizationPageInput): Promise<ReceivedOrganizationInvitationPage>;
+  getReceivedInvitation(invitationId: string): Promise<ReceivedOrganizationInvitation>;
   getToken(): Promise<DeviceToken | null>;
   signUpWithEmail(email: string, password: string, name: string): Promise<AuthSession>;
   signInWithEmail(email: string, password: string): Promise<AuthSession>;
@@ -55,4 +68,4 @@ interface DeviceAuthClient {
 }
 declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, PollDeviceOptions, type SocialIdTokenInput, type SocialIdTokenProvider, createDeviceAuth };
+export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, createDeviceAuth };