@finueva/auth 0.9.0 → 0.10.1

package/README.md

@@ -1,17 +1,8 @@
-# `@finueva/auth`
+# Finueva Auth SDK for TypeScript
 
-The official TypeScript client for Finueva Auth.
+Use `@finueva/auth` to add Finueva sign-in, organization access, invitations, and Drive credentials to a browser, server, CLI, or native application.
 
-Use it to:
-
-- sign users in with email and password;
-- read the current session;
-- manage profile and password details;
-- list organizations and accept invitations;
-- request short-lived Drive credentials;
-- authenticate CLIs and native applications.
-
-The package is ESM-only and has no runtime dependencies. Its API is experimental while the package is below `1.0.0`.
+The current published version is `0.10.0`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
 
 ## Install
 
@@ -19,22 +10,30 @@ The package is ESM-only and has no runtime dependencies. Its API is experimental
 pnpm add @finueva/auth
 ```
 
-Node.js applications require Node.js 22 or later.
+For a browser or server application, ask your Auth operator for:
+
+- the Auth origin for your environment;
+- your registered application origin.
 
-## Pick The Right Client
+For a CLI or native application, ask for:
 
-| Runtime                   | Import                 | How it authenticates                 |
-| ------------------------- | ---------------------- | ------------------------------------ |
-| Browser                   | `@finueva/auth`        | Finueva Auth's HTTP-only cookie      |
-| Server or SSR handler     | `@finueva/auth/server` | Cookies or one incoming bearer token |
-| CLI or native application | `@finueva/auth/device` | A device bearer session              |
+- the Auth origin for your environment;
+- a registered device client ID.
 
-Create one browser client for the application, one server client per request, or one device client per application process.
+Do not reuse configuration from another application or environment.
 
-Before you start, ask the Auth operator to register your exact application origin. Device applications also need a registered client ID. Do not copy values from another application or environment.
+## Choose A Client
+
+| Runtime                   | Import                 | Session authority              | Create it                |
+| ------------------------- | ---------------------- | ------------------------------ | ------------------------ |
+| Browser                   | `@finueva/auth`        | Auth HTTP-only cookie          | Once for the application |
+| Server or SSR handler     | `@finueva/auth/server` | Incoming Auth cookie or bearer | Once per request         |
+| CLI or native application | `@finueva/auth/device` | Device bearer session          | Once per process         |
 
 ## Browser Quick Start
 
+Create the client with the exact Auth and application origins:
+
 ```ts
 import { AuthError, createAuthClient } from "@finueva/auth";
 
@@ -42,193 +41,87 @@ const auth = createAuthClient({
   authOrigin: "https://auth.finueva.com",
   appOrigin: window.location.origin,
 });
+```
+
+Read the current session:
 
+```ts
 const session = await auth.getSession();
 
 if (session) {
   console.log(`Signed in as ${session.user.email}`);
-} else {
-  console.log("Not signed in");
 }
+```
 
+Sign in with email and password:
+
+```ts
 try {
-  const nextSession = await auth.signIn({
+  const session = await auth.signIn({
     email: "ada@example.com",
     password: "correct-horse-battery-staple",
   });
 
-  console.log(`Welcome ${nextSession.user.name}`);
+  console.log(`Welcome ${session.user.name}`);
 } catch (error) {
   if (error instanceof AuthError && error.code === "invalid_credentials") {
-    console.log("Check the email and password.");
+    showInvalidCredentials();
   } else {
     throw error;
   }
 }
 ```
 
-Auth keeps the session token in an HTTP-only cookie. The browser client never returns that token.
-
-### React To Session Changes
-
-Use `onAuthStateChange()` to update the interface:
-
-```ts
-const stop = auth.onAuthStateChange((state) => {
-  switch (state.status) {
-    case "loading":
-      showLoading();
-      break;
-    case "cached":
-      showAccountHint(state.session.user);
-      break;
-    case "authenticated":
-      showAccount(state.session.user);
-      break;
-    case "unauthenticated":
-      showSignIn();
-      break;
-    case "unavailable":
-      showAuthUnavailable();
-      break;
-  }
-});
-
-window.addEventListener("pagehide", stop, { once: true });
-```
-
-`cached` state is only a display hint. Never use cached browser state to authorize an operation. Check access on the server.
-
-Browser snapshots use local storage by default. Choose another mode when you create the client:
-
-```ts
-const auth = createAuthClient({
-  authOrigin: "https://auth.finueva.com",
-  appOrigin: window.location.origin,
-  persistence: "session", // "local", "session", or "memory"
-  timeoutMs: 10_000,
-});
-```
-
-The snapshot contains normalized display data, not cookies or Drive credentials.
-
-## Common Browser Tasks
-
-### Create An Account
-
-```ts
-const session = await auth.signUp("ada@example.com", "correct-horse-battery-staple", "Ada Lovelace");
-```
-
-New passwords must contain 10 to 128 characters.
+The browser owns the session cookie. The SDK does not expose or persist it.
 
-### Update The Profile
+## Common Tasks
 
-```ts
-const session = await auth.updateProfile({
-  name: "Ada Lovelace",
-  image: "https://images.example.com/ada.png",
-});
-```
-
-Pass `image: null` to remove the image.
-
-### Change The Password
-
-```ts
-await auth.changePassword(currentPassword, newPassword);
-```
-
-This revokes the user's other sessions by default. Pass `false` as the third argument only when the product deliberately keeps those sessions.
+| Task                      | Browser                                     | Server                                 | Device                                 |
+| ------------------------- | ------------------------------------------- | -------------------------------------- | -------------------------------------- |
+| Create an account         | `signUp()`                                  | Not available                          | `signUpWithEmail()`                    |
+| Read the current session  | `getSession()`                              | `getSession()`                         | `getSession()`                         |
+| Observe session state     | `onAuthStateChange()`                       | Not available                          | Not available                          |
+| Update a profile          | `updateProfile()`                           | Not available                          | `updateProfile()`                      |
+| Change a password         | `changePassword()`                          | Not available                          | `changePassword()`                     |
+| Reset a password          | `requestPasswordReset()`, `resetPassword()` | Not available                          | Not available                          |
+| Verify an email           | `sendVerificationEmail()`                   | Not available                          | Not available                          |
+| List organizations        | `listOrganizations()`                       | `listOrganizations()`                  | `listOrganizations()`                  |
+| Create an ordinary team   | `createOrganizationTeam()`                  | `createOrganizationTeam()`             | `createOrganizationTeam()`             |
+| Invite an ordinary member | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
+| Accept an invitation      | `acceptInvitation()`                        | `acceptInvitation()`                   | Not available                          |
+| Request Drive access      | `getDriveCredential()`                      | `getDriveCredential()`                 | `getDriveCredential()`                 |
+| End the current session   | `signOut()`                                 | `signOut()`                            | `revokeCurrentDevice()`                |
 
-### Reset A Password
+## Create An Organization Invitation
 
-```ts
-await auth.requestPasswordReset("ada@example.com", `${window.location.origin}/account/reset-password`);
-```
-
-On the reset page, remove the token from the address bar before loading other resources. Use it once:
+Use one new idempotency key for each invitation that you intend to create:
 
 ```ts
-const url = new URL(window.location.href);
-let token = url.searchParams.get("token");
-
-url.searchParams.delete("token");
-window.history.replaceState(null, "", `${url.pathname}${url.search}${url.hash}`);
-
-if (!token) throw new Error("Reset token is missing");
-
-try {
-  await auth.resetPassword(token, newPassword);
-} finally {
-  token = null;
-}
-```
-
-Serve this page with `Cache-Control: no-store` and `Referrer-Policy: no-referrer`. Do not load analytics or third-party content on it.
-
-### Verify An Email
-
-```ts
-await auth.sendVerificationEmail({
-  email: "ada@example.com",
-  callbackURL: `${window.location.origin}/account/email-verified`,
+const invitation = await auth.createOrganizationMemberInvitation("org_01J8R7M6N5P4Q3S2T1", {
+  email: "member@example.com",
+  teamIds: ["team_01J8R7M6N5P4Q3S2T1"],
+  idempotencyKey: crypto.randomUUID(),
 });
-```
-
-The callback must use the application's exact origin. Omit it to use the default Auth result page.
-
-### List Organizations
-
-```ts
-let page = await auth.listOrganizations({ limit: 50 });
 
-for (const organization of page.organizations) {
-  console.log(organization.id, organization.name, organization.slug);
-}
-
-if (page.nextCursor) {
-  page = await auth.listOrganizations({ limit: 50, cursor: page.nextCursor });
-}
+console.log(invitation.id, invitation.expiresAt);
 ```
 
-All organization collections use an opaque cursor and a page size from 1 through 100. Use
-`getOrganization()`, `listOrganizationMembers()`, `listOrganizationTeams()`, and
-`listOrganizationTeamMembers()` with an explicit organization ID. Manual owners and admins can use
-`listOrganizationInvitations()` and `getOrganizationInvitation()`. A verified recipient can use
-`listReceivedInvitations()` and `getReceivedInvitation()`.
-
-Pagination is deterministic while a collection does not change. During concurrent mutation, an
-insert at or before the cursor can be absent, an insert after it can appear once, and a delete,
-update, status change, or expiry can change later pages. Restart pagination when you need a current
-view.
-
-### Accept An Invitation
-
-```ts
-const result = await auth.acceptInvitation({
-  invitationId: "invitation_01J8R7M6N5P4Q3S2T1",
-});
-
-console.log(result.organizationId);
-```
-
-### Sign Out
-
-```ts
-await auth.signOut();
-```
+If the response is lost, repeat the same request with the same key. The SDK does not retry automatically. The result confirms invitation creation. It does not confirm email delivery.
 
 ## Request A Drive Credential
 
-Ask Auth for a credential for one workspace:
+Request one short-lived credential for one workspace:
 
 ```ts
 const credential = await auth.getDriveCredential({
   workspace: { type: "personal" },
 });
 
-const authorization = `${credential.tokenType} ${credential.token}`;
+await fetch("https://drive.finueva.com/api/files", {
+  headers: {
+    authorization: `${credential.tokenType} ${credential.token}`,
+  },
+});
 ```
 
 For an organization workspace:
@@ -242,184 +135,87 @@ const credential = await auth.getDriveCredential({
 });
 ```
 
-Drive credentials last about 14 minutes. Browser and device clients keep them in memory only and refresh them when two minutes remain. The server client does not cache them.
-
-If Drive rejects a credential, request a replacement:
-
-```ts
-const replacement = await auth.getDriveCredential({
-  workspace: { type: "personal" },
-  forceRefresh: true,
-});
-```
-
-The SDK does not replay the failed Drive request. Replay it only when the operation is safe to repeat.
+Browser and device clients cache one completed credential in memory. The server client does not cache credentials. The SDK never replays a failed Drive operation.
 
-## Server And SSR
+## Server Quick Start
 
-Create a server client inside each request handler. It forwards only Finueva Auth cookies. If the incoming request has a bearer token, that token takes precedence and the client forwards no cookies.
+Create one client inside each request handler:
 
 ```ts
-import { AuthError, createServerAuth } from "@finueva/auth/server";
+import { createServerAuth } from "@finueva/auth/server";
 
-export async function handleAccountRequest(request: Request): Promise<Response> {
+export async function handleRequest(request: Request): Promise<Response> {
   const auth = createServerAuth({
     authOrigin: "https://auth.finueva.com",
     appOrigin: "https://files.finueva.com",
     request,
   });
 
-  try {
-    const session = await auth.getSession();
-
-    if (!session) {
-      return Response.json(
-        { authenticated: false },
-        {
-          status: 401,
-          headers: { "cache-control": "no-store" },
-        },
-      );
-    }
-
-    return Response.json(
-      { user: session.user },
-      {
-        headers: { "cache-control": "no-store" },
-      },
-    );
-  } catch (error) {
-    if (error instanceof AuthError) {
-      return Response.json(
-        { code: error.code },
-        {
-          status: error.status,
-          headers: { "cache-control": "no-store" },
-        },
-      );
-    }
+  const session = await auth.getSession();
 
-    throw error;
-  }
+  return Response.json(
+    { authenticated: session !== null, user: session?.user ?? null },
+    { headers: { "cache-control": "no-store" } },
+  );
 }
 ```
 
-Some server mutations return cookies. Apply them to the outgoing response:
+If the incoming request has `Authorization`, the server client uses that bearer and forwards no cookies. Otherwise, it forwards only Auth cookies.
+
+Some server methods return cookie changes. Apply them before you send the response:
 
 ```ts
 const result = await auth.signOut();
-const headers = new Headers({
-  "cache-control": "no-store",
-  location: "/signed-out",
-});
+const headers = new Headers({ location: "/signed-out" });
 
 result.applyCookies(headers);
 
 return new Response(null, { status: 303, headers });
 ```
 
-Call `applyCookies()` after server `signOut()`, `acceptInvitation()`, and `signInWithSocialIdToken()`. If you omit it, the browser does not receive the session change.
-
-Check `Origin`, Fetch Metadata, or a server-generated CSRF token before a server-side mutation. The SDK forwards authority; it does not replace your application's CSRF protection.
+Call `applyCookies()` after server `signOut()`, `acceptInvitation()`, and `signInWithSocialIdToken()`.
 
-## CLI And Native Applications
+## Device Quick Start
 
-Use the device flow when a CLI or device can open a system browser:
+Use the device flow for a CLI or native application that can open a system browser:
 
 ```ts
-import { AuthError, DeviceAuthorizationError, createDeviceAuth } from "@finueva/auth/device";
+import { createDeviceAuth } from "@finueva/auth/device";
 
 const auth = createDeviceAuth({
   authOrigin: "https://auth.finueva.com",
   clientId: "finueva-cli",
 });
 
-const controller = new AbortController();
-process.once("SIGINT", () => controller.abort());
+const authorization = await auth.requestAuthorization();
 
-try {
-  const authorization = await auth.requestAuthorization({
-    signal: controller.signal,
-  });
+console.log(`Open ${authorization.verificationUriComplete}`);
+console.log(`Code: ${authorization.userCode}`);
 
-  console.log(`Open ${authorization.verificationUriComplete}`);
-  console.log(`Code: ${authorization.userCode}`);
-
-  await auth.pollForToken(authorization, {
-    signal: controller.signal,
-  });
-
-  const session = await auth.getSession();
-  console.log(session ? `Signed in as ${session.user.email}` : "Not signed in");
-} catch (error) {
-  if (error instanceof DeviceAuthorizationError || error instanceof AuthError) {
-    console.error(error.code);
-  } else {
-    throw error;
-  }
-}
+await auth.pollForToken(authorization);
 ```
 
-`clientId` is a public registered identifier, not a secret. Never display or log `authorization.deviceCode`.
+`clientId` is public. `deviceCode` is not. Never log or display the device code.
 
-Device sessions are memory-only unless you provide `DeviceTokenPersistence`:
+Device tokens are memory-only by default. For persistence, supply a `DeviceTokenPersistence` adapter backed by an operating-system credential vault. Do not use local storage, a WebView cookie jar, or a plaintext file.
 
-```ts
-import { createDeviceAuth, type DeviceTokenPersistence } from "@finueva/auth/device";
+## Handle Errors
 
-const persistence: DeviceTokenPersistence = {
-  read: (signal) => vault.read("finueva-auth", signal),
-  replace: (token, signal) => vault.replace("finueva-auth", token, signal),
-  delete: (signal) => vault.delete("finueva-auth", signal),
-};
-
-const auth = createDeviceAuth({
-  authOrigin: "https://auth.finueva.com",
-  clientId: "finueva-desktop",
-  fetch: nativeFetch,
-  persistence,
-});
-```
-
-Use the operating system's credential vault. `replace()` must replace the complete token atomically. Do not use local storage, a WebView cookie jar, or a plaintext file. A native application must also supply a reviewed native HTTPS transport that omits ambient WebView cookies.
-
-Direct first-party native email sign-in is available to registered applications:
+Constructor and selected account-input errors can throw `TypeError`. Validated SDK request failures throw `AuthError`. Device authorization can throw `DeviceAuthorizationError`:
 
 ```ts
-const session = await auth.signInWithEmail("ada@example.com", "correct-horse-battery-staple");
-```
-
-End the current device session with `revokeCurrentDevice()`. End every browser and device session for the account with `revokeAllSessions()`.
-
-## Social ID Tokens
-
-Browser, server, and device clients accept Google and Apple ID tokens from a first-party provider integration:
-
-```ts
-const session = await auth.signInWithSocialIdToken({
-  provider: "google",
-  idToken,
-  nonce,
-  signUp: false,
-});
-```
-
-Set `signUp: true` only after the user chooses to create an account. The application owns the provider authorization flow, state, nonce, and PKCE transaction. Pass only the ID token to Auth. Do not pass provider access or refresh tokens.
-
-The generic Google and Apple redirect flow is not exposed by this package.
-
-## Errors
-
-Invalid local arguments throw `TypeError`. Auth failures throw `AuthError`:
+import { AuthError } from "@finueva/auth";
 
-```ts
 try {
-  await auth.getSession();
+  await auth.signIn({
+    email: "ada@example.com",
+    password: "correct-horse-battery-staple",
+  });
 } catch (error) {
   if (!(error instanceof AuthError)) throw error;
 
-  if (error.code === "auth_request_rate_limited") {
-    scheduleRetry(error.retryAfterSeconds ?? 60);
+  if (error.code === "invalid_credentials") {
+    showInvalidCredentials();
   } else if (error.code === "identity_authority_unavailable") {
     showAuthUnavailable();
   } else {
@@ -428,48 +224,55 @@ try {
 }
 ```
 
-Use `error.code` for application behavior. Do not parse `error.message`.
-
-| Code                             | What the application should do                                        |
-| -------------------------------- | --------------------------------------------------------------------- |
-| `invalid_credentials`            | Ask the user to check the credential.                                 |
-| `invalid_auth_input`             | Correct the account input.                                            |
-| `account_conflict`               | Stop the account action. Do not expose account-existence details.     |
-| `authentication_required`        | Start sign-in.                                                        |
-| `email_verification_required`    | Ask the user to verify the current email.                             |
-| `invitation_unavailable`         | Ask for a new invitation. Do not retry the old one.                   |
-| `invalid_workspace_selection`    | Send one exact personal or organization workspace.                    |
-| `state_conflict`                 | Wait for the active authority operation, then read the session again. |
-| `access_denied`                  | Stop the operation.                                                   |
-| `credential_rate_limited`        | Wait for `retryAfterSeconds` when present.                            |
-| `auth_request_rate_limited`      | Wait for `retryAfterSeconds` when present.                            |
-| `identity_authority_unavailable` | Keep state unverified and try again later.                            |
+Use `error.code` for application behavior. Do not parse `error.message`. Except for RFC 8628 device polling, the SDK does not automatically repeat requests.
 
-Device authorization can also throw `DeviceAuthorizationError`. Its codes are `device_access_denied`, `device_authorization_cancelled`, `device_code_expired`, `invalid_device_authorization`, and `identity_authority_unavailable`.
-
-The SDK does not automatically retry requests.
-
-## Security Notes
+## Security Checklist
 
 - Use HTTPS. Plain HTTP is accepted only on localhost.
-- Use exact registered origins. Do not build an Auth origin from the current request host.
+- Register exact application origins.
+- Create server clients per request.
+- Apply returned server cookies before you send the response.
 - Keep browser session snapshots display-only.
-- Create server clients per request. Do not keep one in a module singleton.
-- Apply returned cookies before sending a server response.
-- Keep device bearer tokens in an operating-system credential vault.
-- Keep Drive credentials in memory and send them only to Drive.
+- Keep device sessions in an operating-system credential vault.
+- Keep Drive credentials in memory.
+- Protect server-side mutations against CSRF.
 - Do not log cookies, bearer tokens, ID tokens, reset tokens, device codes, or complete Auth responses.
-- Protect application mutations against CSRF before calling the server client.
 
 ## Current Limits
 
-- The public API is experimental and can change before `1.0.0`.
-- Requests time out after 10 seconds by default. `timeoutMs` accepts 1 to 60,000 milliseconds.
-- Auth JSON responses are limited to 64 KiB.
+- The package is Experimental until `1.0.0`.
+- Requests time out after 10 seconds by default.
+- `timeoutMs` accepts 1 through 60,000 milliseconds.
+- Most responses are limited to 64 KiB. Organization read responses can use up to 256 KiB.
 - Browser snapshots and bearer authorization values are limited to 16 KiB.
-- Organization lists fail closed at 100 records.
+- Organization collections use page sizes from 1 through 100.
 - Organization Drive context supports at most 50 current teams.
-- Account deletion and organization management are not exposed.
-- Cross-root SSO and custom refresh tokens are not implemented.
-- Hosted mobile transport and operating-system vault qualification are incomplete.
-- Production support gates are not complete.
+- Invitation creation supports only the `member` role in ordinary organizations.
+- Invitation resend and cancellation are not public SDK methods.
+- Cross-root SSO, custom refresh tokens, and account deletion are not implemented.
+- Production support gates are incomplete. Ask the Auth operator for the current environment status before adoption.
+
+## Package Exports
+
+```ts
+import { AuthError, createAuthClient } from "@finueva/auth";
+import { createServerAuth } from "@finueva/auth/server";
+import { DeviceAuthorizationError, createDeviceAuth } from "@finueva/auth/device";
+```
+
+TypeScript declarations ship with the package. The public declarations do not expose Better Auth types.
+
+## Documentation
+
+Long-form task guides are maintained with the Auth source:
+
+- [Get started](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/index.md)
+- [Browser applications](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/browser.md)
+- [Server and SSR applications](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/server.md)
+- [CLI and native applications](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/device.md)
+- [Social ID-token sign-in](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/social-sign-in.md)
+- [Organizations and invitations](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/organizations.md)
+- [Drive credentials](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/drive-credentials.md)
+- [Errors and recovery](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/errors-and-recovery.md)
+
+These links track current source and can describe a newer SDK version. Check the version at the start of the guide. Repository access is required until these guides have a public, versioned documentation deployment.

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { A as UpdateProfileInput, M as AuthError, N as AuthErrorCode, O as SocialIdTokenInput, P as AuthErrorStatus, T as ReceivedOrganizationInvitationPage, _ as OrganizationPage, b as OrganizationTeamMemberPage, g as OrganizationMemberPage, h as OrganizationMember, k as SocialIdTokenProvider, l as DriveCredential, m as OrganizationInvitationPage, o as AuthSession, p as OrganizationInvitation, r as AuthOrganization, u as DriveCredentialInput, v as OrganizationPageInput, w as ReceivedOrganizationInvitation, x as OrganizationTeamPage, y as OrganizationTeam } from "./types-B67VIvTQ.js";
+import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, L as UpdateProfileInput, N as SocialIdTokenInput, P as SocialIdTokenProvider, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {
@@ -45,6 +45,10 @@ interface DeviceAuthClient {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
+  createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
+  updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
+  updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
   listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
   listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
   listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
@@ -64,4 +68,4 @@ interface DeviceAuthClient {
 }
 declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, createDeviceAuth };
+export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, createDeviceAuth };

package/dist/device.js

@@ -614,6 +614,81 @@ function normalizeOrganization(value) {
 		}
 	};
 }
+function normalizeOrganizationDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "logo,name,slug") throw new AuthError("invalid_request", 400);
+	if (!boundedString(value.name, 255) || !boundedString(value.slug, 255)) throw new AuthError("invalid_request", 400);
+	let logo;
+	try {
+		logo = nullableHttpsUrl(value.logo);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	return {
+		name: value.name,
+		slug: value.slug,
+		logo
+	};
+}
+function normalizeOrganizationDisplay(value) {
+	try {
+		return normalizeOrganizationDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+function normalizeOrganizationTeamDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).join(",") !== "name" || !boundedString(value.name, 255)) throw new AuthError("invalid_request", 400);
+	return { name: value.name };
+}
+function normalizeOrganizationTeamDisplay(value) {
+	try {
+		return normalizeOrganizationTeamDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationTeam(value) {
+	exact(value, ["id", "name"]);
+	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name
+	};
+}
+function normalizeOrganizationMemberInvitationCreationInput(value) {
+	if (!isObject(value)) throw new AuthError("invalid_request", 400);
+	const keys = Object.keys(value).sort().join(",");
+	if (keys !== "email,idempotencyKey" && keys !== "email,idempotencyKey,teamIds") throw new AuthError("invalid_request", 400);
+	let normalizedEmail;
+	try {
+		normalizedEmail = normalizeEmail(value.email);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
+	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
+	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
+	return {
+		email: normalizedEmail,
+		...teamIds === void 0 ? {} : { teamIds },
+		idempotencyKey: value.idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationMemberInvitation(value) {
+	exact(value, ["expiresAt", "id"]);
+	if (!isId(value.id)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		expiresAt: responseDate(value.expiresAt)
+	};
+}
 function normalizeOrganizations(value) {
 	exact(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -810,6 +885,14 @@ function fromOrganizationReadAuthorityError(value, status) {
 	if (status === 403) return new AuthError("access_denied", 403);
 	return authorityUnavailable();
 }
+function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
+	return fromOrganizationReadAuthorityError(value, status);
+}
 function mapError(code, status) {
 	if (code === "authentication_required") return {
 		code,
@@ -1389,6 +1472,112 @@ function createDeviceAuth(options) {
 				return Promise.reject(error);
 			}
 		},
+		createOrganizationTeam(organizationId, name, idempotencyKey) {
+			let id;
+			let body;
+			try {
+				id = normalizeIdInput(organizationId);
+				body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				return normalizeCreatedOrganizationTeam((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/organizations", id, "teams"), {
+					fetch: requestFetch,
+					timeoutMs,
+					method: "POST",
+					credentials: "omit",
+					headers: {
+						authorization: `Bearer ${current.accessToken}`,
+						"content-type": "application/json"
+					},
+					body,
+					mapError: fromOrganizationMutationAuthorityError
+				})).value);
+			});
+		},
+		createOrganizationMemberInvitation(organizationId, input) {
+			let id;
+			let body;
+			try {
+				id = normalizeIdInput(organizationId);
+				body = normalizeOrganizationMemberInvitationCreationInput(input);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				return normalizeCreatedOrganizationMemberInvitation((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/organizations", id, "invitations"), {
+					fetch: requestFetch,
+					timeoutMs,
+					method: "POST",
+					credentials: "omit",
+					headers: {
+						authorization: `Bearer ${current.accessToken}`,
+						"content-type": "application/json"
+					},
+					body,
+					mapError: fromOrganizationMutationAuthorityError
+				})).value);
+			});
+		},
+		updateOrganizationDisplay(organizationId, input) {
+			let id;
+			let desired;
+			try {
+				id = normalizeIdInput(organizationId);
+				desired = normalizeOrganizationDisplayInput(input);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				return normalizeOrganizationDisplay((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/organizations", id, "display"), {
+					fetch: requestFetch,
+					timeoutMs,
+					method: "POST",
+					credentials: "omit",
+					headers: {
+						authorization: `Bearer ${current.accessToken}`,
+						"content-type": "application/json"
+					},
+					body: desired,
+					mapError: fromOrganizationMutationAuthorityError
+				})).value);
+			});
+		},
+		updateOrganizationTeamDisplay(organizationId, teamId, input) {
+			let organization;
+			let team;
+			let desired;
+			try {
+				organization = normalizeIdInput(organizationId);
+				team = normalizeIdInput(teamId);
+				desired = normalizeOrganizationTeamDisplayInput(input);
+			} catch (error) {
+				return Promise.reject(error);
+			}
+			return serializeAuthority(async () => {
+				const current = await readToken();
+				if (!current) throw new AuthError("authentication_required", 401);
+				return normalizeOrganizationTeamDisplay((await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "display"), {
+					fetch: requestFetch,
+					timeoutMs,
+					method: "POST",
+					credentials: "omit",
+					headers: {
+						authorization: `Bearer ${current.accessToken}`,
+						"content-type": "application/json"
+					},
+					body: desired,
+					mapError: fromOrganizationMutationAuthorityError
+				})).value);
+			});
+		},
 		listOrganizationMembers(organizationId, input) {
 			try {
 				return serializeAuthority(() => organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers));

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as UpdateProfileInput, C as PersonalWorkspaceSelection, D as SignInInput, E as SendVerificationEmailInput, M as AuthError, N as AuthErrorCode, O as SocialIdTokenInput, P as AuthErrorStatus, S as OrganizationWorkspaceSelection, T as ReceivedOrganizationInvitationPage, _ as OrganizationPage, a as AuthPersistenceDriver, b as OrganizationTeamMemberPage, c as AuthUser, d as FinuevaAuthClient, f as InvitationAcceptance, g as OrganizationMemberPage, h as OrganizationMember, i as AuthPersistence, j as WorkspaceSelection, k as SocialIdTokenProvider, l as DriveCredential, m as OrganizationInvitationPage, n as AuthClientOptions, o as AuthSession, p as OrganizationInvitation, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as DriveCredentialInput, v as OrganizationPageInput, w as ReceivedOrganizationInvitation, x as OrganizationTeamPage, y as OrganizationTeam } from "./types-B67VIvTQ.js";
+import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, L as UpdateProfileInput, M as SignInInput, N as SocialIdTokenInput, O as PersonalWorkspaceSelection, P as SocialIdTokenProvider, R as WorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, a as AuthPersistenceDriver, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, i as AuthPersistence, j as SendVerificationEmailInput, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, m as FinuevaAuthClient, n as AuthClientOptions, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };

package/dist/index.js

@@ -2333,6 +2333,81 @@ function normalizeOrganization(value) {
 		}
 	};
 }
+function normalizeOrganizationDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "logo,name,slug") throw new AuthError("invalid_request", 400);
+	if (!boundedString(value.name, 255) || !boundedString(value.slug, 255)) throw new AuthError("invalid_request", 400);
+	let logo;
+	try {
+		logo = nullableHttpsUrl(value.logo);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	return {
+		name: value.name,
+		slug: value.slug,
+		logo
+	};
+}
+function normalizeOrganizationDisplay(value) {
+	try {
+		return normalizeOrganizationDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+function normalizeOrganizationTeamDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).join(",") !== "name" || !boundedString(value.name, 255)) throw new AuthError("invalid_request", 400);
+	return { name: value.name };
+}
+function normalizeOrganizationTeamDisplay(value) {
+	try {
+		return normalizeOrganizationTeamDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationTeam(value) {
+	exact(value, ["id", "name"]);
+	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name
+	};
+}
+function normalizeOrganizationMemberInvitationCreationInput(value) {
+	if (!isObject(value)) throw new AuthError("invalid_request", 400);
+	const keys = Object.keys(value).sort().join(",");
+	if (keys !== "email,idempotencyKey" && keys !== "email,idempotencyKey,teamIds") throw new AuthError("invalid_request", 400);
+	let normalizedEmail;
+	try {
+		normalizedEmail = normalizeEmail(value.email);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
+	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
+	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
+	return {
+		email: normalizedEmail,
+		...teamIds === void 0 ? {} : { teamIds },
+		idempotencyKey: value.idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationMemberInvitation(value) {
+	exact(value, ["expiresAt", "id"]);
+	if (!isId(value.id)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		expiresAt: responseDate(value.expiresAt)
+	};
+}
 function normalizeOrganizations(value) {
 	exact(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -2556,6 +2631,14 @@ function fromOrganizationReadAuthorityError(value, status) {
 	if (status === 403) return new AuthError("access_denied", 403);
 	return authorityUnavailable();
 }
+function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
+	return fromOrganizationReadAuthorityError(value, status);
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -3841,6 +3924,71 @@ function createAuthClient(options) {
 		async getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		async createOrganizationTeam(organizationId, name, idempotencyKey) {
+			const id = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", id, "teams"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeCreatedOrganizationTeam(value);
+		},
+		async createOrganizationMemberInvitation(organizationId, input) {
+			const id = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationMemberInvitationCreationInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", id, "invitations"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeCreatedOrganizationMemberInvitation(value);
+		},
+		async updateOrganizationDisplay(organizationId, input) {
+			const id = normalizeIdInput(organizationId);
+			const desired = normalizeOrganizationDisplayInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", id, "display"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: desired,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeOrganizationDisplay(value);
+		},
+		async updateOrganizationTeamDisplay(organizationId, teamId, input) {
+			const organization = normalizeIdInput(organizationId);
+			const team = normalizeIdInput(teamId);
+			const desired = normalizeOrganizationTeamDisplayInput(input);
+			if (signOutRequest || activeAccountMutationGeneration !== void 0 || invitationRequest) throw new AuthError("state_conflict", 409);
+			const generation = authorityGeneration;
+			const value = await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "display"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: desired,
+				mapError: fromOrganizationMutationAuthorityError
+			});
+			if (generation !== authorityGeneration) throw new AuthError("state_conflict", 409);
+			return normalizeOrganizationTeamDisplay(value);
+		},
 		async listOrganizationMembers(organizationId, input) {
 			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers);
 		},

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-import { C as PersonalWorkspaceSelection, M as AuthError, N as AuthErrorCode, O as SocialIdTokenInput, P as AuthErrorStatus, S as OrganizationWorkspaceSelection, T as ReceivedOrganizationInvitationPage, _ as OrganizationPage, b as OrganizationTeamMemberPage, c as AuthUser, f as InvitationAcceptance, g as OrganizationMemberPage, h as OrganizationMember, j as WorkspaceSelection, k as SocialIdTokenProvider, l as DriveCredential, m as OrganizationInvitationPage, o as AuthSession, p as OrganizationInvitation, r as AuthOrganization, t as AcceptInvitationInput, u as DriveCredentialInput, v as OrganizationPageInput, w as ReceivedOrganizationInvitation, x as OrganizationTeamPage, y as OrganizationTeam } from "./types-B67VIvTQ.js";
+import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, N as SocialIdTokenInput, O as PersonalWorkspaceSelection, P as SocialIdTokenProvider, R as WorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -22,6 +22,10 @@ interface FinuevaServerAuth {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
+  createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
+  updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
+  updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
   listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
   listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
   listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
@@ -35,4 +39,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type WorkspaceSelection, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createServerAuth };

package/dist/server.js

@@ -475,6 +475,12 @@ const DRIVE_CREDENTIAL_LIFETIME_SECONDS = 840;
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
 const MAX_SOCIAL_ID_TOKEN_BYTES = 16 * 1024;
+function normalizeEmail(value) {
+	if (typeof value !== "string") throw new TypeError("email is invalid");
+	const normalized = value.trim().toLowerCase();
+	if (normalized.length === 0 || normalized.length > 320 || !email.test(normalized)) throw new TypeError("email is invalid");
+	return normalized;
+}
 function normalizeSocialIdTokenInput(value) {
 	if (!isObject(value)) throw new TypeError("social ID token input is invalid");
 	const keys = Object.keys(value);
@@ -589,6 +595,81 @@ function normalizeOrganization(value) {
 		}
 	};
 }
+function normalizeOrganizationDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).sort().join(",") !== "logo,name,slug") throw new AuthError("invalid_request", 400);
+	if (!boundedString(value.name, 255) || !boundedString(value.slug, 255)) throw new AuthError("invalid_request", 400);
+	let logo;
+	try {
+		logo = nullableHttpsUrl(value.logo);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	return {
+		name: value.name,
+		slug: value.slug,
+		logo
+	};
+}
+function normalizeOrganizationDisplay(value) {
+	try {
+		return normalizeOrganizationDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+function normalizeOrganizationTeamDisplayInput(value) {
+	if (!isObject(value) || Object.keys(value).join(",") !== "name" || !boundedString(value.name, 255)) throw new AuthError("invalid_request", 400);
+	return { name: value.name };
+}
+function normalizeOrganizationTeamDisplay(value) {
+	try {
+		return normalizeOrganizationTeamDisplayInput(value);
+	} catch {
+		throw authorityUnavailable();
+	}
+}
+function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
+	if (!boundedString(name, 255) || !boundedString(idempotencyKey, 255)) throw new AuthError("invalid_request", 400);
+	return {
+		name,
+		idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationTeam(value) {
+	exact(value, ["id", "name"]);
+	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		name: value.name
+	};
+}
+function normalizeOrganizationMemberInvitationCreationInput(value) {
+	if (!isObject(value)) throw new AuthError("invalid_request", 400);
+	const keys = Object.keys(value).sort().join(",");
+	if (keys !== "email,idempotencyKey" && keys !== "email,idempotencyKey,teamIds") throw new AuthError("invalid_request", 400);
+	let normalizedEmail;
+	try {
+		normalizedEmail = normalizeEmail(value.email);
+	} catch {
+		throw new AuthError("invalid_request", 400);
+	}
+	if (new TextEncoder().encode(normalizedEmail).byteLength > 320 || !boundedString(value.idempotencyKey, 255) || value.teamIds !== void 0 && (!Array.isArray(value.teamIds) || value.teamIds.length > 100)) throw new AuthError("invalid_request", 400);
+	const teamIds = value.teamIds?.map((teamId) => normalizeIdInput(teamId));
+	if (teamIds && new Set(teamIds).size !== teamIds.length) throw new AuthError("invalid_request", 400);
+	return {
+		email: normalizedEmail,
+		...teamIds === void 0 ? {} : { teamIds },
+		idempotencyKey: value.idempotencyKey
+	};
+}
+function normalizeCreatedOrganizationMemberInvitation(value) {
+	exact(value, ["expiresAt", "id"]);
+	if (!isId(value.id)) throw authorityUnavailable();
+	return {
+		id: value.id,
+		expiresAt: responseDate(value.expiresAt)
+	};
+}
 function normalizeOrganizations(value) {
 	exact(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
@@ -798,6 +879,14 @@ function fromOrganizationReadAuthorityError(value, status) {
 	if (status === 403) return new AuthError("access_denied", 403);
 	return authorityUnavailable();
 }
+function fromOrganizationMutationAuthorityError(value, status, retryAfter) {
+	if (status === 400 || status === 413 || status === 415) return new AuthError("invalid_request", 400);
+	if (status === 409) return new AuthError("state_conflict", 409);
+	if (status === 429) return new AuthError("auth_request_rate_limited", 429, parseRetryAfter(retryAfter));
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 403 && code === "REQUEST_ORIGIN_DENIED") return new AuthError("request_origin_denied", 403);
+	return fromOrganizationReadAuthorityError(value, status);
+}
 function fromInvitationAuthorityError(value, status) {
 	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
 	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
@@ -1062,6 +1151,71 @@ function createServerAuth(options) {
 		getOrganization(organizationId) {
 			return organizationRead(normalizeIdInput(organizationId), void 0, normalizeOrganization);
 		},
+		async createOrganizationTeam(organizationId, name, idempotencyKey) {
+			const id = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationTeamCreationInput(name, idempotencyKey);
+			return normalizeCreatedOrganizationTeam(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", id, "teams"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
+		async createOrganizationMemberInvitation(organizationId, input) {
+			const id = normalizeIdInput(organizationId);
+			const body = normalizeOrganizationMemberInvitationCreationInput(input);
+			return normalizeCreatedOrganizationMemberInvitation(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", id, "invitations"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
+		async updateOrganizationDisplay(organizationId, input) {
+			const id = normalizeIdInput(organizationId);
+			const desired = normalizeOrganizationDisplayInput(input);
+			return normalizeOrganizationDisplay(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", id, "display"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body: desired,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
+		async updateOrganizationTeamDisplay(organizationId, teamId, input) {
+			const organization = normalizeIdInput(organizationId);
+			const team = normalizeIdInput(teamId);
+			const desired = normalizeOrganizationTeamDisplayInput(input);
+			return normalizeOrganizationTeamDisplay(await requestJson(joinURL(authOrigin, "api/v1/auth/organizations", organization, "teams", team, "display"), {
+				fetch: fetchImpl,
+				timeoutMs,
+				method: "POST",
+				credentials,
+				headers: {
+					...authHeaders(!authorization),
+					"content-type": "application/json"
+				},
+				body: desired,
+				mapError: fromOrganizationMutationAuthorityError
+			}));
+		},
 		listOrganizationMembers(organizationId, input) {
 			return organizationRead(`${normalizeIdInput(organizationId)}/members`, input, normalizeOrganizationMembers);
 		},

package/dist/{types-B67VIvTQ.d.ts → types-Byw9JQwL.d.ts}

@@ -34,6 +34,16 @@ interface AuthOrganization {
     readInvitations: boolean;
   };
 }
+interface OrganizationDisplay {
+  name: string;
+  slug: string;
+  logo: string | null;
+}
+type UpdateOrganizationDisplayInput = OrganizationDisplay;
+interface OrganizationTeamDisplay {
+  name: string;
+}
+type UpdateOrganizationTeamDisplayInput = OrganizationTeamDisplay;
 interface OrganizationPageInput {
   limit?: number;
   cursor?: string;
@@ -63,6 +73,19 @@ interface OrganizationTeam {
   category: "manual" | "managed";
   createdAt: Date;
 }
+interface CreatedOrganizationTeam {
+  id: string;
+  name: string;
+}
+interface CreateOrganizationMemberInvitationInput {
+  email: string;
+  teamIds?: string[];
+  idempotencyKey: string;
+}
+interface CreatedOrganizationMemberInvitation {
+  id: string;
+  expiresAt: Date;
+}
 interface OrganizationTeamPage {
   teams: OrganizationTeam[];
   nextCursor: string | null;
@@ -184,6 +207,10 @@ interface FinuevaAuthClient {
   getSession(): Promise<AuthSession | null>;
   listOrganizations(input?: OrganizationPageInput): Promise<OrganizationPage>;
   getOrganization(organizationId: string): Promise<AuthOrganization>;
+  createOrganizationTeam(organizationId: string, name: string, idempotencyKey: string): Promise<CreatedOrganizationTeam>;
+  createOrganizationMemberInvitation(organizationId: string, input: CreateOrganizationMemberInvitationInput): Promise<CreatedOrganizationMemberInvitation>;
+  updateOrganizationDisplay(organizationId: string, input: UpdateOrganizationDisplayInput): Promise<OrganizationDisplay>;
+  updateOrganizationTeamDisplay(organizationId: string, teamId: string, input: UpdateOrganizationTeamDisplayInput): Promise<OrganizationTeamDisplay>;
   listOrganizationMembers(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationMemberPage>;
   listOrganizationTeams(organizationId: string, input?: OrganizationPageInput): Promise<OrganizationTeamPage>;
   listOrganizationTeamMembers(organizationId: string, teamId: string, input?: OrganizationPageInput): Promise<OrganizationTeamMemberPage>;
@@ -205,4 +232,4 @@ interface FinuevaAuthClient {
   onSessionChange(listener: (session: AuthSession | null) => void): () => void;
 }
 //#endregion
-export { UpdateProfileInput as A, PersonalWorkspaceSelection as C, SignInInput as D, SendVerificationEmailInput as E, AuthError as M, AuthErrorCode as N, SocialIdTokenInput as O, AuthErrorStatus as P, OrganizationWorkspaceSelection as S, ReceivedOrganizationInvitationPage as T, OrganizationPage as _, AuthPersistenceDriver as a, OrganizationTeamMemberPage as b, AuthUser as c, FinuevaAuthClient as d, InvitationAcceptance as f, OrganizationMemberPage as g, OrganizationMember as h, AuthPersistence as i, WorkspaceSelection as j, SocialIdTokenProvider as k, DriveCredential as l, OrganizationInvitationPage as m, AuthClientOptions as n, AuthSession as o, OrganizationInvitation as p, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, DriveCredentialInput as u, OrganizationPageInput as v, ReceivedOrganizationInvitation as w, OrganizationTeamPage as x, OrganizationTeam as y };
+export { ReceivedOrganizationInvitationPage as A, AuthErrorCode as B, OrganizationTeam as C, OrganizationWorkspaceSelection as D, OrganizationTeamPage as E, UpdateOrganizationDisplayInput as F, UpdateOrganizationTeamDisplayInput as I, UpdateProfileInput as L, SignInInput as M, SocialIdTokenInput as N, PersonalWorkspaceSelection as O, SocialIdTokenProvider as P, WorkspaceSelection as R, OrganizationPageInput as S, OrganizationTeamMemberPage as T, AuthErrorStatus as V, OrganizationInvitation as _, AuthPersistenceDriver as a, OrganizationMemberPage as b, AuthUser as c, CreatedOrganizationTeam as d, DriveCredential as f, OrganizationDisplay as g, InvitationAcceptance as h, AuthPersistence as i, SendVerificationEmailInput as j, ReceivedOrganizationInvitation as k, CreateOrganizationMemberInvitationInput as l, FinuevaAuthClient as m, AuthClientOptions as n, AuthSession as o, DriveCredentialInput as p, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, CreatedOrganizationMemberInvitation as u, OrganizationInvitationPage as v, OrganizationTeamDisplay as w, OrganizationPage as x, OrganizationMember as y, AuthError as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,