@artu-ai/compliance-sdk 0.13.4 → 0.17.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artu AI, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,287 +1,194 @@
 # @artu-ai/compliance-sdk
 
-TypeScript SDK for the Artu Compliance API. Provides type-safe, scope-aware access to KYC verification and regulatory reporting functionality using a registry-based dispatch pattern.
+Type-safe TypeScript SDK for the Artu Compliance API — manage KYC/KYB clients, transactions, alerts, documents, and regulatory reporting, with first-class support for jurisdiction-specific compliance scopes (e.g. Mexico AML).
+
+- 🔒 Fully typed requests and responses
+- 🌎 Scope-aware: get types specific to a jurisdiction + activity (e.g. Mexico · Actividad Vulnerable · Activos Virtuales)
+- 🔁 Async auto-pagination
+- ✅ Client-side validation with clear, typed errors
 
 ## Installation
 
 ```bash
-# npm
 npm install @artu-ai/compliance-sdk
+```
 
-# pnpm
+```bash
 pnpm add @artu-ai/compliance-sdk
-
-# yarn
-yarn add @artu-ai/compliance-sdk
 ```
 
-### Private Package Access
-
-The SDK is a private npm package. Authenticate with npm:
-
 ```bash
-npm login --scope=@artu-ai
+yarn add @artu-ai/compliance-sdk
 ```
 
-Or add to your `.npmrc`:
+`@artu-ai/shared` and `zod` are installed automatically as dependencies.
 
-```ini
-//registry.npmjs.org/:_authToken=YOUR_NPM_TOKEN
-```
-
-## Quick Start
+## Quick start
 
 ```typescript
 import { ComplianceSDK, ClientType } from "@artu-ai/compliance-sdk";
 
-// Initialize the SDK (unscoped)
 const sdk = new ComplianceSDK({
   apiKey: process.env.ARTU_API_KEY,
-  environment: "test",
-});
-
-// Or initialize with a scope for typed resources
-const aviSdk = new ComplianceSDK({
-  apiKey: process.env.ARTU_API_KEY,
-  environment: "test",
-  scope: "MX:AV:AVI",
+  environment: "test", // "test" | "live"
 });
 
-// Create a client (AVI-typed)
-const client = await aviSdk.clients.create({
+// Create a client
+const client = await sdk.clients.create({
   type: ClientType.Individual,
   name: "Juan García",
+  scopes: ["MX"],
 });
 
-// List with auto-pagination
-for await (const txn of aviSdk.transactions.iterate()) {
+// Retrieve, update
+await sdk.clients.update(client.id, { name: "Juan A. García" });
+
+// Auto-paginate
+for await (const txn of sdk.transactions.iterate()) {
   console.log(txn.id, txn.amount);
 }
 ```
 
-## Project Structure
+## Authentication & configuration
 
-```
-src/
-├── sdk/                            # SDK classes
-│   ├── ComplianceSDK.ts            # Main SDK with scope dispatch
-│   ├── base.ts                     # Base scope registration
-│   ├── types.ts                    # SDK configuration types
-│   ├── resource-registry.ts        # Resource factory registry
-│   ├── sdk-registry.ts             # SDK class dispatch registry
-│   └── mex/                        # Mexico jurisdiction SDKs
-│       ├── ComplianceSDK.ts        # Mexico SDK class
-│       ├── types.ts
-│       ├── actividad-vulnerable/
-│       │   ├── avi/                # AVI SDK class + types
-│       │   ├── jys/                # JYS SDK class + types
-│       │   ├── mjr/                # MJR SDK class + types
-│       │   └── tsc/                # TSC SDK class + types
-│       └── cnbv/
-│           └── transmisor/         # CNBV Transmisor SDK class + types
-├── resources/                      # API resource methods
-│   ├── base.ts                     # BaseResource abstract class
-│   ├── clients.ts
-│   ├── addresses.ts
-│   ├── bank-accounts.ts
-│   ├── contact-methods.ts
-│   ├── documents.ts
-│   ├── transactions.ts
-│   ├── alerts.ts
-│   ├── reports.ts
-│   ├── rules.ts
-│   ├── rule-variables.ts
-│   ├── exchange-rates.ts
-│   ├── ocr.ts
-│   └── mex/                        # Mexico-specific resources
-│       ├── clients.ts              # MexClientsResource
-│       ├── transactions.ts
-│       ├── alerts.ts
-│       ├── addresses.ts
-│       ├── bank-accounts.ts
-│       ├── actividad-vulnerable/
-│       │   ├── avi/                # AVI-specific resources
-│       │   ├── jys/
-│       │   ├── mjr/
-│       │   └── tsc/
-│       └── cnbv/
-│           └── transmisor/
-├── models/                         # Data models with helpers
-│   ├── base.ts
-│   ├── Client.ts                   # Type guards (isIndividual, isCompany)
-│   ├── Transaction.ts
-│   ├── Alert.ts
-│   ├── Address.ts
-│   ├── BankAccount.ts
-│   ├── Document.ts
-│   └── mex/                        # Mexico-specific models
-├── errors/                         # Error types
-│   ├── base.ts
-│   ├── api.ts                      # ComplianceAPIError
-│   └── validation.ts               # ValidationError
-├── utils/
-│   ├── trpc-client.ts              # tRPC client factory
-│   ├── environment.ts              # Environment resolution
-│   ├── session.ts
-│   ├── filters.ts
-│   └── pagination.ts
-└── exports/                        # Entry point exports
-    ├── base.ts
-    ├── index.ts
-    └── mexico/
-        ├── index.ts
-        └── actividad-vulnerable/
-            ├── avi.ts
-            ├── jys.ts
-            ├── mjr.ts
-            └── tsc.ts
+```typescript
+const sdk = new ComplianceSDK({
+  apiKey: "sk_test_...",   // or the ARTU_API_KEY env var
+  environment: "test",      // "test" | "live"  (or ARTU_ENVIRONMENT)
+
+  // Optional
+  scope: "MX:AV:AVI",       // see "Scopes" below
+  baseUrl: "https://api.artu.ai",
+  organizationId: "org_...",
+  apiVersion: "v1",
+  timeout: 30000,            // ms
+});
 ```
 
-## Scope System
+Configuration can also be supplied via environment variables: `ARTU_API_KEY`,
+`ARTU_ENVIRONMENT`, `ARTU_BASE_URL`, `ARTU_ORGANIZATION_ID`.
 
-The SDK uses a **registry-based dispatch pattern**. When you construct a `ComplianceSDK` with a scope, it returns a scope-typed instance with the correct resource types:
+### Browser / server-side (cookie auth)
 
-```typescript
-import { ComplianceSDK } from "@artu-ai/compliance-sdk";
+For session-cookie authentication (e.g. a dashboard or a Next.js server component),
+use cookie mode instead of an API key:
 
-// Unscoped — base types
-const sdk = new ComplianceSDK({ apiKey, environment: "test" });
-
-// Mexico scope — Mexico-typed resources
-const mexSdk = new ComplianceSDK({ apiKey, environment: "test", scope: "MX" });
-
-// AVI scope — AVI-typed resources (clients, transactions, alerts)
-const aviSdk = new ComplianceSDK({ apiKey, environment: "test", scope: "MX:AV:AVI" });
+```typescript
+// Browser — send the session cookie with each request
+const sdk = new ComplianceSDK({ mode: "cookie", environment: "test", credentials: "include" });
 
-// Properties
-aviSdk.scope        // "MX:AV:AVI"
-aviSdk.isScoped     // true
-aviSdk.environment  // "test"
-aviSdk.isTest       // true
-aviSdk.isLive       // false
+// Next.js server component — forward the incoming cookie
+import { cookies } from "next/headers";
+const sdk = new ComplianceSDK({
+  mode: "cookie",
+  environment: "test",
+  headers: { cookie: (await cookies()).toString() },
+});
 ```
 
-### Scope-Specific Entry Points
+## Scopes
 
-For static typing without runtime dispatch, import from scope-specific entry points:
+Scopes partition data by jurisdiction and regulated activity. Pass a `scope` and the SDK
+returns an instance whose resources are typed for that scope:
 
 ```typescript
-// Unscoped
-import { ComplianceSDK } from "@artu-ai/compliance-sdk";
+// Unscoped — base types
+const sdk = new ComplianceSDK({ apiKey, environment: "test" });
 
 // Mexico
-import { ComplianceSDK } from "@artu-ai/compliance-sdk/mx";
+const mx = new ComplianceSDK({ apiKey, environment: "test", scope: "MX" });
 
-// Actividad Vulnerable scopes
-import { ComplianceSDK } from "@artu-ai/compliance-sdk/mx/av/avi";
-import { ComplianceSDK } from "@artu-ai/compliance-sdk/mx/av/jys";
-import { ComplianceSDK } from "@artu-ai/compliance-sdk/mx/av/mjr";
-import { ComplianceSDK } from "@artu-ai/compliance-sdk/mx/av/tsc";
+// Mexico · Actividad Vulnerable · Activos Virtuales (crypto) — AVI-typed resources
+const avi = new ComplianceSDK({ apiKey, environment: "test", scope: "MX:AV:AVI" });
 
-// CNBV
-import { ComplianceSDK } from "@artu-ai/compliance-sdk/mx/cnbv/transmisor";
+avi.scope;       // "MX:AV:AVI"
+avi.isScoped;    // true
+avi.environment; // "test"
+avi.isTest;      // true
 ```
 
-Each entry point re-exports scope-specific types:
+### Scoped entry points
+
+For static typing without runtime dispatch, import from a scope-specific entry point. Each
+re-exports the input/output types and resources for that scope:
 
 ```typescript
 import {
   ComplianceSDK,
-  type CreateClientInput,   // AVI-specific create input
-  type Client,              // AVI-typed client
-  ClientsResource,          // AVI clients resource
+  type CreateClientInput, // AVI-specific
+  type Client,            // AVI-typed
 } from "@artu-ai/compliance-sdk/mx/av/avi";
 ```
 
-### Resource Factory Pattern
-
-Resources are registered per scope and fall back to parent scopes:
-
-```
-Query for "MX:AV:AVI"
-├── Try exact match → AVIClientsResource, AVITransactionsResource
-├── Fallback to "MX" → MexBankAccountsResource, MexAddressesResource
-└── Fallback to "base" → DocumentsResource, RulesResource
-```
-
-## SDK Configuration
+Available entry points:
 
-```typescript
-const sdk = new ComplianceSDK({
-  // Auth (choose one mode)
-  mode: "apiKey",                        // "apiKey" | "cookie"
-  apiKey: string,                        // or ARTU_API_KEY env var
-  credentials: "include",               // for cookie mode (browser)
-  headers: { cookie: "..." },           // for cookie mode (Next.js server-side)
-
-  // Environment
-  environment: "test" | "live",          // or ARTU_ENVIRONMENT env var
-  baseUrl: string,                       // or ARTU_BASE_URL env var
-  organizationId: string,               // or ARTU_ORGANIZATION_ID env var
-
-  // Scope (optional)
-  scope: "MX:AV:AVI",                   // Jurisdiction scope
-
-  // Options
-  apiVersion: "v1",
-  timeout: 30000,                        // ms
-});
-```
+| Import path | Scope |
+| --- | --- |
+| `@artu-ai/compliance-sdk` | Base (all data) |
+| `@artu-ai/compliance-sdk/mx` | Mexico |
+| `@artu-ai/compliance-sdk/mx/av/avi` | MX · Actividad Vulnerable · Activos Virtuales |
+| `@artu-ai/compliance-sdk/mx/av/ari` | MX · Actividad Vulnerable · Arrendamiento |
+| `@artu-ai/compliance-sdk/mx/av/inm` | MX · Actividad Vulnerable · Inmuebles |
+| `@artu-ai/compliance-sdk/mx/av/jys` | MX · Actividad Vulnerable · Joyería y Piedras |
+| `@artu-ai/compliance-sdk/mx/av/mjr` | MX · Actividad Vulnerable · Metales y Joyas |
+| `@artu-ai/compliance-sdk/mx/av/tsc` | MX · Actividad Vulnerable · Tarjetas de Servicio |
+| `@artu-ai/compliance-sdk/mx/cnbv` | MX · CNBV |
+| `@artu-ai/compliance-sdk/mx/cnbv/transmisor` | MX · CNBV · Transmisores de Dinero |
 
 ## Resources
 
-| Resource             | Description        | Methods                                                     |
-| -------------------- | ------------------ | ----------------------------------------------------------- |
-| `sdk.clients`        | Client management  | `list`, `retrieve`, `create`, `update`, `delete`, `iterate` |
-| `sdk.addresses`      | Address management | `list`, `retrieve`, `create`, `update`, `delete`            |
-| `sdk.bankAccounts`   | Bank accounts      | `list`, `retrieve`, `create`, `update`, `delete`            |
-| `sdk.contactMethods` | Contact methods    | `list`, `retrieve`, `create`, `update`, `delete`            |
-| `sdk.documents`      | Documents          | `list`, `retrieve`, `create`, `update`, `delete`            |
-| `sdk.transactions`   | Transactions       | `list`, `retrieve`, `create`, `update`, `delete`, `iterate` |
-| `sdk.alerts`         | Alerts             | `list`, `retrieve`, `create`, `update`, `delete`, `generate`, `validate`, `submit` |
-| `sdk.reports`        | Reports            | `list`, `retrieve`, `create`                                |
-| `sdk.rules`          | Monitoring rules   | `list`, `retrieve`, `create`, `update`, `delete`            |
-| `sdk.ruleVariables`  | Rule variables     | `list`, `retrieve`, `create`, `update`, `delete`            |
-| `sdk.exchangeRates`  | Exchange rates     | `list`, `retrieve`                                          |
-| `sdk.ocr`            | OCR extraction     | `extract`                                                   |
+Resources are accessed as properties on the SDK instance. Each supports the standard
+operations — `list`, `retrieve`, `create`, `update`, `delete` — and list endpoints also
+provide `iterate()` for async auto-pagination.
+
+| Resource | Description |
+| --- | --- |
+| `sdk.clients` | KYC/KYB clients (individuals, companies, trusts) |
+| `sdk.transactions` | Transactions |
+| `sdk.alerts` | Regulatory alerts (also `generate`, `validate`, `submit`) |
+| `sdk.documents` | Documents |
+| `sdk.evidence` | Supporting evidence and file uploads |
+| `sdk.addresses` | Addresses |
+| `sdk.bankAccounts` | Bank accounts |
+| `sdk.contactMethods` | Contact methods |
+| `sdk.products` | Products |
+| `sdk.reports` | Regulatory reports |
+| `sdk.exchangeRates` | Exchange rates (read-only) |
+| `sdk.workflows` | Compliance workflows |
+| `sdk.auditLogs` | Audit trail (read-only) |
+| `sdk.tenant` | Tenant settings and defaults |
+
+The SDK also exposes account-management resources (`sdk.users`, `sdk.roles`, `sdk.apiKeys`).
+Workflow tooling is nested under `sdk.workflows` — `sdk.workflows.executions`,
+`.variables`, `.templates`, and `.links`. See the full API reference in the Artu documentation.
 
 ## Models
 
-All resources return model instances with helper methods:
+Resource methods return immutable model instances with typed accessors and type guards:
 
 ```typescript
 const client = await sdk.clients.retrieve("client_123");
 
-// Type guards
-if (client.isIndividual()) {
-  console.log(client.data.dateOfBirth);
+if (client.isIndividual) {
+  console.log(client.birthDate);
+} else if (client.isCompany) {
+  console.log(client.incorporationDate);
 }
-if (client.isCompany()) {
-  console.log(client.data.incorporationDate);
-}
-
-// Refresh from server
-await client.refresh();
 
-// Update in place
-await client.update({ name: "New Name" });
+// Models are immutable data containers — persist changes through the resource:
+const updated = await sdk.clients.update(client.id, { name: "New Name" });
 ```
 
 ## Pagination
 
-### Auto-pagination
-
 ```typescript
+// Auto-pagination
 for await (const client of sdk.clients.iterate()) {
   console.log(client.id);
 }
-```
 
-### Manual Pagination
-
-```typescript
+// Manual pagination
 const page1 = await sdk.clients.list({ limit: 10 });
-
 if (page1.hasMore) {
   const page2 = await sdk.clients.list({
     limit: 10,
@@ -290,80 +197,45 @@ if (page1.hasMore) {
 }
 ```
 
-## Filtering & Sorting
+## Filtering & sorting
 
 ```typescript
 const clients = await sdk.clients.list({
-  filter: {
-    type: "individual",
-    primaryJurisdiction: "mexico",
-  },
-  sort: {
-    field: "createdAt",
-    order: "desc",
-  },
+  filter: { type: "individual" },
+  sort: { field: "createdAt", order: "desc" },
 });
 ```
 
-## Error Handling
+## Error handling
+
+All errors extend `ComplianceError`. The two you'll handle most often are `ValidationError`
+(client-side input validation) and `APIError` (errors returned by the API):
 
 ```typescript
-import { ComplianceAPIError, ValidationError } from "@artu-ai/compliance-sdk";
+import { APIError, ValidationError } from "@artu-ai/compliance-sdk";
 
 try {
   await sdk.clients.create({ /* ... */ });
 } catch (error) {
   if (error instanceof ValidationError) {
-    console.log("Validation errors:", error.errors);
-  } else if (error instanceof ComplianceAPIError) {
+    console.log("Invalid input:", error.errors);
+  } else if (error instanceof APIError) {
     console.log("API error:", error.code, error.message);
   }
 }
 ```
 
-## API Communication
-
-The SDK communicates with the API via a tRPC client using `httpBatchLink`:
-
-```
-SDK method call (e.g., sdk.clients.list())
-    → Input validation (Zod schema)
-    → tRPC client call
-    → POST {baseUrl}/api/trpc (batched)
-    → Response deserialization
-    → Error mapping (tRPC → ValidationError | ComplianceAPIError)
-    → Return typed model instance
-```
-
-## Scripts
-
-| Script             | Description              |
-| ------------------ | ------------------------ |
-| `pnpm build`       | Build package            |
-| `pnpm test`        | Run tests                |
-| `pnpm test:watch`  | Run tests in watch mode  |
-| `pnpm lint`        | Run ESLint               |
-| `pnpm check-types` | TypeScript type checking |
-
-## Key Files
+`APIError` has typed subclasses you can narrow on when useful: `NotFoundError`,
+`UnauthorizedError`, `ForbiddenError`, `RateLimitError`, `ServerError`, `NetworkError`,
+and `TimeoutError`.
 
-| File | Description |
-| ---- | ----------- |
-| [`src/sdk/ComplianceSDK.ts`](./src/sdk/ComplianceSDK.ts) | Main SDK class with scope dispatch |
-| [`src/sdk/resource-registry.ts`](./src/sdk/resource-registry.ts) | Resource factory registration |
-| [`src/sdk/sdk-registry.ts`](./src/sdk/sdk-registry.ts) | SDK class dispatch |
-| [`src/resources/base.ts`](./src/resources/base.ts) | BaseResource abstract class |
-| [`src/models/`](./src/models/) | Data models with helper methods |
-| [`src/errors/`](./src/errors/) | Error type definitions |
-| [`src/utils/trpc-client.ts`](./src/utils/trpc-client.ts) | tRPC client factory |
+## Documentation
 
-## Related Packages
+Full guides and API reference are at **[docs.artu.ai](https://docs.artu.ai)**:
 
-- [`@artu-ai/compliance-sdk-react`](../sdk-react/README.md) - React hooks built on this SDK
-- [`@artu-ai/shared`](../shared/README.md) - Shared schemas, scopes, and types
-- [`apps/api`](../../apps/api/README.md) - API server
-- [`apps/docs`](../../apps/docs/README.md) - SDK documentation
+- [SDK guide](https://docs.artu.ai/sdk)
+- [API reference](https://docs.artu.ai/api-reference)
 
 ## License
 
-UNLICENSED - Private package for Artu AI organization members only.
+[MIT](./LICENSE)

package/dist/errors/api.d.ts

@@ -78,6 +78,22 @@ export declare class UnauthorizedError extends APIError {
 export declare class ForbiddenError extends APIError {
     constructor(message?: string, requestId?: string);
 }
+/**
+ * Organization mismatch error (403).
+ *
+ * Thrown when the client-asserted `X-Organization-ID` no longer matches the
+ * organization of the authenticated session — typically a stale browser tab
+ * after the user switched organizations in another tab. This is an expected,
+ * transient condition, not a permissions failure; host applications should
+ * recover by re-syncing to the session's current organization rather than
+ * surfacing it as an error.
+ *
+ * Subclasses `ForbiddenError` so existing `instanceof ForbiddenError` handling
+ * continues to work.
+ */
+export declare class OrganizationMismatchError extends ForbiddenError {
+    constructor(message?: string, requestId?: string);
+}
 /**
  * Rate limit exceeded error (429).
  * Includes retry information when available.
@@ -157,4 +173,3 @@ export declare function mapTRPCError(error: TRPCClientError<any>): ComplianceErr
  * @returns True if error is an instance of the specified type
  */
 export declare function isAPIError<T extends typeof APIError>(error: unknown, type?: T): error is InstanceType<T>;
-//# sourceMappingURL=api.d.ts.map

package/dist/errors/api.js

@@ -101,6 +101,25 @@ export class ForbiddenError extends APIError {
         this.name = "ForbiddenError";
     }
 }
+/**
+ * Organization mismatch error (403).
+ *
+ * Thrown when the client-asserted `X-Organization-ID` no longer matches the
+ * organization of the authenticated session — typically a stale browser tab
+ * after the user switched organizations in another tab. This is an expected,
+ * transient condition, not a permissions failure; host applications should
+ * recover by re-syncing to the session's current organization rather than
+ * surfacing it as an error.
+ *
+ * Subclasses `ForbiddenError` so existing `instanceof ForbiddenError` handling
+ * continues to work.
+ */
+export class OrganizationMismatchError extends ForbiddenError {
+    constructor(message = "Organization ID mismatch: the authenticated organization does not match the requested organization", requestId) {
+        super(message, requestId);
+        this.name = "OrganizationMismatchError";
+    }
+}
 /**
  * Rate limit exceeded error (429).
  * Includes retry information when available.
@@ -211,6 +230,9 @@ export function mapTRPCError(error) {
         case "UNAUTHORIZED":
             return new UnauthorizedError(error.message, requestId);
         case "FORBIDDEN":
+            if (data?.reason === "organization_mismatch") {
+                return new OrganizationMismatchError(error.message, requestId);
+            }
             return new ForbiddenError(error.message, requestId);
         case "BAD_REQUEST": {
             // Check for Zod validation errors

package/dist/errors/base.d.ts

@@ -84,4 +84,11 @@ export declare class ComplianceError extends Error {
      */
     toSupportInfo(): string;
 }
-//# sourceMappingURL=base.d.ts.map
+/**
+ * Thrown when a scoped SDK read is given an explicit scope filter without
+ * `crossScope: true`. The scoped SDK injects its own scope filter; passing
+ * one explicitly is ambiguous, so we fail loudly before the network call.
+ */
+export declare class ScopeViolationError extends ComplianceError {
+    constructor(scope: string, key: "scope" | "scopes");
+}

package/dist/errors/base.js

@@ -82,3 +82,15 @@ export class ComplianceError extends Error {
         return parts.join("\n");
     }
 }
+/**
+ * Thrown when a scoped SDK read is given an explicit scope filter without
+ * `crossScope: true`. The scoped SDK injects its own scope filter; passing
+ * one explicitly is ambiguous, so we fail loudly before the network call.
+ */
+export class ScopeViolationError extends ComplianceError {
+    constructor(scope, key) {
+        super(`Scoped SDK (scope=${scope}) cannot accept an explicit \`${key}\` filter. ` +
+            `Pass \`crossScope: true\` to broaden the query, or use an unscoped SDK.`, "SCOPE_VIOLATION");
+        this.name = "ScopeViolationError";
+    }
+}

package/dist/errors/index.d.ts

@@ -13,6 +13,7 @@
  * │   ├── NotFoundError
  * │   ├── UnauthorizedError
  * │   ├── ForbiddenError
+ * │   │   └── OrganizationMismatchError
  * │   ├── RateLimitError
  * │   ├── ServerError
  * │   ├── NetworkError
@@ -25,8 +26,8 @@
  *     └── UploadUrlExpiredError
  * ```
  */
-export { APIError, ForbiddenError, isAPIError, mapTRPCError, NetworkError, NotFoundError, RateLimitError, ServerError, TimeoutError, UnauthorizedError, } from "./api";
-export { ComplianceError, type ComplianceErrorJSON, type ComplianceErrorOptions, } from "./base";
+export { APIError, ForbiddenError, isAPIError, mapTRPCError, NetworkError, NotFoundError, OrganizationMismatchError, RateLimitError, ServerError, TimeoutError, UnauthorizedError, } from "./api";
+export { ComplianceError, type ComplianceErrorJSON, type ComplianceErrorOptions, ScopeViolationError, } from "./base";
+export { MigrationBlockedError } from "./migration";
 export { FileTooLargeError, InvalidFileTypeError, isUploadError, UploadAbortedError, UploadError, type UploadStage, UploadTimeoutError, UploadUrlExpiredError, } from "./upload";
 export { ValidationError, type ValidationIssue } from "./validation";
-//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.js

@@ -13,6 +13,7 @@
  * │   ├── NotFoundError
  * │   ├── UnauthorizedError
  * │   ├── ForbiddenError
+ * │   │   └── OrganizationMismatchError
  * │   ├── RateLimitError
  * │   ├── ServerError
  * │   ├── NetworkError
@@ -26,9 +27,11 @@
  * ```
  */
 // API errors
-export { APIError, ForbiddenError, isAPIError, mapTRPCError, NetworkError, NotFoundError, RateLimitError, ServerError, TimeoutError, UnauthorizedError, } from "./api";
+export { APIError, ForbiddenError, isAPIError, mapTRPCError, NetworkError, NotFoundError, OrganizationMismatchError, RateLimitError, ServerError, TimeoutError, UnauthorizedError, } from "./api";
 // Base error
-export { ComplianceError, } from "./base";
+export { ComplianceError, ScopeViolationError, } from "./base";
+// Migration errors
+export { MigrationBlockedError } from "./migration";
 // Upload errors
 export { FileTooLargeError, InvalidFileTypeError, isUploadError, UploadAbortedError, UploadError, UploadTimeoutError, UploadUrlExpiredError, } from "./upload";
 // Validation errors