@foir/sdk 0.24.0 → 0.26.0

package/CHANGELOG.md

@@ -108,6 +108,73 @@ nobody asking for `@foir/sdk` gets it early. The push that carries the commit to
 
 Changes on `dev` that have not been published to npm.
 
+## [0.26.0] — 2026-10-19
+
+### Changed
+
+- **`session.request` in `@foir/sdk/placement` throws `PlacementRequestFailed`.**
+  Its message says each distinct refusal once, where it repeated a read
+  refused on a field once per row, and its `errors` keeps every error with its
+  `path`. It is still an `Error`, so a caller that reads `message` is
+  unaffected.
+
+### Added
+
+- **A hosted sign-in can name the organization it is for** (`@foir/sdk/auth`,
+  `@foir/sdk/react`): `hostedLoginUrl(config, returnTo, { org })`, a session
+  client's `signInUrl(returnTo, { org })` and the provider's
+  `hostedSignInUrl(returnTo, { org })`. Use it when one auth client serves an
+  address per organization. The login domain's front door passes it on, and
+  the sign-in takes that organization's branding, providers and return
+  addresses. The platform refuses an organization other than the one the
+  domain or app is bound to, one of another project, and one that is not
+  active.
+- **`HostedLoginOptions`** (`@foir/sdk/auth`, type).
+
+## [0.25.0] — 2026-10-18
+
+### Changed
+
+- **`deleteMyAccount` for an account with no password needs a recent sign-in**
+  (`@foir/sdk/auth`). `confirm` alone used to be enough. Now it's refused
+  unless the user signed in within the last ten minutes, so a stolen session
+  can't delete an account. Migration: when it's refused, send the user through
+  sign-in again, then call it once more.
+
+### Added
+
+- **`organizations.pool`, `organizations.startPool` and `organizations.dropPool`**
+  (`@foir/sdk/app`). In an operation, read which pool the people of the
+  organisation the run acts in sign in to, start its own pool, or drop it.
+  Reading needs `organizations:read`, and the other two `organizations:write`.
+  Starting one is refused while anybody of the pool it signs in to now stands
+  in it or beneath it, and dropping one while it holds anybody; each refusal
+  says how many. Each answers an `AppOrganizationPool`.
+- **`AppOrganizationPool`** (`@foir/sdk/app`, type).
+- **`organizations.provision` makes its first member by address**
+  (`@foir/sdk/app`): `firstMember: { email, firstName?, lastName? }`, made in
+  the pool that serves the new organisation (its own with `ownPool`). It also
+  needs `users:create`.
+- **`leaveMembership`** (`@foir/sdk/auth`). The signed-in person ends their own
+  membership where the request stands: the organisation `orgId` names, or the
+  project's own. It asks no permission. It's refused where it would leave an
+  organisation with nobody who can staff it, or leave them nowhere to sign in,
+  since a project's people sign in only where they stand.
+- **`myAddresses`, `addMyAddress`, `proveMyAddress`, `makeMyAddressPrimary`
+  and `removeMyAddress`** (`@foir/sdk/auth`), and the **`MyAddress`** type. A
+  signed-in person adds an email address to their own account. It's kept only
+  once the code it was sent proves it. Adding one asks for their current
+  password, or, for an account with none, a sign-in in the last ten minutes.
+  An address another account in the project holds isn't added. The address
+  the account uses moves only to a proven one, and it can't be removed.
+- **`exportMyData`** (`@foir/sdk/auth`), and the **`MyDataExport`** type. A
+  signed-in person takes a copy of their own data: their account, and
+  everything deleting it would erase (the records and files they own). It
+  holds no password, code or token value.
+- **`renameFactor`** (`@foir/sdk/auth`). A signed-in person renames one of
+  their own security keys or passkeys. A name proves nothing, so it asks for
+  no step-up.
+
 ## [0.24.0] — 2026-10-18
 
 ### Changed

package/dist/app/client.d.ts

@@ -222,20 +222,42 @@ export interface AppOrganizationProvision {
         data: Record<string, unknown>;
     };
     /**
-     * The user who becomes its first member. They are given the role the
-     * project names for an organisation's founder, in its settings: the
-     * operation chooses who, and the project decides what they hold.
+     * Who becomes its first member: a user the project has, by `userId`, or
+     * somebody the provision makes by `email` in the pool that serves the new
+     * organisation, which is its own with `ownPool`. That is how an organisation
+     * that signs its own people in gets its first person; making one also needs
+     * `users:create`. They are given the role the project names for an
+     * organisation's founder, in its settings: the operation chooses who, and
+     * the project decides what they hold.
      */
     firstMember?: {
         userId: string;
+    } | {
+        email: string;
+        firstName?: string;
+        lastName?: string;
     };
     /**
      * The organisation signs its own people in, to a pool of its own, apart
      * from its parent's and the project's. Its descendants share that pool
-     * unless one of them starts another. Chosen now, when it is made.
+     * unless one of them starts another. One that exists already starts one
+     * with `organizations.startPool`.
      */
     ownPool?: boolean;
 }
+/**
+ * The pool an organisation's people sign in to, and where it comes from: its
+ * own, the nearest organisation above it that started one, or the project's.
+ */
+export interface AppOrganizationPool {
+    organizationId: string;
+    poolId: string;
+    source: 'OWN' | 'ANCESTOR' | 'PROJECT';
+    /** The organisation whose own pool it is. Null for the project's. */
+    sourceOrganizationId: string | null;
+    /** How many people the pool holds, when it is the organisation's own. Null for any other. */
+    people: number | null;
+}
 /**
  * Who a consent change is for: a user whose id the app holds, or an
  * address.
@@ -556,6 +578,32 @@ export interface AppClient {
                 name: string;
             }[];
         }>;
+        /**
+         * Which pool the people of the organisation this run acts in sign in to.
+         * Needs `organizations:read`. Like every call here it takes no
+         * organisation: the run acts in the one whoever triggered it stands in.
+         */
+        pool(): Promise<AppOrganizationPool>;
+        /**
+         * Start the own pool of the organisation this run acts in, which it and
+         * everything beneath it sign their people in to. Needs
+         * `organizations:write`. Refused while
+         * anybody of the pool it signs in to now holds a membership in it or
+         * beneath it, or an invitation there is open to that pool, and the
+         * refusal says how many: nobody is moved between pools, so those
+         * memberships are removed first and those people sign up again in the
+         * new pool. Its apps, and those beneath it, then sign their people in
+         * there, and anybody signed in through them is signed out. Safe to run
+         * again: it answers the pool it has.
+         */
+        startPool(): Promise<AppOrganizationPool>;
+        /**
+         * Drop the own pool of the organisation this run acts in, so it signs its
+         * people in to the pool above it. Needs `organizations:write`. Refused
+         * while the pool holds anybody or an invitation is open to it: dropping a
+         * pool deletes nobody.
+         */
+        dropPool(): Promise<AppOrganizationPool>;
     };
     notifications: {
         /** Tell a user something. Needs `notifications:write.named`. */

package/dist/app/index.d.ts

@@ -21,7 +21,7 @@
  * The manifest's own messages are on `@foir/sdk/app/contract`.
  */
 export { createAppClient } from './client';
-export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppUser, AppUserEraseResult, AppUserList, AppUserSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
+export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppUser, AppUserEraseResult, AppUserList, AppUserSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationPool, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
 export { appUserEmailUnavailableOf, appUserUnlinkedOf, appLookupConflictOf, isAppFieldWithheld } from './errors';
 export type { AppUserEmailUnavailableReason, AppLookupConflict } from './errors';
 export { appModelFieldName, appModelTypeName, appSelectorEnumValue } from './naming';

package/dist/app.js

@@ -352,6 +352,20 @@ function createAppClient(config) {
   const refuse = (message) => {
     throw new FoirRequestError(`[foir] ${message}`);
   };
+  const POOL_FIELDS = "organizationId poolId source sourceOrganizationId people";
+  async function poolOf(name, document) {
+    const answer = await field(name, document, {});
+    if (!answer?.poolId || !answer.organizationId || answer.source !== "OWN" && answer.source !== "ANCESTOR" && answer.source !== "PROJECT") {
+      return refuse(`${name} reported no error and answered no pool`);
+    }
+    return {
+      organizationId: answer.organizationId,
+      poolId: answer.poolId,
+      source: answer.source,
+      sourceOrganizationId: answer.sourceOrganizationId ?? null,
+      people: answer.people ?? null
+    };
+  }
   let surface;
   function served() {
     surface ??= withFoirRetry(async () => {
@@ -825,9 +839,20 @@ function createAppClient(config) {
           if (settings.modelKey.trim() === "") return refuse("an organisation's settings name the model they are a record of");
           input.settings = { modelKey: settings.modelKey.trim(), data: settings.data };
         }
-        if (organization.firstMember !== void 0) {
-          if (organization.firstMember.userId === "") return refuse("a first member names a user");
-          input.firstMember = { userId: organization.firstMember.userId };
+        const first = organization.firstMember;
+        if (first !== void 0) {
+          if ("email" in first) {
+            const email = first.email.trim();
+            if (email === "") return refuse("a first member made by address names the address");
+            input.firstMember = {
+              email,
+              ...first.firstName !== void 0 ? { firstName: first.firstName } : {},
+              ...first.lastName !== void 0 ? { lastName: first.lastName } : {}
+            };
+          } else {
+            if (first.userId === "") return refuse("a first member names a user");
+            input.firstMember = { userId: first.userId };
+          }
         }
         if (organization.ownPool === true) input.ownPool = true;
         const answered = settings === void 0 ? "organizationId status" : "organizationId settingsRecordId status";
@@ -853,6 +878,15 @@ function createAppClient(config) {
           deletionScheduledAt: answer.deletionScheduledAt ?? null,
           organizations: (answer.organizations ?? []).map((o) => ({ id: o.id, name: o.name }))
         };
+      },
+      async pool() {
+        return poolOf("organizationPool", `query AppOrganizationPool { organizationPool { ${POOL_FIELDS} } }`);
+      },
+      async startPool() {
+        return poolOf("startOrganizationPool", `mutation AppStartOrganizationPool { startOrganizationPool { ${POOL_FIELDS} } }`);
+      },
+      async dropPool() {
+        return poolOf("dropOrganizationPool", `mutation AppDropOrganizationPool { dropOrganizationPool { ${POOL_FIELDS} } }`);
       }
     },
     notifications: {

package/dist/auth/auth.d.ts

@@ -17,7 +17,7 @@
  */
 import { type FoirEnv } from '../graphql/foir-request';
 import { type AuthOpName, type AuthOpOptions } from './ops';
-import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyProfile, type MyProfileChange, type MySession, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext } from './operations';
+import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyProfile, type MyProfileChange, type MySession, type MyAddress, type MyDataExport, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext } from './operations';
 import type { TypedDocumentNode } from '@graphql-typed-document-node/core';
 /** An access token + its rotating refresh token. */
 export interface FoirAuthTokens {
@@ -191,14 +191,26 @@ export declare function myProviderToken(env: FoirEnv, providerKey: string, optio
 export declare function logout(env: FoirEnv, options?: AuthOpOptions): Promise<boolean>;
 /**
  * Delete the calling user's account and their owned records and files.
- * Irreversible. `password` is required for password accounts and omitted for
- * provider-only ones; the server enforces the actual re-auth gate and fails
- * closed, so omitting it is refused rather than allowed.
+ * Irreversible. `password` is required for an account that holds one. An
+ * account with none sets `confirm`, on a sign-in made in the last ten minutes:
+ * an older one is refused, and the user signs in again. The server enforces
+ * the re-auth gate and fails closed.
  */
 export declare function deleteMyAccount(env: FoirEnv, vars: {
     confirm: boolean;
     password?: string;
 }, options?: AuthOpOptions): Promise<DeleteAccountResult>;
+/**
+ * End the calling user's own membership where the request stands: the
+ * organization `orgId` names, or, with none, the project's own. Every role
+ * they hold there ends with it; their account and what they made stay.
+ * `false` when they held no membership there.
+ *
+ * Refused where it would leave an organization with nobody who can staff it,
+ * or leave them nowhere to sign in: a person keeps one membership in the
+ * project, and {@link deleteMyAccount} is how they leave altogether.
+ */
+export declare function leaveMembership(env: FoirEnv, options?: AuthOpOptions): Promise<boolean>;
 /**
  * Change the calling user's own name, picture or language. It asks no
  * permission: these are theirs.
@@ -235,6 +247,41 @@ export declare function createPersonalAccessToken(env: FoirEnv, vars: {
     name: string;
     expiresInDays: number;
 }, options?: AuthOpOptions): Promise<NewPersonalAccessToken>;
+/** The email addresses the calling user is known by, the one their account uses first. */
+export declare function myAddresses(env: FoirEnv, options?: AuthOpOptions): Promise<MyAddress[]>;
+/**
+ * Send a code to an address the calling user is adding to their account, and
+ * answer when it stops working (ISO-8601, ten minutes on). The address is kept
+ * by {@link proveMyAddress}. `password` is their current one; an account with
+ * none needs a sign-in in the last ten minutes instead. At most five codes an
+ * hour.
+ */
+export declare function addMyAddress(env: FoirEnv, vars: {
+    email: string;
+    password?: string;
+}, options?: AuthOpOptions): Promise<string>;
+/**
+ * Keep the address a code was sent to, as proven. Refused where another
+ * account in the project holds the address: nobody's address is taken.
+ */
+export declare function proveMyAddress(env: FoirEnv, vars: {
+    email: string;
+    code: string;
+}, options?: AuthOpOptions): Promise<MyAddress>;
+/** Make one of the calling user's proven addresses the one their account uses. */
+export declare function makeMyAddressPrimary(env: FoirEnv, email: string, options?: AuthOpOptions): Promise<MyAddress>;
+/**
+ * Remove one of the calling user's addresses. The one their account uses
+ * stays: make another primary first.
+ */
+export declare function removeMyAddress(env: FoirEnv, email: string, options?: AuthOpOptions): Promise<boolean>;
+/**
+ * A copy of the calling user's own data: their account (profile, addresses,
+ * memberships and roles, sign-in providers, authorised apps, sessions and
+ * notification preferences) and everything deleting it would erase, the
+ * records and files they own.
+ */
+export declare function exportMyData(env: FoirEnv, options?: AuthOpOptions): Promise<MyDataExport>;
 /** The providers the calling user signs in with. */
 export declare function mySignInMethods(env: FoirEnv, options?: AuthOpOptions): Promise<MySignInMethod[]>;
 /**
@@ -295,6 +342,15 @@ export declare function removeFactor(env: FoirEnv, vars: {
     kind: string;
     id: string;
 }, options?: AuthOpOptions): Promise<boolean>;
+/**
+ * Rename one of the calling user's security keys or passkeys. A name proves
+ * nothing and admits nobody, so no step-up is asked.
+ */
+export declare function renameFactor(env: FoirEnv, vars: {
+    kind: 'security_key' | 'passkey';
+    id: string;
+    name: string;
+}, options?: AuthOpOptions): Promise<MyFactor>;
 /**
  * Make the calling user new recovery codes, with an elevated handle from
  * {@link completeStepUp}. They replace any held and are answered here once.

package/dist/auth/hosted.d.ts

@@ -27,11 +27,22 @@ export interface HostedLoginConfig {
      */
     clientId?: string;
 }
+/** What a sign-in started at the hosted front door is for. */
+export interface HostedLoginOptions {
+    /**
+     * The organization the person signs in to, when one auth client serves an
+     * address per organization. It decides the branding, the pool, and which
+     * addresses the person may come back to. The platform refuses an
+     * organization other than the one the login domain or app is bound to, one
+     * of another project, and one that is not active.
+     */
+    org?: string;
+}
 /**
- * Build the redirect URL to the hosted front door, forwarding a best-effort
- * absolute `returnTo` (honoured if the front door supports it).
+ * Build the redirect URL to the hosted front door, forwarding an absolute
+ * `returnTo` and, where the app names one, the organization the sign-in is for.
  */
-export declare function hostedLoginUrl(config: HostedLoginConfig, returnTo?: string): string;
+export declare function hostedLoginUrl(config: HostedLoginConfig, returnTo?: string, options?: HostedLoginOptions): string;
 /**
  * Build the redirect URL that ENDS the hosted session — the mirror of
  * `hostedLoginUrl`, and the only thing that actually signs a user out on

package/dist/auth/index.d.ts

@@ -10,7 +10,7 @@
  * the caller's own manifest advertises, through the same op transport
  * `@foir/sdk/data` uses, so `graphql` is not on this module's path at all.
  */
-export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, currentUser, myProviderToken, logout, deleteMyAccount, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, makeRecoveryCodes, myOrganizations, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
+export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, currentUser, myProviderToken, logout, deleteMyAccount, leaveMembership, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, myAddresses, addMyAddress, proveMyAddress, makeMyAddressPrimary, removeMyAddress, exportMyData, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, renameFactor, makeRecoveryCodes, myOrganizations, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
 export type { FoirAuthTokens, FoirUser, SessionAdapter, RequireAuthOptions, } from './auth';
 export { userAccess, getSessionAccess, hasRole, hasScope, requireRole, requireScope, FoirAccessDeniedError, } from './access';
 export type { FoirAccess, FoirAccessDenial } from './access';
@@ -18,7 +18,7 @@ export { FoirAuthDowngradedError, FoirSessionExpiredError } from '../graphql/foi
 export { AUTH_OPS } from './ops';
 export type { AuthOpName, AuthOpOptions } from './ops';
 export { hostedLoginUrl, hostedLogoutUrl, fetchHostedSession, hostedSignInNoticeOf } from './hosted';
-export type { HostedLoginConfig, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
+export type { HostedLoginConfig, HostedLoginOptions, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
 export { createFoirSessionClient } from './session-client';
 export type { FoirSessionClient, FoirSessionConfig, FoirSessionUser, } from './session-client';
-export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';
+export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, MyAddress, MyDataExport, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';

package/dist/auth/operations.d.ts

@@ -200,6 +200,61 @@ export interface MySession {
     /** Whether it is the session making the request. */
     current: boolean;
 }
+/** An email address the calling user is known by. */
+export interface MyAddress {
+    email: string;
+    /** Whether it is the address their account uses: shown for them, and where mail to them goes. */
+    primary: boolean;
+    /** Whether they proved they hold it. Every address they added is proven. */
+    proven: boolean;
+    /** ISO-8601. */
+    addedAt: string | null;
+}
+/**
+ * The calling user's copy of their own data, the `foir.my-data.v1` document:
+ * their account and everything deleting it would erase. No password, code or
+ * token value is in it.
+ */
+export interface MyDataExport {
+    format: 'foir.my-data.v1';
+    /** ISO-8601. */
+    exportedAt: string;
+    account: Record<string, unknown> & {
+        id: string;
+        pool: string;
+        poolKind: string;
+        status: string;
+    };
+    addresses: Array<{
+        email: string;
+        primary: boolean;
+        proven: boolean;
+        addedAt?: string;
+    }>;
+    memberships: Array<Record<string, unknown> & {
+        roles: string[];
+    }>;
+    signInMethods: Array<Record<string, unknown>>;
+    authorizedApps: Array<Record<string, unknown>>;
+    sessions: Array<Record<string, unknown>>;
+    notificationPreferences: Array<Record<string, unknown>>;
+    /** The records the user owns, each with the content it holds now. */
+    records: Array<{
+        id: string;
+        model: string;
+        key?: string;
+        project: string;
+        data: Record<string, unknown>;
+    }>;
+    /** The files the user owns; their bytes are fetched from `url`. */
+    files: Array<{
+        id: string;
+        name: string;
+        mimeType: string;
+        size: number;
+        url: string;
+    }>;
+}
 /** A personal access token just made: its value is shown here once. */
 export interface NewPersonalAccessToken {
     token: MySession;

package/dist/auth/ops.d.ts

@@ -56,12 +56,19 @@ export declare const AUTH_OPS: {
     readonly resetPassword: "resetPassword";
     readonly updatePassword: "updatePassword";
     readonly deleteMyAccount: "deleteMyAccount";
+    readonly leaveMembership: "leaveMembership";
     readonly updateMyProfile: "updateMyProfile";
     readonly myAuthorizedApps: "myAuthorizedApps";
     readonly revokeAuthorizedApp: "revokeAuthorizedApp";
     readonly mySessions: "mySessions";
     readonly endMySession: "endMySession";
     readonly signOutEverywhere: "signOutEverywhere";
+    readonly myAddresses: "myAddresses";
+    readonly addMyAddress: "addMyAddress";
+    readonly proveMyAddress: "proveMyAddress";
+    readonly makeMyAddressPrimary: "makeMyAddressPrimary";
+    readonly removeMyAddress: "removeMyAddress";
+    readonly exportMyData: "exportMyData";
     readonly createPersonalAccessToken: "createPersonalAccessToken";
     readonly mySignInMethods: "mySignInMethods";
     readonly connectSignInMethod: "connectSignInMethod";
@@ -72,6 +79,7 @@ export declare const AUTH_OPS: {
     readonly beginFactorEnrollment: "beginFactorEnrollment";
     readonly completeFactorEnrollment: "completeFactorEnrollment";
     readonly removeFactor: "removeFactor";
+    readonly renameFactor: "renameFactor";
     readonly makeRecoveryCodes: "makeRecoveryCodes";
     readonly myOrganizations: "myOrganizations";
     readonly registerOrganization: "registerOrganization";

package/dist/auth/session-client.d.ts

@@ -27,6 +27,7 @@
  * api.foir.dev but a browser cannot reach them there — the cookie would be
  * cross-site, and that CORS surface deliberately refuses credentials.
  */
+import type { HostedLoginOptions } from './hosted';
 export interface FoirSessionConfig {
     /**
      * Your verified custom login domain, e.g. `https://login.acme.com`. Must share
@@ -66,8 +67,12 @@ export interface FoirSessionClient {
     getUser(): Promise<FoirSessionUser | null>;
     /** Revoke the session server-side and clear the cookie. Idempotent. */
     signOut(): Promise<void>;
-    /** Where to send the browser to sign in. */
-    signInUrl(returnTo?: string): string;
+    /**
+     * Where to send the browser to sign in. Name the organization the sign-in is
+     * for with `options.org` when one auth client serves an address per
+     * organization.
+     */
+    signInUrl(returnTo?: string, options?: HostedLoginOptions): string;
     /** Observe session changes. Returns an unsubscribe function. */
     subscribe(listener: (user: FoirSessionUser | null) => void): () => void;
     /** Cancel the refresh timer. Call on unmount. */

package/dist/auth-session.js

@@ -113,10 +113,11 @@ function createFoirSessionClient(config) {
       forget();
       config.onSignOut?.();
     },
-    signInUrl(returnTo) {
+    signInUrl(returnTo, options = {}) {
       const dest = new URL(trimSlash(config.loginOrigin));
       const target = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
       if (target && target !== "/") dest.searchParams.set("returnTo", target);
+      if (options.org) dest.searchParams.set("org", options.org);
       return dest.toString();
     },
     subscribe(listener) {

package/dist/auth.js

@@ -1094,6 +1094,8 @@ var AUTH_OPS = {
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
   deleteMyAccount: "deleteMyAccount",
+  // Ending their own membership where the request stands.
+  leaveMembership: "leaveMembership",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
   myAuthorizedApps: "myAuthorizedApps",
@@ -1103,6 +1105,14 @@ var AUTH_OPS = {
   mySessions: "mySessions",
   endMySession: "endMySession",
   signOutEverywhere: "signOutEverywhere",
+  // Their email addresses: one added is kept once the code it was sent proves it.
+  myAddresses: "myAddresses",
+  addMyAddress: "addMyAddress",
+  proveMyAddress: "proveMyAddress",
+  makeMyAddressPrimary: "makeMyAddressPrimary",
+  removeMyAddress: "removeMyAddress",
+  // A copy of their own data.
+  exportMyData: "exportMyData",
   createPersonalAccessToken: "createPersonalAccessToken",
   mySignInMethods: "mySignInMethods",
   connectSignInMethod: "connectSignInMethod",
@@ -1114,6 +1124,7 @@ var AUTH_OPS = {
   beginFactorEnrollment: "beginFactorEnrollment",
   completeFactorEnrollment: "completeFactorEnrollment",
   removeFactor: "removeFactor",
+  renameFactor: "renameFactor",
   makeRecoveryCodes: "makeRecoveryCodes",
   // The organizations the caller may stand in. Nothing selects one: a request
   // names the organization it acts in (`orgId` or `orgUrl` below), and the
@@ -1282,6 +1293,9 @@ async function logout(env, options) {
 async function deleteMyAccount(env, vars, options) {
   return authOp(env, AUTH_OPS.deleteMyAccount, vars, options);
 }
+async function leaveMembership(env, options) {
+  return authOp(env, AUTH_OPS.leaveMembership, void 0, options);
+}
 async function updateMyProfile(env, change, options) {
   return authOp(env, AUTH_OPS.updateMyProfile, change, options);
 }
@@ -1303,6 +1317,24 @@ async function signOutEverywhere(env, vars = {}, options) {
 async function createPersonalAccessToken(env, vars, options) {
   return authOp(env, AUTH_OPS.createPersonalAccessToken, vars, options);
 }
+async function myAddresses(env, options) {
+  return authOp(env, AUTH_OPS.myAddresses, void 0, options);
+}
+async function addMyAddress(env, vars, options) {
+  return authOp(env, AUTH_OPS.addMyAddress, vars, options);
+}
+async function proveMyAddress(env, vars, options) {
+  return authOp(env, AUTH_OPS.proveMyAddress, vars, options);
+}
+async function makeMyAddressPrimary(env, email, options) {
+  return authOp(env, AUTH_OPS.makeMyAddressPrimary, { email }, options);
+}
+async function removeMyAddress(env, email, options) {
+  return authOp(env, AUTH_OPS.removeMyAddress, { email }, options);
+}
+async function exportMyData(env, options) {
+  return authOp(env, AUTH_OPS.exportMyData, void 0, options);
+}
 async function mySignInMethods(env, options) {
   return authOp(env, AUTH_OPS.mySignInMethods, void 0, options);
 }
@@ -1330,6 +1362,9 @@ async function completeFactorEnrollment(env, vars, options) {
 async function removeFactor(env, vars, options) {
   return authOp(env, AUTH_OPS.removeFactor, vars, options);
 }
+async function renameFactor(env, vars, options) {
+  return authOp(env, AUTH_OPS.renameFactor, vars, options);
+}
 async function makeRecoveryCodes(env, elevatedHandle, options) {
   return authOp(env, AUTH_OPS.makeRecoveryCodes, { elevatedHandle }, options);
 }
@@ -1532,6 +1567,8 @@ var GRANT_TABLE = [
   ["authclients:write", "none", [], []],
   ["domains:read", "none", [], []],
   ["domains:write", "none", [], []],
+  ["loginpages:read", "none", [], []],
+  ["loginpages:write", "none", [], []],
   ["secrets:read", "none", [], []],
   ["secrets:list", "none", [], []],
   ["secrets:put", "none", [], []],
@@ -1569,7 +1606,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -1762,11 +1799,14 @@ async function requireScope(adapter, env, scope) {
 var DEFAULT_COOKIE_NAME = "foir_session";
 var DEFAULT_SESSION_PATH = "/session/token";
 var DEFAULT_END_SESSION_PATH = "/session/end-session";
-function hostedLoginUrl(config, returnTo) {
+function hostedLoginUrl(config, returnTo, options = {}) {
   const dest = new URL(config.loginOrigin);
   if (returnTo && returnTo !== "/") {
     dest.searchParams.set("returnTo", returnTo);
   }
+  if (options.org) {
+    dest.searchParams.set("org", options.org);
+  }
   return dest.toString();
 }
 function hostedLogoutUrl(config, clientId, returnTo) {
@@ -1982,10 +2022,11 @@ function createFoirSessionClient(config) {
       forget();
       config.onSignOut?.();
     },
-    signInUrl(returnTo) {
+    signInUrl(returnTo, options = {}) {
       const dest = new URL(trimSlash(config.loginOrigin));
       const target = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
       if (target && target !== "/") dest.searchParams.set("returnTo", target);
+      if (options.org) dest.searchParams.set("org", options.org);
       return dest.toString();
     },
     subscribe(listener) {
@@ -2007,6 +2048,7 @@ export {
   FoirAccessDeniedError,
   FoirAuthDowngradedError,
   FoirSessionExpiredError,
+  addMyAddress,
   authedOp,
   authedRequest,
   beginFactorEnrollment,
@@ -2022,6 +2064,7 @@ export {
   deleteMyAccount,
   disconnectSignInMethod,
   endMySession,
+  exportMyData,
   fetchHostedSession,
   getAuthConfig,
   getAuthProviders,
@@ -2035,17 +2078,21 @@ export {
   hostedLogoutUrl,
   hostedSignInNoticeOf,
   joinWaitlist,
+  leaveMembership,
   login,
   loginWithOTP,
   loginWithProvider,
   logout,
+  makeMyAddressPrimary,
   makeRecoveryCodes,
+  myAddresses,
   myAuthorizedApps,
   myFactors,
   myOrganizations,
   myProviderToken,
   mySessions,
   mySignInMethods,
+  proveMyAddress,
   providerCallback,
   providerSignInRefusalOf,
   providerVerifyOTP,
@@ -2055,6 +2102,8 @@ export {
   register,
   registerOrganization,
   removeFactor,
+  removeMyAddress,
+  renameFactor,
   requestOTP,
   requestPasswordReset,
   requireAuth,

package/dist/next.js

@@ -974,6 +974,8 @@ var AUTH_OPS = {
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
   deleteMyAccount: "deleteMyAccount",
+  // Ending their own membership where the request stands.
+  leaveMembership: "leaveMembership",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
   myAuthorizedApps: "myAuthorizedApps",
@@ -983,6 +985,14 @@ var AUTH_OPS = {
   mySessions: "mySessions",
   endMySession: "endMySession",
   signOutEverywhere: "signOutEverywhere",
+  // Their email addresses: one added is kept once the code it was sent proves it.
+  myAddresses: "myAddresses",
+  addMyAddress: "addMyAddress",
+  proveMyAddress: "proveMyAddress",
+  makeMyAddressPrimary: "makeMyAddressPrimary",
+  removeMyAddress: "removeMyAddress",
+  // A copy of their own data.
+  exportMyData: "exportMyData",
   createPersonalAccessToken: "createPersonalAccessToken",
   mySignInMethods: "mySignInMethods",
   connectSignInMethod: "connectSignInMethod",
@@ -994,6 +1004,7 @@ var AUTH_OPS = {
   beginFactorEnrollment: "beginFactorEnrollment",
   completeFactorEnrollment: "completeFactorEnrollment",
   removeFactor: "removeFactor",
+  renameFactor: "renameFactor",
   makeRecoveryCodes: "makeRecoveryCodes",
   // The organizations the caller may stand in. Nothing selects one: a request
   // names the organization it acts in (`orgId` or `orgUrl` below), and the

package/dist/placement/index.d.ts

@@ -113,6 +113,23 @@ export declare function placementFrameAncestors(origins: readonly string[]): str
 export declare class PlacementRefused extends Error {
     constructor(reason: string);
 }
+/** One error of a GraphQL answer, as Foir's API sends it. */
+export interface PlacementRequestError {
+    message: string;
+    path?: (string | number)[];
+    extensions?: Record<string, unknown>;
+}
+/**
+ * A request the page made on its token that Foir's API refused or failed.
+ * The message says each distinct refusal once: a read refused on a field is
+ * answered once per row, and one missing grant over five hundred rows would
+ * otherwise read five hundred times. `errors` keeps every one, with its path.
+ */
+export declare class PlacementRequestFailed extends Error {
+    readonly errors: PlacementRequestError[];
+    readonly status: number;
+    constructor(errors: PlacementRequestError[], status: number);
+}
 export interface ConnectPlacementOptions {
     /** Foir's API, e.g. `https://api.foir.dev`. */
     apiUrl: string;

package/dist/placement.js

@@ -41,6 +41,8 @@ var GRANT_TABLE = [
   ["authclients:write", "none", [], []],
   ["domains:read", "none", [], []],
   ["domains:write", "none", [], []],
+  ["loginpages:read", "none", [], []],
+  ["loginpages:write", "none", [], []],
   ["secrets:read", "none", [], []],
   ["secrets:list", "none", [], []],
   ["secrets:put", "none", [], []],
@@ -78,7 +80,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -266,6 +268,17 @@ var PlacementRefused = class extends Error {
     this.name = "PlacementRefused";
   }
 };
+var PlacementRequestFailed = class extends Error {
+  errors;
+  status;
+  constructor(errors, status) {
+    const said = [...new Set(errors.map((e) => e.message))];
+    super(`[foir] placement request failed: ${said.length > 0 ? said.join("; ") : `HTTP ${status}`}`);
+    this.name = "PlacementRequestFailed";
+    this.errors = errors;
+    this.status = status;
+  }
+};
 function isHostMessage(data) {
   if (typeof data !== "object" || data === null) return false;
   const t = data.type;
@@ -325,8 +338,7 @@ function connectPlacement(options) {
         });
         const body = await res.json().catch(() => ({}));
         if (!res.ok || body.errors && body.errors.length > 0) {
-          const messages = body.errors?.map((e) => e.message).join("; ") || `HTTP ${res.status}`;
-          throw new Error(`[foir] placement request failed: ${messages}`);
+          throw new PlacementRequestFailed(body.errors ?? [], res.status);
         }
         return body.data;
       },
@@ -381,6 +393,7 @@ export {
   FOIR_CONSOLE_ORIGINS,
   PLACEMENT_MESSAGE,
   PlacementRefused,
+  PlacementRequestFailed,
   connectPlacement,
   placementFrameAncestors
 };

package/dist/push.js

@@ -1094,6 +1094,8 @@ var AUTH_OPS = {
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
   deleteMyAccount: "deleteMyAccount",
+  // Ending their own membership where the request stands.
+  leaveMembership: "leaveMembership",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
   myAuthorizedApps: "myAuthorizedApps",
@@ -1103,6 +1105,14 @@ var AUTH_OPS = {
   mySessions: "mySessions",
   endMySession: "endMySession",
   signOutEverywhere: "signOutEverywhere",
+  // Their email addresses: one added is kept once the code it was sent proves it.
+  myAddresses: "myAddresses",
+  addMyAddress: "addMyAddress",
+  proveMyAddress: "proveMyAddress",
+  makeMyAddressPrimary: "makeMyAddressPrimary",
+  removeMyAddress: "removeMyAddress",
+  // A copy of their own data.
+  exportMyData: "exportMyData",
   createPersonalAccessToken: "createPersonalAccessToken",
   mySignInMethods: "mySignInMethods",
   connectSignInMethod: "connectSignInMethod",
@@ -1114,6 +1124,7 @@ var AUTH_OPS = {
   beginFactorEnrollment: "beginFactorEnrollment",
   completeFactorEnrollment: "completeFactorEnrollment",
   removeFactor: "removeFactor",
+  renameFactor: "renameFactor",
   makeRecoveryCodes: "makeRecoveryCodes",
   // The organizations the caller may stand in. Nothing selects one: a request
   // names the organization it acts in (`orgId` or `orgUrl` below), and the

package/dist/react/FoirProvider.d.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { AuthProviderPublic, FoirAccess, FoirUser, FoirSessionConfig, SessionAdapter } from '../auth';
+import type { AuthProviderPublic, FoirAccess, FoirUser, FoirSessionConfig, HostedLoginOptions, SessionAdapter } from '../auth';
 import type { ProviderCallbackInput, ProviderLoginInput } from '../auth';
 import type { FoirEnv } from '../graphql/foir-request';
 /** Where the session hydration stands. */
@@ -53,9 +53,10 @@ export interface FoirContextValue {
     /**
      * In `hostedSession` mode, where to send the browser to sign in — sign-in is a
      * redirect to your Foir login domain, not an in-page form. Null in token mode,
-     * where you call {@link FoirContextValue.signIn} instead.
+     * where you call {@link FoirContextValue.signIn} instead. `options.org` names
+     * the organization the sign-in is for.
      */
-    hostedSignInUrl: ((returnTo?: string) => string) | null;
+    hostedSignInUrl: ((returnTo?: string, options?: HostedLoginOptions) => string) | null;
 }
 export interface FoirProviderProps {
     /** API config: `{ PLATFORM_API_URL, PLATFORM_API_KEY }` (a publishable key). */
@@ -151,5 +152,5 @@ export declare function useFoirAuth(): {
     refresh: () => Promise<boolean>;
     getToken: () => Promise<string | null>;
     getProviders: () => Promise<AuthProviderPublic[]>;
-    hostedSignInUrl: ((returnTo?: string) => string) | null;
+    hostedSignInUrl: ((returnTo?: string, options?: HostedLoginOptions) => string) | null;
 };

package/dist/react.js

@@ -968,6 +968,8 @@ var AUTH_OPS = {
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
   deleteMyAccount: "deleteMyAccount",
+  // Ending their own membership where the request stands.
+  leaveMembership: "leaveMembership",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
   myAuthorizedApps: "myAuthorizedApps",
@@ -977,6 +979,14 @@ var AUTH_OPS = {
   mySessions: "mySessions",
   endMySession: "endMySession",
   signOutEverywhere: "signOutEverywhere",
+  // Their email addresses: one added is kept once the code it was sent proves it.
+  myAddresses: "myAddresses",
+  addMyAddress: "addMyAddress",
+  proveMyAddress: "proveMyAddress",
+  makeMyAddressPrimary: "makeMyAddressPrimary",
+  removeMyAddress: "removeMyAddress",
+  // A copy of their own data.
+  exportMyData: "exportMyData",
   createPersonalAccessToken: "createPersonalAccessToken",
   mySignInMethods: "mySignInMethods",
   connectSignInMethod: "connectSignInMethod",
@@ -988,6 +998,7 @@ var AUTH_OPS = {
   beginFactorEnrollment: "beginFactorEnrollment",
   completeFactorEnrollment: "completeFactorEnrollment",
   removeFactor: "removeFactor",
+  renameFactor: "renameFactor",
   makeRecoveryCodes: "makeRecoveryCodes",
   // The organizations the caller may stand in. Nothing selects one: a request
   // names the organization it acts in (`orgId` or `orgUrl` below), and the
@@ -1237,6 +1248,8 @@ var GRANT_TABLE = [
   ["authclients:write", "none", [], []],
   ["domains:read", "none", [], []],
   ["domains:write", "none", [], []],
+  ["loginpages:read", "none", [], []],
+  ["loginpages:write", "none", [], []],
   ["secrets:read", "none", [], []],
   ["secrets:list", "none", [], []],
   ["secrets:put", "none", [], []],
@@ -1274,7 +1287,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -1538,10 +1551,11 @@ function createFoirSessionClient(config) {
       forget();
       config.onSignOut?.();
     },
-    signInUrl(returnTo) {
+    signInUrl(returnTo, options = {}) {
       const dest = new URL(trimSlash(config.loginOrigin));
       const target = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
       if (target && target !== "/") dest.searchParams.set("returnTo", target);
+      if (options.org) dest.searchParams.set("org", options.org);
       return dest.toString();
     },
     subscribe(listener) {
@@ -1768,7 +1782,7 @@ function FoirProvider({
   }, [refresh, loadAccess, accessWasRead]);
   const getProviders = useCallback(() => getAuthProviders(envRef.current), []);
   const hostedSignInUrl = useMemo(
-    () => hosted ? (returnTo) => hosted.signInUrl(returnTo) : null,
+    () => hosted ? (returnTo, options) => hosted.signInUrl(returnTo, options) : null,
     [hosted]
   );
   const value = useMemo(

package/dist/server.js

@@ -115,6 +115,8 @@ var GRANT_TABLE = [
   ["authclients:write", "none", [], []],
   ["domains:read", "none", [], []],
   ["domains:write", "none", [], []],
+  ["loginpages:read", "none", [], []],
+  ["loginpages:write", "none", [], []],
   ["secrets:read", "none", [], []],
   ["secrets:list", "none", [], []],
   ["secrets:put", "none", [], []],
@@ -152,7 +154,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {
@@ -168,7 +168,7 @@
     "blurhash": "^2.0.5",
     "graphql": "^16.10.0",
     "hls.js": "^1.6.16",
-    "jsdom": "^27.0.0",
+    "jsdom": "^28.1.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "tsup": "^8.5.1",
@@ -177,8 +177,8 @@
     "ws": "^8.18.0",
     "y-websocket": "^3.0.0",
     "yjs": "^13.6.30",
-    "@foir/proto-ts": "0.109.0",
-    "@foir/access-vocab": "0.0.0"
+    "@foir/access-vocab": "0.0.0",
+    "@foir/proto-ts": "0.109.0"
   },
   "engines": {
     "node": ">=18.0.0"