@foir/sdk 0.25.0 → 0.26.0

package/CHANGELOG.md

@@ -108,6 +108,29 @@ nobody asking for `@foir/sdk` gets it early. The push that carries the commit to
 
 Changes on `dev` that have not been published to npm.
 
+## [0.26.0] — 2026-10-19
+
+### Changed
+
+- **`session.request` in `@foir/sdk/placement` throws `PlacementRequestFailed`.**
+  Its message says each distinct refusal once, where it repeated a read
+  refused on a field once per row, and its `errors` keeps every error with its
+  `path`. It is still an `Error`, so a caller that reads `message` is
+  unaffected.
+
+### Added
+
+- **A hosted sign-in can name the organization it is for** (`@foir/sdk/auth`,
+  `@foir/sdk/react`): `hostedLoginUrl(config, returnTo, { org })`, a session
+  client's `signInUrl(returnTo, { org })` and the provider's
+  `hostedSignInUrl(returnTo, { org })`. Use it when one auth client serves an
+  address per organization. The login domain's front door passes it on, and
+  the sign-in takes that organization's branding, providers and return
+  addresses. The platform refuses an organization other than the one the
+  domain or app is bound to, one of another project, and one that is not
+  active.
+- **`HostedLoginOptions`** (`@foir/sdk/auth`, type).
+
 ## [0.25.0] — 2026-10-18
 
 ### Changed

package/dist/auth/hosted.d.ts

@@ -27,11 +27,22 @@ export interface HostedLoginConfig {
      */
     clientId?: string;
 }
+/** What a sign-in started at the hosted front door is for. */
+export interface HostedLoginOptions {
+    /**
+     * The organization the person signs in to, when one auth client serves an
+     * address per organization. It decides the branding, the pool, and which
+     * addresses the person may come back to. The platform refuses an
+     * organization other than the one the login domain or app is bound to, one
+     * of another project, and one that is not active.
+     */
+    org?: string;
+}
 /**
- * Build the redirect URL to the hosted front door, forwarding a best-effort
- * absolute `returnTo` (honoured if the front door supports it).
+ * Build the redirect URL to the hosted front door, forwarding an absolute
+ * `returnTo` and, where the app names one, the organization the sign-in is for.
  */
-export declare function hostedLoginUrl(config: HostedLoginConfig, returnTo?: string): string;
+export declare function hostedLoginUrl(config: HostedLoginConfig, returnTo?: string, options?: HostedLoginOptions): string;
 /**
  * Build the redirect URL that ENDS the hosted session — the mirror of
  * `hostedLoginUrl`, and the only thing that actually signs a user out on

package/dist/auth/index.d.ts

@@ -18,7 +18,7 @@ export { FoirAuthDowngradedError, FoirSessionExpiredError } from '../graphql/foi
 export { AUTH_OPS } from './ops';
 export type { AuthOpName, AuthOpOptions } from './ops';
 export { hostedLoginUrl, hostedLogoutUrl, fetchHostedSession, hostedSignInNoticeOf } from './hosted';
-export type { HostedLoginConfig, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
+export type { HostedLoginConfig, HostedLoginOptions, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
 export { createFoirSessionClient } from './session-client';
 export type { FoirSessionClient, FoirSessionConfig, FoirSessionUser, } from './session-client';
 export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, MyAddress, MyDataExport, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';

package/dist/auth/session-client.d.ts

@@ -27,6 +27,7 @@
  * api.foir.dev but a browser cannot reach them there — the cookie would be
  * cross-site, and that CORS surface deliberately refuses credentials.
  */
+import type { HostedLoginOptions } from './hosted';
 export interface FoirSessionConfig {
     /**
      * Your verified custom login domain, e.g. `https://login.acme.com`. Must share
@@ -66,8 +67,12 @@ export interface FoirSessionClient {
     getUser(): Promise<FoirSessionUser | null>;
     /** Revoke the session server-side and clear the cookie. Idempotent. */
     signOut(): Promise<void>;
-    /** Where to send the browser to sign in. */
-    signInUrl(returnTo?: string): string;
+    /**
+     * Where to send the browser to sign in. Name the organization the sign-in is
+     * for with `options.org` when one auth client serves an address per
+     * organization.
+     */
+    signInUrl(returnTo?: string, options?: HostedLoginOptions): string;
     /** Observe session changes. Returns an unsubscribe function. */
     subscribe(listener: (user: FoirSessionUser | null) => void): () => void;
     /** Cancel the refresh timer. Call on unmount. */

package/dist/auth-session.js

@@ -113,10 +113,11 @@ function createFoirSessionClient(config) {
       forget();
       config.onSignOut?.();
     },
-    signInUrl(returnTo) {
+    signInUrl(returnTo, options = {}) {
       const dest = new URL(trimSlash(config.loginOrigin));
       const target = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
       if (target && target !== "/") dest.searchParams.set("returnTo", target);
+      if (options.org) dest.searchParams.set("org", options.org);
       return dest.toString();
     },
     subscribe(listener) {

package/dist/auth.js

@@ -1567,6 +1567,8 @@ var GRANT_TABLE = [
   ["authclients:write", "none", [], []],
   ["domains:read", "none", [], []],
   ["domains:write", "none", [], []],
+  ["loginpages:read", "none", [], []],
+  ["loginpages:write", "none", [], []],
   ["secrets:read", "none", [], []],
   ["secrets:list", "none", [], []],
   ["secrets:put", "none", [], []],
@@ -1604,7 +1606,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -1797,11 +1799,14 @@ async function requireScope(adapter, env, scope) {
 var DEFAULT_COOKIE_NAME = "foir_session";
 var DEFAULT_SESSION_PATH = "/session/token";
 var DEFAULT_END_SESSION_PATH = "/session/end-session";
-function hostedLoginUrl(config, returnTo) {
+function hostedLoginUrl(config, returnTo, options = {}) {
   const dest = new URL(config.loginOrigin);
   if (returnTo && returnTo !== "/") {
     dest.searchParams.set("returnTo", returnTo);
   }
+  if (options.org) {
+    dest.searchParams.set("org", options.org);
+  }
   return dest.toString();
 }
 function hostedLogoutUrl(config, clientId, returnTo) {
@@ -2017,10 +2022,11 @@ function createFoirSessionClient(config) {
       forget();
       config.onSignOut?.();
     },
-    signInUrl(returnTo) {
+    signInUrl(returnTo, options = {}) {
       const dest = new URL(trimSlash(config.loginOrigin));
       const target = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
       if (target && target !== "/") dest.searchParams.set("returnTo", target);
+      if (options.org) dest.searchParams.set("org", options.org);
       return dest.toString();
     },
     subscribe(listener) {

package/dist/placement/index.d.ts

@@ -113,6 +113,23 @@ export declare function placementFrameAncestors(origins: readonly string[]): str
 export declare class PlacementRefused extends Error {
     constructor(reason: string);
 }
+/** One error of a GraphQL answer, as Foir's API sends it. */
+export interface PlacementRequestError {
+    message: string;
+    path?: (string | number)[];
+    extensions?: Record<string, unknown>;
+}
+/**
+ * A request the page made on its token that Foir's API refused or failed.
+ * The message says each distinct refusal once: a read refused on a field is
+ * answered once per row, and one missing grant over five hundred rows would
+ * otherwise read five hundred times. `errors` keeps every one, with its path.
+ */
+export declare class PlacementRequestFailed extends Error {
+    readonly errors: PlacementRequestError[];
+    readonly status: number;
+    constructor(errors: PlacementRequestError[], status: number);
+}
 export interface ConnectPlacementOptions {
     /** Foir's API, e.g. `https://api.foir.dev`. */
     apiUrl: string;

package/dist/placement.js

@@ -41,6 +41,8 @@ var GRANT_TABLE = [
   ["authclients:write", "none", [], []],
   ["domains:read", "none", [], []],
   ["domains:write", "none", [], []],
+  ["loginpages:read", "none", [], []],
+  ["loginpages:write", "none", [], []],
   ["secrets:read", "none", [], []],
   ["secrets:list", "none", [], []],
   ["secrets:put", "none", [], []],
@@ -78,7 +80,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -266,6 +268,17 @@ var PlacementRefused = class extends Error {
     this.name = "PlacementRefused";
   }
 };
+var PlacementRequestFailed = class extends Error {
+  errors;
+  status;
+  constructor(errors, status) {
+    const said = [...new Set(errors.map((e) => e.message))];
+    super(`[foir] placement request failed: ${said.length > 0 ? said.join("; ") : `HTTP ${status}`}`);
+    this.name = "PlacementRequestFailed";
+    this.errors = errors;
+    this.status = status;
+  }
+};
 function isHostMessage(data) {
   if (typeof data !== "object" || data === null) return false;
   const t = data.type;
@@ -325,8 +338,7 @@ function connectPlacement(options) {
         });
         const body = await res.json().catch(() => ({}));
         if (!res.ok || body.errors && body.errors.length > 0) {
-          const messages = body.errors?.map((e) => e.message).join("; ") || `HTTP ${res.status}`;
-          throw new Error(`[foir] placement request failed: ${messages}`);
+          throw new PlacementRequestFailed(body.errors ?? [], res.status);
         }
         return body.data;
       },
@@ -381,6 +393,7 @@ export {
   FOIR_CONSOLE_ORIGINS,
   PLACEMENT_MESSAGE,
   PlacementRefused,
+  PlacementRequestFailed,
   connectPlacement,
   placementFrameAncestors
 };

package/dist/react/FoirProvider.d.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { AuthProviderPublic, FoirAccess, FoirUser, FoirSessionConfig, SessionAdapter } from '../auth';
+import type { AuthProviderPublic, FoirAccess, FoirUser, FoirSessionConfig, HostedLoginOptions, SessionAdapter } from '../auth';
 import type { ProviderCallbackInput, ProviderLoginInput } from '../auth';
 import type { FoirEnv } from '../graphql/foir-request';
 /** Where the session hydration stands. */
@@ -53,9 +53,10 @@ export interface FoirContextValue {
     /**
      * In `hostedSession` mode, where to send the browser to sign in — sign-in is a
      * redirect to your Foir login domain, not an in-page form. Null in token mode,
-     * where you call {@link FoirContextValue.signIn} instead.
+     * where you call {@link FoirContextValue.signIn} instead. `options.org` names
+     * the organization the sign-in is for.
      */
-    hostedSignInUrl: ((returnTo?: string) => string) | null;
+    hostedSignInUrl: ((returnTo?: string, options?: HostedLoginOptions) => string) | null;
 }
 export interface FoirProviderProps {
     /** API config: `{ PLATFORM_API_URL, PLATFORM_API_KEY }` (a publishable key). */
@@ -151,5 +152,5 @@ export declare function useFoirAuth(): {
     refresh: () => Promise<boolean>;
     getToken: () => Promise<string | null>;
     getProviders: () => Promise<AuthProviderPublic[]>;
-    hostedSignInUrl: ((returnTo?: string) => string) | null;
+    hostedSignInUrl: ((returnTo?: string, options?: HostedLoginOptions) => string) | null;
 };

package/dist/react.js

@@ -1248,6 +1248,8 @@ var GRANT_TABLE = [
   ["authclients:write", "none", [], []],
   ["domains:read", "none", [], []],
   ["domains:write", "none", [], []],
+  ["loginpages:read", "none", [], []],
+  ["loginpages:write", "none", [], []],
   ["secrets:read", "none", [], []],
   ["secrets:list", "none", [], []],
   ["secrets:put", "none", [], []],
@@ -1285,7 +1287,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -1549,10 +1551,11 @@ function createFoirSessionClient(config) {
       forget();
       config.onSignOut?.();
     },
-    signInUrl(returnTo) {
+    signInUrl(returnTo, options = {}) {
       const dest = new URL(trimSlash(config.loginOrigin));
       const target = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
       if (target && target !== "/") dest.searchParams.set("returnTo", target);
+      if (options.org) dest.searchParams.set("org", options.org);
       return dest.toString();
     },
     subscribe(listener) {
@@ -1779,7 +1782,7 @@ function FoirProvider({
   }, [refresh, loadAccess, accessWasRead]);
   const getProviders = useCallback(() => getAuthProviders(envRef.current), []);
   const hostedSignInUrl = useMemo(
-    () => hosted ? (returnTo) => hosted.signInUrl(returnTo) : null,
+    () => hosted ? (returnTo, options) => hosted.signInUrl(returnTo, options) : null,
     [hosted]
   );
   const value = useMemo(

package/dist/server.js

@@ -115,6 +115,8 @@ var GRANT_TABLE = [
   ["authclients:write", "none", [], []],
   ["domains:read", "none", [], []],
   ["domains:write", "none", [], []],
+  ["loginpages:read", "none", [], []],
+  ["loginpages:write", "none", [], []],
   ["secrets:read", "none", [], []],
   ["secrets:list", "none", [], []],
   ["secrets:put", "none", [], []],
@@ -152,7 +154,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {
@@ -168,7 +168,7 @@
     "blurhash": "^2.0.5",
     "graphql": "^16.10.0",
     "hls.js": "^1.6.16",
-    "jsdom": "^27.0.0",
+    "jsdom": "^28.1.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "tsup": "^8.5.1",