@foir/sdk 0.25.0 → 0.27.0

package/CHANGELOG.md

@@ -108,6 +108,90 @@ nobody asking for `@foir/sdk` gets it early. The push that carries the commit to
 
 Changes on `dev` that have not been published to npm.
 
+## [0.27.0] — 2026-10-20
+
+### Added
+
+- **`organizations.startPool({ movePeople, dryRun })`** (`@foir/sdk/app`):
+  starting the run's organization's own pool takes its people along when
+  asked. Somebody who stands only there moves whole, and somebody who also
+  stands elsewhere is given a new user there with their memberships, roles and
+  what they own there. `dryRun` counts what would move and changes nothing.
+  The `AppOrganizationPoolMove` and `AppOrganizationPoolStart` types.
+- **`stepUpRequired(error)`** and the `STEP_UP_REQUIRED` error code: what an
+  organization's sign-in rules ask of the signed-in user before a request
+  standing there can succeed, `second_factor` or `sign_in_method`.
+- **`myOrganizationChoices`**: the organizations the signed-in user can enter,
+  as an organization switcher offers them: member, invited, may join or
+  requested, each marked available or not, and whether they stand at the
+  project. Requires the user's bearer.
+- **`organizations.provision({ joining })`** (`@foir/sdk/app`): who may join
+  the new organization without an invitation. `'invitation'` takes only
+  invitations and staff adding people, `'open'` lets someone who can already
+  sign in at its page join by signing in there, and `'request'` makes signing
+  in there a request its staff approve or decline. Left out, the nearest
+  organization above that chose, then the project.
+- **`organizations.provision({ users })`** (`@foir/sdk/app`): where somebody
+  who signs up at the new organization stands. `'joined'` makes them a user of
+  that organization, and `'everyone'` a user of the project, so every
+  organization that shares its sign-in can find, email and sign them in. Left
+  out, the nearest organization above that chose, then the project.
+- **`<FoirFeedback>` takes a note from a visitor who is not signed in**
+  (`@foir/sdk/react`), on a project that takes visitors' notes ("Accept
+  anonymous notes") through a key that gives them `notes:create`. The visitor
+  gets the composer rather than a sign-in prompt, with an optional email to
+  reply to, and is shown the note's `id` as a reference. The new
+  `onVisitorSubmitted` prop is called with the receipt; `onSubmitted` stays the
+  signed-in user's note. A project that does not take visitors' notes still
+  asks them to sign in.
+- **`FoirNoteReceipt`** (`@foir/sdk/data`): `{ id, createdAt }`, what
+  `writeNote` answers a visitor with.
+- **`FoirNoteConfig.signedIn` and `FoirNoteConfig.anonymousAccepted`**:
+  whether the caller writes as a signed-in user, and whether the project takes
+  visitors' notes. `screenshotsEnabled` is false for a visitor, whose note
+  carries no attachment.
+- **`FoirFeedbackClient` carries an optional `writeNote`**, so a client typed
+  before it still satisfies the prop.
+
+### Changed
+
+- **`<FoirFeedback>` writes a signed-in user's note through `writeNote`**, the
+  one note create, rather than `createMyNote`, its older name. The same note
+  on the same data API. A client whose generated module predates `writeNote`
+  is refused it, saying to re-run `foir types`; a client typed without it at
+  all still writes through `createMyNote`.
+- **Breaking: `organizations.startPool()` answers `{ pool, moved }`**
+  (`AppOrganizationPoolStart`): the pool it signs its people in to now, and
+  what moved into it by kind. It answered the pool alone.
+- **`organizations.provision({ ownPool: false })` is sent.** It used to be
+  dropped, so it read as leaving the choice to the project; it now says the
+  organization shares the pool above it, whatever the project chose. Left out,
+  it still takes the project's choice for a top-level organization and its
+  parent's pool for one beneath another.
+
+## [0.26.0] — 2026-10-19
+
+### Changed
+
+- **`session.request` in `@foir/sdk/placement` throws `PlacementRequestFailed`.**
+  Its message says each distinct refusal once, where it repeated a read
+  refused on a field once per row, and its `errors` keeps every error with its
+  `path`. It is still an `Error`, so a caller that reads `message` is
+  unaffected.
+
+### Added
+
+- **A hosted sign-in can name the organization it is for** (`@foir/sdk/auth`,
+  `@foir/sdk/react`): `hostedLoginUrl(config, returnTo, { org })`, a session
+  client's `signInUrl(returnTo, { org })` and the provider's
+  `hostedSignInUrl(returnTo, { org })`. Use it when one auth client serves an
+  address per organization. The login domain's front door passes it on, and
+  the sign-in takes that organization's branding, providers and return
+  addresses. The platform refuses an organization other than the one the
+  domain or app is bound to, one of another project, and one that is not
+  active.
+- **`HostedLoginOptions`** (`@foir/sdk/auth`, type).
+
 ## [0.25.0] — 2026-10-18
 
 ### Changed

package/dist/app/client.d.ts

@@ -241,9 +241,26 @@ export interface AppOrganizationProvision {
      * The organisation signs its own people in, to a pool of its own, apart
      * from its parent's and the project's. Its descendants share that pool
      * unless one of them starts another. One that exists already starts one
-     * with `organizations.startPool`.
+     * with `organizations.startPool`. Left out, the project's choice for one at
+     * the top, and its parent's pool for one beneath another.
      */
     ownPool?: boolean;
+    /**
+     * Where somebody who signs up at it stands: `'joined'` makes them a user of
+     * this organisation, and `'everyone'` a user of the project, so every
+     * organisation that shares its sign-in can find, email and sign them in.
+     * Left out, the nearest organisation above that chose, then the project.
+     * Its first member is a member of it either way.
+     */
+    users?: 'joined' | 'everyone';
+    /**
+     * Who may join it without an invitation: `'invitation'` (only an invitation
+     * or staff adding them), `'open'` (someone who can already sign in at its
+     * page joins by signing in there) or `'request'` (signing in there asks, and
+     * its staff approve or decline). Left out, the nearest organisation above
+     * that chose, then the project.
+     */
+    joining?: 'invitation' | 'open' | 'request';
 }
 /**
  * The pool an organisation's people sign in to, and where it comes from: its
@@ -258,6 +275,44 @@ export interface AppOrganizationPool {
     /** How many people the pool holds, when it is the organisation's own. Null for any other. */
     people: number | null;
 }
+/** What starting an organisation's own pool moved, or for a dry run would move, by kind. */
+export interface AppOrganizationPoolMove {
+    /** Whether nothing was changed. */
+    dryRun: boolean;
+    /** People who stood only there, moved whole into the new pool. */
+    peopleMoved: number;
+    /** People who also stand elsewhere, each given a new user in the new pool. */
+    peopleMade: number;
+    /** Of those, how many are emailed a link to set up their account. */
+    peopleTold: number;
+    /** Memberships of the people given a new user, moved to that new user. */
+    membershipsMoved: number;
+    /** Active roles held in those memberships. */
+    rolesMoved: number;
+    recordsMoved: number;
+    filesMoved: number;
+    /** Notes assigned to them there, now assigned to the new user. A note stays its author's. */
+    notesReassigned: number;
+    notificationsMoved: number;
+    /** Their choices of what they are told there. */
+    notificationChoicesMoved: number;
+    /** The access they were given to single resources there. */
+    accessGrantsMoved: number;
+    /** Open invitations there, now to the new pool. */
+    invitationsMoved: number;
+    /** Requests to join from people it no longer signs in, withdrawn. */
+    joinRequestsWithdrawn: number;
+    /** Apps that now sign in the new pool's people. */
+    appsMoved: number;
+    /** Sign-ins through those apps of anybody not in the new pool, ended. */
+    signInsEnded: number;
+}
+/** Starting an organisation's own pool: the pool it signs its people in to now, and what moved into it. */
+export interface AppOrganizationPoolStart {
+    /** Its pool, now its own; for a dry run, the pool it signs in to still. */
+    pool: AppOrganizationPool;
+    moved: AppOrganizationPoolMove;
+}
 /**
  * Who a consent change is for: a user whose id the app holds, or an
  * address.
@@ -483,9 +538,12 @@ export interface AppClient {
     };
     users: {
         /**
-         * The user who has this email at the install's level, made when there
-         * is none. The same user every time for one email. Needs
-         * `users:create`.
+         * The user who has this email in the sign-in the install's place uses,
+         * made when nobody has it. The same user every time for one email. One
+         * the place does not reach is answered only where its organization lets
+         * them in (open, or their verified address at its open domain), joining
+         * it first; anybody else is refused without saying who has the address.
+         * Needs `users:create`.
          *
          * `verified` says whether that address is one the user has proved is
          * theirs. A user this call makes has not, and neither has one an
@@ -586,17 +644,27 @@ export interface AppClient {
         pool(): Promise<AppOrganizationPool>;
         /**
          * Start the own pool of the organisation this run acts in, which it and
-         * everything beneath it sign their people in to. Needs
-         * `organizations:write`. Refused while
-         * anybody of the pool it signs in to now holds a membership in it or
-         * beneath it, or an invitation there is open to that pool, and the
-         * refusal says how many: nobody is moved between pools, so those
-         * memberships are removed first and those people sign up again in the
-         * new pool. Its apps, and those beneath it, then sign their people in
-         * there, and anybody signed in through them is signed out. Safe to run
-         * again: it answers the pool it has.
+         * everything beneath it that shares its pool sign their people in to.
+         * Needs `organizations:write`.
+         *
+         * Without `movePeople`, refused while anybody of the pool it signs in to
+         * now holds a membership in it or beneath it, or an invitation there is
+         * open to that pool, and the refusal says how many. With it, somebody who
+         * stands only there moves whole, with their addresses, sign-ins and
+         * sessions, and somebody who also stands elsewhere is given a new user
+         * there, with their memberships, roles and what they own there, who
+         * proves their address before they sign in; refused while the new pool
+         * would hold an address twice. `dryRun` answers what would move and
+         * changes nothing.
+         *
+         * Its apps, and those beneath it, then sign their people in there, and
+         * anybody signed in through them who is not in the new pool is signed
+         * out. Safe to run again: it answers the pool it has and moves nobody.
          */
-        startPool(): Promise<AppOrganizationPool>;
+        startPool(options?: {
+            movePeople?: boolean;
+            dryRun?: boolean;
+        }): Promise<AppOrganizationPoolStart>;
         /**
          * Drop the own pool of the organisation this run acts in, so it signs its
          * people in to the pool above it. Needs `organizations:write`. Refused

package/dist/app/index.d.ts

@@ -21,7 +21,7 @@
  * The manifest's own messages are on `@foir/sdk/app/contract`.
  */
 export { createAppClient } from './client';
-export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppUser, AppUserEraseResult, AppUserList, AppUserSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationPool, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
+export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppUser, AppUserEraseResult, AppUserList, AppUserSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationPool, AppOrganizationPoolMove, AppOrganizationPoolStart, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
 export { appUserEmailUnavailableOf, appUserUnlinkedOf, appLookupConflictOf, isAppFieldWithheld } from './errors';
 export type { AppUserEmailUnavailableReason, AppLookupConflict } from './errors';
 export { appModelFieldName, appModelTypeName, appSelectorEnumValue } from './naming';

package/dist/app/vocabulary.generated.d.ts

@@ -3,7 +3,7 @@
  * manifest's hook may subscribe to (an event of the project, that something
  * emits) is the platform's to say: `validateAppManifest` answers it.
  */
-export declare const APP_HOOK_EVENTS: readonly ["RECORD_CREATED", "RECORD_UPDATED", "RECORD_DELETED", "RECORD_PUBLISHED", "RECORD_UNPUBLISHED", "USER_CREATED", "USER_UPDATED", "USER_DELETED", "USER_MERGED", "SESSION_REVOKED", "OPERATION_COMPLETED", "OPERATION_FAILED", "OPERATION_CANCELLED", "OPERATION_TIMED_OUT", "MEMBERSHIP_GRANTED", "MEMBERSHIP_REVOKED", "MEMBERSHIP_ROLE_CHANGED", "TENANT_PLAN_CHANGED", "TENANT_SUBSCRIPTION_STATUS_CHANGED", "PROJECT_CREATED", "PROJECT_ARCHIVED", "INVITATION_ACCEPTED", "IMPORT_COMPLETED", "MIGRATION_APPLIED", "BULK_UPDATE_COMPLETED", "BULK_PUBLISH_COMPLETED", "USER_PREFERENCE_CHANGED", "ORGANIZATION_CREATED", "ORGANIZATION_UPDATED", "ORGANIZATION_MOVED", "ORGANIZATION_SUSPENDED", "ORGANIZATION_RESUMED", "ORGANIZATION_DELETION_SCHEDULED", "ORGANIZATION_DELETION_CANCELLED", "ORGANIZATION_DELETED", "ORGANIZATION_MEMBER_ADDED", "ORGANIZATION_MEMBER_REMOVED", "ORGANIZATION_MEMBER_ROLE_CHANGED", "PROJECT_REACTIVATED"];
+export declare const APP_HOOK_EVENTS: readonly ["RECORD_CREATED", "RECORD_UPDATED", "RECORD_DELETED", "RECORD_PUBLISHED", "RECORD_UNPUBLISHED", "USER_CREATED", "USER_UPDATED", "USER_DELETED", "USER_MERGED", "SESSION_REVOKED", "OPERATION_COMPLETED", "OPERATION_FAILED", "OPERATION_CANCELLED", "OPERATION_TIMED_OUT", "MEMBERSHIP_GRANTED", "MEMBERSHIP_REVOKED", "MEMBERSHIP_ROLE_CHANGED", "TENANT_PLAN_CHANGED", "TENANT_SUBSCRIPTION_STATUS_CHANGED", "PROJECT_CREATED", "PROJECT_ARCHIVED", "INVITATION_ACCEPTED", "IMPORT_COMPLETED", "MIGRATION_APPLIED", "BULK_UPDATE_COMPLETED", "BULK_PUBLISH_COMPLETED", "USER_PREFERENCE_CHANGED", "ORGANIZATION_CREATED", "ORGANIZATION_UPDATED", "ORGANIZATION_MOVED", "ORGANIZATION_SUSPENDED", "ORGANIZATION_RESUMED", "ORGANIZATION_DELETION_SCHEDULED", "ORGANIZATION_DELETION_CANCELLED", "ORGANIZATION_DELETED", "ORGANIZATION_MEMBER_ADDED", "ORGANIZATION_MEMBER_REMOVED", "ORGANIZATION_MEMBER_ROLE_CHANGED", "PROJECT_REACTIVATED", "JOIN_REQUESTED", "JOIN_REQUEST_APPROVED", "JOIN_REQUEST_DECLINED"];
 /** An event a hook can name. */
 export type AppHookEvent = (typeof APP_HOOK_EVENTS)[number];
 /**

package/dist/app.js

@@ -353,8 +353,8 @@ function createAppClient(config) {
     throw new FoirRequestError(`[foir] ${message}`);
   };
   const POOL_FIELDS = "organizationId poolId source sourceOrganizationId people";
-  async function poolOf(name, document) {
-    const answer = await field(name, document, {});
+  const POOL_MOVE_FIELDS = "dryRun peopleMoved peopleMade peopleTold membershipsMoved rolesMoved recordsMoved filesMoved notesReassigned notificationsMoved notificationChoicesMoved accessGrantsMoved invitationsMoved joinRequestsWithdrawn appsMoved signInsEnded";
+  function poolFrom(name, answer) {
     if (!answer?.poolId || !answer.organizationId || answer.source !== "OWN" && answer.source !== "ANCESTOR" && answer.source !== "PROJECT") {
       return refuse(`${name} reported no error and answered no pool`);
     }
@@ -366,6 +366,9 @@ function createAppClient(config) {
       people: answer.people ?? null
     };
   }
+  async function poolOf(name, document) {
+    return poolFrom(name, await field(name, document, {}));
+  }
   let surface;
   function served() {
     surface ??= withFoirRetry(async () => {
@@ -854,7 +857,9 @@ function createAppClient(config) {
             input.firstMember = { userId: first.userId };
           }
         }
-        if (organization.ownPool === true) input.ownPool = true;
+        if (typeof organization.ownPool === "boolean") input.ownPool = organization.ownPool;
+        if (organization.users !== void 0) input.users = organization.users;
+        if (organization.joining !== void 0) input.joining = organization.joining;
         const answered = settings === void 0 ? "organizationId status" : "organizationId settingsRecordId status";
         const answer = await field(
           "provisionOrganization",
@@ -882,8 +887,18 @@ function createAppClient(config) {
       async pool() {
         return poolOf("organizationPool", `query AppOrganizationPool { organizationPool { ${POOL_FIELDS} } }`);
       },
-      async startPool() {
-        return poolOf("startOrganizationPool", `mutation AppStartOrganizationPool { startOrganizationPool { ${POOL_FIELDS} } }`);
+      async startPool(options = {}) {
+        const asks = `movePeople: ${options.movePeople === true}, dryRun: ${options.dryRun === true}`;
+        const answer = await field(
+          "startOrganizationPool",
+          `mutation AppStartOrganizationPool { startOrganizationPool(${asks}) { pool { ${POOL_FIELDS} } moved { ${POOL_MOVE_FIELDS} } } }`,
+          {}
+        );
+        const pool = poolFrom("startOrganizationPool", answer?.pool);
+        if (!answer?.moved) {
+          return refuse("startOrganizationPool reported no error and answered nothing of what moved");
+        }
+        return { pool, moved: answer.moved };
       },
       async dropPool() {
         return poolOf("dropOrganizationPool", `mutation AppDropOrganizationPool { dropOrganizationPool { ${POOL_FIELDS} } }`);
@@ -1218,7 +1233,10 @@ var APP_HOOK_EVENTS = [
   "ORGANIZATION_MEMBER_ADDED",
   "ORGANIZATION_MEMBER_REMOVED",
   "ORGANIZATION_MEMBER_ROLE_CHANGED",
-  "PROJECT_REACTIVATED"
+  "PROJECT_REACTIVATED",
+  "JOIN_REQUESTED",
+  "JOIN_REQUEST_APPROVED",
+  "JOIN_REQUEST_DECLINED"
 ];
 var APP_GRANTS = [
   "appconfig:read",

package/dist/auth/auth.d.ts

@@ -17,7 +17,7 @@
  */
 import { type FoirEnv } from '../graphql/foir-request';
 import { type AuthOpName, type AuthOpOptions } from './ops';
-import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyProfile, type MyProfileChange, type MySession, type MyAddress, type MyDataExport, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext } from './operations';
+import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyOrganizationChoices, type MyProfile, type MyProfileChange, type MySession, type MyAddress, type MyDataExport, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext } from './operations';
 import type { TypedDocumentNode } from '@graphql-typed-document-node/core';
 /** An access token + its rotating refresh token. */
 export interface FoirAuthTokens {
@@ -380,6 +380,15 @@ export declare function myOrganizations(env: FoirEnv, vars?: {
     first?: number;
     after?: string;
 }, options?: AuthOpOptions): Promise<MyOrganization[]>;
+/**
+ * The organizations the signed-in user can enter, as an organization switcher
+ * offers them: those they are a member of, are invited to, may join by signing
+ * in there, or asked to join, in their own sign-in. It is theirs alone. An
+ * organization that lets them in no way is never named, and one that may not
+ * act now is listed with `available: false` rather than left out. Requires the
+ * user's bearer.
+ */
+export declare function myOrganizationChoices(env: FoirEnv, options?: AuthOpOptions): Promise<MyOrganizationChoices>;
 /**
  * Found an organization, as its first member.
  *

package/dist/auth/hosted.d.ts

@@ -27,11 +27,22 @@ export interface HostedLoginConfig {
      */
     clientId?: string;
 }
+/** What a sign-in started at the hosted front door is for. */
+export interface HostedLoginOptions {
+    /**
+     * The organization the person signs in to, when one auth client serves an
+     * address per organization. It decides the branding, the pool, and which
+     * addresses the person may come back to. The platform refuses an
+     * organization other than the one the login domain or app is bound to, one
+     * of another project, and one that is not active.
+     */
+    org?: string;
+}
 /**
- * Build the redirect URL to the hosted front door, forwarding a best-effort
- * absolute `returnTo` (honoured if the front door supports it).
+ * Build the redirect URL to the hosted front door, forwarding an absolute
+ * `returnTo` and, where the app names one, the organization the sign-in is for.
  */
-export declare function hostedLoginUrl(config: HostedLoginConfig, returnTo?: string): string;
+export declare function hostedLoginUrl(config: HostedLoginConfig, returnTo?: string, options?: HostedLoginOptions): string;
 /**
  * Build the redirect URL that ENDS the hosted session — the mirror of
  * `hostedLoginUrl`, and the only thing that actually signs a user out on

package/dist/auth/index.d.ts

@@ -10,7 +10,7 @@
  * the caller's own manifest advertises, through the same op transport
  * `@foir/sdk/data` uses, so `graphql` is not on this module's path at all.
  */
-export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, currentUser, myProviderToken, logout, deleteMyAccount, leaveMembership, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, myAddresses, addMyAddress, proveMyAddress, makeMyAddressPrimary, removeMyAddress, exportMyData, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, renameFactor, makeRecoveryCodes, myOrganizations, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
+export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, currentUser, myProviderToken, logout, deleteMyAccount, leaveMembership, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, myAddresses, addMyAddress, proveMyAddress, makeMyAddressPrimary, removeMyAddress, exportMyData, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, renameFactor, makeRecoveryCodes, myOrganizations, myOrganizationChoices, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
 export type { FoirAuthTokens, FoirUser, SessionAdapter, RequireAuthOptions, } from './auth';
 export { userAccess, getSessionAccess, hasRole, hasScope, requireRole, requireScope, FoirAccessDeniedError, } from './access';
 export type { FoirAccess, FoirAccessDenial } from './access';
@@ -18,7 +18,7 @@ export { FoirAuthDowngradedError, FoirSessionExpiredError } from '../graphql/foi
 export { AUTH_OPS } from './ops';
 export type { AuthOpName, AuthOpOptions } from './ops';
 export { hostedLoginUrl, hostedLogoutUrl, fetchHostedSession, hostedSignInNoticeOf } from './hosted';
-export type { HostedLoginConfig, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
+export type { HostedLoginConfig, HostedLoginOptions, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
 export { createFoirSessionClient } from './session-client';
 export type { FoirSessionClient, FoirSessionConfig, FoirSessionUser, } from './session-client';
-export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, MyAddress, MyDataExport, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';
+export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyOrganizationChoice, MyOrganizationChoices, MyProfile, MyProfileChange, AuthorizedApp, MySession, MyAddress, MyDataExport, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';

package/dist/auth/operations.d.ts

@@ -322,6 +322,38 @@ export interface AuthorizedApp {
     /** ISO-8601. */
     grantedAt: string | null;
 }
+/**
+ * An organization the calling user can enter, and how, as
+ * `myOrganizationChoices` lists it. In their own sign-in only; an organization
+ * that lets them in no way is never named.
+ */
+export interface MyOrganizationChoice {
+    orgId: string;
+    name: string;
+    displayName: string | null;
+    parentId: string | null;
+    /** `member`, `invited`, `may_join` or `requested`. */
+    relation: 'member' | 'invited' | 'may_join' | 'requested';
+    /** False for an organization that may not act now: suspended, or due to be deleted. */
+    available: boolean;
+    /** For `may_join`: `open`, signing in there joins; `request`, it asks. */
+    joining: 'open' | 'request' | null;
+    /** For `may_join`: a verified address of theirs is what lets them. */
+    byAddress: boolean;
+    /** For `invited`: the invitation waiting for them. */
+    invitationId: string | null;
+    /** For `requested`: their waiting request. */
+    requestId: string | null;
+}
+/** What `myOrganizationChoices` answers. */
+export interface MyOrganizationChoices {
+    organizations: Array<MyOrganizationChoice>;
+    /**
+     * They stand at the project, and so at every organization sharing its
+     * sign-in; those are not listed one by one.
+     */
+    projectMember: boolean;
+}
 /**
  * One organization the calling user may stand in, as `myOrganizations`
  * returns it.

package/dist/auth/ops.d.ts

@@ -82,6 +82,7 @@ export declare const AUTH_OPS: {
     readonly renameFactor: "renameFactor";
     readonly makeRecoveryCodes: "makeRecoveryCodes";
     readonly myOrganizations: "myOrganizations";
+    readonly myOrganizationChoices: "myOrganizationChoices";
     readonly registerOrganization: "registerOrganization";
     readonly loginWithProvider: "loginWithProvider";
     readonly providerCallback: "providerCallback";

package/dist/auth/session-client.d.ts

@@ -27,6 +27,7 @@
  * api.foir.dev but a browser cannot reach them there — the cookie would be
  * cross-site, and that CORS surface deliberately refuses credentials.
  */
+import type { HostedLoginOptions } from './hosted';
 export interface FoirSessionConfig {
     /**
      * Your verified custom login domain, e.g. `https://login.acme.com`. Must share
@@ -66,8 +67,12 @@ export interface FoirSessionClient {
     getUser(): Promise<FoirSessionUser | null>;
     /** Revoke the session server-side and clear the cookie. Idempotent. */
     signOut(): Promise<void>;
-    /** Where to send the browser to sign in. */
-    signInUrl(returnTo?: string): string;
+    /**
+     * Where to send the browser to sign in. Name the organization the sign-in is
+     * for with `options.org` when one auth client serves an address per
+     * organization.
+     */
+    signInUrl(returnTo?: string, options?: HostedLoginOptions): string;
     /** Observe session changes. Returns an unsubscribe function. */
     subscribe(listener: (user: FoirSessionUser | null) => void): () => void;
     /** Cancel the refresh timer. Call on unmount. */

package/dist/auth-session.js

@@ -113,10 +113,11 @@ function createFoirSessionClient(config) {
       forget();
       config.onSignOut?.();
     },
-    signInUrl(returnTo) {
+    signInUrl(returnTo, options = {}) {
       const dest = new URL(trimSlash(config.loginOrigin));
       const target = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
       if (target && target !== "/") dest.searchParams.set("returnTo", target);
+      if (options.org) dest.searchParams.set("org", options.org);
       return dest.toString();
     },
     subscribe(listener) {

package/dist/auth.js

@@ -1130,6 +1130,9 @@ var AUTH_OPS = {
   // names the organization it acts in (`orgId` or `orgUrl` below), and the
   // platform checks the caller stands there every time.
   myOrganizations: "myOrganizations",
+  // Where they may go: the organizations they are a member of, are invited
+  // to, may join, or asked to join. An organization switcher's choices.
+  myOrganizationChoices: "myOrganizationChoices",
   // Founding one. Present in a manifest only when the project opted in.
   registerOrganization: "registerOrganization",
   // External identity providers.
@@ -1371,6 +1374,9 @@ async function makeRecoveryCodes(env, elevatedHandle, options) {
 async function myOrganizations(env, vars, options) {
   return authOp(env, AUTH_OPS.myOrganizations, vars ?? {}, options);
 }
+async function myOrganizationChoices(env, options) {
+  return authOp(env, AUTH_OPS.myOrganizationChoices, {}, options);
+}
 async function registerOrganization(env, vars, options) {
   return authOp(env, AUTH_OPS.registerOrganization, vars, options);
 }
@@ -1567,6 +1573,8 @@ var GRANT_TABLE = [
   ["authclients:write", "none", [], []],
   ["domains:read", "none", [], []],
   ["domains:write", "none", [], []],
+  ["loginpages:read", "none", [], []],
+  ["loginpages:write", "none", [], []],
   ["secrets:read", "none", [], []],
   ["secrets:list", "none", [], []],
   ["secrets:put", "none", [], []],
@@ -1604,7 +1612,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -1797,11 +1805,14 @@ async function requireScope(adapter, env, scope) {
 var DEFAULT_COOKIE_NAME = "foir_session";
 var DEFAULT_SESSION_PATH = "/session/token";
 var DEFAULT_END_SESSION_PATH = "/session/end-session";
-function hostedLoginUrl(config, returnTo) {
+function hostedLoginUrl(config, returnTo, options = {}) {
   const dest = new URL(config.loginOrigin);
   if (returnTo && returnTo !== "/") {
     dest.searchParams.set("returnTo", returnTo);
   }
+  if (options.org) {
+    dest.searchParams.set("org", options.org);
+  }
   return dest.toString();
 }
 function hostedLogoutUrl(config, clientId, returnTo) {
@@ -2017,10 +2028,11 @@ function createFoirSessionClient(config) {
       forget();
       config.onSignOut?.();
     },
-    signInUrl(returnTo) {
+    signInUrl(returnTo, options = {}) {
       const dest = new URL(trimSlash(config.loginOrigin));
       const target = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
       if (target && target !== "/") dest.searchParams.set("returnTo", target);
+      if (options.org) dest.searchParams.set("org", options.org);
       return dest.toString();
     },
     subscribe(listener) {
@@ -2082,6 +2094,7 @@ export {
   myAddresses,
   myAuthorizedApps,
   myFactors,
+  myOrganizationChoices,
   myOrganizations,
   myProviderToken,
   mySessions,

package/dist/data/builtins.d.ts

@@ -517,22 +517,50 @@ export interface FoirUserNote {
     createdAt: string;
 }
 /**
- * What a note surface has to know about the project before it renders anything
- * — `foir.ns.notes.noteConfig`.
- *
- * Charged `notes:create` rather than `notes:read`, and refused to a caller with
- * no user session, because the only caller it is useful to is one that can
- * submit. So a composer can read it as its single readiness probe: an answer
- * means this visitor may write, and a refusal names which half is missing.
+ * What a note surface has to know before it renders anything —
+ * `foir.ns.notes.noteConfig`.
+ *
+ * Charged `notes:create` rather than `notes:read`, and answered to exactly the
+ * callers `writeNote` takes a note from: a signed-in user, and a visitor with
+ * no session on a project that takes visitors' notes, through a key that gives
+ * them `notes:create`. Everyone else is refused. So a composer can read it as
+ * its single readiness probe: an answer means this caller may write, and says
+ * how; a refusal names which half is missing.
  */
 export interface FoirNoteConfig {
     /**
-     * Whether this project's note surfaces may OFFER to capture a screenshot.
+     * Whether this caller's composer may OFFER to capture a screenshot: the
+     * project allows it, and the caller is signed in. Always false for a
+     * visitor, whose note carries no attachment.
      *
      * It gates the offer, not the storing. Capture stays opt-in per submission —
      * the browser's own picker is the consent gate and it cannot be bypassed.
      */
     screenshotsEnabled: boolean;
+    /**
+     * Whether the project takes notes from visitors who are not signed in
+     * (Notes settings → "Accept anonymous notes").
+     */
+    anonymousAccepted: boolean;
+    /**
+     * Whether the note this caller writes is a signed-in user's. False is a
+     * visitor's: `writeNote` answers it with a {@link FoirNoteReceipt} and nothing
+     * more, and it may carry a `contactEmail`.
+     */
+    signedIn: boolean;
+}
+/**
+ * What `writeNote` answers a visitor with: the note's `id` and `createdAt`,
+ * and nothing else, because nobody is signed in to read the note back as. Ask
+ * for more and the write is refused before anything is written.
+ *
+ * Show the `id` to the visitor so they can quote it. Nothing on the public
+ * plane takes it to read the note.
+ */
+export interface FoirNoteReceipt {
+    id: string;
+    /** ISO-8601. */
+    createdAt: string;
 }
 /** `myNotes` arguments. Forward-only cursor pagination, like every list read. */
 export interface FoirMyNotesArgs {
@@ -558,11 +586,8 @@ export type FoirMyNotesResult = FoirConnection<FoirUserNote>;
  * A signed-in user's note is theirs and comes back in `myNotes`. A
  * visitor's, through a key that gives `notes:create` to whoever comes through
  * it, on a project that takes visitors' notes, is nobody's: ask for its `id`
- * and `createdAt` and nothing else, because nothing reads it back.
- *
- * Served by a data API that has the field. `<FoirFeedback>` still writes
- * through `createMyNote`, the same create under its older name, which every
- * data API serves.
+ * and `createdAt` and nothing else (`pick: ['id', 'createdAt']`), because
+ * nothing reads it back. What comes back is a {@link FoirNoteReceipt}.
  */
 export interface FoirWriteNoteArgs {
     /** A visitor may write about a record and nothing else. */