@foir/sdk 0.26.0 → 0.27.0

package/CHANGELOG.md

@@ -108,6 +108,67 @@ nobody asking for `@foir/sdk` gets it early. The push that carries the commit to
 
 Changes on `dev` that have not been published to npm.
 
+## [0.27.0] — 2026-10-20
+
+### Added
+
+- **`organizations.startPool({ movePeople, dryRun })`** (`@foir/sdk/app`):
+  starting the run's organization's own pool takes its people along when
+  asked. Somebody who stands only there moves whole, and somebody who also
+  stands elsewhere is given a new user there with their memberships, roles and
+  what they own there. `dryRun` counts what would move and changes nothing.
+  The `AppOrganizationPoolMove` and `AppOrganizationPoolStart` types.
+- **`stepUpRequired(error)`** and the `STEP_UP_REQUIRED` error code: what an
+  organization's sign-in rules ask of the signed-in user before a request
+  standing there can succeed, `second_factor` or `sign_in_method`.
+- **`myOrganizationChoices`**: the organizations the signed-in user can enter,
+  as an organization switcher offers them: member, invited, may join or
+  requested, each marked available or not, and whether they stand at the
+  project. Requires the user's bearer.
+- **`organizations.provision({ joining })`** (`@foir/sdk/app`): who may join
+  the new organization without an invitation. `'invitation'` takes only
+  invitations and staff adding people, `'open'` lets someone who can already
+  sign in at its page join by signing in there, and `'request'` makes signing
+  in there a request its staff approve or decline. Left out, the nearest
+  organization above that chose, then the project.
+- **`organizations.provision({ users })`** (`@foir/sdk/app`): where somebody
+  who signs up at the new organization stands. `'joined'` makes them a user of
+  that organization, and `'everyone'` a user of the project, so every
+  organization that shares its sign-in can find, email and sign them in. Left
+  out, the nearest organization above that chose, then the project.
+- **`<FoirFeedback>` takes a note from a visitor who is not signed in**
+  (`@foir/sdk/react`), on a project that takes visitors' notes ("Accept
+  anonymous notes") through a key that gives them `notes:create`. The visitor
+  gets the composer rather than a sign-in prompt, with an optional email to
+  reply to, and is shown the note's `id` as a reference. The new
+  `onVisitorSubmitted` prop is called with the receipt; `onSubmitted` stays the
+  signed-in user's note. A project that does not take visitors' notes still
+  asks them to sign in.
+- **`FoirNoteReceipt`** (`@foir/sdk/data`): `{ id, createdAt }`, what
+  `writeNote` answers a visitor with.
+- **`FoirNoteConfig.signedIn` and `FoirNoteConfig.anonymousAccepted`**:
+  whether the caller writes as a signed-in user, and whether the project takes
+  visitors' notes. `screenshotsEnabled` is false for a visitor, whose note
+  carries no attachment.
+- **`FoirFeedbackClient` carries an optional `writeNote`**, so a client typed
+  before it still satisfies the prop.
+
+### Changed
+
+- **`<FoirFeedback>` writes a signed-in user's note through `writeNote`**, the
+  one note create, rather than `createMyNote`, its older name. The same note
+  on the same data API. A client whose generated module predates `writeNote`
+  is refused it, saying to re-run `foir types`; a client typed without it at
+  all still writes through `createMyNote`.
+- **Breaking: `organizations.startPool()` answers `{ pool, moved }`**
+  (`AppOrganizationPoolStart`): the pool it signs its people in to now, and
+  what moved into it by kind. It answered the pool alone.
+- **`organizations.provision({ ownPool: false })` is sent.** It used to be
+  dropped, so it read as leaving the choice to the project; it now says the
+  organization shares the pool above it, whatever the project chose. Left out,
+  it still takes the project's choice for a top-level organization and its
+  parent's pool for one beneath another.
+
 ## [0.26.0] — 2026-10-19
 
 ### Changed

package/dist/app/client.d.ts

@@ -241,9 +241,26 @@ export interface AppOrganizationProvision {
      * The organisation signs its own people in, to a pool of its own, apart
      * from its parent's and the project's. Its descendants share that pool
      * unless one of them starts another. One that exists already starts one
-     * with `organizations.startPool`.
+     * with `organizations.startPool`. Left out, the project's choice for one at
+     * the top, and its parent's pool for one beneath another.
      */
     ownPool?: boolean;
+    /**
+     * Where somebody who signs up at it stands: `'joined'` makes them a user of
+     * this organisation, and `'everyone'` a user of the project, so every
+     * organisation that shares its sign-in can find, email and sign them in.
+     * Left out, the nearest organisation above that chose, then the project.
+     * Its first member is a member of it either way.
+     */
+    users?: 'joined' | 'everyone';
+    /**
+     * Who may join it without an invitation: `'invitation'` (only an invitation
+     * or staff adding them), `'open'` (someone who can already sign in at its
+     * page joins by signing in there) or `'request'` (signing in there asks, and
+     * its staff approve or decline). Left out, the nearest organisation above
+     * that chose, then the project.
+     */
+    joining?: 'invitation' | 'open' | 'request';
 }
 /**
  * The pool an organisation's people sign in to, and where it comes from: its
@@ -258,6 +275,44 @@ export interface AppOrganizationPool {
     /** How many people the pool holds, when it is the organisation's own. Null for any other. */
     people: number | null;
 }
+/** What starting an organisation's own pool moved, or for a dry run would move, by kind. */
+export interface AppOrganizationPoolMove {
+    /** Whether nothing was changed. */
+    dryRun: boolean;
+    /** People who stood only there, moved whole into the new pool. */
+    peopleMoved: number;
+    /** People who also stand elsewhere, each given a new user in the new pool. */
+    peopleMade: number;
+    /** Of those, how many are emailed a link to set up their account. */
+    peopleTold: number;
+    /** Memberships of the people given a new user, moved to that new user. */
+    membershipsMoved: number;
+    /** Active roles held in those memberships. */
+    rolesMoved: number;
+    recordsMoved: number;
+    filesMoved: number;
+    /** Notes assigned to them there, now assigned to the new user. A note stays its author's. */
+    notesReassigned: number;
+    notificationsMoved: number;
+    /** Their choices of what they are told there. */
+    notificationChoicesMoved: number;
+    /** The access they were given to single resources there. */
+    accessGrantsMoved: number;
+    /** Open invitations there, now to the new pool. */
+    invitationsMoved: number;
+    /** Requests to join from people it no longer signs in, withdrawn. */
+    joinRequestsWithdrawn: number;
+    /** Apps that now sign in the new pool's people. */
+    appsMoved: number;
+    /** Sign-ins through those apps of anybody not in the new pool, ended. */
+    signInsEnded: number;
+}
+/** Starting an organisation's own pool: the pool it signs its people in to now, and what moved into it. */
+export interface AppOrganizationPoolStart {
+    /** Its pool, now its own; for a dry run, the pool it signs in to still. */
+    pool: AppOrganizationPool;
+    moved: AppOrganizationPoolMove;
+}
 /**
  * Who a consent change is for: a user whose id the app holds, or an
  * address.
@@ -483,9 +538,12 @@ export interface AppClient {
     };
     users: {
         /**
-         * The user who has this email at the install's level, made when there
-         * is none. The same user every time for one email. Needs
-         * `users:create`.
+         * The user who has this email in the sign-in the install's place uses,
+         * made when nobody has it. The same user every time for one email. One
+         * the place does not reach is answered only where its organization lets
+         * them in (open, or their verified address at its open domain), joining
+         * it first; anybody else is refused without saying who has the address.
+         * Needs `users:create`.
          *
          * `verified` says whether that address is one the user has proved is
          * theirs. A user this call makes has not, and neither has one an
@@ -586,17 +644,27 @@ export interface AppClient {
         pool(): Promise<AppOrganizationPool>;
         /**
          * Start the own pool of the organisation this run acts in, which it and
-         * everything beneath it sign their people in to. Needs
-         * `organizations:write`. Refused while
-         * anybody of the pool it signs in to now holds a membership in it or
-         * beneath it, or an invitation there is open to that pool, and the
-         * refusal says how many: nobody is moved between pools, so those
-         * memberships are removed first and those people sign up again in the
-         * new pool. Its apps, and those beneath it, then sign their people in
-         * there, and anybody signed in through them is signed out. Safe to run
-         * again: it answers the pool it has.
+         * everything beneath it that shares its pool sign their people in to.
+         * Needs `organizations:write`.
+         *
+         * Without `movePeople`, refused while anybody of the pool it signs in to
+         * now holds a membership in it or beneath it, or an invitation there is
+         * open to that pool, and the refusal says how many. With it, somebody who
+         * stands only there moves whole, with their addresses, sign-ins and
+         * sessions, and somebody who also stands elsewhere is given a new user
+         * there, with their memberships, roles and what they own there, who
+         * proves their address before they sign in; refused while the new pool
+         * would hold an address twice. `dryRun` answers what would move and
+         * changes nothing.
+         *
+         * Its apps, and those beneath it, then sign their people in there, and
+         * anybody signed in through them who is not in the new pool is signed
+         * out. Safe to run again: it answers the pool it has and moves nobody.
          */
-        startPool(): Promise<AppOrganizationPool>;
+        startPool(options?: {
+            movePeople?: boolean;
+            dryRun?: boolean;
+        }): Promise<AppOrganizationPoolStart>;
         /**
          * Drop the own pool of the organisation this run acts in, so it signs its
          * people in to the pool above it. Needs `organizations:write`. Refused

package/dist/app/index.d.ts

@@ -21,7 +21,7 @@
  * The manifest's own messages are on `@foir/sdk/app/contract`.
  */
 export { createAppClient } from './client';
-export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppUser, AppUserEraseResult, AppUserList, AppUserSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationPool, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
+export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppUser, AppUserEraseResult, AppUserList, AppUserSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationPool, AppOrganizationPoolMove, AppOrganizationPoolStart, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
 export { appUserEmailUnavailableOf, appUserUnlinkedOf, appLookupConflictOf, isAppFieldWithheld } from './errors';
 export type { AppUserEmailUnavailableReason, AppLookupConflict } from './errors';
 export { appModelFieldName, appModelTypeName, appSelectorEnumValue } from './naming';

package/dist/app/vocabulary.generated.d.ts

@@ -3,7 +3,7 @@
  * manifest's hook may subscribe to (an event of the project, that something
  * emits) is the platform's to say: `validateAppManifest` answers it.
  */
-export declare const APP_HOOK_EVENTS: readonly ["RECORD_CREATED", "RECORD_UPDATED", "RECORD_DELETED", "RECORD_PUBLISHED", "RECORD_UNPUBLISHED", "USER_CREATED", "USER_UPDATED", "USER_DELETED", "USER_MERGED", "SESSION_REVOKED", "OPERATION_COMPLETED", "OPERATION_FAILED", "OPERATION_CANCELLED", "OPERATION_TIMED_OUT", "MEMBERSHIP_GRANTED", "MEMBERSHIP_REVOKED", "MEMBERSHIP_ROLE_CHANGED", "TENANT_PLAN_CHANGED", "TENANT_SUBSCRIPTION_STATUS_CHANGED", "PROJECT_CREATED", "PROJECT_ARCHIVED", "INVITATION_ACCEPTED", "IMPORT_COMPLETED", "MIGRATION_APPLIED", "BULK_UPDATE_COMPLETED", "BULK_PUBLISH_COMPLETED", "USER_PREFERENCE_CHANGED", "ORGANIZATION_CREATED", "ORGANIZATION_UPDATED", "ORGANIZATION_MOVED", "ORGANIZATION_SUSPENDED", "ORGANIZATION_RESUMED", "ORGANIZATION_DELETION_SCHEDULED", "ORGANIZATION_DELETION_CANCELLED", "ORGANIZATION_DELETED", "ORGANIZATION_MEMBER_ADDED", "ORGANIZATION_MEMBER_REMOVED", "ORGANIZATION_MEMBER_ROLE_CHANGED", "PROJECT_REACTIVATED"];
+export declare const APP_HOOK_EVENTS: readonly ["RECORD_CREATED", "RECORD_UPDATED", "RECORD_DELETED", "RECORD_PUBLISHED", "RECORD_UNPUBLISHED", "USER_CREATED", "USER_UPDATED", "USER_DELETED", "USER_MERGED", "SESSION_REVOKED", "OPERATION_COMPLETED", "OPERATION_FAILED", "OPERATION_CANCELLED", "OPERATION_TIMED_OUT", "MEMBERSHIP_GRANTED", "MEMBERSHIP_REVOKED", "MEMBERSHIP_ROLE_CHANGED", "TENANT_PLAN_CHANGED", "TENANT_SUBSCRIPTION_STATUS_CHANGED", "PROJECT_CREATED", "PROJECT_ARCHIVED", "INVITATION_ACCEPTED", "IMPORT_COMPLETED", "MIGRATION_APPLIED", "BULK_UPDATE_COMPLETED", "BULK_PUBLISH_COMPLETED", "USER_PREFERENCE_CHANGED", "ORGANIZATION_CREATED", "ORGANIZATION_UPDATED", "ORGANIZATION_MOVED", "ORGANIZATION_SUSPENDED", "ORGANIZATION_RESUMED", "ORGANIZATION_DELETION_SCHEDULED", "ORGANIZATION_DELETION_CANCELLED", "ORGANIZATION_DELETED", "ORGANIZATION_MEMBER_ADDED", "ORGANIZATION_MEMBER_REMOVED", "ORGANIZATION_MEMBER_ROLE_CHANGED", "PROJECT_REACTIVATED", "JOIN_REQUESTED", "JOIN_REQUEST_APPROVED", "JOIN_REQUEST_DECLINED"];
 /** An event a hook can name. */
 export type AppHookEvent = (typeof APP_HOOK_EVENTS)[number];
 /**

package/dist/app.js

@@ -353,8 +353,8 @@ function createAppClient(config) {
     throw new FoirRequestError(`[foir] ${message}`);
   };
   const POOL_FIELDS = "organizationId poolId source sourceOrganizationId people";
-  async function poolOf(name, document) {
-    const answer = await field(name, document, {});
+  const POOL_MOVE_FIELDS = "dryRun peopleMoved peopleMade peopleTold membershipsMoved rolesMoved recordsMoved filesMoved notesReassigned notificationsMoved notificationChoicesMoved accessGrantsMoved invitationsMoved joinRequestsWithdrawn appsMoved signInsEnded";
+  function poolFrom(name, answer) {
     if (!answer?.poolId || !answer.organizationId || answer.source !== "OWN" && answer.source !== "ANCESTOR" && answer.source !== "PROJECT") {
       return refuse(`${name} reported no error and answered no pool`);
     }
@@ -366,6 +366,9 @@ function createAppClient(config) {
       people: answer.people ?? null
     };
   }
+  async function poolOf(name, document) {
+    return poolFrom(name, await field(name, document, {}));
+  }
   let surface;
   function served() {
     surface ??= withFoirRetry(async () => {
@@ -854,7 +857,9 @@ function createAppClient(config) {
             input.firstMember = { userId: first.userId };
           }
         }
-        if (organization.ownPool === true) input.ownPool = true;
+        if (typeof organization.ownPool === "boolean") input.ownPool = organization.ownPool;
+        if (organization.users !== void 0) input.users = organization.users;
+        if (organization.joining !== void 0) input.joining = organization.joining;
         const answered = settings === void 0 ? "organizationId status" : "organizationId settingsRecordId status";
         const answer = await field(
           "provisionOrganization",
@@ -882,8 +887,18 @@ function createAppClient(config) {
       async pool() {
         return poolOf("organizationPool", `query AppOrganizationPool { organizationPool { ${POOL_FIELDS} } }`);
       },
-      async startPool() {
-        return poolOf("startOrganizationPool", `mutation AppStartOrganizationPool { startOrganizationPool { ${POOL_FIELDS} } }`);
+      async startPool(options = {}) {
+        const asks = `movePeople: ${options.movePeople === true}, dryRun: ${options.dryRun === true}`;
+        const answer = await field(
+          "startOrganizationPool",
+          `mutation AppStartOrganizationPool { startOrganizationPool(${asks}) { pool { ${POOL_FIELDS} } moved { ${POOL_MOVE_FIELDS} } } }`,
+          {}
+        );
+        const pool = poolFrom("startOrganizationPool", answer?.pool);
+        if (!answer?.moved) {
+          return refuse("startOrganizationPool reported no error and answered nothing of what moved");
+        }
+        return { pool, moved: answer.moved };
       },
       async dropPool() {
         return poolOf("dropOrganizationPool", `mutation AppDropOrganizationPool { dropOrganizationPool { ${POOL_FIELDS} } }`);
@@ -1218,7 +1233,10 @@ var APP_HOOK_EVENTS = [
   "ORGANIZATION_MEMBER_ADDED",
   "ORGANIZATION_MEMBER_REMOVED",
   "ORGANIZATION_MEMBER_ROLE_CHANGED",
-  "PROJECT_REACTIVATED"
+  "PROJECT_REACTIVATED",
+  "JOIN_REQUESTED",
+  "JOIN_REQUEST_APPROVED",
+  "JOIN_REQUEST_DECLINED"
 ];
 var APP_GRANTS = [
   "appconfig:read",

package/dist/auth/auth.d.ts

@@ -17,7 +17,7 @@
  */
 import { type FoirEnv } from '../graphql/foir-request';
 import { type AuthOpName, type AuthOpOptions } from './ops';
-import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyProfile, type MyProfileChange, type MySession, type MyAddress, type MyDataExport, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext } from './operations';
+import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyOrganizationChoices, type MyProfile, type MyProfileChange, type MySession, type MyAddress, type MyDataExport, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext } from './operations';
 import type { TypedDocumentNode } from '@graphql-typed-document-node/core';
 /** An access token + its rotating refresh token. */
 export interface FoirAuthTokens {
@@ -380,6 +380,15 @@ export declare function myOrganizations(env: FoirEnv, vars?: {
     first?: number;
     after?: string;
 }, options?: AuthOpOptions): Promise<MyOrganization[]>;
+/**
+ * The organizations the signed-in user can enter, as an organization switcher
+ * offers them: those they are a member of, are invited to, may join by signing
+ * in there, or asked to join, in their own sign-in. It is theirs alone. An
+ * organization that lets them in no way is never named, and one that may not
+ * act now is listed with `available: false` rather than left out. Requires the
+ * user's bearer.
+ */
+export declare function myOrganizationChoices(env: FoirEnv, options?: AuthOpOptions): Promise<MyOrganizationChoices>;
 /**
  * Found an organization, as its first member.
  *

package/dist/auth/index.d.ts

@@ -10,7 +10,7 @@
  * the caller's own manifest advertises, through the same op transport
  * `@foir/sdk/data` uses, so `graphql` is not on this module's path at all.
  */
-export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, currentUser, myProviderToken, logout, deleteMyAccount, leaveMembership, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, myAddresses, addMyAddress, proveMyAddress, makeMyAddressPrimary, removeMyAddress, exportMyData, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, renameFactor, makeRecoveryCodes, myOrganizations, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
+export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, currentUser, myProviderToken, logout, deleteMyAccount, leaveMembership, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, myAddresses, addMyAddress, proveMyAddress, makeMyAddressPrimary, removeMyAddress, exportMyData, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, renameFactor, makeRecoveryCodes, myOrganizations, myOrganizationChoices, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
 export type { FoirAuthTokens, FoirUser, SessionAdapter, RequireAuthOptions, } from './auth';
 export { userAccess, getSessionAccess, hasRole, hasScope, requireRole, requireScope, FoirAccessDeniedError, } from './access';
 export type { FoirAccess, FoirAccessDenial } from './access';
@@ -21,4 +21,4 @@ export { hostedLoginUrl, hostedLogoutUrl, fetchHostedSession, hostedSignInNotice
 export type { HostedLoginConfig, HostedLoginOptions, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
 export { createFoirSessionClient } from './session-client';
 export type { FoirSessionClient, FoirSessionConfig, FoirSessionUser, } from './session-client';
-export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, MyAddress, MyDataExport, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';
+export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyOrganizationChoice, MyOrganizationChoices, MyProfile, MyProfileChange, AuthorizedApp, MySession, MyAddress, MyDataExport, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';

package/dist/auth/operations.d.ts

@@ -322,6 +322,38 @@ export interface AuthorizedApp {
     /** ISO-8601. */
     grantedAt: string | null;
 }
+/**
+ * An organization the calling user can enter, and how, as
+ * `myOrganizationChoices` lists it. In their own sign-in only; an organization
+ * that lets them in no way is never named.
+ */
+export interface MyOrganizationChoice {
+    orgId: string;
+    name: string;
+    displayName: string | null;
+    parentId: string | null;
+    /** `member`, `invited`, `may_join` or `requested`. */
+    relation: 'member' | 'invited' | 'may_join' | 'requested';
+    /** False for an organization that may not act now: suspended, or due to be deleted. */
+    available: boolean;
+    /** For `may_join`: `open`, signing in there joins; `request`, it asks. */
+    joining: 'open' | 'request' | null;
+    /** For `may_join`: a verified address of theirs is what lets them. */
+    byAddress: boolean;
+    /** For `invited`: the invitation waiting for them. */
+    invitationId: string | null;
+    /** For `requested`: their waiting request. */
+    requestId: string | null;
+}
+/** What `myOrganizationChoices` answers. */
+export interface MyOrganizationChoices {
+    organizations: Array<MyOrganizationChoice>;
+    /**
+     * They stand at the project, and so at every organization sharing its
+     * sign-in; those are not listed one by one.
+     */
+    projectMember: boolean;
+}
 /**
  * One organization the calling user may stand in, as `myOrganizations`
  * returns it.

package/dist/auth/ops.d.ts

@@ -82,6 +82,7 @@ export declare const AUTH_OPS: {
     readonly renameFactor: "renameFactor";
     readonly makeRecoveryCodes: "makeRecoveryCodes";
     readonly myOrganizations: "myOrganizations";
+    readonly myOrganizationChoices: "myOrganizationChoices";
     readonly registerOrganization: "registerOrganization";
     readonly loginWithProvider: "loginWithProvider";
     readonly providerCallback: "providerCallback";

package/dist/auth.js

@@ -1130,6 +1130,9 @@ var AUTH_OPS = {
   // names the organization it acts in (`orgId` or `orgUrl` below), and the
   // platform checks the caller stands there every time.
   myOrganizations: "myOrganizations",
+  // Where they may go: the organizations they are a member of, are invited
+  // to, may join, or asked to join. An organization switcher's choices.
+  myOrganizationChoices: "myOrganizationChoices",
   // Founding one. Present in a manifest only when the project opted in.
   registerOrganization: "registerOrganization",
   // External identity providers.
@@ -1371,6 +1374,9 @@ async function makeRecoveryCodes(env, elevatedHandle, options) {
 async function myOrganizations(env, vars, options) {
   return authOp(env, AUTH_OPS.myOrganizations, vars ?? {}, options);
 }
+async function myOrganizationChoices(env, options) {
+  return authOp(env, AUTH_OPS.myOrganizationChoices, {}, options);
+}
 async function registerOrganization(env, vars, options) {
   return authOp(env, AUTH_OPS.registerOrganization, vars, options);
 }
@@ -2088,6 +2094,7 @@ export {
   myAddresses,
   myAuthorizedApps,
   myFactors,
+  myOrganizationChoices,
   myOrganizations,
   myProviderToken,
   mySessions,

package/dist/data/builtins.d.ts

@@ -517,22 +517,50 @@ export interface FoirUserNote {
     createdAt: string;
 }
 /**
- * What a note surface has to know about the project before it renders anything
- * — `foir.ns.notes.noteConfig`.
- *
- * Charged `notes:create` rather than `notes:read`, and refused to a caller with
- * no user session, because the only caller it is useful to is one that can
- * submit. So a composer can read it as its single readiness probe: an answer
- * means this visitor may write, and a refusal names which half is missing.
+ * What a note surface has to know before it renders anything —
+ * `foir.ns.notes.noteConfig`.
+ *
+ * Charged `notes:create` rather than `notes:read`, and answered to exactly the
+ * callers `writeNote` takes a note from: a signed-in user, and a visitor with
+ * no session on a project that takes visitors' notes, through a key that gives
+ * them `notes:create`. Everyone else is refused. So a composer can read it as
+ * its single readiness probe: an answer means this caller may write, and says
+ * how; a refusal names which half is missing.
  */
 export interface FoirNoteConfig {
     /**
-     * Whether this project's note surfaces may OFFER to capture a screenshot.
+     * Whether this caller's composer may OFFER to capture a screenshot: the
+     * project allows it, and the caller is signed in. Always false for a
+     * visitor, whose note carries no attachment.
      *
      * It gates the offer, not the storing. Capture stays opt-in per submission —
      * the browser's own picker is the consent gate and it cannot be bypassed.
      */
     screenshotsEnabled: boolean;
+    /**
+     * Whether the project takes notes from visitors who are not signed in
+     * (Notes settings → "Accept anonymous notes").
+     */
+    anonymousAccepted: boolean;
+    /**
+     * Whether the note this caller writes is a signed-in user's. False is a
+     * visitor's: `writeNote` answers it with a {@link FoirNoteReceipt} and nothing
+     * more, and it may carry a `contactEmail`.
+     */
+    signedIn: boolean;
+}
+/**
+ * What `writeNote` answers a visitor with: the note's `id` and `createdAt`,
+ * and nothing else, because nobody is signed in to read the note back as. Ask
+ * for more and the write is refused before anything is written.
+ *
+ * Show the `id` to the visitor so they can quote it. Nothing on the public
+ * plane takes it to read the note.
+ */
+export interface FoirNoteReceipt {
+    id: string;
+    /** ISO-8601. */
+    createdAt: string;
 }
 /** `myNotes` arguments. Forward-only cursor pagination, like every list read. */
 export interface FoirMyNotesArgs {
@@ -558,11 +586,8 @@ export type FoirMyNotesResult = FoirConnection<FoirUserNote>;
  * A signed-in user's note is theirs and comes back in `myNotes`. A
  * visitor's, through a key that gives `notes:create` to whoever comes through
  * it, on a project that takes visitors' notes, is nobody's: ask for its `id`
- * and `createdAt` and nothing else, because nothing reads it back.
- *
- * Served by a data API that has the field. `<FoirFeedback>` still writes
- * through `createMyNote`, the same create under its older name, which every
- * data API serves.
+ * and `createdAt` and nothing else (`pick: ['id', 'createdAt']`), because
+ * nothing reads it back. What comes back is a {@link FoirNoteReceipt}.
  */
 export interface FoirWriteNoteArgs {
     /** A visitor may write about a record and nothing else. */

package/dist/data/index.d.ts

@@ -59,7 +59,7 @@ export { planFoirModelCall, planFoirNamespaceCall } from './document';
 export type { FoirCall, FoirDocumentPlan, FoirNamespaceCall, FoirNamespaceSelections, FoirRecordPath, FoirSelectionModel, FoirSelectionNamespace, FoirSelections, FoirSelectionSource, FoirSelectionUnions, } from './document';
 export { createFoirSubjectRegistry, recordFoirSubjects } from './subjects';
 export type { FoirSubject, FoirSubjectEntry, FoirSubjectOptions, FoirSubjectOrigin, FoirSubjectRegistry, } from './subjects';
-export type { CollabInfo, FileValue, FoirAccessGrant, FoirAccessLevel, FoirAccessSource, FoirAccessor, FoirCreateMyNoteArgs, FoirWriteNoteArgs, FoirUserNote, FoirUserNoteAttachment, FoirDegraded, FoirDepthBelow, FoirDepthLevel, FoirDeviceType, FoirGranteeKind, FoirJsonValue, FoirMyAccess, FoirMyNotesArgs, FoirMyNotesResult, FoirNoteConfig, FoirNoteSubjectType, FoirPlatformType, FoirRecordOwner, FoirResolveContext, FoirResourceAccess, FoirUnexpandedRecord, FoirUpdateManyPayload, FoirVisibility, GeoPoint, Image, ImageFormat, ImageVariant, ImageVariantSet, MediaValue, Passage, Prose, ProseSpan, RecordAncestor, Reference, Richtext, Video, } from './builtins';
+export type { CollabInfo, FileValue, FoirAccessGrant, FoirAccessLevel, FoirAccessSource, FoirAccessor, FoirCreateMyNoteArgs, FoirWriteNoteArgs, FoirUserNote, FoirUserNoteAttachment, FoirDegraded, FoirDepthBelow, FoirDepthLevel, FoirDeviceType, FoirGranteeKind, FoirJsonValue, FoirMyAccess, FoirMyNotesArgs, FoirMyNotesResult, FoirNoteConfig, FoirNoteReceipt, FoirNoteSubjectType, FoirPlatformType, FoirRecordOwner, FoirResolveContext, FoirResourceAccess, FoirUnexpandedRecord, FoirUpdateManyPayload, FoirVisibility, GeoPoint, Image, ImageFormat, ImageVariant, ImageVariantSet, MediaValue, Passage, Prose, ProseSpan, RecordAncestor, Reference, Richtext, Video, } from './builtins';
 /**
  * Pre-rename spellings. The `<Name>Block` wrappers and the `<Name>Value`
  * split are the same thing as the types above — an item IS its value — so each
@@ -81,5 +81,5 @@ export type { FoirConnection, FoirFieldsShape, FoirModelDefinition, FoirNamespac
 export type { FoirInclude, FoirModelOperation, FoirNamespaceOperation, FoirOmittableKey, FoirOpResult, FoirQuery, FoirRecordResult, FoirWriteResult, } from './selection';
 export { FoirDecimal, decimal } from './decimal';
 export type { FoirDecimalDivOptions, FoirDecimalInput, FoirDecimalRounding, } from './decimal';
-export { FoirRequestError, FoirAuthDowngradedError, FoirSessionExpiredError, FOIR_VISITOR_IP_HEADER, } from '../transport/foir-http';
-export type { FoirEnv, FoirGraphQLErrorItem, FoirTokenProvider, FoirAuthDowngrade, FoirVisitor, FoirVisitorSource, } from '../transport/foir-http';
+export { FoirRequestError, FoirAuthDowngradedError, FoirSessionExpiredError, FOIR_VISITOR_IP_HEADER, stepUpRequired, } from '../transport/foir-http';
+export type { FoirEnv, FoirGraphQLErrorItem, FoirTokenProvider, FoirAuthDowngrade, FoirStepUp, FoirVisitor, FoirVisitorSource, } from '../transport/foir-http';

package/dist/data.js

@@ -10,6 +10,15 @@ var MALFORMED_PRUNE_REASONS = /* @__PURE__ */ new Set([
   "subselections_on_scalar",
   "missing_subselections"
 ]);
+function stepUpRequired(error) {
+  if (!(error instanceof FoirRequestError)) return null;
+  for (const item of error.graphQLErrors ?? []) {
+    if (item.extensions?.code !== "STEP_UP_REQUIRED") continue;
+    const asked = item.extensions.stepUp;
+    if (asked === "second_factor" || asked === "sign_in_method") return asked;
+  }
+  return null;
+}
 var FoirRequestError = class extends Error {
   /** HTTP status code, when the request failed at the HTTP layer. */
   status;
@@ -2686,5 +2695,6 @@ export {
   planFoirModelCall,
   planFoirNamespaceCall,
   printSubscriptionDocument,
-  recordFoirSubjects
+  recordFoirSubjects,
+  stepUpRequired
 };

package/dist/next.js

@@ -1010,6 +1010,9 @@ var AUTH_OPS = {
   // names the organization it acts in (`orgId` or `orgUrl` below), and the
   // platform checks the caller stands there every time.
   myOrganizations: "myOrganizations",
+  // Where they may go: the organizations they are a member of, are invited
+  // to, may join, or asked to join. An organization switcher's choices.
+  myOrganizationChoices: "myOrganizationChoices",
   // Founding one. Present in a manifest only when the project opted in.
   registerOrganization: "registerOrganization",
   // External identity providers.

package/dist/push.js

@@ -1130,6 +1130,9 @@ var AUTH_OPS = {
   // names the organization it acts in (`orgId` or `orgUrl` below), and the
   // platform checks the caller stands there every time.
   myOrganizations: "myOrganizations",
+  // Where they may go: the organizations they are a member of, are invited
+  // to, may join, or asked to join. An organization switcher's choices.
+  myOrganizationChoices: "myOrganizationChoices",
   // Founding one. Present in a manifest only when the project opted in.
   registerOrganization: "registerOrganization",
   // External identity providers.

package/dist/react/FoirFeedback.d.ts

@@ -1,4 +1,4 @@
-import type { FoirUserNote, FoirSubject, FoirSubjectRegistry } from '../data';
+import type { FoirNoteReceipt, FoirUserNote, FoirSubject, FoirSubjectRegistry } from '../data';
 import { type FoirFeedbackClient } from './feedback-notes';
 export type { FoirFeedbackClient } from './feedback-notes';
 export interface FoirFeedbackProps {
@@ -41,12 +41,19 @@ export interface FoirFeedbackProps {
     /** Start with the panel open. Default false. */
     defaultOpen?: boolean;
     /**
-     * Called when the visitor has to sign in first. Given a handler, the widget
-     * renders a button that calls it; given none, it says so and stops.
+     * Called when the visitor has to sign in first: the project takes no notes
+     * from visitors who are not signed in. Given a handler, the widget renders a
+     * button that calls it; given none, it says so and stops.
      */
     onSignIn?: () => void;
-    /** Called with the note once it is written. */
+    /** Called with a signed-in user's note once it is written. */
     onSubmitted?: (note: FoirUserNote) => void;
+    /**
+     * Called with the receipt once a visitor who is not signed in has sent a
+     * note: its id and when it was written, which is all a visitor's note
+     * answers with.
+     */
+    onVisitorSubmitted?: (receipt: FoirNoteReceipt) => void;
     /**
      * Called with anything that failed. The widget also logs it — this is for
      * routing it into your own error reporting, not for making it visible.
@@ -59,4 +66,4 @@ export interface FoirFeedbackProps {
      */
     className?: string;
 }
-export declare function FoirFeedback({ client, subjects, subject, label, triggerLabel, title, placeholder, defaultOpen, onSignIn, onSubmitted, onError, className, }: FoirFeedbackProps): import("react/jsx-runtime").JSX.Element;
+export declare function FoirFeedback({ client, subjects, subject, label, triggerLabel, title, placeholder, defaultOpen, onSignIn, onSubmitted, onVisitorSubmitted, onError, className, }: FoirFeedbackProps): import("react/jsx-runtime").JSX.Element;

package/dist/react/feedback-notes.d.ts

@@ -7,7 +7,7 @@
  * shape (see `data/selection.ts`) — so every response here has to be read rather
  * than cast, and reading is the part worth testing on its own.
  */
-import type { FoirUserNote, FoirNoteConfig, FoirSubject } from '../data';
+import type { FoirUserNote, FoirNoteConfig, FoirNoteReceipt, FoirSubject } from '../data';
 import type { FoirScreenCapture } from '../media/screen-capture';
 /**
  * The client the widget needs, and no more of it.
@@ -15,9 +15,9 @@ import type { FoirScreenCapture } from '../media/screen-capture';
  * Structural rather than `FoirClient<S>`, for two reasons. `FoirClient` is
  * generic in the caller's generated schema, so naming it here would force the
  * component's props to be generic in a parameter nothing else reads. And what
- * the widget actually depends on is three root fields — narrowing to them means
- * a client whose key cannot reach `files` still satisfies this type, which is
- * the honest shape: a project with screenshots off never uploads anything.
+ * the widget actually depends on is a handful of root fields — narrowing to them
+ * means a client whose key cannot reach `files` still satisfies this type, which
+ * is the honest shape: a project with screenshots off never uploads anything.
  *
  * The signatures are the ones `foir types` emits for every namespace op —
  * `Record<string, unknown>` in, `unknown` out — so a real generated client
@@ -27,6 +27,14 @@ export interface FoirFeedbackClient {
     readonly ns: {
         readonly notes: {
             noteConfig(args?: Record<string, unknown>): Promise<unknown>;
+            /**
+             * The one note create, for a signed-in user and a visitor alike. Optional
+             * so a client typed before it still satisfies this; without it a
+             * signed-in user's note goes through `createMyNote`, and a visitor's
+             * cannot be sent.
+             */
+            writeNote?(args?: Record<string, unknown>): Promise<unknown>;
+            /** The older name of `writeNote` for a signed-in user. */
             createMyNote(args?: Record<string, unknown>): Promise<unknown>;
         };
         /**
@@ -77,6 +85,12 @@ export declare function classifyNotesFault(err: unknown): FoirFeedbackFault;
  * `screenshotsEnabled` to false. Defaulting would be the quiet version of a
  * project's setting being ignored: the offer would disappear from every surface
  * at once and the only symptom would be a missing button.
+ *
+ * `signedIn` and `anonymousAccepted` are read as the older contract when they
+ * are absent, which is not a guess: a data API without them answers only a
+ * signed-in user, and refuses everyone else. A generated module that predates
+ * them selects neither from a data API that has both, and the client's drift
+ * check names that module as the thing to regenerate.
  */
 export declare function readNoteConfig(client: FoirFeedbackClient): Promise<FoirNoteConfig>;
 /** What one submission carries. */
@@ -101,3 +115,23 @@ export interface FoirFeedbackSubmission {
  * they wrote ("as you can see in the screenshot") stops making sense.
  */
 export declare function submitFeedbackNote(client: FoirFeedbackClient, submission: FoirFeedbackSubmission): Promise<FoirUserNote>;
+/** What a visitor's submission carries. */
+export interface FoirVisitorSubmission {
+    /** What the note is about, as for a signed-in user's. */
+    subject: FoirSubject;
+    body: string;
+    /**
+     * Where the project's team may reply, as the visitor typed it. Sent only
+     * when it is not blank, and never verified by anyone.
+     */
+    contactEmail?: string;
+}
+/**
+ * Write a visitor's note, and hand back its receipt.
+ *
+ * It asks for the note's `id` and `createdAt` and nothing else, because that is
+ * all a visitor's note answers with: asked for more, the data API refuses the
+ * write before anything is written. And it takes no attachment, which a
+ * visitor's note cannot carry.
+ */
+export declare function submitVisitorNote(client: FoirFeedbackClient, submission: FoirVisitorSubmission): Promise<FoirNoteReceipt>;

package/dist/react.js

@@ -1004,6 +1004,9 @@ var AUTH_OPS = {
   // names the organization it acts in (`orgId` or `orgUrl` below), and the
   // platform checks the caller stands there every time.
   myOrganizations: "myOrganizations",
+  // Where they may go: the organizations they are a member of, are invited
+  // to, may join, or asked to join. An organization switcher's choices.
+  myOrganizationChoices: "myOrganizationChoices",
   // Founding one. Present in a manifest only when the project opted in.
   registerOrganization: "registerOrganization",
   // External identity providers.
@@ -2246,7 +2249,14 @@ async function readNoteConfig(client) {
       "[foir] noteConfig answered without a boolean `screenshotsEnabled`. The widget reads it to decide whether to offer screenshot capture, and will not guess."
     );
   }
-  return { screenshotsEnabled };
+  const signedIn = result?.signedIn ?? true;
+  const anonymousAccepted = result?.anonymousAccepted ?? false;
+  if (typeof signedIn !== "boolean" || typeof anonymousAccepted !== "boolean") {
+    throw new Error(
+      "[foir] noteConfig answered `signedIn` or `anonymousAccepted` with something other than a boolean. The widget reads them to decide whether this visitor writes as themselves, and will not guess."
+    );
+  }
+  return { screenshotsEnabled, anonymousAccepted, signedIn };
 }
 async function submitFeedbackNote(client, submission) {
   const attachmentFileIds = [];
@@ -2255,14 +2265,42 @@ async function submitFeedbackNote(client, submission) {
       await uploadFeedbackAttachment(client, submission.screenshot, submission.fetch)
     );
   }
-  const args = {
+  const args = noteArgs(submission.subject, submission.body);
+  if (attachmentFileIds.length > 0) args.attachmentFileIds = attachmentFileIds;
+  const { notes } = client.ns;
+  return readCreatedNote(
+    await (notes.writeNote ? notes.writeNote(args) : notes.createMyNote(args))
+  );
+}
+async function submitVisitorNote(client, submission) {
+  const { notes } = client.ns;
+  if (!notes.writeNote) {
+    throw new Error(
+      "[foir] this client has no `notes.writeNote`, which is the only create that takes a note from a visitor who is not signed in. Re-run `foir types`."
+    );
+  }
+  const args = noteArgs(submission.subject, submission.body);
+  const contactEmail = submission.contactEmail?.trim();
+  if (contactEmail) args.contactEmail = contactEmail;
+  args.pick = ["id", "createdAt"];
+  const result = await notes.writeNote(args);
+  if (!result || typeof result.id !== "string" || result.id === "") {
+    throw new Error(
+      "[foir] writeNote answered a visitor with no receipt. Nothing was saved \u2014 if it had been, the surface would have returned its id."
+    );
+  }
+  return {
+    id: result.id,
+    createdAt: typeof result.createdAt === "string" ? result.createdAt : ""
+  };
+}
+function noteArgs(subject, body) {
+  return {
     subjectType: "record",
-    subjectId: submission.subject.recordId,
-    subjectModelKey: submission.subject.modelKey,
-    body: submission.body
+    subjectId: subject.recordId,
+    subjectModelKey: subject.modelKey,
+    body
   };
-  if (attachmentFileIds.length > 0) args.attachmentFileIds = attachmentFileIds;
-  return readCreatedNote(await client.ns.notes.createMyNote(args));
 }
 async function uploadFeedbackAttachment(client, screenshot, fetchImpl = globalThis.fetch) {
   const files = client.ns.files;
@@ -2314,7 +2352,7 @@ function readCreatedNote(result) {
   const note = result;
   if (!note || typeof note.id !== "string" || note.id === "") {
     throw new Error(
-      "[foir] createMyNote answered with no note. Nothing was saved \u2014 if it had been, the surface would have returned it."
+      "[foir] writeNote answered with no note. Nothing was saved \u2014 if it had been, the surface would have returned it."
     );
   }
   return {
@@ -2364,6 +2402,8 @@ var COPY = {
   loading: "One moment\u2026",
   sendFailed: "Your feedback could not be sent. Please try again.",
   sent: "Thanks. Your feedback has been sent.",
+  reference: "Reference",
+  contactEmail: "Your email, if you would like a reply (optional)",
   send: "Send feedback",
   sending: "Sending\u2026",
   capture: "Add a screenshot",
@@ -2400,6 +2440,13 @@ var textareaStyle = {
   minHeight: 96,
   resize: "vertical"
 };
+var inputStyle2 = {
+  padding: "8px 10px",
+  borderRadius: 6,
+  border: "1px solid currentColor",
+  background: "transparent",
+  font: "inherit"
+};
 var headingStyle = { margin: 0, fontSize: 15, fontWeight: 600 };
 var subjectStyle = { margin: 0, fontSize: 13, opacity: 0.75 };
 var noteStyle = { margin: 0, fontSize: 13 };
@@ -2424,12 +2471,15 @@ function FoirFeedback({
   defaultOpen = false,
   onSignIn,
   onSubmitted,
+  onVisitorSubmitted,
   onError,
   className
 }) {
   const [open, setOpen] = useState4(defaultOpen);
   const [probe, setProbe] = useState4({ status: "loading" });
   const [body, setBody] = useState4("");
+  const [contactEmail, setContactEmail] = useState4("");
+  const [receipt, setReceipt] = useState4(null);
   const [screenshot, setScreenshot] = useState4(null);
   const [capturing, setCapturing] = useState4(false);
   const [busy, setBusy] = useState4(false);
@@ -2448,7 +2498,11 @@ function FoirFeedback({
       try {
         const config = await readNoteConfig(client);
         if (!cancelled) {
-          setProbe({ status: "ready", screenshotsEnabled: config.screenshotsEnabled });
+          setProbe({
+            status: "ready",
+            screenshotsEnabled: config.screenshotsEnabled,
+            signedIn: config.signedIn
+          });
         }
       } catch (err) {
         if (cancelled) return;
@@ -2479,19 +2533,32 @@ function FoirFeedback({
   const onSubmit = async (event) => {
     event.preventDefault();
     const prose = body.trim();
-    if (!resolved || !prose || busy) return;
+    if (!resolved || !prose || busy || probe.status !== "ready") return;
     setBusy(true);
     setFailure(null);
     try {
-      const note = await submitFeedbackNote(client, {
-        subject: resolved,
-        body: prose,
-        screenshot
-      });
-      setBody("");
-      setScreenshot(null);
-      setSent(true);
-      onSubmitted?.(note);
+      if (probe.signedIn) {
+        const note = await submitFeedbackNote(client, {
+          subject: resolved,
+          body: prose,
+          screenshot
+        });
+        setBody("");
+        setScreenshot(null);
+        setSent(true);
+        onSubmitted?.(note);
+      } else {
+        const written = await submitVisitorNote(client, {
+          subject: resolved,
+          body: prose,
+          contactEmail
+        });
+        setBody("");
+        setContactEmail("");
+        setReceipt(written);
+        setSent(true);
+        onVisitorSubmitted?.(written);
+      }
     } catch (err) {
       const fault = classifyNotesFault(err);
       reportFault(fault, err, "sending feedback failed");
@@ -2507,6 +2574,7 @@ function FoirFeedback({
       return;
     }
     setSent(false);
+    setReceipt(null);
     setFailure(null);
     setOpen(true);
   };
@@ -2567,11 +2635,28 @@ function FoirFeedback({
                 disabled: busy,
                 onChange: (event) => {
                   setBody(event.target.value);
-                  if (sent) setSent(false);
+                  if (sent) {
+                    setSent(false);
+                    setReceipt(null);
+                  }
                 },
                 style: styled ? textareaStyle : void 0
               }
             ),
+            !probe.signedIn && /* @__PURE__ */ jsx5(
+              "input",
+              {
+                type: "email",
+                "data-foir-feedback-contact": true,
+                "aria-label": COPY.contactEmail,
+                placeholder: COPY.contactEmail,
+                autoComplete: "email",
+                value: contactEmail,
+                disabled: busy,
+                onChange: (event) => setContactEmail(event.target.value),
+                style: styled ? inputStyle2 : void 0
+              }
+            ),
             probe.screenshotsEnabled && isFoirScreenCaptureSupported() && /* @__PURE__ */ jsx5(Fragment2, { children: screenshot ? /* @__PURE__ */ jsxs4(Fragment2, { children: [
               /* @__PURE__ */ jsx5(
                 "img",
@@ -2614,6 +2699,11 @@ function FoirFeedback({
                 children: COPY.sent
               }
             ),
+            sent && !failure && receipt && /* @__PURE__ */ jsxs4("p", { "data-foir-feedback-receipt": true, style: styled ? subjectStyle : void 0, children: [
+              COPY.reference,
+              ": ",
+              receipt.id
+            ] }),
             /* @__PURE__ */ jsx5(
               "button",
               {

package/dist/server/index.d.ts

@@ -12,5 +12,5 @@ export type { CallbackClient, CallbackResult } from './callback-client';
 export { createEventsClient, FoirEventCursorExpiredError, isFoirEventCursorExpired, FOIR_EVENTS_PATH, FOIR_EVENTS_SCOPE, FOIR_EVENTS_RETENTION_DAYS, } from './events-client';
 export type { FoirEvent, FoirEventActor, FoirEventPage, FoirEventRetention, FoirEventsClient, FoirEventsClientConfig, FoirEventsListParams, FoirEventsStreamParams, FoirEventsSubscribeParams, } from './events-client';
 export type { FoirSubscription, FoirSubscriptionHandlers } from '../data/ws-transport';
-export { FoirRequestError, FoirAuthDowngradedError, FoirSessionExpiredError, isFoirForbidden, isFoirNotFound, isFoirRateLimited, isFoirUnauthenticated, } from '../transport/foir-http';
+export { FoirRequestError, FoirAuthDowngradedError, FoirSessionExpiredError, isFoirForbidden, isFoirNotFound, isFoirRateLimited, isFoirUnauthenticated, stepUpRequired, } from '../transport/foir-http';
 export type { FoirErrorCode, FoirErrorExtensions, FoirGraphQLErrorItem, FoirAuthDowngrade, } from '../transport/foir-http';

package/dist/server.js

@@ -699,6 +699,15 @@ function continueRun(continuation) {
 }
 
 // src/transport/foir-http.ts
+function stepUpRequired(error) {
+  if (!(error instanceof FoirRequestError)) return null;
+  for (const item of error.graphQLErrors ?? []) {
+    if (item.extensions?.code !== "STEP_UP_REQUIRED") continue;
+    const asked = item.extensions.stepUp;
+    if (asked === "second_factor" || asked === "sign_in_method") return asked;
+  }
+  return null;
+}
 var FoirRequestError = class extends Error {
   /** HTTP status code, when the request failed at the HTTP layer. */
   status;
@@ -1752,6 +1761,7 @@ export {
   recordsReadModels,
   recordsWriteModels,
   requireScopedToken,
+  stepUpRequired,
   verifyScopedToken,
   verifyWebhookSignature
 };

package/dist/transport/foir-http.d.ts

@@ -55,7 +55,14 @@ export declare function resolveFoirApiKey(env: FoirEnv): string | undefined;
  * because an absent record is an answer rather than a failure. `NOT_FOUND` only
  * appears when a mutation names something that does not exist.
  */
-export type FoirErrorCode = 'INVALID_ARGUMENT' | 'NOT_FOUND' | 'ALREADY_EXISTS' | 'FAILED_PRECONDITION' | 'PERMISSION_DENIED' | 'UNAUTHENTICATED' | 'RATE_LIMITED' | 'TIMEOUT' | 'UNAVAILABLE' | 'CANCELED' | 'INTERNAL';
+export type FoirErrorCode = 'INVALID_ARGUMENT' | 'NOT_FOUND' | 'ALREADY_EXISTS' | 'FAILED_PRECONDITION' | 'PERMISSION_DENIED' | 'UNAUTHENTICATED' | 'RATE_LIMITED' | 'TIMEOUT' | 'UNAVAILABLE' | 'CANCELED' | 'INTERNAL' | 'STEP_UP_REQUIRED';
+/**
+ * What a `STEP_UP_REQUIRED` refusal asks of the signed-in user, in
+ * `extensions.stepUp`: `second_factor`, prove a second factor (the step-up
+ * flow) and retry; `sign_in_method`, sign in again with a method the
+ * organization the request stands in accepts.
+ */
+export type FoirStepUp = 'second_factor' | 'sign_in_method';
 export interface FoirErrorExtensions {
     /** Stable machine-readable code. Branch on this, never on `message`. */
     code?: FoirErrorCode | string;
@@ -63,6 +70,8 @@ export interface FoirErrorExtensions {
     requestId?: string;
     /** On `RATE_LIMITED`: whole seconds to wait. Never less than 1. */
     retryAfter?: number;
+    /** On `STEP_UP_REQUIRED`: what the signed-in user must do before retrying. */
+    stepUp?: FoirStepUp;
     [key: string]: unknown;
 }
 export interface FoirGraphQLErrorItem {
@@ -115,6 +124,13 @@ export interface FoirRateLimitSnapshot {
     /** Unix seconds at which the window resets. */
     resetAt: number;
 }
+/**
+ * What an error asks of the signed-in user before the request can succeed, or
+ * null: an organization's sign-in rules turned the session away, because it
+ * requires a second factor the session has not proven (`second_factor`) or does
+ * not accept how the user signed in (`sign_in_method`).
+ */
+export declare function stepUpRequired(error: unknown): FoirStepUp | null;
 export declare class FoirRequestError extends Error {
     /** HTTP status code, when the request failed at the HTTP layer. */
     readonly status?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {