@greensecurity/javascript-sdk 0.45.0-beta.16 → 0.45.0-beta.17

package/dist/esm/models/components/passwordrequiredresponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"passwordrequiredresponse.js","sourceRoot":"","sources":["../../../../src/models/components/passwordrequiredresponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AAenD,gBAAgB;AAChB,MAAM,CAAC,MAAM,sCAAsC,GAI/C,CAAC,CAAC,MAAM,CAAC;IACX,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;IACnC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;IACxB,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC,CAC9C,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAClE,sDAAsD,CACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"passwordrequiredresponse.js","sourceRoot":"","sources":["../../../../src/models/components/passwordrequiredresponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AAgDnD,gBAAgB;AAChB,MAAM,CAAC,MAAM,sCAAsC,GAI/C,CAAC,CAAC,MAAM,CAAC;IACX,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;IACnC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;IACxB,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;CAC1C,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,MAAM,CAAC,CAAC,EAAE;QACf,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC,CAC9C,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAClE,sDAAsD,CACvD,CAAC;AACJ,CAAC"}

package/dist/esm/models/components/samlloginrequiredresponse.d.ts

@@ -20,6 +20,39 @@ export type SamlLoginRequiredResponse = {
      * This is the URL that should be opened to initiate the SAML login flow
      */
     ssoUrl: string;
+    /**
+     * Opaque, signed state that Green Security issues when a third-party service
+     *
+     * @remarks
+     * provider starts a "Login with Green Security" SAML flow at
+     * `/saml/idp/sso`. The login screen receives it as the `sso_state` query
+     * string parameter and must pass it back, byte for byte, on every call to
+     * this endpoint for the remainder of the login journey — including the
+     * second call that carries an `mfa_code`.
+     *
+     * The blob is signed, not encrypted, and it expires five minutes after the
+     * service provider's request arrives. Do not parse it, shorten it, decode
+     * it, or re-encode it.
+     *
+     * **An invalid blob does not fail the login.** This is the opposite of what
+     * most integrators assume, so it is worth stating plainly: a forged, edited
+     * or expired `sso_state` is silently discarded, and the request then
+     * proceeds as an ordinary login. Valid credentials still authenticate and
+     * still return `200` — just with no `sso` object, leaving the user signed in
+     * to Green Security with no way back to the service provider that sent them.
+     * Never treat a `200` as proof that the SSO hand-off survived; check for
+     * `sso` explicitly.
+     *
+     * Every `202` response echoes the *verified* blob back in its own
+     * `sso_state` field. Always send back the value from the response you just
+     * received rather than the one you started with, so that a blob the server
+     * has already rejected is never resent, and so a client does not have to
+     * hold state of its own across the login journey.
+     *
+     * Omit this field entirely for an ordinary login that did not originate
+     * from a service provider.
+     */
+    ssoState?: string | undefined;
 };
 /** @internal */
 export declare const SamlLoginRequiredResponse$inboundSchema: z.ZodType<SamlLoginRequiredResponse, z.ZodTypeDef, unknown>;

package/dist/esm/models/components/samlloginrequiredresponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"samlloginrequiredresponse.d.ts","sourceRoot":"","sources":["../../../../src/models/components/samlloginrequiredresponse.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,uCAAuC,EAAE,CAAC,CAAC,OAAO,CAC7D,yBAAyB,EACzB,CAAC,CAAC,UAAU,EACZ,OAAO,CAYP,CAAC;AAEH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,yBAAyB,EAAE,kBAAkB,CAAC,CAMhE"}
+{"version":3,"file":"samlloginrequiredresponse.d.ts","sourceRoot":"","sources":["../../../../src/models/components/samlloginrequiredresponse.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,uCAAuC,EAAE,CAAC,CAAC,OAAO,CAC7D,yBAAyB,EACzB,CAAC,CAAC,UAAU,EACZ,OAAO,CAcP,CAAC;AAEH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,yBAAyB,EAAE,kBAAkB,CAAC,CAMhE"}

package/dist/esm/models/components/samlloginrequiredresponse.js

@@ -12,10 +12,12 @@ export const SamlLoginRequiredResponse$inboundSchema = z.object({
     error: types.string(),
     sso_instructions: types.optional(types.string()),
     sso_url: types.string(),
+    sso_state: types.optional(types.string()),
 }).transform((v) => {
     return remap$(v, {
         "sso_instructions": "ssoInstructions",
         "sso_url": "ssoUrl",
+        "sso_state": "ssoState",
     });
 });
 export function samlLoginRequiredResponseFromJSON(jsonString) {

package/dist/esm/models/components/samlloginrequiredresponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"samlloginrequiredresponse.js","sourceRoot":"","sources":["../../../../src/models/components/samlloginrequiredresponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AAwBnD,gBAAgB;AAChB,MAAM,CAAC,MAAM,uCAAuC,GAIhD,CAAC,CAAC,MAAM,CAAC;IACX,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;IACrC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;IACxB,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;IACrB,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAChD,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,MAAM,CAAC,CAAC,EAAE;QACf,kBAAkB,EAAE,iBAAiB;QACrC,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,iCAAiC,CAC/C,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,uCAAuC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACnE,uDAAuD,CACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"samlloginrequiredresponse.js","sourceRoot":"","sources":["../../../../src/models/components/samlloginrequiredresponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AAyDnD,gBAAgB;AAChB,MAAM,CAAC,MAAM,uCAAuC,GAIhD,CAAC,CAAC,MAAM,CAAC;IACX,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;IACrC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;IACxB,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;IACrB,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAChD,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;CAC1C,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,MAAM,CAAC,CAAC,EAAE;QACf,kBAAkB,EAAE,iBAAiB;QACrC,SAAS,EAAE,QAAQ;QACnB,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,iCAAiC,CAC/C,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,uCAAuC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACnE,uDAAuD,CACxD,CAAC;AACJ,CAAC"}

package/dist/esm/models/components/ssocontinuation.d.ts

@@ -0,0 +1,44 @@
+import * as z from "zod/v3";
+import { Result as SafeParseResult } from "../../types/fp.js";
+import { SDKValidationError } from "../errors/sdkvalidationerror.js";
+/**
+ * Where to send the browser to finish a "Login with Green Security" flow.
+ *
+ * @remarks
+ *
+ * Present on a `200` from `POST /users/authenticate` only when the request
+ * carried a valid, unexpired `sso_state`. Its absence means the login
+ * succeeded but the SAML flow did not resume — treat the login as an
+ * ordinary one rather than retrying.
+ *
+ * This object is additive. The login itself is unaffected by it: the
+ * caller's own permanent token is in `user_token` exactly as it would be on
+ * any other successful authentication, and it is not the token embedded in
+ * `continue_url`.
+ */
+export type SsoContinuation = {
+    /**
+     * An absolute, single-use URL on Green Security's domain. Navigate the
+     *
+     * @remarks
+     * browser to it (a full page navigation, not `fetch`); it answers with a
+     * self-submitting form that POSTs the signed `SAMLResponse` and the
+     * original `RelayState` to the service provider's assertion consumer
+     * service URL.
+     *
+     * The `token` in this URL is a separate **one-time** token that is
+     * consumed the first time the URL is followed, so the URL is good for
+     * exactly one navigation. It is not the caller's permanent token, which
+     * is returned unchanged in `user_token`. Treat the URL as a secret:
+     * whoever follows it first receives that user's assertion.
+     *
+     * Never fetch this URL from your own back end: the response is meant for
+     * the user's browser, and posting the assertion from anywhere else
+     * breaks the flow.
+     */
+    continueUrl: string;
+};
+/** @internal */
+export declare const SsoContinuation$inboundSchema: z.ZodType<SsoContinuation, z.ZodTypeDef, unknown>;
+export declare function ssoContinuationFromJSON(jsonString: string): SafeParseResult<SsoContinuation, SDKValidationError>;
+//# sourceMappingURL=ssocontinuation.d.ts.map

package/dist/esm/models/components/ssocontinuation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssocontinuation.d.ts","sourceRoot":"","sources":["../../../../src/models/components/ssocontinuation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;;;;;;;;;;;;;;;OAkBG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,OAAO,CACnD,eAAe,EACf,CAAC,CAAC,UAAU,EACZ,OAAO,CAOP,CAAC;AAEH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAMtD"}

package/dist/esm/models/components/ssocontinuation.js

@@ -0,0 +1,19 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as z from "zod/v3";
+import { remap as remap$ } from "../../lib/primitives.js";
+import { safeParse } from "../../lib/schemas.js";
+import * as types from "../../types/primitives.js";
+/** @internal */
+export const SsoContinuation$inboundSchema = z.object({
+    continue_url: types.string(),
+}).transform((v) => {
+    return remap$(v, {
+        "continue_url": "continueUrl",
+    });
+});
+export function ssoContinuationFromJSON(jsonString) {
+    return safeParse(jsonString, (x) => SsoContinuation$inboundSchema.parse(JSON.parse(x)), `Failed to parse 'SsoContinuation' from JSON`);
+}
+//# sourceMappingURL=ssocontinuation.js.map

package/dist/esm/models/components/ssocontinuation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssocontinuation.js","sourceRoot":"","sources":["../../../../src/models/components/ssocontinuation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AAyCnD,gBAAgB;AAChB,MAAM,CAAC,MAAM,6BAA6B,GAItC,CAAC,CAAC,MAAM,CAAC;IACX,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE;CAC7B,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,MAAM,CAAC,CAAC,EAAE;QACf,cAAc,EAAE,aAAa;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACzD,6CAA6C,CAC9C,CAAC;AACJ,CAAC"}

package/dist/esm/models/operations/postauthenticate.d.ts

@@ -10,7 +10,7 @@ export type PostAuthenticateRequestBody = components.LoginEmailAndPassword | com
  * The request has been accepted for processing, but the processing has not been completed. The request might be processed later.
  */
 export type PostAuthenticateResponseBody = components.MfaRequiredResponse | components.SamlLoginRequiredResponse | components.PasswordRequiredResponse | components.PasswordNotSetResponse;
-export type PostAuthenticateResponse = components.User | components.MfaRequiredResponse | components.SamlLoginRequiredResponse | components.PasswordRequiredResponse | components.PasswordNotSetResponse;
+export type PostAuthenticateResponse = components.AuthenticateSuccessResponse | components.MfaRequiredResponse | components.SamlLoginRequiredResponse | components.PasswordRequiredResponse | components.PasswordNotSetResponse;
 /** @internal */
 export type PostAuthenticateRequestBody$Outbound = components.LoginEmailAndPassword$Outbound | components.LoginRequirementsFromEmail$Outbound;
 /** @internal */

package/dist/esm/models/operations/postauthenticate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postauthenticate.d.ts","sourceRoot":"","sources":["../../../../src/models/operations/postauthenticate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,2BAA2B,GACnC,UAAU,CAAC,qBAAqB,GAChC,UAAU,CAAC,0BAA0B,CAAC;AAE1C;;GAEG;AACH,MAAM,MAAM,4BAA4B,GACpC,UAAU,CAAC,mBAAmB,GAC9B,UAAU,CAAC,yBAAyB,GACpC,UAAU,CAAC,wBAAwB,GACnC,UAAU,CAAC,sBAAsB,CAAC;AAEtC,MAAM,MAAM,wBAAwB,GAChC,UAAU,CAAC,IAAI,GACf,UAAU,CAAC,mBAAmB,GAC9B,UAAU,CAAC,yBAAyB,GACpC,UAAU,CAAC,wBAAwB,GACnC,UAAU,CAAC,sBAAsB,CAAC;AAEtC,gBAAgB;AAChB,MAAM,MAAM,oCAAoC,GAC5C,UAAU,CAAC,8BAA8B,GACzC,UAAU,CAAC,mCAAmC,CAAC;AAEnD,gBAAgB;AAChB,eAAO,MAAM,0CAA0C,EAAE,CAAC,CAAC,OAAO,CAChE,oCAAoC,EACpC,CAAC,CAAC,UAAU,EACZ,2BAA2B,CAI3B,CAAC;AAEH,wBAAgB,iCAAiC,CAC/C,2BAA2B,EAAE,2BAA2B,GACvD,MAAM,CAMR;AAED,gBAAgB;AAChB,eAAO,MAAM,0CAA0C,EAAE,CAAC,CAAC,OAAO,CAChE,4BAA4B,EAC5B,CAAC,CAAC,UAAU,EACZ,OAAO,CAMP,CAAC;AAEH,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,4BAA4B,EAAE,kBAAkB,CAAC,CAMnE;AAED,gBAAgB;AAChB,eAAO,MAAM,sCAAsC,EAAE,CAAC,CAAC,OAAO,CAC5D,wBAAwB,EACxB,CAAC,CAAC,UAAU,EACZ,OAAO,CASP,CAAC;AAEH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAM/D"}
+{"version":3,"file":"postauthenticate.d.ts","sourceRoot":"","sources":["../../../../src/models/operations/postauthenticate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;GAEG;AACH,MAAM,MAAM,2BAA2B,GACnC,UAAU,CAAC,qBAAqB,GAChC,UAAU,CAAC,0BAA0B,CAAC;AAE1C;;GAEG;AACH,MAAM,MAAM,4BAA4B,GACpC,UAAU,CAAC,mBAAmB,GAC9B,UAAU,CAAC,yBAAyB,GACpC,UAAU,CAAC,wBAAwB,GACnC,UAAU,CAAC,sBAAsB,CAAC;AAEtC,MAAM,MAAM,wBAAwB,GAChC,UAAU,CAAC,2BAA2B,GACtC,UAAU,CAAC,mBAAmB,GAC9B,UAAU,CAAC,yBAAyB,GACpC,UAAU,CAAC,wBAAwB,GACnC,UAAU,CAAC,sBAAsB,CAAC;AAEtC,gBAAgB;AAChB,MAAM,MAAM,oCAAoC,GAC5C,UAAU,CAAC,8BAA8B,GACzC,UAAU,CAAC,mCAAmC,CAAC;AAEnD,gBAAgB;AAChB,eAAO,MAAM,0CAA0C,EAAE,CAAC,CAAC,OAAO,CAChE,oCAAoC,EACpC,CAAC,CAAC,UAAU,EACZ,2BAA2B,CAI3B,CAAC;AAEH,wBAAgB,iCAAiC,CAC/C,2BAA2B,EAAE,2BAA2B,GACvD,MAAM,CAMR;AAED,gBAAgB;AAChB,eAAO,MAAM,0CAA0C,EAAE,CAAC,CAAC,OAAO,CAChE,4BAA4B,EAC5B,CAAC,CAAC,UAAU,EACZ,OAAO,CAMP,CAAC;AAEH,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,4BAA4B,EAAE,kBAAkB,CAAC,CAMnE;AAED,gBAAgB;AAChB,eAAO,MAAM,sCAAsC,EAAE,CAAC,CAAC,OAAO,CAC5D,wBAAwB,EACxB,CAAC,CAAC,UAAU,EACZ,OAAO,CASP,CAAC;AAEH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,GACjB,eAAe,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAM/D"}

package/dist/esm/models/operations/postauthenticate.js

@@ -25,7 +25,7 @@ export function postAuthenticateResponseBodyFromJSON(jsonString) {
 }
 /** @internal */
 export const PostAuthenticateResponse$inboundSchema = smartUnion([
-    components.User$inboundSchema,
+    components.AuthenticateSuccessResponse$inboundSchema,
     z.union([
         components.MfaRequiredResponse$inboundSchema,
         components.SamlLoginRequiredResponse$inboundSchema,

package/dist/esm/models/operations/postauthenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"postauthenticate.js","sourceRoot":"","sources":["../../../../src/models/operations/postauthenticate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AA+BrD,gBAAgB;AAChB,MAAM,CAAC,MAAM,0CAA0C,GAInD,UAAU,CAAC;IACb,UAAU,CAAC,oCAAoC;IAC/C,UAAU,CAAC,yCAAyC;CACrD,CAAC,CAAC;AAEH,MAAM,UAAU,iCAAiC,CAC/C,2BAAwD;IAExD,OAAO,IAAI,CAAC,SAAS,CACnB,0CAA0C,CAAC,KAAK,CAC9C,2BAA2B,CAC5B,CACF,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,0CAA0C,GAInD,CAAC,CAAC,KAAK,CAAC;IACV,UAAU,CAAC,iCAAiC;IAC5C,UAAU,CAAC,uCAAuC;IAClD,UAAU,CAAC,sCAAsC;IACjD,UAAU,CAAC,oCAAoC;CAChD,CAAC,CAAC;AAEH,MAAM,UAAU,oCAAoC,CAClD,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACtE,0DAA0D,CAC3D,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,sCAAsC,GAI/C,UAAU,CAAC;IACb,UAAU,CAAC,kBAAkB;IAC7B,CAAC,CAAC,KAAK,CAAC;QACN,UAAU,CAAC,iCAAiC;QAC5C,UAAU,CAAC,uCAAuC;QAClD,UAAU,CAAC,sCAAsC;QACjD,UAAU,CAAC,oCAAoC;KAChD,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC,CAC9C,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAClE,sDAAsD,CACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"postauthenticate.js","sourceRoot":"","sources":["../../../../src/models/operations/postauthenticate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AA+BrD,gBAAgB;AAChB,MAAM,CAAC,MAAM,0CAA0C,GAInD,UAAU,CAAC;IACb,UAAU,CAAC,oCAAoC;IAC/C,UAAU,CAAC,yCAAyC;CACrD,CAAC,CAAC;AAEH,MAAM,UAAU,iCAAiC,CAC/C,2BAAwD;IAExD,OAAO,IAAI,CAAC,SAAS,CACnB,0CAA0C,CAAC,KAAK,CAC9C,2BAA2B,CAC5B,CACF,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,0CAA0C,GAInD,CAAC,CAAC,KAAK,CAAC;IACV,UAAU,CAAC,iCAAiC;IAC5C,UAAU,CAAC,uCAAuC;IAClD,UAAU,CAAC,sCAAsC;IACjD,UAAU,CAAC,oCAAoC;CAChD,CAAC,CAAC;AAEH,MAAM,UAAU,oCAAoC,CAClD,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACtE,0DAA0D,CAC3D,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,sCAAsC,GAI/C,UAAU,CAAC;IACb,UAAU,CAAC,yCAAyC;IACpD,CAAC,CAAC,KAAK,CAAC;QACN,UAAU,CAAC,iCAAiC;QAC5C,UAAU,CAAC,uCAAuC;QAClD,UAAU,CAAC,sCAAsC;QACjD,UAAU,CAAC,oCAAoC;KAChD,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC,CAC9C,UAAkB;IAElB,OAAO,SAAS,CACd,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAClE,sDAAsD,CACvD,CAAC;AACJ,CAAC"}

package/dist/esm/react-query/usersPostAuthenticate.d.ts

@@ -49,6 +49,43 @@ export type UsersPostAuthenticateMutationError = errors.ApiErrorResponse | Green
  * 3. Site redirects to your selected `return_url`
  * 4. The `user_token` will be appended as a query string parameter to your `return_url` - you must parse this token and store it
  * 5. Fetch the user object from `/users/me` using the token
+ *
+ * ## Finishing a "Login with Green Security" flow
+ *
+ * Green Security is also a SAML2 **identity provider**. When a third-party service provider sends a user to
+ * `/saml/idp/sso` to sign in with their Green Security account, the user lands on a Green Security login screen
+ * carrying an `sso_state` query string parameter. That parameter is a signed, five-minute record of which service
+ * provider is waiting, where its assertion consumer service lives, and what `RelayState` it sent.
+ *
+ * Authentication itself is unchanged - the user may still need a password, an MFA code, a magic link or a round trip
+ * to their own SAML IdP, and every `requires` value above applies as normal. The only difference is that you must
+ * echo `sso_state` back on **every** call in the sequence, unchanged, including the follow-up that carries the
+ * `mfa_code`.
+ *
+ * Each `202` response carries the verified blob back to you in its own top-level `sso_state` field. Send back the
+ * value from the response you just received rather than the one you started with. The two are normally the same
+ * string, but re-sending your original copy is how a blob the server has already rejected gets resent, and it forces
+ * you to hold login state you would otherwise not need.
+ *
+ * 1. Read `sso_state` from the query string of the login screen you were sent to
+ * 2. Run the login exactly as you would otherwise, adding `sso_state` to each request body and taking the value for
+ *    the next request from the previous `202` response
+ * 3. On the `200` response, read `sso.continue_url`
+ * 4. Navigate the browser to `sso.continue_url` - a full page navigation, not a background fetch. It answers with a
+ *    self-submitting form that delivers the signed `SAMLResponse` and the original `RelayState` to the service
+ *    provider
+ * 5. The service provider validates the assertion and the user is signed in on their side
+ *
+ * On the `password_reset` leg the blob is **also** appended to `redirect_url` as a query parameter, alongside
+ * `return_url`. The browser follows that redirect and leaves the JSON body behind, so anything the remaining legs of
+ * the login still need has to ride the URL. Preserve the query string exactly as given.
+ *
+ * An invalid `sso_state` never fails a login. A forged, edited or expired blob is silently dropped and the request is
+ * then treated as an ordinary login, so valid credentials still return `200` - just with no `sso` object. Check for
+ * `sso` explicitly rather than reading `200` as proof the hand-off survived. When it is absent, do not retry with the
+ * same blob; the user has to start again from the service provider. See the
+ * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
+ * guide for the service provider half of this flow.
  */
 export declare function useUsersPostAuthenticateMutation(options?: MutationHookOptions<UsersPostAuthenticateMutationData, UsersPostAuthenticateMutationError, UsersPostAuthenticateMutationVariables>): UseMutationResult<UsersPostAuthenticateMutationData, UsersPostAuthenticateMutationError, UsersPostAuthenticateMutationVariables>;
 export declare function mutationKeyUsersPostAuthenticate(): MutationKey;

package/dist/esm/react-query/usersPostAuthenticate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usersPostAuthenticate.d.ts","sourceRoot":"","sources":["../../../src/react-query/usersPostAuthenticate.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAEX,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,sCAAsC,GAAG;IACnD,OAAO,EAAE,UAAU,CAAC,2BAA2B,CAAC;IAChD,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAC3C,UAAU,CAAC,wBAAwB,CAAC;AAEtC,MAAM,MAAM,kCAAkC,GAC1C,MAAM,CAAC,gBAAgB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,CAAC,EAAE,mBAAmB,CAC3B,iCAAiC,EACjC,kCAAkC,EAClC,sCAAsC,CACvC,GACA,iBAAiB,CAClB,iCAAiC,EACjC,kCAAkC,EAClC,sCAAsC,CACvC,CAMA;AAED,wBAAgB,gCAAgC,IAAI,WAAW,CAE9D;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,cAAc,GAC3B;IACD,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,CACV,SAAS,EAAE,sCAAsC,KAC9C,OAAO,CAAC,iCAAiC,CAAC,CAAC;CACjD,CA0BA"}
+{"version":3,"file":"usersPostAuthenticate.d.ts","sourceRoot":"","sources":["../../../src/react-query/usersPostAuthenticate.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAEX,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,sCAAsC,GAAG;IACnD,OAAO,EAAE,UAAU,CAAC,2BAA2B,CAAC;IAChD,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAC3C,UAAU,CAAC,wBAAwB,CAAC;AAEtC,MAAM,MAAM,kCAAkC,GAC1C,MAAM,CAAC,gBAAgB,GACvB,kBAAkB,GAClB,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,CAAC,EAAE,mBAAmB,CAC3B,iCAAiC,EACjC,kCAAkC,EAClC,sCAAsC,CACvC,GACA,iBAAiB,CAClB,iCAAiC,EACjC,kCAAkC,EAClC,sCAAsC,CACvC,CAMA;AAED,wBAAgB,gCAAgC,IAAI,WAAW,CAE9D;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,cAAc,GAC3B;IACD,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,EAAE,CACV,SAAS,EAAE,sCAAsC,KAC9C,OAAO,CAAC,iCAAiC,CAAC,CAAC;CACjD,CA0BA"}

package/dist/esm/react-query/usersPostAuthenticate.js

@@ -41,6 +41,43 @@ import { useGreenSecurityContext } from "./_context.js";
  * 3. Site redirects to your selected `return_url`
  * 4. The `user_token` will be appended as a query string parameter to your `return_url` - you must parse this token and store it
  * 5. Fetch the user object from `/users/me` using the token
+ *
+ * ## Finishing a "Login with Green Security" flow
+ *
+ * Green Security is also a SAML2 **identity provider**. When a third-party service provider sends a user to
+ * `/saml/idp/sso` to sign in with their Green Security account, the user lands on a Green Security login screen
+ * carrying an `sso_state` query string parameter. That parameter is a signed, five-minute record of which service
+ * provider is waiting, where its assertion consumer service lives, and what `RelayState` it sent.
+ *
+ * Authentication itself is unchanged - the user may still need a password, an MFA code, a magic link or a round trip
+ * to their own SAML IdP, and every `requires` value above applies as normal. The only difference is that you must
+ * echo `sso_state` back on **every** call in the sequence, unchanged, including the follow-up that carries the
+ * `mfa_code`.
+ *
+ * Each `202` response carries the verified blob back to you in its own top-level `sso_state` field. Send back the
+ * value from the response you just received rather than the one you started with. The two are normally the same
+ * string, but re-sending your original copy is how a blob the server has already rejected gets resent, and it forces
+ * you to hold login state you would otherwise not need.
+ *
+ * 1. Read `sso_state` from the query string of the login screen you were sent to
+ * 2. Run the login exactly as you would otherwise, adding `sso_state` to each request body and taking the value for
+ *    the next request from the previous `202` response
+ * 3. On the `200` response, read `sso.continue_url`
+ * 4. Navigate the browser to `sso.continue_url` - a full page navigation, not a background fetch. It answers with a
+ *    self-submitting form that delivers the signed `SAMLResponse` and the original `RelayState` to the service
+ *    provider
+ * 5. The service provider validates the assertion and the user is signed in on their side
+ *
+ * On the `password_reset` leg the blob is **also** appended to `redirect_url` as a query parameter, alongside
+ * `return_url`. The browser follows that redirect and leaves the JSON body behind, so anything the remaining legs of
+ * the login still need has to ride the URL. Preserve the query string exactly as given.
+ *
+ * An invalid `sso_state` never fails a login. A forged, edited or expired blob is silently dropped and the request is
+ * then treated as an ordinary login, so valid credentials still return `200` - just with no `sso` object. Check for
+ * `sso` explicitly rather than reading `200` as proof the hand-off survived. When it is absent, do not retry with the
+ * same blob; the user has to start again from the service provider. See the
+ * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
+ * guide for the service provider half of this flow.
  */
 export function useUsersPostAuthenticateMutation(options) {
     const client = useGreenSecurityContext();

package/dist/esm/react-query/usersPostAuthenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"usersPostAuthenticate.js","sourceRoot":"","sources":["../../../src/react-query/usersPostAuthenticate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AActD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAsBxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAIC;IAMD,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;IACzC,OAAO,WAAW,CAAC;QACjB,GAAG,kCAAkC,CAAC,MAAM,EAAE,OAAO,CAAC;QACtD,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CAAC,+BAA+B,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAA0B,EAC1B,WAA4B;IAO5B,OAAO;QACL,WAAW,EAAE,gCAAgC,EAAE;QAC/C,UAAU,EAAE,SAAS,+BAA+B,CAAC,EACnD,OAAO,EACP,OAAO,GACR;YACC,MAAM,aAAa,GAAG;gBACpB,GAAG,WAAW;gBACd,GAAG,OAAO;gBACV,YAAY,EAAE;oBACZ,GAAG,WAAW,EAAE,YAAY;oBAC5B,GAAG,OAAO,EAAE,YAAY;oBACxB,MAAM,EAAE,cAAc,CACpB,WAAW,EAAE,YAAY,EAAE,MAAM,EACjC,OAAO,EAAE,YAAY,EAAE,MAAM,CAC9B;iBACF;aACF,CAAC;YACF,OAAO,WAAW,CAAC,qBAAqB,CACtC,OAAO,EACP,OAAO,EACP,aAAa,CACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"usersPostAuthenticate.js","sourceRoot":"","sources":["../../../src/react-query/usersPostAuthenticate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AActD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAsBxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAIC;IAMD,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;IACzC,OAAO,WAAW,CAAC;QACjB,GAAG,kCAAkC,CAAC,MAAM,EAAE,OAAO,CAAC;QACtD,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CAAC,+BAA+B,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAA0B,EAC1B,WAA4B;IAO5B,OAAO;QACL,WAAW,EAAE,gCAAgC,EAAE;QAC/C,UAAU,EAAE,SAAS,+BAA+B,CAAC,EACnD,OAAO,EACP,OAAO,GACR;YACC,MAAM,aAAa,GAAG;gBACpB,GAAG,WAAW;gBACd,GAAG,OAAO;gBACV,YAAY,EAAE;oBACZ,GAAG,WAAW,EAAE,YAAY;oBAC5B,GAAG,OAAO,EAAE,YAAY;oBACxB,MAAM,EAAE,cAAc,CACpB,WAAW,EAAE,YAAY,EAAE,MAAM,EACjC,OAAO,EAAE,YAAY,EAAE,MAAM,CAC9B;iBACF;aACF,CAAC;YACF,OAAO,WAAW,CAAC,qBAAqB,CACtC,OAAO,EACP,OAAO,EACP,aAAa,CACd,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/sdk/users.d.ts

@@ -100,6 +100,43 @@ export declare class Users extends ClientSDK {
      * 3. Site redirects to your selected `return_url`
      * 4. The `user_token` will be appended as a query string parameter to your `return_url` - you must parse this token and store it
      * 5. Fetch the user object from `/users/me` using the token
+     *
+     * ## Finishing a "Login with Green Security" flow
+     *
+     * Green Security is also a SAML2 **identity provider**. When a third-party service provider sends a user to
+     * `/saml/idp/sso` to sign in with their Green Security account, the user lands on a Green Security login screen
+     * carrying an `sso_state` query string parameter. That parameter is a signed, five-minute record of which service
+     * provider is waiting, where its assertion consumer service lives, and what `RelayState` it sent.
+     *
+     * Authentication itself is unchanged - the user may still need a password, an MFA code, a magic link or a round trip
+     * to their own SAML IdP, and every `requires` value above applies as normal. The only difference is that you must
+     * echo `sso_state` back on **every** call in the sequence, unchanged, including the follow-up that carries the
+     * `mfa_code`.
+     *
+     * Each `202` response carries the verified blob back to you in its own top-level `sso_state` field. Send back the
+     * value from the response you just received rather than the one you started with. The two are normally the same
+     * string, but re-sending your original copy is how a blob the server has already rejected gets resent, and it forces
+     * you to hold login state you would otherwise not need.
+     *
+     * 1. Read `sso_state` from the query string of the login screen you were sent to
+     * 2. Run the login exactly as you would otherwise, adding `sso_state` to each request body and taking the value for
+     *    the next request from the previous `202` response
+     * 3. On the `200` response, read `sso.continue_url`
+     * 4. Navigate the browser to `sso.continue_url` - a full page navigation, not a background fetch. It answers with a
+     *    self-submitting form that delivers the signed `SAMLResponse` and the original `RelayState` to the service
+     *    provider
+     * 5. The service provider validates the assertion and the user is signed in on their side
+     *
+     * On the `password_reset` leg the blob is **also** appended to `redirect_url` as a query parameter, alongside
+     * `return_url`. The browser follows that redirect and leaves the JSON body behind, so anything the remaining legs of
+     * the login still need has to ride the URL. Preserve the query string exactly as given.
+     *
+     * An invalid `sso_state` never fails a login. A forged, edited or expired blob is silently dropped and the request is
+     * then treated as an ordinary login, so valid credentials still return `200` - just with no `sso` object. Check for
+     * `sso` explicitly rather than reading `200` as proof the hand-off survived. When it is absent, do not retry with the
+     * same blob; the user has to start again from the service provider. See the
+     * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
+     * guide for the service provider half of this flow.
      */
     postAuthenticate(request: operations.PostAuthenticateRequestBody, options?: RequestOptions): Promise<operations.PostAuthenticateResponse>;
     /**

package/dist/esm/sdk/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/sdk/users.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,KAAM,SAAQ,SAAS;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAQ3B;;;;;;;;;;;;;OAaG;IACG,WAAW,CACf,OAAO,EAAE,UAAU,CAAC,kBAAkB,EACtC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,UAAU,CACd,OAAO,EAAE,UAAU,CAAC,iBAAiB,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;IAQ7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACG,gBAAgB,CACpB,OAAO,EAAE,UAAU,CAAC,2BAA2B,EAC/C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;IAQ/C;;;;;OAKG;IACG,YAAY,CAChB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC;IAOjD;;;;;;;;;;;;OAYG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,aAAa,CACjB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,SAAS,CACb,OAAO,EAAE,UAAU,CAAC,oBAAoB,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;IAQ3C;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,0CAA0C,CAAC;IAQjE;;;;;;OAMG;IACG,QAAQ,CACZ,OAAO,EAAE,UAAU,CAAC,mBAAmB,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;IAQzC;;;;;OAKG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,kDAAkD,CAAC;CAO1E"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/sdk/users.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,KAAM,SAAQ,SAAS;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAQ3B;;;;;;;;;;;;;OAaG;IACG,WAAW,CACf,OAAO,EAAE,UAAU,CAAC,kBAAkB,EACtC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,UAAU,CACd,OAAO,EAAE,UAAU,CAAC,iBAAiB,EACrC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;IAQ7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwEG;IACG,gBAAgB,CACpB,OAAO,EAAE,UAAU,CAAC,2BAA2B,EAC/C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC;IAQ/C;;;;;OAKG;IACG,YAAY,CAChB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC;IAOjD;;;;;;;;;;;;OAYG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,aAAa,CACjB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,SAAS,CACb,OAAO,EAAE,UAAU,CAAC,oBAAoB,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;IAQ3C;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,0CAA0C,CAAC;IAQjE;;;;;;OAMG;IACG,QAAQ,CACZ,OAAO,EAAE,UAAU,CAAC,mBAAmB,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;IAQzC;;;;;OAKG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,kDAAkD,CAAC;CAO1E"}

package/dist/esm/sdk/users.js

@@ -120,6 +120,43 @@ export class Users extends ClientSDK {
      * 3. Site redirects to your selected `return_url`
      * 4. The `user_token` will be appended as a query string parameter to your `return_url` - you must parse this token and store it
      * 5. Fetch the user object from `/users/me` using the token
+     *
+     * ## Finishing a "Login with Green Security" flow
+     *
+     * Green Security is also a SAML2 **identity provider**. When a third-party service provider sends a user to
+     * `/saml/idp/sso` to sign in with their Green Security account, the user lands on a Green Security login screen
+     * carrying an `sso_state` query string parameter. That parameter is a signed, five-minute record of which service
+     * provider is waiting, where its assertion consumer service lives, and what `RelayState` it sent.
+     *
+     * Authentication itself is unchanged - the user may still need a password, an MFA code, a magic link or a round trip
+     * to their own SAML IdP, and every `requires` value above applies as normal. The only difference is that you must
+     * echo `sso_state` back on **every** call in the sequence, unchanged, including the follow-up that carries the
+     * `mfa_code`.
+     *
+     * Each `202` response carries the verified blob back to you in its own top-level `sso_state` field. Send back the
+     * value from the response you just received rather than the one you started with. The two are normally the same
+     * string, but re-sending your original copy is how a blob the server has already rejected gets resent, and it forces
+     * you to hold login state you would otherwise not need.
+     *
+     * 1. Read `sso_state` from the query string of the login screen you were sent to
+     * 2. Run the login exactly as you would otherwise, adding `sso_state` to each request body and taking the value for
+     *    the next request from the previous `202` response
+     * 3. On the `200` response, read `sso.continue_url`
+     * 4. Navigate the browser to `sso.continue_url` - a full page navigation, not a background fetch. It answers with a
+     *    self-submitting form that delivers the signed `SAMLResponse` and the original `RelayState` to the service
+     *    provider
+     * 5. The service provider validates the assertion and the user is signed in on their side
+     *
+     * On the `password_reset` leg the blob is **also** appended to `redirect_url` as a query parameter, alongside
+     * `return_url`. The browser follows that redirect and leaves the JSON body behind, so anything the remaining legs of
+     * the login still need has to ride the URL. Preserve the query string exactly as given.
+     *
+     * An invalid `sso_state` never fails a login. A forged, edited or expired blob is silently dropped and the request is
+     * then treated as an ordinary login, so valid credentials still return `200` - just with no `sso` object. Check for
+     * `sso` explicitly rather than reading `200` as proof the hand-off survived. When it is absent, do not retry with the
+     * same blob; the user has to start again from the service provider. See the
+     * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
+     * guide for the service provider half of this flow.
      */
     async postAuthenticate(request, options) {
         return unwrapAsync(usersPostAuthenticate(this, request, options));

package/dist/esm/sdk/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../src/sdk/users.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAG3D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,OAAO,KAAM,SAAQ,SAAS;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,WAAW,CACf,OAAsC,EACtC,OAAwB;QAExB,OAAO,WAAW,CAAC,gBAAgB,CACjC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,UAAU,CACd,OAAqC,EACrC,OAAwB;QAExB,OAAO,WAAW,CAAC,eAAe,CAChC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAA+C,EAC/C,OAAwB;QAExB,OAAO,WAAW,CAAC,qBAAqB,CACtC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,OAAwB;QAExB,OAAO,WAAW,CAAC,iBAAiB,CAClC,IAAI,EACJ,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,OAA4C,EAC5C,OAAwB;QAExB,OAAO,WAAW,CAAC,kBAAkB,CACnC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACb,OAAwC,EACxC,OAAwB;QAExB,OAAO,WAAW,CAAC,cAAc,CAC/B,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAmD,EACnD,OAAwB;QAExB,OAAO,WAAW,CAAC,yBAAyB,CAC1C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAuC,EACvC,OAAwB;QAExB,OAAO,WAAW,CAAC,aAAa,CAC9B,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAAmD,EACnD,OAAwB;QAExB,OAAO,WAAW,CAAC,6BAA6B,CAC9C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../src/sdk/users.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAG3D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,OAAO,KAAM,SAAQ,SAAS;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,WAAW,CACf,OAAsC,EACtC,OAAwB;QAExB,OAAO,WAAW,CAAC,gBAAgB,CACjC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,UAAU,CACd,OAAqC,EACrC,OAAwB;QAExB,OAAO,WAAW,CAAC,eAAe,CAChC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAA+C,EAC/C,OAAwB;QAExB,OAAO,WAAW,CAAC,qBAAqB,CACtC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,OAAwB;QAExB,OAAO,WAAW,CAAC,iBAAiB,CAClC,IAAI,EACJ,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,OAA4C,EAC5C,OAAwB;QAExB,OAAO,WAAW,CAAC,kBAAkB,CACnC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CACb,OAAwC,EACxC,OAAwB;QAExB,OAAO,WAAW,CAAC,cAAc,CAC/B,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAmD,EACnD,OAAwB;QAExB,OAAO,WAAW,CAAC,yBAAyB,CAC1C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAuC,EACvC,OAAwB;QAExB,OAAO,WAAW,CAAC,aAAa,CAC9B,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,OAAyC,EACzC,OAAwB;QAExB,OAAO,WAAW,CAAC,mBAAmB,CACpC,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAAmD,EACnD,OAAwB;QAExB,OAAO,WAAW,CAAC,6BAA6B,CAC9C,IAAI,EACJ,OAAO,EACP,OAAO,CACR,CAAC,CAAC;IACL,CAAC;CACF"}

package/jsr.json

@@ -2,7 +2,7 @@
 
 {
   "name": "@greensecurity/javascript-sdk",
-  "version": "0.45.0-beta.16",
+  "version": "0.45.0-beta.17",
   "exports": {
     ".": "./src/index.ts",    
     "./models/errors": "./src/models/errors/index.ts",    

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@greensecurity/javascript-sdk",
-  "version": "0.45.0-beta.16",
+  "version": "0.45.0-beta.17",
   "author": "Green Security LLC",
   "type": "module",
   "tshy": {

package/src/__tests__/vendors.test.ts

@@ -121,7 +121,7 @@ test("Vendors List Vendor Credits", async () => {
       page: 1,
       useUrlParams: false,
     },
-    creditBalance: 6030.32,
+    creditBalance: 473.87,
   });
 });
 

package/src/__tests__/webhooks.test.ts

@@ -20,7 +20,7 @@ test("Webhooks List All Webhook Endpoints", async () => {
   const testWebhookListForVendorUserResult = await greenSecurity.webhooks
     .listAllWebhookEndpoints({
       itemsPerPage: 25,
-      desc: true,
+      desc: 0,
       sort: "",
     });
   expect(testWebhookListForVendorUserResult).toBeDefined();

package/src/__tests__/zones.test.ts

@@ -39,14 +39,7 @@ test("Zones List Or Search Security Zones", async () => {
         facility: {},
       },
       {
-        facility: {
-          contacts: null,
-          vendorGuestPolicy: {
-            enabled: true,
-            vendorGuestLimitAndOr: "and",
-            vendorGuestRequireEmail: false,
-          },
-        },
+        facility: {},
       },
     ],
   });
@@ -65,7 +58,7 @@ test("Zones Security Zone Checkin", async () => {
 
   const result = await greenSecurity.zones.securityZoneCheckin({
     qrCode: "<value>",
-    zoneId: 679291,
+    zoneId: 997849,
   });
   expect(result).toBeDefined();
   expect(result).toEqual({});

package/src/funcs/usersPostAuthenticate.ts

@@ -60,6 +60,43 @@ import { Result } from "../types/fp.js";
  * 3. Site redirects to your selected `return_url`
  * 4. The `user_token` will be appended as a query string parameter to your `return_url` - you must parse this token and store it
  * 5. Fetch the user object from `/users/me` using the token
+ *
+ * ## Finishing a "Login with Green Security" flow
+ *
+ * Green Security is also a SAML2 **identity provider**. When a third-party service provider sends a user to
+ * `/saml/idp/sso` to sign in with their Green Security account, the user lands on a Green Security login screen
+ * carrying an `sso_state` query string parameter. That parameter is a signed, five-minute record of which service
+ * provider is waiting, where its assertion consumer service lives, and what `RelayState` it sent.
+ *
+ * Authentication itself is unchanged - the user may still need a password, an MFA code, a magic link or a round trip
+ * to their own SAML IdP, and every `requires` value above applies as normal. The only difference is that you must
+ * echo `sso_state` back on **every** call in the sequence, unchanged, including the follow-up that carries the
+ * `mfa_code`.
+ *
+ * Each `202` response carries the verified blob back to you in its own top-level `sso_state` field. Send back the
+ * value from the response you just received rather than the one you started with. The two are normally the same
+ * string, but re-sending your original copy is how a blob the server has already rejected gets resent, and it forces
+ * you to hold login state you would otherwise not need.
+ *
+ * 1. Read `sso_state` from the query string of the login screen you were sent to
+ * 2. Run the login exactly as you would otherwise, adding `sso_state` to each request body and taking the value for
+ *    the next request from the previous `202` response
+ * 3. On the `200` response, read `sso.continue_url`
+ * 4. Navigate the browser to `sso.continue_url` - a full page navigation, not a background fetch. It answers with a
+ *    self-submitting form that delivers the signed `SAMLResponse` and the original `RelayState` to the service
+ *    provider
+ * 5. The service provider validates the assertion and the user is signed in on their side
+ *
+ * On the `password_reset` leg the blob is **also** appended to `redirect_url` as a query parameter, alongside
+ * `return_url`. The browser follows that redirect and leaves the JSON body behind, so anything the remaining legs of
+ * the login still need has to ride the URL. Preserve the query string exactly as given.
+ *
+ * An invalid `sso_state` never fails a login. A forged, edited or expired blob is silently dropped and the request is
+ * then treated as an ordinary login, so valid credentials still return `200` - just with no `sso` object. Check for
+ * `sso` explicitly rather than reading `200` as proof the hand-off survived. When it is absent, do not retry with the
+ * same blob; the user has to start again from the service provider. See the
+ * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
+ * guide for the service provider half of this flow.
  */
 export function usersPostAuthenticate(
   client: GreenSecurityCore,

package/src/lib/config.ts

@@ -80,8 +80,8 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "0.45.0",
-  sdkVersion: "0.45.0-beta.16",
+  sdkVersion: "0.45.0-beta.17",
   genVersion: "2.935.1",
   userAgent:
-    "speakeasy-sdk/typescript 0.45.0-beta.16 2.935.1 0.45.0 @greensecurity/javascript-sdk",
+    "speakeasy-sdk/typescript 0.45.0-beta.17 2.935.1 0.45.0 @greensecurity/javascript-sdk",
 } as const;