@sixb/core 0.1.13 → 0.1.14

package/dist/webhooks/internal.js

@@ -10,9 +10,9 @@ import {
 } from "../chunk-cbn96bve.js";
 import"../chunk-xgptywp0.js";
 import"../chunk-fc5zfxy1.js";
-import"../chunk-9pfw47qx.js";
+import"../chunk-6rzb1g6h.js";
 import"../chunk-drz59ve0.js";
-import"../chunk-0321g649.js";
+import"../chunk-2jntasmh.js";
 import"../chunk-pqajwytd.js";
 import"../chunk-ky7zpbtt.js";
 import"../chunk-gfdh9kqa.js";
@@ -21,7 +21,7 @@ import"../chunk-69266efg.js";
 import"../chunk-xnx96gfy.js";
 import"../chunk-jgwb25gc.js";
 import"../chunk-h89wz928.js";
-import"../chunk-n33e8dz8.js";
+import"../chunk-3a338wrp.js";
 import {
   ExecutionStorageError2
 } from "../chunk-tw03bsmb.js";
@@ -29,7 +29,7 @@ import"../chunk-3nx8vj5a.js";
 import"../chunk-ht4a7mjg.js";
 import {
   canRetryWebhookRun2
-} from "../chunk-gc226ten.js";
+} from "../chunk-3fpgxpsq.js";
 import"../chunk-7ytf06d3.js";
 import"../chunk-mr60an99.js";
 import"../chunk-mmagke4x.js";
@@ -39,7 +39,7 @@ import"../chunk-jmfet9r4.js";
 import {
   WebhookRunError2
 } from "../chunk-qf954wje.js";
-import"../chunk-darm7eeg.js";
+import"../chunk-gct3m1da.js";
 import {
   isOAuthConnectorDefinition2,
   isStaticConnectorDefinition2

package/dist/workflows/index.js

@@ -8,7 +8,7 @@ import {
   defineWorkflow2,
   createWorkflowNodeFailure2,
   unwrapWorkflowNodeFailure2
-} from "../chunk-s24qbp32.js";
+} from "../chunk-wn7mznxc.js";
 import"../chunk-e1c18xjx.js";
 import"../chunk-fb3feg1e.js";
 import"../chunk-dfm066qg.js";
@@ -45,31 +45,31 @@ import {
   snapshotWorkflowActionInput2,
   WorkflowRunDispatcher2,
   requestWorkflowRun2
-} from "../chunk-cvrbhvtr.js";
-import"../chunk-a69fkrtr.js";
+} from "../chunk-16jenmzw.js";
+import"../chunk-q2xghyft.js";
 import"../chunk-cbn96bve.js";
-import"../chunk-bep5rrdq.js";
-import"../chunk-gmt22nxx.js";
-import"../chunk-91wthfwe.js";
+import"../chunk-ww185kt6.js";
+import"../chunk-4ypbe95r.js";
+import"../chunk-hxgj4kzd.js";
 import"../chunk-85cd7e8c.js";
-import"../chunk-w9bp61e7.js";
+import"../chunk-jfdggg1p.js";
 import"../chunk-bxx3ms5t.js";
-import"../chunk-04h4t2b5.js";
+import"../chunk-kxea54yg.js";
 import"../chunk-f85hpqnm.js";
 import"../chunk-4tnrzqqh.js";
 import"../chunk-5a4a52tq.js";
 import"../chunk-91kcnbf0.js";
 import"../chunk-rb143ggb.js";
 import"../chunk-cd234ba4.js";
-import"../chunk-693f3zn8.js";
-import"../chunk-63fp9x3q.js";
-import"../chunk-898y24dd.js";
-import"../chunk-rqtdtm43.js";
+import"../chunk-dv4ct8mp.js";
+import"../chunk-pvgpckm1.js";
+import"../chunk-728fp090.js";
+import"../chunk-00pfcqh4.js";
 import"../chunk-m8zkvep1.js";
-import"../chunk-gc226ten.js";
+import"../chunk-3fpgxpsq.js";
 import"../chunk-jmfet9r4.js";
 import"../chunk-qf954wje.js";
-import"../chunk-darm7eeg.js";
+import"../chunk-gct3m1da.js";
 import"../chunk-zdkcdshk.js";
 import"../chunk-ht4a7mjg.js";
 import"../chunk-mr60an99.js";
@@ -83,7 +83,7 @@ import"../chunk-xnx96gfy.js";
 import"../chunk-s3csryxe.js";
 import"../chunk-jgwb25gc.js";
 import"../chunk-tw03bsmb.js";
-import"../chunk-n33e8dz8.js";
+import"../chunk-3a338wrp.js";
 import"../chunk-h89wz928.js";
 import"../chunk-xgptywp0.js";
 import"../chunk-ky7zpbtt.js";
@@ -97,7 +97,7 @@ import"../chunk-gfdh9kqa.js";
 import"../chunk-wr8qp979.js";
 import"../chunk-dmn70ztd.js";
 import"../chunk-vn3yh259.js";
-import"../chunk-9pfw47qx.js";
+import"../chunk-6rzb1g6h.js";
 import"../chunk-2fv8sajb.js";
 import"../chunk-drz59ve0.js";
 import"../chunk-rzcjp5m2.js";
@@ -105,7 +105,7 @@ import"../chunk-v4jbb3rs.js";
 import"../chunk-d8yes9yx.js";
 import"../chunk-rzkr70gr.js";
 import"../chunk-z3y5kg1x.js";
-import"../chunk-0321g649.js";
+import"../chunk-2jntasmh.js";
 export {
   WorkflowDefinitionError2 as WorkflowDefinitionError,
   WorkflowRunDispatcher2 as WorkflowRunDispatcher,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/core",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "The ontology-first runtime for Sixb — objects, links, telemetry, actions, and provider contracts",
   "keywords": [
     "sixb",

package/src/auth/errors.ts

@@ -17,3 +17,26 @@ export class AuthRuntimeError extends Error {
     super(message)
   }
 }
+
+/** Why a strategy refused someone who authenticated. Each is something a person can act on. */
+export type SignInRefusalReason =
+  | "not_invited"
+  | "suspended"
+  | "domain_not_allowed"
+  | "no_trusted_address"
+
+/**
+ * Thrown by a strategy that refuses a sign-in for a known reason. The sign-in page tells the
+ * person which reason, naming `email` when there is one; `message` is for the server log.
+ */
+export class SignInRefusedError extends Error {
+  readonly name = "SignInRefusedError"
+
+  constructor(
+    readonly reason: SignInRefusalReason,
+    message: string,
+    readonly email?: string
+  ) {
+    super(message)
+  }
+}

package/src/auth/index.ts

@@ -37,7 +37,7 @@ export {
   verifyDoubleSubmitCsrf,
 } from "./csrf"
 export type { AuthRuntimeErrorCode } from "./errors"
-export { AuthRuntimeError } from "./errors"
+export { AuthRuntimeError, SignInRefusedError } from "./errors"
 export type { AuthRuntimeOptions } from "./runtime"
 export {
   AuthRuntime,

package/src/auth/runtime.ts

@@ -19,6 +19,7 @@ import {
   type AuthStorage,
   AuthStorageError,
   type CompleteDeviceAuthorizationInput,
+  type GroupMembershipRecord,
   type InvitationRecord,
   type ServiceAccountGroupMembershipRecord,
   type ServiceAccountRecord,
@@ -991,9 +992,9 @@ export class AuthRuntime {
 
     const members: MemberSummary[] = []
     for (const user of result.users) {
-      const groupIds = (
+      const { groupIds, managedGroupIds } = memberGroups(
         await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })
-      ).map((membership) => membership.groupId)
+      )
 
       // Visibility is scope-based: a member is listed when the caller can assign
       // groups or suspend over the member's current groups. This keeps out-of-scope
@@ -1008,6 +1009,7 @@ export class AuthRuntime {
       members.push({
         user,
         groupIds,
+        managedGroupIds,
         capabilities: {
           assignGroups: canAssignGroups,
           // A caller cannot suspend themselves; reactivation only applies to a
@@ -1033,12 +1035,11 @@ export class AuthRuntime {
     // The target must exist and every group it currently holds must be assignable
     // by the caller. Missing and out-of-scope targets raise the same error so a
     // caller cannot probe which users exist.
-    const { user, groupIds: currentGroupIds } = await this.requireManageableMember(
-      storage,
-      scope,
-      "assignGroups",
-      userId
-    )
+    const {
+      user,
+      groupIds: currentGroupIds,
+      managedGroupIds: currentManagedGroupIds,
+    } = await this.requireManageableMember(storage, scope, "assignGroups", userId)
 
     const requestedGroupIds = this.resolveMemberGroupIds(input.groupIds)
     // Every requested group must fall within the caller's assign scope.
@@ -1055,6 +1056,15 @@ export class AuthRuntime {
     const additions = requestedGroupIds.filter((groupId) => !current.has(groupId))
     const removals = currentGroupIds.filter((groupId) => !requested.has(groupId))
 
+    // The identity provider would restore these at the user's next sign-in.
+    const managedRemovals = removals.filter((groupId) => currentManagedGroupIds.includes(groupId))
+    if (managedRemovals.length > 0) {
+      throw new AuthRuntimeError(
+        "invalid_auth_input",
+        `[Sixb] Group(s) ${managedRemovals.join(", ")} are managed by the identity provider. Change them there; they sync at the user's next sign-in.`
+      )
+    }
+
     // Self-protection: a caller may add in-scope groups to themselves but may not
     // remove any of their own current groups, so they cannot lock themselves out.
     if (user.id === caller.user.id && removals.length > 0) {
@@ -1086,11 +1096,11 @@ export class AuthRuntime {
     // request resolves the updated membership.
     this.sessionCache?.invalidateUser(user.id)
 
-    const groupIds = (
+    const { groupIds, managedGroupIds } = memberGroups(
       await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })
-    ).map((membership) => membership.groupId)
+    )
 
-    return { user, groupIds }
+    return { user, groupIds, managedGroupIds }
   }
 
   async suspendMember(
@@ -1100,7 +1110,12 @@ export class AuthRuntime {
     const storage = this.requireAuthStorage()
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds)
     const userId = assertNonEmpty(input.userId, "User id")
-    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId)
+    const { user, groupIds, managedGroupIds } = await this.requireManageableMember(
+      storage,
+      scope,
+      "suspend",
+      userId
+    )
 
     if (user.id === caller.user.id) {
       throw new AuthRuntimeError(
@@ -1118,7 +1133,7 @@ export class AuthRuntime {
     // user stops authenticating immediately.
     this.sessionCache?.invalidateUser(user.id)
 
-    return { user: suspended, groupIds }
+    return { user: suspended, groupIds, managedGroupIds }
   }
 
   async reactivateMember(
@@ -1128,7 +1143,12 @@ export class AuthRuntime {
     const storage = this.requireAuthStorage()
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds)
     const userId = assertNonEmpty(input.userId, "User id")
-    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId)
+    const { user, groupIds, managedGroupIds } = await this.requireManageableMember(
+      storage,
+      scope,
+      "suspend",
+      userId
+    )
 
     // Reactivation restores access but not sessions; the user signs in again.
     const reactivated = await storage.users.updateStatus({
@@ -1138,7 +1158,7 @@ export class AuthRuntime {
       updatedAt: new Date(),
     })
 
-    return { user: reactivated, groupIds }
+    return { user: reactivated, groupIds, managedGroupIds }
   }
 
   /** The caller's active sessions across every audience, most recently active first. */
@@ -1210,13 +1230,15 @@ export class AuthRuntime {
     scope: MembershipPolicyScope,
     operation: MembershipOperation,
     userId: string
-  ): Promise<{ readonly user: UserRecord; readonly groupIds: readonly string[] }> {
+  ): Promise<{
+    readonly user: UserRecord
+    readonly groupIds: readonly string[]
+    readonly managedGroupIds: readonly string[]
+  }> {
     const user = await storage.users.getById({ projectId: this.projectId, id: userId })
-    const groupIds = user
-      ? (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId })).map(
-          (membership) => membership.groupId
-        )
-      : []
+    const { groupIds, managedGroupIds } = memberGroups(
+      user ? await storage.groupMemberships.listForUser({ projectId: this.projectId, userId }) : []
+    )
 
     if (!user || !canPerformMembershipOperation(scope, operation, groupIds)) {
       throw new AuthStorageError(
@@ -1225,7 +1247,7 @@ export class AuthRuntime {
       )
     }
 
-    return { user, groupIds }
+    return { user, groupIds, managedGroupIds }
   }
 
   private resolveMemberGroupIds(input: readonly string[]): readonly string[] {
@@ -1525,6 +1547,18 @@ export class AuthRuntime {
   }
 }
 
+function memberGroups(memberships: readonly GroupMembershipRecord[]): {
+  readonly groupIds: readonly string[]
+  readonly managedGroupIds: readonly string[]
+} {
+  return {
+    groupIds: memberships.map((membership) => membership.groupId),
+    managedGroupIds: memberships
+      .filter((membership) => membership.source === "directory")
+      .map((membership) => membership.groupId),
+  }
+}
+
 /** The interactive session a caller authenticated with, when it used one. */
 function callerSessionId(caller: AuthenticatedRequestAuthSession): string | undefined {
   return caller.credentialSource === "session" ? caller.session.id : undefined

package/src/auth/strategy.ts

@@ -7,6 +7,8 @@
  * entry plus the storage contracts from `@sixb/core/storage`.
  */
 
+export type { SignInRefusalReason } from "./errors"
+export { SignInRefusedError } from "./errors"
 export type {
   AuthEmailDeliveryStatus,
   AuthInvitationRecipientInput,

package/src/auth/types.ts

@@ -322,6 +322,11 @@ export interface MemberCapabilities {
 export interface MemberSummary {
   readonly user: UserRecord
   readonly groupIds: readonly string[]
+  /**
+   * The groups among `groupIds` that the identity provider manages. They sync at the user's next
+   * sign-in, so they cannot be removed here.
+   */
+  readonly managedGroupIds: readonly string[]
   readonly capabilities: MemberCapabilities
 }
 
@@ -340,6 +345,7 @@ export interface UpdateMemberGroupsInput {
 export interface UpdateMemberGroupsResult {
   readonly user: UserRecord
   readonly groupIds: readonly string[]
+  readonly managedGroupIds: readonly string[]
 }
 
 export interface SuspendMemberInput {
@@ -349,6 +355,7 @@ export interface SuspendMemberInput {
 export interface SuspendMemberResult {
   readonly user: UserRecord
   readonly groupIds: readonly string[]
+  readonly managedGroupIds: readonly string[]
 }
 
 export interface ReactivateMemberInput {
@@ -358,6 +365,7 @@ export interface ReactivateMemberInput {
 export interface ReactivateMemberResult {
   readonly user: UserRecord
   readonly groupIds: readonly string[]
+  readonly managedGroupIds: readonly string[]
 }
 
 /** `"session"` reads only the cookie; `"any"` reads a bearer access token, else the cookie. */

package/src/storage/auth/errors.ts

@@ -10,7 +10,6 @@ export type AuthStorageErrorCode =
   | "duplicate_service_account"
   | "duplicate_session"
   | "duplicate_user"
-  | "email_link_not_allowed"
   | "expired_magic_link"
   | "expired_oidc_attempt"
   | "invalid_input"

package/src/storage/auth/in-memory/auth-storage.ts

@@ -7,6 +7,7 @@ import type {
   CompleteOidcSignInInput,
   CompleteSignInResult,
   GroupMembershipRecord,
+  GroupMembershipSource,
   InvitationRecord,
   SessionRecord,
   SuspendUserAndRevokeSessionsInput,
@@ -42,6 +43,7 @@ import {
   normalizeEmail,
   normalizeGroupIds,
   oidcAttemptKey,
+  removeGroupMembershipRecord,
   revokeActiveSessionsForUser,
   upsertGroupMembershipRecord,
   userKey,
@@ -219,25 +221,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
 
-    if (
-      shouldCreateUser &&
-      !activeInvitation &&
-      input.allowUserCreationWithoutInvitation &&
-      input.requireNoActiveUsersForUserCreation &&
-      hasActiveUsers(this.state, projectId)
-    ) {
-      consumeMagicLinkRecord(this.state, {
-        projectId,
-        id: input.magicLinkId,
-        tokenHash: input.tokenHash,
-        consumedAt: completedAt,
-      })
-      throw new AuthStorageError(
-        "user_creation_not_allowed",
-        `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`
-      )
-    }
-
     validateCompleteSessionInput(this.state, projectId, input.session)
     assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
@@ -280,8 +263,9 @@ export class InMemoryAuthStorage implements AuthStorage {
       projectId,
       user,
     })
-    const memberships = this.applyManualGroups({
+    const memberships = this.applyGroups({
       completedAt,
+      source: "manual",
       groupIds: manualGroupIds,
       projectId,
       userId: user.id,
@@ -352,14 +336,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
 
-    if (!identity && user && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
-      this.consumeOidcAttempt(input, completedAt, projectId)
-      throw new AuthStorageError(
-        "email_link_not_allowed",
-        `[Sixb] OIDC identity cannot auto-link to user '${user.id}' for project '${projectId}'.`
-      )
-    }
-
     if (user?.status === "suspended") {
       this.consumeOidcAttempt(input, completedAt, projectId)
       throw new AuthStorageError(
@@ -368,14 +344,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
 
-    if (shouldCreateUser && !input.emailVerified) {
-      this.consumeOidcAttempt(input, completedAt, projectId)
-      throw new AuthStorageError(
-        "user_creation_not_allowed",
-        `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`
-      )
-    }
-
     if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
       this.consumeOidcAttempt(input, completedAt, projectId)
       throw new AuthStorageError(
@@ -384,20 +352,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
 
-    if (
-      shouldCreateUser &&
-      !activeInvitation &&
-      input.allowUserCreationWithoutInvitation &&
-      input.requireNoActiveUsersForUserCreation &&
-      hasActiveUsers(this.state, projectId)
-    ) {
-      this.consumeOidcAttempt(input, completedAt, projectId)
-      throw new AuthStorageError(
-        "user_creation_not_allowed",
-        `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`
-      )
-    }
-
     validateCompleteSessionInput(this.state, projectId, input.session)
     assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
@@ -434,12 +388,19 @@ export class InMemoryAuthStorage implements AuthStorage {
       projectId,
       user,
     })
-    const memberships = this.applyManualGroups({
+    const memberships = this.syncDirectoryGroups({
       completedAt,
-      groupIds: manualGroupIds,
+      groupIds: input.directoryGroupIds,
       projectId,
       userId: user.id,
-      existing: invitation.memberships,
+      existing: this.applyGroups({
+        completedAt,
+        source: "manual",
+        groupIds: manualGroupIds,
+        projectId,
+        userId: user.id,
+        existing: invitation.memberships,
+      }),
     })
 
     const nextIdentity: UserIdentityRecord = {
@@ -533,10 +494,11 @@ export class InMemoryAuthStorage implements AuthStorage {
     return { invitation, memberships }
   }
 
-  private applyManualGroups(input: {
+  private applyGroups(input: {
     readonly completedAt: Date
     readonly groupIds: readonly string[]
     readonly projectId: string
+    readonly source: GroupMembershipSource
     readonly userId: string
     readonly existing: readonly GroupMembershipRecord[]
   }): readonly GroupMembershipRecord[] {
@@ -547,13 +509,40 @@ export class InMemoryAuthStorage implements AuthStorage {
           projectId: input.projectId,
           userId: input.userId,
           groupId,
-          source: "manual",
+          source: input.source,
           createdAt: input.completedAt,
         })
       )
     }
     return memberships
   }
+  // Directory memberships become exactly `groupIds`. A group the user already holds from another
+  // source keeps that source, and memberships from other sources are never removed.
+  private syncDirectoryGroups(input: {
+    readonly completedAt: Date
+    readonly groupIds?: readonly string[]
+    readonly projectId: string
+    readonly userId: string
+    readonly existing: readonly GroupMembershipRecord[]
+  }): readonly GroupMembershipRecord[] {
+    if (!input.groupIds) {
+      return input.existing
+    }
+
+    const groupIds = normalizeGroupIds(input.groupIds)
+    const stale = [...this.state.groupMemberships.values()].filter(
+      (membership) =>
+        membership.projectId === input.projectId &&
+        membership.userId === input.userId &&
+        membership.source === "directory" &&
+        !groupIds.includes(membership.groupId)
+    )
+    for (const membership of stale) {
+      removeGroupMembershipRecord(this.state, membership)
+    }
+
+    return this.applyGroups({ ...input, groupIds, source: "directory" })
+  }
 
   private createSignInSession(input: {
     readonly projectId: string
@@ -599,16 +588,6 @@ function restoreMap<TKey, TValue>(target: Map<TKey, TValue>, snapshot: Map<TKey,
   }
 }
 
-function hasActiveUsers(state: AuthStorageState, projectId: string): boolean {
-  for (const user of state.users.values()) {
-    if (user.projectId === projectId && user.status === "active") {
-      return true
-    }
-  }
-
-  return false
-}
-
 function assertSignInSessionAudience(
   projectId: string,
   sessionAudience: string,

package/src/storage/auth/types.ts

@@ -4,7 +4,8 @@ import type { AuthorizablePrincipal } from "../../execution/types"
 export type UserStatus = "active" | "suspended"
 export type ServiceAccountStatus = "active" | "suspended"
 export type InvitationStatus = "pending" | "accepted" | "revoked"
-export type GroupMembershipSource = "invitation" | "manual" | "agent"
+/** `directory`: owned by the identity provider, and synced to its groups on every sign-in. */
+export type GroupMembershipSource = "invitation" | "manual" | "agent" | "directory"
 export type DeviceAuthorizationStatus = "pending" | "approved" | "denied" | "consumed"
 export const MAX_PENDING_DEVICE_AUTHORIZATIONS = 100
 
@@ -45,7 +46,8 @@ export interface ServiceAccountGroupMembershipRecord {
   readonly projectId: string
   readonly serviceAccountId: string
   readonly groupId: string
-  readonly source: GroupMembershipSource
+  /** Service accounts never sign in, so no identity provider owns their memberships. */
+  readonly source: Exclude<GroupMembershipSource, "directory">
   readonly createdAt: Date
 }
 
@@ -269,7 +271,7 @@ export interface UpsertAuthServiceAccountGroupMembershipInput {
   readonly projectId: string
   readonly serviceAccountId: string
   readonly groupId: string
-  readonly source: GroupMembershipSource
+  readonly source: ServiceAccountGroupMembershipRecord["source"]
   readonly createdAt?: Date
 }
 
@@ -431,7 +433,6 @@ export interface CompleteMagicLinkSignInInput {
   readonly newUserDisplayName?: string
   readonly newUserAvatarUrl?: string
   readonly allowUserCreationWithoutInvitation?: boolean
-  readonly requireNoActiveUsersForUserCreation?: boolean
   readonly manualGroupIds?: readonly string[]
   readonly session: CompleteAuthSessionInput
 }
@@ -442,15 +443,22 @@ export interface CompleteOidcSignInInput {
   readonly stateHash: string
   readonly completedAt: Date
   readonly subject: string
+  /**
+   * An address the strategy has already decided to trust. Without an identity for `subject`, it
+   * links the user who has this email, or claims this email's invitation for a new user.
+   */
   readonly email: string
-  readonly emailVerified?: boolean
   readonly displayName?: string
   readonly avatarUrl?: string
   readonly claims?: Readonly<Record<string, unknown>>
-  readonly autoLinkByVerifiedEmail?: boolean
   readonly allowUserCreationWithoutInvitation?: boolean
-  readonly requireNoActiveUsersForUserCreation?: boolean
   readonly manualGroupIds?: readonly string[]
+  /**
+   * The groups the identity provider grants this user. When present, the user's `directory`
+   * memberships become exactly these; memberships from any other source are never touched, and a
+   * group the user already has from another source keeps it. Omitted, nothing is synced.
+   */
+  readonly directoryGroupIds?: readonly string[]
   readonly newUserId: string
   readonly session: CompleteAuthSessionInput
 }