@smartytalent/openai-tools 0.7.1 → 0.7.3

package/dist/tools.json

@@ -349,7 +349,15 @@
                   "plan": {
                     "type": "string",
                     "minLength": 1,
-                    "maxLength": 255
+                    "maxLength": 255,
+                    "enum": [
+                      "startup",
+                      "growth",
+                      "expansion",
+                      "corporate",
+                      "system"
+                    ],
+                    "description": "Billing plan. The API Gateway authorizer maps custom:userPlan onto a usage plan key and falls back to `system` - the PLATFORM's own plan - for anything it does not recognise, so an invented name does not fail, it silently meters that customer against our internal quota. `enterprise` was such a name (a second word for `corporate`) and was folded into it 2026-07-27. NOTE: the server checks this list explicitly, because validate_item honours type/pattern/length but IGNORES enum."
                   },
                   "activeLanguages": {
                     "type": "array",
@@ -803,7 +811,15 @@
                   "plan": {
                     "type": "string",
                     "minLength": 1,
-                    "maxLength": 255
+                    "maxLength": 255,
+                    "enum": [
+                      "startup",
+                      "growth",
+                      "expansion",
+                      "corporate",
+                      "system"
+                    ],
+                    "description": "Billing plan. The API Gateway authorizer maps custom:userPlan onto a usage plan key and falls back to `system` - the PLATFORM's own plan - for anything it does not recognise, so an invented name does not fail, it silently meters that customer against our internal quota. `enterprise` was such a name (a second word for `corporate`) and was folded into it 2026-07-27. NOTE: the server checks this list explicitly, because validate_item honours type/pattern/length but IGNORES enum."
                   },
                   "activeLanguages": {
                     "type": "array",
@@ -1284,6 +1300,14 @@
                     "type": "string",
                     "description": "The admin-consent link an operator sends to the customer's IT. Built server-side so the app registration id is never hardcoded in a client. Absent if the platform Microsoft provider cannot be read."
                   },
+                  "sessionsRevoked": {
+                    "type": "integer",
+                    "description": "POST response, present ONLY on the transition to required=true: how many accounts were signed out everywhere. The PreAuthentication gate stops new password sign-ins but never fires on token refresh, and a refresh token lives 30 days - so without this sweep the switch would take a month to take effect for anyone already signed in. Nobody is exempt, including the break-glass roles: they keep their password and simply sign in again."
+                  },
+                  "sessionsFailed": {
+                    "type": "integer",
+                    "description": "POST response, alongside sessionsRevoked: accounts the sweep could not sign out. Non-zero means the door is partially open - those sessions keep working until their refresh token expires - and the operator is the only one positioned to see it, which is why it is returned rather than only logged."
+                  },
                   "idpDeleted": {
                     "type": "boolean",
                     "description": "DELETE response only: whether the customer's Cognito identity provider was actually removed. False when it was already gone, so a retry of the teardown reads as success rather than an error."
@@ -1297,7 +1321,7 @@
                   },
                   "loginUrl": {
                     "type": "string",
-                    "description": "Ready-made login link for this customer's employees (a tile in their Entra My Apps, an intranet bookmark, the welcome email). Carries identity_provider so Cognito goes straight to their Entra. There is deliberately no email-domain discovery endpoint: Cognito's own domain routing is SAML-only, and a public discovery endpoint would be an oracle for whether a given company is our customer. Lands in the myaccount app, which every role can reach - a JIT employee in the pending state has no role yet, so a role-scoped app would refuse them and the link would look broken. Derived on read, never stored. Absent if the enterprise app client cannot be read."
+                    "description": "Ready-made login link for this customer's employees (a tile in their Entra My Apps, an intranet bookmark, the welcome email), of the form https://myaccount.{domain}/sso?idp=ms-{shortCode}. It points at the APP, never at Cognito's authorize endpoint: nextauth refuses a callback it did not initiate, because the state, nonce and PKCE verifier it validates against live in cookies it sets while building the authorize URL itself - a hand-assembled Cognito link fails with 'State cookie was missing' however correct its parameters are. The page forwards idp as identity_provider, which also keeps the enterprise client's hosted page from drawing a button for every customer IdP on it. There is deliberately no email-domain discovery endpoint: Cognito's own domain routing is SAML-only, and a public discovery endpoint would be an oracle for whether a given company is our customer. Lands in the myaccount app, which every role can reach - a JIT employee in the pending state has no role yet, so a role-scoped app would refuse them and the link would look broken. Derived on read, never stored."
                   }
                 }
               }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartytalent/openai-tools",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "OpenAI function/tool definitions for SmartyTalent API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",