@tula-tech/contract 0.1.1 → 0.3.0

package/dist/index.js

@@ -2,17 +2,47 @@ import {
   ACTIVITY_TYPES2,
   EVENT_SCHEMA_VERSION2,
   EVENT_TARGET_TYPES2
-} from "./shared/chunk-7yqzghgm.js";
+} from "./shared/chunk-bsea97tx.js";
 import {
   COMMON_PASSWORDS2,
   DEFAULT_SPECIAL_CHARS2,
   normalizePassword2,
   evaluatePassword2
 } from "./shared/chunk-sc6qg3d2.js";
+import {
+  MAX_PERMISSIONS_PER_ROLE2,
+  MAX_CUSTOM_ROLES2,
+  MAX_PERMISSION_KEY_LENGTH2,
+  ROLE_KEY_PATTERN2,
+  PERMISSION_KEY_PATTERN2,
+  SYSTEM_PERMISSIONS2,
+  MEMBERSHIPS_MANAGE_PERMISSION2,
+  DOMAINS_MANAGE_PERMISSION2,
+  INVITATIONS_MANAGE_PERMISSION2,
+  ORGANIZATION_MANAGE_PERMISSION2,
+  ORGANIZATION_DELETE_PERMISSION2,
+  MEMBERSHIPS_READ_PERMISSION2,
+  SSO_MANAGE_PERMISSION2,
+  BUILT_IN_ROLES2,
+  isSystemPermission2,
+  isBuiltInRoleKey2,
+  rolePermissionRefusal2,
+  normalizePermissions2,
+  organizationRoleWeakenings2
+} from "./shared/chunk-yzgakhtb.js";
 import {
   CUSTOM_CLAIMS_CLAIM2,
+  ORGANIZATION_ID_CLAIM2,
+  SSO_CONNECTION_CLAIM2,
+  ORGANIZATION_ROLE_CLAIM2,
+  ORGANIZATION_PERMISSIONS_CLAIM2,
   RESERVED_CLAIM_NAMES2,
   MAX_CUSTOM_CLAIMS_BYTES2,
+  MAX_ORGANIZATION_CLAIMS_BYTES2,
+  MAX_ORGANIZATION_PERMISSIONS_CLAIM2,
+  organizationClaimsBytes2,
+  readOrganizationClaims2,
+  hasOrganizationAccess2,
   MAX_JWT_TEMPLATES2,
   MAX_JWT_TEMPLATE_CLAIMS2,
   MAX_CUSTOM_CLAIM_KEY_LENGTH2,
@@ -22,7 +52,7 @@ import {
   customClaimsBytes2,
   checkCustomClaims2,
   readCustomClaims2
-} from "./shared/chunk-4rb5jsfz.js";
+} from "./shared/chunk-fkx6fc8e.js";
 import {
   DPOP_HEADER2,
   DPOP_NONCE_HEADER2,
@@ -67,12 +97,29 @@ import {
   bindsCodeWithPkce2,
   CUSTOM_SCHEME_REDIRECT_REFUSALS2,
   customSchemeRedirectRefusal2
-} from "./shared/chunk-r202nxfw.js";
+} from "./shared/chunk-n1jdq72m.js";
 import {
   ERROR_DEFINITIONS2,
   ERROR_CODES2,
   errorDefinition2
-} from "./shared/chunk-cce3bhet.js";
+} from "./shared/chunk-5r2ka03q.js";
+import {
+  MAX_DOMAIN_LENGTH2,
+  MAX_DOMAIN_LABEL_LENGTH2,
+  MIN_DOMAIN_LENGTH2,
+  MAX_DOMAINS_PER_ORGANIZATION2,
+  DOMAIN_VERIFICATION_LIFETIME_DAYS2,
+  DOMAIN_REMINDER_DAYS2,
+  DOMAIN_REVERIFICATION_GRACE_DAYS2,
+  ORGANIZATION_DOMAIN_STATUSES2,
+  ORGANIZATION_DOMAIN_MODES2,
+  DOMAIN_PATTERN2,
+  PUBLIC_EMAIL_DOMAINS2,
+  PUBLIC_EMAIL_BRANDS2,
+  isPublicEmailDomain2,
+  domainRefusal2,
+  domainOfAddress2
+} from "./shared/chunk-cdg41bxh.js";
 import {
   environmentIssuer2,
   jwksUrl2
@@ -91,10 +138,12 @@ import {
   ENVIRONMENT_HEADER2,
   DASHBOARD_SESSION_COOKIE2,
   EMAIL_LINK_TOKEN_PARAM2,
+  ORGANIZATION_INVITATION_TOKEN_PARAM2,
   EMAIL_LINK_ATTEMPT_PARAM2,
   OAUTH_TICKET_PARAM2,
-  OAUTH_ERROR_PARAM2
-} from "./shared/chunk-q309e9bk.js";
+  OAUTH_ERROR_PARAM2,
+  SETUP_LINK_HEADER2
+} from "./shared/chunk-4hytq4je.js";
 import {
   THEME_TOKENS2,
   DEFAULT_THEME2,
@@ -102,7 +151,7 @@ import {
   isValidThemeValue2,
   themeToCssVariables2,
   contrastRatio2
-} from "./shared/chunk-pcn6ax54.js";
+} from "./shared/chunk-g0ddvjqg.js";
 import {
   WEBHOOK_ID_HEADER2,
   WEBHOOK_TIMESTAMP_HEADER2,
@@ -231,6 +280,57 @@ var CreateUserRequestSchema = z2.object({
   lastName: z2.string().trim().max(100).optional(),
   emailVerified: z2.boolean().optional()
 }).meta({ ref: "CreateUserRequest" });
+var MAX_IMPORT_ROWS = 500;
+var MAX_IMPORT_METADATA_BYTES = 4096;
+var MAX_IMPORT_PASSWORD_PARAMS = 16;
+var ImportPasswordSchema = z2.object({
+  algorithm: z2.string().max(64),
+  hash: z2.string().max(1024),
+  params: z2.record(z2.string().max(64), z2.union([z2.string().max(1024), z2.number()])).refine((params) => Object.keys(params).length <= MAX_IMPORT_PASSWORD_PARAMS, {
+    message: `at most ${MAX_IMPORT_PASSWORD_PARAMS} params`
+  }).optional()
+}).meta({ ref: "ImportPassword" });
+var ImportUserRowSchema = z2.object({
+  email: z2.string().max(320),
+  emailVerified: z2.boolean(),
+  name: z2.string().trim().max(200).optional(),
+  metadata: z2.record(z2.string().max(128), z2.unknown()).optional(),
+  externalId: z2.string().trim().min(1).max(256).optional(),
+  password: ImportPasswordSchema.optional()
+}).meta({ ref: "ImportUserRow" });
+var FirebaseScryptParamsSchema = z2.object({
+  signerKey: z2.string().max(512),
+  saltSeparator: z2.string().max(256),
+  rounds: z2.number().int(),
+  memCost: z2.number().int()
+}).meta({ ref: "FirebaseScryptParams" });
+var ImportUsersRequestSchema = z2.object({
+  users: z2.array(ImportUserRowSchema).min(1).max(MAX_IMPORT_ROWS),
+  firebaseScrypt: FirebaseScryptParamsSchema.optional()
+}).meta({ ref: "ImportUsersRequest" });
+var ImportSkipReasonSchema = z2.enum(["email_exists", "repeated_in_batch"]).meta({ ref: "ImportSkipReason" });
+var ImportRowResultSchema = z2.discriminatedUnion("status", [
+  z2.object({ index: z2.number().int().min(0), status: z2.literal("created"), id: z2.uuid() }),
+  z2.object({
+    index: z2.number().int().min(0),
+    status: z2.literal("skipped"),
+    reason: ImportSkipReasonSchema,
+    id: z2.uuid().optional(),
+    sameExternalId: z2.boolean().optional()
+  }),
+  z2.object({
+    index: z2.number().int().min(0),
+    status: z2.literal("refused"),
+    code: z2.string(),
+    message: z2.string()
+  })
+]).meta({ ref: "ImportRowResult" });
+var ImportUsersResultSchema = z2.object({
+  results: z2.array(ImportRowResultSchema),
+  created: z2.number().int().min(0),
+  skipped: z2.number().int().min(0),
+  refused: z2.number().int().min(0)
+}).meta({ ref: "ImportUsersResult" });
 var SetPasswordRequestSchema = z2.object({ password: z2.string().max(1024) }).meta({ ref: "SetPasswordRequest" });
 var ChangePasswordRequestSchema = z2.object({
   currentPassword: z2.string().max(1024),
@@ -252,7 +352,15 @@ var SetUserEmailRequestSchema = z2.strictObject({ email: z2.string().max(320) })
 
 // src/audit.ts
 var ActivityTypeSchema = z3.enum(ACTIVITY_TYPES2).meta({ ref: "ActivityType" });
-var AUDIT_ACTOR_TYPES = ["user", "admin", "system", "agent", "instance_admin"];
+var AUDIT_ACTOR_TYPES = [
+  "user",
+  "admin",
+  "system",
+  "agent",
+  "instance_admin",
+  "directory",
+  "setup_link"
+];
 var INSTANCE_ACTIVITY_TYPES = [
   "instance.signed_in",
   "instance.sign_in_failed",
@@ -273,6 +381,15 @@ var AUDIT_TARGET_TYPES = [
   "webhook_endpoint",
   "hook",
   "native_app",
+  "sso_connection",
+  "scim_token",
+  "scim_group",
+  "setup_link",
+  "organization",
+  "organization_membership",
+  "organization_role",
+  "organization_domain",
+  "organization_invitation",
   "proposal"
 ];
 var AuditLogSchema = z3.object({
@@ -288,6 +405,17 @@ var AuditLogSchema = z3.object({
   metadata: z3.record(z3.string(), z3.unknown()),
   occurredAt: z3.iso.datetime()
 }).meta({ ref: "AuditLog" });
+var AUDIT_EXPORT_FORMATS = ["ndjson", "csv"];
+var MAX_AUDIT_EXPORT_ROWS = 1e5;
+var CURSOR_PATTERN = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)~([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;
+var AuditExportCursorSchema = z3.string().regex(CURSOR_PATTERN);
+function auditExportCursor(entry) {
+  return `${entry.occurredAt}~${entry.id}`;
+}
+function parseAuditExportCursor(cursor) {
+  const match = CURSOR_PATTERN.exec(cursor);
+  return match ? { occurredAt: match[1], id: match[2] } : null;
+}
 var AuditLogListSchema = z3.object({ meta: PaginationMetaSchema, data: z3.array(AuditLogSchema) }).meta({ ref: "AuditLogList" });
 // src/duration.ts
 import { z as z4 } from "zod";
@@ -346,28 +474,154 @@ var EmailTemplatesSchema = z5.strictObject(shape).superRefine((templates, contex
 }).meta({ ref: "EmailTemplates" });
 var EmailSettingsSchema = z5.strictObject({ templates: EmailTemplatesSchema.default({}) }).meta({ ref: "EmailSettings" });
 // src/environment-settings.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
-// src/password-policy.ts
+// src/organization.ts
 import { z as z6 } from "zod";
+var MIN_ORGANIZATION_SLUG_LENGTH = 2;
+var MAX_ORGANIZATION_SLUG_LENGTH = 48;
+var MAX_ORGANIZATION_NAME_LENGTH = 100;
+var ORGANIZATION_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var RoleKeySchema = z6.string().regex(ROLE_KEY_PATTERN2, "a role key is lower-case letters, digits and underscores").meta({ ref: "OrganizationRoleKey" });
+var PermissionKeySchema = z6.string().max(MAX_PERMISSION_KEY_LENGTH2).regex(PERMISSION_KEY_PATTERN2, "a permission key is org:<feature>:<action>").meta({ ref: "PermissionKey" });
+var RolePermissionsSchema = z6.array(z6.string()).max(MAX_PERMISSIONS_PER_ROLE2).superRefine((permissions, context) => {
+  const seen = new Set;
+  permissions.forEach((key, index) => {
+    const refusal = rolePermissionRefusal2(key);
+    if (refusal === "grammar") {
+      context.addIssue({
+        code: "custom",
+        path: [index],
+        message: "a permission key is org:<feature>:<action>"
+      });
+    } else if (refusal === "reserved") {
+      context.addIssue({
+        code: "custom",
+        path: [index],
+        message: "the feature sys is reserved: only the system permissions Tula defines are allowed"
+      });
+    }
+    if (seen.has(key)) {
+      context.addIssue({ code: "custom", path: [index], message: "a permission is listed once" });
+    }
+    seen.add(key);
+  });
+}).meta({ ref: "OrganizationRolePermissions" });
+var OrganizationSlugSchema = z6.string().min(MIN_ORGANIZATION_SLUG_LENGTH).max(MAX_ORGANIZATION_SLUG_LENGTH).regex(ORGANIZATION_SLUG_PATTERN, "a slug is lower-case letters and digits joined by hyphens").meta({ ref: "OrganizationSlug" });
+var OrganizationName = z6.string().trim().min(1).max(MAX_ORGANIZATION_NAME_LENGTH).refine((name) => !Array.from(name).some((char) => isControl(char.codePointAt(0) ?? 0)), {
+  message: "must not contain control characters"
+});
+function isControl(code) {
+  return code <= 31 || code >= 127 && code <= 159;
+}
+var OrganizationSchema = z6.object({
+  id: z6.string(),
+  name: z6.string(),
+  slug: z6.string(),
+  createdBy: z6.string().nullable(),
+  createdAt: z6.iso.datetime(),
+  updatedAt: z6.iso.datetime()
+}).meta({ ref: "Organization" });
+var OrganizationListSchema = z6.object({ meta: PaginationMetaSchema, data: z6.array(OrganizationSchema) }).meta({ ref: "OrganizationList" });
+var CreateOrganizationRequestSchema = z6.strictObject({ name: OrganizationName, slug: OrganizationSlugSchema }).meta({ ref: "CreateOrganizationRequest" });
+var UpdateOrganizationRequestSchema = z6.strictObject({ name: OrganizationName.optional(), slug: OrganizationSlugSchema.optional() }).refine((body) => body.name !== undefined || body.slug !== undefined, {
+  message: "send a name, a slug or both"
+}).meta({ ref: "UpdateOrganizationRequest" });
+var OrganizationPageQuerySchema = z6.object({
+  page: z6.coerce.number().int().min(1).max(1e6).default(1),
+  size: z6.coerce.number().int().min(1).max(MAX_PAGE_SIZE).default(DEFAULT_PAGE_SIZE)
+}).meta({ ref: "OrganizationPageQuery" });
+var OrganizationSearchQuerySchema = OrganizationPageQuerySchema.extend({
+  q: z6.string().trim().max(100).optional()
+}).meta({ ref: "OrganizationSearchQuery" });
+var OrganizationMembershipSchema = z6.object({
+  id: z6.string(),
+  organizationId: z6.string(),
+  userId: z6.string(),
+  role: z6.string(),
+  createdAt: z6.iso.datetime(),
+  updatedAt: z6.iso.datetime()
+}).meta({ ref: "OrganizationMembership" });
+var OrganizationMembershipListSchema = z6.object({ meta: PaginationMetaSchema, data: z6.array(OrganizationMembershipSchema) }).meta({ ref: "OrganizationMembershipList" });
+var AddOrganizationMemberRequestSchema = z6.strictObject({ userId: z6.uuid(), role: RoleKeySchema }).meta({ ref: "AddOrganizationMemberRequest" });
+var UpdateOrganizationMemberRequestSchema = z6.strictObject({ role: RoleKeySchema }).meta({ ref: "UpdateOrganizationMemberRequest" });
+var UserOrganizationSchema = z6.object({
+  id: z6.string(),
+  name: z6.string(),
+  slug: z6.string(),
+  role: z6.string(),
+  permissions: z6.array(z6.string()),
+  createdAt: z6.iso.datetime()
+}).meta({ ref: "UserOrganization" });
+var UserOrganizationListSchema = z6.object({
+  activeOrganizationId: z6.string().nullable(),
+  meta: PaginationMetaSchema,
+  data: z6.array(UserOrganizationSchema)
+}).meta({ ref: "UserOrganizationList" });
+var SetActiveOrganizationRequestSchema = z6.strictObject({ organizationId: z6.uuid().nullable() }).meta({ ref: "SetActiveOrganizationRequest" });
+var ActiveOrganizationSchema = z6.object({
+  sessionId: z6.string(),
+  organizationId: z6.string().nullable(),
+  accessToken: z6.string().optional(),
+  accessTokenExpiresAt: z6.iso.datetime().optional()
+}).meta({ ref: "ActiveOrganization" });
+var OrganizationMemberSchema = z6.object({
+  userId: z6.string(),
+  name: z6.string().nullable(),
+  email: z6.string().nullable(),
+  role: z6.string(),
+  createdAt: z6.iso.datetime()
+}).meta({ ref: "OrganizationMember" });
+var OrganizationMemberListSchema = z6.object({ meta: PaginationMetaSchema, data: z6.array(OrganizationMemberSchema) }).meta({ ref: "OrganizationMemberList" });
+var AssignableRoleSchema = z6.object({ key: z6.string(), name: z6.string() }).meta({ ref: "AssignableRole" });
+var AssignableRoleListSchema = z6.object({ data: z6.array(AssignableRoleSchema) }).meta({ ref: "AssignableRoleList" });
+var UserMembershipSchema = z6.object({
+  organizationId: z6.string(),
+  name: z6.string(),
+  slug: z6.string(),
+  role: z6.string(),
+  joinedAt: z6.iso.datetime()
+}).meta({ ref: "UserMembership" });
+var UserMembershipListSchema = z6.object({ meta: PaginationMetaSchema, data: z6.array(UserMembershipSchema) }).meta({ ref: "UserMembershipList" });
+var ORGANIZATION_FIELDS = ["name", "slug"];
+var RoleNameSchema = OrganizationName;
+var OrganizationRoleSchema = z6.object({
+  id: z6.string(),
+  key: z6.string(),
+  name: z6.string(),
+  permissions: z6.array(z6.string()),
+  builtIn: z6.boolean(),
+  version: z6.number().int().min(1),
+  createdAt: z6.iso.datetime(),
+  updatedAt: z6.iso.datetime()
+}).meta({ ref: "OrganizationRole" });
+var OrganizationRoleListSchema = z6.object({ data: z6.array(OrganizationRoleSchema) }).meta({ ref: "OrganizationRoleList" });
+var CreateOrganizationRoleRequestSchema = z6.strictObject({ key: RoleKeySchema, name: RoleNameSchema, permissions: RolePermissionsSchema }).meta({ ref: "CreateOrganizationRoleRequest" });
+var UpdateOrganizationRoleRequestSchema = z6.strictObject({ name: RoleNameSchema.optional(), permissions: RolePermissionsSchema.optional() }).refine((body) => body.name !== undefined || body.permissions !== undefined, {
+  message: "send a name, permissions or both"
+}).meta({ ref: "UpdateOrganizationRoleRequest" });
+var ORGANIZATION_ROLE_FIELDS = ["name", "permissions"];
+
+// src/password-policy.ts
+import { z as z7 } from "zod";
 var MAX_PASSWORD_HISTORY = 24;
-var PasswordPolicySchema = z6.object({
-  preset: z6.enum(["recommended", "strict", "legacy", "custom"]),
-  minLength: z6.number().int().min(1).max(256),
-  maxLength: z6.number().int().min(8).max(1024),
-  requireLowercase: z6.boolean(),
-  requireUppercase: z6.boolean(),
-  requireNumber: z6.boolean(),
-  requireSpecial: z6.boolean(),
-  minCharacterClasses: z6.number().int().min(0).max(4),
-  specialChars: z6.string().min(1),
-  disallowUserInfo: z6.boolean(),
-  disallowCommon: z6.boolean(),
-  breachCheck: z6.enum(["off", "warn", "block"]),
-  maxRepeatedChars: z6.number().int().min(1).nullable(),
-  blockSequences: z6.boolean(),
-  history: z6.number().int().min(0).max(MAX_PASSWORD_HISTORY),
-  expiryDays: z6.number().int().min(1).nullable()
+var PasswordPolicySchema = z7.object({
+  preset: z7.enum(["recommended", "strict", "legacy", "custom"]),
+  minLength: z7.number().int().min(1).max(256),
+  maxLength: z7.number().int().min(8).max(1024),
+  requireLowercase: z7.boolean(),
+  requireUppercase: z7.boolean(),
+  requireNumber: z7.boolean(),
+  requireSpecial: z7.boolean(),
+  minCharacterClasses: z7.number().int().min(0).max(4),
+  specialChars: z7.string().min(1),
+  disallowUserInfo: z7.boolean(),
+  disallowCommon: z7.boolean(),
+  breachCheck: z7.enum(["off", "warn", "block"]),
+  maxRepeatedChars: z7.number().int().min(1).nullable(),
+  blockSequences: z7.boolean(),
+  history: z7.number().int().min(0).max(MAX_PASSWORD_HISTORY),
+  expiryDays: z7.number().int().min(1).nullable()
 }).refine((p) => p.maxLength >= p.minLength, {
   message: "maxLength must be at least minLength",
   path: ["maxLength"]
@@ -726,35 +980,35 @@ function phoneNumberPrefix(phoneNumber) {
 }
 
 // src/session-profile.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // src/jwt-template.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/session.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var REFRESH_TOKEN_PREFIX = "tula_rt_";
-var SessionClientSchema = z7.enum(["web", "ios", "android", "server"]).meta({ ref: "SessionClient" });
-var SessionSchema = z7.object({
-  id: z7.string(),
+var SessionClientSchema = z8.enum(["web", "ios", "android", "server"]).meta({ ref: "SessionClient" });
+var SessionSchema = z8.object({
+  id: z8.string(),
   client: SessionClientSchema,
-  userAgent: z7.string().nullable(),
-  ipAddress: z7.string().nullable(),
-  createdAt: z7.iso.datetime(),
-  lastActiveAt: z7.iso.datetime(),
-  expiresAt: z7.iso.datetime(),
-  current: z7.boolean(),
-  deviceBound: z7.boolean()
+  userAgent: z8.string().nullable(),
+  ipAddress: z8.string().nullable(),
+  createdAt: z8.iso.datetime(),
+  lastActiveAt: z8.iso.datetime(),
+  expiresAt: z8.iso.datetime(),
+  current: z8.boolean(),
+  deviceBound: z8.boolean()
 }).meta({ ref: "Session" });
 var AdminSessionSchema = SessionSchema.extend({
-  userId: z7.string(),
-  active: z7.boolean()
+  userId: z8.string(),
+  active: z8.boolean()
 }).meta({ ref: "AdminSession" });
-var SessionListSchema = z7.object({ data: z7.array(SessionSchema) }).meta({ ref: "SessionList" });
-var RefreshTokenRequestSchema = z7.object({ refreshToken: z7.string().max(512).optional() }).meta({ ref: "RefreshTokenRequest" });
+var SessionListSchema = z8.object({ data: z8.array(SessionSchema) }).meta({ ref: "SessionList" });
+var RefreshTokenRequestSchema = z8.object({ refreshToken: z8.string().max(512).optional() }).meta({ ref: "RefreshTokenRequest" });
 var MAX_VERIFIED_TOKEN_LENGTH = 4096;
-var VerifySessionRequestSchema = z7.object({ token: z7.string().min(1).max(MAX_VERIFIED_TOKEN_LENGTH) }).meta({ ref: "VerifySessionRequest" });
-var RevokedSessionsSchema = z7.object({ revoked: z7.number().int().min(0) }).meta({ ref: "RevokedSessions" });
+var VerifySessionRequestSchema = z8.object({ token: z8.string().min(1).max(MAX_VERIFIED_TOKEN_LENGTH) }).meta({ ref: "VerifySessionRequest" });
+var RevokedSessionsSchema = z8.object({ revoked: z8.number().int().min(0) }).meta({ ref: "RevokedSessions" });
 
 // src/jwt-template.ts
 var JWT_TEMPLATE_SOURCES = [
@@ -764,7 +1018,7 @@ var JWT_TEMPLATE_SOURCES = [
   "session.client",
   "session.created_at"
 ];
-var JwtTemplateSourceSchema = z8.enum(JWT_TEMPLATE_SOURCES).meta({ ref: "JwtTemplateSource" });
+var JwtTemplateSourceSchema = z9.enum(JWT_TEMPLATE_SOURCES).meta({ ref: "JwtTemplateSource" });
 var MAX_EMAIL_LENGTH = 320;
 var MAX_EMAIL_CLAIM_BYTES = 2 * MAX_EMAIL_LENGTH + 2;
 var MAX_BOOLEAN_BYTES = 5;
@@ -778,14 +1032,14 @@ var SOURCE_MAX_BYTES = {
   "session.created_at": MAX_TIME_BYTES
 };
 var UNPRINTABLE = /[\p{Cc}\p{Zl}\p{Zp}]/u;
-var Constant = z8.union([
-  z8.string().max(MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2).refine((value) => !UNPRINTABLE.test(value), {
+var Constant = z9.union([
+  z9.string().max(MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2).refine((value) => !UNPRINTABLE.test(value), {
     message: "must not contain control characters or line breaks"
   }),
-  z8.number(),
-  z8.boolean()
+  z9.number(),
+  z9.boolean()
 ]);
-var JwtTemplateClaimSchema = z8.union([z8.strictObject({ from: JwtTemplateSourceSchema }), z8.strictObject({ value: Constant })]).meta({ ref: "JwtTemplateClaim" });
+var JwtTemplateClaimSchema = z9.union([z9.strictObject({ from: JwtTemplateSourceSchema }), z9.strictObject({ value: Constant })]).meta({ ref: "JwtTemplateClaim" });
 var CLAIM_KEY_RULE = `a claim key is ASCII letters, digits and underscores, not starting with a digit, at most ${MAX_CUSTOM_CLAIM_KEY_LENGTH2} characters, and not a reserved claim name`;
 function keyBytes(key) {
   return customClaimsBytes2({ [key]: 0 }) - 3;
@@ -803,7 +1057,7 @@ function jwtTemplateMaxBytes(template) {
   return claims.reduce((bytes, [key, claim]) => bytes + keyBytes(key) + valueMaxBytes(claim), 2 + separators);
 }
 var fields = {
-  claims: z8.record(z8.string().refine(isCustomClaimKey2, { message: CLAIM_KEY_RULE }), JwtTemplateClaimSchema).default({})
+  claims: z9.record(z9.string().refine(isCustomClaimKey2, { message: CLAIM_KEY_RULE }), JwtTemplateClaimSchema).default({})
 };
 function fewEnough(template) {
   return Object.keys(template.claims).length <= MAX_JWT_TEMPLATE_CLAIMS2;
@@ -811,7 +1065,7 @@ function fewEnough(template) {
 function smallEnough(template) {
   return jwtTemplateMaxBytes(template) <= MAX_CUSTOM_CLAIMS_BYTES2;
 }
-var JwtTemplateSchema = z8.strictObject(fields).refine(fewEnough, {
+var JwtTemplateSchema = z9.strictObject(fields).refine(fewEnough, {
   message: `at most ${MAX_JWT_TEMPLATE_CLAIMS2} claims`,
   path: ["claims"]
 }).refine(smallEnough, {
@@ -845,7 +1099,7 @@ function jwtTemplateOfProfile(settings, profile) {
 }
 
 // src/session-profile.ts
-var SessionTypeSchema = z9.enum(["hybrid", "stateful"]).meta({ ref: "SessionType" });
+var SessionTypeSchema = z10.enum(["hybrid", "stateful"]).meta({ ref: "SessionType" });
 var MIN_ACCESS_TOKEN_TTL = "30s";
 var MAX_ACCESS_TOKEN_TTL = "15m";
 var MIN_IDLE_TIMEOUT = "1m";
@@ -858,7 +1112,7 @@ var DEFAULT_STEP_UP_AFTER = "10m";
 var MAX_CUSTOM_SESSION_PROFILES = 10;
 var MAX_SESSION_PROFILE_NAME_LENGTH = 32;
 var MAX_SESSIONS_PER_USER = 100;
-var DeviceBindingPolicySchema = z9.enum(["none", "optional", "required"]).meta({ ref: "DeviceBindingPolicy" });
+var DeviceBindingPolicySchema = z10.enum(["none", "optional", "required"]).meta({ ref: "DeviceBindingPolicy" });
 var BUILT_IN_SESSION_PROFILES = ["web", "mobile"];
 function defaultDeviceBinding(name) {
   return name === "web" ? "none" : "optional";
@@ -867,7 +1121,7 @@ var PROFILE_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 function isSessionProfileName(name) {
   return typeof name === "string" && name.length <= MAX_SESSION_PROFILE_NAME_LENGTH && PROFILE_NAME.test(name);
 }
-var SessionProfileNameSchema = z9.string().max(MAX_SESSION_PROFILE_NAME_LENGTH).regex(PROFILE_NAME).meta({ ref: "SessionProfileName" });
+var SessionProfileNameSchema = z10.string().max(MAX_SESSION_PROFILE_NAME_LENGTH).regex(PROFILE_NAME).meta({ ref: "SessionProfileName" });
 function ms(value) {
   return DurationSchema.safeParse(value).success ? durationToMs(value) : Number.NaN;
 }
@@ -885,7 +1139,7 @@ var profileFields = {
   idleTimeout: bounded(MIN_IDLE_TIMEOUT, MAX_SESSION_TIMEOUT).default("7d"),
   absoluteTimeout: bounded(MIN_IDLE_TIMEOUT, MAX_SESSION_TIMEOUT).nullable().default("30d"),
   stepUpAfter: bounded(MIN_STEP_UP_AFTER, MAX_STEP_UP_AFTER).nullable().default(null),
-  clientSelectable: z9.boolean().default(false),
+  clientSelectable: z10.boolean().default(false),
   jwtTemplate: SessionProfileNameSchema.nullable().default(null),
   deviceBinding: DeviceBindingPolicySchema.default("optional")
 };
@@ -910,13 +1164,13 @@ var accessWithinIdle = {
 function accessFits(profile) {
   return !(ms(profile.accessTokenTtl) > ms(profile.idleTimeout));
 }
-var SessionProfileSchema = z9.strictObject({ ...profileFields, refresh: z9.strictObject(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute).refine(accessFits, accessWithinIdle).meta({ ref: "SessionProfile" });
-var WebSessionProfileSchema = z9.strictObject({ ...webProfileFields, refresh: z9.strictObject(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute).refine(accessFits, accessWithinIdle).meta({ ref: "WebSessionProfile" });
-var StoredProfile = z9.object({ ...profileFields, refresh: z9.object(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute);
-var StoredWebProfile = z9.object({ ...webProfileFields, refresh: z9.object(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute);
+var SessionProfileSchema = z10.strictObject({ ...profileFields, refresh: z10.strictObject(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute).refine(accessFits, accessWithinIdle).meta({ ref: "SessionProfile" });
+var WebSessionProfileSchema = z10.strictObject({ ...webProfileFields, refresh: z10.strictObject(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute).refine(accessFits, accessWithinIdle).meta({ ref: "WebSessionProfile" });
+var StoredProfile = z10.object({ ...profileFields, refresh: z10.object(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute);
+var StoredWebProfile = z10.object({ ...webProfileFields, refresh: z10.object(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute);
 var DEFAULT_WEB_SESSION_PROFILE = WebSessionProfileSchema.parse({});
 var DEFAULT_MOBILE_SESSION_PROFILE = SessionProfileSchema.parse({});
-var SessionLimitActionSchema = z9.enum(["end_oldest", "refuse_newest"]).meta({ ref: "SessionLimitAction" });
+var SessionLimitActionSchema = z10.enum(["end_oldest", "refuse_newest"]).meta({ ref: "SessionLimitAction" });
 function isBuiltIn(name) {
   return BUILT_IN_SESSION_PROFILES.includes(name);
 }
@@ -929,7 +1183,7 @@ var PROFILE_SCHEMAS = {
 };
 function profilesOf(kind) {
   const { web, other } = PROFILE_SCHEMAS[kind];
-  return z9.object({ web: web.prefault({}), mobile: other.prefault({}) }).catchall(other).refine((profiles) => customNames(profiles).every(isSessionProfileName), {
+  return z10.object({ web: web.prefault({}), mobile: other.prefault({}) }).catchall(other).refine((profiles) => customNames(profiles).every(isSessionProfileName), {
     message: `a profile name is lowercase letters, digits and single hyphens, starting with a letter, at most ${MAX_SESSION_PROFILE_NAME_LENGTH} characters`
   }).refine((profiles) => customNames(profiles).length <= MAX_CUSTOM_SESSION_PROFILES, {
     message: `at most ${MAX_CUSTOM_SESSION_PROFILES} profiles besides web and mobile`
@@ -939,10 +1193,10 @@ function profilesOf(kind) {
   });
 }
 var TEMPLATE_NAME_RULE = `a template name is lowercase letters, digits and single hyphens, starting with a letter, at most ${MAX_SESSION_PROFILE_NAME_LENGTH} characters`;
-var JwtTemplates = z9.record(z9.string().refine(isSessionProfileName, { message: TEMPLATE_NAME_RULE }), JwtTemplateSchema).refine((templates) => Object.keys(templates).length <= MAX_JWT_TEMPLATES2, {
+var JwtTemplates = z10.record(z10.string().refine(isSessionProfileName, { message: TEMPLATE_NAME_RULE }), JwtTemplateSchema).refine((templates) => Object.keys(templates).length <= MAX_JWT_TEMPLATES2, {
   message: `at most ${MAX_JWT_TEMPLATES2} templates`
 }).default({});
-var StoredJwtTemplates = z9.unknown().optional().transform((stored) => {
+var StoredJwtTemplates = z10.unknown().optional().transform((stored) => {
   const templates = {};
   if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
     return templates;
@@ -968,15 +1222,15 @@ function templatesExist(settings, context) {
   }
 }
 var limitFields = {
-  maxPerUser: z9.number().int().min(1).max(MAX_SESSIONS_PER_USER).nullable().default(null),
+  maxPerUser: z10.number().int().min(1).max(MAX_SESSIONS_PER_USER).nullable().default(null),
   onLimit: SessionLimitActionSchema.default("end_oldest")
 };
-var SessionSettingsSchema = z9.strictObject({
+var SessionSettingsSchema = z10.strictObject({
   profiles: profilesOf("strict").prefault({}),
   ...limitFields,
   jwtTemplates: JwtTemplates
 }).superRefine(templatesExist).meta({ ref: "SessionSettings" });
-var StoredSessionSettingsSchema = z9.object({
+var StoredSessionSettingsSchema = z10.object({
   profiles: profilesOf("stored").prefault({}),
   ...limitFields,
   jwtTemplates: StoredJwtTemplates
@@ -1165,10 +1419,10 @@ function smsSegments(text) {
 }
 
 // src/sms-template-schema.ts
-import { z as z10 } from "zod";
-var SmsTemplateSchema = z10.strictObject({ text: z10.string().max(MAX_SMS_TEMPLATE_LENGTH) }).meta({ ref: "SmsTemplate" });
+import { z as z11 } from "zod";
+var SmsTemplateSchema = z11.strictObject({ text: z11.string().max(MAX_SMS_TEMPLATE_LENGTH) }).meta({ ref: "SmsTemplate" });
 var shape2 = Object.fromEntries(SMS_TEMPLATE_KINDS.map((kind) => [kind, SmsTemplateSchema.optional()]));
-var SmsTemplatesSchema = z10.strictObject(shape2).superRefine((templates, context) => {
+var SmsTemplatesSchema = z11.strictObject(shape2).superRefine((templates, context) => {
   for (const kind of SMS_TEMPLATE_KINDS) {
     const template = templates[kind];
     if (template === undefined) {
@@ -1193,7 +1447,7 @@ var MIN_PASSWORD_MIN_LENGTH = 8;
 var MAX_AUDIT_RETENTION_DAYS = 3650;
 var UNPRINTABLE3 = /[\p{Cc}\p{Zl}\p{Zp}]/u;
 var LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
-var HOST = `(?:${LABEL}(?:\\.${LABEL})*|\\[[0-9a-f:.]{2,45}\\])`;
+var HOST = `(?:${LABEL}(?:\\.${LABEL})*|\\[(?!.*:::)(?:[0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}\\])`;
 var PORT = "(?::([1-9][0-9]{0,4}))?";
 var HTTPS_ORIGIN = new RegExp(`^https://${HOST}${PORT}$`);
 var LOOPBACK_ORIGIN = new RegExp(`^http://(?:localhost|127\\.0\\.0\\.1|\\[::1\\])${PORT}$`);
@@ -1209,24 +1463,24 @@ function isWebOrigin(value) {
 function distinct(values) {
   return new Set(values).size === values.length;
 }
-var WebOriginSchema = z11.string().max(255).refine(isWebOrigin, {
+var WebOriginSchema = z12.string().max(255).refine(isWebOrigin, {
   message: "must be an origin such as https://app.example.com (lowercase, no path, no wildcard; http only for localhost)"
 }).meta({ ref: "WebOrigin" });
-var RedirectUrlSchema = z11.string().max(2048).refine(isRedirectUrl2, {
+var RedirectUrlSchema = z12.string().max(2048).refine(isRedirectUrl2, {
   message: "must be an absolute https URL (http only for localhost) with no credentials, fragment or wildcard, or a custom scheme with a full stop such as com.example.app:/oauth (no query, no fragment)"
 }).meta({ ref: "RedirectUrl" });
-var App = z11.object({
-  name: z11.string().trim().min(1).max(MAX_APP_NAME_LENGTH).refine((name) => !UNPRINTABLE3.test(name), {
+var App = z12.object({
+  name: z12.string().trim().min(1).max(MAX_APP_NAME_LENGTH).refine((name) => !UNPRINTABLE3.test(name), {
     message: "must not contain control characters or line breaks"
   }).default(DEFAULT_APP_NAME),
-  supportEmail: z11.email().max(254).nullable().default(null)
+  supportEmail: z12.email().max(254).nullable().default(null)
 });
 var AppInput = App.strict().refine((app) => !hasHiddenCharacter2(app.name), {
   path: ["name"],
   message: "must not contain text-direction controls, private-use or unassigned characters, or half a surrogate pair"
 });
-var PasswordMethod = z11.object({ enabled: z11.boolean().default(true) });
-var OptionalMethod = z11.object({ enabled: z11.boolean().default(false) });
+var PasswordMethod = z12.object({ enabled: z12.boolean().default(true) });
+var OptionalMethod = z12.object({ enabled: z12.boolean().default(false) });
 var SIGN_IN_METHODS_WITHOUT_SIGN_UP = ["smsCode"];
 var AT_LEAST_ONE_SIGN_IN_METHOD = "at least one sign-in method must stay enabled";
 function hasEnabledSignInMethod(settings) {
@@ -1239,8 +1493,8 @@ var linkNeedsCode = {
 function linkHasCode(methods) {
   return !methods.emailLink.enabled || methods.emailCode.enabled;
 }
-var SignUpPasswordModeSchema = z11.enum(["required", "optional"]).meta({ ref: "SignUpPasswordMode" });
-var SignUp = z11.object({
+var SignUpPasswordModeSchema = z12.enum(["required", "optional"]).meta({ ref: "SignUpPasswordMode" });
+var SignUp = z12.object({
   password: SignUpPasswordModeSchema.default("required")
 });
 var passwordlessNeedsCode = {
@@ -1250,31 +1504,44 @@ var passwordlessNeedsCode = {
 function passwordlessHasCode(settings) {
   return settings.signUp.password === "required" || settings.signIn.methods.emailCode.enabled;
 }
-var AllowedOrigins = z11.array(WebOriginSchema).max(MAX_ALLOWED_ORIGINS).refine(distinct, { message: "must not list an origin twice" });
-var Urls = z11.object({
+var AllowedOrigins = z12.array(WebOriginSchema).max(MAX_ALLOWED_ORIGINS).refine(distinct, { message: "must not list an origin twice" });
+var Urls = z12.object({
   allowedOrigins: AllowedOrigins.default([]),
-  allowedRedirectUrls: z11.array(RedirectUrlSchema).max(MAX_ALLOWED_REDIRECT_URLS).refine(distinct, { message: "must not list a URL twice" }).default([])
+  allowedRedirectUrls: z12.array(RedirectUrlSchema).max(MAX_ALLOWED_REDIRECT_URLS).refine(distinct, { message: "must not list a URL twice" }).default([])
 });
-var Audit = z11.object({
-  retentionDays: z11.number().int().min(1).max(MAX_AUDIT_RETENTION_DAYS).nullable().default(null)
+var Audit = z12.object({
+  retentionDays: z12.number().int().min(1).max(MAX_AUDIT_RETENTION_DAYS).nullable().default(null)
 });
-var Agents = z11.object({
-  proposalsInProduction: z11.boolean().default(false),
-  testSignIn: z11.boolean().nullable().default(null)
+var Agents = z12.object({
+  proposalsInProduction: z12.boolean().default(false),
+  testSignIn: z12.boolean().nullable().default(null)
 });
-var Notifications = z11.object({
-  passwordChanged: z11.boolean().default(true),
-  newSignIn: z11.boolean().default(true),
-  mfaChanged: z11.boolean().default(true),
-  identityChanged: z11.boolean().default(true)
+var Sso = z12.object({
+  enabled: z12.boolean().default(false)
 });
-var MfaPolicySchema = z11.enum(["off", "optional", "required"]).meta({ ref: "MfaPolicy" });
-var Mfa = z11.object({
+var DEFAULT_MAX_ORGANIZATIONS_CREATED_PER_USER = 5;
+var MAX_ORGANIZATIONS_CREATED_PER_USER = 1000;
+var Organizations = z12.object({
+  enabled: z12.boolean().default(false),
+  allowUserCreated: z12.boolean().default(false),
+  maxCreatedPerUser: z12.number().int().min(1).max(MAX_ORGANIZATIONS_CREATED_PER_USER).nullable().default(DEFAULT_MAX_ORGANIZATIONS_CREATED_PER_USER),
+  creatorRole: RoleKeySchema.default("admin"),
+  defaultRole: RoleKeySchema.default("member"),
+  personalAccount: z12.boolean().default(true)
+});
+var Notifications = z12.object({
+  passwordChanged: z12.boolean().default(true),
+  newSignIn: z12.boolean().default(true),
+  mfaChanged: z12.boolean().default(true),
+  identityChanged: z12.boolean().default(true)
+});
+var MfaPolicySchema = z12.enum(["off", "optional", "required"]).meta({ ref: "MfaPolicy" });
+var Mfa = z12.object({
   policy: MfaPolicySchema.default("optional"),
-  smsCode: z11.object({ enabled: z11.boolean().default(false) }).prefault({})
+  smsCode: z12.object({ enabled: z12.boolean().default(false) }).prefault({})
 });
 var MfaInput = Mfa.extend({
-  smsCode: z11.strictObject({ enabled: z11.boolean().default(false) }).prefault({})
+  smsCode: z12.strictObject({ enabled: z12.boolean().default(false) }).prefault({})
 }).strict();
 var RP_ID = new RegExp(`^(?:localhost|${LABEL}(?:\\.${LABEL})+)$`);
 function isRelyingPartyId(value) {
@@ -1289,8 +1556,8 @@ function originMatchesRelyingParty(origin, rpId) {
   }
   return host === rpId || host.endsWith(`.${rpId}`);
 }
-var Passkeys = z11.object({
-  rpId: z11.string().refine(isRelyingPartyId, {
+var Passkeys = z12.object({
+  rpId: z12.string().refine(isRelyingPartyId, {
     message: "must be a domain such as example.com, or localhost (no scheme, port or path)"
   }).nullable().default(null)
 });
@@ -1301,20 +1568,20 @@ var passkeyNeedsRpId = {
 function passkeyHasRpId(settings) {
   return !settings.signIn.methods.passkey.enabled || settings.passkeys.rpId !== null;
 }
-var SmsCountrySchema = z11.string().refine(isSmsCountry, {
+var SmsCountrySchema = z12.string().refine(isSmsCountry, {
   message: "must be an ISO 3166-1 alpha-2 country code in upper case, such as DE"
 }).meta({ ref: "SmsCountry" });
-var SmsCountries = z11.array(SmsCountrySchema).max(SMS_COUNTRIES.length).refine(distinct, { message: "must not list a country twice" });
-var Sms = z11.object({
-  enabled: z11.boolean().default(false),
+var SmsCountries = z12.array(SmsCountrySchema).max(SMS_COUNTRIES.length).refine(distinct, { message: "must not list a country twice" });
+var Sms = z12.object({
+  enabled: z12.boolean().default(false),
   allowedCountries: SmsCountries.default([]),
-  dailyMessageLimit: z11.number().int().min(1).max(MAX_SMS_DAILY_MESSAGE_LIMIT).default(DEFAULT_SMS_DAILY_MESSAGE_LIMIT),
+  dailyMessageLimit: z12.number().int().min(1).max(MAX_SMS_DAILY_MESSAGE_LIMIT).default(DEFAULT_SMS_DAILY_MESSAGE_LIMIT),
   templates: SmsTemplatesSchema.default({})
 });
 var password = PasswordPolicySchema.default(PASSWORD_POLICY_PRESETS.recommended);
-var version = z11.literal(1).default(1);
-var SignIn = z11.strictObject({
-  methods: z11.strictObject({
+var version = z12.literal(1).default(1);
+var SignIn = z12.strictObject({
+  methods: z12.strictObject({
     password: PasswordMethod.strict().prefault({}),
     emailCode: OptionalMethod.strict().prefault({}),
     emailLink: OptionalMethod.strict().prefault({}),
@@ -1326,7 +1593,7 @@ var minLengthFloor = {
   message: `must be at least ${MIN_PASSWORD_MIN_LENGTH}`,
   path: ["password", "minLength"]
 };
-var EnvironmentSettingsSchema = z11.strictObject({
+var EnvironmentSettingsSchema = z12.strictObject({
   version,
   app: App.strict().prefault({}),
   password,
@@ -1335,6 +1602,8 @@ var EnvironmentSettingsSchema = z11.strictObject({
   urls: Urls.strict().prefault({}),
   audit: Audit.strict().prefault({}),
   agents: Agents.strict().prefault({}),
+  organizations: Organizations.strict().prefault({}),
+  sso: Sso.strict().prefault({}),
   notifications: Notifications.strict().prefault({}),
   mfa: MfaInput.prefault({}),
   passkeys: Passkeys.strict().prefault({}),
@@ -1342,18 +1611,20 @@ var EnvironmentSettingsSchema = z11.strictObject({
   sms: Sms.strict().prefault({}),
   emails: EmailSettingsSchema.prefault({})
 }).refine((settings) => settings.password.minLength >= MIN_PASSWORD_MIN_LENGTH, minLengthFloor).refine(passwordlessHasCode, passwordlessNeedsCode).refine(passkeyHasRpId, passkeyNeedsRpId).meta({ ref: "EnvironmentSettings" });
-var EnvironmentSettingsInputSchema = z11.strictObject({
+var EnvironmentSettingsInputSchema = z12.strictObject({
   version,
   app: AppInput.prefault({}),
   password: PasswordPolicySchema.optional(),
   signIn: SignIn,
   signUp: SignUp.strict().prefault({}),
-  urls: z11.strictObject({
+  urls: z12.strictObject({
     allowedOrigins: AllowedOrigins.optional(),
     allowedRedirectUrls: Urls.shape.allowedRedirectUrls
   }).prefault({}),
   audit: Audit.strict().prefault({}),
   agents: Agents.strict().prefault({}),
+  organizations: Organizations.strict().prefault({}),
+  sso: Sso.strict().prefault({}),
   notifications: Notifications.strict().prefault({}),
   mfa: MfaInput.prefault({}),
   passkeys: Passkeys.strict().prefault({}),
@@ -1361,12 +1632,12 @@ var EnvironmentSettingsInputSchema = z11.strictObject({
   sms: Sms.strict().prefault({}),
   emails: EmailSettingsSchema.prefault({})
 }).refine((settings) => settings.password === undefined || settings.password.minLength >= MIN_PASSWORD_MIN_LENGTH, minLengthFloor).refine(passwordlessHasCode, passwordlessNeedsCode).refine(passkeyHasRpId, passkeyNeedsRpId).meta({ ref: "EnvironmentSettingsInput" });
-var Stored = z11.object({
+var Stored = z12.object({
   version,
   app: App.prefault({}),
   password,
-  signIn: z11.object({
-    methods: z11.object({
+  signIn: z12.object({
+    methods: z12.object({
       password: PasswordMethod.prefault({}),
       emailCode: OptionalMethod.prefault({}),
       emailLink: OptionalMethod.prefault({}),
@@ -1378,6 +1649,8 @@ var Stored = z11.object({
   urls: Urls.prefault({}),
   audit: Audit.prefault({}),
   agents: Agents.prefault({}),
+  organizations: Organizations.prefault({}),
+  sso: Sso.prefault({}),
   notifications: Notifications.prefault({}),
   mfa: Mfa.prefault({}),
   passkeys: Passkeys.prefault({}),
@@ -1457,40 +1730,45 @@ function parseStoredEnvironmentSettings(stored) {
 }
 var CONFIG_TOOL_PATTERN = /^[a-z0-9][a-z0-9._-]{0,31}$/;
 var CONFIG_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
-var SettingsManagedBySchema = z11.object({
-  tool: z11.string().regex(CONFIG_TOOL_PATTERN),
-  configHash: z11.string().regex(CONFIG_HASH_PATTERN),
-  at: z11.iso.datetime(),
-  revision: z11.number().int().min(1),
-  drifted: z11.boolean()
+var SettingsManagedBySchema = z12.object({
+  tool: z12.string().regex(CONFIG_TOOL_PATTERN),
+  configHash: z12.string().regex(CONFIG_HASH_PATTERN),
+  at: z12.iso.datetime(),
+  revision: z12.number().int().min(1),
+  drifted: z12.boolean()
 }).meta({ ref: "SettingsManagedBy" });
-var ClientConfigSchema = z11.object({
-  app: z11.object({ name: z11.string(), supportEmail: z11.string().nullable() }),
-  signIn: z11.object({
-    methods: z11.array(z11.string()),
-    oauth: z11.array(z11.string()).optional()
+var ClientConfigSchema = z12.object({
+  app: z12.object({ name: z12.string(), supportEmail: z12.string().nullable() }),
+  signIn: z12.object({
+    methods: z12.array(z12.string()),
+    oauth: z12.array(z12.string()).optional()
   }),
-  signUp: z11.object({ password: SignUpPasswordModeSchema }).optional(),
+  signUp: z12.object({ password: SignUpPasswordModeSchema }).optional(),
   password: PasswordPolicySchema,
-  mfa: z11.object({ policy: MfaPolicySchema, smsCode: z11.boolean().optional() }).optional(),
-  phone: z11.object({ enabled: z11.boolean() }).optional()
+  mfa: z12.object({ policy: MfaPolicySchema, smsCode: z12.boolean().optional() }).optional(),
+  phone: z12.object({ enabled: z12.boolean() }).optional(),
+  organizations: z12.object({
+    enabled: z12.boolean(),
+    allowUserCreated: z12.boolean(),
+    personalAccount: z12.boolean()
+  }).optional()
 }).meta({ ref: "ClientConfig" });
 // src/errors.ts
-import { z as z12 } from "zod";
-var ErrorCodeSchema = z12.enum(ERROR_CODES2).meta({ ref: "ErrorCode" });
-var ErrorParamsSchema = z12.record(z12.string(), z12.union([z12.string(), z12.number(), z12.boolean()])).meta({ ref: "ErrorParams" });
-var FieldErrorSchema = z12.object({
-  field: z12.string(),
+import { z as z13 } from "zod";
+var ErrorCodeSchema = z13.enum(ERROR_CODES2).meta({ ref: "ErrorCode" });
+var ErrorParamsSchema = z13.record(z13.string(), z13.union([z13.string(), z13.number(), z13.boolean()])).meta({ ref: "ErrorParams" });
+var FieldErrorSchema = z13.object({
+  field: z13.string(),
   code: ErrorCodeSchema,
-  message: z12.string(),
+  message: z13.string(),
   params: ErrorParamsSchema.optional()
 }).meta({ ref: "FieldError" });
-var ErrorEnvelopeSchema = z12.object({
-  status: z12.number().int(),
+var ErrorEnvelopeSchema = z13.object({
+  status: z13.number().int(),
   code: ErrorCodeSchema,
-  detail: z12.string(),
+  detail: z13.string(),
   params: ErrorParamsSchema.optional(),
-  errors: z12.array(FieldErrorSchema).optional()
+  errors: z13.array(FieldErrorSchema).optional()
 }).meta({ ref: "ErrorEnvelope" });
 // src/event-fixtures.ts
 var USER = "0199c2f4-7a10-7c3e-9b1a-5d2e8f4a6c01";
@@ -1502,7 +1780,14 @@ var SIGNING_KEY = "0199c2f4-7a15-7d88-86f7-9a4b5e1d2c06";
 var WEBHOOK_ENDPOINT = "0199c2f4-7a18-7abb-99ca-cd7e8b4a5f09";
 var HOOK = "0199c2f4-7a19-7bcc-8adb-de8f9c5b6a10";
 var NATIVE_APP = "0199c2f4-7a1a-7cdd-9bec-ef9a0d6c7b11";
+var SSO_CONNECTION = "0199c2f4-7a1a-7cdd-9bec-ef9a0d6c7b9c";
+var SCIM_TOKEN = "0199c2f4-7a1b-7cde-8cfd-f0ab1e7d8cad";
 var PROPOSAL = "0199c2f4-7a1b-7dee-8cfd-f0ab1e7d8c12";
+var ORGANIZATION = "0199c2f4-7a1d-7f00-8e1f-12cd3a9f0e14";
+var MEMBERSHIP = "0199c2f4-7a1e-7011-9f2a-23de4b0a1f15";
+var ORGANIZATION_ROLE = "0199c2f4-7a1f-7122-8a3b-34ef5c1b2a16";
+var ORGANIZATION_DOMAIN = "0199c2f4-7a21-7344-8c5d-56a17e3d4c18";
+var INVITATION = "0199c2f4-7a20-7233-9b4c-45f06d2c3b17";
 var AGENT = "0199c2f4-7a1c-7eff-9d0e-01bc2f8e9d13";
 var schemaVersion = EVENT_SCHEMA_VERSION2;
 var occurredAt = "2026-10-08T09:30:00.000Z";
@@ -1517,6 +1802,18 @@ var aboutEnvironment = { type: "environment", id: ENVIRONMENT };
 var aboutWebhookEndpoint = { type: "webhook_endpoint", id: WEBHOOK_ENDPOINT };
 var aboutHook = { type: "hook", id: HOOK };
 var aboutNativeApp = { type: "native_app", id: NATIVE_APP };
+var aboutSsoConnection = { type: "sso_connection", id: SSO_CONNECTION };
+var SETUP_LINK = "0199c2f4-7a1b-7cde-8cfd-f0ab1e7d8cae";
+var aboutSetupLink = { type: "setup_link", id: SETUP_LINK };
+var SCIM_GROUP = "0199c2f4-7a1b-7cde-8cfd-f0ab1e7d8caf";
+var aboutScimGroup = { type: "scim_group", id: SCIM_GROUP };
+var aboutScimToken = { type: "scim_token", id: SCIM_TOKEN };
+var directory = { type: "directory", id: SCIM_TOKEN };
+var aboutOrganization = { type: "organization", id: ORGANIZATION };
+var aboutMembership = { type: "organization_membership", id: MEMBERSHIP };
+var aboutRole = { type: "organization_role", id: ORGANIZATION_ROLE };
+var aboutDomain = { type: "organization_domain", id: ORGANIZATION_DOMAIN };
+var aboutInvitation = { type: "organization_invitation", id: INVITATION };
 var aboutProposal = { type: "proposal", id: PROPOSAL };
 var proposed = { operation: "ban_user", targetType: "user", targetId: USER };
 function eventId(n) {
@@ -1538,6 +1835,15 @@ var EVENT_FIXTURES = {
       test: true
     }
   },
+  "user.imported": {
+    id: eventId(114),
+    type: "user.imported",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutUser,
+    data: { emailVerified: true, passwordless: false, passwordAlgorithm: "bcrypt" }
+  },
   "user.email_verified": {
     id: eventId(2),
     type: "user.email_verified",
@@ -1628,6 +1934,15 @@ var EVENT_FIXTURES = {
     target: aboutUser,
     data: { provider: "google", method: "auto" }
   },
+  "user.sso_linked": {
+    id: eventId(122),
+    type: "user.sso_linked",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { connectionId: "0190a1b2-0000-7000-8000-0000000000c1", method: "email" }
+  },
   "user.identity_unlinked": {
     id: eventId(12),
     type: "user.identity_unlinked",
@@ -1950,6 +2265,279 @@ var EVENT_FIXTURES = {
     target: aboutNativeApp,
     data: { platform: "android" }
   },
+  "sso_connection.created": {
+    id: eventId(119),
+    type: "sso_connection.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutSsoConnection,
+    data: { protocol: "oidc", status: "draft", domains: 1 }
+  },
+  "sso_connection.updated": {
+    id: eventId(120),
+    type: "sso_connection.updated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutSsoConnection,
+    data: { protocol: "oidc", changed: ["status"], status: "disabled", weakened: true }
+  },
+  "scim_token.created": {
+    id: eventId(1431),
+    type: "scim_token.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutScimToken,
+    data: { organizationId: ORGANIZATION }
+  },
+  "scim_token.revoked": {
+    id: eventId(1432),
+    type: "scim_token.revoked",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutScimToken,
+    data: { organizationId: ORGANIZATION }
+  },
+  "setup_link.created": {
+    id: eventId(1440),
+    type: "setup_link.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutSetupLink,
+    data: { organizationId: ORGANIZATION }
+  },
+  "setup_link.revoked": {
+    id: eventId(1441),
+    type: "setup_link.revoked",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutSetupLink,
+    data: { organizationId: ORGANIZATION }
+  },
+  "user.scim_provisioned": {
+    id: eventId(1433),
+    type: "user.scim_provisioned",
+    schemaVersion,
+    occurredAt,
+    actor: directory,
+    target: aboutUser,
+    data: { organizationId: ORGANIZATION, method: "created" }
+  },
+  "user.scim_updated": {
+    id: eventId(1434),
+    type: "user.scim_updated",
+    schemaVersion,
+    occurredAt,
+    actor: directory,
+    target: aboutUser,
+    data: { organizationId: ORGANIZATION, changed: ["name"] }
+  },
+  "scim_group.created": {
+    id: eventId(1435),
+    type: "scim_group.created",
+    schemaVersion,
+    occurredAt,
+    actor: directory,
+    target: aboutScimGroup,
+    data: { organizationId: ORGANIZATION }
+  },
+  "scim_group.updated": {
+    id: eventId(1436),
+    type: "scim_group.updated",
+    schemaVersion,
+    occurredAt,
+    actor: directory,
+    target: aboutScimGroup,
+    data: { organizationId: ORGANIZATION, changed: ["members"] }
+  },
+  "scim_group.deleted": {
+    id: eventId(1437),
+    type: "scim_group.deleted",
+    schemaVersion,
+    occurredAt,
+    actor: directory,
+    target: aboutScimGroup,
+    data: { organizationId: ORGANIZATION }
+  },
+  "sso_connection.deleted": {
+    id: eventId(121),
+    type: "sso_connection.deleted",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutSsoConnection,
+    data: { protocol: "oidc" }
+  },
+  "organization.created": {
+    id: eventId(46),
+    type: "organization.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutOrganization,
+    data: {}
+  },
+  "organization.updated": {
+    id: eventId(47),
+    type: "organization.updated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutOrganization,
+    data: { changed: ["name", "slug"] }
+  },
+  "organization.deleted": {
+    id: eventId(48),
+    type: "organization.deleted",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutOrganization,
+    data: { memberships: 3 }
+  },
+  "organization_membership.added": {
+    id: eventId(49),
+    type: "organization_membership.added",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutMembership,
+    data: { organizationId: ORGANIZATION, userId: USER, role: "member", via: "domain_auto_join" }
+  },
+  "organization_membership.role_changed": {
+    id: eventId(50),
+    type: "organization_membership.role_changed",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutMembership,
+    data: { organizationId: ORGANIZATION, userId: USER, role: "admin", previousRole: "member" }
+  },
+  "organization_membership.removed": {
+    id: eventId(51),
+    type: "organization_membership.removed",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutMembership,
+    data: { organizationId: ORGANIZATION, userId: USER, role: "member" }
+  },
+  "organization_role.created": {
+    id: eventId(52),
+    type: "organization_role.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutRole,
+    data: { role: "billing_manager", permissions: 2 }
+  },
+  "organization_role.updated": {
+    id: eventId(53),
+    type: "organization_role.updated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutRole,
+    data: { role: "billing_manager", changed: ["permissions"], permissions: 3, weakened: true }
+  },
+  "organization_role.deleted": {
+    id: eventId(54),
+    type: "organization_role.deleted",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutRole,
+    data: { role: "billing_manager" }
+  },
+  "organization_domain.claimed": {
+    id: eventId(115),
+    type: "organization_domain.claimed",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutDomain,
+    data: { organizationId: ORGANIZATION, domain: "acme.com", mode: "suggest" }
+  },
+  "organization_domain.verified": {
+    id: eventId(116),
+    type: "organization_domain.verified",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutDomain,
+    data: {
+      organizationId: ORGANIZATION,
+      domain: "acme.com",
+      mode: "auto_join",
+      reverified: true,
+      weakened: true
+    }
+  },
+  "organization_domain.updated": {
+    id: eventId(117),
+    type: "organization_domain.updated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutDomain,
+    data: {
+      organizationId: ORGANIZATION,
+      domain: "acme.com",
+      mode: "auto_join",
+      previousMode: "suggest",
+      weakened: true
+    }
+  },
+  "organization_domain.removed": {
+    id: eventId(118),
+    type: "organization_domain.removed",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutDomain,
+    data: { organizationId: ORGANIZATION, domain: "acme.com" }
+  },
+  "organization_invitation.created": {
+    id: eventId(55),
+    type: "organization_invitation.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutInvitation,
+    data: { organizationId: ORGANIZATION, role: "member" }
+  },
+  "organization_invitation.accepted": {
+    id: eventId(56),
+    type: "organization_invitation.accepted",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutInvitation,
+    data: { organizationId: ORGANIZATION, role: "member", userId: USER }
+  },
+  "organization_invitation.declined": {
+    id: eventId(57),
+    type: "organization_invitation.declined",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutInvitation,
+    data: { organizationId: ORGANIZATION, role: "member", userId: USER }
+  },
+  "organization_invitation.revoked": {
+    id: eventId(58),
+    type: "organization_invitation.revoked",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutInvitation,
+    data: { organizationId: ORGANIZATION, role: "member" }
+  },
   "session.refresh_proof_refused": {
     id: eventId(39),
     type: "session.refresh_proof_refused",
@@ -1977,6 +2565,15 @@ var EVENT_FIXTURES = {
     target: aboutProposal,
     data: { ...proposed, proposedBy: AGENT }
   },
+  "proposal.rejected": {
+    id: eventId(1442),
+    type: "proposal.rejected",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutProposal,
+    data: { ...proposed, proposedBy: AGENT }
+  },
   "proposal.executed": {
     id: eventId(42),
     type: "proposal.executed",
@@ -1995,6 +2592,27 @@ var EVENT_FIXTURES = {
     target: aboutProposal,
     data: { ...proposed, approvedBy: admin, reason: "target_not_found" }
   },
+  "audit.exported": {
+    id: eventId(46),
+    type: "audit.exported",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutEnvironment,
+    data: {
+      phase: "finished",
+      format: "ndjson",
+      rowCount: 1200,
+      resumed: false,
+      action: "user.banned",
+      actorId: USER,
+      actorType: "user",
+      targetId: USER,
+      organizationId: ORGANIZATION,
+      from: "2026-10-01T00:00:00.000Z",
+      to: occurredAt
+    }
+  },
   "sign_in_test.started": {
     id: eventId(44),
     type: "sign_in_test.started",
@@ -2015,19 +2633,19 @@ var EVENT_FIXTURES = {
   }
 };
 // src/events.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 
 // src/hook.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 
 // src/oauth.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // src/flow.ts
-import { z as z13 } from "zod";
-var SecondFactorMethodSchema = z13.enum(["totp", "passkey", "backup_code", "sms_code"]).meta({ ref: "SecondFactorMethod" });
-var PreparedSecondFactorMethodSchema = z13.enum(["sms_code"]).meta({ ref: "PreparedSecondFactorMethod" });
-var FirstFactorStrategySchema = z13.enum([
+import { z as z14 } from "zod";
+var SecondFactorMethodSchema = z14.enum(["totp", "passkey", "backup_code", "sms_code"]).meta({ ref: "SecondFactorMethod" });
+var PreparedSecondFactorMethodSchema = z14.enum(["sms_code"]).meta({ ref: "PreparedSecondFactorMethod" });
+var FirstFactorStrategySchema = z14.enum([
   "password",
   "email_code",
   "email_link",
@@ -2040,107 +2658,108 @@ var FirstFactorStrategySchema = z13.enum([
   "oauth_discord",
   "oauth_linkedin",
   "oauth_x",
-  "oauth_facebook"
+  "oauth_facebook",
+  "sso"
 ]).meta({ ref: "FirstFactorStrategy" });
-var FactorEnrolmentMethodSchema = z13.enum(["totp"]).meta({ ref: "FactorEnrolmentMethod" });
-var EmailVerificationStrategySchema = z13.enum(["email_code", "email_link"]).meta({ ref: "EmailVerificationStrategy" });
-var PreparedFirstFactorStrategySchema = z13.enum(["email_code", "email_link", "sms_code"]).meta({ ref: "PreparedFirstFactorStrategy" });
-var NewPasswordReasonSchema = z13.enum(["expired"]).meta({ ref: "NewPasswordReason" });
-var FlowStepSchema = z13.discriminatedUnion("status", [
-  z13.object({ status: z13.literal("needs_identifier") }),
-  z13.object({ status: z13.literal("needs_password") }),
-  z13.object({
-    status: z13.literal("needs_first_factor"),
-    strategies: z13.array(FirstFactorStrategySchema).min(1),
-    prepared: z13.object({ strategy: PreparedFirstFactorStrategySchema, destination: z13.string() }).optional()
+var FactorEnrolmentMethodSchema = z14.enum(["totp"]).meta({ ref: "FactorEnrolmentMethod" });
+var EmailVerificationStrategySchema = z14.enum(["email_code", "email_link"]).meta({ ref: "EmailVerificationStrategy" });
+var PreparedFirstFactorStrategySchema = z14.enum(["email_code", "email_link", "sms_code"]).meta({ ref: "PreparedFirstFactorStrategy" });
+var NewPasswordReasonSchema = z14.enum(["expired"]).meta({ ref: "NewPasswordReason" });
+var FlowStepSchema = z14.discriminatedUnion("status", [
+  z14.object({ status: z14.literal("needs_identifier") }),
+  z14.object({ status: z14.literal("needs_password") }),
+  z14.object({
+    status: z14.literal("needs_first_factor"),
+    strategies: z14.array(FirstFactorStrategySchema).min(1),
+    prepared: z14.object({ strategy: PreparedFirstFactorStrategySchema, destination: z14.string() }).optional()
   }),
-  z13.object({
-    status: z13.literal("needs_email_verification"),
-    destination: z13.string(),
-    strategies: z13.array(EmailVerificationStrategySchema).min(1)
+  z14.object({
+    status: z14.literal("needs_email_verification"),
+    destination: z14.string(),
+    strategies: z14.array(EmailVerificationStrategySchema).min(1)
   }),
-  z13.object({
-    status: z13.literal("needs_new_password"),
-    destination: z13.string(),
-    strategies: z13.array(EmailVerificationStrategySchema),
+  z14.object({
+    status: z14.literal("needs_new_password"),
+    destination: z14.string(),
+    strategies: z14.array(EmailVerificationStrategySchema),
     reason: NewPasswordReasonSchema.optional()
   }).refine((step) => step.reason === undefined === step.strategies.length > 0, {
     message: "strategies is empty exactly when a reason is given",
     path: ["strategies"]
   }),
-  z13.object({
-    status: z13.literal("needs_second_factor"),
-    options: z13.array(SecondFactorMethodSchema).min(1),
-    prepared: z13.object({ method: PreparedSecondFactorMethodSchema, destination: z13.string() }).optional()
+  z14.object({
+    status: z14.literal("needs_second_factor"),
+    options: z14.array(SecondFactorMethodSchema).min(1),
+    prepared: z14.object({ method: PreparedSecondFactorMethodSchema, destination: z14.string() }).optional()
   }),
-  z13.object({
-    status: z13.literal("needs_factor_enrolment"),
-    methods: z13.array(FactorEnrolmentMethodSchema).min(1)
+  z14.object({
+    status: z14.literal("needs_factor_enrolment"),
+    methods: z14.array(FactorEnrolmentMethodSchema).min(1)
   }),
-  z13.object({
-    status: z13.literal("complete"),
-    userId: z13.string(),
-    sessionId: z13.string()
+  z14.object({
+    status: z14.literal("complete"),
+    userId: z14.string(),
+    sessionId: z14.string()
   })
 ]).meta({ ref: "FlowStep" });
-var FlowKindSchema = z13.enum(["sign_in", "sign_up", "password_reset"]).meta({ ref: "FlowKind" });
-var SessionTokensSchema = z13.object({
-  sessionId: z13.string(),
-  accessToken: z13.string().optional(),
-  accessTokenExpiresAt: z13.iso.datetime().optional(),
-  refreshToken: z13.string().optional()
+var FlowKindSchema = z14.enum(["sign_in", "sign_up", "password_reset"]).meta({ ref: "FlowKind" });
+var SessionTokensSchema = z14.object({
+  sessionId: z14.string(),
+  accessToken: z14.string().optional(),
+  accessTokenExpiresAt: z14.iso.datetime().optional(),
+  refreshToken: z14.string().optional()
 }).meta({ ref: "SessionTokens" });
-var FlowAttemptSchema = z13.object({
-  id: z13.string(),
+var FlowAttemptSchema = z14.object({
+  id: z14.string(),
   kind: FlowKindSchema,
-  expiresAt: z13.iso.datetime(),
+  expiresAt: z14.iso.datetime(),
   step: FlowStepSchema,
-  attemptSecret: z13.string().optional(),
-  linkBinding: z13.string().optional(),
+  attemptSecret: z14.string().optional(),
+  linkBinding: z14.string().optional(),
   session: SessionTokensSchema.optional(),
-  backupCodes: z13.array(z13.string()).optional(),
-  backupCodesRemaining: z13.number().int().min(0).optional()
+  backupCodes: z14.array(z14.string()).optional(),
+  backupCodesRemaining: z14.number().int().min(0).optional()
 }).meta({ ref: "FlowAttempt" });
-var SignUpRequestSchema = z13.object({
-  email: z13.string().max(320),
-  password: z13.string().max(1024).optional(),
-  firstName: z13.string().trim().max(100).optional(),
-  lastName: z13.string().trim().max(100).optional()
+var SignUpRequestSchema = z14.object({
+  email: z14.string().max(320),
+  password: z14.string().max(1024).optional(),
+  firstName: z14.string().trim().max(100).optional(),
+  lastName: z14.string().trim().max(100).optional()
 }).meta({ ref: "SignUpRequest" });
-var SignInStartRequestSchema = z13.object({ identifier: z13.string().max(320) }).meta({ ref: "SignInStartRequest" });
-var PasswordAttemptRequestSchema = z13.object({ password: z13.string().max(1024) }).meta({ ref: "PasswordAttemptRequest" });
+var SignInStartRequestSchema = z14.object({ identifier: z14.string().max(320) }).meta({ ref: "SignInStartRequest" });
+var PasswordAttemptRequestSchema = z14.object({ password: z14.string().max(1024) }).meta({ ref: "PasswordAttemptRequest" });
 var MAX_LINK_FIELD_LENGTH = 2048;
-var FirstFactorPrepareRequestSchema = z13.object({
+var FirstFactorPrepareRequestSchema = z14.object({
   strategy: PreparedFirstFactorStrategySchema,
-  redirectUrl: z13.string().max(MAX_LINK_FIELD_LENGTH).optional()
+  redirectUrl: z14.string().max(MAX_LINK_FIELD_LENGTH).optional()
 }).meta({ ref: "FirstFactorPrepareRequest" });
-var FirstFactorAttemptRequestSchema = z13.discriminatedUnion("strategy", [
-  z13.object({ strategy: z13.literal("email_code"), code: z13.string().regex(/^\d{6}$/) }),
-  z13.object({ strategy: z13.literal("email_link") }),
-  z13.object({ strategy: z13.literal("sms_code"), code: z13.string().regex(/^\d{6}$/) })
+var FirstFactorAttemptRequestSchema = z14.discriminatedUnion("strategy", [
+  z14.object({ strategy: z14.literal("email_code"), code: z14.string().regex(/^\d{6}$/) }),
+  z14.object({ strategy: z14.literal("email_link") }),
+  z14.object({ strategy: z14.literal("sms_code"), code: z14.string().regex(/^\d{6}$/) })
 ]).meta({ ref: "FirstFactorAttemptRequest" });
-var EmailLinkRequestSchema = z13.object({
-  token: z13.string().min(1).max(MAX_LINK_FIELD_LENGTH),
-  attemptId: z13.uuid(),
-  binding: z13.string().max(MAX_LINK_FIELD_LENGTH).optional()
+var EmailLinkRequestSchema = z14.object({
+  token: z14.string().min(1).max(MAX_LINK_FIELD_LENGTH),
+  attemptId: z14.uuid(),
+  binding: z14.string().max(MAX_LINK_FIELD_LENGTH).optional()
 }).meta({ ref: "EmailLinkRequest" });
-var EmailLinkResultSchema = z13.object({ status: z13.literal("verified") }).meta({ ref: "EmailLinkResult" });
-var VerifyEmailRequestSchema = z13.object({ code: z13.string().regex(/^\d{6}$/) }).meta({ ref: "VerifyEmailRequest" });
+var EmailLinkResultSchema = z14.object({ status: z14.literal("verified") }).meta({ ref: "EmailLinkResult" });
+var VerifyEmailRequestSchema = z14.object({ code: z14.string().regex(/^\d{6}$/) }).meta({ ref: "VerifyEmailRequest" });
 var MAX_BACKUP_CODE_INPUT_LENGTH = 64;
-var SecondFactorRequestSchema = z13.discriminatedUnion("method", [
-  z13.object({ method: z13.literal("totp"), code: z13.string().regex(/^\d{6}$/) }),
-  z13.object({ method: z13.literal("sms_code"), code: z13.string().regex(/^\d{6}$/) }),
-  z13.object({
-    method: z13.literal("backup_code"),
-    code: z13.string().min(1).max(MAX_BACKUP_CODE_INPUT_LENGTH)
+var SecondFactorRequestSchema = z14.discriminatedUnion("method", [
+  z14.object({ method: z14.literal("totp"), code: z14.string().regex(/^\d{6}$/) }),
+  z14.object({ method: z14.literal("sms_code"), code: z14.string().regex(/^\d{6}$/) }),
+  z14.object({
+    method: z14.literal("backup_code"),
+    code: z14.string().min(1).max(MAX_BACKUP_CODE_INPUT_LENGTH)
   }),
-  z13.object({ method: z13.literal("passkey"), credential: PasskeyAssertionCredentialSchema })
+  z14.object({ method: z14.literal("passkey"), credential: PasskeyAssertionCredentialSchema })
 ]).meta({ ref: "SecondFactorRequest" });
-var SecondFactorPrepareRequestSchema = z13.object({ method: PreparedSecondFactorMethodSchema }).meta({ ref: "SecondFactorPrepareRequest" });
-var PasskeySignInStartSchema = z13.object({ attempt: FlowAttemptSchema, options: PasskeyRequestOptionsSchema }).meta({ ref: "PasskeySignInStart" });
-var PasswordResetStartRequestSchema = z13.object({ email: z13.string().max(320) }).meta({ ref: "PasswordResetStartRequest" });
-var PasswordResetRequestSchema = z13.object({ code: z13.string().regex(/^\d{6}$/), password: z13.string().max(1024) }).meta({ ref: "PasswordResetRequest" });
-var NewPasswordRequestSchema = z13.object({ password: z13.string().max(1024) }).meta({ ref: "NewPasswordRequest" });
+var SecondFactorPrepareRequestSchema = z14.object({ method: PreparedSecondFactorMethodSchema }).meta({ ref: "SecondFactorPrepareRequest" });
+var PasskeySignInStartSchema = z14.object({ attempt: FlowAttemptSchema, options: PasskeyRequestOptionsSchema }).meta({ ref: "PasskeySignInStart" });
+var PasswordResetStartRequestSchema = z14.object({ email: z14.string().max(320) }).meta({ ref: "PasswordResetStartRequest" });
+var PasswordResetRequestSchema = z14.object({ code: z14.string().regex(/^\d{6}$/), password: z14.string().max(1024) }).meta({ ref: "PasswordResetRequest" });
+var NewPasswordRequestSchema = z14.object({ password: z14.string().max(1024) }).meta({ ref: "NewPasswordRequest" });
 
 // src/oauth.ts
 var OAUTH_PROVIDERS = [
@@ -2153,7 +2772,7 @@ var OAUTH_PROVIDERS = [
   "x",
   "facebook"
 ];
-var OAuthProviderSchema = z14.enum(OAUTH_PROVIDERS).meta({ ref: "OAuthProvider" });
+var OAuthProviderSchema = z15.enum(OAUTH_PROVIDERS).meta({ ref: "OAuthProvider" });
 var OAUTH_PROVIDERS_WITHOUT_ADDRESS = [
   "x",
   "facebook"
@@ -2163,7 +2782,7 @@ function givesNoAddress(provider) {
 }
 var MICROSOFT_TENANT_ALIASES = ["common", "organizations", "consumers"];
 var GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var MicrosoftTenantSchema = z14.string().trim().toLowerCase().refine((value) => MICROSOFT_TENANT_ALIASES.includes(value) || GUID.test(value), { message: "must be common, organizations, consumers or a tenant id (a GUID)" }).meta({ ref: "MicrosoftTenant" });
+var MicrosoftTenantSchema = z15.string().trim().toLowerCase().refine((value) => MICROSOFT_TENANT_ALIASES.includes(value) || GUID.test(value), { message: "must be common, organizations, consumers or a tenant id (a GUID)" }).meta({ ref: "MicrosoftTenant" });
 var ID_TOKEN_PROVIDERS = [
   "google",
   "apple"
@@ -2175,23 +2794,23 @@ var ID_TOKEN_CLIENT_KINDS = {
 function takesAdditionalClientIds(provider) {
   return provider === "google";
 }
-var IdTokenProviderSchema = z14.enum(ID_TOKEN_PROVIDERS).meta({ ref: "IdTokenProvider" });
+var IdTokenProviderSchema = z15.enum(ID_TOKEN_PROVIDERS).meta({ ref: "IdTokenProvider" });
 var MAX_ADDITIONAL_CLIENT_IDS = 8;
 var GOOGLE_CLIENT_ID = /^[0-9]{1,32}(-[0-9a-z]{1,64})?\.apps\.googleusercontent\.com$/;
 function isGoogleClientId(value) {
   return value.length <= 128 && GOOGLE_CLIENT_ID.test(value);
 }
-var AdditionalClientIdsSchema = z14.array(z14.string().refine(isGoogleClientId, {
+var AdditionalClientIdsSchema = z15.array(z15.string().refine(isGoogleClientId, {
   message: "must be a Google OAuth client id (…apps.googleusercontent.com)"
 })).max(MAX_ADDITIONAL_CLIENT_IDS).refine((ids) => new Set(ids).size === ids.length, { message: "must not repeat a client id" }).meta({ ref: "AdditionalClientIds" });
 function ownClientIdAmong(clientId, additionalClientIds) {
   return additionalClientIds.indexOf(clientId);
 }
 var DEPENDENT_ACCOUNTS_SCAN_LIMIT = 1000;
-var OAuthProviderDependentsSchema = z14.object({
+var OAuthProviderDependentsSchema = z15.object({
   provider: OAuthProviderSchema,
-  accounts: z14.number().int().min(0).max(DEPENDENT_ACCOUNTS_SCAN_LIMIT),
-  more: z14.boolean()
+  accounts: z15.number().int().min(0).max(DEPENDENT_ACCOUNTS_SCAN_LIMIT),
+  more: z15.boolean()
 }).meta({ ref: "OAuthProviderDependents" });
 function oauthProviderWeakenings(before, after) {
   const weakened = [];
@@ -2207,55 +2826,55 @@ function oauthProviderWeakenings(before, after) {
 }
 var MAX_ID_TOKEN_LENGTH = 8192;
 var MAX_ID_TOKEN_NAME_LENGTH = 100;
-var IdTokenStartRequestSchema = z14.strictObject({ provider: IdTokenProviderSchema }).meta({ ref: "IdTokenStartRequest" });
-var IdTokenStartSchema = z14.object({ attempt: FlowAttemptSchema, nonce: z14.string() }).meta({ ref: "IdTokenStart" });
-var IdTokenExchangeRequestSchema = z14.strictObject({
-  idToken: z14.string().min(1).max(MAX_ID_TOKEN_LENGTH),
-  givenName: z14.string().max(MAX_ID_TOKEN_NAME_LENGTH).optional(),
-  familyName: z14.string().max(MAX_ID_TOKEN_NAME_LENGTH).optional()
+var IdTokenStartRequestSchema = z15.strictObject({ provider: IdTokenProviderSchema }).meta({ ref: "IdTokenStartRequest" });
+var IdTokenStartSchema = z15.object({ attempt: FlowAttemptSchema, nonce: z15.string() }).meta({ ref: "IdTokenStart" });
+var IdTokenExchangeRequestSchema = z15.strictObject({
+  idToken: z15.string().min(1).max(MAX_ID_TOKEN_LENGTH),
+  givenName: z15.string().max(MAX_ID_TOKEN_NAME_LENGTH).optional(),
+  familyName: z15.string().max(MAX_ID_TOKEN_NAME_LENGTH).optional()
 }).meta({ ref: "IdTokenExchangeRequest" });
 var MAX_OAUTH_FIELD_LENGTH = 2048;
-var OAuthStartRequestSchema = z14.object({
+var OAuthStartRequestSchema = z15.object({
   provider: OAuthProviderSchema,
-  redirectUrl: z14.string().max(MAX_OAUTH_FIELD_LENGTH)
+  redirectUrl: z15.string().max(MAX_OAUTH_FIELD_LENGTH)
 }).meta({ ref: "OAuthStartRequest" });
-var OAuthStartSchema = z14.object({
+var OAuthStartSchema = z15.object({
   attempt: FlowAttemptSchema,
-  authorizationUrl: z14.url(),
-  binding: z14.string()
+  authorizationUrl: z15.url(),
+  binding: z15.string()
 }).meta({ ref: "OAuthStart" });
-var OAuthExchangeRequestSchema = z14.object({
-  ticket: z14.string().min(1).max(MAX_OAUTH_FIELD_LENGTH),
-  attemptId: z14.uuid(),
-  binding: z14.string().max(MAX_OAUTH_FIELD_LENGTH).optional()
+var OAuthExchangeRequestSchema = z15.object({
+  ticket: z15.string().min(1).max(MAX_OAUTH_FIELD_LENGTH),
+  attemptId: z15.uuid(),
+  binding: z15.string().max(MAX_OAUTH_FIELD_LENGTH).optional()
 }).meta({ ref: "OAuthExchangeRequest" });
-var IdentitySchema = z14.object({
-  id: z14.string(),
-  provider: z14.string(),
-  createdAt: z14.iso.datetime()
+var IdentitySchema = z15.object({
+  id: z15.string(),
+  provider: z15.string(),
+  createdAt: z15.iso.datetime()
 }).meta({ ref: "Identity" });
-var IdentityListSchema = z14.object({ data: z14.array(IdentitySchema) }).meta({ ref: "IdentityList" });
-var IdentityLinkStartSchema = z14.object({
-  attemptId: z14.string(),
-  expiresAt: z14.iso.datetime(),
-  authorizationUrl: z14.url(),
-  binding: z14.string()
+var IdentityListSchema = z15.object({ data: z15.array(IdentitySchema) }).meta({ ref: "IdentityList" });
+var IdentityLinkStartSchema = z15.object({
+  attemptId: z15.string(),
+  expiresAt: z15.iso.datetime(),
+  authorizationUrl: z15.url(),
+  binding: z15.string()
 }).meta({ ref: "IdentityLinkStart" });
-var OAuthProviderSettingsSchema = z14.object({
+var OAuthProviderSettingsSchema = z15.object({
   provider: OAuthProviderSchema,
-  configured: z14.boolean(),
-  enabled: z14.boolean(),
-  clientId: z14.string().nullable(),
-  teamId: z14.string().nullable(),
-  keyId: z14.string().nullable(),
-  tenant: z14.string().nullable(),
-  additionalClientIds: z14.array(z14.string()).default([]),
-  callbackUrl: z14.url(),
-  updatedAt: z14.iso.datetime().nullable()
+  configured: z15.boolean(),
+  enabled: z15.boolean(),
+  clientId: z15.string().nullable(),
+  teamId: z15.string().nullable(),
+  keyId: z15.string().nullable(),
+  tenant: z15.string().nullable(),
+  additionalClientIds: z15.array(z15.string()).default([]),
+  callbackUrl: z15.url(),
+  updatedAt: z15.iso.datetime().nullable()
 }).meta({ ref: "OAuthProviderSettings" });
-var OAuthProviderSettingsListSchema = z14.object({ data: z14.array(OAuthProviderSettingsSchema) }).meta({ ref: "OAuthProviderSettingsList" });
-var credential = (max) => z14.string().trim().min(1).max(max);
-var OAuthProviderUpdateSchema = z14.strictObject({
+var OAuthProviderSettingsListSchema = z15.object({ data: z15.array(OAuthProviderSettingsSchema) }).meta({ ref: "OAuthProviderSettingsList" });
+var credential = (max) => z15.string().trim().min(1).max(max);
+var OAuthProviderUpdateSchema = z15.strictObject({
   clientId: credential(512),
   clientSecret: credential(2048).optional(),
   teamId: credential(64).optional(),
@@ -2263,51 +2882,51 @@ var OAuthProviderUpdateSchema = z14.strictObject({
   privateKey: credential(8192).optional(),
   tenant: MicrosoftTenantSchema.optional(),
   additionalClientIds: AdditionalClientIdsSchema.optional(),
-  enabled: z14.boolean().default(true)
+  enabled: z15.boolean().default(true)
 }).meta({ ref: "OAuthProviderUpdate" });
 
 // src/webhook.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var MAX_WEBHOOK_URL_LENGTH = 2048;
 var MAX_WEBHOOK_ENDPOINTS = 10;
-var url = () => z15.string().min(1).max(MAX_WEBHOOK_URL_LENGTH).regex(/^[^\s\u0000-\u001f\u007f]+$/, "Must not contain spaces or control characters.");
-var eventTypes = () => z15.array(z15.enum(ACTIVITY_TYPES2)).min(1).max(ACTIVITY_TYPES2.length).refine((types) => new Set(types).size === types.length, {
+var url = () => z16.string().min(1).max(MAX_WEBHOOK_URL_LENGTH).regex(/^[^\s\u0000-\u001f\u007f]+$/, "Must not contain spaces or control characters.");
+var eventTypes = () => z16.array(z16.enum(ACTIVITY_TYPES2)).min(1).max(ACTIVITY_TYPES2.length).refine((types) => new Set(types).size === types.length, {
   message: "An event type is listed more than once."
 });
-var WebhookEndpointSchema = z15.object({
-  id: z15.uuid(),
-  url: z15.string(),
-  eventTypes: z15.array(z15.string()),
-  enabled: z15.boolean(),
-  disabledReason: z15.string().nullable(),
-  failingSince: z15.iso.datetime().nullable(),
-  lastFailedAt: z15.iso.datetime().nullable(),
-  rotationOverlapEndsAt: z15.iso.datetime().nullable(),
-  createdAt: z15.iso.datetime(),
-  updatedAt: z15.iso.datetime()
+var WebhookEndpointSchema = z16.object({
+  id: z16.uuid(),
+  url: z16.string(),
+  eventTypes: z16.array(z16.string()),
+  enabled: z16.boolean(),
+  disabledReason: z16.string().nullable(),
+  failingSince: z16.iso.datetime().nullable(),
+  lastFailedAt: z16.iso.datetime().nullable(),
+  rotationOverlapEndsAt: z16.iso.datetime().nullable(),
+  createdAt: z16.iso.datetime(),
+  updatedAt: z16.iso.datetime()
 }).meta({ ref: "WebhookEndpoint" });
 var CreatedWebhookEndpointSchema = WebhookEndpointSchema.extend({
-  secret: z15.string().describe("The signing secret. Store it now: it is shown only once.")
+  secret: z16.string().describe("The signing secret. Store it now: it is shown only once.")
 }).meta({ ref: "CreatedWebhookEndpoint" });
 var RotatedWebhookSecretSchema = WebhookEndpointSchema.extend({
-  secret: z15.string().describe("The new signing secret. Store it now: it is shown only once."),
-  rotationOverlapEndsAt: z15.iso.datetime().describe("When the previous secret stops signing. Until then deliveries carry both signatures.")
+  secret: z16.string().describe("The new signing secret. Store it now: it is shown only once."),
+  rotationOverlapEndsAt: z16.iso.datetime().describe("When the previous secret stops signing. Until then deliveries carry both signatures.")
 }).meta({ ref: "RotatedWebhookSecret" });
 var WEBHOOK_ROTATION_REFUSALS = [
   "rotation_in_progress",
   "no_rotation_in_progress",
   "secret_unreadable"
 ];
-var WebhookEndpointListSchema = z15.object({ data: z15.array(WebhookEndpointSchema) }).meta({ ref: "WebhookEndpointList" });
-var CreateWebhookEndpointRequestSchema = z15.strictObject({
+var WebhookEndpointListSchema = z16.object({ data: z16.array(WebhookEndpointSchema) }).meta({ ref: "WebhookEndpointList" });
+var CreateWebhookEndpointRequestSchema = z16.strictObject({
   url: url(),
   eventTypes: eventTypes(),
-  enabled: z15.boolean().default(true)
+  enabled: z16.boolean().default(true)
 }).meta({ ref: "CreateWebhookEndpointRequest" });
-var UpdateWebhookEndpointRequestSchema = z15.strictObject({
+var UpdateWebhookEndpointRequestSchema = z16.strictObject({
   url: url().optional(),
   eventTypes: eventTypes().optional(),
-  enabled: z15.boolean().optional()
+  enabled: z16.boolean().optional()
 }).refine((update) => Object.values(update).some((value) => value !== undefined), {
   message: "Name at least one field to change."
 }).meta({ ref: "UpdateWebhookEndpointRequest" });
@@ -2318,44 +2937,44 @@ var WEBHOOK_REDELIVER_REFUSALS = [
   "attempt_limit"
 ];
 var WEBHOOK_DELIVERY_STATES = ["pending", "delivered", "failed"];
-var WebhookDeliveryAttemptSchema = z15.object({
-  attempt: z15.number().int().min(1),
-  attemptedAt: z15.iso.datetime(),
-  statusCode: z15.number().int().nullable(),
-  durationMs: z15.number().int().min(0),
-  failureReason: z15.string().nullable()
+var WebhookDeliveryAttemptSchema = z16.object({
+  attempt: z16.number().int().min(1),
+  attemptedAt: z16.iso.datetime(),
+  statusCode: z16.number().int().nullable(),
+  durationMs: z16.number().int().min(0),
+  failureReason: z16.string().nullable()
 }).meta({ ref: "WebhookDeliveryAttempt" });
-var WebhookDeliverySchema = z15.object({
-  id: z15.uuid(),
-  endpointId: z15.uuid(),
-  eventId: z15.uuid().nullable(),
-  eventType: z15.string(),
-  test: z15.boolean(),
-  state: z15.string(),
-  attemptCount: z15.number().int().min(0),
-  nextAttemptAt: z15.iso.datetime().nullable(),
-  lastAttemptAt: z15.iso.datetime().nullable(),
-  statusCode: z15.number().int().nullable(),
-  failureReason: z15.string().nullable(),
-  completedAt: z15.iso.datetime().nullable(),
-  createdAt: z15.iso.datetime()
+var WebhookDeliverySchema = z16.object({
+  id: z16.uuid(),
+  endpointId: z16.uuid(),
+  eventId: z16.uuid().nullable(),
+  eventType: z16.string(),
+  test: z16.boolean(),
+  state: z16.string(),
+  attemptCount: z16.number().int().min(0),
+  nextAttemptAt: z16.iso.datetime().nullable(),
+  lastAttemptAt: z16.iso.datetime().nullable(),
+  statusCode: z16.number().int().nullable(),
+  failureReason: z16.string().nullable(),
+  completedAt: z16.iso.datetime().nullable(),
+  createdAt: z16.iso.datetime()
 }).meta({ ref: "WebhookDelivery" });
 var WebhookDeliveryDetailSchema = WebhookDeliverySchema.extend({
-  attempts: z15.array(WebhookDeliveryAttemptSchema)
+  attempts: z16.array(WebhookDeliveryAttemptSchema)
 }).meta({ ref: "WebhookDeliveryDetail" });
-var WebhookDeliveryListSchema = z15.object({ meta: PaginationMetaSchema, data: z15.array(WebhookDeliverySchema) }).meta({ ref: "WebhookDeliveryList" });
-var SendTestWebhookRequestSchema = z15.strictObject({ eventType: z15.enum(ACTIVITY_TYPES2) }).meta({ ref: "SendTestWebhookRequest" });
-var WebhookSendResultSchema = z15.object({
-  deliveryId: z15.uuid(),
-  outcome: z15.enum(["delivered", "failed"]),
-  statusCode: z15.number().int().nullable(),
-  durationMs: z15.number().int().min(0),
-  failureReason: z15.string().nullable()
+var WebhookDeliveryListSchema = z16.object({ meta: PaginationMetaSchema, data: z16.array(WebhookDeliverySchema) }).meta({ ref: "WebhookDeliveryList" });
+var SendTestWebhookRequestSchema = z16.strictObject({ eventType: z16.enum(ACTIVITY_TYPES2) }).meta({ ref: "SendTestWebhookRequest" });
+var WebhookSendResultSchema = z16.object({
+  deliveryId: z16.uuid(),
+  outcome: z16.enum(["delivered", "failed"]),
+  statusCode: z16.number().int().nullable(),
+  durationMs: z16.number().int().min(0),
+  failureReason: z16.string().nullable()
 }).meta({ ref: "WebhookSendResult" });
 
 // src/hook.ts
 var HOOK_POINTS = ["before_sign_up", "before_session", "before_token"];
-var HookPointSchema = z16.enum(HOOK_POINTS).meta({ ref: "HookPoint" });
+var HookPointSchema = z17.enum(HOOK_POINTS).meta({ ref: "HookPoint" });
 var HOOK_QUESTION_TYPES = {
   before_sign_up: "hook.before_sign_up",
   before_session: "hook.before_session",
@@ -2397,78 +3016,79 @@ function hookLastCallFailed(lastOutcome) {
 var HOOK_FIELDS = ["url", "enabled", "deadlineMs", "failureMode"];
 var HOOK_MAX_DENIAL_CODE_LENGTH = 64;
 var HOOK_DENIAL_CODE_PATTERN = /^[a-z0-9_]{1,64}$/;
-var url2 = () => z16.string().min(1).max(MAX_WEBHOOK_URL_LENGTH).regex(/^[^\s\u0000-\u001f\u007f]+$/, "Must not contain spaces or control characters.");
-var deadlineMs = () => z16.number().int().min(HOOK_MIN_DEADLINE_MS).max(HOOK_MAX_DEADLINE_MS);
-var HookRecentOutcomesSchema = z16.object({
-  since: z16.iso.datetime(),
-  allowed: z16.number().int().min(0),
-  denied: z16.number().int().min(0),
-  failed: z16.number().int().min(0),
-  timedOut: z16.number().int().min(0),
-  lastCallAt: z16.iso.datetime().nullable(),
-  lastOutcome: z16.string().nullable()
+var url2 = () => z17.string().min(1).max(MAX_WEBHOOK_URL_LENGTH).regex(/^[^\s\u0000-\u001f\u007f]+$/, "Must not contain spaces or control characters.");
+var deadlineMs = () => z17.number().int().min(HOOK_MIN_DEADLINE_MS).max(HOOK_MAX_DEADLINE_MS);
+var HookRecentOutcomesSchema = z17.object({
+  since: z17.iso.datetime(),
+  allowed: z17.number().int().min(0),
+  denied: z17.number().int().min(0),
+  failed: z17.number().int().min(0),
+  timedOut: z17.number().int().min(0),
+  lastCallAt: z17.iso.datetime().nullable(),
+  lastOutcome: z17.string().nullable()
 }).meta({ ref: "HookRecentOutcomes" });
-var HookSchema = z16.object({
-  id: z16.uuid(),
-  point: z16.string(),
-  url: z16.string(),
-  enabled: z16.boolean(),
-  deadlineMs: z16.number().int(),
-  failureMode: z16.string(),
-  lastFailedAt: z16.iso.datetime().nullable(),
-  lastFailureReason: z16.string().nullable(),
+var HookSchema = z17.object({
+  id: z17.uuid(),
+  point: z17.string(),
+  url: z17.string(),
+  enabled: z17.boolean(),
+  deadlineMs: z17.number().int(),
+  failureMode: z17.string(),
+  lastFailedAt: z17.iso.datetime().nullable(),
+  lastFailureReason: z17.string().nullable(),
   recentOutcomes: HookRecentOutcomesSchema,
-  createdAt: z16.iso.datetime(),
-  updatedAt: z16.iso.datetime()
+  createdAt: z17.iso.datetime(),
+  updatedAt: z17.iso.datetime()
 }).meta({ ref: "Hook" });
 var CreatedHookSchema = HookSchema.extend({
-  secret: z16.string().describe("The signing secret. Store it now: it is shown only once.")
+  secret: z17.string().describe("The signing secret. Store it now: it is shown only once.")
 }).meta({ ref: "CreatedHook" });
-var HookListSchema = z16.object({ data: z16.array(HookSchema) }).meta({ ref: "HookList" });
-var CreateHookRequestSchema = z16.strictObject({
-  point: z16.enum(HOOK_POINTS),
+var HookListSchema = z17.object({ data: z17.array(HookSchema) }).meta({ ref: "HookList" });
+var CreateHookRequestSchema = z17.strictObject({
+  point: z17.enum(HOOK_POINTS),
   url: url2(),
-  enabled: z16.boolean().default(true),
+  enabled: z17.boolean().default(true),
   deadlineMs: deadlineMs().default(HOOK_DEFAULT_DEADLINE_MS),
-  failureMode: z16.enum(HOOK_FAILURE_MODES).default("deny")
+  failureMode: z17.enum(HOOK_FAILURE_MODES).default("deny")
 }).meta({ ref: "CreateHookRequest" });
-var UpdateHookRequestSchema = z16.strictObject({
+var UpdateHookRequestSchema = z17.strictObject({
   url: url2().optional(),
-  enabled: z16.boolean().optional(),
+  enabled: z17.boolean().optional(),
   deadlineMs: deadlineMs().optional(),
-  failureMode: z16.enum(HOOK_FAILURE_MODES).optional()
+  failureMode: z17.enum(HOOK_FAILURE_MODES).optional()
 }).refine((update) => Object.values(update).some((value) => value !== undefined), {
   message: "Name at least one field to change."
 }).meta({ ref: "UpdateHookRequest" });
 var HOOK_SIGN_UP_METHODS = [
   "password",
   "passwordless",
-  ...OAUTH_PROVIDERS.map((provider) => `oauth_${provider}`)
+  ...OAUTH_PROVIDERS.map((provider) => `oauth_${provider}`),
+  "sso"
 ];
-var HookBeforeSignUpDataSchema = z16.strictObject({
-  email: z16.string().min(3).max(320).nullable(),
-  method: z16.enum(HOOK_SIGN_UP_METHODS),
+var HookBeforeSignUpDataSchema = z17.strictObject({
+  email: z17.string().min(3).max(320).nullable(),
+  method: z17.enum(HOOK_SIGN_UP_METHODS),
   client: SessionClientSchema,
-  ipAddress: z16.string().max(64).nullable()
+  ipAddress: z17.string().max(64).nullable()
 }).meta({
   ref: "HookBeforeSignUpData",
   description: "What a hook is told about a sign-up before the account is created."
 });
-var id = () => z16.uuid();
-var profile = () => z16.string().min(1).max(32);
-var amr = () => z16.array(z16.string().regex(/^[a-z][a-z0-9_]{0,31}$/)).max(16);
-var HookBeforeSessionDataSchema = z16.strictObject({
+var id = () => z17.uuid();
+var profile = () => z17.string().min(1).max(32);
+var amr = () => z17.array(z17.string().regex(/^[a-z][a-z0-9_]{0,31}$/)).max(16);
+var HookBeforeSessionDataSchema = z17.strictObject({
   userId: id(),
   client: SessionClientSchema,
   profile: profile(),
   amr: amr(),
-  signUp: z16.boolean(),
-  ipAddress: z16.string().max(64).nullable()
+  signUp: z17.boolean(),
+  ipAddress: z17.string().max(64).nullable()
 }).meta({
   ref: "HookBeforeSessionData",
   description: "What a hook is told about a sign-in before its session is created."
 });
-var HookBeforeTokenDataSchema = z16.strictObject({
+var HookBeforeTokenDataSchema = z17.strictObject({
   userId: id(),
   sessionId: id(),
   client: SessionClientSchema,
@@ -2479,11 +3099,11 @@ var HookBeforeTokenDataSchema = z16.strictObject({
   description: "What a hook is told about a session before its token is issued."
 });
 function question(point, data, meta) {
-  return z16.strictObject({
-    id: z16.uuid(),
-    type: z16.literal(HOOK_QUESTION_TYPES[point]),
-    schemaVersion: z16.literal(HOOK_SCHEMA_VERSION),
-    occurredAt: z16.iso.datetime(),
+  return z17.strictObject({
+    id: z17.uuid(),
+    type: z17.literal(HOOK_QUESTION_TYPES[point]),
+    schemaVersion: z17.literal(HOOK_SCHEMA_VERSION),
+    occurredAt: z17.iso.datetime(),
     data
   }).meta(meta);
 }
@@ -2501,7 +3121,7 @@ var HOOK_QUESTION_SCHEMAS = {
     description: "What the server posts, signed, to the hook registered for `before_token`, when a session is created and each time its user proves a factor again. The answer is the claims the session’s tokens carry until the next question. Not an event."
   })
 };
-var HookQuestionSchema = z16.discriminatedUnion("type", [
+var HookQuestionSchema = z17.discriminatedUnion("type", [
   HOOK_QUESTION_SCHEMAS.before_sign_up,
   HOOK_QUESTION_SCHEMAS.before_session,
   HOOK_QUESTION_SCHEMAS.before_token
@@ -2547,15 +3167,15 @@ var HOOK_QUESTION_FIXTURES = {
     }
   }
 };
-var HookAnswerSchema = z16.discriminatedUnion("decision", [
-  z16.strictObject({ decision: z16.literal("allow") }),
-  z16.strictObject({
-    decision: z16.literal("deny"),
-    code: z16.string().regex(HOOK_DENIAL_CODE_PATTERN).optional()
+var HookAnswerSchema = z17.discriminatedUnion("decision", [
+  z17.strictObject({ decision: z17.literal("allow") }),
+  z17.strictObject({
+    decision: z17.literal("deny"),
+    code: z17.string().regex(HOOK_DENIAL_CODE_PATTERN).optional()
   })
 ]).meta({ ref: "HookAnswer" });
-var HookClaimsAnswerSchema = z16.strictObject({
-  claims: z16.record(z16.string(), z16.union([z16.string(), z16.number(), z16.boolean()])).refine((claims) => ("claims" in checkCustomClaims2(claims)), {
+var HookClaimsAnswerSchema = z17.strictObject({
+  claims: z17.record(z17.string(), z17.union([z17.string(), z17.number(), z17.boolean()])).refine((claims) => ("claims" in checkCustomClaims2(claims)), {
     message: `Every key must be a custom claim key that is not reserved, every value one string, number or boolean, and the whole at most ${MAX_CUSTOM_CLAIMS_BYTES2} bytes as JSON.`
   })
 }).meta({ ref: "HookClaimsAnswer" });
@@ -2589,7 +3209,7 @@ function hookWeakenings(was, is) {
 }
 
 // src/native-app.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var NATIVE_APP_PLATFORMS = ["ios", "android"];
 var MAX_NATIVE_APPS = 20;
 var MAX_CERT_FINGERPRINTS = 10;
@@ -2637,47 +3257,47 @@ function androidApkKeyHashOrigin(fingerprint) {
   const base64url = base64.replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
   return `${ANDROID_APK_KEY_HASH_PREFIX}${base64url}`;
 }
-var teamId = () => z17.string().regex(APPLE_TEAM_ID_PATTERN, "Must be the ten upper-case letters and digits of an Apple team.");
-var bundleId = () => z17.string().max(MAX_BUNDLE_ID_LENGTH).regex(BUNDLE_ID_PATTERN, "Must be a bundle id such as com.example.app: letters, digits and hyphens in segments joined by periods.");
-var packageName = () => z17.string().max(MAX_PACKAGE_NAME_LENGTH).regex(PACKAGE_NAME_PATTERN, "Must be a package name such as com.example.app: two or more segments joined by periods, each starting with a letter.");
-var fingerprints = () => z17.array(z17.string().max(95).regex(CERT_FINGERPRINT_INPUT_PATTERN, "Must be a SHA-256 fingerprint: 32 bytes as hex, with or without colons.")).min(1).max(MAX_CERT_FINGERPRINTS).refine((list) => normalizeCertFingerprints(list).length === list.length, {
+var teamId = () => z18.string().regex(APPLE_TEAM_ID_PATTERN, "Must be the ten upper-case letters and digits of an Apple team.");
+var bundleId = () => z18.string().max(MAX_BUNDLE_ID_LENGTH).regex(BUNDLE_ID_PATTERN, "Must be a bundle id such as com.example.app: letters, digits and hyphens in segments joined by periods.");
+var packageName = () => z18.string().max(MAX_PACKAGE_NAME_LENGTH).regex(PACKAGE_NAME_PATTERN, "Must be a package name such as com.example.app: two or more segments joined by periods, each starting with a letter.");
+var fingerprints = () => z18.array(z18.string().max(95).regex(CERT_FINGERPRINT_INPUT_PATTERN, "Must be a SHA-256 fingerprint: 32 bytes as hex, with or without colons.")).min(1).max(MAX_CERT_FINGERPRINTS).refine((list) => normalizeCertFingerprints(list).length === list.length, {
   message: "Name each fingerprint once."
 });
-var appLinkPaths = () => z17.array(z17.string().max(MAX_APP_LINK_PATH_LENGTH).refine(isAppLinkPath, {
+var appLinkPaths = () => z18.array(z18.string().max(MAX_APP_LINK_PATH_LENGTH).refine(isAppLinkPath, {
   message: "Must be one exact path such as /oauth/callback: letters, digits and . _ ~ - in segments after a slash, with no wildcard, query or trailing slash."
 })).max(MAX_APP_LINK_PATHS).refine((list) => new Set(list).size === list.length, { message: "Name each path once." });
 var NATIVE_APP_FIELDS = ["teamId", "sha256CertFingerprints", "appLinkPaths"];
-var stamps = { id: z17.uuid(), createdAt: z17.iso.datetime(), updatedAt: z17.iso.datetime() };
-var IosAppSchema = z17.object({
+var stamps = { id: z18.uuid(), createdAt: z18.iso.datetime(), updatedAt: z18.iso.datetime() };
+var IosAppSchema = z18.object({
   ...stamps,
-  platform: z17.literal("ios"),
-  teamId: z17.string(),
-  bundleId: z17.string(),
-  appLinkPaths: z17.array(z17.string())
+  platform: z18.literal("ios"),
+  teamId: z18.string(),
+  bundleId: z18.string(),
+  appLinkPaths: z18.array(z18.string())
 }).meta({ ref: "IosApp" });
-var AndroidAppSchema = z17.object({
+var AndroidAppSchema = z18.object({
   ...stamps,
-  platform: z17.literal("android"),
-  packageName: z17.string(),
-  sha256CertFingerprints: z17.array(z17.string()),
-  appLinkPaths: z17.array(z17.string())
+  platform: z18.literal("android"),
+  packageName: z18.string(),
+  sha256CertFingerprints: z18.array(z18.string()),
+  appLinkPaths: z18.array(z18.string())
 }).meta({ ref: "AndroidApp" });
-var NativeAppSchema = z17.discriminatedUnion("platform", [IosAppSchema, AndroidAppSchema]).meta({ ref: "NativeApp" });
-var NativeAppListSchema = z17.object({ data: z17.array(NativeAppSchema) }).meta({ ref: "NativeAppList" });
-var IosAppIdentitySchema = z17.strictObject({
-  platform: z17.literal("ios"),
+var NativeAppSchema = z18.discriminatedUnion("platform", [IosAppSchema, AndroidAppSchema]).meta({ ref: "NativeApp" });
+var NativeAppListSchema = z18.object({ data: z18.array(NativeAppSchema) }).meta({ ref: "NativeAppList" });
+var IosAppIdentitySchema = z18.strictObject({
+  platform: z18.literal("ios"),
   teamId: teamId(),
   bundleId: bundleId(),
   appLinkPaths: appLinkPaths().optional()
 }).meta({ ref: "IosAppIdentity" });
-var AndroidAppIdentitySchema = z17.strictObject({
-  platform: z17.literal("android"),
+var AndroidAppIdentitySchema = z18.strictObject({
+  platform: z18.literal("android"),
   packageName: packageName(),
   sha256CertFingerprints: fingerprints(),
   appLinkPaths: appLinkPaths().optional()
 }).meta({ ref: "AndroidAppIdentity" });
-var CreateNativeAppRequestSchema = z17.discriminatedUnion("platform", [IosAppIdentitySchema, AndroidAppIdentitySchema]).meta({ ref: "CreateNativeAppRequest" });
-var UpdateNativeAppRequestSchema = z17.strictObject({
+var CreateNativeAppRequestSchema = z18.discriminatedUnion("platform", [IosAppIdentitySchema, AndroidAppIdentitySchema]).meta({ ref: "CreateNativeAppRequest" });
+var UpdateNativeAppRequestSchema = z18.strictObject({
   teamId: teamId().optional(),
   sha256CertFingerprints: fingerprints().optional(),
   appLinkPaths: appLinkPaths().optional()
@@ -2686,23 +3306,23 @@ var UpdateNativeAppRequestSchema = z17.strictObject({
 }).meta({ ref: "UpdateNativeAppRequest" });
 var ASSET_LINKS_RELATIONS = ["delegate_permission/common.get_login_creds"];
 var ASSET_LINKS_APP_LINK_RELATION = "delegate_permission/common.handle_all_urls";
-var AppleAppSiteAssociationSchema = z17.strictObject({
-  webcredentials: z17.strictObject({
-    apps: z17.array(z17.string()).min(1)
+var AppleAppSiteAssociationSchema = z18.strictObject({
+  webcredentials: z18.strictObject({
+    apps: z18.array(z18.string()).min(1)
   }).optional(),
-  applinks: z17.strictObject({
-    details: z17.array(z17.strictObject({
-      appIDs: z17.array(z17.string()).length(1),
-      components: z17.array(z17.strictObject({ "/": z17.string() })).min(1)
+  applinks: z18.strictObject({
+    details: z18.array(z18.strictObject({
+      appIDs: z18.array(z18.string()).length(1),
+      components: z18.array(z18.strictObject({ "/": z18.string() })).min(1)
     })).min(1)
   }).optional()
 }).meta({ ref: "AppleAppSiteAssociation" });
-var AssetLinksSchema = z17.array(z17.strictObject({
-  relation: z17.array(z17.string()).min(1),
-  target: z17.strictObject({
-    namespace: z17.literal("android_app"),
-    package_name: z17.string(),
-    sha256_cert_fingerprints: z17.array(z17.string()).min(1)
+var AssetLinksSchema = z18.array(z18.strictObject({
+  relation: z18.array(z18.string()).min(1),
+  target: z18.strictObject({
+    namespace: z18.literal("android_app"),
+    package_name: z18.string(),
+    sha256_cert_fingerprints: z18.array(z18.string()).min(1)
   })
 })).meta({ ref: "AssetLinks" });
 function nativeAppIdentifier(app) {
@@ -2759,7 +3379,7 @@ function nativeAppWeakenings(was, is) {
 }
 
 // src/proposal.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var PROPOSAL_OPERATIONS = [
   "ban_user",
   "unban_user",
@@ -2773,7 +3393,14 @@ var PROPOSAL_OPERATION_TARGETS = {
   end_session: "session",
   disable_oauth_provider: "oauth_provider"
 };
-var PROPOSAL_STATUSES = ["pending", "expired", "approved", "executed", "failed"];
+var PROPOSAL_STATUSES = [
+  "pending",
+  "expired",
+  "approved",
+  "executed",
+  "failed",
+  "rejected"
+];
 var PROPOSAL_FAILURE_REASONS = [
   "target_not_found",
   "error",
@@ -2790,25 +3417,25 @@ var PROPOSAL_APPROVAL_REFUSALS = [
 ];
 var PROPOSAL_CREATION_REFUSALS = ["production_environment"];
 var PROPOSAL_APPROVER_TYPES = ["admin", "instance_admin"];
-var ProposalOperationSchema = z18.enum(PROPOSAL_OPERATIONS).meta({ ref: "ProposalOperation" });
-var ProposalStatusSchema = z18.enum(PROPOSAL_STATUSES).meta({ ref: "ProposalStatus" });
+var ProposalOperationSchema = z19.enum(PROPOSAL_OPERATIONS).meta({ ref: "ProposalOperation" });
+var ProposalStatusSchema = z19.enum(PROPOSAL_STATUSES).meta({ ref: "ProposalStatus" });
 function isProposalTargetId(type, id) {
   const providers = OAUTH_PROVIDERS;
   if (type === "oauth_provider") {
     return providers.includes(id);
   }
-  return id === id.toLowerCase() && z18.uuid().safeParse(id).success;
+  return id === id.toLowerCase() && z19.uuid().safeParse(id).success;
 }
-var ProposalTargetSchema = z18.strictObject({
-  type: z18.enum(PROPOSAL_TARGET_TYPES),
-  id: z18.union([z18.uuid(), z18.enum(OAUTH_PROVIDERS)])
+var ProposalTargetSchema = z19.strictObject({
+  type: z19.enum(PROPOSAL_TARGET_TYPES),
+  id: z19.union([z19.uuid(), z19.enum(OAUTH_PROVIDERS)])
 }).refine((target) => isProposalTargetId(target.type, target.id), {
   path: ["id"],
   message: "must name a target of that type"
 }).meta({ ref: "ProposalTarget" });
-var ProposalApproverSchema = z18.object({
-  type: z18.enum(PROPOSAL_APPROVER_TYPES),
-  id: z18.string().min(1).max(128).nullable()
+var ProposalApproverSchema = z19.object({
+  type: z19.enum(PROPOSAL_APPROVER_TYPES),
+  id: z19.string().min(1).max(128).nullable()
 }).meta({ ref: "ProposalApprover" });
 function targetIsOfOperation(request) {
   return PROPOSAL_OPERATION_TARGETS[request.operation] === request.target.type;
@@ -2817,24 +3444,24 @@ var TARGET_OF_OPERATION = {
   path: ["target", "type"],
   message: "must be the kind of target the operation acts on"
 };
-var CreateProposalRequestSchema = z18.strictObject({ operation: ProposalOperationSchema, target: ProposalTargetSchema }).refine(targetIsOfOperation, TARGET_OF_OPERATION).meta({ ref: "CreateProposalRequest" });
-var ApproveProposalRequestSchema = z18.strictObject({ operation: ProposalOperationSchema, target: ProposalTargetSchema }).refine(targetIsOfOperation, TARGET_OF_OPERATION).meta({ ref: "ApproveProposalRequest" });
-var ProposalSchema = z18.object({
-  id: z18.uuid(),
+var CreateProposalRequestSchema = z19.strictObject({ operation: ProposalOperationSchema, target: ProposalTargetSchema }).refine(targetIsOfOperation, TARGET_OF_OPERATION).meta({ ref: "CreateProposalRequest" });
+var ApproveProposalRequestSchema = z19.strictObject({ operation: ProposalOperationSchema, target: ProposalTargetSchema }).refine(targetIsOfOperation, TARGET_OF_OPERATION).meta({ ref: "ApproveProposalRequest" });
+var ProposalSchema = z19.object({
+  id: z19.uuid(),
   operation: ProposalOperationSchema,
   target: ProposalTargetSchema,
-  summary: z18.string(),
+  summary: z19.string(),
   status: ProposalStatusSchema,
-  proposedBy: z18.object({ type: z18.literal("agent"), id: z18.uuid() }),
-  createdAt: z18.iso.datetime(),
-  expiresAt: z18.iso.datetime(),
+  proposedBy: z19.object({ type: z19.literal("agent"), id: z19.uuid() }),
+  createdAt: z19.iso.datetime(),
+  expiresAt: z19.iso.datetime(),
   approvedBy: ProposalApproverSchema.nullable(),
-  approvedAt: z18.iso.datetime().nullable(),
-  failureReason: z18.enum(PROPOSAL_FAILURE_REASONS).nullable(),
-  expiryReason: z18.enum(PROPOSAL_EXPIRY_REASONS).nullable(),
-  changed: z18.boolean().optional()
+  approvedAt: z19.iso.datetime().nullable(),
+  failureReason: z19.enum(PROPOSAL_FAILURE_REASONS).nullable(),
+  expiryReason: z19.enum(PROPOSAL_EXPIRY_REASONS).nullable(),
+  changed: z19.boolean().optional()
 }).meta({ ref: "Proposal" });
-var ProposalListSchema = z18.object({ data: z18.array(ProposalSchema) }).meta({ ref: "ProposalList" });
+var ProposalListSchema = z19.object({ data: z19.array(ProposalSchema) }).meta({ ref: "ProposalList" });
 var SUMMARIES = {
   ban_user: (id) => `Ban the user ${id}: every session of theirs ends now, and they cannot sign in until an administrator lifts the ban.`,
   unban_user: (id) => `Lift the ban on the user ${id}: they can sign in again. The sessions that ended when they were banned stay ended.`,
@@ -2848,6 +3475,29 @@ function proposalSummary(operation, target) {
   return SUMMARIES[operation](target.id);
 }
 
+// src/sso.ts
+var SSO_CONNECTION_STATUSES = ["draft", "active", "disabled"];
+var SSO_PROTOCOLS = ["oidc", "saml"];
+var SSO_CONNECTION_FIELDS = [
+  "name",
+  "issuer",
+  "clientId",
+  "clientSecret",
+  "saml",
+  "defaultRole",
+  "enforced",
+  "breakGlassRole",
+  "trustIdpMfa",
+  "domains",
+  "status",
+  "attributeMapping",
+  "groupRoles",
+  "test"
+];
+var MAX_SSO_CONNECTION_DOMAINS = 20;
+var MAX_SAML_CERTIFICATES = 2;
+var MAX_SSO_GROUP_ROLES = 100;
+
 // src/test-address.ts
 var TEST_ADDRESS_DOMAIN = "test.tula.invalid";
 var TEST_ADDRESS_LOCAL_PREFIX = "tula-test-";
@@ -2892,12 +3542,13 @@ function testSignInAllowed(setting, kind) {
 }
 
 // src/tokens.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 var ACCESS_TOKEN_VERSION = 1;
 var ACCESS_TOKEN_ALGORITHM = "EdDSA";
 var PUBLISHABLE_KEY_PREFIX = "tula_pk_";
 var SECRET_KEY_PREFIX = "tula_sk_";
 var AGENT_KEY_PREFIX = "tula_ak_";
+var SCIM_TOKEN_PREFIX = "tula_scim_";
 var AUTHENTICATION_METHODS = [
   "pwd",
   "email",
@@ -2910,36 +3561,42 @@ var AUTHENTICATION_METHODS = [
   "user"
 ];
 var STEP_UP_MAX_AGE_SECONDS = 600;
-var AccessTokenClaimsSchema = z19.object({
-  iss: z19.string(),
-  sub: z19.string(),
-  aud: z19.string(),
-  sid: z19.string(),
-  pid: z19.string(),
-  eid: z19.string(),
-  iat: z19.number().int(),
-  exp: z19.number().int(),
-  v: z19.literal(ACCESS_TOKEN_VERSION),
-  auth_time: z19.number().int().optional(),
-  amr: z19.array(z19.string()).optional(),
-  sp: z19.string().optional(),
-  cnf: z19.object({ jkt: z19.string() }).optional(),
-  [CUSTOM_CLAIMS_CLAIM2]: z19.record(z19.string(), z19.union([z19.string(), z19.number(), z19.boolean()])).optional()
+var AccessTokenClaimsSchema = z20.object({
+  iss: z20.string(),
+  sub: z20.string(),
+  aud: z20.string(),
+  sid: z20.string(),
+  pid: z20.string(),
+  eid: z20.string(),
+  iat: z20.number().int(),
+  exp: z20.number().int(),
+  v: z20.literal(ACCESS_TOKEN_VERSION),
+  auth_time: z20.number().int().optional(),
+  amr: z20.array(z20.string()).optional(),
+  sp: z20.string().optional(),
+  cnf: z20.object({ jkt: z20.string() }).optional(),
+  [ORGANIZATION_ID_CLAIM2]: z20.string().optional(),
+  [SSO_CONNECTION_CLAIM2]: z20.string().optional(),
+  [ORGANIZATION_ROLE_CLAIM2]: z20.string().optional(),
+  [ORGANIZATION_PERMISSIONS_CLAIM2]: z20.array(z20.string()).optional(),
+  [CUSTOM_CLAIMS_CLAIM2]: z20.record(z20.string(), z20.union([z20.string(), z20.number(), z20.boolean()])).optional()
 }).meta({ ref: "AccessTokenClaims" });
-var JwkSchema = z19.object({
-  kty: z19.literal("OKP"),
-  crv: z19.literal("Ed25519"),
-  x: z19.string(),
-  kid: z19.string(),
-  alg: z19.literal(ACCESS_TOKEN_ALGORITHM),
-  use: z19.literal("sig")
+var JwkSchema = z20.object({
+  kty: z20.literal("OKP"),
+  crv: z20.literal("Ed25519"),
+  x: z20.string(),
+  kid: z20.string(),
+  alg: z20.literal(ACCESS_TOKEN_ALGORITHM),
+  use: z20.literal("sig")
 }).meta({ ref: "Jwk" });
-var JwksSchema = z19.object({ keys: z19.array(JwkSchema) }).meta({ ref: "Jwks" });
+var JwksSchema = z20.object({ keys: z20.array(JwkSchema) }).meta({ ref: "Jwks" });
+var SETUP_LINK_TOKEN_PREFIX = "tula_setup_";
 
 // src/events.ts
-var id2 = () => z20.uuid();
+var id2 = () => z21.uuid();
+var DomainName = z21.string().max(MAX_DOMAIN_LENGTH2).regex(DOMAIN_PATTERN2);
 function data(name, description, shape) {
-  return z20.object(shape).meta({ ref: `${name}EventData`, description });
+  return z21.object(shape).meta({ ref: `${name}EventData`, description });
 }
 function proposalIsWhole(change) {
   return change.proposalId === undefined === (change.approvedBy === undefined);
@@ -2955,11 +3612,11 @@ function passkeyRemovalIsWhole(removal) {
   return removal.method === "user" ? named && !outcome : outcome && !named;
 }
 var provider = OAuthProviderSchema;
-var dependentAccounts = z20.number().int().min(0).max(DEPENDENT_ACCOUNTS_SCAN_LIMIT);
+var dependentAccounts = z21.number().int().min(0).max(DEPENDENT_ACCOUNTS_SCAN_LIMIT);
 var proposed2 = {
-  operation: z20.enum(PROPOSAL_OPERATIONS),
-  targetType: z20.enum(PROPOSAL_TARGET_TYPES),
-  targetId: z20.union([id2(), provider])
+  operation: z21.enum(PROPOSAL_OPERATIONS),
+  targetType: z21.enum(PROPOSAL_TARGET_TYPES),
+  targetId: z21.union([id2(), provider])
 };
 var WEBHOOK_ENDPOINT_FIELDS = ["url", "eventTypes", "enabled"];
 var WEBHOOK_DISABLED_REASONS = ["failing", "gone"];
@@ -2967,7 +3624,7 @@ var MAX_CHANGED_SETTINGS = 256;
 var MAX_SETTING_NAME_LENGTH = 128;
 var EVENT_DATA_SCHEMAS = {
   "user.created": data("UserCreated", "A user account was created.", {
-    method: z20.enum([
+    method: z21.enum([
       "admin",
       "sign_up",
       "oauth_google",
@@ -2977,55 +3634,66 @@ var EVENT_DATA_SCHEMAS = {
       "oauth_discord",
       "oauth_linkedin",
       "oauth_x",
-      "oauth_facebook"
+      "oauth_facebook",
+      "sso",
+      "scim"
     ]),
-    emailVerified: z20.boolean(),
-    passwordless: z20.boolean().optional(),
-    hookBypassed: z20.boolean().optional(),
-    test: z20.boolean().optional()
+    emailVerified: z21.boolean(),
+    passwordless: z21.boolean().optional(),
+    hookBypassed: z21.boolean().optional(),
+    test: z21.boolean().optional()
+  }),
+  "user.imported": data("UserImported", "A user account was created by an import.", {
+    emailVerified: z21.boolean(),
+    passwordless: z21.boolean().optional(),
+    passwordAlgorithm: z21.enum(["bcrypt", "argon2id", "argon2i", "pbkdf2_sha256", "firebase_scrypt"]).optional()
   }),
   "user.email_verified": data("UserEmailVerified", "A user proved their email address.", {}),
-  "user.banned": z20.object({
+  "user.banned": z21.object({
     proposalId: id2().optional(),
     approvedBy: ProposalApproverSchema.optional()
   }).refine(proposalIsWhole, PROPOSAL_IS_WHOLE).meta({
     ref: "UserBannedEventData",
     description: "A user was banned; their sessions end. With `proposalId` and `approvedBy` (both or neither) when the ban carried out an agent’s proposal a human approved."
   }),
-  "user.unbanned": z20.object(carriedOut()).refine(proposalIsWhole, PROPOSAL_IS_WHOLE).meta({
+  "user.unbanned": z21.object(carriedOut()).refine(proposalIsWhole, PROPOSAL_IS_WHOLE).meta({
     ref: "UserUnbannedEventData",
     description: "A user’s ban was lifted. With `proposalId` and `approvedBy` (both or neither) when that carried out an agent’s proposal a human approved."
   }),
   "user.deleted": data("UserDeleted", "A user account was deleted.", {}),
   "user.password_changed": data("UserPasswordChanged", "A user’s password was set, replaced or removed.", {
-    method: z20.enum(["admin_reset", "self", "reset", "email_verification"]),
-    created: z20.boolean().optional(),
-    removed: z20.boolean().optional()
+    method: z21.enum(["admin_reset", "self", "reset", "email_verification"]),
+    created: z21.boolean().optional(),
+    removed: z21.boolean().optional()
   }),
   "user.mfa_enabled": data("UserMfaEnabled", "A user turned two-step verification on.", {
-    method: z20.enum(["totp"])
+    method: z21.enum(["totp"])
   }),
   "user.mfa_disabled": data("UserMfaDisabled", "A user’s two-step verification was removed.", {
-    method: z20.enum(["self", "admin_reset", "enrolment_incomplete"])
+    method: z21.enum(["self", "admin_reset", "enrolment_incomplete"])
   }),
   "user.backup_codes_regenerated": data("UserBackupCodesRegenerated", "A user replaced their backup codes; the earlier set no longer works.", {}),
   "user.backup_code_used": data("UserBackupCodeUsed", "A user proved their second factor with a backup code.", {}),
   "user.identity_linked": data("UserIdentityLinked", "A provider account was connected to a user.", {
     provider,
-    method: z20.enum(["auto", "profile"])
+    method: z21.enum(["auto", "profile"])
+  }),
+  "user.sso_linked": data("UserSsoLinked", "An account was given its identity at a single sign-on connection (ADR 0067).", {
+    connectionId: id2(),
+    method: z21.enum(["email", "provisioned"])
   }),
   "user.identity_unlinked": data("UserIdentityUnlinked", "A provider account was disconnected from a user.", { provider }),
   "user.passkey_added": data("UserPasskeyAdded", "A user registered a passkey.", {
     passkeyId: id2(),
-    synced: z20.boolean()
+    synced: z21.boolean()
   }),
   "user.passkey_renamed": data("UserPasskeyRenamed", "A user renamed a passkey.", {
     passkeyId: id2()
   }),
-  "user.passkey_removed": z20.object({
-    method: z20.enum(["user", "admin_reset"]),
+  "user.passkey_removed": z21.object({
+    method: z21.enum(["user", "admin_reset"]),
     passkeyId: id2().optional(),
-    canStillSignIn: z20.boolean().optional()
+    canStillSignIn: z21.boolean().optional()
   }).refine(passkeyRemovalIsWhole, {
     message: "`passkeyId` goes with `user`, `canStillSignIn` with `admin_reset`"
   }).meta({
@@ -3034,25 +3702,25 @@ var EVENT_DATA_SCHEMAS = {
   }),
   "user.passkey_counter_regressed": data("UserPasskeyCounterRegressed", "A passkey’s signature counter did not grow: it may have been cloned. The sign-in was refused.", { passkeyId: id2() }),
   "user.email_added": data("UserEmailAdded", "An email address was stored on a user who had none. The address is not in the event.", {
-    method: z20.enum(["self", "admin"]),
-    verified: z20.boolean()
+    method: z21.enum(["self", "admin"]),
+    verified: z21.boolean()
   }),
   "user.phone_number_added": data("UserPhoneNumberAdded", "A user verified a phone number, which is now the account’s (replacing an earlier one).", {}),
   "user.phone_number_removed": data("UserPhoneNumberRemoved", "A user took the phone number off their account.", {}),
   "user.sms_factor_enabled": data("UserSmsFactorEnabled", "A user made a code texted to their phone number their second factor.", {}),
   "user.sms_factor_removed": data("UserSmsFactorRemoved", "A texted code is no longer a user’s second factor.", {
-    method: z20.enum(["self", "admin_reset", "phone_number_removed", "phone_number_changed"])
+    method: z21.enum(["self", "admin_reset", "phone_number_removed", "phone_number_changed"])
   }),
   "session.created": data("SessionCreated", "A user signed in.", {
     userId: id2(),
     client: SessionClientSchema,
-    hookBypassed: z20.boolean().optional(),
-    claimsHookBypassed: z20.boolean().optional(),
-    deviceBound: z20.boolean().optional()
+    hookBypassed: z21.boolean().optional(),
+    claimsHookBypassed: z21.boolean().optional(),
+    deviceBound: z21.boolean().optional()
   }),
-  "session.revoked": z20.object({
+  "session.revoked": z21.object({
     userId: id2(),
-    reason: z20.enum([
+    reason: z21.enum([
       "sign_out",
       "revoked_by_user",
       "revoked_by_admin",
@@ -3066,32 +3734,32 @@ var EVENT_DATA_SCHEMAS = {
     ref: "SessionRevokedEventData",
     description: "A session was ended before it expired. With `proposalId` and `approvedBy` (both or neither) when ending it carried out an agent’s proposal a human approved."
   }),
-  "session.reuse_detected": data("SessionReuseDetected", "A rotated refresh token was presented again: the session was ended as possibly stolen.", { userId: id2(), reason: z20.literal("reuse_detected") }),
+  "session.reuse_detected": data("SessionReuseDetected", "A rotated refresh token was presented again: the session was ended as possibly stolen.", { userId: id2(), reason: z21.literal("reuse_detected") }),
   "session.stepped_up": data("SessionSteppedUp", "A signed-in user proved a factor again for a session.", {
     userId: id2(),
-    methods: z20.array(z20.enum(AUTHENTICATION_METHODS)).max(AUTHENTICATION_METHODS.length),
-    claimsHookBypassed: z20.boolean().optional()
+    methods: z21.array(z21.enum(AUTHENTICATION_METHODS)).max(AUTHENTICATION_METHODS.length),
+    claimsHookBypassed: z21.boolean().optional()
   }),
   "session.refresh_proof_refused": data("SessionRefreshProofRefused", "A refresh of a device-bound session came without a valid proof of its key. The session was not ended and no token was rotated.", {
     userId: id2(),
-    reason: z20.enum(["missing", "invalid", "wrong_key", "replayed"]),
-    suppressedInPreviousMinute: z20.number().int().min(0)
+    reason: z21.enum(["missing", "invalid", "wrong_key", "replayed"]),
+    suppressedInPreviousMinute: z21.number().int().min(0)
   }),
   "api_key.created": data("ApiKeyCreated", "An API key was created.", {
-    kind: z20.enum(["publishable", "secret", "agent"])
+    kind: z21.enum(["publishable", "secret", "agent"])
   }),
   "api_key.revoked": data("ApiKeyRevoked", "An API key was revoked.", {}),
   "signing_key.rotated": data("SigningKeyRotated", "An environment’s access-token signing keys were rotated. The target is the new active key.", { retiredKeyId: id2(), nextKeyId: id2() }),
   "environment.settings_updated": data("EnvironmentSettingsUpdated", "An environment’s settings were replaced.", {
-    revision: z20.number().int().positive(),
-    changed: z20.array(z20.string().max(MAX_SETTING_NAME_LENGTH).regex(/^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*$/)).max(MAX_CHANGED_SETTINGS),
-    weakened: z20.boolean().optional(),
-    managedBy: z20.string().regex(CONFIG_TOOL_PATTERN).nullable().optional(),
-    outsideConfig: z20.boolean().optional()
+    revision: z21.number().int().positive(),
+    changed: z21.array(z21.string().max(MAX_SETTING_NAME_LENGTH).regex(/^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*$/)).max(MAX_CHANGED_SETTINGS),
+    weakened: z21.boolean().optional(),
+    managedBy: z21.string().regex(CONFIG_TOOL_PATTERN).nullable().optional(),
+    outsideConfig: z21.boolean().optional()
   }),
-  "oauth_provider.updated": z20.object({
+  "oauth_provider.updated": z21.object({
     provider,
-    changed: z20.array(z20.enum([
+    changed: z21.array(z21.enum([
       "clientId",
       "secret",
       "teamId",
@@ -3100,11 +3768,11 @@ var EVENT_DATA_SCHEMAS = {
       "additionalClientIds",
       "enabled"
     ])).max(7),
-    created: z20.boolean().optional(),
-    additionalClientIdCount: z20.number().int().min(0).max(MAX_ADDITIONAL_CLIENT_IDS).optional(),
-    weakened: z20.boolean().optional(),
+    created: z21.boolean().optional(),
+    additionalClientIdCount: z21.number().int().min(0).max(MAX_ADDITIONAL_CLIENT_IDS).optional(),
+    weakened: z21.boolean().optional(),
     dependentAccounts: dependentAccounts.optional(),
-    dependentAccountsIncomplete: z20.boolean().optional(),
+    dependentAccountsIncomplete: z21.boolean().optional(),
     ...carriedOut()
   }).refine(proposalIsWhole, PROPOSAL_IS_WHOLE).meta({
     ref: "OAuthProviderUpdatedEventData",
@@ -3112,132 +3780,306 @@ var EVENT_DATA_SCHEMAS = {
   }),
   "oauth_provider.deleted": data("OAuthProviderDeleted", "An OAuth provider’s credentials were removed.", {
     provider,
-    weakened: z20.boolean().optional(),
+    weakened: z21.boolean().optional(),
     dependentAccounts: dependentAccounts.optional(),
-    dependentAccountsIncomplete: z20.boolean().optional()
+    dependentAccountsIncomplete: z21.boolean().optional()
   }),
   "webhook_endpoint.created": data("WebhookEndpointCreated", "A webhook endpoint was registered. Its address and signing secret are not in the event.", {
-    eventTypes: z20.number().int().min(1).max(ACTIVITY_TYPES2.length),
-    enabled: z20.boolean()
+    eventTypes: z21.number().int().min(1).max(ACTIVITY_TYPES2.length),
+    enabled: z21.boolean()
   }),
   "webhook_endpoint.updated": data("WebhookEndpointUpdated", "A webhook endpoint was changed.", {
-    changed: z20.array(z20.enum(WEBHOOK_ENDPOINT_FIELDS)).min(1).max(WEBHOOK_ENDPOINT_FIELDS.length)
+    changed: z21.array(z21.enum(WEBHOOK_ENDPOINT_FIELDS)).min(1).max(WEBHOOK_ENDPOINT_FIELDS.length)
   }),
   "webhook_endpoint.deleted": data("WebhookEndpointDeleted", "A webhook endpoint was removed; nothing more is delivered to it.", {}),
   "webhook_endpoint.disabled": data("WebhookEndpointDisabled", "The server switched a webhook endpoint off: its deliveries kept failing, or it answered 410 Gone. Nothing is delivered to it until it is switched on again.", {
-    reason: z20.enum(WEBHOOK_DISABLED_REASONS)
+    reason: z21.enum(WEBHOOK_DISABLED_REASONS)
   }),
   "webhook_endpoint.secret_rotated": data("WebhookEndpointSecretRotated", "A webhook endpoint’s signing secret was replaced. Deliveries carry a signature for the new secret and one for the previous secret until the time given; after it, for the new one only. Neither secret, nor any part of one, is in the event.", {
-    rotationOverlapEndsAt: z20.iso.datetime()
+    rotationOverlapEndsAt: z21.iso.datetime()
   }),
   "webhook_endpoint.previous_secret_revoked": data("WebhookEndpointPreviousSecretRevoked", "An administrator ended the overlap of a secret rotation early: the endpoint’s previous signing secret stopped signing at once and was deleted. Deliveries carry a signature for the current secret only.", {}),
   "hook.created": data("HookCreated", "A hook was registered. Its address and signing secret are not in the event.", {
-    point: z20.enum(HOOK_POINTS),
-    enabled: z20.boolean(),
-    failureMode: z20.enum(HOOK_FAILURE_MODES),
-    weakened: z20.boolean().optional()
+    point: z21.enum(HOOK_POINTS),
+    enabled: z21.boolean(),
+    failureMode: z21.enum(HOOK_FAILURE_MODES),
+    weakened: z21.boolean().optional()
   }),
   "hook.updated": data("HookUpdated", "A hook was changed.", {
-    point: z20.enum(HOOK_POINTS),
-    changed: z20.array(z20.enum(HOOK_FIELDS)).min(1).max(HOOK_FIELDS.length),
-    weakened: z20.boolean().optional()
+    point: z21.enum(HOOK_POINTS),
+    changed: z21.array(z21.enum(HOOK_FIELDS)).min(1).max(HOOK_FIELDS.length),
+    weakened: z21.boolean().optional()
   }),
   "hook.deleted": data("HookDeleted", "A hook was removed; it is not asked any more.", {
-    point: z20.enum(HOOK_POINTS),
-    weakened: z20.boolean().optional()
+    point: z21.enum(HOOK_POINTS),
+    weakened: z21.boolean().optional()
   }),
   "native_app.created": data("NativeAppCreated", "A native app was registered: the association files served for the environment name it from now on. Its bundle id or package name, its team and its fingerprints are not in the event.", {
-    platform: z20.enum(NATIVE_APP_PLATFORMS),
-    fingerprints: z20.number().int().min(0).max(MAX_CERT_FINGERPRINTS),
-    appLinkPaths: z20.number().int().min(0).max(MAX_APP_LINK_PATHS).optional(),
-    weakened: z20.boolean().optional()
+    platform: z21.enum(NATIVE_APP_PLATFORMS),
+    fingerprints: z21.number().int().min(0).max(MAX_CERT_FINGERPRINTS),
+    appLinkPaths: z21.number().int().min(0).max(MAX_APP_LINK_PATHS).optional(),
+    weakened: z21.boolean().optional()
   }),
   "native_app.updated": data("NativeAppUpdated", "A registered native app was changed.", {
-    platform: z20.enum(NATIVE_APP_PLATFORMS),
-    changed: z20.array(z20.enum(NATIVE_APP_FIELDS)).min(1).max(NATIVE_APP_FIELDS.length),
-    fingerprints: z20.number().int().min(0).max(MAX_CERT_FINGERPRINTS),
-    appLinkPaths: z20.number().int().min(0).max(MAX_APP_LINK_PATHS).optional(),
-    weakened: z20.boolean().optional()
+    platform: z21.enum(NATIVE_APP_PLATFORMS),
+    changed: z21.array(z21.enum(NATIVE_APP_FIELDS)).min(1).max(NATIVE_APP_FIELDS.length),
+    fingerprints: z21.number().int().min(0).max(MAX_CERT_FINGERPRINTS),
+    appLinkPaths: z21.number().int().min(0).max(MAX_APP_LINK_PATHS).optional(),
+    weakened: z21.boolean().optional()
+  }),
+  "native_app.deleted": data("NativeAppDeleted", "A registered native app was removed: the association files no longer name it.", { platform: z21.enum(NATIVE_APP_PLATFORMS) }),
+  "sso_connection.created": data("SsoConnectionCreated", "A single sign-on connection was created for an organization. Its issuer, client and domains are not in the event.", {
+    protocol: z21.enum(SSO_PROTOCOLS),
+    status: z21.enum(SSO_CONNECTION_STATUSES),
+    domains: z21.number().int().min(0).max(MAX_SSO_CONNECTION_DOMAINS)
+  }),
+  "sso_connection.updated": data("SsoConnectionUpdated", "A single sign-on connection was changed.", {
+    protocol: z21.enum(SSO_PROTOCOLS),
+    changed: z21.array(z21.enum(SSO_CONNECTION_FIELDS)).min(1).max(SSO_CONNECTION_FIELDS.length),
+    status: z21.enum(SSO_CONNECTION_STATUSES),
+    weakened: z21.boolean().optional()
+  }),
+  "sso_connection.deleted": data("SsoConnectionDeleted", "A single sign-on connection was removed.", { protocol: z21.enum(SSO_PROTOCOLS) }),
+  "scim_token.created": data("ScimTokenCreated", "A SCIM token was created for an organization's directory. The token is not in the event.", { organizationId: id2() }),
+  "scim_token.revoked": data("ScimTokenRevoked", "A SCIM token was revoked: the directory it belonged to can no longer provision with it.", { organizationId: id2() }),
+  "setup_link.created": data("SetupLinkCreated", "A setup link was created for an organization (ADR 0067). The token is not in the event.", { organizationId: id2() }),
+  "setup_link.revoked": data("SetupLinkRevoked", "A setup link was revoked: the portal it opened refuses it from the next request.", { organizationId: id2() }),
+  "user.scim_provisioned": data("UserScimProvisioned", "An organization's directory created an account or took over an existing one (ADR 0067).", {
+    organizationId: id2(),
+    method: z21.enum(["created", "linked"])
+  }),
+  "user.scim_updated": data("UserScimUpdated", "An organization's directory changed a user it manages (ADR 0067). Which fields (name, email), never a value.", { organizationId: id2(), changed: z21.array(z21.enum(["name", "email"])) }),
+  "scim_group.created": data("ScimGroupCreated", "An organization's directory pushed a new group. The group's name is not in the event.", { organizationId: id2() }),
+  "scim_group.updated": data("ScimGroupUpdated", "A group of an organization's directory changed. Which fields, never their values.", {
+    organizationId: id2(),
+    changed: z21.array(z21.enum(["displayName", "externalId", "members"]))
+  }),
+  "scim_group.deleted": data("ScimGroupDeleted", "A group of an organization's directory was removed.", { organizationId: id2() }),
+  "organization.created": data("OrganizationCreated", "An organization was created. Its name and slug are not in the event: read the organization by its id.", {}),
+  "organization.updated": data("OrganizationUpdated", "An organization was renamed or its slug changed.", {
+    changed: z21.array(z21.enum(ORGANIZATION_FIELDS)).min(1).max(ORGANIZATION_FIELDS.length)
   }),
-  "native_app.deleted": data("NativeAppDeleted", "A registered native app was removed: the association files no longer name it.", { platform: z20.enum(NATIVE_APP_PLATFORMS) }),
+  "organization.deleted": data("OrganizationDeleted", "An organization was deleted, and its memberships with it. No `organization_membership.removed` event is recorded for them.", {
+    memberships: z21.number().int().min(0)
+  }),
+  "organization_membership.added": data("OrganizationMembershipAdded", "A user became a member of an organization. The target is the membership. `via` is present when it was not an administrator or an invitation that added them: `domain_auto_join` (they signed up with a verified address on a domain set to auto-join) or `domain_suggestion` (they joined an organization their verified address was suggested).", {
+    organizationId: id2(),
+    userId: id2(),
+    role: RoleKeySchema,
+    via: z21.enum(["domain_auto_join", "domain_suggestion"]).optional()
+  }),
+  "organization_membership.role_changed": data("OrganizationMembershipRoleChanged", "A member was given another role. The session of that member carries the new role from its next refresh.", { organizationId: id2(), userId: id2(), role: RoleKeySchema, previousRole: RoleKeySchema }),
+  "organization_membership.removed": data("OrganizationMembershipRemoved", "A member was removed from an organization. The session of that user leaves the organization at its next refresh; the account stays.", { organizationId: id2(), userId: id2(), role: RoleKeySchema }),
+  "organization_role.created": data("OrganizationRoleCreated", "A custom role was defined. No member holds it yet. Read the role by its key for its name and permissions.", { role: RoleKeySchema, permissions: z21.number().int().min(0).max(MAX_PERMISSIONS_PER_ROLE2) }),
+  "organization_role.updated": data("OrganizationRoleUpdated", "A custom role was renamed or its permissions were replaced. Members who hold it carry the new permissions from their next refresh. `weakened` is present, and true, when the role gained a permission.", {
+    role: RoleKeySchema,
+    changed: z21.array(z21.enum(ORGANIZATION_ROLE_FIELDS)).min(1).max(ORGANIZATION_ROLE_FIELDS.length),
+    permissions: z21.number().int().min(0).max(MAX_PERMISSIONS_PER_ROLE2),
+    weakened: z21.literal(true).optional()
+  }),
+  "organization_role.deleted": data("OrganizationRoleDeleted", "A custom role was deleted. No member held it.", { role: RoleKeySchema }),
+  "organization_domain.claimed": data("OrganizationDomainClaimed", "A code was emailed to an address on a domain an organization wants to claim (the first time, or again). Nothing is granted until the code is entered.", { organizationId: id2(), domain: DomainName, mode: z21.enum(ORGANIZATION_DOMAIN_MODES2) }),
+  "organization_domain.verified": data("OrganizationDomainVerified", "An organization verified a domain: users who sign up with a verified address on it are suggested the organization or joined to it, by `mode`, until the verification lapses. `reverified` is present, and true, when the domain was already verified (proven again before or after it lapsed). `weakened` is present, and true, for `auto_join`.", {
+    organizationId: id2(),
+    domain: DomainName,
+    mode: z21.enum(ORGANIZATION_DOMAIN_MODES2),
+    reverified: z21.literal(true).optional(),
+    weakened: z21.literal(true).optional()
+  }),
+  "organization_domain.updated": data("OrganizationDomainUpdated", "What a domain does was changed. `weakened` is present, and true, when the domain now auto-joins.", {
+    organizationId: id2(),
+    domain: DomainName,
+    mode: z21.enum(ORGANIZATION_DOMAIN_MODES2),
+    previousMode: z21.enum(ORGANIZATION_DOMAIN_MODES2),
+    weakened: z21.literal(true).optional()
+  }),
+  "organization_domain.removed": data("OrganizationDomainRemoved", "A domain was removed, verified or not. No future sign-up joins or is suggested the organization because of it; members who joined stay.", { organizationId: id2(), domain: DomainName }),
+  "organization_invitation.created": data("OrganizationInvitationCreated", "Someone was invited to an organization. The target is the invitation; the invited address is not in the event: read the invitation by its id.", { organizationId: id2(), role: RoleKeySchema }),
+  "organization_invitation.accepted": data("OrganizationInvitationAccepted", "An invitation was accepted by the user it was for, who became a member in the same transaction (an `organization_membership.added` event follows it). The actor is that user.", { organizationId: id2(), role: RoleKeySchema, userId: id2() }),
+  "organization_invitation.declined": data("OrganizationInvitationDeclined", "An invitation was declined by the user it was for. The actor is that user.", { organizationId: id2(), role: RoleKeySchema, userId: id2() }),
+  "organization_invitation.revoked": data("OrganizationInvitationRevoked", "A pending invitation was withdrawn: its link no longer works.", { organizationId: id2(), role: RoleKeySchema }),
   "proposal.created": data("ProposalCreated", "An agent asked for a change as a proposal. Nothing has changed: a human has to approve it.", proposed2),
   "proposal.approved": data("ProposalApproved", "A human approved an agent’s proposal. The actor is the human; the operation follows.", {
     ...proposed2,
     proposedBy: id2()
   }),
+  "proposal.rejected": data("ProposalRejected", "A human rejected an agent’s proposal. The actor is the human; nothing was carried out.", {
+    ...proposed2,
+    proposedBy: id2()
+  }),
   "proposal.executed": data("ProposalExecuted", "An approved proposal’s operation was carried out. The actor is the agent that asked.", {
     ...proposed2,
     approvedBy: ProposalApproverSchema,
-    changed: z20.boolean().optional()
+    changed: z21.boolean().optional()
   }),
   "proposal.failed": data("ProposalFailed", "An approved proposal’s operation was not carried out. The proposal is spent all the same.", {
     ...proposed2,
     approvedBy: ProposalApproverSchema,
-    reason: z20.enum(PROPOSAL_FAILURE_REASONS)
+    reason: z21.enum(PROPOSAL_FAILURE_REASONS)
+  }),
+  "audit.exported": data("AuditExported", "An environment’s audit log was exported. The filters are those of the request; `rowCount` is how many entries were written (a stream that ended early counts what it wrote); `resumed` is true when the request continued an earlier export.", {
+    phase: z21.enum(["started", "finished"]).optional(),
+    format: z21.enum(AUDIT_EXPORT_FORMATS),
+    rowCount: z21.number().int().min(0),
+    resumed: z21.boolean(),
+    action: z21.enum(ACTIVITY_TYPES2).optional(),
+    actorId: id2().optional(),
+    actorType: z21.enum(AUDIT_ACTOR_TYPES).optional(),
+    targetId: id2().optional(),
+    organizationId: id2().optional(),
+    from: z21.iso.datetime({ offset: true }).optional(),
+    to: z21.iso.datetime({ offset: true }).optional()
   }),
   "sign_in_test.started": data("SignInTestStarted", "A sign-in test began: the server is about to sign a throwaway user up and in through the environment’s flow, and delete it.", {}),
   "sign_in_test.finished": data("SignInTestFinished", "A sign-in test ended. `userId` is the throwaway user it made (absent when no account was made); `cleanup` says whether that user was deleted.", {
-    outcome: z20.enum(SIGN_IN_TEST_OUTCOMES),
-    cleanup: z20.enum(SIGN_IN_TEST_CLEANUPS),
+    outcome: z21.enum(SIGN_IN_TEST_OUTCOMES),
+    cleanup: z21.enum(SIGN_IN_TEST_CLEANUPS),
     userId: id2().optional()
   })
 };
-var EventActorSchema = z20.object({ type: z20.enum(AUDIT_ACTOR_TYPES), id: z20.string().min(1).max(128).nullable() }).meta({ ref: "EventActor" });
+var EventActorSchema = z21.object({ type: z21.enum(AUDIT_ACTOR_TYPES), id: z21.string().min(1).max(128).nullable() }).meta({ ref: "EventActor" });
 function envelope(type) {
   const details = EVENT_DATA_SCHEMAS[type];
-  const { ref, description } = z20.globalRegistry.get(details) ?? {};
-  return z20.object({
+  const { ref, description } = z21.globalRegistry.get(details) ?? {};
+  return z21.object({
     id: id2(),
-    type: z20.literal(type),
-    schemaVersion: z20.literal(EVENT_SCHEMA_VERSION2),
-    occurredAt: z20.iso.datetime(),
+    type: z21.literal(type),
+    schemaVersion: z21.literal(EVENT_SCHEMA_VERSION2),
+    occurredAt: z21.iso.datetime(),
     actor: EventActorSchema,
-    target: z20.object({ type: z20.literal(EVENT_TARGET_TYPES2[type]), id: id2() }),
+    target: z21.object({ type: z21.literal(EVENT_TARGET_TYPES2[type]), id: id2() }),
     data: details,
-    test: z20.literal(true).optional()
+    test: z21.literal(true).optional()
   }).meta({ ref: String(ref).replace(/Data$/, ""), description });
 }
 var envelopes = ACTIVITY_TYPES2.map((type) => [type, envelope(type)]);
 var EVENT_SCHEMAS = Object.fromEntries(envelopes);
-var TulaEventSchema = z20.discriminatedUnion("type", envelopes.map(([, schema]) => schema)).meta({ ref: "TulaEvent" });
+var TulaEventSchema = z21.discriminatedUnion("type", envelopes.map(([, schema]) => schema)).meta({ ref: "TulaEvent" });
 // src/mfa.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var TOTP_DIGITS = 6;
 var TOTP_PERIOD_SECONDS = 30;
 var BACKUP_CODE_COUNT = 10;
-var FactorsSchema = z21.object({
-  totp: z21.object({ enabled: z21.boolean(), confirmedAt: z21.iso.datetime().nullable() }),
-  backupCodes: z21.object({ remaining: z21.number().int().min(0) }),
-  sms: z21.object({
-    enabled: z21.boolean(),
-    enabledAt: z21.iso.datetime().nullable(),
-    inUse: z21.boolean(),
-    available: z21.boolean()
+var FactorsSchema = z22.object({
+  totp: z22.object({ enabled: z22.boolean(), confirmedAt: z22.iso.datetime().nullable() }),
+  backupCodes: z22.object({ remaining: z22.number().int().min(0) }),
+  sms: z22.object({
+    enabled: z22.boolean(),
+    enabledAt: z22.iso.datetime().nullable(),
+    inUse: z22.boolean(),
+    available: z22.boolean()
   }).optional()
 }).meta({ ref: "Factors" });
-var SmsFactorCodeSchema = z21.object({
-  method: z21.literal("sms_code"),
-  destination: z21.string(),
-  expiresAt: z21.iso.datetime()
+var SmsFactorCodeSchema = z22.object({
+  method: z22.literal("sms_code"),
+  destination: z22.string(),
+  expiresAt: z22.iso.datetime()
 }).meta({ ref: "SmsFactorCode" });
-var SmsFactorConfirmRequestSchema = z21.object({ code: z21.string().regex(/^\d{6}$/) }).meta({ ref: "SmsFactorConfirmRequest" });
-var TotpEnrolmentSchema = z21.object({ secret: z21.string(), uri: z21.string() }).meta({ ref: "TotpEnrolment" });
-var TotpConfirmRequestSchema = z21.object({ code: z21.string().regex(/^\d{6}$/) }).meta({ ref: "TotpConfirmRequest" });
-var BackupCodesSchema = z21.object({ codes: z21.array(z21.string()) }).meta({ ref: "BackupCodes" });
-var StepUpMethodSchema = z21.enum(["password", "totp", "backup_code", "email_code", "passkey", "sms_code"]).meta({ ref: "StepUpMethod" });
-var StepUpRequestSchema = z21.discriminatedUnion("method", [
-  z21.object({ method: z21.literal("password"), password: z21.string().max(1024) }),
-  z21.object({ method: z21.literal("totp"), code: z21.string().regex(/^\d{6}$/) }),
-  z21.object({ method: z21.literal("backup_code"), code: z21.string().min(1).max(64) }),
-  z21.object({ method: z21.literal("email_code"), code: z21.string().regex(/^\d{6}$/) }),
-  z21.object({ method: z21.literal("passkey"), credential: PasskeyAssertionCredentialSchema }),
-  z21.object({ method: z21.literal("sms_code"), code: z21.string().regex(/^\d{6}$/) })
+var SmsFactorConfirmRequestSchema = z22.object({ code: z22.string().regex(/^\d{6}$/) }).meta({ ref: "SmsFactorConfirmRequest" });
+var TotpEnrolmentSchema = z22.object({ secret: z22.string(), uri: z22.string() }).meta({ ref: "TotpEnrolment" });
+var TotpConfirmRequestSchema = z22.object({ code: z22.string().regex(/^\d{6}$/) }).meta({ ref: "TotpConfirmRequest" });
+var BackupCodesSchema = z22.object({ codes: z22.array(z22.string()) }).meta({ ref: "BackupCodes" });
+var StepUpMethodSchema = z22.enum(["password", "totp", "backup_code", "email_code", "passkey", "sms_code"]).meta({ ref: "StepUpMethod" });
+var StepUpRequestSchema = z22.discriminatedUnion("method", [
+  z22.object({ method: z22.literal("password"), password: z22.string().max(1024) }),
+  z22.object({ method: z22.literal("totp"), code: z22.string().regex(/^\d{6}$/) }),
+  z22.object({ method: z22.literal("backup_code"), code: z22.string().min(1).max(64) }),
+  z22.object({ method: z22.literal("email_code"), code: z22.string().regex(/^\d{6}$/) }),
+  z22.object({ method: z22.literal("passkey"), credential: PasskeyAssertionCredentialSchema }),
+  z22.object({ method: z22.literal("sms_code"), code: z22.string().regex(/^\d{6}$/) })
 ]).meta({ ref: "StepUpRequest" });
-var StepUpEmailCodeSchema = z21.object({
-  method: z21.literal("email_code"),
-  destination: z21.string(),
-  expiresAt: z21.iso.datetime()
+var StepUpEmailCodeSchema = z22.object({
+  method: z22.literal("email_code"),
+  destination: z22.string(),
+  expiresAt: z22.iso.datetime()
 }).meta({ ref: "StepUpEmailCode" });
+// src/organization-domain.ts
+import { z as z23 } from "zod";
+var OrganizationDomainNameSchema = z23.string().max(2 * MAX_DOMAIN_LENGTH2).superRefine((domain, context) => {
+  const refusal = domainRefusal2(domain);
+  if (refusal === "grammar") {
+    context.addIssue({
+      code: "custom",
+      message: "a domain is lower-case ASCII letters, digits and hyphens in labels joined by full stops (write an internationalised name in punycode)"
+    });
+  } else if (refusal === "length") {
+    context.addIssue({
+      code: "custom",
+      message: "a domain is at most 253 characters, and each label at most 63"
+    });
+  }
+}).meta({ ref: "OrganizationDomainName" });
+var OrganizationDomainModeSchema = z23.enum(ORGANIZATION_DOMAIN_MODES2).meta({ ref: "OrganizationDomainMode" });
+var OrganizationDomainStatusSchema = z23.enum(ORGANIZATION_DOMAIN_STATUSES2).meta({ ref: "OrganizationDomainStatus" });
+var OrganizationDomainSchema = z23.object({
+  id: z23.string(),
+  domain: z23.string(),
+  mode: OrganizationDomainModeSchema,
+  status: OrganizationDomainStatusSchema,
+  verifiedAt: z23.iso.datetime().nullable(),
+  expiresAt: z23.iso.datetime().nullable(),
+  codeExpiresAt: z23.iso.datetime().nullable(),
+  createdAt: z23.iso.datetime(),
+  updatedAt: z23.iso.datetime()
+}).meta({ ref: "OrganizationDomain" });
+var OrganizationDomainListSchema = z23.object({ data: z23.array(OrganizationDomainSchema) }).meta({ ref: "OrganizationDomainList" });
+var StartOrganizationDomainRequestSchema = z23.strictObject({
+  domain: OrganizationDomainNameSchema,
+  email: z23.string().max(320),
+  mode: OrganizationDomainModeSchema
+}).meta({ ref: "StartOrganizationDomainRequest" });
+var VerifyOrganizationDomainRequestSchema = z23.strictObject({ code: z23.string().regex(/^\d{6}$/) }).meta({ ref: "VerifyOrganizationDomainRequest" });
+var UpdateOrganizationDomainRequestSchema = z23.strictObject({ mode: OrganizationDomainModeSchema }).meta({ ref: "UpdateOrganizationDomainRequest" });
+var OrganizationSuggestionSchema = z23.object({ id: z23.string(), name: z23.string(), slug: z23.string() }).meta({ ref: "OrganizationSuggestion" });
+var OrganizationSuggestionListSchema = z23.object({ data: z23.array(OrganizationSuggestionSchema) }).meta({ ref: "OrganizationSuggestionList" });
+// src/organization-invitation.ts
+import { z as z24 } from "zod";
+var INVITATION_EXPIRY_DAYS = 7;
+var MAX_LINK_FIELD_LENGTH2 = 2048;
+var INVITATION_STATUSES = [
+  "pending",
+  "accepted",
+  "declined",
+  "revoked",
+  "expired"
+];
+var OrganizationInvitationSchema = z24.object({
+  id: z24.string(),
+  organizationId: z24.string(),
+  email: z24.string(),
+  role: z24.string(),
+  status: z24.enum(INVITATION_STATUSES),
+  invitedBy: z24.string().nullable(),
+  expiresAt: z24.iso.datetime(),
+  createdAt: z24.iso.datetime()
+}).meta({ ref: "OrganizationInvitation" });
+var OrganizationInvitationListSchema = z24.object({ meta: PaginationMetaSchema, data: z24.array(OrganizationInvitationSchema) }).meta({ ref: "OrganizationInvitationList" });
+var OrganizationInvitationQuerySchema = z24.object({
+  page: z24.coerce.number().int().min(1).max(1e6).default(1),
+  size: z24.coerce.number().int().min(1).max(MAX_PAGE_SIZE).default(DEFAULT_PAGE_SIZE),
+  status: z24.enum(INVITATION_STATUSES).default("pending")
+}).meta({ ref: "OrganizationInvitationQuery" });
+var CreateOrganizationInvitationRequestSchema = z24.strictObject({
+  email: z24.string().max(320),
+  role: RoleKeySchema,
+  redirectUrl: z24.string().max(MAX_LINK_FIELD_LENGTH2)
+}).meta({ ref: "CreateOrganizationInvitationRequest" });
+var InvitationTokenRequestSchema = z24.strictObject({ token: z24.string().min(1).max(MAX_LINK_FIELD_LENGTH2) }).meta({ ref: "InvitationTokenRequest" });
+var InvitationPreviewSchema = z24.object({
+  organizationName: z24.string(),
+  role: z24.string(),
+  email: z24.string(),
+  expiresAt: z24.iso.datetime()
+}).meta({ ref: "InvitationPreview" });
+var AcceptedInvitationSchema = UserOrganizationSchema.meta({ ref: "AcceptedInvitation" });
+var MyOrganizationInvitationSchema = z24.object({
+  id: z24.string(),
+  organizationName: z24.string(),
+  role: z24.string(),
+  expiresAt: z24.iso.datetime()
+}).meta({ ref: "MyOrganizationInvitation" });
+var MyOrganizationInvitationListSchema = z24.object({ meta: PaginationMetaSchema, data: z24.array(MyOrganizationInvitationSchema) }).meta({ ref: "MyOrganizationInvitationList" });
+var MyOrganizationInvitationQuerySchema = OrganizationPageQuerySchema;
 // src/settings-weakening.ts
 var SWITCHED_RULES = [
   "requireLowercase",
@@ -3382,6 +4224,20 @@ function redirectWeakenings(before, after) {
   const had = new Set(before.allowedRedirectUrls);
   return after.allowedRedirectUrls.some((url) => !had.has(url) && isCustomSchemeRedirectUrl2(url)) ? ["urls.allowedRedirectUrls"] : [];
 }
+function organizationWeakenings(before, after) {
+  const paths = [];
+  if (before.enabled && !after.enabled) {
+    paths.push("organizations.enabled");
+  }
+  if (!before.allowUserCreated && after.allowUserCreated) {
+    paths.push("organizations.allowUserCreated");
+  }
+  const cap = (value) => value ?? Number.POSITIVE_INFINITY;
+  if (cap(after.maxCreatedPerUser) > cap(before.maxCreatedPerUser)) {
+    paths.push("organizations.maxCreatedPerUser");
+  }
+  return paths;
+}
 function settingsWeakenings(before, after) {
   const paths = passwordWeakenings(before.password, after.password);
   if (shorterRetention(before.audit.retentionDays, after.audit.retentionDays)) {
@@ -3413,44 +4269,327 @@ function settingsWeakenings(before, after) {
   if (isAllowed === true && wasAllowed !== true || isAllowed === null && wasAllowed === false) {
     paths.push("agents.testSignIn");
   }
+  paths.push(...organizationWeakenings(before.organizations, after.organizations));
   return paths;
 }
 // src/sign-in-test.ts
-import * as z22 from "zod";
-var SignInTestStepResultSchema = z22.strictObject({
-  step: z22.enum(SIGN_IN_TEST_STEPS),
-  outcome: z22.enum(SIGN_IN_TEST_STEP_OUTCOMES),
-  durationMs: z22.number().int().min(0),
+import * as z25 from "zod";
+var SignInTestStepResultSchema = z25.strictObject({
+  step: z25.enum(SIGN_IN_TEST_STEPS),
+  outcome: z25.enum(SIGN_IN_TEST_STEP_OUTCOMES),
+  durationMs: z25.number().int().min(0),
   code: ErrorCodeSchema.optional(),
-  reason: z22.enum(SIGN_IN_TEST_REASONS).optional()
+  reason: z25.enum(SIGN_IN_TEST_REASONS).optional()
 }).meta({ ref: "SignInTestStepResult" });
-var SignInTestReportSchema = z22.strictObject({
-  outcome: z22.enum(SIGN_IN_TEST_OUTCOMES),
-  steps: z22.array(SignInTestStepResultSchema).length(SIGN_IN_TEST_STEPS.length),
-  userId: z22.uuid().nullable(),
-  cleanup: z22.enum(SIGN_IN_TEST_CLEANUPS)
+var SignInTestReportSchema = z25.strictObject({
+  outcome: z25.enum(SIGN_IN_TEST_OUTCOMES),
+  steps: z25.array(SignInTestStepResultSchema).length(SIGN_IN_TEST_STEPS.length),
+  userId: z25.uuid().nullable(),
+  cleanup: z25.enum(SIGN_IN_TEST_CLEANUPS)
 }).meta({ ref: "SignInTestReport" });
 // src/sms.ts
-import { z as z23 } from "zod";
+import { z as z26 } from "zod";
 var SMS_USAGE_MAX_DAYS = 30;
 var SMS_USAGE_DEFAULT_DAYS = 7;
 var SMS_USAGE_MAX_PREFIXES = 100;
-var count = z23.number().int().min(0);
-var SmsPrefixUsageSchema = z23.object({
-  prefix: z23.string().regex(new RegExp(`^\\+[0-9]{1,${SMS_PREFIX_MAX_DIGITS}}$`)),
+var count = z26.number().int().min(0);
+var SmsPrefixUsageSchema = z26.object({
+  prefix: z26.string().regex(new RegExp(`^\\+[0-9]{1,${SMS_PREFIX_MAX_DIGITS}}$`)),
   sent: count,
   used: count,
   unused: count
 }).meta({ ref: "SmsPrefixUsage" });
-var SmsUsageSchema = z23.object({
-  since: z23.iso.date(),
-  days: z23.number().int().min(1).max(SMS_USAGE_MAX_DAYS),
+var SmsUsageSchema = z26.object({
+  since: z26.iso.date(),
+  days: z26.number().int().min(1).max(SMS_USAGE_MAX_DAYS),
   sent: count,
   used: count,
   unused: count,
-  prefixes: z23.array(SmsPrefixUsageSchema).max(SMS_USAGE_MAX_PREFIXES),
-  truncated: z23.boolean()
+  prefixes: z26.array(SmsPrefixUsageSchema).max(SMS_USAGE_MAX_PREFIXES),
+  truncated: z26.boolean()
 }).meta({ ref: "SmsUsage" });
+// src/sso-attributes.ts
+var SSO_IDP_PRESETS = [
+  "okta",
+  "entra",
+  "google_workspace",
+  "jumpcloud",
+  "onelogin",
+  "ping",
+  "generic"
+];
+var CLAIM = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims";
+var MS_GROUPS = "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups";
+var OIDC_STANDARD = { email: ["email"], firstName: ["given_name"], lastName: ["family_name"] };
+var SSO_ATTRIBUTE_DEFAULTS = {
+  saml: {
+    okta: {
+      email: ["email"],
+      firstName: ["firstName"],
+      lastName: ["lastName"],
+      groups: ["groups"]
+    },
+    entra: {
+      email: [`${CLAIM}/emailaddress`],
+      firstName: [`${CLAIM}/givenname`],
+      lastName: [`${CLAIM}/surname`],
+      groups: [MS_GROUPS]
+    },
+    google_workspace: {
+      email: ["email"],
+      firstName: ["firstName"],
+      lastName: ["lastName"],
+      groups: ["groups"]
+    },
+    jumpcloud: {
+      email: ["email"],
+      firstName: ["firstname"],
+      lastName: ["lastname"],
+      groups: ["memberOf"]
+    },
+    onelogin: {
+      email: ["User.email"],
+      firstName: ["User.FirstName"],
+      lastName: ["User.LastName"],
+      groups: ["memberOf"]
+    },
+    ping: { email: ["mail"], firstName: ["givenName"], lastName: ["sn"], groups: ["memberOf"] },
+    generic: {
+      email: ["email", "mail", `${CLAIM}/emailaddress`, "urn:oid:0.9.2342.19200300.100.1.3"],
+      firstName: ["givenName", "firstName", `${CLAIM}/givenname`],
+      lastName: ["sn", "surname", "lastName", `${CLAIM}/surname`],
+      groups: ["groups", "memberOf", MS_GROUPS]
+    }
+  },
+  oidc: {
+    okta: { ...OIDC_STANDARD, groups: ["groups"] },
+    entra: { ...OIDC_STANDARD, groups: ["groups"] },
+    google_workspace: { ...OIDC_STANDARD, groups: ["groups"] },
+    jumpcloud: { ...OIDC_STANDARD, groups: ["groups"] },
+    onelogin: { ...OIDC_STANDARD, groups: ["groups"] },
+    ping: { ...OIDC_STANDARD, groups: ["memberOf"] },
+    generic: { ...OIDC_STANDARD, groups: ["groups"] }
+  }
+};
+function effectiveAttributeNames(protocol, mapping) {
+  const base = SSO_ATTRIBUTE_DEFAULTS[protocol][mapping?.idp ?? "generic"];
+  return {
+    email: mapping?.email ? [mapping.email] : base.email,
+    firstName: mapping?.firstName ? [mapping.firstName] : base.firstName,
+    lastName: mapping?.lastName ? [mapping.lastName] : base.lastName,
+    groups: mapping?.groups ? [mapping.groups] : base.groups
+  };
+}
+// src/sso-connection.ts
+import { z as z27 } from "zod";
+var Domains = z27.array(OrganizationDomainNameSchema).max(MAX_SSO_CONNECTION_DOMAINS);
+var IssuerSchema = z27.url({ protocol: /^https?$/ }).max(2048);
+var SamlSettingsInputSchema = z27.strictObject({
+  metadataXml: z27.string().min(1).max(512 * 1024).optional(),
+  metadataUrl: z27.url({ protocol: /^https?$/ }).max(2048).optional(),
+  idpEntityId: z27.string().min(1).max(1024).optional(),
+  ssoUrl: z27.url({ protocol: /^https?$/ }).max(2048).optional(),
+  certificates: z27.array(z27.string().min(1).max(16 * 1024)).min(1).max(MAX_SAML_CERTIFICATES).optional()
+}).meta({ ref: "SamlSettingsInput" });
+var SsoAttributeMappingSchema = z27.strictObject({
+  idp: z27.enum(SSO_IDP_PRESETS).optional(),
+  email: z27.string().trim().min(1).max(512).optional(),
+  firstName: z27.string().trim().min(1).max(512).optional(),
+  lastName: z27.string().trim().min(1).max(512).optional(),
+  groups: z27.string().trim().min(1).max(512).optional()
+}).meta({ ref: "SsoAttributeMapping" });
+var SsoGroupRolesSchema = z27.strictObject({
+  mappings: z27.array(z27.strictObject({ group: z27.string().min(1).max(256), role: RoleKeySchema })).max(MAX_SSO_GROUP_ROLES)
+}).meta({ ref: "SsoGroupRoles" });
+var SetupGroupRolesSchema = z27.strictObject({
+  mappings: z27.array(z27.strictObject({
+    group: z27.string().min(1).max(256),
+    role: RoleKeySchema,
+    locked: z27.boolean()
+  }))
+}).meta({ ref: "SetupGroupRoles" });
+var CreateSsoConnectionRequestSchema = z27.strictObject({
+  organizationId: z27.uuid(),
+  protocol: z27.enum(SSO_PROTOCOLS).default("oidc"),
+  name: z27.string().trim().min(1).max(100),
+  issuer: IssuerSchema.optional(),
+  clientId: z27.string().min(1).max(512).optional(),
+  clientSecret: z27.string().min(1).max(4096).optional(),
+  saml: SamlSettingsInputSchema.optional(),
+  attributeMapping: SsoAttributeMappingSchema.optional(),
+  defaultRole: RoleKeySchema.default("member"),
+  domains: Domains.default([])
+}).meta({ ref: "CreateSsoConnectionRequest" });
+var CreateMySsoConnectionRequestSchema = CreateSsoConnectionRequestSchema.omit({
+  organizationId: true
+}).meta({ ref: "CreateMySsoConnectionRequest" });
+var UpdateSsoConnectionRequestSchema = z27.strictObject({
+  name: z27.string().trim().min(1).max(100),
+  issuer: IssuerSchema,
+  clientId: z27.string().min(1).max(512),
+  clientSecret: z27.string().min(1).max(4096),
+  saml: SamlSettingsInputSchema,
+  attributeMapping: SsoAttributeMappingSchema,
+  defaultRole: RoleKeySchema,
+  enforced: z27.boolean(),
+  breakGlassRole: RoleKeySchema.nullable(),
+  trustIdpMfa: z27.boolean(),
+  domains: Domains,
+  status: z27.enum(SSO_CONNECTION_STATUSES)
+}).partial().meta({ ref: "UpdateSsoConnectionRequest" });
+var SamlConnectionViewSchema = z27.object({
+  idpEntityId: z27.string(),
+  ssoUrl: z27.string(),
+  metadataUrl: z27.string().nullable(),
+  certificates: z27.array(z27.object({ fingerprint: z27.string(), notAfter: z27.iso.datetime(), expired: z27.boolean() })),
+  spEntityId: z27.string(),
+  acsUrl: z27.string(),
+  spMetadataUrl: z27.string()
+}).meta({ ref: "SamlConnection" });
+var SsoConnectionSchema = z27.object({
+  id: z27.uuid(),
+  organizationId: z27.uuid(),
+  protocol: z27.enum(SSO_PROTOCOLS),
+  name: z27.string(),
+  status: z27.enum(SSO_CONNECTION_STATUSES),
+  issuer: z27.string(),
+  clientId: z27.string(),
+  clientSecretSet: z27.boolean(),
+  saml: SamlConnectionViewSchema.nullable(),
+  redirectUri: z27.string().nullable(),
+  attributeMapping: SsoAttributeMappingSchema.nullable(),
+  defaultRole: z27.string(),
+  enforced: z27.boolean(),
+  breakGlassRole: z27.string().nullable(),
+  trustIdpMfa: z27.boolean(),
+  domains: z27.array(z27.string()),
+  tested: z27.boolean(),
+  createdAt: z27.iso.datetime(),
+  updatedAt: z27.iso.datetime()
+}).meta({ ref: "SsoConnection" });
+var SsoConnectionListSchema = z27.object({ connections: z27.array(SsoConnectionSchema) }).meta({ ref: "SsoConnectionList" });
+var SsoConnectionListQuerySchema = z27.object({ organizationId: z27.uuid().optional() });
+function ssoWeakenings(current, fields) {
+  const changes = fields;
+  const found = [];
+  const content = Object.keys(changes).filter((key) => changes[key] !== undefined && !["name", "status", "enforced", "breakGlassRole", "trustIdpMfa"].includes(key));
+  if (changes.status === "active") {
+    found.push("activate");
+  }
+  if (current.status === "active" && content.length > 0) {
+    found.push("active_content");
+  }
+  if (changes.enforced === false && current.enforced) {
+    found.push("enforcement_off");
+  }
+  if (changes.trustIdpMfa === true && !current.trustIdpMfa) {
+    found.push("trust_idp_mfa");
+  }
+  if (typeof changes.breakGlassRole === "string" && changes.breakGlassRole !== current.breakGlassRole) {
+    found.push("break_glass_role");
+  }
+  return found;
+}
+var SsoStartRequestSchema = z27.object({ redirectUrl: z27.string().max(2048) }).meta({ ref: "SsoStartRequest" });
+// src/sso-setup-link.ts
+import { z as z28 } from "zod";
+var DEFAULT_SETUP_LINK_DAYS = 7;
+var MAX_SETUP_LINK_DAYS = 30;
+var IssuerSchema2 = z28.url({ protocol: /^https?$/ }).max(2048);
+var SetupLinkSchema = z28.object({
+  id: z28.uuid(),
+  organizationId: z28.uuid(),
+  name: z28.string(),
+  prefix: z28.string().describe("The start of the token, to tell links apart in a list."),
+  expiresAt: z28.iso.datetime(),
+  revokedAt: z28.iso.datetime().nullable(),
+  lastUsedAt: z28.iso.datetime().nullable(),
+  createdAt: z28.iso.datetime()
+}).meta({ ref: "SetupLink" });
+var CreatedSetupLinkSchema = SetupLinkSchema.extend({
+  token: z28.string().describe("The setup token. Shown once; only its hash is stored."),
+  url: z28.string().describe("The address to send to the IT administrator. The token is in its fragment.")
+}).meta({ ref: "CreatedSetupLink" });
+var SetupLinkListSchema = z28.object({ links: z28.array(SetupLinkSchema) }).meta({ ref: "SetupLinkList" });
+var CreateSetupLinkRequestSchema = z28.strictObject({
+  organizationId: z28.uuid(),
+  name: z28.string().trim().min(1).max(100).default("SSO setup"),
+  expiresInDays: z28.number().int().min(1).max(MAX_SETUP_LINK_DAYS).default(DEFAULT_SETUP_LINK_DAYS)
+}).meta({ ref: "CreateSetupLinkRequest" });
+var CreateMySetupLinkRequestSchema = CreateSetupLinkRequestSchema.omit({
+  organizationId: true
+}).meta({ ref: "CreateMySetupLinkRequest" });
+var SetupConnectionCreateSchema = z28.strictObject({
+  protocol: z28.enum(SSO_PROTOCOLS).default("oidc"),
+  name: z28.string().trim().min(1).max(100),
+  issuer: IssuerSchema2.optional(),
+  clientId: z28.string().min(1).max(512).optional(),
+  clientSecret: z28.string().min(1).max(4096).optional(),
+  saml: SamlSettingsInputSchema.optional(),
+  attributeMapping: SsoAttributeMappingSchema.optional(),
+  domains: z28.array(OrganizationDomainNameSchema).max(20).default([])
+}).meta({ ref: "SetupConnectionCreate" });
+var SetupConnectionUpdateSchema = z28.strictObject({
+  name: z28.string().trim().min(1).max(100),
+  issuer: IssuerSchema2,
+  clientId: z28.string().min(1).max(512),
+  clientSecret: z28.string().min(1).max(4096),
+  saml: SamlSettingsInputSchema,
+  attributeMapping: SsoAttributeMappingSchema,
+  domains: z28.array(OrganizationDomainNameSchema).max(20),
+  status: z28.literal("active")
+}).partial().meta({ ref: "SetupConnectionUpdate" });
+var SetupScimTokenCreateSchema = z28.strictObject({ name: z28.string().trim().min(1).max(100) }).meta({ ref: "SetupScimTokenCreate" });
+var SetupPortalSchema = z28.object({
+  organization: z28.object({ id: z28.uuid(), name: z28.string() }),
+  domains: z28.array(z28.string()).describe("The organization’s verified domains."),
+  expiresAt: z28.iso.datetime(),
+  connections: z28.array(SsoConnectionSchema)
+}).meta({ ref: "SetupPortal" });
+// src/sso-test.ts
+import { z as z29 } from "zod";
+var SSO_TEST_REASONS = {
+  wrong_audience: "The response was meant for a different audience. Set the identity provider’s audience (SP entity id) or client id to the values shown for this connection.",
+  wrong_issuer: "The response came from a different issuer than the one saved. Check the identity provider’s entity id or issuer.",
+  wrong_recipient: "The response was addressed to another address than this connection’s assertion consumer service URL. Copy the ACS URL shown here into the identity provider.",
+  unsigned_assertion: "The assertion was not signed. Turn on assertion signing in the identity provider.",
+  signature_invalid: "The signature did not match the saved certificate. Upload the certificate the identity provider currently signs with.",
+  signature_algorithm: "The response was signed with an algorithm that is not accepted. Use RSA with SHA-256.",
+  certificate_not_trusted: "The response was signed with a key that is not one of the saved certificates.",
+  certificate_expired: "The saved signing certificate has expired. Upload the identity provider’s new certificate.",
+  assertion_expired: "The response had already expired. Check that the identity provider’s clock is right and that you finish the sign-in promptly.",
+  clock_skew: "The response is not valid yet. The identity provider’s clock is ahead of this server’s; correct it.",
+  response_not_to_this_request: "The response did not answer this test’s sign-in request (it was started at the identity provider, or is for another request).",
+  replayed: "This response was already used once.",
+  idp_refused: "The identity provider reported that the sign-in failed.",
+  encrypted_assertion: "The assertion was encrypted, which is not supported. Turn off assertion encryption.",
+  malformed_response: "The response could not be read or did not have the shape required (one signed assertion with a subject and conditions).",
+  discovery_failed: "The identity provider’s configuration could not be read, or names an address that is not https.",
+  token_exchange_failed: "The identity provider did not accept the code. Check the client id and the client secret.",
+  no_id_token: "The identity provider’s answer held no ID token.",
+  id_token_invalid: "The ID token could not be verified.",
+  email_missing: "The identity provider sent no email address for the person.",
+  email_outside_domains: "The email address is not on one of the connection’s verified domains, so it would be refused."
+};
+var REASON_CODES = Object.keys(SSO_TEST_REASONS);
+var SsoTestStartRequestSchema = z29.object({ redirectUrl: z29.string().max(2048) }).meta({ ref: "SsoTestStartRequest" });
+var AdminSsoTestStartRequestSchema = z29.object({ redirectUrl: z29.string().max(2048).optional() }).meta({ ref: "AdminSsoTestStartRequest" });
+var SsoTestStartSchema = z29.object({ testId: z29.uuid(), authorizationUrl: z29.string() }).meta({ ref: "SsoTestStart" });
+var SsoTestResultSchema = z29.object({
+  testId: z29.uuid(),
+  status: z29.enum(["pending", "passed", "failed"]),
+  reason: z29.enum(REASON_CODES).nullable(),
+  message: z29.string().nullable(),
+  attributes: z29.array(z29.object({ name: z29.string(), values: z29.array(z29.string()) })),
+  groups: z29.array(z29.string()),
+  mapped: z29.object({
+    email: z29.string().nullable(),
+    givenName: z29.string().nullable(),
+    familyName: z29.string().nullable(),
+    emailOnVerifiedDomain: z29.boolean()
+  }).nullable()
+}).meta({ ref: "SsoTestResult" });
+var SsoTestIdParamSchema = z29.object({ id: z29.uuid(), testId: z29.uuid() });
 export {
   ACCESS_TOKEN_ALGORITHM,
   ACCESS_TOKEN_VERSION,
@@ -3463,20 +4602,29 @@ export {
   ASSET_LINKS_RELATIONS,
   AT_LEAST_ONE_SIGN_IN_METHOD,
   AUDIT_ACTOR_TYPES,
+  AUDIT_EXPORT_FORMATS,
   AUDIT_TARGET_TYPES,
   AUTHENTICATION_METHODS,
+  AcceptedInvitationSchema,
   AccessTokenClaimsSchema,
+  ActiveOrganizationSchema,
   ActivityTypeSchema,
+  AddOrganizationMemberRequestSchema,
   AdditionalClientIdsSchema,
   AdminSessionSchema,
+  AdminSsoTestStartRequestSchema,
   AndroidAppIdentitySchema,
   AndroidAppSchema,
   AppleAppSiteAssociationSchema,
   ApproveProposalRequestSchema,
   AssetLinksSchema,
+  AssignableRoleListSchema,
+  AssignableRoleSchema,
+  AuditExportCursorSchema,
   AuditLogListSchema,
   AuditLogSchema,
   BACKUP_CODE_COUNT,
+  BUILT_IN_ROLES2 as BUILT_IN_ROLES,
   BUILT_IN_SESSION_PROFILES,
   BUNDLE_ID_PATTERN,
   BackupCodesSchema,
@@ -3495,11 +4643,19 @@ export {
   ChangePasswordRequestSchema,
   ClientConfigSchema,
   CreateHookRequestSchema,
+  CreateMySetupLinkRequestSchema,
+  CreateMySsoConnectionRequestSchema,
   CreateNativeAppRequestSchema,
+  CreateOrganizationInvitationRequestSchema,
+  CreateOrganizationRequestSchema,
+  CreateOrganizationRoleRequestSchema,
   CreateProposalRequestSchema,
+  CreateSetupLinkRequestSchema,
+  CreateSsoConnectionRequestSchema,
   CreateUserRequestSchema,
   CreateWebhookEndpointRequestSchema,
   CreatedHookSchema,
+  CreatedSetupLinkSchema,
   CreatedWebhookEndpointSchema,
   CurrentUserSchema,
   DASHBOARD_HEADER2 as DASHBOARD_HEADER,
@@ -3507,14 +4663,21 @@ export {
   DASHBOARD_SESSION_COOKIE2 as DASHBOARD_SESSION_COOKIE,
   DEFAULT_APP_NAME,
   DEFAULT_ENVIRONMENT_SETTINGS,
+  DEFAULT_MAX_ORGANIZATIONS_CREATED_PER_USER,
   DEFAULT_MOBILE_SESSION_PROFILE,
   DEFAULT_PAGE_SIZE,
+  DEFAULT_SETUP_LINK_DAYS,
   DEFAULT_SMS_DAILY_MESSAGE_LIMIT,
   DEFAULT_SPECIAL_CHARS2 as DEFAULT_SPECIAL_CHARS,
   DEFAULT_STEP_UP_AFTER,
   DEFAULT_THEME2 as DEFAULT_THEME,
   DEFAULT_WEB_SESSION_PROFILE,
   DEPENDENT_ACCOUNTS_SCAN_LIMIT,
+  DOMAINS_MANAGE_PERMISSION2 as DOMAINS_MANAGE_PERMISSION,
+  DOMAIN_PATTERN2 as DOMAIN_PATTERN,
+  DOMAIN_REMINDER_DAYS2 as DOMAIN_REMINDER_DAYS,
+  DOMAIN_REVERIFICATION_GRACE_DAYS2 as DOMAIN_REVERIFICATION_GRACE_DAYS,
+  DOMAIN_VERIFICATION_LIFETIME_DAYS2 as DOMAIN_VERIFICATION_LIFETIME_DAYS,
   DPOP_ALGORITHMS2 as DPOP_ALGORITHMS,
   DPOP_HEADER2 as DPOP_HEADER,
   DPOP_NONCE_HEADER2 as DPOP_NONCE_HEADER,
@@ -3555,6 +4718,7 @@ export {
   FactorEnrolmentMethodSchema,
   FactorsSchema,
   FieldErrorSchema,
+  FirebaseScryptParamsSchema,
   FirstFactorAttemptRequestSchema,
   FirstFactorPrepareRequestSchema,
   FirstFactorStrategySchema,
@@ -3592,6 +4756,9 @@ export {
   ID_TOKEN_PROVIDERS,
   INSTANCE_ACTIVITY_TYPES,
   INSTANCE_AUDIT_TARGET_TYPES,
+  INVITATIONS_MANAGE_PERMISSION2 as INVITATIONS_MANAGE_PERMISSION,
+  INVITATION_EXPIRY_DAYS,
+  INVITATION_STATUSES,
   IdTokenExchangeRequestSchema,
   IdTokenProviderSchema,
   IdTokenStartRequestSchema,
@@ -3599,7 +4766,15 @@ export {
   IdentityLinkStartSchema,
   IdentityListSchema,
   IdentitySchema,
+  ImportPasswordSchema,
+  ImportRowResultSchema,
+  ImportSkipReasonSchema,
+  ImportUserRowSchema,
+  ImportUsersRequestSchema,
+  ImportUsersResultSchema,
   InstanceActivityTypeSchema,
+  InvitationPreviewSchema,
+  InvitationTokenRequestSchema,
   IosAppIdentitySchema,
   IosAppSchema,
   JWT_TEMPLATE_SOURCES,
@@ -3615,6 +4790,7 @@ export {
   MAX_APP_LINK_PATHS,
   MAX_APP_LINK_PATH_LENGTH,
   MAX_APP_NAME_LENGTH,
+  MAX_AUDIT_EXPORT_ROWS,
   MAX_AUDIT_RETENTION_DAYS,
   MAX_BUNDLE_ID_LENGTH,
   MAX_CERT_FINGERPRINTS,
@@ -3622,7 +4798,11 @@ export {
   MAX_CUSTOM_CLAIMS_BYTES2 as MAX_CUSTOM_CLAIMS_BYTES,
   MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2 as MAX_CUSTOM_CLAIM_CONSTANT_LENGTH,
   MAX_CUSTOM_CLAIM_KEY_LENGTH2 as MAX_CUSTOM_CLAIM_KEY_LENGTH,
+  MAX_CUSTOM_ROLES2 as MAX_CUSTOM_ROLES,
   MAX_CUSTOM_SESSION_PROFILES,
+  MAX_DOMAINS_PER_ORGANIZATION2 as MAX_DOMAINS_PER_ORGANIZATION,
+  MAX_DOMAIN_LABEL_LENGTH2 as MAX_DOMAIN_LABEL_LENGTH,
+  MAX_DOMAIN_LENGTH2 as MAX_DOMAIN_LENGTH,
   MAX_DPOP_PROOF_LENGTH2 as MAX_DPOP_PROOF_LENGTH,
   MAX_DURATION_MS,
   MAX_EMAIL_BODY_LENGTH2 as MAX_EMAIL_BODY_LENGTH,
@@ -3631,35 +4811,56 @@ export {
   MAX_EMAIL_TEMPLATES_BYTES2 as MAX_EMAIL_TEMPLATES_BYTES,
   MAX_ID_TOKEN_LENGTH,
   MAX_ID_TOKEN_NAME_LENGTH,
+  MAX_IMPORT_METADATA_BYTES,
+  MAX_IMPORT_PASSWORD_PARAMS,
+  MAX_IMPORT_ROWS,
   MAX_JWT_TEMPLATES2 as MAX_JWT_TEMPLATES,
   MAX_JWT_TEMPLATE_CLAIMS2 as MAX_JWT_TEMPLATE_CLAIMS,
   MAX_NATIVE_APPS,
+  MAX_ORGANIZATIONS_CREATED_PER_USER,
+  MAX_ORGANIZATION_CLAIMS_BYTES2 as MAX_ORGANIZATION_CLAIMS_BYTES,
+  MAX_ORGANIZATION_NAME_LENGTH,
+  MAX_ORGANIZATION_PERMISSIONS_CLAIM2 as MAX_ORGANIZATION_PERMISSIONS_CLAIM,
+  MAX_ORGANIZATION_SLUG_LENGTH,
   MAX_PACKAGE_NAME_LENGTH,
   MAX_PAGE_SIZE,
   MAX_PASSKEYS_PER_USER,
   MAX_PASSKEY_NAME_LENGTH,
   MAX_PASSWORD_HISTORY,
+  MAX_PERMISSIONS_PER_ROLE2 as MAX_PERMISSIONS_PER_ROLE,
+  MAX_PERMISSION_KEY_LENGTH2 as MAX_PERMISSION_KEY_LENGTH,
   MAX_PHONE_NUMBER_DIGITS,
   MAX_REUSE_GRACE_PERIOD,
+  MAX_SAML_CERTIFICATES,
   MAX_SESSIONS_PER_USER,
   MAX_SESSION_PROFILE_NAME_LENGTH,
   MAX_SESSION_TIMEOUT,
   MAX_SETTING_NAME_LENGTH,
+  MAX_SETUP_LINK_DAYS,
   MAX_SMS_DAILY_MESSAGE_LIMIT,
   MAX_SMS_TEMPLATE_LENGTH,
+  MAX_SSO_CONNECTION_DOMAINS,
+  MAX_SSO_GROUP_ROLES,
   MAX_STEP_UP_AFTER,
   MAX_VERIFIED_TOKEN_LENGTH,
   MAX_WEBHOOK_ENDPOINTS,
   MAX_WEBHOOK_URL_LENGTH,
+  MEMBERSHIPS_MANAGE_PERMISSION2 as MEMBERSHIPS_MANAGE_PERMISSION,
+  MEMBERSHIPS_READ_PERMISSION2 as MEMBERSHIPS_READ_PERMISSION,
   MICROSOFT_TENANT_ALIASES,
   MIN_ACCESS_TOKEN_TTL,
+  MIN_DOMAIN_LENGTH2 as MIN_DOMAIN_LENGTH,
   MIN_IDLE_TIMEOUT,
+  MIN_ORGANIZATION_SLUG_LENGTH,
   MIN_PASSWORD_MIN_LENGTH,
   MIN_PHONE_NUMBER_DIGITS,
   MIN_REUSE_GRACE_PERIOD,
   MIN_STEP_UP_AFTER,
   MfaPolicySchema,
   MicrosoftTenantSchema,
+  MyOrganizationInvitationListSchema,
+  MyOrganizationInvitationQuerySchema,
+  MyOrganizationInvitationSchema,
   NATIVE_APP_FIELDS,
   NATIVE_APP_PLATFORMS,
   NativeAppListSchema,
@@ -3680,10 +4881,43 @@ export {
   OAuthProviderUpdateSchema,
   OAuthStartRequestSchema,
   OAuthStartSchema,
+  ORGANIZATION_DELETE_PERMISSION2 as ORGANIZATION_DELETE_PERMISSION,
+  ORGANIZATION_DOMAIN_MODES2 as ORGANIZATION_DOMAIN_MODES,
+  ORGANIZATION_DOMAIN_STATUSES2 as ORGANIZATION_DOMAIN_STATUSES,
+  ORGANIZATION_FIELDS,
+  ORGANIZATION_ID_CLAIM2 as ORGANIZATION_ID_CLAIM,
+  ORGANIZATION_INVITATION_TOKEN_PARAM2 as ORGANIZATION_INVITATION_TOKEN_PARAM,
+  ORGANIZATION_MANAGE_PERMISSION2 as ORGANIZATION_MANAGE_PERMISSION,
+  ORGANIZATION_PERMISSIONS_CLAIM2 as ORGANIZATION_PERMISSIONS_CLAIM,
+  ORGANIZATION_ROLE_CLAIM2 as ORGANIZATION_ROLE_CLAIM,
+  ORGANIZATION_ROLE_FIELDS,
+  ORGANIZATION_SLUG_PATTERN,
+  OrganizationDomainListSchema,
+  OrganizationDomainModeSchema,
+  OrganizationDomainNameSchema,
+  OrganizationDomainSchema,
+  OrganizationDomainStatusSchema,
+  OrganizationInvitationListSchema,
+  OrganizationInvitationQuerySchema,
+  OrganizationInvitationSchema,
+  OrganizationListSchema,
+  OrganizationMemberListSchema,
+  OrganizationMemberSchema,
+  OrganizationMembershipListSchema,
+  OrganizationMembershipSchema,
+  OrganizationPageQuerySchema,
+  OrganizationRoleListSchema,
+  OrganizationRoleSchema,
+  OrganizationSchema,
+  OrganizationSearchQuerySchema,
+  OrganizationSlugSchema,
+  OrganizationSuggestionListSchema,
+  OrganizationSuggestionSchema,
   PACKAGE_NAME_PATTERN,
   PASSKEY_ALGORITHMS,
   PASSKEY_CHALLENGE_TTL_MS,
   PASSWORD_POLICY_PRESETS,
+  PERMISSION_KEY_PATTERN2 as PERMISSION_KEY_PATTERN,
   PROPOSAL_APPROVAL_REFUSALS,
   PROPOSAL_APPROVER_TYPES,
   PROPOSAL_CREATION_REFUSALS,
@@ -3693,6 +4927,8 @@ export {
   PROPOSAL_OPERATION_TARGETS,
   PROPOSAL_STATUSES,
   PROPOSAL_TARGET_TYPES,
+  PUBLIC_EMAIL_BRANDS2 as PUBLIC_EMAIL_BRANDS,
+  PUBLIC_EMAIL_DOMAINS2 as PUBLIC_EMAIL_DOMAINS,
   PUBLISHABLE_KEY_HEADER2 as PUBLISHABLE_KEY_HEADER,
   PUBLISHABLE_KEY_PREFIX,
   PaginationMetaSchema,
@@ -3710,6 +4946,7 @@ export {
   PasswordPolicySchema,
   PasswordResetRequestSchema,
   PasswordResetStartRequestSchema,
+  PermissionKeySchema,
   PhoneCodeSentSchema,
   PhoneNumberRequestSchema,
   PhoneNumberVerifyRequestSchema,
@@ -3725,12 +4962,19 @@ export {
   REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM2 as REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM,
   REFRESH_TOKEN_PREFIX,
   RESERVED_CLAIM_NAMES2 as RESERVED_CLAIM_NAMES,
+  ROLE_KEY_PATTERN2 as ROLE_KEY_PATTERN,
   RedirectUrlSchema,
   RefreshTokenRequestSchema,
   RevokedSessionsSchema,
+  RoleKeySchema,
+  RoleNameSchema,
+  RolePermissionsSchema,
   RotatedWebhookSecretSchema,
+  SCIM_TOKEN_PREFIX,
   SECRET_KEY_PREFIX,
   SESSION_PROFILE_HEADER2 as SESSION_PROFILE_HEADER,
+  SETUP_LINK_HEADER2 as SETUP_LINK_HEADER,
+  SETUP_LINK_TOKEN_PREFIX,
   SIGN_IN_METHODS_WITHOUT_SIGN_UP,
   SIGN_IN_TEST_CLEANUPS,
   SIGN_IN_TEST_OUTCOMES,
@@ -3748,7 +4992,18 @@ export {
   SMS_USAGE_DEFAULT_DAYS,
   SMS_USAGE_MAX_DAYS,
   SMS_USAGE_MAX_PREFIXES,
+  SSO_ATTRIBUTE_DEFAULTS,
+  SSO_CONNECTION_CLAIM2 as SSO_CONNECTION_CLAIM,
+  SSO_CONNECTION_FIELDS,
+  SSO_CONNECTION_STATUSES,
+  SSO_IDP_PRESETS,
+  SSO_MANAGE_PERMISSION2 as SSO_MANAGE_PERMISSION,
+  SSO_PROTOCOLS,
+  SSO_TEST_REASONS,
   STEP_UP_MAX_AGE_SECONDS,
+  SYSTEM_PERMISSIONS2 as SYSTEM_PERMISSIONS,
+  SamlConnectionViewSchema,
+  SamlSettingsInputSchema,
   SecondFactorMethodSchema,
   SecondFactorPrepareRequestSchema,
   SecondFactorRequestSchema,
@@ -3762,9 +5017,17 @@ export {
   SessionSettingsSchema,
   SessionTokensSchema,
   SessionTypeSchema,
+  SetActiveOrganizationRequestSchema,
   SetPasswordRequestSchema,
   SetUserEmailRequestSchema,
   SettingsManagedBySchema,
+  SetupConnectionCreateSchema,
+  SetupConnectionUpdateSchema,
+  SetupGroupRolesSchema,
+  SetupLinkListSchema,
+  SetupLinkSchema,
+  SetupPortalSchema,
+  SetupScimTokenCreateSchema,
   SignInStartRequestSchema,
   SignInTestReportSchema,
   SignInTestStepResultSchema,
@@ -3777,6 +5040,17 @@ export {
   SmsTemplateSchema,
   SmsTemplatesSchema,
   SmsUsageSchema,
+  SsoAttributeMappingSchema,
+  SsoConnectionListQuerySchema,
+  SsoConnectionListSchema,
+  SsoConnectionSchema,
+  SsoGroupRolesSchema,
+  SsoStartRequestSchema,
+  SsoTestIdParamSchema,
+  SsoTestResultSchema,
+  SsoTestStartRequestSchema,
+  SsoTestStartSchema,
+  StartOrganizationDomainRequestSchema,
   StepUpEmailCodeSchema,
   StepUpMethodSchema,
   StepUpRequestSchema,
@@ -3791,12 +5065,22 @@ export {
   TulaEventSchema,
   UpdateHookRequestSchema,
   UpdateNativeAppRequestSchema,
+  UpdateOrganizationDomainRequestSchema,
+  UpdateOrganizationMemberRequestSchema,
+  UpdateOrganizationRequestSchema,
+  UpdateOrganizationRoleRequestSchema,
+  UpdateSsoConnectionRequestSchema,
   UpdateWebhookEndpointRequestSchema,
   UserAuthenticationSchema,
   UserListSchema,
+  UserMembershipListSchema,
+  UserMembershipSchema,
+  UserOrganizationListSchema,
+  UserOrganizationSchema,
   UserSchema,
   UserSortSchema,
   VerifyEmailRequestSchema,
+  VerifyOrganizationDomainRequestSchema,
   VerifySessionRequestSchema,
   WEBHOOK_DELIVERY_STATES,
   WEBHOOK_DISABLED_REASONS,
@@ -3821,6 +5105,7 @@ export {
   androidApkKeyHashOrigin,
   appleAppSiteAssociation,
   assetLinks,
+  auditExportCursor,
   bindsCodeWithPkce2 as bindsCodeWithPkce,
   builtInSessionProfile,
   checkCustomClaims2 as checkCustomClaims,
@@ -3830,7 +5115,10 @@ export {
   customSchemeRedirectRefusal2 as customSchemeRedirectRefusal,
   darkCssVariable2 as darkCssVariable,
   defaultDeviceBinding,
+  domainOfAddress2 as domainOfAddress,
+  domainRefusal2 as domainRefusal,
   durationToMs,
+  effectiveAttributeNames,
   emailTemplateParagraphs2 as emailTemplateParagraphs,
   emailTemplateProblems2 as emailTemplateProblems,
   emailTemplatesBytes2 as emailTemplatesBytes,
@@ -3844,10 +5132,12 @@ export {
   hasForbiddenRedirectCharacter2 as hasForbiddenRedirectCharacter,
   hasHiddenCharacter2 as hasHiddenCharacter,
   hasInvisibleCharacter2 as hasInvisibleCharacter,
+  hasOrganizationAccess2 as hasOrganizationAccess,
   hookFailureOutcome,
   hookLastCallFailed,
   hookWeakenings,
   isAppLinkPath,
+  isBuiltInRoleKey2 as isBuiltInRoleKey,
   isCustomClaimKey2 as isCustomClaimKey,
   isCustomClaimValue2 as isCustomClaimValue,
   isCustomSchemeRedirectUrl2 as isCustomSchemeRedirectUrl,
@@ -3857,11 +5147,13 @@ export {
   isKeyThumbprint2 as isKeyThumbprint,
   isPhoneNumberAllowed,
   isProposalTargetId,
+  isPublicEmailDomain2 as isPublicEmailDomain,
   isRedirectUrl2 as isRedirectUrl,
   isRelyingPartyId,
   isSessionProfileName,
   isSmsCountry,
   isSmsTemplateKind,
+  isSystemPermission2 as isSystemPermission,
   isTestAddress,
   isValidThemeValue2 as isValidThemeValue,
   jwkThumbprint2 as jwkThumbprint,
@@ -3875,9 +5167,13 @@ export {
   normalizeCertFingerprint,
   normalizeCertFingerprints,
   normalizePassword2 as normalizePassword,
+  normalizePermissions2 as normalizePermissions,
   oauthProviderWeakenings,
+  organizationClaimsBytes2 as organizationClaimsBytes,
+  organizationRoleWeakenings2 as organizationRoleWeakenings,
   originMatchesRelyingParty,
   ownClientIdAmong,
+  parseAuditExportCursor,
   parseEmailTemplate2 as parseEmailTemplate,
   parsePhoneNumber,
   parseStoredEnvironmentSettings,
@@ -3887,6 +5183,7 @@ export {
   proposalSummary,
   readCustomClaims2 as readCustomClaims,
   readHookClaimsAnswer,
+  readOrganizationClaims2 as readOrganizationClaims,
   readStoredEmailTemplates2 as readStoredEmailTemplates,
   readStoredEnvironmentSettings,
   readStoredJwtTemplate,
@@ -3894,12 +5191,14 @@ export {
   readsAsLink2 as readsAsLink,
   redirectUrlKind2 as redirectUrlKind,
   resolveSessionProfile,
+  rolePermissionRefusal2 as rolePermissionRefusal,
   settingsWeakenings,
   signWebhook2 as signWebhook,
   smsCostLimits,
   smsPrefixCountries,
   smsSegments,
   smsTemplateProblems,
+  ssoWeakenings,
   stepUpWindowSeconds,
   takesAdditionalClientIds,
   testAddress,