@tula-tech/contract 0.2.0 → 0.3.0

package/README.md

@@ -35,4 +35,109 @@ const step = FlowStepSchema.parse(await response.json())
 
 The reference of every export is [docs/reference/contract.md](../../docs/reference/contract.md).
 Under a strict Content-Security-Policy (no `'unsafe-eval'`), see
-[docs/releasing.md](../../docs/releasing.md#tula-techcontract-under-a-strict-content-security-policy).
+[docs/internal/releasing.md](../../docs/internal/releasing.md#tula-techcontract-under-a-strict-content-security-policy).
+
+## What it holds
+
+| Area | What is in it |
+| --- | --- |
+| Flow protocol | `FlowStepSchema` and the schemas of the steps a server answers a sign-up, a sign-in or a reset with (`needs_password`, `needs_first_factor`, `needs_email_verification`, `needs_new_password`, `needs_second_factor`, `needs_factor_enrolment`, `complete`). The API never says which screen to draw; a client reads the step. |
+| Errors | `ERROR_CODES`, `ERROR_DEFINITIONS` and `errorDefinition(code)`: every stable, dot-namespaced code (`password.too_short`) with its status. The envelope an error is answered with is a schema too. |
+| Passwords | `evaluatePassword(policy, password, userInfo)` and the policy presets: the same rules the server applies, so a form can show them before a request is made. |
+| Sessions and tokens | The session profile, the token claims, `environmentIssuer(apiUrl, environmentId)` and `jwksUrl(issuer)`, which tell a verifier where an environment's keys are published. |
+| Settings | The schema of an environment's settings, OAuth providers, hooks, native apps, JWT templates, email and SMS templates and organization roles. `@tula-tech/config` validates a config file with it. |
+| Events | `ACTIVITY_TYPES` and the webhook signature constants (the `webhook-id`, `webhook-timestamp` and `webhook-signature` headers, `WEBHOOK_TOLERANCE_SECONDS`), for a receiver that checks a delivery. |
+| Headers | `PUBLISHABLE_KEY_HEADER` (`x-tula-publishable-key`), `CLIENT_HEADER` (`x-tula-client`) and the attempt header a flow call carries. |
+| Redirect URLs | `isRedirectUrl`, `redirectUrlKind` and the rules for a custom-scheme redirect, shared by the server and the SDKs. |
+| Theme | The default theme tokens the React SDK's stylesheet and the native SDKs are generated from (`@tula-tech/contract/theme`). |
+
+## Examples
+
+Check a password against a policy before a form is submitted:
+
+```ts
+import { PASSWORD_POLICY_PRESETS } from '@tula-tech/contract'
+import { evaluatePassword } from '@tula-tech/contract/password-rules'
+
+const { ok, checks } = evaluatePassword(PASSWORD_POLICY_PRESETS.recommended, 'correct horse')
+if (!ok) {
+  for (const check of checks.filter((c) => !c.passed)) {
+    console.log(check.rule)
+  }
+}
+```
+
+Find where an environment publishes its signing keys, to verify an access token offline:
+
+```ts
+import { environmentIssuer, jwksUrl } from '@tula-tech/contract/issuer'
+
+const issuer = environmentIssuer('https://auth.example.com', environmentId)
+const keys = jwksUrl(issuer) // <issuer>/.well-known/jwks.json
+```
+
+Look up what an error code means without importing Zod:
+
+```ts
+import { ERROR_CODES, errorDefinition } from '@tula-tech/contract/error-codes'
+
+if ((ERROR_CODES as readonly string[]).includes(body.code)) {
+  const { status } = errorDefinition(body.code)
+}
+```
+
+## Using the OpenAPI document
+
+`@tula-tech/contract/openapi.json` is the document the API publishes at `/v1/openapi.json`,
+committed with every release. It is what `@tula-tech/core` and `@tula-tech/admin` generate
+their types from, so a generator of your own (another language, a test double) can start from
+the same file:
+
+```ts
+import openapi from '@tula-tech/contract/openapi.json' with { type: 'json' }
+
+console.log(Object.keys(openapi.paths).length)
+```
+
+## Compatibility
+
+- **ESM only**, with type declarations. The package has no side effects, so a bundler can drop
+  what you do not import.
+- It runs in browsers, Node, Bun and edge runtimes: it uses no Node-only API.
+- The root entry point depends on **Zod 4**. The subpath entry points listed above import no
+  Zod, so a browser bundle that needs only a constant or a pure function does not carry it.
+- Zod's JIT code generation uses `new Function`. Where a strict Content-Security-Policy
+  forbids `'unsafe-eval'`, follow
+  [the note in docs/internal/releasing.md](../../docs/internal/releasing.md#tula-techcontract-under-a-strict-content-security-policy).
+
+## Stability and versions
+
+- Every `@tula-tech/*` package of one release shares a version. Install this package at the
+  same version as the SDK that uses it (`@tula-tech/core`, `@tula-tech/react`,
+  `@tula-tech/nextjs`), or let that SDK bring it.
+- A change to a route, a response or an error code is a change to this package, and the
+  OpenAPI document in it is regenerated with the API. While the version is `0.x`, read the
+  [changelog](https://github.com/Tula-Solutions/tula-auth-and-user-management/releases)
+  before you upgrade.
+- Match on an error's `code`, not on its `detail` sentence, which is for people.
+
+## Security notes
+
+- The schemas describe what a server and a client may send; they do not authenticate anything.
+  Validating a payload with them is not a substitute for verifying a token or a webhook
+  signature.
+- Nothing in this package holds a secret. Secret keys (`tula_sk_…`) belong to the server
+  side only and are the concern of `@tula-tech/admin`.
+
+## Related packages
+
+| Package | What |
+| --- | --- |
+| [`@tula-tech/core`](../core/README.md) | The headless client: flows, the session, single-flight refresh. |
+| [`@tula-tech/react`](../react/README.md) | Provider, hooks and prebuilt components. |
+| [`@tula-tech/nextjs`](../nextjs/README.md) | The Next.js App Router SDK. |
+| [`@tula-tech/admin`](../admin/README.md) | The typed client for `/v1/admin/*`. Server-side only. |
+| [`@tula-tech/config`](../config/README.md) | `defineConfig()` for `tula.config.ts`. |
+
+The flow protocol is explained in [ADR 0019](../../docs/adr/0019-flow-engine-v2.md); the decisions
+behind the rest are indexed in the [ADR README](../../docs/adr/README.md). Licensed under Apache-2.0.

package/dist/custom-claims.d.ts

@@ -1,5 +1,5 @@
 /**
-* The one top-level claim every custom claim is nested under (ADR 0036).
+* The one top-level claim every custom claim is nested under.
 *
 * An operator's claims never sit beside Tula's own, so a claim Tula adds later cannot collide
 * with a customer's, and a template cannot set a claim Tula's servers or SDKs act on. `ext`
@@ -12,6 +12,17 @@
 * ```
 */
 declare const CUSTOM_CLAIMS_CLAIM = "ext";
+/** The access token's claim naming the active organization. */
+declare const ORGANIZATION_ID_CLAIM = "org_id";
+/** The access token's claim naming the SSO connection a session was signed in through. */
+declare const SSO_CONNECTION_CLAIM = "sso_conn";
+/** The access token's claim holding the key of the member's role in the active organization. */
+declare const ORGANIZATION_ROLE_CLAIM = "org_role";
+/**
+* The access token's claim holding the permission keys of that role. A list of strings,
+* present only beside the other two.
+*/
+declare const ORGANIZATION_PERMISSIONS_CLAIM = "org_perms";
 /**
 * Claim names a custom claim's key may never be: every claim Tula's tokens carry, the
 * registered claims a verifier acts on, `cnf` (reserved for device binding) and the namespace
@@ -25,7 +36,7 @@ declare const CUSTOM_CLAIMS_CLAIM = "ext";
 * RESERVED_CLAIM_NAMES.includes('sub') // true
 * ```
 */
-declare const RESERVED_CLAIM_NAMES: readonly ["iss", "sub", "aud", "exp", "nbf", "iat", "jti", "sid", "pid", "eid", "v", "auth_time", "amr", "sp", "cnf", "ext"];
+declare const RESERVED_CLAIM_NAMES: readonly ["iss", "sub", "aud", "exp", "nbf", "iat", "jti", "sid", "pid", "eid", "v", "auth_time", "amr", "sp", "cnf", "org_id", "org_role", "org_perms", "sso_conn", "ext"];
 /**
 * The most bytes the namespace claim's value may take as JSON (UTF-8), whatever puts claims
 * in it.
@@ -36,6 +47,110 @@ declare const RESERVED_CLAIM_NAMES: readonly ["iss", "sub", "aud", "exp", "nbf",
 * room for a long issuer URL.
 */
 declare const MAX_CUSTOM_CLAIMS_BYTES = 1024;
+/**
+* The most bytes the three organization claims may take together, as JSON (UTF-8): their own
+* cap, beside {@link MAX_CUSTOM_CLAIMS_BYTES} and never taken from it.
+*
+* It is the true upper bound of what the grammars allow: an organization id (a UUID, 36
+* characters), a role key of 32 characters and 32 permissions of the longest key
+* (`org:sys:` + 32 + `:` + 32 = 73 characters) take 2,541 bytes; the cap leaves a little
+* room. A role is bounded by the contract and the database, so a token never reaches it
+* unless a row was written by hand: the server then issues the token **without** the
+* organization claims (no claim is "no permission"), never with a cut list.
+*/
+declare const MAX_ORGANIZATION_CLAIMS_BYTES = 2560;
+/** Most permissions an organization role (and so the `org_perms` claim) holds. */
+declare const MAX_ORGANIZATION_PERMISSIONS_CLAIM = 32;
+/** The organization claims of a verified session: who it acts as, in which organization. */
+interface OrganizationClaims {
+	/** The active organization's id. */
+	readonly orgId: string;
+	/** The key of the member's role in it. */
+	readonly orgRole: string;
+	/** The permission keys of that role. */
+	readonly orgPermissions: readonly string[];
+}
+/**
+* Whether permission keys and an organization id and role can ride in a token: the UTF-8 length
+* of the JSON of the three claims, which {@link MAX_ORGANIZATION_CLAIMS_BYTES} caps.
+*
+* @param claims - The three claims.
+* @returns The byte count.
+*
+* @example
+* ```ts
+* organizationClaimsBytes({ orgId: 'o1', orgRole: 'member', orgPermissions: [] }) // 52
+* ```
+*/
+declare function organizationClaimsBytes(claims: OrganizationClaims): number;
+/**
+* Read the organization claims out of a session's claims, for an SDK or an application.
+*
+* Call it only with claims that were **verified**: this checks a shape, not where the claims
+* came from. The three are returned together or not at all. A token that carries one without
+* the others, a value of another type, an id or a role key outside their grammar, more than
+* {@link MAX_ORGANIZATION_PERMISSIONS_CLAIM} permissions, a permission outside the permission
+* grammar (`PERMISSION_KEY_PATTERN`) or claims over {@link MAX_ORGANIZATION_CLAIMS_BYTES} has
+* **no** active organization, whole: never repaired and never partly believed. Treat `null`
+* as "no organization, no permission".
+*
+* @param claims - A session's verified claims.
+* @returns A frozen copy, or `null` when no organization is active (or the claims are not
+*   what a Tula server issues).
+*
+* @example
+* ```ts
+* readOrganizationClaims({ org_id: 'o1', org_role: 'admin', org_perms: ['org:sys:memberships:read']
+* })
+* // { orgId: 'o1', orgRole: 'admin', orgPermissions: ['org:sys:memberships:read'] }
+* readOrganizationClaims({ org_id: 'o1' }) // null
+* ```
+*/
+declare function readOrganizationClaims(claims: unknown): OrganizationClaims | null;
+/**
+* What {@link hasOrganizationAccess} asks: one permission key, or one role key. Exactly one
+* of the two.
+*
+* @example
+* ```ts
+* const byPermission: OrganizationCheck = { permission: 'org:billing:read' }
+* const byRole: OrganizationCheck = { role: 'admin' }
+* ```
+*/
+type OrganizationCheck = {
+	readonly permission: string;
+	readonly role?: never;
+} | {
+	readonly role: string;
+	readonly permission?: never;
+};
+/**
+* Whether the active organization grants a permission or a role: the one rule behind
+* `has()` in `@tula-tech/nextjs` and `@tula-tech/react`.
+*
+* It is exact. A permission is held when the claims list that very key; there is no wildcard
+* (`org:billing:*` matches nothing) and no implication between keys (`manage` does not
+* include `read`). A role is held when it is the member's role key. It is **false** with no
+* active organization, for a check that names neither or both, and for anything that is not a
+* non-empty string: a check that cannot be understood never grants.
+*
+* This reads claims, so it is as old as the access token (the server decides afresh at every
+* refresh, within the token's life). Use it to decide what to show and what to let through
+* quickly; a request that changes data is authorized by the server that changes it.
+*
+* @param claims - What {@link readOrganizationClaims} returned, or `null`.
+* @param check - The permission or the role asked for.
+* @returns Whether the organization grants it.
+*
+* @example
+* ```ts
+* const claims = readOrganizationClaims(payload)
+* hasOrganizationAccess(claims, { permission: 'org:billing:read' })
+* hasOrganizationAccess(claims, { role: 'admin' })
+* hasOrganizationAccess(null, { role: 'admin' }) // false: no organization is active
+* ```
+*/
+declare function hasOrganizationAccess(claims: OrganizationClaims | null | undefined, check: OrganizationCheck): boolean;
 /** Most JWT templates an environment may define. */
 declare const MAX_JWT_TEMPLATES = 10;
 /** Most claims one JWT template may define. */
@@ -158,4 +273,4 @@ declare function checkCustomClaims(value: unknown): CustomClaimsCheck;
 * ```
 */
 declare function readCustomClaims(claims: unknown): CustomClaims | null;
-export { CUSTOM_CLAIMS_CLAIM, CustomClaimValue, CustomClaims, CustomClaimsCheck, MAX_CUSTOM_CLAIMS_BYTES, MAX_CUSTOM_CLAIM_CONSTANT_LENGTH, MAX_CUSTOM_CLAIM_KEY_LENGTH, MAX_JWT_TEMPLATES, MAX_JWT_TEMPLATE_CLAIMS, RESERVED_CLAIM_NAMES, checkCustomClaims, customClaimsBytes, isCustomClaimKey, isCustomClaimValue, readCustomClaims };
+export { CUSTOM_CLAIMS_CLAIM, CustomClaimValue, CustomClaims, CustomClaimsCheck, MAX_CUSTOM_CLAIMS_BYTES, MAX_CUSTOM_CLAIM_CONSTANT_LENGTH, MAX_CUSTOM_CLAIM_KEY_LENGTH, MAX_JWT_TEMPLATES, MAX_JWT_TEMPLATE_CLAIMS, MAX_ORGANIZATION_CLAIMS_BYTES, MAX_ORGANIZATION_PERMISSIONS_CLAIM, ORGANIZATION_ID_CLAIM, ORGANIZATION_PERMISSIONS_CLAIM, ORGANIZATION_ROLE_CLAIM, OrganizationCheck, OrganizationClaims, RESERVED_CLAIM_NAMES, SSO_CONNECTION_CLAIM, checkCustomClaims, customClaimsBytes, hasOrganizationAccess, isCustomClaimKey, isCustomClaimValue, organizationClaimsBytes, readCustomClaims, readOrganizationClaims };

package/dist/custom-claims.js

@@ -1,7 +1,16 @@
 import {
   CUSTOM_CLAIMS_CLAIM2,
+  ORGANIZATION_ID_CLAIM2,
+  SSO_CONNECTION_CLAIM2,
+  ORGANIZATION_ROLE_CLAIM2,
+  ORGANIZATION_PERMISSIONS_CLAIM2,
   RESERVED_CLAIM_NAMES2,
   MAX_CUSTOM_CLAIMS_BYTES2,
+  MAX_ORGANIZATION_CLAIMS_BYTES2,
+  MAX_ORGANIZATION_PERMISSIONS_CLAIM2,
+  organizationClaimsBytes2,
+  readOrganizationClaims2,
+  hasOrganizationAccess2,
   MAX_JWT_TEMPLATES2,
   MAX_JWT_TEMPLATE_CLAIMS2,
   MAX_CUSTOM_CLAIM_KEY_LENGTH2,
@@ -11,7 +20,8 @@ import {
   customClaimsBytes2,
   checkCustomClaims2,
   readCustomClaims2
-} from "./shared/chunk-4rb5jsfz.js";
+} from "./shared/chunk-fkx6fc8e.js";
+import"./shared/chunk-yzgakhtb.js";
 export {
   CUSTOM_CLAIMS_CLAIM2 as CUSTOM_CLAIMS_CLAIM,
   MAX_CUSTOM_CLAIMS_BYTES2 as MAX_CUSTOM_CLAIMS_BYTES,
@@ -19,10 +29,19 @@ export {
   MAX_CUSTOM_CLAIM_KEY_LENGTH2 as MAX_CUSTOM_CLAIM_KEY_LENGTH,
   MAX_JWT_TEMPLATES2 as MAX_JWT_TEMPLATES,
   MAX_JWT_TEMPLATE_CLAIMS2 as MAX_JWT_TEMPLATE_CLAIMS,
+  MAX_ORGANIZATION_CLAIMS_BYTES2 as MAX_ORGANIZATION_CLAIMS_BYTES,
+  MAX_ORGANIZATION_PERMISSIONS_CLAIM2 as MAX_ORGANIZATION_PERMISSIONS_CLAIM,
+  ORGANIZATION_ID_CLAIM2 as ORGANIZATION_ID_CLAIM,
+  ORGANIZATION_PERMISSIONS_CLAIM2 as ORGANIZATION_PERMISSIONS_CLAIM,
+  ORGANIZATION_ROLE_CLAIM2 as ORGANIZATION_ROLE_CLAIM,
   RESERVED_CLAIM_NAMES2 as RESERVED_CLAIM_NAMES,
+  SSO_CONNECTION_CLAIM2 as SSO_CONNECTION_CLAIM,
   checkCustomClaims2 as checkCustomClaims,
   customClaimsBytes2 as customClaimsBytes,
+  hasOrganizationAccess2 as hasOrganizationAccess,
   isCustomClaimKey2 as isCustomClaimKey,
   isCustomClaimValue2 as isCustomClaimValue,
-  readCustomClaims2 as readCustomClaims
+  organizationClaimsBytes2 as organizationClaimsBytes,
+  readCustomClaims2 as readCustomClaims,
+  readOrganizationClaims2 as readOrganizationClaims
 };

package/dist/error-codes.d.ts

@@ -122,6 +122,22 @@ declare const ERROR_DEFINITIONS: {
 		readonly status: 409;
 		readonly message: "This account has no password yet. Use \"forgot password\" to set one.";
 	};
+	readonly "import.unsupported_algorithm": {
+		readonly status: 422;
+		readonly message: "That password hash algorithm is not supported.";
+	};
+	readonly "import.hash_malformed": {
+		readonly status: 422;
+		readonly message: "That password hash is malformed.";
+	};
+	readonly "import.hash_parameters_too_weak": {
+		readonly status: 422;
+		readonly message: "That password hash is too weak to import.";
+	};
+	readonly "import.hash_parameters_too_costly": {
+		readonly status: 422;
+		readonly message: "That password hash is too costly to verify.";
+	};
 	readonly "verification.invalid_code": {
 		readonly status: 422;
 		readonly message: "That code is incorrect.";
@@ -314,6 +330,194 @@ declare const ERROR_DEFINITIONS: {
 		readonly status: 400;
 		readonly message: "Signing in here needs a device key.";
 	};
+	readonly "user.last_organization_manager": {
+		readonly status: 409;
+		readonly message: "This user is the only manager of an organization. Add another manager or delete the organization first.";
+	};
+	readonly "user.managed": {
+		readonly status: 403;
+		readonly message: "This account is managed by your organization. Ask your administrator to change it.";
+	};
+	readonly "organization.disabled": {
+		readonly status: 403;
+		readonly message: "Organizations are not enabled for this environment.";
+	};
+	readonly "organization.slug_taken": {
+		readonly status: 409;
+		readonly message: "An organization with that slug already exists.";
+	};
+	readonly "organization.member_exists": {
+		readonly status: 409;
+		readonly message: "That user is already a member of this organization.";
+	};
+	readonly "organization.last_manager": {
+		readonly status: 409;
+		readonly message: "An organization must keep at least one member who can manage its members.";
+	};
+	readonly "organization.role_unknown": {
+		readonly status: 422;
+		readonly message: "That role does not exist in this environment.";
+	};
+	readonly "organization.not_a_member": {
+		readonly status: 403;
+		readonly message: "You are not a member of that organization.";
+	};
+	readonly "organization.creation_disabled": {
+		readonly status: 403;
+		readonly message: "Creating an organization is not allowed in this environment.";
+	};
+	readonly "organization.limit_reached": {
+		readonly status: 403;
+		readonly message: "You have reached the number of organizations you can create.";
+	};
+	readonly "organization.personal_account_disabled": {
+		readonly status: 409;
+		readonly message: "An organization must be active in this environment.";
+	};
+	readonly "organization.role_exists": {
+		readonly status: 409;
+		readonly message: "A role with that key already exists in this environment.";
+	};
+	readonly "organization.role_in_use": {
+		readonly status: 409;
+		readonly message: "Members still hold this role. Give them another role first.";
+	};
+	readonly "organization.role_built_in": {
+		readonly status: 409;
+		readonly message: "A built-in role cannot be changed or deleted.";
+	};
+	readonly "organization.role_limit": {
+		readonly status: 409;
+		readonly message: "This environment has the most custom roles it can have.";
+	};
+	readonly "organization.permission_required": {
+		readonly status: 403;
+		readonly message: "Your role does not allow that.";
+	};
+	readonly "organization.role_not_assignable": {
+		readonly status: 403;
+		readonly message: "You can only invite to a role no stronger than yours.";
+	};
+	readonly "organization.invitation_exists": {
+		readonly status: 409;
+		readonly message: "That address already has a pending invitation.";
+	};
+	readonly "organization.invitation_not_found": {
+		readonly status: 404;
+		readonly message: "This invitation does not exist.";
+	};
+	readonly "organization.invitation_expired": {
+		readonly status: 410;
+		readonly message: "This invitation has expired.";
+	};
+	readonly "organization.invitation_revoked": {
+		readonly status: 410;
+		readonly message: "This invitation was withdrawn.";
+	};
+	readonly "organization.invitation_used": {
+		readonly status: 410;
+		readonly message: "This invitation was already used.";
+	};
+	readonly "organization.invitation_wrong_account": {
+		readonly status: 403;
+		readonly message: "This invitation was sent to another email address.";
+	};
+	readonly "organization.invitation_email_unverified": {
+		readonly status: 403;
+		readonly message: "Verify your email address to accept this invitation.";
+	};
+	readonly "organization.invitation_role_gone": {
+		readonly status: 409;
+		readonly message: "The role this invitation offers no longer exists.";
+	};
+	readonly "organization.domain_public": {
+		readonly status: 422;
+		readonly message: "A public email domain cannot be claimed by an organization.";
+	};
+	readonly "organization.domain_taken": {
+		readonly status: 409;
+		readonly message: "That domain is verified for an organization already.";
+	};
+	readonly "organization.domain_address_mismatch": {
+		readonly status: 422;
+		readonly message: "That address is not on the domain.";
+	};
+	readonly "organization.domain_limit": {
+		readonly status: 409;
+		readonly message: "This organization has the most domains it can have.";
+	};
+	readonly "organization.suggestion_unavailable": {
+		readonly status: 403;
+		readonly message: "You cannot join that organization.";
+	};
+	readonly "sso.disabled": {
+		readonly status: 403;
+		readonly message: "Single sign-on is not enabled for this environment.";
+	};
+	readonly "sso.connection_not_found": {
+		readonly status: 404;
+		readonly message: "No such single sign-on connection.";
+	};
+	readonly "sso.name_taken": {
+		readonly status: 409;
+		readonly message: "The organization already has a connection with that name.";
+	};
+	readonly "sso.domain_taken": {
+		readonly status: 409;
+		readonly message: "Another active connection already serves one of those domains.";
+	};
+	readonly "sso.domain_not_verified": {
+		readonly status: 422;
+		readonly message: "Every domain must be one of the organization's verified domains.";
+	};
+	readonly "sso.issuer_not_allowed": {
+		readonly status: 422;
+		readonly message: "The issuer is not an address the server may call.";
+	};
+	readonly "sso.saml_invalid": {
+		readonly status: 422;
+		readonly message: "The SAML settings could not be read or are incomplete.";
+	};
+	readonly "sso.connection_in_use": {
+		readonly status: 409;
+		readonly message: "The connection is active; disable it before deleting it.";
+	};
+	readonly "sso.invalid_transition": {
+		readonly status: 409;
+		readonly message: "A connection cannot move to that status from its current one.";
+	};
+	readonly "sso.url_not_https": {
+		readonly status: 422;
+		readonly message: "The identity provider’s sign-in address must start with https.";
+	};
+	readonly "sso.test_required": {
+		readonly status: 409;
+		readonly message: "Run a passing test sign-in of the connection’s current settings before activating it.";
+	};
+	readonly "sso.test_not_found": {
+		readonly status: 404;
+		readonly message: "No such test sign-in.";
+	};
+	readonly "sso.role_not_allowed": {
+		readonly status: 403;
+		readonly message: "A setup link cannot map a group to a role that holds system permissions.";
+	};
+	readonly "sso.unavailable": {
+		readonly status: 400;
+		readonly message: "Single sign-on is not available for that address.";
+	};
+	readonly "sso.provider_error": {
+		readonly status: 401;
+		readonly message: "The identity provider did not sign you in.";
+	};
+	readonly "sso.user_not_provisioned": {
+		readonly status: 403;
+		readonly message: "Your account has not been set up for this organization. Ask its administrator.";
+	};
+	readonly "sso.email_domain_mismatch": {
+		readonly status: 403;
+		readonly message: "Your email address is not on this connection's domains.";
+	};
 	readonly rate_limited: {
 		readonly status: 429;
 		readonly message: "Too many requests. Try again shortly.";

package/dist/error-codes.js

@@ -2,7 +2,7 @@ import {
   ERROR_DEFINITIONS2,
   ERROR_CODES2,
   errorDefinition2
-} from "./shared/chunk-cce3bhet.js";
+} from "./shared/chunk-5r2ka03q.js";
 export {
   ERROR_CODES2 as ERROR_CODES,
   ERROR_DEFINITIONS2 as ERROR_DEFINITIONS,

package/dist/event-types.d.ts

@@ -19,7 +19,7 @@
 * }
 * ```
 */
-declare const ACTIVITY_TYPES: readonly ["user.created", "user.email_verified", "user.banned", "user.unbanned", "user.deleted", "user.password_changed", "user.mfa_enabled", "user.mfa_disabled", "user.backup_codes_regenerated", "user.backup_code_used", "user.identity_linked", "user.identity_unlinked", "user.email_added", "user.passkey_added", "user.passkey_renamed", "user.passkey_removed", "user.passkey_counter_regressed", "user.phone_number_added", "user.phone_number_removed", "user.sms_factor_enabled", "user.sms_factor_removed", "session.created", "session.revoked", "session.reuse_detected", "session.stepped_up", "session.refresh_proof_refused", "api_key.created", "api_key.revoked", "signing_key.rotated", "environment.settings_updated", "oauth_provider.updated", "oauth_provider.deleted", "webhook_endpoint.created", "webhook_endpoint.updated", "webhook_endpoint.deleted", "webhook_endpoint.disabled", "webhook_endpoint.secret_rotated", "webhook_endpoint.previous_secret_revoked", "hook.created", "hook.updated", "hook.deleted", "native_app.created", "native_app.updated", "native_app.deleted", "proposal.created", "proposal.approved", "proposal.executed", "proposal.failed", "sign_in_test.started", "sign_in_test.finished"];
+declare const ACTIVITY_TYPES: readonly ["user.created", "user.imported", "user.email_verified", "user.banned", "user.unbanned", "user.deleted", "user.password_changed", "user.mfa_enabled", "user.mfa_disabled", "user.backup_codes_regenerated", "user.backup_code_used", "user.identity_linked", "user.identity_unlinked", "user.sso_linked", "user.email_added", "user.passkey_added", "user.passkey_renamed", "user.passkey_removed", "user.passkey_counter_regressed", "user.phone_number_added", "user.phone_number_removed", "user.sms_factor_enabled", "user.sms_factor_removed", "session.created", "session.revoked", "session.reuse_detected", "session.stepped_up", "session.refresh_proof_refused", "api_key.created", "api_key.revoked", "signing_key.rotated", "environment.settings_updated", "oauth_provider.updated", "oauth_provider.deleted", "webhook_endpoint.created", "webhook_endpoint.updated", "webhook_endpoint.deleted", "webhook_endpoint.disabled", "webhook_endpoint.secret_rotated", "webhook_endpoint.previous_secret_revoked", "hook.created", "hook.updated", "hook.deleted", "native_app.created", "native_app.updated", "native_app.deleted", "sso_connection.created", "sso_connection.updated", "sso_connection.deleted", "scim_token.created", "scim_token.revoked", "setup_link.created", "setup_link.revoked", "user.scim_provisioned", "user.scim_updated", "scim_group.created", "scim_group.updated", "scim_group.deleted", "organization.created", "organization.updated", "organization.deleted", "organization_membership.added", "organization_membership.role_changed", "organization_membership.removed", "organization_role.created", "organization_role.updated", "organization_role.deleted", "organization_domain.claimed", "organization_domain.verified", "organization_domain.updated", "organization_domain.removed", "organization_invitation.created", "organization_invitation.accepted", "organization_invitation.declined", "organization_invitation.revoked", "proposal.created", "proposal.approved", "proposal.rejected", "proposal.executed", "proposal.failed", "audit.exported", "sign_in_test.started", "sign_in_test.finished"];
 /** A recorded action type: one of {@link ACTIVITY_TYPES}. */
 type ActivityType = (typeof ACTIVITY_TYPES)[number];
 /**
@@ -52,6 +52,7 @@ declare const EVENT_SCHEMA_VERSION = 1;
 */
 declare const EVENT_TARGET_TYPES: {
 	readonly "user.created": "user";
+	readonly "user.imported": "user";
 	readonly "user.email_verified": "user";
 	readonly "user.banned": "user";
 	readonly "user.unbanned": "user";
@@ -64,6 +65,7 @@ declare const EVENT_TARGET_TYPES: {
 	readonly "user.identity_linked": "user";
 	readonly "user.email_added": "user";
 	readonly "user.identity_unlinked": "user";
+	readonly "user.sso_linked": "user";
 	readonly "user.passkey_added": "user";
 	readonly "user.passkey_renamed": "user";
 	readonly "user.passkey_removed": "user";
@@ -95,10 +97,41 @@ declare const EVENT_TARGET_TYPES: {
 	readonly "native_app.created": "native_app";
 	readonly "native_app.updated": "native_app";
 	readonly "native_app.deleted": "native_app";
+	readonly "sso_connection.created": "sso_connection";
+	readonly "sso_connection.updated": "sso_connection";
+	readonly "sso_connection.deleted": "sso_connection";
+	readonly "scim_token.created": "scim_token";
+	readonly "scim_token.revoked": "scim_token";
+	readonly "setup_link.created": "setup_link";
+	readonly "setup_link.revoked": "setup_link";
+	readonly "user.scim_provisioned": "user";
+	readonly "user.scim_updated": "user";
+	readonly "scim_group.created": "scim_group";
+	readonly "scim_group.updated": "scim_group";
+	readonly "scim_group.deleted": "scim_group";
+	readonly "organization.created": "organization";
+	readonly "organization.updated": "organization";
+	readonly "organization.deleted": "organization";
+	readonly "organization_membership.added": "organization_membership";
+	readonly "organization_membership.role_changed": "organization_membership";
+	readonly "organization_membership.removed": "organization_membership";
+	readonly "organization_role.created": "organization_role";
+	readonly "organization_role.updated": "organization_role";
+	readonly "organization_role.deleted": "organization_role";
+	readonly "organization_domain.claimed": "organization_domain";
+	readonly "organization_domain.verified": "organization_domain";
+	readonly "organization_domain.updated": "organization_domain";
+	readonly "organization_domain.removed": "organization_domain";
+	readonly "organization_invitation.created": "organization_invitation";
+	readonly "organization_invitation.accepted": "organization_invitation";
+	readonly "organization_invitation.declined": "organization_invitation";
+	readonly "organization_invitation.revoked": "organization_invitation";
 	readonly "proposal.created": "proposal";
 	readonly "proposal.approved": "proposal";
+	readonly "proposal.rejected": "proposal";
 	readonly "proposal.executed": "proposal";
 	readonly "proposal.failed": "proposal";
+	readonly "audit.exported": "environment";
 	readonly "sign_in_test.started": "environment";
 	readonly "sign_in_test.finished": "environment";
 };

package/dist/event-types.js

@@ -2,7 +2,7 @@ import {
   ACTIVITY_TYPES2,
   EVENT_SCHEMA_VERSION2,
   EVENT_TARGET_TYPES2
-} from "./shared/chunk-7yqzghgm.js";
+} from "./shared/chunk-bsea97tx.js";
 export {
   ACTIVITY_TYPES2 as ACTIVITY_TYPES,
   EVENT_SCHEMA_VERSION2 as EVENT_SCHEMA_VERSION,