@tula-tech/core 0.1.1 → 0.3.0

package/dist/index.js

@@ -325,10 +325,293 @@ function isStepUpPrepared(value) {
   return isPhoneCodeSent(value) && (method === "email_code" || method === "sms_code");
 }
 
-// src/passkey.ts
+// src/oauth.ts
+import { ERROR_DEFINITIONS as ERROR_DEFINITIONS2 } from "@tula-tech/contract/error-codes";
+import {
+  EMAIL_LINK_ATTEMPT_PARAM as EMAIL_LINK_ATTEMPT_PARAM2,
+  OAUTH_ERROR_PARAM,
+  OAUTH_TICKET_PARAM
+} from "@tula-tech/contract/headers";
+var OAUTH_BINDING_TTL_MS = 15 * 60000;
+var OAUTH_TICKET_HOLD_MS = 60000;
+var RETRYABLE = new Set([
+  "network.failed",
+  "network.timeout",
+  "rate_limited"
+]);
+function isRetryableOAuthError(error) {
+  return isTulaError(error) && RETRYABLE.has(error.code);
+}
+var OAUTH_STORAGE_PREFIX = "tula.oauth.";
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function createOAuthStore(environment, scope) {
+  const storage = environment.tabStorage;
+  const keyOf = (attemptId) => `${OAUTH_STORAGE_PREFIX}${attemptId}`;
+  function guarded(work, fallback) {
+    try {
+      return work();
+    } catch {
+      return fallback;
+    }
+  }
+  function prune() {
+    if (!storage) {
+      return;
+    }
+    const stale = [];
+    for (let index = 0;index < storage.length; index++) {
+      const key = storage.key(index);
+      if (key?.startsWith(OAUTH_STORAGE_PREFIX)) {
+        const expiry = guarded(() => JSON.parse(storage.getItem(key) ?? "null")?.e, undefined);
+        if (typeof expiry !== "number" || expiry <= environment.now()) {
+          stale.push(key);
+        }
+      }
+    }
+    for (const key of stale) {
+      storage.removeItem(key);
+    }
+  }
+  return {
+    available: () => guarded(() => {
+      if (!storage) {
+        return false;
+      }
+      const probe = `${OAUTH_STORAGE_PREFIX}probe`;
+      storage.setItem(probe, "1");
+      storage.removeItem(probe);
+      return true;
+    }, false),
+    save: (attemptId, binding, intent) => guarded(() => {
+      if (!storage) {
+        return false;
+      }
+      prune();
+      storage.setItem(keyOf(attemptId), JSON.stringify({
+        b: binding,
+        e: environment.now() + OAUTH_BINDING_TTL_MS,
+        s: scope,
+        k: intent
+      }));
+      return true;
+    }, false),
+    read: (attemptId) => guarded(() => {
+      prune();
+      const entry = JSON.parse(storage?.getItem(keyOf(attemptId)) ?? "null");
+      return isRecord3(entry) && typeof entry.b === "string" && entry.s === scope && (entry.k === "sign_in" || entry.k === "link") ? { binding: entry.b, intent: entry.k } : null;
+    }, null),
+    remove(attemptId) {
+      guarded(() => storage?.removeItem(keyOf(attemptId)), undefined);
+    }
+  };
+}
+function readOAuthFragment(url) {
+  const at = url.indexOf("#");
+  if (at === -1) {
+    return null;
+  }
+  const fragment = new URLSearchParams(url.slice(at + 1));
+  const ticket = fragment.get(OAUTH_TICKET_PARAM);
+  const error = fragment.get(OAUTH_ERROR_PARAM);
+  if (!ticket && !error) {
+    return null;
+  }
+  const attemptId = fragment.get(EMAIL_LINK_ATTEMPT_PARAM2) ?? "";
+  for (const name of [OAUTH_TICKET_PARAM, OAUTH_ERROR_PARAM, EMAIL_LINK_ATTEMPT_PARAM2]) {
+    fragment.delete(name);
+  }
+  const rest = fragment.toString();
+  return {
+    attemptId,
+    ticket: ticket || null,
+    error: ticket ? null : error,
+    cleanUrl: `${url.slice(0, at)}${rest ? `#${rest}` : ""}`
+  };
+}
+function createOAuthTicketHolder() {
+  let held = null;
+  return {
+    get: () => held,
+    set(next) {
+      held = next;
+    }
+  };
+}
+function discardOAuthCallback(context) {
+  const held = context.held.get();
+  if (held) {
+    context.held.set(null);
+    context.oauth.remove(held.attemptId);
+  }
+}
+function isLinkStart(value) {
+  return isRecord3(value) && typeof value.attemptId === "string" && value.attemptId !== "" && typeof value.authorizationUrl === "string" && typeof value.binding === "string";
+}
+function isIdentity(value) {
+  return isRecord3(value) && typeof value.id === "string" && typeof value.provider === "string";
+}
+function isIdentityList(value) {
+  return isRecord3(value) && Array.isArray(value.data) && value.data.every(isIdentity);
+}
+async function startOAuth(context, input, intent) {
+  const { environment, oauth, transport, session } = context;
+  discardOAuthCallback(context);
+  if (!oauth.available()) {
+    throw clientError("storage.failed", context.messages());
+  }
+  const page = environment.page;
+  if (page && originOf(input.redirectUrl) !== originOf(page.url())) {
+    throw clientError("link.cross_origin", context.messages());
+  }
+  const body = { provider: input.provider, redirectUrl: input.redirectUrl };
+  let attemptId;
+  let started;
+  if (intent === "link") {
+    const answer = await session.authorized("startIdentityLink", { body });
+    if (!isLinkStart(answer)) {
+      throw clientError("response.invalid", context.messages());
+    }
+    attemptId = answer.attemptId;
+    started = answer;
+  } else {
+    const answer = await transport.call("startOAuthSignIn", { body });
+    if (!isRecord3(answer) || !isRecord3(answer.attempt) || typeof answer.attempt.id !== "string" || typeof answer.authorizationUrl !== "string" || typeof answer.binding !== "string") {
+      throw clientError("response.invalid", context.messages());
+    }
+    attemptId = answer.attempt.id;
+    started = { authorizationUrl: answer.authorizationUrl, binding: answer.binding };
+  }
+  return keepAndNavigate(context, attemptId, started, input.navigate, intent);
+}
+function keepAndNavigate(context, attemptId, started, navigate, intent) {
+  const { oauth, environment } = context;
+  if (!/^https?:\/\//i.test(started.authorizationUrl)) {
+    throw clientError("response.invalid", context.messages());
+  }
+  if (!oauth.save(attemptId, started.binding, intent)) {
+    throw clientError("storage.failed", context.messages());
+  }
+  if (navigate !== false) {
+    environment.page?.assign?.(started.authorizationUrl);
+  }
+  return { url: started.authorizationUrl };
+}
+async function startSso(context, bound, input) {
+  discardOAuthCallback(context);
+  if (!context.oauth.available()) {
+    throw clientError("storage.failed", context.messages());
+  }
+  const page = context.environment.page;
+  if (page && originOf(input.redirectUrl) !== originOf(page.url())) {
+    throw clientError("link.cross_origin", context.messages());
+  }
+  const answer = await context.transport.call("startSsoSignIn", {
+    ...bound,
+    body: { redirectUrl: input.redirectUrl }
+  });
+  if (!isRecord3(answer) || typeof answer.authorizationUrl !== "string" || typeof answer.binding !== "string") {
+    throw clientError("response.invalid", context.messages());
+  }
+  return keepAndNavigate(context, bound.params.attemptId, { authorizationUrl: answer.authorizationUrl, binding: answer.binding }, input.navigate, "sign_in");
+}
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function failed(code, messages) {
+  const known = Object.hasOwn(ERROR_DEFINITIONS2, code) ? code : "oauth.provider_error";
+  return {
+    status: "error",
+    code: known,
+    message: formatMessage(known, { messages })
+  };
+}
+async function handleOAuthCallback(context) {
+  const { environment, oauth, held, transport, session } = context;
+  const page = environment.page;
+  if (!page) {
+    return { status: "none" };
+  }
+  const arrived = readOAuthFragment(page.url());
+  let answer;
+  if (arrived) {
+    try {
+      page.replaceUrl(arrived.cleanUrl);
+    } catch {}
+    discardOAuthCallback(context);
+    if (arrived.error !== null || arrived.ticket === null) {
+      oauth.remove(arrived.attemptId);
+      return arrived.error !== null ? failed(arrived.error, context.messages()) : { status: "different_browser" };
+    }
+    answer = {
+      attemptId: arrived.attemptId,
+      ticket: arrived.ticket,
+      until: environment.now() + OAUTH_TICKET_HOLD_MS
+    };
+  } else {
+    const waiting = held.get();
+    if (!waiting) {
+      return { status: "none" };
+    }
+    if (waiting.until <= environment.now()) {
+      discardOAuthCallback(context);
+      return failed("oauth.ticket_invalid", context.messages());
+    }
+    answer = waiting;
+  }
+  const kept = oauth.read(answer.attemptId);
+  const settle = () => {
+    held.set(null);
+    oauth.remove(answer.attemptId);
+  };
+  if (!kept) {
+    settle();
+    return { status: "different_browser" };
+  }
+  held.set(answer);
+  const body = { ticket: answer.ticket, attemptId: answer.attemptId, binding: kept.binding };
+  try {
+    let outcome;
+    if (kept.intent === "link") {
+      const identity = await session.authorized("exchangeIdentityLinkTicket", { body });
+      if (!isIdentity(identity)) {
+        throw clientError("response.invalid", context.messages());
+      }
+      outcome = { status: "linked", identity };
+    } else {
+      const attempt = await transport.call("exchangeOAuthTicket", { body });
+      const complete = isRecord3(attempt) && isRecord3(attempt.step) && attempt.step.status === "complete";
+      outcome = {
+        status: complete ? "complete" : "needs_step",
+        flow: await signInFlow(context, attempt)
+      };
+    }
+    settle();
+    return outcome;
+  } catch (error) {
+    if (isRetryableOAuthError(error)) {
+      throw error;
+    }
+    settle();
+    if (!isTulaError(error) || error.status === 0) {
+      throw error;
+    }
+    if (error.code === "oauth.different_browser") {
+      return { status: "different_browser" };
+    }
+    return { status: "error", code: error.code, message: error.message };
+  }
+}
+
+// src/passkey.ts
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function base64UrlToBytes(text) {
   const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/"));
   const bytes = new Uint8Array(binary.length);
@@ -346,7 +629,7 @@ function bytesToBase64Url(buffer) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function descriptors(list) {
-  return Array.isArray(list) ? list.map((entry) => isRecord3(entry) && typeof entry.id === "string" ? { ...entry, id: base64UrlToBytes(entry.id) } : entry) : undefined;
+  return Array.isArray(list) ? list.map((entry) => isRecord4(entry) && typeof entry.id === "string" ? { ...entry, id: base64UrlToBytes(entry.id) } : entry) : undefined;
 }
 function creationOptionsFromJson(options) {
   return {
@@ -368,7 +651,7 @@ function isBinary(value) {
   return value instanceof ArrayBuffer || ArrayBuffer.isView(value);
 }
 function credentialToJson(credential) {
-  const response = isRecord3(credential.response) ? credential.response : {};
+  const response = isRecord4(credential.response) ? credential.response : {};
   const encoded = {};
   for (const name of [
     "clientDataJSON",
@@ -401,7 +684,7 @@ function call(target, method) {
   return typeof candidate === "function" ? candidate.call(target) : undefined;
 }
 function toJson(credential) {
-  if (!isRecord3(credential)) {
+  if (!isRecord4(credential)) {
     return null;
   }
   if (typeof credential.toJSON === "function") {
@@ -415,13 +698,13 @@ function isBase64Url(value) {
   return typeof value === "string" && /^[A-Za-z0-9_-]+$/.test(value);
 }
 function isRegistration(value) {
-  return isRecord3(value) && isBase64Url(value.id) && value.type === "public-key" && isRecord3(value.response) && isBase64Url(value.response.clientDataJSON) && isBase64Url(value.response.attestationObject);
+  return isRecord4(value) && isBase64Url(value.id) && value.type === "public-key" && isRecord4(value.response) && isBase64Url(value.response.clientDataJSON) && isBase64Url(value.response.attestationObject);
 }
 function isAssertion(value) {
-  return isRecord3(value) && isBase64Url(value.id) && value.type === "public-key" && isRecord3(value.response) && isBase64Url(value.response.clientDataJSON) && isBase64Url(value.response.authenticatorData) && isBase64Url(value.response.signature);
+  return isRecord4(value) && isBase64Url(value.id) && value.type === "public-key" && isRecord4(value.response) && isBase64Url(value.response.clientDataJSON) && isBase64Url(value.response.authenticatorData) && isBase64Url(value.response.signature);
 }
 function ceremonyCode(error) {
-  const name = isRecord3(error) || error instanceof Error ? error.name : "";
+  const name = isRecord4(error) || error instanceof Error ? error.name : "";
   if (name === "InvalidStateError") {
     return "passkey.already_on_device";
   }
@@ -473,7 +756,7 @@ function browserProvider(globals) {
   };
 }
 function isPasskey(value) {
-  return isRecord3(value) && typeof value.id === "string" && value.id !== "" && typeof value.name === "string" && typeof value.synced === "boolean" && typeof value.createdAt === "string" && (value.lastUsedAt === null || typeof value.lastUsedAt === "string");
+  return isRecord4(value) && typeof value.id === "string" && value.id !== "" && typeof value.name === "string" && typeof value.synced === "boolean" && typeof value.createdAt === "string" && (value.lastUsedAt === null || typeof value.lastUsedAt === "string");
 }
 function toPasskey(value) {
   const { id, name, synced, createdAt, lastUsedAt } = value;
@@ -483,22 +766,23 @@ function isPasskeyAnswer(value) {
   return isPasskey(value);
 }
 function isPasskeyList(value) {
-  return isRecord3(value) && Array.isArray(value.passkeys) && value.passkeys.every(isPasskey);
+  return isRecord4(value) && Array.isArray(value.passkeys) && value.passkeys.every(isPasskey);
 }
 function isCreationOptions(value) {
-  return isRecord3(value) && isBase64Url(value.challenge) && isRecord3(value.rp) && typeof value.rp.id === "string" && isRecord3(value.user) && isBase64Url(value.user.id) && Array.isArray(value.pubKeyCredParams);
+  return isRecord4(value) && isBase64Url(value.challenge) && isRecord4(value.rp) && typeof value.rp.id === "string" && isRecord4(value.user) && isBase64Url(value.user.id) && Array.isArray(value.pubKeyCredParams);
 }
 function isRequestOptions(value) {
-  return isRecord3(value) && isBase64Url(value.challenge) && typeof value.rpId === "string";
+  return isRecord4(value) && isBase64Url(value.challenge) && typeof value.rpId === "string";
 }
 function isPasskeySignInStart(value) {
-  return isRecord3(value) && isRecord3(value.attempt) && isRequestOptions(value.options);
+  return isRecord4(value) && isRecord4(value.attempt) && isRequestOptions(value.options);
 }
 
 // src/session.ts
 var ACCESS_TOKEN_EXPIRY_SKEW_MS = 1e4;
 var REFRESH_TIMEOUT_MS = 8000;
 var REFRESH_RETRY_WINDOW_MS = 1e4;
+var MAX_UNDELIVERED = 8;
 var MIN_REFRESH_RETRY_TIMEOUT_MS = 1000;
 var MAX_REFRESH_BACKOFF_MS = 5 * 60000;
 function refreshBudgetMs(refreshTimeoutMs) {
@@ -507,27 +791,40 @@ function refreshBudgetMs(refreshTimeoutMs) {
 var LOCK_WAIT_MARGIN_MS = 2000;
 var MAX_ENDED_SESSIONS = 32;
 var CHANNEL_VERSION2 = 1;
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null;
 }
 function jwtLifetimeMs(token) {
   try {
     const payload = token.split(".")[1] ?? "";
     const claims = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
-    if (isRecord4(claims) && typeof claims.iat === "number" && typeof claims.exp === "number" && claims.exp > claims.iat) {
+    if (isRecord5(claims) && typeof claims.iat === "number" && typeof claims.exp === "number" && claims.exp > claims.iat) {
       return (claims.exp - claims.iat) * 1000;
     }
   } catch {}
   return;
 }
+function organizationIdOf(token) {
+  try {
+    const payload = token.split(".")[1] ?? "";
+    const claims = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+    if (isRecord5(claims) && typeof claims.org_id === "string" && claims.org_id !== "") {
+      return claims.org_id;
+    }
+  } catch {}
+  return null;
+}
+function isActiveOrganization(value) {
+  return isRecord5(value) && typeof value.sessionId === "string" && value.sessionId !== "" && (value.organizationId === null || typeof value.organizationId === "string" && value.organizationId !== "") && (value.accessToken === undefined || typeof value.accessToken === "string" && value.accessToken !== "" && (jwtLifetimeMs(value.accessToken) !== undefined || typeof value.accessTokenExpiresAt === "string" && !Number.isNaN(Date.parse(value.accessTokenExpiresAt))));
+}
 function accessTokenLifetimeMs(issued, now) {
   return jwtLifetimeMs(issued.accessToken) ?? Math.max(0, Date.parse(issued.accessTokenExpiresAt ?? "") - now);
 }
 function isSessionTokens(value) {
-  return isRecord4(value) && typeof value.accessToken === "string" && value.accessToken !== "" && typeof value.sessionId === "string" && value.sessionId !== "" && (value.refreshToken === undefined || typeof value.refreshToken === "string") && (jwtLifetimeMs(value.accessToken) !== undefined || typeof value.accessTokenExpiresAt === "string" && !Number.isNaN(Date.parse(value.accessTokenExpiresAt)));
+  return isRecord5(value) && typeof value.accessToken === "string" && value.accessToken !== "" && typeof value.sessionId === "string" && value.sessionId !== "" && (value.refreshToken === undefined || typeof value.refreshToken === "string") && (jwtLifetimeMs(value.accessToken) !== undefined || typeof value.accessTokenExpiresAt === "string" && !Number.isNaN(Date.parse(value.accessTokenExpiresAt)));
 }
 function isStatefulSession(value) {
-  return isRecord4(value) && typeof value.sessionId === "string" && value.sessionId !== "" && value.accessToken === undefined && value.accessTokenExpiresAt === undefined && value.refreshToken === undefined;
+  return isRecord5(value) && typeof value.sessionId === "string" && value.sessionId !== "" && value.accessToken === undefined && value.accessTokenExpiresAt === undefined && value.refreshToken === undefined;
 }
 function sessionIsGone(error) {
   return error.code.startsWith("session.") || error.code === "auth.unauthenticated" || error.code === "auth.user_banned";
@@ -553,13 +850,13 @@ function createSessionManager(options) {
   let refreshing = null;
   let backoff = null;
   let orphan = null;
-  let undelivered = null;
+  let undelivered = [];
   let channel;
   let channelOpened = false;
   const endedSessions = new Set;
   let signingOut = 0;
   function setState(next) {
-    const same = next.status === state.status && (next.status !== "signed-in" || state.status === "signed-in" && next.sessionId === state.sessionId && next.user === state.user);
+    const same = next.status === state.status && (next.status !== "signed-in" || state.status === "signed-in" && next.sessionId === state.sessionId && next.user === state.user && next.organizationId === state.organizationId);
     if (same) {
       return;
     }
@@ -616,7 +913,12 @@ function createSessionManager(options) {
     if (generation !== mine) {
       return;
     }
-    setState({ status: "signed-in", sessionId: current.sessionId, user });
+    setState({
+      status: "signed-in",
+      sessionId: current.sessionId,
+      user,
+      organizationId: current.organizationId
+    });
   }
   function commit(issued) {
     generation += 1;
@@ -627,6 +929,7 @@ function createSessionManager(options) {
       tokens = {
         accessToken: null,
         sessionId: issued.sessionId,
+        organizationId: tokens?.sessionId === issued.sessionId ? tokens.organizationId : null,
         expiresAt: Number.MAX_SAFE_INTEGER,
         refreshAt: Number.MAX_SAFE_INTEGER
       };
@@ -635,6 +938,7 @@ function createSessionManager(options) {
       tokens = {
         accessToken,
         sessionId: issued.sessionId,
+        organizationId: organizationIdOf(accessToken),
         expiresAt: now + lifetime,
         refreshAt: now + lifetime - Math.min(ACCESS_TOKEN_EXPIRY_SKEW_MS, lifetime / 2)
       };
@@ -674,7 +978,7 @@ function createSessionManager(options) {
     return refreshToken;
   }
   function receive(data) {
-    if (!isRecord4(data) || data.v !== CHANNEL_VERSION2) {
+    if (!isRecord5(data) || data.v !== CHANNEL_VERSION2) {
       return;
     }
     if (data.type === "signed-out") {
@@ -694,6 +998,7 @@ function createSessionManager(options) {
       tokens = {
         accessToken: data.accessToken,
         sessionId: data.sessionId,
+        organizationId: typeof data.organizationId === "string" && data.organizationId !== "" ? data.organizationId : null,
         expiresAt: data.expiresAt,
         refreshAt: data.refreshAt
       };
@@ -803,6 +1108,9 @@ function createSessionManager(options) {
     return { token: issued.accessToken ?? null, installed, failure: await persist(issued) };
   }
   async function runRefresh(explicit) {
+    if (signingOut > 0) {
+      return null;
+    }
     if (!explicit && backoff && environment.now() < backoff.until) {
       throw backoff.error;
     }
@@ -857,7 +1165,6 @@ function createSessionManager(options) {
       throw clientError("response.invalid", options.messages());
     }
     openChannel();
-    undelivered = null;
     const installed = commit(issued);
     const failure = await persist(issued);
     await settle(installed);
@@ -895,19 +1202,29 @@ function createSessionManager(options) {
         failure = clientError("storage.failed", options.messages(), cause);
       }
     }
-    const newest = orphan ?? presented ?? undelivered;
+    const newest = orphan ?? presented;
     orphan = null;
-    if (web || newest) {
+    const owed = [...new Set([newest, ...undelivered].filter((t) => !!t))];
+    if (web) {
       try {
-        await withLock(() => transport.call("signOut", { body: newest ? { refreshToken: newest } : {} }));
-        undelivered = null;
+        await withLock(() => transport.call("signOut", { body: {} }));
       } catch (error) {
         failure = error;
-        if (!web && generation === mine) {
+      }
+    } else {
+      const kept = [];
+      for (const token of owed) {
+        try {
+          await withLock(() => transport.call("signOut", { body: { refreshToken: token } }));
+        } catch (error) {
+          failure = failure ?? error;
           const over = isTulaError(error) && error.code.startsWith("session.");
-          undelivered = over ? null : newest;
+          if (!over) {
+            kept.push(token);
+          }
         }
       }
+      undelivered = kept.slice(0, MAX_UNDELIVERED);
     }
     if (failure) {
       throw failure;
@@ -996,6 +1313,42 @@ function createSessionManager(options) {
       throw unauthenticated();
     }
   }
+  let organizationEpoch = 0;
+  async function setActiveOrganization(organizationId) {
+    openChannel();
+    organizationEpoch += 1;
+    await refreshing?.catch(ignore);
+    const { answer, sent } = await send("setActiveOrganization", { body: { organizationId } });
+    if (!isActiveOrganization(answer)) {
+      throw clientError("response.invalid", options.messages());
+    }
+    if (state.status === "signed-out" || tokens?.sessionId !== answer.sessionId) {
+      throw unauthenticated();
+    }
+    if (answer.accessToken === undefined) {
+      if (generation === sent && !refreshing && tokens) {
+        tokens = { ...tokens, organizationId: answer.organizationId };
+        post({ type: "session", ...tokens });
+        if (state.status === "signed-in") {
+          setState({ ...state, organizationId: answer.organizationId });
+        }
+      }
+      return answer;
+    }
+    if (generation === sent && !refreshing) {
+      await settle(commit({
+        sessionId: answer.sessionId,
+        accessToken: answer.accessToken,
+        accessTokenExpiresAt: answer.accessTokenExpiresAt
+      }));
+      return answer;
+    }
+    await refreshing?.catch(ignore);
+    if (tokens?.sessionId !== answer.sessionId || !await refresh(true)) {
+      throw unauthenticated();
+    }
+    return answer;
+  }
   return {
     state: () => state,
     subscribe(listener) {
@@ -1020,6 +1373,16 @@ function createSessionManager(options) {
     },
     authorized,
     stepUp,
+    setActiveOrganization,
+    organizationEpoch: () => organizationEpoch,
+    noteActiveOrganization(sessionId, organizationId, epoch) {
+      if (epoch === organizationEpoch && tokens && tokens.accessToken === null && tokens.sessionId === sessionId) {
+        tokens = { ...tokens, organizationId };
+        if (state.status === "signed-in" && state.sessionId === sessionId) {
+          setState({ ...state, organizationId });
+        }
+      }
+    },
     expire() {
       if (tokens) {
         tokens = { ...tokens, refreshAt: 0 };
@@ -1029,11 +1392,11 @@ function createSessionManager(options) {
 }
 
 // src/flows.ts
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isUsableAttempt(value) {
-  if (!isRecord5(value) || typeof value.id !== "string" || value.id === "" || !isRecord5(value.step) || typeof value.step.status !== "string") {
+  if (!isRecord6(value) || typeof value.id !== "string" || value.id === "" || !isRecord6(value.step) || typeof value.step.status !== "string") {
     return false;
   }
   return value.step.status === "complete" ? isSessionTokens(value.session) || isStatefulSession(value.session) : value.session === undefined;
@@ -1127,7 +1490,7 @@ function enrolmentActions(context, attempt, kind) {
     }),
     confirmTotpEnrolment: ({ code }) => attempt.exclusive(async (bound) => {
       const next = await context.transport.call(confirm, { ...bound, body: { code } });
-      const backupCodes = isRecord5(next) ? next.backupCodes : undefined;
+      const backupCodes = isRecord6(next) ? next.backupCodes : undefined;
       if (!isCodes(backupCodes)) {
         throw clientError("response.invalid", context.messages());
       }
@@ -1146,7 +1509,7 @@ function secondFactorAction(context, attempt, operation) {
   const submit = async (bound, proof) => {
     const body = proof.method === "passkey" ? { method: "passkey", credential: proof.credential } : { method: proof.method, code: proof.code };
     const next = await context.transport.call(operation, { ...bound, body });
-    const remaining = isRecord5(next) ? next.backupCodesRemaining : undefined;
+    const remaining = isRecord6(next) ? next.backupCodesRemaining : undefined;
     if (remaining !== undefined && !(Number.isInteger(remaining) && Number(remaining) >= 0)) {
       throw clientError("response.invalid", context.messages());
     }
@@ -1211,6 +1574,7 @@ async function signInFlow(context, started, first) {
     },
     attemptFirstFactor: (input) => attempt.step((bound) => transport.call("attemptSignInFirstFactor", { ...bound, body: input })),
     waitForEmailLink: (options) => waiting.wait(options?.signal),
+    startSso: (input) => attempt.exclusive((bound) => startSso(context, bound, input)),
     discard() {
       attempt.discard();
       waiting.stop();
@@ -1315,377 +1679,116 @@ function emailLinkWait(context, attempt) {
       stopListening();
       if (channel) {
         channel.onmessage = null;
-        channel.close?.();
-      }
-    }
-  }
-  return {
-    wait(signal) {
-      if (attempt.finished()) {
-        return Promise.reject(attempt.refused("flow.invalid_step"));
-      }
-      if (signal?.aborted) {
-        return Promise.resolve(attempt.snapshot().step);
-      }
-      if (stopping) {
-        stopping = false;
-        resumed = true;
-      }
-      loop ??= run();
-      const running = loop;
-      return new Promise((resolve, reject) => {
-        const leave = () => {
-          callers.delete(release);
-          signal?.removeEventListener("abort", release);
-        };
-        const release = () => {
-          leave();
-          resolve(attempt.snapshot().step);
-          if (callers.size === 0) {
-            stopping = true;
-            wake?.();
-          }
-        };
-        callers.add(release);
-        signal?.addEventListener("abort", release);
-        running.then((step) => {
-          leave();
-          resolve(step);
-        }, (error) => {
-          leave();
-          reject(error);
-        });
-      });
-    },
-    stop
-  };
-}
-async function passwordResetFlow(context, started) {
-  const { transport } = context;
-  const attempt = createAttempt(context, started);
-  await attempt.accept(started);
-  return flowObject(attempt, {
-    submit: ({ code, password }) => attempt.step((bound) => transport.call("submitPasswordReset", { ...bound, body: { code, password } })),
-    resendCode: () => attempt.step((bound) => transport.call("resendPasswordResetCode", bound)),
-    ...secondFactorAction(context, attempt, "submitPasswordResetSecondFactor"),
-    ...enrolmentActions(context, attempt, "password_reset"),
-    discard: () => attempt.discard()
-  });
-}
-var PASSKEY_AUTOFILL_ROUND_MS = 240000;
-async function askForPasskey(context, authenticator, options, request) {
-  if (!request.autofill) {
-    return authenticator.get(options, { signal: request.signal });
-  }
-  const round = new AbortController;
-  let lapsed = false;
-  const stop = () => round.abort();
-  request.signal?.addEventListener("abort", stop);
-  const cancel = context.environment.setTimer(() => {
-    lapsed = true;
-    round.abort();
-  }, PASSKEY_AUTOFILL_ROUND_MS);
-  try {
-    if (request.signal?.aborted) {
-      round.abort();
-    }
-    return await authenticator.get(options, { signal: round.signal, autofill: true });
-  } catch (error) {
-    if (lapsed && !request.signal?.aborted) {
-      return null;
-    }
-    throw error;
-  } finally {
-    cancel();
-    request.signal?.removeEventListener("abort", stop);
-  }
-}
-async function passkeySignIn(context, request = {}) {
-  const authenticator = context.passkeys();
-  for (;; ) {
-    const started = await context.transport.call("startPasskeySignIn", {});
-    if (!isPasskeySignInStart(started)) {
-      throw clientError("response.invalid", context.messages());
-    }
-    const credential = await askForPasskey(context, authenticator, started.options, request);
-    if (credential !== null) {
-      return signInFlow(context, started.attempt, (bound) => context.transport.call("submitSignInPasskey", { ...bound, body: { credential } }));
-    }
-  }
-}
-async function idTokenSignIn(context, provider) {
-  const started = await context.transport.call("startIdTokenSignIn", {
-    body: { provider }
-  });
-  if (!isRecord5(started) || typeof started.nonce !== "string" || !isUsableAttempt(started.attempt)) {
-    throw clientError("response.invalid", context.messages());
-  }
-  const { attempt } = started;
-  return {
-    nonce: started.nonce,
-    exchange: (idToken, name) => signInFlow(context, attempt, (bound) => context.transport.call("submitSignInIdToken", { ...bound, body: { ...name, idToken } }))
-  };
-}
-
-// src/oauth.ts
-import { ERROR_DEFINITIONS as ERROR_DEFINITIONS2 } from "@tula-tech/contract/error-codes";
-import {
-  EMAIL_LINK_ATTEMPT_PARAM as EMAIL_LINK_ATTEMPT_PARAM2,
-  OAUTH_ERROR_PARAM,
-  OAUTH_TICKET_PARAM
-} from "@tula-tech/contract/headers";
-var OAUTH_BINDING_TTL_MS = 15 * 60000;
-var OAUTH_TICKET_HOLD_MS = 60000;
-var RETRYABLE = new Set([
-  "network.failed",
-  "network.timeout",
-  "rate_limited"
-]);
-function isRetryableOAuthError(error) {
-  return isTulaError(error) && RETRYABLE.has(error.code);
-}
-var OAUTH_STORAGE_PREFIX = "tula.oauth.";
-function isRecord6(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function createOAuthStore(environment, scope) {
-  const storage = environment.tabStorage;
-  const keyOf = (attemptId) => `${OAUTH_STORAGE_PREFIX}${attemptId}`;
-  function guarded(work, fallback) {
-    try {
-      return work();
-    } catch {
-      return fallback;
-    }
-  }
-  function prune() {
-    if (!storage) {
-      return;
-    }
-    const stale = [];
-    for (let index = 0;index < storage.length; index++) {
-      const key = storage.key(index);
-      if (key?.startsWith(OAUTH_STORAGE_PREFIX)) {
-        const expiry = guarded(() => JSON.parse(storage.getItem(key) ?? "null")?.e, undefined);
-        if (typeof expiry !== "number" || expiry <= environment.now()) {
-          stale.push(key);
-        }
-      }
-    }
-    for (const key of stale) {
-      storage.removeItem(key);
-    }
-  }
-  return {
-    available: () => guarded(() => {
-      if (!storage) {
-        return false;
-      }
-      const probe = `${OAUTH_STORAGE_PREFIX}probe`;
-      storage.setItem(probe, "1");
-      storage.removeItem(probe);
-      return true;
-    }, false),
-    save: (attemptId, binding, intent) => guarded(() => {
-      if (!storage) {
-        return false;
-      }
-      prune();
-      storage.setItem(keyOf(attemptId), JSON.stringify({
-        b: binding,
-        e: environment.now() + OAUTH_BINDING_TTL_MS,
-        s: scope,
-        k: intent
-      }));
-      return true;
-    }, false),
-    read: (attemptId) => guarded(() => {
-      prune();
-      const entry = JSON.parse(storage?.getItem(keyOf(attemptId)) ?? "null");
-      return isRecord6(entry) && typeof entry.b === "string" && entry.s === scope && (entry.k === "sign_in" || entry.k === "link") ? { binding: entry.b, intent: entry.k } : null;
-    }, null),
-    remove(attemptId) {
-      guarded(() => storage?.removeItem(keyOf(attemptId)), undefined);
-    }
-  };
-}
-function readOAuthFragment(url) {
-  const at = url.indexOf("#");
-  if (at === -1) {
-    return null;
-  }
-  const fragment = new URLSearchParams(url.slice(at + 1));
-  const ticket = fragment.get(OAUTH_TICKET_PARAM);
-  const error = fragment.get(OAUTH_ERROR_PARAM);
-  if (!ticket && !error) {
-    return null;
-  }
-  const attemptId = fragment.get(EMAIL_LINK_ATTEMPT_PARAM2) ?? "";
-  for (const name of [OAUTH_TICKET_PARAM, OAUTH_ERROR_PARAM, EMAIL_LINK_ATTEMPT_PARAM2]) {
-    fragment.delete(name);
-  }
-  const rest = fragment.toString();
-  return {
-    attemptId,
-    ticket: ticket || null,
-    error: ticket ? null : error,
-    cleanUrl: `${url.slice(0, at)}${rest ? `#${rest}` : ""}`
-  };
-}
-function createOAuthTicketHolder() {
-  let held = null;
-  return {
-    get: () => held,
-    set(next) {
-      held = next;
+        channel.close?.();
+      }
     }
-  };
-}
-function discardOAuthCallback(context) {
-  const held = context.held.get();
-  if (held) {
-    context.held.set(null);
-    context.oauth.remove(held.attemptId);
   }
+  return {
+    wait(signal) {
+      if (attempt.finished()) {
+        return Promise.reject(attempt.refused("flow.invalid_step"));
+      }
+      if (signal?.aborted) {
+        return Promise.resolve(attempt.snapshot().step);
+      }
+      if (stopping) {
+        stopping = false;
+        resumed = true;
+      }
+      loop ??= run();
+      const running = loop;
+      return new Promise((resolve, reject) => {
+        const leave = () => {
+          callers.delete(release);
+          signal?.removeEventListener("abort", release);
+        };
+        const release = () => {
+          leave();
+          resolve(attempt.snapshot().step);
+          if (callers.size === 0) {
+            stopping = true;
+            wake?.();
+          }
+        };
+        callers.add(release);
+        signal?.addEventListener("abort", release);
+        running.then((step) => {
+          leave();
+          resolve(step);
+        }, (error) => {
+          leave();
+          reject(error);
+        });
+      });
+    },
+    stop
+  };
 }
-function isLinkStart(value) {
-  return isRecord6(value) && typeof value.attemptId === "string" && value.attemptId !== "" && typeof value.authorizationUrl === "string" && typeof value.binding === "string";
-}
-function isIdentity(value) {
-  return isRecord6(value) && typeof value.id === "string" && typeof value.provider === "string";
-}
-function isIdentityList(value) {
-  return isRecord6(value) && Array.isArray(value.data) && value.data.every(isIdentity);
+async function passwordResetFlow(context, started) {
+  const { transport } = context;
+  const attempt = createAttempt(context, started);
+  await attempt.accept(started);
+  return flowObject(attempt, {
+    submit: ({ code, password }) => attempt.step((bound) => transport.call("submitPasswordReset", { ...bound, body: { code, password } })),
+    resendCode: () => attempt.step((bound) => transport.call("resendPasswordResetCode", bound)),
+    ...secondFactorAction(context, attempt, "submitPasswordResetSecondFactor"),
+    ...enrolmentActions(context, attempt, "password_reset"),
+    discard: () => attempt.discard()
+  });
 }
-async function startOAuth(context, input, intent) {
-  const { environment, oauth, transport, session } = context;
-  discardOAuthCallback(context);
-  if (!oauth.available()) {
-    throw clientError("storage.failed", context.messages());
+var PASSKEY_AUTOFILL_ROUND_MS = 240000;
+async function askForPasskey(context, authenticator, options, request) {
+  if (!request.autofill) {
+    return authenticator.get(options, { signal: request.signal });
   }
-  const page = environment.page;
-  if (page && originOf(input.redirectUrl) !== originOf(page.url())) {
-    throw clientError("link.cross_origin", context.messages());
+  const round = new AbortController;
+  let lapsed = false;
+  const stop = () => round.abort();
+  request.signal?.addEventListener("abort", stop);
+  const cancel = context.environment.setTimer(() => {
+    lapsed = true;
+    round.abort();
+  }, PASSKEY_AUTOFILL_ROUND_MS);
+  try {
+    if (request.signal?.aborted) {
+      round.abort();
+    }
+    return await authenticator.get(options, { signal: round.signal, autofill: true });
+  } catch (error) {
+    if (lapsed && !request.signal?.aborted) {
+      return null;
+    }
+    throw error;
+  } finally {
+    cancel();
+    request.signal?.removeEventListener("abort", stop);
   }
-  const body = { provider: input.provider, redirectUrl: input.redirectUrl };
-  let attemptId;
-  let started;
-  if (intent === "link") {
-    const answer = await session.authorized("startIdentityLink", { body });
-    if (!isLinkStart(answer)) {
+}
+async function passkeySignIn(context, request = {}) {
+  const authenticator = context.passkeys();
+  for (;; ) {
+    const started = await context.transport.call("startPasskeySignIn", {});
+    if (!isPasskeySignInStart(started)) {
       throw clientError("response.invalid", context.messages());
     }
-    attemptId = answer.attemptId;
-    started = answer;
-  } else {
-    const answer = await transport.call("startOAuthSignIn", { body });
-    if (!isRecord6(answer) || !isRecord6(answer.attempt) || typeof answer.attempt.id !== "string" || typeof answer.authorizationUrl !== "string" || typeof answer.binding !== "string") {
-      throw clientError("response.invalid", context.messages());
+    const credential = await askForPasskey(context, authenticator, started.options, request);
+    if (credential !== null) {
+      return signInFlow(context, started.attempt, (bound) => context.transport.call("submitSignInPasskey", { ...bound, body: { credential } }));
     }
-    attemptId = answer.attempt.id;
-    started = { authorizationUrl: answer.authorizationUrl, binding: answer.binding };
   }
-  if (!/^https?:\/\//i.test(started.authorizationUrl)) {
-    throw clientError("response.invalid", context.messages());
-  }
-  if (!oauth.save(attemptId, started.binding, intent)) {
-    throw clientError("storage.failed", context.messages());
-  }
-  if (input.navigate !== false) {
-    page?.assign?.(started.authorizationUrl);
-  }
-  return { url: started.authorizationUrl };
 }
-function originOf(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return null;
+async function idTokenSignIn(context, provider) {
+  const started = await context.transport.call("startIdTokenSignIn", {
+    body: { provider }
+  });
+  if (!isRecord6(started) || typeof started.nonce !== "string" || !isUsableAttempt(started.attempt)) {
+    throw clientError("response.invalid", context.messages());
   }
-}
-function failed(code, messages) {
-  const known = Object.hasOwn(ERROR_DEFINITIONS2, code) ? code : "oauth.provider_error";
+  const { attempt } = started;
   return {
-    status: "error",
-    code: known,
-    message: formatMessage(known, { messages })
-  };
-}
-async function handleOAuthCallback(context) {
-  const { environment, oauth, held, transport, session } = context;
-  const page = environment.page;
-  if (!page) {
-    return { status: "none" };
-  }
-  const arrived = readOAuthFragment(page.url());
-  let answer;
-  if (arrived) {
-    try {
-      page.replaceUrl(arrived.cleanUrl);
-    } catch {}
-    discardOAuthCallback(context);
-    if (arrived.error !== null || arrived.ticket === null) {
-      oauth.remove(arrived.attemptId);
-      return arrived.error !== null ? failed(arrived.error, context.messages()) : { status: "different_browser" };
-    }
-    answer = {
-      attemptId: arrived.attemptId,
-      ticket: arrived.ticket,
-      until: environment.now() + OAUTH_TICKET_HOLD_MS
-    };
-  } else {
-    const waiting = held.get();
-    if (!waiting) {
-      return { status: "none" };
-    }
-    if (waiting.until <= environment.now()) {
-      discardOAuthCallback(context);
-      return failed("oauth.ticket_invalid", context.messages());
-    }
-    answer = waiting;
-  }
-  const kept = oauth.read(answer.attemptId);
-  const settle = () => {
-    held.set(null);
-    oauth.remove(answer.attemptId);
+    nonce: started.nonce,
+    exchange: (idToken, name) => signInFlow(context, attempt, (bound) => context.transport.call("submitSignInIdToken", { ...bound, body: { ...name, idToken } }))
   };
-  if (!kept) {
-    settle();
-    return { status: "different_browser" };
-  }
-  held.set(answer);
-  const body = { ticket: answer.ticket, attemptId: answer.attemptId, binding: kept.binding };
-  try {
-    let outcome;
-    if (kept.intent === "link") {
-      const identity = await session.authorized("exchangeIdentityLinkTicket", { body });
-      if (!isIdentity(identity)) {
-        throw clientError("response.invalid", context.messages());
-      }
-      outcome = { status: "linked", identity };
-    } else {
-      const attempt = await transport.call("exchangeOAuthTicket", { body });
-      const complete = isRecord6(attempt) && isRecord6(attempt.step) && attempt.step.status === "complete";
-      outcome = {
-        status: complete ? "complete" : "needs_step",
-        flow: await signInFlow(context, attempt)
-      };
-    }
-    settle();
-    return outcome;
-  } catch (error) {
-    if (isRetryableOAuthError(error)) {
-      throw error;
-    }
-    settle();
-    if (!isTulaError(error) || error.status === 0) {
-      throw error;
-    }
-    if (error.code === "oauth.different_browser") {
-      return { status: "different_browser" };
-    }
-    return { status: "error", code: error.code, message: error.message };
-  }
 }
 
 // src/storage.ts
@@ -1719,6 +1822,8 @@ import {
 
 // src/generated/api.gen.ts
 var OPERATIONS = {
+  acceptMyOrganizationInvitation: { method: "POST", path: "/v1/client/me/organization-invitations/{invitationId}/accept", session: true },
+  acceptOrganizationInvitation: { method: "POST", path: "/v1/client/me/organization-invitations/accept", session: true },
   attemptSignInFirstFactor: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/first-factor/attempt", session: false },
   changeMyPassword: { method: "POST", path: "/v1/client/me/password", session: true },
   confirmPasswordResetTotpEnrolment: { method: "POST", path: "/v1/client/password-resets/{attemptId}/factor-enrolment/totp/confirm", session: false },
@@ -1726,7 +1831,14 @@ var OPERATIONS = {
   confirmSignUpTotpEnrolment: { method: "POST", path: "/v1/client/sign-ups/{attemptId}/factor-enrolment/totp/confirm", session: false },
   confirmSmsFactorEnrolment: { method: "POST", path: "/v1/client/me/factors/sms/confirm", session: true },
   confirmTotpEnrolment: { method: "POST", path: "/v1/client/me/factors/totp/confirm", session: true },
+  createMyOrganization: { method: "POST", path: "/v1/client/me/organizations", session: true },
+  createMyOrganizationSetupLink: { method: "POST", path: "/v1/client/me/organizations/{id}/setup-links", session: true },
+  createMyOrganizationSsoConnection: { method: "POST", path: "/v1/client/me/organizations/{organizationId}/sso-connections", session: true },
+  declineMyOrganizationInvitation: { method: "POST", path: "/v1/client/me/organization-invitations/{invitationId}/decline", session: true },
+  declineOrganizationInvitation: { method: "POST", path: "/v1/client/me/organization-invitations/decline", session: true },
   deleteMyIdentity: { method: "DELETE", path: "/v1/client/me/identities/{identityId}", session: true },
+  deleteMyOrganization: { method: "DELETE", path: "/v1/client/me/organizations/{organizationId}", session: true },
+  deleteMyOrganizationSsoConnection: { method: "DELETE", path: "/v1/client/me/organizations/{organizationId}/sso-connections/{id}", session: true },
   disableSmsFactor: { method: "DELETE", path: "/v1/client/me/factors/sms", session: true },
   disableTotp: { method: "DELETE", path: "/v1/client/me/factors/totp", session: true },
   exchangeIdentityLinkTicket: { method: "POST", path: "/v1/client/me/identities/oauth/exchange", session: true },
@@ -1735,33 +1847,57 @@ var OPERATIONS = {
   getClientConfig: { method: "GET", path: "/v1/client/config", session: false },
   getMe: { method: "GET", path: "/v1/client/me", session: true },
   getMyFactors: { method: "GET", path: "/v1/client/me/factors", session: true },
+  getMyOrganizationSsoConnection: { method: "GET", path: "/v1/client/me/organizations/{organizationId}/sso-connections/{id}", session: true },
+  getMyOrganizationSsoConnectionTest: { method: "GET", path: "/v1/client/me/organizations/{organizationId}/sso-connections/{id}/tests/{testId}", session: true },
+  getMyOrganizationSsoGroupRoles: { method: "GET", path: "/v1/client/me/organizations/{organizationId}/sso-connections/{id}/group-roles", session: true },
   getPasswordPolicy: { method: "GET", path: "/v1/client/password-policy", session: false },
   getPasswordResetSecondFactorPasskeyOptions: { method: "POST", path: "/v1/client/password-resets/{attemptId}/second-factor/passkey/options", session: false },
   getSignInSecondFactorPasskeyOptions: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/second-factor/passkey/options", session: false },
   getStepUpPasskeyOptions: { method: "POST", path: "/v1/client/sessions/step-up/passkey", session: true },
+  inviteToMyOrganization: { method: "POST", path: "/v1/client/me/organizations/{organizationId}/invitations", session: true },
+  joinOrganizationSuggestion: { method: "POST", path: "/v1/client/me/organizations/suggestions/{organizationId}/join", session: true },
   listMyIdentities: { method: "GET", path: "/v1/client/me/identities", session: true },
+  listMyOrganizationDomains: { method: "GET", path: "/v1/client/me/organizations/{id}/domains", session: true },
+  listMyOrganizationInvitations: { method: "GET", path: "/v1/client/me/organizations/{organizationId}/invitations", session: true },
+  listMyOrganizationMembers: { method: "GET", path: "/v1/client/me/organizations/{organizationId}/members", session: true },
+  listMyOrganizationRoles: { method: "GET", path: "/v1/client/me/organizations/{organizationId}/roles", session: true },
+  listMyOrganizations: { method: "GET", path: "/v1/client/me/organizations", session: true },
+  listMyOrganizationSetupLinks: { method: "GET", path: "/v1/client/me/organizations/{id}/setup-links", session: true },
+  listMyOrganizationSsoConnections: { method: "GET", path: "/v1/client/me/organizations/{organizationId}/sso-connections", session: true },
+  listMyOrganizationSuggestions: { method: "GET", path: "/v1/client/me/organizations/suggestions", session: true },
   listMyPasskeys: { method: "GET", path: "/v1/client/me/passkeys", session: true },
+  listMyPendingOrganizationInvitations: { method: "GET", path: "/v1/client/me/organization-invitations", session: true },
   listSessions: { method: "GET", path: "/v1/client/sessions", session: true },
   preparePasswordResetSecondFactor: { method: "POST", path: "/v1/client/password-resets/{attemptId}/second-factor/prepare", session: false },
   prepareSignInFirstFactor: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/first-factor/prepare", session: false },
   prepareSignInSecondFactor: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/second-factor/prepare", session: false },
+  previewOrganizationInvitation: { method: "POST", path: "/v1/client/organization-invitations/preview", session: false },
+  refreshMyOrganizationSsoMetadata: { method: "POST", path: "/v1/client/me/organizations/{organizationId}/sso-connections/{id}/refresh-metadata", session: true },
   refreshSession: { method: "POST", path: "/v1/client/sessions/refresh", session: false },
   regenerateBackupCodes: { method: "POST", path: "/v1/client/me/factors/backup-codes", session: true },
+  removeMyOrganizationDomain: { method: "DELETE", path: "/v1/client/me/organizations/{id}/domains/{domainId}", session: true },
+  removeMyOrganizationMember: { method: "DELETE", path: "/v1/client/me/organizations/{organizationId}/members/{userId}", session: true },
   removePasskey: { method: "DELETE", path: "/v1/client/me/passkeys/{passkeyId}", session: true },
   removePhoneNumber: { method: "DELETE", path: "/v1/client/me/phone", session: true },
   renamePasskey: { method: "PATCH", path: "/v1/client/me/passkeys/{passkeyId}", session: true },
+  replaceMyOrganizationSsoGroupRoles: { method: "PUT", path: "/v1/client/me/organizations/{organizationId}/sso-connections/{id}/group-roles", session: true },
   requestEmailAddressCode: { method: "POST", path: "/v1/client/me/email", session: true },
   requestPhoneCode: { method: "POST", path: "/v1/client/me/phone", session: true },
   resendPasswordResetCode: { method: "POST", path: "/v1/client/password-resets/{attemptId}/resend-code", session: false },
   resendSignInCode: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/resend-code", session: false },
   resendSignUpCode: { method: "POST", path: "/v1/client/sign-ups/{attemptId}/resend-code", session: false },
+  revokeMyOrganizationInvitation: { method: "DELETE", path: "/v1/client/me/organizations/{organizationId}/invitations/{invitationId}", session: true },
+  revokeMyOrganizationSetupLink: { method: "DELETE", path: "/v1/client/me/organizations/{id}/setup-links/{linkId}", session: true },
   revokeOtherSessions: { method: "POST", path: "/v1/client/sessions/revoke-others", session: true },
   revokeSession: { method: "DELETE", path: "/v1/client/sessions/{sessionId}", session: true },
   sendStepUpEmailCode: { method: "POST", path: "/v1/client/sessions/step-up/email-code", session: true },
   sendStepUpSmsCode: { method: "POST", path: "/v1/client/sessions/step-up/sms-code", session: true },
+  setActiveOrganization: { method: "PUT", path: "/v1/client/me/organizations/active", session: true },
   signOut: { method: "POST", path: "/v1/client/sessions/sign-out", session: false },
   startIdentityLink: { method: "POST", path: "/v1/client/me/identities/oauth", session: true },
   startIdTokenSignIn: { method: "POST", path: "/v1/client/sign-ins/id-token", session: false },
+  startMyOrganizationDomain: { method: "POST", path: "/v1/client/me/organizations/{id}/domains", session: true },
+  startMyOrganizationSsoConnectionTest: { method: "POST", path: "/v1/client/me/organizations/{organizationId}/sso-connections/{id}/tests", session: true },
   startOAuthSignIn: { method: "POST", path: "/v1/client/sign-ins/oauth", session: false },
   startPasskeyRegistration: { method: "POST", path: "/v1/client/me/passkeys/options", session: true },
   startPasskeySignIn: { method: "POST", path: "/v1/client/sign-ins/passkey", session: false },
@@ -1772,6 +1908,7 @@ var OPERATIONS = {
   startSignUp: { method: "POST", path: "/v1/client/sign-ups", session: false },
   startSignUpTotpEnrolment: { method: "POST", path: "/v1/client/sign-ups/{attemptId}/factor-enrolment/totp", session: false },
   startSmsFactorEnrolment: { method: "POST", path: "/v1/client/me/factors/sms", session: true },
+  startSsoSignIn: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/sso", session: false },
   startTotpEnrolment: { method: "POST", path: "/v1/client/me/factors/totp", session: true },
   stepUpSession: { method: "POST", path: "/v1/client/sessions/step-up", session: true },
   submitPasswordReset: { method: "POST", path: "/v1/client/password-resets/{attemptId}/password", session: false },
@@ -1781,7 +1918,12 @@ var OPERATIONS = {
   submitSignInPasskey: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/passkey", session: false },
   submitSignInPassword: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/password", session: false },
   submitSignInSecondFactor: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/second-factor", session: false },
+  updateMyOrganization: { method: "PATCH", path: "/v1/client/me/organizations/{organizationId}", session: true },
+  updateMyOrganizationDomain: { method: "PATCH", path: "/v1/client/me/organizations/{id}/domains/{domainId}", session: true },
+  updateMyOrganizationMember: { method: "PATCH", path: "/v1/client/me/organizations/{organizationId}/members/{userId}", session: true },
+  updateMyOrganizationSsoConnection: { method: "PATCH", path: "/v1/client/me/organizations/{organizationId}/sso-connections/{id}", session: true },
   verifyEmailAddress: { method: "POST", path: "/v1/client/me/email/verify", session: true },
+  verifyMyOrganizationDomain: { method: "POST", path: "/v1/client/me/organizations/{id}/domains/{domainId}/verify", session: true },
   verifyPhoneNumber: { method: "POST", path: "/v1/client/me/phone/verify", session: true },
   verifySignInEmail: { method: "POST", path: "/v1/client/sign-ins/{attemptId}/verify-email", session: false },
   verifySignInLink: { method: "POST", path: "/v1/client/sign-ins/link", session: false },
@@ -1863,8 +2005,15 @@ function errorFromResponse(response, payload, messages) {
     retryAfterMs: readRetryAfterMs(response, params)
   });
 }
-function buildUrl(baseUrl, path, params) {
-  return baseUrl + path.replace(/\{(\w+)\}/g, (_placeholder, name) => encodeURIComponent(params[name] ?? ""));
+function buildUrl(baseUrl, path, params, query = {}) {
+  const search = new URLSearchParams;
+  for (const [name, value] of Object.entries(query)) {
+    if (value !== undefined) {
+      search.set(name, String(value));
+    }
+  }
+  const text = search.toString();
+  return baseUrl + path.replace(/\{(\w+)\}/g, (_placeholder, name) => encodeURIComponent(params[name] ?? "")) + (text === "" ? "" : `?${text}`);
 }
 function createTransport(options) {
   let nonce;
@@ -1900,7 +2049,7 @@ function createTransport(options) {
     if (input.attemptSecret) {
       headers.set(FLOW_ATTEMPT_HEADER, input.attemptSecret);
     }
-    const url = buildUrl(options.baseUrl, route.path, input.params ?? {});
+    const url = buildUrl(options.baseUrl, route.path, input.params ?? {}, input.query);
     const source = PROVEN.has(id) ? options.deviceKey : undefined;
     const controller = new AbortController;
     const timer = setTimeout(() => controller.abort(), input.timeoutMs ?? options.timeoutMs);
@@ -1917,6 +2066,7 @@ function createTransport(options) {
           headers,
           body: input.body === undefined ? undefined : JSON.stringify(input.body),
           signal: controller.signal,
+          redirect: "manual",
           ...options.client === "web" && { credentials: "include" }
         }));
         if (options.deviceKey) {
@@ -1952,11 +2102,11 @@ function createTransport(options) {
     if (!response.ok) {
       throw errorFromResponse(response, payload, options.messages());
     }
-    if (payload === null) {
+    if (response.status !== 204 && !isRecord7(payload)) {
       throw new TulaError({
         code: "response.invalid",
         message: formatMessage("response.invalid", { messages: options.messages() }),
-        status: response.status
+        status: payload === null ? response.status : 0
       });
     }
     return payload;
@@ -1969,7 +2119,7 @@ var DEFAULT_TIMEOUT_MS = 15000;
 var PUBLISHABLE_KEY_PREFIX = "tula_pk_";
 var SECRET_KEY_PREFIX = "tula_sk_";
 var SESSION_PROFILE_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
-function normalizeBaseUrl(baseUrl) {
+function normalizeBaseUrl(baseUrl, allowInsecureHttp) {
   let url;
   try {
     url = new URL(baseUrl);
@@ -1979,6 +2129,10 @@ function normalizeBaseUrl(baseUrl) {
   if (url.protocol !== "https:" && url.protocol !== "http:") {
     throw new TypeError("createTulaClient: `baseUrl` must be an http(s) URL");
   }
+  const host = url.hostname;
+  if (url.protocol === "http:" && !allowInsecureHttp && host !== "localhost" && !host.endsWith(".localhost") && host !== "127.0.0.1" && host !== "[::1]") {
+    throw new TypeError("createTulaClient: `baseUrl` is plain http to another machine; use https (or set `allowInsecureHttp` on a private network you trust)");
+  }
   return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
 }
 function defaultClientKind() {
@@ -1989,7 +2143,7 @@ function createClient(options, environment) {
   if (typeof publishableKey !== "string" || !publishableKey.startsWith(PUBLISHABLE_KEY_PREFIX)) {
     throw new TypeError(typeof publishableKey === "string" && publishableKey.startsWith(SECRET_KEY_PREFIX) ? "createTulaClient: this is a secret key. Never put one in a client; use the publishable key" : "createTulaClient: `publishableKey` must be a publishable key (tula_pk_…)");
   }
-  const baseUrl = normalizeBaseUrl(options.baseUrl);
+  const baseUrl = normalizeBaseUrl(options.baseUrl, options.allowInsecureHttp);
   const client = options.client ?? defaultClientKind();
   if (client === "web" && options.storage) {
     throw new TypeError("createTulaClient: a `web` client keeps its refresh token in an httpOnly cookie and takes no `storage`");
@@ -2051,13 +2205,11 @@ function createClient(options, environment) {
     environment,
     links,
     scope,
-    passkeys
-  };
-  const oauth = {
-    ...flows,
+    passkeys,
     oauth: createOAuthStore(environment, scope),
     held: createOAuthTicketHolder()
   };
+  const oauth = flows;
   let config = null;
   function checked(answer, guard) {
     if (!guard(answer)) {
@@ -2166,6 +2318,122 @@ function createClient(options, environment) {
       },
       prepareStepUp: ({ method }) => receipt(method === "sms_code" ? "sendStepUpSmsCode" : "sendStepUpEmailCode", method)
     },
+    organizations: {
+      async list(query) {
+        const epoch = session.organizationEpoch();
+        const answer = await session.authorized("listMyOrganizations", { query });
+        const now = session.state();
+        if (now.status === "signed-in") {
+          session.noteActiveOrganization(now.sessionId, answer.activeOrganizationId, epoch);
+        }
+        return answer;
+      },
+      create: (input) => session.authorized("createMyOrganization", { body: input }),
+      setActive: (organizationId) => session.setActiveOrganization(organizationId),
+      suggestions: () => session.authorized("listMyOrganizationSuggestions", {}),
+      join: (organizationId) => session.authorized("joinOrganizationSuggestion", { params: { organizationId } }),
+      update: (organizationId, input) => session.authorized("updateMyOrganization", { params: { organizationId }, body: input }),
+      async remove(organizationId) {
+        await session.authorized("deleteMyOrganization", { params: { organizationId } });
+      },
+      async leave(organizationId) {
+        const now = session.state();
+        const user = now.status === "signed-in" ? now.user : null;
+        const userId = user?.id ?? (await asUser(() => session.authorized("getMe", {}))).id;
+        await session.authorized("removeMyOrganizationMember", {
+          params: { organizationId, userId }
+        });
+      },
+      roles: (organizationId) => session.authorized("listMyOrganizationRoles", { params: { organizationId } }),
+      members: {
+        list: (organizationId) => session.authorized("listMyOrganizationMembers", { params: { organizationId } }),
+        changeRole: (organizationId, userId, role) => session.authorized("updateMyOrganizationMember", {
+          params: { organizationId, userId },
+          body: { role }
+        }),
+        async remove(organizationId, userId) {
+          await session.authorized("removeMyOrganizationMember", {
+            params: { organizationId, userId }
+          });
+        }
+      },
+      domains: {
+        list: (id) => session.authorized("listMyOrganizationDomains", { params: { id } }),
+        start: (id, input) => session.authorized("startMyOrganizationDomain", { params: { id }, body: input }),
+        verify: (id, domainId, code) => session.authorized("verifyMyOrganizationDomain", {
+          params: { id, domainId },
+          body: { code }
+        }),
+        update: (id, domainId, mode) => session.authorized("updateMyOrganizationDomain", {
+          params: { id, domainId },
+          body: { mode }
+        }),
+        async remove(id, domainId) {
+          await session.authorized("removeMyOrganizationDomain", { params: { id, domainId } });
+        }
+      },
+      sso: {
+        list: (organizationId) => session.authorized("listMyOrganizationSsoConnections", { params: { organizationId } }),
+        get: (organizationId, id) => session.authorized("getMyOrganizationSsoConnection", { params: { organizationId, id } }),
+        create: (organizationId, input) => session.authorized("createMyOrganizationSsoConnection", {
+          params: { organizationId },
+          body: input
+        }),
+        update: (organizationId, id, input) => session.authorized("updateMyOrganizationSsoConnection", {
+          params: { organizationId, id },
+          body: input
+        }),
+        refreshMetadata: (organizationId, id) => session.authorized("refreshMyOrganizationSsoMetadata", {
+          params: { organizationId, id }
+        }),
+        async remove(organizationId, id) {
+          await session.authorized("deleteMyOrganizationSsoConnection", {
+            params: { organizationId, id }
+          });
+        },
+        groupRoles: (organizationId, id) => session.authorized("getMyOrganizationSsoGroupRoles", { params: { organizationId, id } }),
+        setGroupRoles: (organizationId, id, mapping) => session.authorized("replaceMyOrganizationSsoGroupRoles", {
+          params: { organizationId, id },
+          body: mapping
+        }),
+        startTest: (organizationId, id, redirectUrl) => session.authorized("startMyOrganizationSsoConnectionTest", {
+          params: { organizationId, id },
+          body: { redirectUrl }
+        }),
+        testResult: (organizationId, id, testId) => session.authorized("getMyOrganizationSsoConnectionTest", {
+          params: { organizationId, id, testId }
+        }),
+        setupLinks: (organizationId) => session.authorized("listMyOrganizationSetupLinks", { params: { id: organizationId } }),
+        createSetupLink: (organizationId, input = {}) => session.authorized("createMyOrganizationSetupLink", {
+          params: { id: organizationId },
+          body: input
+        }),
+        async revokeSetupLink(organizationId, linkId) {
+          await session.authorized("revokeMyOrganizationSetupLink", {
+            params: { id: organizationId, linkId }
+          });
+        }
+      },
+      invitations: {
+        list: (organizationId) => session.authorized("listMyOrganizationInvitations", { params: { organizationId } }),
+        invite: (organizationId, input) => session.authorized("inviteToMyOrganization", { params: { organizationId }, body: input }),
+        async revoke(organizationId, invitationId) {
+          await session.authorized("revokeMyOrganizationInvitation", {
+            params: { organizationId, invitationId }
+          });
+        },
+        preview: (token) => transport.call("previewOrganizationInvitation", { body: { token } }),
+        accept: (token) => session.authorized("acceptOrganizationInvitation", { body: { token } }),
+        async decline(token) {
+          await session.authorized("declineOrganizationInvitation", { body: { token } });
+        },
+        mine: () => session.authorized("listMyPendingOrganizationInvitations", {}),
+        acceptMine: (invitationId) => session.authorized("acceptMyOrganizationInvitation", { params: { invitationId } }),
+        async declineMine(invitationId) {
+          await session.authorized("declineMyOrganizationInvitation", { params: { invitationId } });
+        }
+      }
+    },
     user: {
       get: () => asUser(() => session.authorized("getMe", {})),
       email: {
@@ -2266,6 +2534,22 @@ function createClient(options, environment) {
 function createTulaClient(options) {
   return createClient(options, runtimeEnvironment());
 }
+// src/invitation.ts
+import { ORGANIZATION_INVITATION_TOKEN_PARAM } from "@tula-tech/contract/headers";
+function readInvitationLink(url) {
+  const at = url.indexOf("#");
+  if (at === -1) {
+    return null;
+  }
+  const fragment = new URLSearchParams(url.slice(at + 1));
+  const token = fragment.get(ORGANIZATION_INVITATION_TOKEN_PARAM);
+  if (!token) {
+    return null;
+  }
+  fragment.delete(ORGANIZATION_INVITATION_TOKEN_PARAM);
+  const rest = fragment.toString();
+  return { token, cleanUrl: `${url.slice(0, at)}${rest ? `#${rest}` : ""}` };
+}
 export {
   ACCESS_TOKEN_EXPIRY_SKEW_MS,
   DEFAULT_TIMEOUT_MS,
@@ -2285,6 +2569,7 @@ export {
   isStepUpRequired,
   isTulaError,
   memoryStorage,
+  readInvitationLink,
   runtimeEnvironment,
   stepUpMethods
 };