@tula-tech/core 0.2.0 → 0.3.1

package/dist/index.d.ts

@@ -4,6 +4,27 @@ import { DeviceKey as DeviceKey2 } from "@tula-tech/contract/device-binding";
 import { ErrorCode as ErrorCode2 } from "@tula-tech/contract/error-codes";
 /** Schemas of the client API (`/v1/client/*`), by their name in the OpenAPI document. */
 interface Schemas {
+	AcceptedInvitation: {
+		id: string;
+		name: string;
+		slug: string;
+		role: string;
+		permissions: string[];
+		createdAt: string;
+	};
+	ActiveOrganization: {
+		sessionId: string;
+		organizationId: string | null;
+		accessToken?: string;
+		accessTokenExpiresAt?: string;
+	};
+	AssignableRole: {
+		key: string;
+		name: string;
+	};
+	AssignableRoleList: {
+		data: Schemas["AssignableRole"][];
+	};
 	BackupCodes: {
 		codes: string[];
 	};
@@ -31,6 +52,50 @@ interface Schemas {
 		phone?: {
 			enabled: boolean;
 		};
+		organizations?: {
+			enabled: boolean;
+			allowUserCreated: boolean;
+			personalAccount: boolean;
+		};
+	};
+	CreateMySetupLinkRequest: {
+		name?: string;
+		expiresInDays?: number;
+	};
+	CreateMySsoConnectionRequest: {
+		protocol?: "oidc" | "saml";
+		name: string;
+		issuer?: string;
+		clientId?: string;
+		clientSecret?: string;
+		saml?: Schemas["SamlSettingsInput"];
+		attributeMapping?: Schemas["SsoAttributeMapping"];
+		defaultRole?: Schemas["OrganizationRoleKey"];
+		domains?: Schemas["OrganizationDomainName"][];
+	};
+	CreateOrganizationInvitationRequest: {
+		email: string;
+		role: Schemas["OrganizationRoleKey"];
+		redirectUrl: string;
+	};
+	CreateOrganizationRequest: {
+		name: string;
+		slug: Schemas["OrganizationSlug"];
+	};
+	CreatedSetupLink: {
+		id: string;
+		organizationId: string;
+		name: string;
+		/** The start of the token, to tell links apart in a list. */
+		prefix: string;
+		expiresAt: string;
+		revokedAt: string | null;
+		lastUsedAt: string | null;
+		createdAt: string;
+		/** The setup token. Shown once; only its hash is stored. */
+		token: string;
+		/** The address to send to the IT administrator. The token is in its fragment. */
+		url: string;
 	};
 	CurrentUser: {
 		id: string;
@@ -64,7 +129,7 @@ interface Schemas {
 		status: "verified";
 	};
 	EmailVerificationStrategy: "email_code" | "email_link";
-	ErrorCode: "auth.invalid_credentials" | "auth.unauthenticated" | "auth.invalid_key" | "auth.forbidden" | "auth.user_banned" | "auth.method_disabled" | "auth.step_up_required" | "flow.not_found" | "flow.invalid_step" | "email.invalid" | "email.already_set" | "password.too_short" | "password.too_long" | "password.missing_lowercase" | "password.missing_uppercase" | "password.missing_number" | "password.missing_special" | "password.too_few_character_classes" | "password.contains_user_info" | "password.common" | "password.breached" | "password.repeated_characters" | "password.sequence" | "password.reused" | "password.not_set" | "verification.invalid_code" | "verification.expired" | "verification.too_many_attempts" | "verification.different_browser" | "mfa.invalid_code" | "mfa.already_enabled" | "mfa.not_enabled" | "mfa.enrolment_expired" | "mfa.not_available" | "mfa.enrolment_needs_other_sign_in" | "mfa.needs_other_sign_in" | "mfa.sms_not_allowed" | "mfa.phone_number_required" | "mfa.required_by_policy" | "oauth.access_denied" | "oauth.provider_error" | "oauth.state_invalid" | "oauth.ticket_invalid" | "oauth.different_browser" | "oauth.email_missing" | "oauth.email_unverified" | "oauth.account_exists" | "oauth.identity_in_use" | "oauth.already_linked" | "identity.last_sign_in_method" | "webhook.url_not_allowed" | "webhook.cannot_redeliver" | "webhook.rotation_refused" | "hook.denied" | "hook.unavailable" | "hook.url_not_allowed" | "passkey.registration_failed" | "passkey.already_registered" | "passkey.limit_reached" | "passkey.last_sign_in_method" | "phone.invalid" | "sms.disabled" | "sms.country_not_allowed" | "sms.unavailable" | "session.invalid_token" | "session.expired" | "session.revoked" | "session.reuse_detected" | "session.limit_reached" | "device.proof_invalid" | "device.nonce_required" | "device.binding_not_supported" | "device.binding_required" | "rate_limited" | "request.malformed" | "request.too_large" | "request.origin_not_allowed" | "request.redirect_not_allowed" | "validation.failed" | "resource.not_found" | "resource.conflict" | "precondition.required" | "precondition.failed" | "not_implemented" | "service.unavailable" | "internal";
+	ErrorCode: "auth.invalid_credentials" | "auth.unauthenticated" | "auth.invalid_key" | "auth.forbidden" | "auth.user_banned" | "auth.method_disabled" | "auth.step_up_required" | "flow.not_found" | "flow.invalid_step" | "email.invalid" | "email.already_set" | "password.too_short" | "password.too_long" | "password.missing_lowercase" | "password.missing_uppercase" | "password.missing_number" | "password.missing_special" | "password.too_few_character_classes" | "password.contains_user_info" | "password.common" | "password.breached" | "password.repeated_characters" | "password.sequence" | "password.reused" | "password.not_set" | "import.unsupported_algorithm" | "import.hash_malformed" | "import.hash_parameters_too_weak" | "import.hash_parameters_too_costly" | "verification.invalid_code" | "verification.expired" | "verification.too_many_attempts" | "verification.different_browser" | "mfa.invalid_code" | "mfa.already_enabled" | "mfa.not_enabled" | "mfa.enrolment_expired" | "mfa.not_available" | "mfa.enrolment_needs_other_sign_in" | "mfa.needs_other_sign_in" | "mfa.sms_not_allowed" | "mfa.phone_number_required" | "mfa.required_by_policy" | "oauth.access_denied" | "oauth.provider_error" | "oauth.state_invalid" | "oauth.ticket_invalid" | "oauth.different_browser" | "oauth.email_missing" | "oauth.email_unverified" | "oauth.account_exists" | "oauth.identity_in_use" | "oauth.already_linked" | "identity.last_sign_in_method" | "webhook.url_not_allowed" | "webhook.cannot_redeliver" | "webhook.rotation_refused" | "hook.denied" | "hook.unavailable" | "hook.url_not_allowed" | "passkey.registration_failed" | "passkey.already_registered" | "passkey.limit_reached" | "passkey.last_sign_in_method" | "phone.invalid" | "sms.disabled" | "sms.country_not_allowed" | "sms.unavailable" | "session.invalid_token" | "session.expired" | "session.revoked" | "session.reuse_detected" | "session.limit_reached" | "device.proof_invalid" | "device.nonce_required" | "device.binding_not_supported" | "device.binding_required" | "user.last_organization_manager" | "user.managed" | "organization.disabled" | "organization.slug_taken" | "organization.member_exists" | "organization.last_manager" | "organization.role_unknown" | "organization.not_a_member" | "organization.creation_disabled" | "organization.limit_reached" | "organization.personal_account_disabled" | "organization.role_exists" | "organization.role_in_use" | "organization.role_built_in" | "organization.role_limit" | "organization.permission_required" | "organization.role_not_assignable" | "organization.invitation_exists" | "organization.invitation_not_found" | "organization.invitation_expired" | "organization.invitation_revoked" | "organization.invitation_used" | "organization.invitation_wrong_account" | "organization.invitation_email_unverified" | "organization.invitation_role_gone" | "organization.domain_public" | "organization.domain_taken" | "organization.domain_address_mismatch" | "organization.domain_limit" | "organization.suggestion_unavailable" | "sso.disabled" | "sso.connection_not_found" | "sso.name_taken" | "sso.domain_taken" | "sso.domain_not_verified" | "sso.issuer_not_allowed" | "sso.saml_invalid" | "sso.connection_in_use" | "sso.invalid_transition" | "sso.url_not_https" | "sso.test_required" | "sso.test_not_found" | "sso.role_not_allowed" | "sso.unavailable" | "sso.provider_error" | "sso.user_not_provisioned" | "sso.email_domain_mismatch" | "rate_limited" | "request.malformed" | "request.too_large" | "request.origin_not_allowed" | "request.redirect_not_allowed" | "validation.failed" | "resource.not_found" | "resource.conflict" | "precondition.required" | "precondition.failed" | "not_implemented" | "service.unavailable" | "internal";
 	ErrorEnvelope: {
 		status: number;
 		code: Schemas["ErrorCode"];
@@ -110,7 +175,7 @@ interface Schemas {
 		strategy: Schemas["PreparedFirstFactorStrategy"];
 		redirectUrl?: string;
 	};
-	FirstFactorStrategy: "password" | "email_code" | "email_link" | "passkey" | "sms_code" | "oauth_google" | "oauth_github" | "oauth_apple" | "oauth_microsoft" | "oauth_discord" | "oauth_linkedin" | "oauth_x" | "oauth_facebook";
+	FirstFactorStrategy: "password" | "email_code" | "email_link" | "passkey" | "sms_code" | "oauth_google" | "oauth_github" | "oauth_apple" | "oauth_microsoft" | "oauth_discord" | "oauth_linkedin" | "oauth_x" | "oauth_facebook" | "sso";
 	FlowAttempt: {
 		id: string;
 		kind: Schemas["FlowKind"];
@@ -185,7 +250,26 @@ interface Schemas {
 	IdentityList: {
 		data: Schemas["Identity"][];
 	};
+	InvitationPreview: {
+		organizationName: string;
+		role: string;
+		email: string;
+		expiresAt: string;
+	};
+	InvitationTokenRequest: {
+		token: string;
+	};
 	MfaPolicy: "off" | "optional" | "required";
+	MyOrganizationInvitation: {
+		id: string;
+		organizationName: string;
+		role: string;
+		expiresAt: string;
+	};
+	MyOrganizationInvitationList: {
+		meta: Schemas["PaginationMeta"];
+		data: Schemas["MyOrganizationInvitation"][];
+	};
 	NewPasswordReason: "expired";
 	NewPasswordRequest: {
 		password: string;
@@ -205,6 +289,64 @@ interface Schemas {
 		provider: Schemas["OAuthProvider"];
 		redirectUrl: string;
 	};
+	OrganizationDomain: {
+		id: string;
+		domain: string;
+		mode: Schemas["OrganizationDomainMode"];
+		status: Schemas["OrganizationDomainStatus"];
+		verifiedAt: string | null;
+		expiresAt: string | null;
+		codeExpiresAt: string | null;
+		createdAt: string;
+		updatedAt: string;
+	};
+	OrganizationDomainList: {
+		data: Schemas["OrganizationDomain"][];
+	};
+	OrganizationDomainMode: "suggest" | "auto_join";
+	OrganizationDomainName: string;
+	OrganizationDomainStatus: "pending" | "verified" | "needs_reverification";
+	OrganizationInvitation: {
+		id: string;
+		organizationId: string;
+		email: string;
+		role: string;
+		status: "pending" | "accepted" | "declined" | "revoked" | "expired";
+		invitedBy: string | null;
+		expiresAt: string;
+		createdAt: string;
+	};
+	OrganizationInvitationList: {
+		meta: Schemas["PaginationMeta"];
+		data: Schemas["OrganizationInvitation"][];
+	};
+	OrganizationMember: {
+		userId: string;
+		name: string | null;
+		email: string | null;
+		role: string;
+		createdAt: string;
+	};
+	OrganizationMemberList: {
+		meta: Schemas["PaginationMeta"];
+		data: Schemas["OrganizationMember"][];
+	};
+	OrganizationRoleKey: string;
+	OrganizationSlug: string;
+	OrganizationSuggestion: {
+		id: string;
+		name: string;
+		slug: string;
+	};
+	OrganizationSuggestionList: {
+		data: Schemas["OrganizationSuggestion"][];
+	};
+	PaginationMeta: {
+		totalCount: number;
+		totalPages: number;
+		page: number;
+		perPage: number;
+	};
 	Passkey: {
 		id: string;
 		name: string;
@@ -339,6 +481,26 @@ interface Schemas {
 	RevokedSessions: {
 		revoked: number;
 	};
+	SamlConnection: {
+		idpEntityId: string;
+		ssoUrl: string;
+		metadataUrl: string | null;
+		certificates: {
+			fingerprint: string;
+			notAfter: string;
+			expired: boolean;
+		}[];
+		spEntityId: string;
+		acsUrl: string;
+		spMetadataUrl: string;
+	};
+	SamlSettingsInput: {
+		metadataXml?: string;
+		metadataUrl?: string;
+		idpEntityId?: string;
+		ssoUrl?: string;
+		certificates?: string[];
+	};
 	SecondFactorMethod: "totp" | "passkey" | "backup_code" | "sms_code";
 	SecondFactorPrepareRequest: {
 		method: Schemas["PreparedSecondFactorMethod"];
@@ -377,6 +539,23 @@ interface Schemas {
 		accessTokenExpiresAt?: string;
 		refreshToken?: string;
 	};
+	SetActiveOrganizationRequest: {
+		organizationId: string | null;
+	};
+	SetupLink: {
+		id: string;
+		organizationId: string;
+		name: string;
+		/** The start of the token, to tell links apart in a list. */
+		prefix: string;
+		expiresAt: string;
+		revokedAt: string | null;
+		lastUsedAt: string | null;
+		createdAt: string;
+	};
+	SetupLinkList: {
+		links: Schemas["SetupLink"][];
+	};
 	SignInStartRequest: {
 		identifier: string;
 	};
@@ -395,6 +574,75 @@ interface Schemas {
 	SmsFactorConfirmRequest: {
 		code: string;
 	};
+	SsoAttributeMapping: {
+		idp?: "okta" | "entra" | "google_workspace" | "jumpcloud" | "onelogin" | "ping" | "generic";
+		email?: string;
+		firstName?: string;
+		lastName?: string;
+		groups?: string;
+	};
+	SsoConnection: {
+		id: string;
+		organizationId: string;
+		protocol: "oidc" | "saml";
+		name: string;
+		status: "draft" | "active" | "disabled";
+		issuer: string;
+		clientId: string;
+		clientSecretSet: boolean;
+		saml: Schemas["SamlConnection"] | null;
+		redirectUri: string | null;
+		attributeMapping: Schemas["SsoAttributeMapping"] | null;
+		defaultRole: string;
+		enforced: boolean;
+		breakGlassRole: string | null;
+		trustIdpMfa: boolean;
+		domains: string[];
+		tested: boolean;
+		createdAt: string;
+		updatedAt: string;
+	};
+	SsoConnectionList: {
+		connections: Schemas["SsoConnection"][];
+	};
+	SsoGroupRoles: {
+		mappings: {
+			group: string;
+			role: Schemas["OrganizationRoleKey"];
+		}[];
+	};
+	SsoStartRequest: {
+		redirectUrl: string;
+	};
+	SsoTestResult: {
+		testId: string;
+		status: "pending" | "passed" | "failed";
+		reason: "wrong_audience" | "wrong_issuer" | "wrong_recipient" | "unsigned_assertion" | "signature_invalid" | "signature_algorithm" | "certificate_not_trusted" | "certificate_expired" | "assertion_expired" | "clock_skew" | "response_not_to_this_request" | "replayed" | "idp_refused" | "encrypted_assertion" | "malformed_response" | "discovery_failed" | "token_exchange_failed" | "no_id_token" | "id_token_invalid" | "email_missing" | "email_outside_domains" | null;
+		message: string | null;
+		attributes: {
+			name: string;
+			values: string[];
+		}[];
+		groups: string[];
+		mapped: {
+			email: string | null;
+			givenName: string | null;
+			familyName: string | null;
+			emailOnVerifiedDomain: boolean;
+		} | null;
+	};
+	SsoTestStart: {
+		testId: string;
+		authorizationUrl: string;
+	};
+	SsoTestStartRequest: {
+		redirectUrl: string;
+	};
+	StartOrganizationDomainRequest: {
+		domain: Schemas["OrganizationDomainName"];
+		email: string;
+		mode: Schemas["OrganizationDomainMode"];
+	};
 	StepUpEmailCode: {
 		method: "email_code";
 		destination: string;
@@ -426,9 +674,49 @@ interface Schemas {
 		secret: string;
 		uri: string;
 	};
+	UpdateOrganizationDomainRequest: {
+		mode: Schemas["OrganizationDomainMode"];
+	};
+	UpdateOrganizationMemberRequest: {
+		role: Schemas["OrganizationRoleKey"];
+	};
+	UpdateOrganizationRequest: {
+		name?: string;
+		slug?: Schemas["OrganizationSlug"];
+	};
+	UpdateSsoConnectionRequest: {
+		name?: string;
+		issuer?: string;
+		clientId?: string;
+		clientSecret?: string;
+		saml?: Schemas["SamlSettingsInput"];
+		attributeMapping?: Schemas["SsoAttributeMapping"];
+		defaultRole?: Schemas["OrganizationRoleKey"];
+		enforced?: boolean;
+		breakGlassRole?: Schemas["OrganizationRoleKey"] | null;
+		trustIdpMfa?: boolean;
+		domains?: Schemas["OrganizationDomainName"][];
+		status?: "draft" | "active" | "disabled";
+	};
+	UserOrganization: {
+		id: string;
+		name: string;
+		slug: string;
+		role: string;
+		permissions: string[];
+		createdAt: string;
+	};
+	UserOrganizationList: {
+		activeOrganizationId: string | null;
+		meta: Schemas["PaginationMeta"];
+		data: Schemas["UserOrganization"][];
+	};
 	VerifyEmailRequest: {
 		code: string;
 	};
+	VerifyOrganizationDomainRequest: {
+		code: string;
+	};
 }
 /**
 * The next step of a sign-up, sign-in or password reset, decided by the server and
@@ -528,7 +816,11 @@ type ClientKind = Schemas["SessionClient"];
 * - `loading`: not known yet. Call `load()` (or `session.getToken()`) to find out.
 * - `signed-out`: nobody is signed in.
 * - `signed-in`: a session exists. `user` is `null` only until it has been fetched, or if
-*   fetching it failed; `user.get()` fetches it again.
+*   fetching it failed; `user.get()` fetches it again. `organizationId` is the organization
+*   the session acts in, `null` for the personal account. For a session with an
+*   access token it is read from the token's `org_id` claim (unverified: for showing, never
+*   for authorizing) and so follows every refresh; a browser's `stateful` session has no
+*   token, so it is known after `organizations.list()` or `organizations.setActive()`.
 *
 * @example
 * ```ts
@@ -547,6 +839,7 @@ type AuthState = {
 	readonly status: "signed-in";
 	readonly sessionId: string;
 	readonly user: User | null;
+	readonly organizationId: string | null;
 };
 /**
 * A `fetch` the client sends every request through. The global `fetch` fits; so does a
@@ -700,6 +993,106 @@ type EmailCodeSent2 = Schemas["EmailCodeSent"];
 */
 type StepUpMethod = StepUpProof["method"];
 /**
+* An organization the signed-in user belongs to, with their role in it and its permission
+* keys.
+*
+* @example
+* ```ts
+* const { data } = await tula.organizations.list()
+* const admin = data.find((org) => org.role === 'admin')
+* ```
+*/
+type UserOrganization2 = Schemas["UserOrganization"];
+/** A page of the user's organizations, with the session's active organization's id. */
+type UserOrganizationList2 = Schemas["UserOrganizationList"];
+/** An organization the user may join because of a verified address (`organizations.suggestions()`). */
+type OrganizationSuggestion2 = Schemas["OrganizationSuggestion"];
+/** What `organizations.suggestions()` answers: the organizations the user is offered. */
+type OrganizationSuggestionList2 = Schemas["OrganizationSuggestionList"];
+/**
+* An invitation to an organization as the inviting side sees it. The token the emailed link
+* carries is never part of it.
+*
+* @example
+* ```ts
+* const { data } = await tula.organizations.invitations.list(org.id)
+* const open = data.filter((invitation) => invitation.status === 'pending')
+* ```
+*/
+type OrganizationInvitation2 = Schemas["OrganizationInvitation"];
+/** A page of an organization's invitations. */
+type OrganizationInvitationList2 = Schemas["OrganizationInvitationList"];
+/**
+* An invitation addressed to the signed-in user, as `organizations.invitations.mine()` lists it:
+* its `id`, the organization's name, the role's key and the expiry; never a token.
+*
+* @example
+* ```ts
+* const { data } = await tula.organizations.invitations.mine()
+* await tula.organizations.invitations.acceptMine(data[0].id)
+* ```
+*/
+type MyOrganizationInvitation2 = Schemas["MyOrganizationInvitation"];
+/** A page of the invitations addressed to the signed-in user. */
+type MyOrganizationInvitationList2 = Schemas["MyOrganizationInvitationList"];
+/** The body of `organizations.invitations.invite()`: the address, a role's key and the page the link leads to. */
+type CreateOrganizationInvitationInput = Schemas["CreateOrganizationInvitationRequest"];
+/** What the holder of an invitation's token may see before signing in. */
+type InvitationPreview2 = Schemas["InvitationPreview"];
+/** What accepting an invitation answers: the organization joined, with the role and its permissions. */
+type AcceptedInvitation2 = Schemas["AcceptedInvitation"];
+/**
+* A member of an organization as another member sees them: the user's id, name and address
+* (each `null` when they have none) and the key of their role.
+*
+* @example
+* ```ts
+* const { data } = await tula.organizations.members.list(org.id)
+* const admins = data.filter((member) => member.role === 'admin')
+* ```
+*/
+type OrganizationMember2 = Schemas["OrganizationMember"];
+/** A page of an organization's members. */
+type OrganizationMemberList2 = Schemas["OrganizationMemberList"];
+/** A role the signed-in member may give: its key and its name. */
+type AssignableRole2 = Schemas["AssignableRole"];
+/** What `organizations.roles()` answers: the roles the member may offer. */
+type AssignableRoleList2 = Schemas["AssignableRoleList"];
+/** The body of `organizations.update()`: a new name, a new slug, or both. */
+type UpdateOrganizationInput = Schemas["UpdateOrganizationRequest"];
+/** A domain an organization claimed, pending a code or verified. */
+type OrganizationDomain2 = Schemas["OrganizationDomain"];
+/** An organization's domains. */
+type OrganizationDomainList2 = Schemas["OrganizationDomainList"];
+/** The body of `organizations.domains.start()`: the domain, an address on it and the mode. */
+type StartOrganizationDomainInput = Schemas["StartOrganizationDomainRequest"];
+/** An SSO connection of an organization, as its admins see it: never with the client secret. */
+type OrganizationSsoConnection = Schemas["SsoConnection"];
+/** An organization's SSO connections. */
+type OrganizationSsoConnectionList = Schemas["SsoConnectionList"];
+/** The body of `organizations.sso.create()`: the organization is the one of the call. */
+type CreateOrganizationSsoConnectionInput = Schemas["CreateMySsoConnectionRequest"];
+/** The fields `organizations.sso.update()` changes; an absent one is kept. */
+type UpdateOrganizationSsoConnectionInput = Schemas["UpdateSsoConnectionRequest"];
+/** An organization's IdP group to role mapping, in precedence order. */
+type OrganizationSsoGroupRoles = Schemas["SsoGroupRoles"];
+/** A started test sign-in: where to send the browser, and the id it returns with. */
+type OrganizationSsoTestStart = Schemas["SsoTestStart"];
+/** A test sign-in's result. */
+type OrganizationSsoTestResult = Schemas["SsoTestResult"];
+/** An SSO setup link of an organization, as listed (never its token). */
+type OrganizationSetupLink = Schemas["SetupLink"];
+/** The setup links of an organization. */
+type OrganizationSetupLinkList = Schemas["SetupLinkList"];
+/** A new setup link: the `token` and `url` are shown once. */
+type CreatedOrganizationSetupLink = Schemas["CreatedSetupLink"];
+/** The body of `organizations.sso.createSetupLink()`. */
+type CreateOrganizationSetupLinkInput = Schemas["CreateMySetupLinkRequest"];
+/** What `organizations.setActive()` answers: the session's active organization now. */
+type ActiveOrganization2 = Schemas["ActiveOrganization"];
+/** The body of `organizations.create()`: a name and a slug (lower-case letters, digits, hyphens). */
+type CreateOrganizationInput = Schemas["CreateOrganizationRequest"];
+/**
 * Codes for failures that happen in the client, before or instead of an API answer. They sit
 * next to the contract's codes so that callers have one thing to catch and one field to switch
 * on. `status` is `0` for all of them.
@@ -844,7 +1237,8 @@ interface TulaErrorInit {
 *
 * `code` is a contract code (`auth.invalid_credentials`, `password.too_short`, `rate_limited`,
 * …) or one of the client's own (`network.failed`, `network.timeout`, `response.invalid`,
-* `storage.failed`, `flow.busy`). An error the client raised itself has `status: 0`. `message` is ready to show, taken from the client's locale table. An error
+* `storage.failed`, `flow.busy`). An error the client raised itself has `status: 0`. `message` is
+* ready to show, taken from the client's locale table. An error
 * never contains a token, an attempt's secret or a password.
 *
 * @example
@@ -1026,7 +1420,7 @@ import { DeviceKey } from "@tula-tech/contract/device-binding";
 /**
 * Where a client's device key comes from, for a runtime that cannot hand one over when the
 * client is created: a key in a phone's secure hardware is found or made by a native call,
-* which takes time and can fail (ADR 0052). Asked before every request a key proves.
+* which takes time and can fail. Asked before every request a key proves.
 *
 * @param operation - The request about to be sent: the operation id of one of the starts,
 *   or `refreshSession`.
@@ -1127,7 +1521,7 @@ interface Environment {
 	linkStorage: LinkStorageLike | undefined;
 	/**
 	* Storage one tab keeps across a navigation and no other tab can read (`sessionStorage`).
-	* Holds the binding of an OAuth round trip while the tab is at the provider (ADR 0026): not a
+	* Holds the binding of an OAuth round trip while the tab is at the provider: not a
 	* token, and not an attempt's secret.
 	*/
 	tabStorage: LinkStorageLike | undefined;
@@ -1135,7 +1529,7 @@ interface Environment {
 	page: PageLike | undefined;
 	/**
 	* Where `navigator.credentials` and `PublicKeyCredential` are looked up when a passkey is
-	* asked for (ADR 0027). Read lazily: a runtime without WebAuthn simply has neither.
+	* asked for. Read lazily: a runtime without WebAuthn simply has neither.
 	*/
 	passkeys: PasskeyGlobals | undefined;
 	/**
@@ -1145,7 +1539,7 @@ interface Environment {
 	passkeyProvider?: PasskeyProvider;
 	/**
 	* Where the client's device key comes from, for a runtime that finds or makes it by a call
-	* that takes time (a key in a phone's secure hardware; ADR 0052). Asked before every
+	* that takes time (a key in a phone's secure hardware). Asked before every
 	* request a key proves, unless the client was given a `deviceKey` of its own. Never for a
 	* `web` client.
 	*/
@@ -1196,8 +1590,9 @@ declare function runtimeEnvironment(globals?: RuntimeGlobals): Environment;
 * The `web` client kind never uses it: there the refresh token lives in an httpOnly cookie that
 * JavaScript cannot read. For `ios`, `android` and `server` the token is a long-lived
 * credential, so back this with the platform's secure store (Keychain, Keystore, an encrypted
-* file), never with `localStorage` or a plain file. A React Native secure-store adapter ships in
-* Phase 2.
+* file), never with `localStorage` or a plain file: script can read those, so any script on
+* the page (an XSS, a compromised dependency) could take the refresh token. The default
+* {@link memoryStorage} is not readable that way.
 *
 * @example
 * ```ts
@@ -1343,13 +1738,78 @@ interface EmailLinkOutcome {
 	/** What happened. */
 	readonly status: "none" | "signed_in" | "verified" | "different_browser" | "expired";
 }
+/** A provider `signIn.withOAuth` can be asked for. */
+type OAuthProvider2 = Schemas["OAuthProvider"];
+/** A provider account connected to the signed-in user. */
+type Identity2 = Schemas["Identity"];
+/**
+* Whether a failure thrown by `signIn.handleOAuthCallback()` left the round trip in place, so
+* that calling it again retries the exchange: the request got no answer (`network.failed`,
+* `network.timeout`) or was rate limited.
+*
+* @param error - What `handleOAuthCallback()` threw.
+* @returns `true` when calling it again can still succeed.
+*
+* @example
+* ```ts
+* try {
+*   await tula.signIn.handleOAuthCallback()
+* } catch (error) {
+*   if (isRetryableOAuthError(error)) showTryAgain()
+* }
+* ```
+*/
+declare function isRetryableOAuthError(error: unknown): boolean;
+/**
+* What became of an OAuth round trip, as `signIn.handleOAuthCallback()` reports it.
+*
+* - `none`: the address holds no OAuth answer. Nothing was sent.
+* - `complete`: signed in. `flow.step.status` is `complete`.
+* - `needs_step`: the provider was accepted as a first factor and something still stands before
+*   the session (`needs_second_factor`, `needs_factor_enrolment`). `flow` is positioned on that
+*   step: `flow.submitSecondFactor(…)` and the enrolment actions work as for any sign-in.
+* - `linked`: a provider account was connected to the signed-in user (a link started with
+*   `user.identities.link`).
+* - `different_browser`: this browser did not start the sign-in (or no longer has what it kept).
+*   Nothing was completed. Start again here.
+* - `error`: it did not go through. `code` is a contract error code: `oauth.access_denied` (the
+*   user cancelled), `oauth.account_exists` (sign in the usual way, then connect the provider
+*   from the profile), `oauth.email_unverified`, `oauth.ticket_invalid`, …; `message` is its text.
+*
+* @example
+* ```ts
+* const outcome: OAuthCallbackOutcome = await tula.signIn.handleOAuthCallback()
+* if (outcome.status === 'needs_step') {
+*   await outcome.flow.submitSecondFactor({ method: 'totp', code })
+* }
+* ```
+*/
+type OAuthCallbackOutcome = {
+	readonly status: "none";
+} | {
+	readonly status: "complete";
+	readonly flow: SignInFlow;
+} | {
+	readonly status: "needs_step";
+	readonly flow: SignInFlow;
+} | {
+	readonly status: "linked";
+	readonly identity: Identity2;
+} | {
+	readonly status: "different_browser";
+} | {
+	readonly status: "error";
+	readonly code: string;
+	readonly message: string;
+};
 /**
 * What a flow looks like when it is logged or serialised: where it stands, and nothing that
 * could continue it. The attempt's secret is never part of it.
 *
 * @example
 * ```ts
-* JSON.stringify(flow) // {"id":"…","kind":"sign_in","step":{"status":"needs_password"},"expiresAt":"…"}
+* JSON.stringify(flow) //
+* {"id":"…","kind":"sign_in","step":{"status":"needs_password"},"expiresAt":"…"}
 * ```
 */
 interface FlowSnapshot<Kind extends FlowKind2 = FlowKind2> {
@@ -1367,7 +1827,8 @@ interface FlowSnapshot<Kind extends FlowKind2 = FlowKind2> {
 *
 * @example
 * ```ts
-* const { step, backupCodesRemaining } = await flow.submitSecondFactor({ method: 'backup_code', code })
+* const { step, backupCodesRemaining } = await flow.submitSecondFactor({ method: 'backup_code', code
+* })
 * if (backupCodesRemaining !== undefined && backupCodesRemaining < 3) {
 *   suggestNewBackupCodes()
 * }
@@ -1641,7 +2102,8 @@ interface SignInFlow extends Flow<"sign_in">, FactorEnrolmentActions, SecondFact
 	* With `email_link` the email also carries a link to `redirectUrl`, which must be one of the
 	* environment's allowed redirect URLs, exactly, **and on the same origin as the page that
 	* asks** (scheme, host and port): what ties the link to this browser is kept in this origin's
-	* storage, and a page on another origin could not read it. The link works only in this browser: the
+	* storage, and a page on another origin could not read it. The link works only in this browser:
+	* the
 	* flow keeps what ties the two together (in `localStorage`; it is not a token and authorizes
 	* nothing by itself). Follow it with {@link SignInFlow.waitForEmailLink}.
 	*
@@ -1701,6 +2163,28 @@ interface SignInFlow extends Flow<"sign_in">, FactorEnrolmentActions, SecondFact
 	waitForEmailLink(options?: {
 		signal?: AbortSignal;
 	}): Promise<FlowStep2>;
+	/**
+	* Continue with single sign-on (step `needs_first_factor` offering `sso`: the address's
+	* domain is bound to an active connection). Keeps the round trip's binding for this tab and
+	* navigates to the identity provider, unless `navigate` is `false`. The provider returns to
+	* `redirectUrl`; call `signIn.handleOAuthCallback()` on that page, as after a provider.
+	*
+	* @param input - The page to come back to (one of the allowed redirect URLs, same origin as
+	*   this page), and `navigate: false` to navigate yourself.
+	* @returns The identity provider's URL.
+	* @throws TulaError `request.redirect_not_allowed`, `sso.*` codes, `link.cross_origin` and
+	*   `storage.failed` (raised by the client, no request sent).
+	* @example
+	* ```ts
+	* await flow.startSso({ redirectUrl: `${location.origin}/oauth/callback` })
+	* ```
+	*/
+	startSso(input: {
+		redirectUrl: string;
+		navigate?: boolean;
+	}): Promise<{
+		url: string;
+	}>;
 }
 /**
 * A password reset in progress. The emailed code and the new password travel together, so a
@@ -1773,88 +2257,24 @@ interface IdTokenName {
 	/** The family name, at most 100 characters. */
 	familyName?: string;
 }
-/** A provider `signIn.withOAuth` can be asked for. */
-type OAuthProvider2 = Schemas["OAuthProvider"];
-/** A provider account connected to the signed-in user. */
-type Identity2 = Schemas["Identity"];
 /**
-* Whether a failure thrown by `signIn.handleOAuthCallback()` left the round trip in place, so
-* that calling it again retries the exchange: the request got no answer (`network.failed`,
-* `network.timeout`) or was rate limited.
-*
-* @param error - What `handleOAuthCallback()` threw.
-* @returns `true` when calling it again can still succeed.
+* How long one request may take before it fails with `network.timeout`, unless the client is
+* created with its own `timeoutMs`.
 *
 * @example
 * ```ts
-* try {
-*   await tula.signIn.handleOAuthCallback()
-* } catch (error) {
-*   if (isRetryableOAuthError(error)) showTryAgain()
-* }
+* createTulaClient({ publishableKey, baseUrl, timeoutMs: DEFAULT_TIMEOUT_MS * 2 })
 * ```
 */
-declare function isRetryableOAuthError(error: unknown): boolean;
+declare const DEFAULT_TIMEOUT_MS = 15e3;
 /**
-* What became of an OAuth round trip, as `signIn.handleOAuthCallback()` reports it.
-*
-* - `none`: the address holds no OAuth answer. Nothing was sent.
-* - `complete`: signed in. `flow.step.status` is `complete`.
-* - `needs_step`: the provider was accepted as a first factor and something still stands before
-*   the session (`needs_second_factor`, `needs_factor_enrolment`). `flow` is positioned on that
-*   step: `flow.submitSecondFactor(…)` and the enrolment actions work as for any sign-in.
-* - `linked`: a provider account was connected to the signed-in user (a link started with
-*   `user.identities.link`).
-* - `different_browser`: this browser did not start the sign-in (or no longer has what it kept).
-*   Nothing was completed. Start again here.
-* - `error`: it did not go through. `code` is a contract error code: `oauth.access_denied` (the
-*   user cancelled), `oauth.account_exists` (sign in the usual way, then connect the provider
-*   from the profile), `oauth.email_unverified`, `oauth.ticket_invalid`, …; `message` is its text.
+* Options of {@link createTulaClient}.
 *
 * @example
 * ```ts
-* const outcome: OAuthCallbackOutcome = await tula.signIn.handleOAuthCallback()
-* if (outcome.status === 'needs_step') {
-*   await outcome.flow.submitSecondFactor({ method: 'totp', code })
-* }
-* ```
-*/
-type OAuthCallbackOutcome = {
-	readonly status: "none";
-} | {
-	readonly status: "complete";
-	readonly flow: SignInFlow;
-} | {
-	readonly status: "needs_step";
-	readonly flow: SignInFlow;
-} | {
-	readonly status: "linked";
-	readonly identity: Identity2;
-} | {
-	readonly status: "different_browser";
-} | {
-	readonly status: "error";
-	readonly code: string;
-	readonly message: string;
-};
-/**
-* How long one request may take before it fails with `network.timeout`, unless the client is
-* created with its own `timeoutMs`.
-*
-* @example
-* ```ts
-* createTulaClient({ publishableKey, baseUrl, timeoutMs: DEFAULT_TIMEOUT_MS * 2 })
-* ```
-*/
-declare const DEFAULT_TIMEOUT_MS = 15e3;
-/**
-* Options of {@link createTulaClient}.
-*
-* @example
-* ```ts
-* const options: TulaClientOptions = {
-*   publishableKey: 'tula_pk_dev_…',
-*   baseUrl: 'https://auth.example.com',
+* const options: TulaClientOptions = {
+*   publishableKey: 'tula_pk_dev_…',
+*   baseUrl: 'https://auth.example.com',
 * }
 * ```
 */
@@ -1864,6 +2284,12 @@ interface TulaClientOptions {
 	/** Where the Tula API is served, e.g. `https://auth.example.com`. */
 	baseUrl: string;
 	/**
+	* Allow a plain `http:` `baseUrl` to a host that is not this machine. Off by default: the
+	* publishable key and the bearer tokens would cross the network readable. Only for a private
+	* network you trust.
+	*/
+	allowInsecureHttp?: boolean;
+	/**
 	* The kind of client, which decides where the refresh token lives. `web` (the default in a
 	* browser): an httpOnly cookie set by the API, which this SDK never sees. `ios`, `android`,
 	* `server` (the default elsewhere): the `storage` adapter.
@@ -1875,7 +2301,7 @@ interface TulaClientOptions {
 	*/
 	storage?: TokenStorage;
 	/**
-	* The session profile to ask for, by name (ADR 0028). The session gets it only where the
+	* The session profile to ask for, by name. The session gets it only where the
 	* environment marks that profile `clientSelectable`; any other name is ignored by the API
 	* and the session gets the profile of its client kind (`web`, or `mobile` for the others).
 	* Leave it out to take that default. A name is lowercase letters, digits and single hyphens,
@@ -1888,7 +2314,7 @@ interface TulaClientOptions {
 	*/
 	sessionProfile?: string;
 	/**
-	* A key to bind this client's sessions to (ADR 0043). With one, every sign-in, sign-up and
+	* A key to bind this client's sessions to. With one, every sign-in, sign-up and
 	* password reset this client starts asks for a **device-bound** session, and every refresh
 	* proves the key: a refresh token copied off the device is then of no use without it. The
 	* proofs (`DPoP` headers) and the server's nonce are handled by the client.
@@ -1937,7 +2363,8 @@ interface TulaClient {
 	readonly state: AuthState;
 	/**
 	* What a server rendered for this client, when a framework integration knows it
-	* (`@tula-tech/nextjs` sets it from the request's session). `@tula-tech/react` uses it as the state
+	* (`@tula-tech/nextjs` sets it from the request's session). `@tula-tech/react` uses it as the
+	* state
 	* during server rendering and hydration instead of `loading`. `createTulaClient` never sets
 	* it.
 	*/
@@ -2124,7 +2551,8 @@ interface TulaClient {
 			provider: IdTokenProvider2;
 		}): Promise<IdTokenSignIn>;
 		/**
-		* "Continue with Google, GitHub, Apple, Microsoft, Discord, LinkedIn, X or Facebook": a sign-in that creates the account when the
+		* "Continue with Google, GitHub, Apple, Microsoft, Discord, LinkedIn, X or Facebook": a sign-in
+		* that creates the account when the
 		* provider's verified address has none.
 		*
 		* Asks the API for the provider's URL, keeps the round trip's binding for this tab
@@ -2212,7 +2640,7 @@ interface TulaClient {
 		* An access token to send to your own backend, refreshed first when it is missing or about
 		* to expire. Any number of concurrent calls share one refresh.
 		*
-		* **`null` while signed in on a `stateful` session profile** (ADR 0028). Such a session is
+		* **`null` while signed in on a `stateful` session profile**. Such a session is
 		* an httpOnly cookie the browser holds and this client never sees: there is no token, so
 		* there is nothing to return and nothing is asked of the API. Use `state.status` to know
 		* whether the user is signed in; a backend on the API's own host receives the cookie and
@@ -2337,6 +2765,591 @@ interface TulaClient {
 			method: "email_code" | "sms_code";
 		}): Promise<StepUpPrepared>;
 	};
+	/**
+	* The signed-in user's organizations and the one the session acts in. While the
+	* environment's `organizations.enabled` setting is off, each call answers
+	* `organization.disabled`.
+	*/
+	readonly organizations: {
+		/**
+		* The organizations the user belongs to, with their role and its permission keys in each,
+		* and the session's active organization, one page at a time (the first, 20 of them, without
+		* a query). `meta.totalPages` says whether there is a next page.
+		*
+		* @param query - The page to read (1-based, default 1) and its `size` (1 to 100, default 20).
+		* @returns The page; `activeOrganizationId` is `null` for the personal account.
+		* @throws TulaError `auth.unauthenticated` when signed out, `organization.disabled`.
+		* @example
+		* ```ts
+		* const { data, meta, activeOrganizationId } = await tula.organizations.list({ page: 2 })
+		* ```
+		*/
+		list(query?: {
+			page?: number;
+			size?: number;
+		}): Promise<UserOrganizationList2>;
+		/**
+		* Create an organization the user owns (it holds the environment's `creatorRole`). The
+		* session does not switch to it: call `setActive`.
+		*
+		* @param input - The name and the slug.
+		* @returns The organization.
+		* @throws TulaError `organization.creation_disabled`, `organization.limit_reached`,
+		*   `organization.slug_taken`.
+		* @example
+		* ```ts
+		* const org = await tula.organizations.create({ name: 'Acme', slug: 'acme' })
+		* await tula.organizations.setActive(org.id)
+		* ```
+		*/
+		create(input: CreateOrganizationInput): Promise<UserOrganization2>;
+		/**
+		* Make an organization the one the session acts in (or `null`, the personal account). The
+		* access token is replaced with one that carries `org_id`, `org_role` and `org_perms`;
+		* `state.organizationId` follows.
+		*
+		* @param organizationId - The organization, or `null`.
+		* @returns The API's answer.
+		* @throws TulaError `organization.not_a_member`, `organization.personal_account_disabled`.
+		* @example
+		* ```ts
+		* await tula.organizations.setActive(org.id)
+		* ```
+		*/
+		setActive(organizationId: string | null): Promise<ActiveOrganization2>;
+		/**
+		* The organizations the user may join because their **verified** email address is on a
+		* domain the organization verified: its id, name and slug,
+		* nothing of its members. Empty for a user with no verified address, for one already in
+		* the organization and for a domain that is not exactly the address's.
+		*
+		* @returns The suggestions.
+		* @throws TulaError `auth.unauthenticated` when signed out, `organization.disabled`.
+		* @example
+		* ```ts
+		* const { data } = await tula.organizations.suggestions()
+		* ```
+		*/
+		suggestions(): Promise<OrganizationSuggestionList2>;
+		/**
+		* Join a suggested organization with the environment's default role. The server decides
+		* again, so a suggestion that is gone (the domain was removed, the address changed) is
+		* refused. The session does not switch to it: call `setActive`.
+		*
+		* @param organizationId - The organization, from {@link suggestions}.
+		* @returns The organization, with the user's role and its permission keys.
+		* @throws TulaError `organization.suggestion_unavailable`, `organization.member_exists`,
+		*   `organization.disabled`.
+		* @example
+		* ```ts
+		* const [first] = (await tula.organizations.suggestions()).data
+		* if (first) {
+		*   await tula.organizations.join(first.id)
+		* }
+		* ```
+		*/
+		join(organizationId: string): Promise<UserOrganization2>;
+		/**
+		* Rename an organization, or change its slug. Needs `org:sys:organization:manage`, which
+		* the API reads from the user's membership on every call.
+		*
+		* @param organizationId - The organization.
+		* @param input - A new `name`, a new `slug`, or both.
+		* @returns The organization with the user's role, as it is now.
+		* @throws TulaError `organization.not_a_member`, `organization.permission_required`,
+		*   `organization.slug_taken`, `organization.disabled`.
+		* @example
+		* ```ts
+		* await tula.organizations.update(org.id, { name: 'Acme Inc' })
+		* ```
+		*/
+		update(organizationId: string, input: UpdateOrganizationInput): Promise<UserOrganization2>;
+		/**
+		* Delete an organization for good, with its memberships, invitations and domains. Needs
+		* `org:sys:organization:delete`. Members' sessions leave it at their next refresh; if it
+		* was this session's active organization, call `setActive` for another one.
+		*
+		* @param organizationId - The organization.
+		* @throws TulaError `organization.not_a_member`, `organization.permission_required`,
+		*   `organization.disabled`.
+		* @example
+		* ```ts
+		* await tula.organizations.remove(org.id)
+		* await tula.organizations.setActive(null)
+		* ```
+		*/
+		remove(organizationId: string): Promise<void>;
+		/**
+		* Leave an organization: remove the signed-in user's own membership, which needs no
+		* permission. The last member who can manage members cannot leave.
+		*
+		* @param organizationId - The organization.
+		* @throws TulaError `organization.not_a_member`, `organization.last_manager`,
+		*   `organization.disabled`.
+		* @example
+		* ```ts
+		* await tula.organizations.leave(org.id)
+		* ```
+		*/
+		leave(organizationId: string): Promise<void>;
+		/**
+		* The roles the user may give to an invitation or a member: those whose permissions they
+		* hold themselves. Needs `org:sys:invitations:manage` or `org:sys:memberships:manage`.
+		*
+		* @param organizationId - The organization.
+		* @returns The roles' keys and names.
+		* @throws TulaError `organization.not_a_member`, `organization.permission_required`,
+		*   `organization.disabled`.
+		* @example
+		* ```ts
+		* const { data } = await tula.organizations.roles(org.id)
+		* ```
+		*/
+		roles(organizationId: string): Promise<AssignableRoleList2>;
+		/**
+		* An organization's members. Reading needs `org:sys:memberships:read` or `:manage`;
+		* changing needs `org:sys:memberships:manage`, which the API reads from the user's
+		* membership on every call.
+		*/
+		readonly members: {
+			/**
+			* The organization's members, oldest first, with each one's name, address and role key.
+			* Only the first page: the client sends no paging query yet.
+			*
+			* @param organizationId - The organization.
+			* @returns The page.
+			* @throws TulaError `organization.not_a_member`, `organization.permission_required`,
+			*   `organization.disabled`.
+			* @example
+			* ```ts
+			* const { data } = await tula.organizations.members.list(org.id)
+			* ```
+			*/
+			list(organizationId: string): Promise<OrganizationMemberList2>;
+			/**
+			* Give a member another role, one whose permissions the user holds themselves. The
+			* member's sessions carry it from their next refresh.
+			*
+			* @param organizationId - The organization.
+			* @param userId - The member.
+			* @param role - The key of the new role.
+			* @returns The member, as they are now.
+			* @throws TulaError `organization.permission_required`, `organization.role_unknown`,
+			*   `organization.role_not_assignable`, `organization.last_manager`.
+			* @example
+			* ```ts
+			* await tula.organizations.members.changeRole(org.id, member.userId, 'admin')
+			* ```
+			*/
+			changeRole(organizationId: string, userId: string, role: string): Promise<OrganizationMember2>;
+			/**
+			* Remove a member. The user keeps their account; to remove yourself use `leave`.
+			*
+			* @param organizationId - The organization.
+			* @param userId - The member.
+			* @throws TulaError `organization.permission_required`, `organization.last_manager`.
+			* @example
+			* ```ts
+			* await tula.organizations.members.remove(org.id, member.userId)
+			* ```
+			*/
+			remove(organizationId: string, userId: string): Promise<void>;
+		};
+		/**
+		* An organization's domains: the organization claims one by
+		* a code emailed to an address on it, and a verified one suggests or joins the people who
+		* sign up with a verified address on it. Needs `org:sys:domains:manage`, which the API
+		* reads from the user's membership on every call.
+		*/
+		readonly domains: {
+			/**
+			* The organization's domains, oldest first: claims waiting for a code and verified ones.
+			*
+			* @param organizationId - The organization.
+			* @returns The domains.
+			* @throws TulaError `organization.not_a_member`, `auth.forbidden`, `organization.disabled`.
+			* @example
+			* ```ts
+			* const { data } = await tula.organizations.domains.list(org.id)
+			* ```
+			*/
+			list(organizationId: string): Promise<OrganizationDomainList2>;
+			/**
+			* Claim a domain: email a code to an address on it. Sent again for a pending claim it
+			* emails a new code.
+			*
+			* @param organizationId - The organization.
+			* @param input - The domain, an address on it and what a verified domain does.
+			* @returns The pending claim.
+			* @throws TulaError `organization.domain_public`, `organization.domain_taken`,
+			*   `organization.domain_address_mismatch`, `organization.domain_limit`, `rate_limited`.
+			* @example
+			* ```ts
+			* await tula.organizations.domains.start(org.id, {
+			*   domain: 'acme.com',
+			*   email: 'ada@acme.com',
+			*   mode: 'suggest',
+			* })
+			* ```
+			*/
+			start(organizationId: string, input: StartOrganizationDomainInput): Promise<OrganizationDomain2>;
+			/**
+			* Enter the emailed code. Five wrong guesses use the code up.
+			*
+			* @param organizationId - The organization.
+			* @param domainId - The claim.
+			* @param code - The six digits.
+			* @returns The verified domain.
+			* @throws TulaError `verification.invalid_code` and its siblings, `organization.domain_taken`.
+			* @example
+			* ```ts
+			* await tula.organizations.domains.verify(org.id, domain.id, '123456')
+			* ```
+			*/
+			verify(organizationId: string, domainId: string, code: string): Promise<OrganizationDomain2>;
+			/**
+			* Change what a domain does.
+			*
+			* @param organizationId - The organization.
+			* @param domainId - The domain.
+			* @param mode - `suggest` or `auto_join`.
+			* @returns The domain.
+			* @example
+			* ```ts
+			* await tula.organizations.domains.update(org.id, domain.id, 'auto_join')
+			* ```
+			*/
+			update(organizationId: string, domainId: string, mode: OrganizationDomain2["mode"]): Promise<OrganizationDomain2>;
+			/**
+			* Remove a domain. Later sign-ups are neither offered nor joined to the organization;
+			* the members it brought stay.
+			*
+			* @param organizationId - The organization.
+			* @param domainId - The domain.
+			* @example
+			* ```ts
+			* await tula.organizations.domains.remove(org.id, domain.id)
+			* ```
+			*/
+			remove(organizationId: string, domainId: string): Promise<void>;
+		};
+		/**
+		* An organization's single sign-on, for a member whose role holds
+		* `org:sys:sso:manage`, which the API reads from the membership on every call. The client
+		* secret is write-only: no answer returns it. Switching enforcement off, trusting the
+		* identity provider for MFA and naming a break-glass role need a recent sign-in
+		* (`auth.step_up_required`: step up, then repeat the call).
+		*/
+		readonly sso: {
+			/**
+			* The organization's connections, with the service provider values to give the IdP.
+			*
+			* @param organizationId - The organization.
+			* @returns The connections.
+			* @throws TulaError `organization.not_a_member`, `auth.forbidden`, `sso.disabled`.
+			* @example
+			* ```ts
+			* const { connections } = await tula.organizations.sso.list(org.id)
+			* ```
+			*/
+			list(organizationId: string): Promise<OrganizationSsoConnectionList>;
+			/**
+			* One connection.
+			*
+			* @param organizationId - The organization.
+			* @param id - The connection.
+			* @returns The connection.
+			* @example
+			* ```ts
+			* const connection = await tula.organizations.sso.get(org.id, id)
+			* ```
+			*/
+			get(organizationId: string, id: string): Promise<OrganizationSsoConnection>;
+			/**
+			* Create a draft connection; a draft signs nobody in.
+			*
+			* @param organizationId - The organization.
+			* @param input - The connection.
+			* @returns The connection.
+			* @example
+			* ```ts
+			* await tula.organizations.sso.create(org.id, { name: 'Okta', issuer, clientId, clientSecret
+			* })
+			* ```
+			*/
+			create(organizationId: string, input: CreateOrganizationSsoConnectionInput): Promise<OrganizationSsoConnection>;
+			/**
+			* Change a connection; fields left out are kept.
+			*
+			* @param organizationId - The organization.
+			* @param id - The connection.
+			* @param input - The fields to change.
+			* @returns The connection as it is now.
+			* @throws TulaError `auth.step_up_required` for a weakening on a stale session.
+			* @example
+			* ```ts
+			* await tula.organizations.sso.update(org.id, id, { status: 'active' })
+			* ```
+			*/
+			update(organizationId: string, id: string, input: UpdateOrganizationSsoConnectionInput): Promise<OrganizationSsoConnection>;
+			/**
+			* Read a SAML connection's metadata address again (a rotated certificate).
+			*
+			* @param organizationId - The organization.
+			* @param id - The connection.
+			* @returns The connection.
+			* @example
+			* ```ts
+			* await tula.organizations.sso.refreshMetadata(org.id, id)
+			* ```
+			*/
+			refreshMetadata(organizationId: string, id: string): Promise<OrganizationSsoConnection>;
+			/**
+			* Delete a connection that is not active (`sso.connection_in_use` otherwise); its users keep
+			* their accounts.
+			*
+			* @param organizationId - The organization.
+			* @param id - The connection.
+			* @example
+			* ```ts
+			* await tula.organizations.sso.remove(org.id, id)
+			* ```
+			*/
+			remove(organizationId: string, id: string): Promise<void>;
+			/**
+			* The IdP group to role mapping, in precedence order.
+			*
+			* @param organizationId - The organization.
+			* @param id - A connection of the organization.
+			* @returns The mapping.
+			* @example
+			* ```ts
+			* const { mappings } = await tula.organizations.sso.groupRoles(org.id, id)
+			* ```
+			*/
+			groupRoles(organizationId: string, id: string): Promise<OrganizationSsoGroupRoles>;
+			/**
+			* Replace the whole mapping.
+			*
+			* @param organizationId - The organization.
+			* @param id - A connection of the organization.
+			* @param mapping - The new mapping.
+			* @returns The mapping as saved.
+			* @example
+			* ```ts
+			* await tula.organizations.sso.setGroupRoles(org.id, id, { mappings: [{ group: 'eng', role:
+			* 'admin' }] })
+			* ```
+			*/
+			setGroupRoles(organizationId: string, id: string, mapping: OrganizationSsoGroupRoles): Promise<OrganizationSsoGroupRoles>;
+			/**
+			* Start a test sign-in of a connection. A passing test of its current settings is what
+			* turns it on (`sso.test_required`). Send the browser to `authorizationUrl`; it returns to
+			* `redirectUrl` with `#tula_test=<testId>`.
+			*
+			* @param organizationId - The organization.
+			* @param id - A connection of the organization.
+			* @param redirectUrl - The page to return to; the environment must allow it.
+			* @returns The test's id and where to send the browser.
+			* @throws TulaError `request.redirect_not_allowed`, and those of {@link get}.
+			* @example
+			* ```ts
+			* const { authorizationUrl } = await tula.organizations.sso.startTest(org.id, id,
+			* location.href)
+			* ```
+			*/
+			startTest(organizationId: string, id: string, redirectUrl: string): Promise<OrganizationSsoTestStart>;
+			/**
+			* Read a test's result: what arrived and how it mapped, or why it failed.
+			*
+			* @param organizationId - The organization.
+			* @param id - The connection.
+			* @param testId - The id the browser came back with.
+			* @returns The result; `pending` until the browser has come back.
+			* @throws TulaError `sso.test_not_found`, and those of {@link get}.
+			* @example
+			* ```ts
+			* const result = await tula.organizations.sso.testResult(org.id, id, testId)
+			* ```
+			*/
+			testResult(organizationId: string, id: string, testId: string): Promise<OrganizationSsoTestResult>;
+			/**
+			* The organization's SSO setup links, newest first; never their tokens. A link lets an
+			* IT administrator without an account set up an OpenID Connect connection (not SAML).
+			*
+			* @param organizationId - The organization.
+			* @returns The links.
+			* @throws TulaError `organization.not_a_member`, `organization.permission_required`,
+			* `sso.disabled`.
+			* @example
+			* ```ts
+			* const { links } = await tula.organizations.sso.setupLinks(org.id)
+			* ```
+			*/
+			setupLinks(organizationId: string): Promise<OrganizationSetupLinkList>;
+			/**
+			* Make a setup link. The answer holds the link's `url` once; it is not stored.
+			*
+			* @param organizationId - The organization.
+			* @param input - The link's name and life in days.
+			* @returns The link, with its token and address.
+			* @throws TulaError those of {@link setupLinks}.
+			* @example
+			* ```ts
+			* const { url } = await tula.organizations.sso.createSetupLink(org.id, { name: 'Acme IT' })
+			* ```
+			*/
+			createSetupLink(organizationId: string, input?: CreateOrganizationSetupLinkInput): Promise<CreatedOrganizationSetupLink>;
+			/**
+			* End a setup link now.
+			*
+			* @param organizationId - The organization.
+			* @param linkId - The link.
+			* @throws TulaError those of {@link setupLinks}.
+			* @example
+			* ```ts
+			* await tula.organizations.sso.revokeSetupLink(org.id, link.id)
+			* ```
+			*/
+			revokeSetupLink(organizationId: string, linkId: string): Promise<void>;
+		};
+		/**
+		* Invitations by email. The inviting calls need the permission
+		* `org:sys:invitations:manage`, which the API reads from the user's membership on every
+		* call. Answering needs the invited account: signed in, with the invited address, verified.
+		*/
+		readonly invitations: {
+			/**
+			* An organization's pending invitations, newest first. Only the first page: the client
+			* sends no paging or state query yet.
+			*
+			* @param organizationId - The organization.
+			* @returns The page.
+			* @throws TulaError `organization.not_a_member`, `organization.permission_required`,
+			*   `organization.disabled`.
+			* @example
+			* ```ts
+			* const { data } = await tula.organizations.invitations.list(org.id)
+			* ```
+			*/
+			list(organizationId: string): Promise<OrganizationInvitationList2>;
+			/**
+			* Email an invitation. The link leads to `input.redirectUrl` (one of the environment's
+			* allowed redirect URLs) with the token in its fragment; read it there with
+			* `readInvitationLink`. The role must be within the permissions of the inviter's own.
+			*
+			* @param organizationId - The organization.
+			* @param input - The address, the role's key and the redirect URL.
+			* @returns The invitation; the token is only in the email.
+			* @throws TulaError `organization.not_a_member`, `organization.permission_required`,
+			*   `organization.role_not_assignable`, `organization.role_unknown`,
+			*   `organization.member_exists`, `organization.invitation_exists`,
+			*   `request.redirect_not_allowed`, `rate_limited`.
+			* @example
+			* ```ts
+			* await tula.organizations.invitations.invite(org.id, {
+			*   email: 'ada@example.com',
+			*   role: 'member',
+			*   redirectUrl: 'https://app.example.com/join',
+			* })
+			* ```
+			*/
+			invite(organizationId: string, input: CreateOrganizationInvitationInput): Promise<OrganizationInvitation2>;
+			/**
+			* Withdraw a pending invitation: its link stops working.
+			*
+			* @param organizationId - The organization.
+			* @param invitationId - The invitation.
+			* @throws TulaError `organization.invitation_used`, `organization.invitation_revoked`,
+			*   `organization.invitation_expired` (410) for one that is no longer pending, and the
+			*   errors of `list`.
+			* @example
+			* ```ts
+			* await tula.organizations.invitations.revoke(org.id, invitation.id)
+			* ```
+			*/
+			revoke(organizationId: string, invitationId: string): Promise<void>;
+			/**
+			* What an invitation's token shows before anyone has signed in: the organization's
+			* name, the role's key and the address invited, to prefill a sign-up. Needs no session.
+			*
+			* @param token - The token from the link's fragment.
+			* @returns The preview.
+			* @throws TulaError `organization.invitation_not_found`, `organization.invitation_expired`,
+			*   `organization.invitation_revoked`, `organization.invitation_used`.
+			* @example
+			* ```ts
+			* const { organizationName, email } = await tula.organizations.invitations.preview(token)
+			* ```
+			*/
+			preview(token: string): Promise<InvitationPreview2>;
+			/**
+			* Join the organization the token invites to, with the invitation's role. Only the
+			* account the invitation was sent to may, and only with a verified address.
+			*
+			* @param token - The token from the link's fragment.
+			* @returns The organization joined, with the role and its permission keys.
+			* @throws TulaError `organization.invitation_wrong_account`,
+			*   `organization.invitation_email_unverified`, `organization.invitation_role_gone`,
+			*   `organization.member_exists`, and the errors of `preview`.
+			* @example
+			* ```ts
+			* const org = await tula.organizations.invitations.accept(token)
+			* await tula.organizations.setActive(org.id)
+			* ```
+			*/
+			accept(token: string): Promise<AcceptedInvitation2>;
+			/**
+			* Turn an invitation down: it is used up and nobody joins.
+			*
+			* @param token - The token from the link's fragment.
+			* @throws TulaError As `accept`, but a deleted role does not matter.
+			* @example
+			* ```ts
+			* await tula.organizations.invitations.decline(token)
+			* ```
+			*/
+			decline(token: string): Promise<void>;
+			/**
+			* The pending invitations addressed to the signed-in user's own verified address, newest
+			* first: an `id`, the organization's name, the role's key and the expiry, never a token.
+			* Only the first page: the client sends no paging query yet. An unverified address
+			* has none.
+			*
+			* @returns The page.
+			* @throws TulaError `organization.disabled`, `auth.unauthenticated`.
+			* @example
+			* ```ts
+			* const { data } = await tula.organizations.invitations.mine()
+			* ```
+			*/
+			mine(): Promise<MyOrganizationInvitationList2>;
+			/**
+			* Join the organization of an invitation listed by `mine()`, by its id. The same checks as
+			* `accept`: an id that is not the user's own answers `organization.invitation_not_found`.
+			*
+			* @param invitationId - The `id` from `mine()`.
+			* @returns The organization joined, with the role and its permission keys.
+			* @throws TulaError As `accept`.
+			* @example
+			* ```ts
+			* const org = await tula.organizations.invitations.acceptMine(invitation.id)
+			* ```
+			*/
+			acceptMine(invitationId: string): Promise<AcceptedInvitation2>;
+			/**
+			* Turn down an invitation listed by `mine()`, by its id.
+			*
+			* @param invitationId - The `id` from `mine()`.
+			* @throws TulaError As `decline`.
+			* @example
+			* ```ts
+			* await tula.organizations.invitations.declineMine(invitation.id)
+			* ```
+			*/
+			declineMine(invitationId: string): Promise<void>;
+		};
+	};
 	/** The signed-in user. */
 	readonly user: {
 		/**
@@ -2360,7 +3373,7 @@ interface TulaClient {
 			newPassword: string;
 		}): Promise<void>;
 		/**
-		* The signed-in user's passkeys (ADR 0027). Adding, renaming and removing one may answer
+		* The signed-in user's passkeys. Adding, renaming and removing one may answer
 		* `auth.step_up_required`; see `session.stepUp`.
 		*/
 		readonly passkeys: {
@@ -2756,4 +3769,31 @@ declare function createClient(options: TulaClientOptions, environment: Environme
 * ```
 */
 declare function createTulaClient(options: TulaClientOptions): TulaClient;
-export { ACCESS_TOKEN_EXPIRY_SKEW_MS, AuthState, BackupCodes2 as BackupCodes, ChannelLike, ClientConfig2 as ClientConfig, ClientErrorCode, ClientKind, DEFAULT_TIMEOUT_MS, DeviceKey3 as DeviceKey, DeviceKeySource, DevicePublicJwk, EMAIL_LINK_POLL_INTERVAL_MS, EMAIL_LINK_SESSION_WAIT_MS, EN_MESSAGES, EmailCodeSent2 as EmailCodeSent, EmailLinkOutcome, Environment, ErrorParams2 as ErrorParams, FactorEnrolmentMethod2 as FactorEnrolmentMethod, FactorEnrolmentResult, Factors2 as Factors, FetchLike, FirstFactorStrategy2 as FirstFactorStrategy, FlowKind2 as FlowKind, FlowSnapshot, FlowStep2 as FlowStep, IdTokenName, IdTokenProvider2 as IdTokenProvider, IdTokenSignIn, Identity2 as Identity, LinkStorageLike, LockManagerLike, MAX_REFRESH_BACKOFF_MS, Messages, MfaPolicy2 as MfaPolicy, OAuthCallbackOutcome, OAuthProvider2 as OAuthProvider, PageLike, Passkey2 as Passkey, PasskeyCreationOptions2 as PasskeyCreationOptions, PasskeyGlobals, PasskeyProvider, PasskeyRequest, PasskeyRequestOptions2 as PasskeyRequestOptions, PasswordCheck, PasswordEvaluation, PasswordPolicy2 as PasswordPolicy, PasswordResetFlow, PasswordRule, PasswordUserInfo, PhoneCodeSent2 as PhoneCodeSent, REFRESH_RETRY_WINDOW_MS, REFRESH_TIMEOUT_MS, SecondFactorMethod2 as SecondFactorMethod, SecondFactorProof, SecondFactorResult, Session2 as Session, SignInFlow, SignUpFlow, SmsFactorCode2 as SmsFactorCode, StepUpMethod, StepUpPrepared, StepUpProof, TokenStorage, TotpEnrolment2 as TotpEnrolment, TulaClient, TulaClientOptions, TulaError, TulaErrorCode, TulaErrorInit, TulaFieldError, User, createTulaClient, createClient as createTulaClientWithEnvironment, evaluatePassword, formatMessage, generateSoftwareDeviceKey, isRetryableOAuthError, isStepUpRequired, isTulaError, memoryStorage, runtimeEnvironment, stepUpMethods };
+/** An invitation's token as read from the URL of an emailed link. */
+interface InvitationLink {
+	/** The token to pass to `organizations.invitations.preview`, `accept` or `decline`. */
+	token: string;
+	/** The URL without the token, to put back in the address bar so the token is not kept. */
+	cleanUrl: string;
+}
+/**
+* Read the invitation token from the URL an emailed invitation link leads to.
+*
+* The token travels in the URL fragment (`#tula_invitation=…`), which a browser never sends to
+* a server, so it is in no log and in no `Referer`. Read it, then replace the address bar with
+* `cleanUrl` (`history.replaceState`) so that the token is not left in the history.
+*
+* @param url - The page's URL, e.g. `window.location.href`.
+* @returns The token and the URL without it, or `null` when the URL carries no token.
+*
+* @example
+* ```ts
+* const link = readInvitationLink(window.location.href)
+* if (link) {
+*   history.replaceState(null, '', link.cleanUrl)
+*   const { organizationName } = await tula.organizations.invitations.preview(link.token)
+* }
+* ```
+*/
+declare function readInvitationLink(url: string): InvitationLink | null;
+export { ACCESS_TOKEN_EXPIRY_SKEW_MS, AcceptedInvitation2 as AcceptedInvitation, ActiveOrganization2 as ActiveOrganization, AssignableRole2 as AssignableRole, AssignableRoleList2 as AssignableRoleList, AuthState, BackupCodes2 as BackupCodes, ChannelLike, ClientConfig2 as ClientConfig, ClientErrorCode, ClientKind, CreateOrganizationInput, CreateOrganizationInvitationInput, CreateOrganizationSetupLinkInput, CreateOrganizationSsoConnectionInput, CreatedOrganizationSetupLink, DEFAULT_TIMEOUT_MS, DeviceKey3 as DeviceKey, DeviceKeySource, DevicePublicJwk, EMAIL_LINK_POLL_INTERVAL_MS, EMAIL_LINK_SESSION_WAIT_MS, EN_MESSAGES, EmailCodeSent2 as EmailCodeSent, EmailLinkOutcome, Environment, ErrorParams2 as ErrorParams, FactorEnrolmentMethod2 as FactorEnrolmentMethod, FactorEnrolmentResult, Factors2 as Factors, FetchLike, FirstFactorStrategy2 as FirstFactorStrategy, FlowKind2 as FlowKind, FlowSnapshot, FlowStep2 as FlowStep, IdTokenName, IdTokenProvider2 as IdTokenProvider, IdTokenSignIn, Identity2 as Identity, InvitationLink, InvitationPreview2 as InvitationPreview, LinkStorageLike, LockManagerLike, MAX_REFRESH_BACKOFF_MS, Messages, MfaPolicy2 as MfaPolicy, MyOrganizationInvitation2 as MyOrganizationInvitation, MyOrganizationInvitationList2 as MyOrganizationInvitationList, OAuthCallbackOutcome, OAuthProvider2 as OAuthProvider, OrganizationDomain2 as OrganizationDomain, OrganizationDomainList2 as OrganizationDomainList, OrganizationInvitation2 as OrganizationInvitation, OrganizationInvitationList2 as OrganizationInvitationList, OrganizationMember2 as OrganizationMember, OrganizationMemberList2 as OrganizationMemberList, OrganizationSetupLink, OrganizationSetupLinkList, OrganizationSsoConnection, OrganizationSsoConnectionList, OrganizationSsoGroupRoles, OrganizationSsoTestResult, OrganizationSsoTestStart, OrganizationSuggestion2 as OrganizationSuggestion, OrganizationSuggestionList2 as OrganizationSuggestionList, PageLike, Passkey2 as Passkey, PasskeyCreationOptions2 as PasskeyCreationOptions, PasskeyGlobals, PasskeyProvider, PasskeyRequest, PasskeyRequestOptions2 as PasskeyRequestOptions, PasswordCheck, PasswordEvaluation, PasswordPolicy2 as PasswordPolicy, PasswordResetFlow, PasswordRule, PasswordUserInfo, PhoneCodeSent2 as PhoneCodeSent, REFRESH_RETRY_WINDOW_MS, REFRESH_TIMEOUT_MS, SecondFactorMethod2 as SecondFactorMethod, SecondFactorProof, SecondFactorResult, Session2 as Session, SignInFlow, SignUpFlow, SmsFactorCode2 as SmsFactorCode, StartOrganizationDomainInput, StepUpMethod, StepUpPrepared, StepUpProof, TokenStorage, TotpEnrolment2 as TotpEnrolment, TulaClient, TulaClientOptions, TulaError, TulaErrorCode, TulaErrorInit, TulaFieldError, UpdateOrganizationInput, UpdateOrganizationSsoConnectionInput, User, UserOrganization2 as UserOrganization, UserOrganizationList2 as UserOrganizationList, createTulaClient, createClient as createTulaClientWithEnvironment, evaluatePassword, formatMessage, generateSoftwareDeviceKey, isRetryableOAuthError, isStepUpRequired, isTulaError, memoryStorage, readInvitationLink, runtimeEnvironment, stepUpMethods };