v0.17.0

0.17.0 (2026-10-23)

Features

• support per-instance AuthKit token lifetimes (#168) (0a45553)

Bug Fixes

• audit-logs: accept the production event body shape (#158) (12d5f2b)
• auth: enforce step-bound pending tokens and refresh org membership (#164) (a7926a5)
• auth: one-time-code errors, lockouts and verified-only totp factors (#159) (7bca006)
• authorization: list the environment roles that apply to an organization (#153) (cb173ed)
• authorization: production slug, deletion and resource list rules (#160) (f6c05da)
• errors: answer 404s with production's entity_not_found body (#157) (ed8b984)
• organizations: verify starts dns, domain rules, unique external_id (#161) (4ac1425)
• portal: validate portal link intents and widget token scopes (#165) (49c6b86)
• sso: one connection per org, create rules, authorize states (#163) (102d2bd)
• user-management: reject what production rejects (#162) (ef8fc50)
• webhooks: PATCH endpoint updates, validate URLs and events, require events on list (#156) (cdde3fa)