@foir/cli 0.77.0 → 0.79.0

package/dist/lib/config-helpers.d.ts

@@ -56,15 +56,16 @@ interface EnumFieldConfig {
     placement?: FieldPlacement;
 }
 /**
- * Per-field {read, write} principal allow-lists. A non-empty `write` names
- * the only principals permitted to write the field — "public" | "self" |
- * "scoped" | "service" | "admin" — and any other principal is rejected by the
- * platform on every write path. Omit for the default (writable by any
- * authenticated principal). `read` governs client API exposure only.
+ * Which sides of a field are guarded. A guarded side is read, or written, only
+ * by a holder of the grant that names the field: `records:read:<model>.<field>`
+ * or `records:write:<model>.<field>`, at a reach that covers the record. A
+ * grant on the model does not reach a guarded side, and one on every owner's
+ * records of every model does. Give the field's grants to the roles, keys and
+ * operations that read or write it. Omit for a field that follows its model.
  */
-interface FieldAccessInput {
-    read?: string[];
-    write?: string[];
+interface FieldGuardInput {
+    read?: boolean;
+    write?: boolean;
 }
 interface BaseFieldDefinitionInput {
     key: string;
@@ -93,7 +94,7 @@ interface BaseFieldDefinitionInput {
     storage?: string;
     templateZone?: string;
     zoneOrder?: number;
-    access?: FieldAccessInput;
+    guarded?: FieldGuardInput;
 }
 type SelectFieldDefinitionInput = BaseFieldDefinitionInput & {
     type: 'select';
@@ -184,11 +185,9 @@ interface LookupDefinitionInput {
 interface AccessInput {
     /**
      * Which plane owns records of this model:
-     *  - `'customer'` — owned by the customer who created them. Per-customer RLS
-     *    isolation, private response-cache, per-owner lookups. Required for a
-     *    customer-context singleton.
-     *  - `'admin'` — owned by the operator who created them; operator-private
-     *    (other operators can't see them unless shared).
+     *  - `'user'`: owned by a person: the one the write names as the owner,
+     *    else the person who writes it. Per-owner RLS isolation, private
+     *    response-cache, per-owner lookups. Required for a per-user singleton.
      *  - `'project'` — no individual owner; records belong to the project. The
      *    platform default.
      *  - `'organization'` — owned by one of the project's ORGANIZATIONS (the
@@ -196,27 +195,27 @@ interface AccessInput {
      *    the row stays in the project plane, so the project credential finds
      *    every organization's rows — which is how a multi-tenant app resolves
      *    `<sub>.theapp.com` to an org before it knows which org the request is
-     *    for. Written by the project (never for a customer), owner
+     *    for. Written by the project (never for a person), owner
      *    named by `ownerId` or by the org the caller acts in (`X-Org-Id`);
      *    `singleton` means one record per organization. Refused on a project
      *    with no organizations and on a shared (layered/group) model.
      */
-    ownerPlane: 'customer' | 'admin' | 'project' | 'organization';
+    ownerPlane: 'user' | 'project' | 'organization';
     /**
      * Visibility new records start at (the record descriptor modes):
      *  - `'private'` — only the owner and explicit grants.
      *  - `'public'` — readable by anyone with API access, including signed-in
-     *    customers on the public API.
+     *    users on the public API.
      *
      * On a PROJECT-plane model, omitting this defaults to `'public'` at
      * CREATION — project content is meant to be read, and `'private'` there does
      * not mean what it looks like: a project record has no owner, so it stays
      * readable by anonymous and server-side callers while being hidden from
-     * signed-in customers. Set `'private'` explicitly to opt a project model out.
+     * signed-in users. Set `'private'` explicitly to opt a project model out.
      *
      * The default is applied by the platform, at the create path only. Omitting it
      * on a model that already exists means "leave it alone" — it will not reset a
-     * visibility you changed in the console. Owned planes (customer/admin) are
+     * visibility you changed in the console. Owned planes (user, organization) are
      * always private (the platform rejects a public default there) regardless of
      * this value.
      */
@@ -250,8 +249,11 @@ interface QuotaRule {
     points: number;
     /** Window duration in seconds (3600=1hr, 86400=1day, 604800=7day, 2592000=30day). */
     duration: number;
-    /** Scope for tracking: per customer, per user, or per tenant. */
-    scope: 'customer' | 'user' | 'tenant';
+    /**
+     * Whose counter a run is charged to: `user`, the person the run is for;
+     * `actor`, whoever started it; or `tenant`, the workspace.
+     */
+    scope: 'user' | 'actor' | 'tenant';
     /** Optional rule expression condition. */
     condition?: Record<string, unknown>;
     /** Optional expiry — rule is ignored after this date (ISO 8601). */
@@ -286,7 +288,7 @@ interface ApplyConfigOperationInput {
     timeoutMs?: number;
     inputSchema?: Record<string, unknown>;
     outputSchema?: Record<string, unknown>;
-    /** Usage quota rules (rate limits per customer/user/tenant). */
+    /** Usage quota rules (rate limits per user, actor or tenant). */
     quotas?: {
         rules: QuotaRule[];
     };
@@ -358,19 +360,19 @@ interface ApplyConfigOperationInput {
      * that does both declares both. List every model the operation touches.
      *
      * Ownership, `records:attribute:<model_key>` (or `records:attribute` for
-     * every model), lets the operation name the customer a record belongs to
+     * every model), lets the operation name the user a record belongs to
      * when it creates one (`create<Model>(input, ownerId)`) and hand a record
-     * to another customer (`set<Model>Owner`). It is held only by an
+     * to another user (`set<Model>Owner`). It is held only by an
      * operation: no API key of any type can be minted with it.
      *
      * The rest are written as the catalogue writes them: `embeddings:read`,
      * `embeddings:write`, `files:read`, `files:write`, `users:create` (create
-     * a customer, such as the buyer at a guest checkout), `users:read.named`
-     * (read one customer the operation names, by id or by their exact email
+     * a user, such as the buyer at a guest checkout), `users:read.named`
+     * (read one user the operation names, by id or by their exact email
      * address), `users:read.all` (that, and the list),
-     * `notifications:write.named` (notify the project's customers; an
-     * operation acting for a customer notifies that customer alone, and one
-     * at an organisation reaches only its customers), `status:write`, and
+     * `notifications:write.named` (notify the project's users; an
+     * operation acting for a user notifies that user alone, and one
+     * at an organisation reaches only its users), `status:write`, and
      * `secrets:read`. A grant an operation may not declare is refused at
      * push, by name. The whole list is at
      * https://docs.foir.dev/api/operation-permissions.
@@ -448,7 +450,7 @@ interface ApplyConfigOperationInput {
 /**
  * A context dimension — the home for segments. `sourceType: 'segment'`
  * carries an `evaluationRules` RuleExpression (evaluated fresh at request time
- * into segment.<key>); `sourceType: 'model'` designates a customer-context
+ * into segment.<key>); `sourceType: 'model'` designates a user-context
  * source model via `sourceModelKey`; `sourceType: 'request'` is a value the
  * application sends in the contexts argument of a read, one of the records of
  * the model `sourceModelKey` names. Reconciled config-scoped by `foir push`
@@ -460,7 +462,7 @@ interface ApplyConfigContextDimensionInput {
     name: string;
     description?: string;
     /**
-     * 'segment' (rule-based) | 'model' (customer-context source) | 'request'
+     * 'segment' (rule-based) | 'model' (user-context source) | 'request'
      * (a value sent with the read) | custom.
      */
     sourceType: string;
@@ -468,7 +470,7 @@ interface ApplyConfigContextDimensionInput {
     evaluationRules?: Record<string, unknown>;
     /**
      * The model the dimension is backed by. For sourceType 'model', a
-     * customer-owned singleton. For sourceType 'request', a model whose records
+     * user-owned singleton. For sourceType 'request', a model whose records
      * belong to the project as a whole: each record's natural key is one value.
      */
     sourceModelKey?: string;
@@ -508,7 +510,7 @@ interface ApplyConfigVariantCatalogEntryInput {
 /**
  * One transactional email's wording, keyed by the action that sends it.
  *
- * `actionKey` names a send path — `email.customer.welcome`, or a notification
+ * `actionKey` names a send path — `email.project.welcome`, or a notification
  * hook's own key. The platform refuses one it does not recognise, because a row
  * written under a typo is read by nothing and looks applied.
  *
@@ -563,49 +565,43 @@ interface ApplyConfigAuthProviderInput {
     priority?: number;
 }
 /**
- * Login-with-Foir customer-lane relying party. Each entry registers a
- * storefront or third-party app that can launch the hosted customer
- * login at auth.foir.dev/authorize?client_id=… and exchange the auth
- * code at /customer/oauth/token.
+ * A Login-with-Foir auth client. Each entry registers a storefront or
+ * other app that signs the project's users in at the hosted login
+ * (auth.foir.dev/authorize?client_id=…) and exchanges the code at
+ * /oauth/token.
  *
  * The reconciler is project-scoped (tenant + project come from the
- * push context), so consumers only declare the per-RP fields. Pass to
- * `relyingParties` on the manifest.
+ * push context), so consumers only declare the per-client fields. Pass to
+ * `authClients` on the manifest.
  */
 /**
- * Per-RP login method config (login-with-foir-full-workstream-plan.md
- * §Per-RP login method toggle). All fields optional — missing keys
+ * Per-client login method config (login-with-foir-full-workstream-plan.md
+ * §Per-client login method toggle). All fields optional — missing keys
  * default to enabled. Lets a project's storefront opt to only Sign in
  * with Shopify (disable password/OTP + don't list Apple) without
  * touching the project-level provider catalogue.
  */
-interface ApplyConfigRelyingPartyLoginMethods {
+interface ApplyConfigAuthClientLoginMethods {
     /**
-     * Show email & password sign-in on this RP's hosted login? Defaults to
+     * Show email & password sign-in on this auth client's hosted login? Defaults to
      * true. Only narrows the project capability — can't enable a method the
-     * project (`customerPasswordEnabled`) has turned off.
+     * project (`passwordEnabled`) has turned off.
      */
     password?: boolean;
     /**
-     * Show one-time code sign-in on this RP's hosted login? Defaults to true.
-     * Only narrows the project capability (`customerOtpEnabled`).
+     * Show one-time code sign-in on this auth client's hosted login? Defaults to true.
+     * Only narrows the project capability (`otpEnabled`).
      */
     otp?: boolean;
     /**
-     * Provider keys to HIDE on this RP's login page. Empty/missing = show
+     * Provider keys to HIDE on this auth client's login page. Empty/missing = show
      * every provider configured at the project level. List a key (e.g.
-     * "google") to omit it from this RP only.
+     * "google") to omit it from this auth client only.
      */
     disabledProviders?: string[];
 }
-interface ApplyConfigRelyingPartyInput {
-    /**
-     * Which lane this RP authenticates. `foir push` is project-scoped, so
-     * RPs declared in config are customer-lane (the default); admin RPs are
-     * platform-managed and not part of project config.
-     */
-    kind?: 'customer' | 'admin';
-    /** Public RP slug, unique per project (e.g. `acme-storefront`). */
+interface ApplyConfigAuthClientInput {
+    /** Public auth client slug, unique per project (e.g. `acme-storefront`). */
     clientId: string;
     /** Display name shown on the hosted login. */
     name: string;
@@ -623,7 +619,7 @@ interface ApplyConfigRelyingPartyInput {
     redirectUris: string[];
     /**
      * The most a sign-in through this app may carry of what the person's roles
-     * give them, in the permission catalogue's names: the same names a customer
+     * give them, in the permission catalogue's names: the same names a user
      * role is declared with (https://docs.foir.dev/api/role-permissions).
      *
      * The list gives nobody anything. A person holds what their roles give, and
@@ -639,25 +635,41 @@ interface ApplyConfigRelyingPartyInput {
      */
     grants: string[];
     /**
-     * Per-RP login method filter (customer-lane). Combines with the project-
-     * level customer auth settings (project may have password OFF entirely; an
-     * RP can't override-up, only override-down).
+     * Whether this app is the project's own. A sign-in through the project's own
+     * app asks nobody to agree to it. Through any other app, each user is shown
+     * what it asks to carry for them and agrees to it once, and the token
+     * carries no more than they agreed. Leave it off for an app someone else
+     * runs.
      */
-    loginMethods?: ApplyConfigRelyingPartyLoginMethods;
+    firstParty?: boolean;
     /**
-     * White-label custom login domains for this RP, e.g.
+     * Per-client login method filter. Combines with the project-
+     * level user auth settings (project may have password OFF entirely; an
+     * auth client can't override-up, only override-down).
+     */
+    loginMethods?: ApplyConfigAuthClientLoginMethods;
+    /**
+     * White-label custom login domains for this auth client, e.g.
      * `['login.eide.clothing']`. `foir push` registers each (creating a pending
      * row + a DNS-TXT challenge) and prunes any not listed. Verification is a
      * separate step — add the CNAME + `_foir-challenge` TXT records the push
-     * output prints, then verify. Customer-lane only.
+     * output prints, then verify.
      */
     customDomains?: string[];
     /**
      * Where a bare custom-domain (front-door) login lands after Foir sets the
      * first-party session cookie — the app's landing, not an OAuth
-     * callback. Empty falls back to the redirect URI. Customer-lane only.
+     * callback. Empty falls back to the redirect URI.
      */
     postLoginUrl?: string;
+    /**
+     * An address in your app that starts its sign-in (OIDC's
+     * `initiate_login_uri`). When someone accepts an invitation or resets their
+     * password on Foir's hosted pages, they are sent here with `iss`,
+     * `login_hint` and `target_link_uri`, and your app signs them in as usual.
+     * Absent, they finish on the hosted page. https, or http on localhost.
+     */
+    initiateLoginUri?: string;
     /**
      * Browser origins allowed to exchange the first-party session cookie for an
      * access token — i.e. the origins your SPA runs on, e.g.
@@ -670,7 +682,7 @@ interface ApplyConfigRelyingPartyInput {
      * origin on your domain, including a subdomain takeover or anything serving
      * user content there.
      *
-     * Absent leaves the list untouched; `[]` clears it. Customer-lane only, and
+     * Absent leaves the list untouched; `[]` clears it. It is
      * only meaningful alongside a verified `customDomains` entry (the cookie is
      * only ever issued on one).
      */
@@ -704,14 +716,30 @@ interface ApplyConfigHookInput {
 interface ApplyConfigApiKeyInput {
     /** Name for this API key (e.g. "Tilly iOS", "Tilly CRM sync"). */
     name: string;
-    /** Key type: 'public' for your app, 'secret' for a third-party client's own server. */
-    keyType: 'public' | 'secret';
+    /**
+     * What the key is for. You choose it, and the platform holds the key to what
+     * that kind may hold and give:
+     *
+     *  - `'publishable'` sits in a web page or an app, where anyone can read it.
+     *    It gives a visitor only what is safe to give everyone.
+     *  - `'server'` is held by the server that renders your pages. It is a
+     *    publishable key that may also say who and where its visitor is
+     *    (`visitors:forward`), and it never goes to a browser.
+     *  - `'admin'` is a machine's own: a sync job, a pipeline, a tool. It does
+     *    what it holds, gives nobody anything, and nobody signs in through it.
+     *    It expires.
+     *
+     * A key's kind never changes. A config that declares another kind for a key
+     * that already exists is refused: declare a new key under a new name.
+     */
+    kind: 'publishable' | 'server' | 'admin';
     /** Environment variable name to write the key to in .env (e.g. "FOIR_PUBLIC_KEY"). */
     envVar: string;
     /**
-     * What the key holds: the most anyone may do through it, in the permission
-     * catalogue's names (e.g. ["records:read", "records:write"]). A secret key
-     * may hold ["*"].
+     * What the key holds, in the permission catalogue's names (e.g.
+     * ["records:read", "records:write"]): for a publishable or a server key the
+     * most a signed-in user may do through it, and for an admin key what it
+     * does. An admin key may hold ["*"].
      *
      * Declared for every key. Nothing is filled in, so a key declared without
      * it would be minted holding nothing, and a push refuses one.
@@ -721,13 +749,14 @@ interface ApplyConfigApiKeyInput {
      */
     grants: string[];
     /**
-     * What the key gives whoever comes through it, in the same names: a visitor
-     * with no sign-in, on a public key, and a signed-in user beneath their role,
-     * on either kind.
+     * What a publishable or a server key gives whoever comes through it, in the
+     * same names: a visitor with no sign-in, and a signed-in user beneath their
+     * role. An admin key gives nobody anything, and one declared with this list
+     * is refused.
      *
      * NOTHING IS FILLED IN. A key declared without this list gives a visitor
-     * nothing, whatever it holds: a public key holding `records:read` and no
-     * list here is a key no visitor can read with. Name each read a visitor
+     * nothing, whatever it holds: a publishable key holding `records:read` and
+     * no list here is a key no visitor can read with. Name each read a visitor
      * needs. A visitor may also be given one model to submit into
      * (`records:create:<model>`) and one operation to run
      * (`operations:execute:<operation>`), each naming something this config
@@ -737,6 +766,17 @@ interface ApplyConfigApiKeyInput {
      * place. Left out, a push leaves what the key gives as it is.
      */
     baselineGrants?: string[];
+    /**
+     * An admin key only: how long it lives from the push that makes it, in days
+     * (e.g. "90d", which is what it is given when nothing is said, up to
+     * "365d"). A publishable or a server key never expires, and one declared
+     * with this is refused.
+     *
+     * It is read when the key is made. A push never renews a key that exists:
+     * renew it with `foir api-keys renew`, so that a key is kept alive by
+     * somebody deciding to and not by a pipeline that happens to run.
+     */
+    expiresIn?: string;
     /** Restrict the key to specific model keys (e.g. ["tilly_note", "tilly_block"]). */
     allowedModels?: string[];
     /** Restrict file uploads: a MIME type ("image/png"), a whole type ("image/*"), or IMAGE, VIDEO, FILE. */
@@ -762,24 +802,24 @@ interface ApplyConfigApiKeyInput {
     org?: string;
 }
 /**
- * A customer role declared in foir.config.ts and reconciled by `foir push`.
- * The role's `grants` are what a customer who holds it may do once signed in:
+ * A role declared in foir.config.ts and reconciled by `foir push`.
+ * The role's `grants` are what a user who holds it may do once signed in:
  * their access token carries them. Roles are matched by `key` within the
  * project: a declared key that already exists is updated in place, and a new
  * key is created. A role on the platform that the config leaves out is left
  * as it is, never disabled.
  *
- * Without a role, a signed-in customer may do only what the key gives
- * everyone who comes through it (its `baselineGrants`). Anything a customer
+ * Without a role, a signed-in user may do only what the key gives
+ * everyone who comes through it (its `baselineGrants`). Anything a user
  * may do beyond that comes from a role they hold.
  */
-interface ApplyConfigCustomerRoleInput {
+interface ApplyConfigUserRoleInput {
     /** Stable key, unique per project (e.g. "default", "member"). */
     key: string;
-    /** Human-readable name (e.g. "Default Customer"). */
+    /** Human-readable name (e.g. "Default User"). */
     name: string;
     /**
-     * What the role gives customers who hold it, as grants in the permission
+     * What the role gives users who hold it, as grants in the permission
      * catalogue's names: records:read:<model>, records:write:<model>,
      * records:create:<model>, operations:execute, files:read and the rest of
      * the list at https://docs.foir.dev/api/role-permissions.
@@ -788,14 +828,12 @@ interface ApplyConfigCustomerRoleInput {
      * grants, so a role that should do both lists `records:write:<model>` and
      * `records:create:<model>`.
      *
-     * The `self:*` shorthand is worked out when a customer signs in, into the
-     * read, the write and the create of every model the project lets a customer
-     * write. It does NOT include operations:execute, so list that explicitly
-     * when the app's customers run operations.
+     * A guarded field is given by the grants that name it,
+     * `records:read:<model>.<field>` and `records:write:<model>.<field>`.
      *
      * `operations:execute` runs every operation the key exposes;
      * `operations:execute:<operation_key>` runs that one alone, so a role can
-     * let every customer check out and keep rebooking for the customers whose
+     * let every user check out and keep rebooking for the users whose
      * role gives it. A push naming an operation the project does not have is
      * refused, by name.
      *
@@ -803,8 +841,8 @@ interface ApplyConfigCustomerRoleInput {
      */
     grants: string[];
     /**
-     * When true, every customer in the project inherits this role with no
-     * per-customer assignment. An app's baseline customer grant should be a
+     * When true, every user in the project inherits this role with no
+     * per-user assignment. An app's baseline user grant should be a
      * single `isDefault: true` role. Defaults to false.
      */
     isDefault?: boolean;
@@ -815,7 +853,7 @@ interface ApplyConfigCustomerRoleInput {
  *
  * EXPLICIT, BECAUSE SILENCE IS THE WRONG DEFAULT HERE. An optional source left
  * out of the config could be a decision or an oversight, and the two have
- * opposite consequences: one is an operator who does not want their customers
+ * opposite consequences: one is an operator who does not want their users
  * synced, the other is an operator who thinks they are and is wrong. So an
  * optional source that is neither mapped nor declined is refused at push, with
  * both spellings named. Nothing is submitted for a declined one, so the platform
@@ -824,7 +862,7 @@ interface ApplyConfigCustomerRoleInput {
  *
  *   sources: {
  *     product:  { toModel: 'product', naturalKey: 'shopifyId', fields: { … } },
- *     customer: false,   // this project does not sync customers
+ *     user: false,   // this project does not sync users
  *   }
  */
 type AppMappingDeclined = false;
@@ -872,15 +910,15 @@ interface AppInput {
     /** Opaque settings forwarded to the app's middleware. */
     settings?: Record<string, unknown>;
     /**
-     * The customer sign-in this install pairs with the app, for an app whose own
-     * system has customers: the key of one of the project's OAuth or OIDC
-     * customer sign-ins, declared under `authProviders`. Every identity the app
+     * The user sign-in this install pairs with the app, for an app whose own
+     * system has users: the key of one of the project's OAuth or OIDC
+     * user sign-ins, declared under `authProviders`. Every identity the app
      * names is resolved through it.
      *
      * `false` pairs none. Leave it out to leave the install's pairing alone: a
      * push never removes a pairing it was not told about.
      */
-    customerSignIn?: string | false;
+    userSignIn?: string | false;
     mappings?: {
         /** `false` declines an OPTIONAL source. See AppMappingDeclined. */
         sources?: Record<string, AppSourceMappingInput | AppMappingDeclined>;
@@ -896,32 +934,32 @@ interface AppInput {
  * the column, `undefined` leaves it untouched.
  */
 interface ApplyConfigProjectSettingsInput {
-    /** Display name in customer-facing emails / portal headers. */
+    /** Display name in the project's own emails and portal headers. */
     displayName?: string;
-    /** Public URL of the project logo (rendered in customer emails). */
+    /** Public URL of the project logo (rendered in user emails). */
     logoUrl?: string;
-    /** Hex color used as accent in customer-facing emails. */
+    /** Hex color used as accent in the project's own emails. */
     primaryColor?: string;
-    /** "From" name on outbound customer emails. */
+    /** "From" name on outbound user emails. */
     fromName?: string;
-    /** "Reply-To" address on outbound customer emails. */
+    /** "Reply-To" address on outbound user emails. */
     replyTo?: string;
     /** Support email surfaced in email footers. */
     supportEmail?: string;
     /**
      * Public base URL of the consumer-facing app (storefront, portal,
-     * internal tool, …). Reset / verify / invitation links in customer
+     * internal tool, …). Reset / verify / invitation links in user
      * emails are built from this — required before the platform will mint
-     * customer-email links.
+     * user-email links.
      */
     appBaseUrl?: string;
     /**
-     * Whether the platform sends a welcome email on customer registration.
+     * Whether the platform sends a welcome email on user registration.
      * Default true. Disable for invite-style flows.
      */
-    customerWelcomeEmailEnabled?: boolean;
+    welcomeEmailEnabled?: boolean;
     /**
-     * Self-serve customer signup mode. Default `public`. `restricted` accepts only
+     * Self-serve user signup mode. Default `public`. `restricted` accepts only
      * invited emails, `waitlist` queues signups for approval, `closed` disables
      * self-serve signup entirely.
      */
@@ -936,28 +974,28 @@ interface ApplyConfigProjectSettingsInput {
      */
     signupRestrictions?: SignupRestrictionsInput;
     /**
-     * Whether email/password customer login is exposed. Default true. Disable
+     * Whether email/password sign-in is exposed. Default true. Disable
      * for a passwordless project (one-time codes or single sign-on only).
      */
-    customerPasswordEnabled?: boolean;
+    passwordEnabled?: boolean;
     /**
-     * Whether email one-time-code customer login is exposed. Default false.
+     * Whether email one-time-code sign-in is exposed. Default false.
      */
-    customerOtpEnabled?: boolean;
+    otpEnabled?: boolean;
     /**
-     * Whether a signed-in customer may register an organization of their own
-     * through `registerOperatorOrganization`. Default false. Needs
-     * `operatorSignupRole` to name the role the founder is given, or the
+     * Whether a signed-in user may register an organization of their own
+     * through `registerOrganization`. Default false. Needs
+     * `organizationSignupRole` to name the role the founder is given, or the
      * platform refuses every registration.
      */
-    operatorSignupEnabled?: boolean;
+    organizationSignupEnabled?: boolean;
     /**
-     * The key of the customer role a self-registered organization's founder
+     * The key of the role a self-registered organization's founder
      * holds in it (a role of this project, e.g. `'operator'`). No default.
      */
-    operatorSignupRole?: string;
+    organizationSignupRole?: string;
     /**
-     * The customer roles an organization's own staffer may hand out, by key.
+     * The roles an organization's own staffer may hand out, by key.
      *
      * THE CEILING ON WHAT AN ORGANIZATION CAN BECOME, set by the party that is
      * not inside it. An organization's staffer may add a member with a role only
@@ -970,7 +1008,7 @@ interface ApplyConfigProjectSettingsInput {
      * take the capability away from every organization in the project. A bare
      * "send nothing to clear" could not tell the last two apart.
      *
-     * Every key must name a live customer role of this project. The platform
+     * Every key must name a live role of this project. The platform
      * refuses the whole list rather than dropping an entry it cannot resolve,
      * because a list that quietly lost one is a capability an operator believes
      * they granted and did not.
@@ -1053,8 +1091,8 @@ interface ApplyConfigDesignTokensInput {
  *
  * Organisation POLICY is manifest-shaped and belongs here: whether self-serve
  * sign-up is on, which role a founder is given, which roles an organisation may
- * assign. Organisation INSTANCES are administrative state, like a customer or a
- * credential's last use — created by an operator, by a customer signing up, or
+ * assign. Organisation INSTANCES are administrative state, like a user or a
+ * credential's last use — created by an operator, by a user signing up, or
  * by a provisioning call, and suspended or deleted by deliberate acts with
  * their own confirmations and their own audit trail.
  *
@@ -1062,7 +1100,7 @@ interface ApplyConfigDesignTokensInput {
  * rule: a family a manifest OMITS is a family whose resources this config owns
  * and no longer wants. Apply that to organisations and a founder who pushed a
  * config without an organisations block would lose a live tenant — every row,
- * every customer, every credential — because a file did not mention it.
+ * every user, every credential — because a file did not mention it.
  */
 interface ApplyConfigInput {
     key: string;
@@ -1106,16 +1144,16 @@ interface ApplyConfigInput {
     schedules?: ApplyConfigScheduleInput[];
     hooks?: ApplyConfigHookInput[];
     authProviders?: ApplyConfigAuthProviderInput[];
-    relyingParties?: ApplyConfigRelyingPartyInput[];
+    authClients?: ApplyConfigAuthClientInput[];
     placements?: ApplyConfigPlacementInput[];
     apiKeys?: ApplyConfigApiKeyInput[];
     /**
-     * Customer RBAC roles, reconciled by `foir push`. Declare an
-     * `isDefault: true` role to grant every customer the write/execute scopes
-     * their tokens need — without one, customers get read-only
+     * User RBAC roles, reconciled by `foir push`. Declare an
+     * `isDefault: true` role to grant every user the write/execute scopes
+     * their tokens need — without one, users get read-only
      * tokens after the Model B auth change.
      */
-    customerRoles?: ApplyConfigCustomerRoleInput[];
+    userRoles?: ApplyConfigUserRoleInput[];
     /** Per-project app declarations, keyed by app name. */
     apps?: Record<string, AppInput>;
     /**
@@ -1246,8 +1284,8 @@ declare function defineVariantCatalogEntry(entry: ApplyConfigVariantCatalogEntry
 declare function defineSchedule(schedule: ApplyConfigScheduleInput): ApplyConfigScheduleInput;
 /** Define an auth provider. */
 declare function defineAuthProvider(provider: ApplyConfigAuthProviderInput): ApplyConfigAuthProviderInput;
-/** Define a Login-with-Foir relying party (storefront / external app). */
-declare function defineRelyingParty(client: ApplyConfigRelyingPartyInput): ApplyConfigRelyingPartyInput;
+/** Define a Login-with-Foir auth client (storefront / external app). */
+declare function defineAuthClient(client: ApplyConfigAuthClientInput): ApplyConfigAuthClientInput;
 /** Define a lifecycle hook. */
 declare function defineHook(hook: ApplyConfigHookInput): ApplyConfigHookInput;
 /** Define an editor placement (sidebar or main-editor tab). */
@@ -1286,4 +1324,4 @@ interface FoirSecretsConfig {
  */
 declare function defineSecrets(config: FoirSecretsConfig): FoirSecretsConfig;
 
-export { type AccessInput, type AppInput, type AppMappingDeclined, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigContextDimensionInput, type ApplyConfigCustomerRoleInput, type ApplyConfigDesignTokensInput, type ApplyConfigEmailCopyInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigLocaleInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectEmailInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigRelyingPartyInput, type ApplyConfigRelyingPartyLoginMethods, type ApplyConfigScheduleInput, type ApplyConfigVariantCatalogEntryInput, type DestinationValue, type DestinationValues, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type FieldAccessInput, type FieldDefinitionInput, type FieldPlacement, type FieldRelationshipInput, type FoirProjectsConfig, type FoirSecretsConfig, type LookupDefinitionInput, type NamedProjectInput, type NamedProjectManifest, type QuotaRule, type ReferenceFieldConfig, type ReferenceFieldDefinitionInput, type SecretDeclaration, type SecretOwnerKind, type SelectFieldConfig, type SelectFieldDefinitionInput, type SelectedNamedProject, type SignupModeName, type SignupRestrictionsInput, defineAuthProvider, defineConfig, defineContextDimension, defineDesignTokens, defineEmailCopy, defineEnumField, defineField, defineHook, defineLocale, defineModel, defineOperation, definePlacement, defineRelyingParty, defineSchedule, defineSecrets, defineSelectField, defineVariantCatalogEntry };
+export { type AccessInput, type AppInput, type AppMappingDeclined, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthClientInput, type ApplyConfigAuthClientLoginMethods, type ApplyConfigAuthProviderInput, type ApplyConfigContextDimensionInput, type ApplyConfigDesignTokensInput, type ApplyConfigEmailCopyInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigLocaleInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectEmailInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigScheduleInput, type ApplyConfigUserRoleInput, type ApplyConfigVariantCatalogEntryInput, type DestinationValue, type DestinationValues, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type FieldDefinitionInput, type FieldGuardInput, type FieldPlacement, type FieldRelationshipInput, type FoirProjectsConfig, type FoirSecretsConfig, type LookupDefinitionInput, type NamedProjectInput, type NamedProjectManifest, type QuotaRule, type ReferenceFieldConfig, type ReferenceFieldDefinitionInput, type SecretDeclaration, type SecretOwnerKind, type SelectFieldConfig, type SelectFieldDefinitionInput, type SelectedNamedProject, type SignupModeName, type SignupRestrictionsInput, defineAuthClient, defineAuthProvider, defineConfig, defineContextDimension, defineDesignTokens, defineEmailCopy, defineEnumField, defineField, defineHook, defineLocale, defineModel, defineOperation, definePlacement, defineSchedule, defineSecrets, defineSelectField, defineVariantCatalogEntry };

package/dist/lib/config-helpers.js

@@ -38,7 +38,7 @@ function defineSchedule(schedule) {
 function defineAuthProvider(provider) {
   return provider;
 }
-function defineRelyingParty(client) {
+function defineAuthClient(client) {
   return client;
 }
 function defineHook(hook) {
@@ -51,6 +51,7 @@ function defineSecrets(config) {
   return config;
 }
 export {
+  defineAuthClient,
   defineAuthProvider,
   defineConfig,
   defineContextDimension,
@@ -63,7 +64,6 @@ export {
   defineModel,
   defineOperation,
   definePlacement,
-  defineRelyingParty,
   defineSchedule,
   defineSecrets,
   defineSelectField,