@foir/sdk 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -108,6 +108,30 @@ nobody asking for `@foir/sdk` gets it early. The push that carries the commit to
 
 Changes on `dev` that have not been published to npm.
 
+## [0.15.0] — 2026-10-02
+
+Published under npm's `next` tag from `dev`, because it calls parts of the
+platform that production serves from the next promotion; `latest` moves to it
+then.
+
+### Added
+
+- **`notifications.setConsent` answers `confirmationPending`**, and takes
+  `givenElsewhere` and `locale` (`@foir/sdk/app`). A project can ask that an
+  opt-in an app collects in a category is confirmed by email before it counts.
+  In such a category an opt-in writes nothing: the platform sends the customer
+  one confirmation email, in the page's `locale` when they have stated no
+  language of their own, and the answer says `confirmationPending`. The
+  preference turns on when they follow the link. Everywhere else an opt-in is
+  applied at once, as before.
+- A consent the app carries over from the system it was given in says
+  `givenElsewhere: true`, and is applied as it stands.
+
+### Changed
+
+- `notifications.setConsent` asks the platform for `confirmationPending`, a
+  field a platform older than this release does not have.
+
 ## [0.14.0] — 2026-10-01
 
 Published under npm's `next` tag from `dev`, because it calls parts of the

package/dist/app/client.d.ts

@@ -183,6 +183,22 @@ export interface AppConsentChange {
      * answering `stale`.
      */
     sourceModifiedAt?: string;
+    /**
+     * True when the customer gave this consent in another system and the app is
+     * carrying it over (a mirror). It is applied as it stands.
+     *
+     * Left out, the app collected the consent itself (a sign-up form), and an
+     * opt-in is applied the way its category says: at once, or, in a category
+     * that confirms by email, only when the customer follows the link the
+     * platform sends them. Until then nothing is written and the answer says
+     * `confirmationPending`.
+     */
+    givenElsewhere?: boolean;
+    /**
+     * The language of the page the consent was collected on. The confirmation
+     * email is written in it when the customer has stated none of their own.
+     */
+    locale?: string;
 }
 /** What the calling token is, and what it is served. Read from the platform, never off the token. */
 export interface AppWhoami {
@@ -409,9 +425,16 @@ export interface AppClient {
         /**
          * Set a named customer's consent in an opt-in category. Needs
          * `notifications:consent`, which only an operation's token carries.
+         *
+         * `confirmationPending` is true when an opt-in the app collected was not
+         * applied because its category confirms by email first: the customer has
+         * been sent a link, or was sent one recently, and the preference turns on
+         * when they follow it. The answer is the same whether or not the address
+         * already had a customer.
          */
         setConsent(change: AppConsentChange): Promise<{
             stale: boolean;
+            confirmationPending: boolean;
         }>;
     };
     operations: {

package/dist/app.js

@@ -825,13 +825,15 @@ function createAppClient(config) {
           enabled: change.enabled
         };
         if (change.sourceModifiedAt !== void 0) input.sourceModifiedAt = change.sourceModifiedAt;
+        if (change.givenElsewhere !== void 0) input.givenElsewhere = change.givenElsewhere;
+        if (change.locale !== void 0) input.locale = change.locale;
         const answer = await field(
           "setCustomerConsent",
-          `mutation AppSetCustomerConsent($input: SetCustomerConsentInput!) { setCustomerConsent(input: $input) { stale } }`,
+          `mutation AppSetCustomerConsent($input: SetCustomerConsentInput!) { setCustomerConsent(input: $input) { stale confirmationPending } }`,
           { input }
         );
         if (!answer) return refuse("setCustomerConsent reported no error and answered nothing");
-        return { stale: answer.stale === true };
+        return { stale: answer.stale === true, confirmationPending: answer.confirmationPending === true };
       }
     },
     operations: {

package/dist/server/server-client.d.ts

@@ -4,8 +4,8 @@
  * Used by config API backends (e.g., Hono servers) to query the platform
  * GraphQL API at runtime. Provisioning (models, operations, schedules) is
  * handled by `foir push`. Record writes from upstream sources go through
- * the scoped-token `upsertRecord` GraphQL mutation served by the
- * integrations gateway, not through this client.
+ * the scoped-token `upsertRecord` GraphQL mutation an app's token reaches
+ * (`@foir/sdk/app`), not through this client.
  *
  * Auth: All requests use an API key (x-api-key header).
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {