@foir/sdk 0.17.0 → 0.19.0

package/CHANGELOG.md

@@ -108,6 +108,121 @@ nobody asking for `@foir/sdk` gets it early. The push that carries the commit to
 
 Changes on `dev` that have not been published to npm.
 
+## [0.19.0] — 2026-10-02
+
+Published under npm's `next` tag from `dev`. The data client's change needs no
+platform release. `setConsent` by email calls a field the platform serves from
+the next promotion; `latest` moves to this version then.
+
+### Changed
+
+- **Breaking: schema drift by itself no longer refuses a typed call**
+  (`@foir/sdk/data`). What `strictSchemaDrift` refuses has changed; its name
+  and its default have not.
+
+  Before, a client built with a generated module refused every typed call,
+  with `FoirSchemaDriftError`, from the moment it saw the server serving another
+  surface version. That version is a hash over everything `foir types` reads,
+  so it moves whenever the surface grows. A field published on a model, or an
+  op the platform added to every model, made every deployed client refuse its
+  second typed call, though nothing it prints had changed.
+
+  Now the drift is reported once, exactly as before (`onSchemaDrift`, or the
+  `console.warn`), and it refuses nothing by itself. When the manifest arrives
+  the client compares its generated trees with the served ones, and refuses a
+  typed call only when something that call depends on is no longer served the
+  way the module describes it:
+
+  - its op is gone, or the op's root field or result kind changed;
+  - an argument the module declares is gone, or has a type the generated one no
+    longer fits, or the op now requires an argument the module does not know;
+  - a field its selection names is gone or changed shape, in the model the op
+    returns or in a union that model embeds;
+  - a relation the call includes changed target, became a list or a
+    connection, or its target model lost a field.
+
+  Anything added refuses nothing: a model, a namespace, an op, an optional
+  argument, a field, a relation, a union member, a subscription. An argument
+  that went from required to optional refuses nothing either.
+
+  `FoirSchemaDriftError`'s message now names what the refused call depends on
+  (`models.order.selection.status (no longer served)`), and still names
+  `foir types` as the remedy. The warning for a drift that broke nothing says
+  the surface has grown and that every typed call keeps working.
+
+  Unchanged: `strictSchemaDrift: false` turns refusal off entirely, the first
+  call on a client is never blocked on the manifest, `raw()` is never refused,
+  and `checkSchemaDrift: false` skips the fetch. `createFoirDriftHandler` in
+  `@foir/sdk/live` still resyncs on every drift, whether or not anything is
+  incompatible.
+
+  A client wired by hand with `surfaceVersion` and no `selections` prints from
+  the served manifest, so it has nothing older to compare and is no longer
+  refused on drift.
+
+  Migration: none for an app that only catches `FoirSchemaDriftError`. An app
+  that used the refusal to learn that its module was stale in ANY way should
+  read `onSchemaDrift`, which still fires for every drift, or gate on
+  `foir types --check` in CI.
+- **Breaking: `FoirSchemaDrift` has a new required field, `incompatible`**
+  (`@foir/sdk/data`). Code that reads a drift is unaffected. Code that builds
+  one by hand, for example to test a handler given to `onSchemaDrift` or made by
+  `createFoirDriftHandler`, must add `incompatible: []`.
+- **Breaking (types): `AppConsentChange` names its customer one way**
+  (`@foir/sdk/app`). It was an interface with a required `customerId`. It is
+  now a type that holds a `customerId` or an `email`, never both. A change
+  written as `{ customerId, ... }` is unaffected. An interface that extended
+  `AppConsentChange` no longer compiles: intersect with it instead.
+
+### Added
+
+- `notifications.setConsent` takes `email` in place of `customerId`
+  (`@foir/sdk/app`), for an opt-in from somebody who may have no customer yet,
+  such as a sign-up form. The platform finds the customer holding the address
+  at the install's level, or makes one, together with the change, so a change
+  it refuses (a category the project does not have, a confirmation email the
+  project cannot send) leaves no customer behind. Finding or making the
+  customer first with `customers.ensure` did. The operation must declare
+  `customers:write` as well as `notifications:consent`. `AppConsentSubject` is
+  exported.
+
+- `FoirSchemaDrift.incompatible`: what the generated module describes that the
+  server no longer serves that way, as sorted paths into the manifest
+  (`models.order.selection.status`, `models.order.ops.update`,
+  `namespaces.search.ops.searchRecords.args.query`,
+  `models.order.relations.customer`, `selectionUnions.Block.HeroBlock.title`).
+  Empty when the surface has only grown. `changed` keeps its meaning: what
+  moved, not what broke.
+
+## [0.18.0] — 2026-10-02
+
+Published under npm's `next` tag from `dev`, because it calls fields the
+platform serves from the next promotion; `latest` moves to it then.
+
+### Changed
+
+- **Breaking: an app finds a customer by identity through its install, not
+  through a model** (`@foir/sdk/app`). The customer sign-in an app's customers
+  come through is paired with the install as a whole, so the two reads that
+  walk it no longer name a model and have moved beside the other customer
+  reads:
+  - `records.customer.identities(model, customerId)` is now
+    `customers.identities(customerId)`.
+  - `customers.byIdentity(identity)` is new: the id of the customer who holds
+    an identity at the app's own system, or `null`. It replaces reading a
+    customer's record for its owner.
+
+  Both need the new capability `customers:read:identity` (or `customers:read`),
+  declared by the operation, and are refused at an install that pairs no
+  sign-in. Reading or writing a model is no longer what admits them.
+- `install.config()` asks the platform for `customerSignIn`, a field a platform
+  older than this release does not have.
+
+### Added
+
+- `install.config()` answers `customerSignIn`: the key of the customer sign-in
+  the install pairs, or `null` when it pairs none.
+
 ## [0.17.0] — 2026-10-02
 
 Published under npm's `next` tag from `dev`, because it reads a field the

package/README.md

@@ -88,7 +88,14 @@ was generated from: a hash over exactly what `foir types` reads, which moves onl
 when regenerating would write a different file. Pushing an operation, a role or
 a key moves the server's invalidation counter and not the surface, so it is not
 drift. Publishing a field on a model the types include is, and the client
-refuses the next typed call with a message naming the model. The remedy is
+reports it once, naming the model.
+
+**Drift does not stop a call.** A surface that has grown still answers every
+document the module prints. A typed call is refused, with `FoirSchemaDriftError`,
+only when something it depends on is no longer served as generated: a field its
+selection names, its op, one of its arguments, or the target of a relation it
+includes. The message names that part, and `drift.incompatible` lists every
+such part as a path (`models.order.selection.status`). The remedy is
 `foir types`; `strictSchemaDrift: false` never is.
 
 **Scalars are always complete**, so `post.title` is typed present and *is*

package/dist/app/client.d.ts

@@ -103,6 +103,14 @@ export interface AppInstallConfig {
      * (`appCustomerEmailUnavailableOf`), so say so before one is.
      */
     customerEmailUnavailable: AppCustomerEmailUnavailableReason | null;
+    /**
+     * The customer sign-in this install pairs with the app, by key, for an app
+     * whose own system has customers; null when it pairs none. Every identity
+     * the app names is resolved through it, so while it is null nothing finds a
+     * customer by identity: `customers.byIdentity` and `customers.identities`
+     * are refused, and an operation that needs them is not registered.
+     */
+    customerSignIn: string | null;
 }
 /**
  * The status an install reports. Leaving out `subscriptionHealth`,
@@ -178,8 +186,24 @@ export interface AppNotification {
     /** Makes the send safe to repeat: the same key from the same operation tells the customer once. */
     idempotencyKey?: string;
 }
-export interface AppConsentChange {
+/**
+ * Who a consent change is for: a customer whose id the app holds, or an
+ * address.
+ *
+ * By `email`, the customer holding the address at the operation's level is
+ * found, or made, together with the change, so a change the platform refuses
+ * leaves no customer behind. It is for an opt-in from somebody who may have no
+ * customer yet (a sign-up form), and the operation must declare
+ * `customers:write` as well as `notifications:consent`.
+ */
+export type AppConsentSubject = {
     customerId: string;
+    email?: undefined;
+} | {
+    email: string;
+    customerId?: undefined;
+};
+export type AppConsentChange = AppConsentSubject & {
     /** A notification category the project makes opt-in. */
     category: string;
     /** The channel the consent is for, as the project's preferences name it (for example `email`). */
@@ -207,7 +231,7 @@ export interface AppConsentChange {
      * email is written in it when the customer has stated none of their own.
      */
     locale?: string;
-}
+};
 /** What the calling token is, and what it is served. Read from the platform, never off the token. */
 export interface AppWhoami {
     /** The app the token acts for, when it acts for one. */
@@ -378,12 +402,6 @@ export interface AppClient {
              * else is attached to them. Needs `customers:write` as well.
              */
             erase(model: string, identity: string): Promise<AppCustomerEraseResult>;
-            /**
-             * The other direction: the identities a customer the app names by id
-             * signs in with there, most recently seen first. Empty when they sign in
-             * with none. For an app acting on an event that names the Foir customer.
-             */
-            identities(model: string, customerId: string): Promise<string[]>;
         };
     };
     customers: {
@@ -415,6 +433,23 @@ export interface AppClient {
          * `customers:read`.
          */
         byEmail(email: string): Promise<AppCustomer | null>;
+        /**
+         * The id of the customer who holds this identity at the app's own system,
+         * or null when nobody does: for an app hearing from its system about one
+         * of its customers. The identity is the subject of the customer's sign-in
+         * with that system, and it is resolved through the customer sign-in the
+         * install pairs (`install.config().customerSignIn`) and no other. Never
+         * matched by email. Needs `customers:read:identity`, or `customers:read`.
+         */
+        byIdentity(identity: string): Promise<string | null>;
+        /**
+         * The other direction: the identities a customer the app names by id
+         * holds at the app's own system, most recently seen first, through the
+         * same pairing. Empty when they have never signed in that way. For an app
+         * acting on an event that names the Foir customer. Needs
+         * `customers:read:identity`, or `customers:read`.
+         */
+        identities(customerId: string): Promise<string[]>;
         /**
          * The customers at the install's level, a page at a time, newest first.
          * Needs `customers:read`: an operation declaring only
@@ -439,6 +474,10 @@ export interface AppClient {
          * been sent a link, or was sent one recently, and the preference turns on
          * when they follow it. The answer is the same whether or not the address
          * already had a customer.
+         *
+         * Name the customer by `customerId`, or by `email` for somebody who may
+         * have no customer yet: the platform finds or makes them with the change,
+         * and that also needs `customers:write`.
          */
         setConsent(change: AppConsentChange): Promise<{
             stale: boolean;

package/dist/app/contract/proto/apps/v1/apps_pb.d.ts

@@ -117,6 +117,14 @@ export declare type AppConfig = Message<"apps.v1.AppConfig"> & {
    * @generated from field: repeated apps.v1.Feature features = 13;
    */
   features: Feature[];
+
+  /**
+   * OPTIONAL. The app's own system has customers who sign in to it. See
+   * CustomerSignIn.
+   *
+   * @generated from field: apps.v1.CustomerSignIn customer_sign_in = 14;
+   */
+  customerSignIn?: CustomerSignIn | undefined;
 };
 
 /**
@@ -125,6 +133,42 @@ export declare type AppConfig = Message<"apps.v1.AppConfig"> & {
  */
 export declare const AppConfigSchema: GenMessage<AppConfig>;
 
+/**
+ * The app's own system has customers, and the app names each by the subject of
+ * their sign-in with that system: a store's customer number, which is also who
+ * they are when they sign in to the project through the store's sign-in.
+ *
+ * Declaring it lets an install pair ONE of the project's customer sign-ins with
+ * the app (ConfirmInstallAppRequest.customer_sign_in): the operator says which
+ * sign-in the app's customers come through, and the platform resolves every
+ * identity the app names through that sign-in and no other. The pairing is the
+ * operator's, never inferred: the install knows the external account it
+ * connects, not which of the project's sign-ins its customers use, and a wrong
+ * pairing would attach one person's data to another.
+ *
+ * The pairing is optional. What needs it says so, and cannot be on without it:
+ * a source that names its customers by identity (SourceType.identity), a
+ * feature that finds customers through it (Feature.customer_sign_in), and an
+ * operation that asks who holds an identity (customers:read:identity).
+ *
+ * @generated from message apps.v1.CustomerSignIn
+ */
+export declare type CustomerSignIn = Message<"apps.v1.CustomerSignIn"> & {
+  /**
+   * What the setup tells the operator they are choosing, in a sentence: which
+   * customers these are and what identifies them.
+   *
+   * @generated from field: string description = 1;
+   */
+  description: string;
+};
+
+/**
+ * Describes the message apps.v1.CustomerSignIn.
+ * Use `create(CustomerSignInSchema)` to create a new message.
+ */
+export declare const CustomerSignInSchema: GenMessage<CustomerSignIn>;
+
 /**
  * A feature of the app: something the operator turns on or off as a whole at
  * setup, such as a store's preorders or its back-in-stock alerts.
@@ -180,6 +224,16 @@ export declare type Feature = Message<"apps.v1.Feature"> & {
    * @generated from field: repeated string sources = 5;
    */
   sources: string[];
+
+  /**
+   * The feature finds customers through the install's customer sign-in
+   * (AppConfig.customer_sign_in), which the manifest must declare. It cannot
+   * be on at an install that pairs none: the setup asks for the sign-in at the
+   * switch, and the platform refuses the switch without one.
+   *
+   * @generated from field: bool customer_sign_in = 6;
+   */
+  customerSignIn: boolean;
 };
 
 /**
@@ -586,10 +640,11 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
    *
    * It is what lets a sync write customer-owned rows. The platform resolves the
    * value to a Foir customer through the customer sign-in the install pairs
-   * with the source (SourceMapping.identity_provider), at the install's level:
-   * the customer who signs in with that identity, or one made for it. Each
-   * customer holds one row of the source, their profile, so the source has no
-   * natural key; the customer is the key. Never matched by email.
+   * with the app (AppConfig.customer_sign_in, which the manifest must then
+   * declare), at the install's level: the customer who signs in with that
+   * identity, or one made for it. Each customer holds one row of the source,
+   * their profile, so the source has no natural key; the customer is the key.
+   * Never matched by email.
    *
    * @generated from field: string identity = 10;
    */
@@ -1429,6 +1484,18 @@ export enum ManifestCapability {
    */
   CUSTOMERS_READ_NAMED = 15,
 
+  /**
+   * The link between a customer and who they are at the app's own system, and
+   * nothing else about them: the customer who holds an identity, and the
+   * identities a customer the operation names by id holds, both through the
+   * customer sign-in the install pairs with the app and no other. An operation
+   * that declares customers:read holds it too; customers:read:named does not
+   * reach it, nor it what that reaches.
+   *
+   * @generated from enum value: MANIFEST_CAPABILITY_CUSTOMERS_READ_IDENTITY = 16;
+   */
+  CUSTOMERS_READ_IDENTITY = 16,
+
   /**
    * Reporting an ASYNC run's outcome.
    *

package/dist/app/index.d.ts

@@ -21,7 +21,7 @@
  * The manifest's own messages are on `@foir/sdk/app/contract`.
  */
 export { createAppClient } from './client';
-export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppCustomer, AppCustomerEraseResult, AppCustomerList, AppCustomerSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
+export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppCustomer, AppCustomerEraseResult, AppCustomerList, AppCustomerSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
 export { appCustomerEmailUnavailableOf, appCustomerUnlinkedOf, appLookupConflictOf, isAppFieldWithheld } from './errors';
 export type { AppCustomerEmailUnavailableReason, AppLookupConflict } from './errors';
 export { appModelFieldName, appModelTypeName, appSelectorEnumValue } from './naming';

package/dist/app/vocabulary.generated.d.ts

@@ -7,7 +7,7 @@ export declare const APP_HOOK_EVENTS: readonly ["RECORD_CREATED", "RECORD_UPDATE
 /** An event a hook can name. */
 export type AppHookEvent = (typeof APP_HOOK_EVENTS)[number];
 /** The capabilities an operation declares as written. */
-export declare const APP_CAPABILITIES: readonly ["config:read", "secrets:read.app", "secrets:put.app", "secrets:list.app", "secrets:delete.app", "status:write", "files:read", "files:list", "files:write", "customers:write", "notifications:write", "notifications:consent", "customers:read", "customers:read:named", "operations:complete"];
+export declare const APP_CAPABILITIES: readonly ["config:read", "secrets:read.app", "secrets:put.app", "secrets:list.app", "secrets:delete.app", "status:write", "files:read", "files:list", "files:write", "customers:write", "notifications:write", "notifications:consent", "customers:read", "customers:read:named", "customers:read:identity", "operations:complete"];
 /** A capability an operation declares as written. */
 export type AppCapability = (typeof APP_CAPABILITIES)[number];
 /**

package/dist/app-contract.js

@@ -8,30 +8,31 @@ var file_buf_validate_validate = /* @__PURE__ */ fileDesc("ChtidWYvdmFsaWRhdGUvd
 
 // ../proto-ts/src/apps/v1/apps_pb.js
 import { file_google_protobuf_descriptor as file_google_protobuf_descriptor2, file_google_protobuf_struct } from "@bufbuild/protobuf/wkt";
-var file_apps_v1_apps = /* @__PURE__ */ fileDesc2("ChJhcHBzL3YxL2FwcHMucHJvdG8SB2FwcHMudjEilgUKCUFwcENvbmZpZxI0CgRuYW1lGAEgASgJQia6SCNyIRhAMh1eW2Etel1bYS16MC05XSooLVthLXowLTldKykqJBIYCgd2ZXJzaW9uGAIgASgJQge6SARyAhABEiMKCG1ldGFkYXRhGAMgASgLMhEuYXBwcy52MS5NZXRhZGF0YRInCgptaWRkbGV3YXJlGAQgASgLMhMuYXBwcy52MS5NaWRkbGV3YXJlEikKC2NyZWRlbnRpYWxzGAUgASgLMhQuYXBwcy52MS5DcmVkZW50aWFscxIwCg9zZXR0aW5nc19zY2hlbWEYBiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EjAKB3NvdXJjZXMYByADKAsyHy5hcHBzLnYxLkFwcENvbmZpZy5Tb3VyY2VzRW50cnkSLAoFc2lua3MYCCADKAsyHS5hcHBzLnYxLkFwcENvbmZpZy5TaW5rc0VudHJ5EiYKCm9wZXJhdGlvbnMYCSADKAsyEi5hcHBzLnYxLk9wZXJhdGlvbhIcCgVob29rcxgKIAMoCzINLmFwcHMudjEuSG9vaxIXCgJ1aRgLIAEoCzILLmFwcHMudjEuVUkSIQoHaW5ib3VuZBgMIAEoCzIQLmFwcHMudjEuSW5ib3VuZBIiCghmZWF0dXJlcxgNIAMoCzIQLmFwcHMudjEuRmVhdHVyZRpDCgxTb3VyY2VzRW50cnkSCwoDa2V5GAEgASgJEiIKBXZhbHVlGAIgASgLMhMuYXBwcy52MS5Tb3VyY2VUeXBlOgI4ARpDCgpTaW5rc0VudHJ5EgsKA2tleRgBIAEoCRIkCgV2YWx1ZRgCIAEoCzIVLmFwcHMudjEuU2lua0NvbnRyYWN0OgI4ASKNAQoHRmVhdHVyZRIzCgNrZXkYASABKAlCJrpII3IhGEAyHV5bYS16XVthLXowLTldKigtW2EtejAtOV0rKSokEhYKBXRpdGxlGAIgASgJQge6SARyAhABEhMKC2Rlc2NyaXB0aW9uGAMgASgJEg8KB3NldHRpbmcYBCABKAkSDwoHc291cmNlcxgFIAMoCSJlCghNZXRhZGF0YRIUCgxkaXNwbGF5X25hbWUYASABKAkSEwoLZGVzY3JpcHRpb24YAiABKAkSDAoEaWNvbhgDIAEoCRIOCgZhdXRob3IYBCABKAkSEAoIaG9tZXBhZ2UYBSABKAkiLQoKTWlkZGxld2FyZRIfCgN1cmwYASABKAlCErpID3INMgteaHR0cHM6Ly8uKyLXAgoLQ3JlZGVudGlhbHMSLwoIc3RyYXRlZ3kYASABKA4yHS5hcHBzLnYxLkNyZWRlbnRpYWxzLlN0cmF0ZWd5EiwKBnNjaGVtYRgCIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAIgBARIoCgVvYXV0aBgDIAEoCzIULmFwcHMudjEuT0F1dGhDb25maWdIAYgBASKpAQoIU3RyYXRlZ3kSGAoUU1RSQVRFR1lfVU5TUEVDSUZJRUQQABISCg5TVFJBVEVHWV9PQVVUSBABEhQKEFNUUkFURUdZX0FQSV9LRVkQAhIaChZTVFJBVEVHWV9TSEFSRURfU0VDUkVUEAMSFAoQU1RSQVRFR1lfU1NIX0tFWRAEEhEKDVNUUkFURUdZX05PTkUQBRIUChBTVFJBVEVHWV9NQU5BR0VEEAZCCQoHX3NjaGVtYUIICgZfb2F1dGgiTAoLT0F1dGhDb25maWcSHAoUYXV0aG9yaXplX3N0YXJ0X3BhdGgYASABKAkSHwoXYXV0aG9yaXplX2NhbGxiYWNrX3BhdGgYAiABKAkiVgoHSW5ib3VuZBIhCgd3ZWJob29rGAEgASgLMhAuYXBwcy52MS5XZWJob29rEigKB2FjY291bnQYAiABKAsyFy5hcHBzLnYxLkFjY291bnRXZWJob29rIhcKB1dlYmhvb2sSDAoEcGF0aBgBIAEoCSI/Cg5BY2NvdW50V2ViaG9vaxIMCgRwYXRoGAEgASgJEg8KB3NldHRpbmcYAiABKAkSDgoGc291cmNlGAMgASgJIt0CCgpTb3VyY2VUeXBlEg0KBWxhYmVsGAEgASgJEi8KBmZpZWxkcxgCIAMoCzIfLmFwcHMudjEuU291cmNlVHlwZS5GaWVsZHNFbnRyeRITCgtuYXR1cmFsX2tleRgDIAEoCRIQCghvcHRpb25hbBgEIAEoCBIWCg5wcm92aXNpb25fb25seRgFIAEoCBIrCglyZWZlcmVuY2UYBiABKAsyGC5hcHBzLnYxLlNvdXJjZVJlZmVyZW5jZRIkCgVvd25lchgHIAEoDjIVLmFwcHMudjEuU3RvcmFnZU93bmVyEhMKC3JlY29tbWVuZGVkGAggASgIEg4KBmxvb2t1cBgJIAMoCRIQCghpZGVudGl0eRgKIAEoCRpGCgtGaWVsZHNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKAsyFy5hcHBzLnYxLlN1Z2dlc3RlZEZpZWxkOgI4ASKqAgoPU291cmNlUmVmZXJlbmNlEhEKCWtleV9maWVsZBgBIAEoCRI0CgZmaWVsZHMYAiADKAsyJC5hcHBzLnYxLlNvdXJjZVJlZmVyZW5jZS5GaWVsZHNFbnRyeRIQCghlbmRwb2ludBgDIAEoCRINCgVob3N0cxgEIAMoCRIqCgdyZXF1ZXN0GAUgASgLMhkuYXBwcy52MS5SZWZlcmVuY2VSZXF1ZXN0EhoKEnJlc3BvbnNlX3RyYW5zZm9ybRgGIAEoCRIdChVjYWNoZV9tYXhfYWdlX3NlY29uZHMYByABKAUaRgoLRmllbGRzRW50cnkSCwoDa2V5GAEgASgJEiYKBXZhbHVlGAIgASgLMhcuYXBwcy52MS5TdWdnZXN0ZWRGaWVsZDoCOAEiswIKEFJlZmVyZW5jZVJlcXVlc3QSDgoGbWV0aG9kGAEgASgJEhUKDXBhdGhfdGVtcGxhdGUYAiABKAkSMwoFcXVlcnkYAyADKAsyJC5hcHBzLnYxLlJlZmVyZW5jZVJlcXVlc3QuUXVlcnlFbnRyeRI3CgdoZWFkZXJzGAQgAygLMiYuYXBwcy52MS5SZWZlcmVuY2VSZXF1ZXN0LkhlYWRlcnNFbnRyeRIVCg1ib2R5X3RlbXBsYXRlGAUgASgJEhUKDWJhdGNoX2NhcGFibGUYBiABKAgaLAoKUXVlcnlFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGi4KDEhlYWRlcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIroBCgxTaW5rQ29udHJhY3QSDQoFbGFiZWwYASABKAkSMQoGZmllbGRzGAIgAygLMiEuYXBwcy52MS5TaW5rQ29udHJhY3QuRmllbGRzRW50cnkSEwoLbmF0dXJhbF9rZXkYAyABKAkSEAoIb3B0aW9uYWwYBCABKAgaQQoLRmllbGRzRW50cnkSCwoDa2V5GAEgASgJEiEKBXZhbHVlGAIgASgLMhIuYXBwcy52MS5TaW5rRmllbGQ6AjgBIpYCCg5TdWdnZXN0ZWRGaWVsZBIMCgR0eXBlGAEgASgJEhIKBWxhYmVsGAIgASgJSACIAQESFQoIcmVxdWlyZWQYAyABKAhIAYgBARIsCgZjb25maWcYBCABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SAKIAQESPQoTc3VwcG9ydGVkX2RpcmVjdGlvbhgFIAEoDjIbLmFwcHMudjEuRmllbGRTeW5jRGlyZWN0aW9uSAOIAQESFgoJcXVlcnlhYmxlGAYgASgISASIAQFCCAoGX2xhYmVsQgsKCV9yZXF1aXJlZEIJCgdfY29uZmlnQhYKFF9zdXBwb3J0ZWRfZGlyZWN0aW9uQgwKCl9xdWVyeWFibGUiWwoJU2lua0ZpZWxkEgwKBHR5cGUYASABKAkSEAoIc2VtYW50aWMYAiABKAkSEAoIcmVxdWlyZWQYAyABKAgSEgoFbGFiZWwYBCABKAlIAIgBAUIICgZfbGFiZWwimAQKCU9wZXJhdGlvbhI6CgNrZXkYASABKAlCLbpIKnIoGEAyJF4oX18pP1thLXpdW2EtejAtOV9dKigtW2EtejAtOV9dKykqJBIMCgRuYW1lGAIgASgJEhgKC2Rlc2NyaXB0aW9uGAMgASgJSACIAQESHQoIZW5kcG9pbnQYBCABKAlCC7pICHIGMgReLy4qEhQKDGNhcGFiaWxpdGllcxgFIAMoCRIXCgp0aW1lb3V0X21zGAYgASgFSAGIAQESMgoMcmV0cnlfcG9saWN5GAcgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEgCiAEBEjIKDGlucHV0X3NjaGVtYRgIIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIA4gBARIzCg1vdXRwdXRfc2NoZW1hGAkgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEgEiAEBEhsKDnN1cHBvcnRzX2FzeW5jGAogASgISAWIAQESGQoRcnVuX2FmdGVyX2luc3RhbGwYCyABKAgSHgoWcnVuc19vbl9tYXBwZWRfc291cmNlcxgMIAEoCEIOCgxfZGVzY3JpcHRpb25CDQoLX3RpbWVvdXRfbXNCDwoNX3JldHJ5X3BvbGljeUIPCg1faW5wdXRfc2NoZW1hQhAKDl9vdXRwdXRfc2NoZW1hQhEKD19zdXBwb3J0c19hc3luYyI9ChZNYW5pZmVzdENhcGFiaWxpdHlTcGVjEhAKCGRlY2xhcmVzGAEgASgJEhEKCXBlcl9tb2RlbBgCIAEoCCKmAQoESG9vaxIzCgNrZXkYASABKAlCJrpII3IhGEAyHV5bYS16XVthLXowLTldKigtW2EtejAtOV0rKSokEgwKBG5hbWUYAiABKAkSFgoFZXZlbnQYAyABKAlCB7pIBHICEAESJwoGZmlsdGVyGAQgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIaCglvcGVyYXRpb24YBSABKAlCB7pIBHICEAEiNwoCVUkSMQoKcGxhY2VtZW50cxgBIAMoCzIdLmFwcHMudjEuUGxhY2VtZW50RGVjbGFyYXRpb24itgQKFFBsYWNlbWVudERlY2xhcmF0aW9uEjMKA2tleRgBIAEoCUImukgjciEYQDIdXlthLXpdW2EtejAtOV0qKC1bYS16MC05XSspKiQSNAoGdGFyZ2V0GAIgASgOMiQuYXBwcy52MS5QbGFjZW1lbnREZWNsYXJhdGlvbi5UYXJnZXQSEgoFbW9kZWwYAyABKAlIAIgBARISCgVmaWVsZBgEIAEoCUgBiAEBEiEKGWZpZWxkX3NlbGVjdGVkX2F0X2luc3RhbGwYBSABKAgSEAoDdGFiGAYgASgJSAKIAQESFgoFdGl0bGUYByABKAlCB7pIBHICEAESHwoDdXJsGAggASgJQhK6SA9yDTILXmh0dHBzOi8vLisSHQoQcmVwbGFjZXNfZGVmYXVsdBgJIAEoCEgDiAEBEisKBWhpbnRzGAogASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEgEiAEBEg4KBnNjb3BlcxgLIAMoCRIQCghzZXR0aW5ncxgMIAMoCSJ0CgZUYXJnZXQSFgoSVEFSR0VUX1VOU1BFQ0lGSUVEEAASFAoQVEFSR0VUX0ZVTExfUEFHRRABEhYKElRBUkdFVF9NQUlOX0VESVRPUhACEhIKDlRBUkdFVF9TSURFQkFSEAMSEAoMVEFSR0VUX0ZJRUxEEARCCAoGX21vZGVsQggKBl9maWVsZEIGCgRfdGFiQhMKEV9yZXBsYWNlc19kZWZhdWx0QggKBl9oaW50cyqsAQoSRmllbGRTeW5jRGlyZWN0aW9uEiQKIEZJRUxEX1NZTkNfRElSRUNUSU9OX1VOU1BFQ0lGSUVEEAASJAogRklFTERfU1lOQ19ESVJFQ1RJT05fU09VUkNFX09OTFkQARIiCh5GSUVMRF9TWU5DX0RJUkVDVElPTl9TSU5LX09OTFkQAhImCiJGSUVMRF9TWU5DX0RJUkVDVElPTl9CSURJUkVDVElPTkFMEAMqhAEKDFN0b3JhZ2VPd25lchIdChlTVE9SQUdFX09XTkVSX1VOU1BFQ0lGSUVEEAASGQoVU1RPUkFHRV9PV05FUl9QUk9KRUNUEAESHgoaU1RPUkFHRV9PV05FUl9PUkdBTklaQVRJT04QAhIaChZTVE9SQUdFX09XTkVSX0NVU1RPTUVSEAMqxAoKEk1hbmlmZXN0Q2FwYWJpbGl0eRIjCh9NQU5JRkVTVF9DQVBBQklMSVRZX1VOU1BFQ0lGSUVEEAASNgofTUFOSUZFU1RfQ0FQQUJJTElUWV9DT05GSUdfUkVBRBABGhGaph0NCgtjb25maWc6cmVhZBJACiRNQU5JRkVTVF9DQVBBQklMSVRZX1NFQ1JFVFNfUkVBRF9BUFAQAhoWmqYdEgoQc2VjcmV0czpyZWFkLmFwcBI+CiNNQU5JRkVTVF9DQVBBQklMSVRZX1NFQ1JFVFNfUFVUX0FQUBADGhWaph0RCg9zZWNyZXRzOnB1dC5hcHASQAokTUFOSUZFU1RfQ0FQQUJJTElUWV9TRUNSRVRTX0xJU1RfQVBQEAQaFpqmHRIKEHNlY3JldHM6bGlzdC5hcHASRAomTUFOSUZFU1RfQ0FQQUJJTElUWV9TRUNSRVRTX0RFTEVURV9BUFAQBRoYmqYdFAoSc2VjcmV0czpkZWxldGUuYXBwEjgKIE1BTklGRVNUX0NBUEFCSUxJVFlfU1RBVFVTX1dSSVRFEAYaEpqmHQ4KDHN0YXR1czp3cml0ZRI0Ch5NQU5JRkVTVF9DQVBBQklMSVRZX0ZJTEVTX1JFQUQQBxoQmqYdDAoKZmlsZXM6cmVhZBI0Ch5NQU5JRkVTVF9DQVBBQklMSVRZX0ZJTEVTX0xJU1QQCBoQmqYdDAoKZmlsZXM6bGlzdBI2Ch9NQU5JRkVTVF9DQVBBQklMSVRZX0ZJTEVTX1dSSVRFEAkaEZqmHQ0KC2ZpbGVzOndyaXRlEj4KI01BTklGRVNUX0NBUEFCSUxJVFlfQ1VTVE9NRVJTX1dSSVRFEAoaFZqmHREKD2N1c3RvbWVyczp3cml0ZRJGCidNQU5JRkVTVF9DQVBBQklMSVRZX05PVElGSUNBVElPTlNfV1JJVEUQCxoZmqYdFQoTbm90aWZpY2F0aW9uczp3cml0ZRJKCilNQU5JRkVTVF9DQVBBQklMSVRZX05PVElGSUNBVElPTlNfQ09OU0VOVBAMGhuaph0XChVub3RpZmljYXRpb25zOmNvbnNlbnQSPAoiTUFOSUZFU1RfQ0FQQUJJTElUWV9DVVNUT01FUlNfUkVBRBAOGhSaph0QCg5jdXN0b21lcnM6cmVhZBJICihNQU5JRkVTVF9DQVBBQklMSVRZX0NVU1RPTUVSU19SRUFEX05BTUVEEA8aGpqmHRYKFGN1c3RvbWVyczpyZWFkOm5hbWVkEkYKJ01BTklGRVNUX0NBUEFCSUxJVFlfT1BFUkFUSU9OU19DT01QTEVURRANGhmaph0VChNvcGVyYXRpb25zOmNvbXBsZXRlEjsKIE1BTklGRVNUX0NBUEFCSUxJVFlfUkVDT1JEU19SRUFEEBQaFZqmHREKDXJlY29yZHM6cmVhZDoQARI9CiFNQU5JRkVTVF9DQVBBQklMSVRZX1JFQ09SRFNfV1JJVEUQFRoWmqYdEgoOcmVjb3Jkczp3cml0ZToQARI/CiJNQU5JRkVTVF9DQVBBQklMSVRZX1JFQ09SRFNfREVMRVRFEBYaF5qmHRMKD3JlY29yZHM6ZGVsZXRlOhABEkEKI01BTklGRVNUX0NBUEFCSUxJVFlfUkVDT1JEU19QVUJMSVNIEBcaGJqmHRQKEHJlY29yZHM6cHVibGlzaDoQARJFCiVNQU5JRkVTVF9DQVBBQklMSVRZX1JFQ09SRFNfQVRUUklCVVRFEBgaGpqmHRYKEnJlY29yZHM6YXR0cmlidXRlOhABOnUKE21hbmlmZXN0X2NhcGFiaWxpdHkSIS5nb29nbGUucHJvdG9idWYuRW51bVZhbHVlT3B0aW9ucxjj1AMgASgLMh8uYXBwcy52MS5NYW5pZmVzdENhcGFiaWxpdHlTcGVjUhJtYW5pZmVzdENhcGFiaWxpdHlCNVozZ2l0aHViLmNvbS9laWRlc3R1ZGlvL2ZvaXIvZ2VuL3Byb3RvL2FwcHMvdjE7YXBwc3YxYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_descriptor2, file_google_protobuf_struct]);
+var file_apps_v1_apps = /* @__PURE__ */ fileDesc2("ChJhcHBzL3YxL2FwcHMucHJvdG8SB2FwcHMudjEiyQUKCUFwcENvbmZpZxI0CgRuYW1lGAEgASgJQia6SCNyIRhAMh1eW2Etel1bYS16MC05XSooLVthLXowLTldKykqJBIYCgd2ZXJzaW9uGAIgASgJQge6SARyAhABEiMKCG1ldGFkYXRhGAMgASgLMhEuYXBwcy52MS5NZXRhZGF0YRInCgptaWRkbGV3YXJlGAQgASgLMhMuYXBwcy52MS5NaWRkbGV3YXJlEikKC2NyZWRlbnRpYWxzGAUgASgLMhQuYXBwcy52MS5DcmVkZW50aWFscxIwCg9zZXR0aW5nc19zY2hlbWEYBiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EjAKB3NvdXJjZXMYByADKAsyHy5hcHBzLnYxLkFwcENvbmZpZy5Tb3VyY2VzRW50cnkSLAoFc2lua3MYCCADKAsyHS5hcHBzLnYxLkFwcENvbmZpZy5TaW5rc0VudHJ5EiYKCm9wZXJhdGlvbnMYCSADKAsyEi5hcHBzLnYxLk9wZXJhdGlvbhIcCgVob29rcxgKIAMoCzINLmFwcHMudjEuSG9vaxIXCgJ1aRgLIAEoCzILLmFwcHMudjEuVUkSIQoHaW5ib3VuZBgMIAEoCzIQLmFwcHMudjEuSW5ib3VuZBIiCghmZWF0dXJlcxgNIAMoCzIQLmFwcHMudjEuRmVhdHVyZRIxChBjdXN0b21lcl9zaWduX2luGA4gASgLMhcuYXBwcy52MS5DdXN0b21lclNpZ25JbhpDCgxTb3VyY2VzRW50cnkSCwoDa2V5GAEgASgJEiIKBXZhbHVlGAIgASgLMhMuYXBwcy52MS5Tb3VyY2VUeXBlOgI4ARpDCgpTaW5rc0VudHJ5EgsKA2tleRgBIAEoCRIkCgV2YWx1ZRgCIAEoCzIVLmFwcHMudjEuU2lua0NvbnRyYWN0OgI4ASIlCg5DdXN0b21lclNpZ25JbhITCgtkZXNjcmlwdGlvbhgBIAEoCSKnAQoHRmVhdHVyZRIzCgNrZXkYASABKAlCJrpII3IhGEAyHV5bYS16XVthLXowLTldKigtW2EtejAtOV0rKSokEhYKBXRpdGxlGAIgASgJQge6SARyAhABEhMKC2Rlc2NyaXB0aW9uGAMgASgJEg8KB3NldHRpbmcYBCABKAkSDwoHc291cmNlcxgFIAMoCRIYChBjdXN0b21lcl9zaWduX2luGAYgASgIImUKCE1ldGFkYXRhEhQKDGRpc3BsYXlfbmFtZRgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRIMCgRpY29uGAMgASgJEg4KBmF1dGhvchgEIAEoCRIQCghob21lcGFnZRgFIAEoCSItCgpNaWRkbGV3YXJlEh8KA3VybBgBIAEoCUISukgPcg0yC15odHRwczovLy4rItcCCgtDcmVkZW50aWFscxIvCghzdHJhdGVneRgBIAEoDjIdLmFwcHMudjEuQ3JlZGVudGlhbHMuU3RyYXRlZ3kSLAoGc2NoZW1hGAIgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEgAiAEBEigKBW9hdXRoGAMgASgLMhQuYXBwcy52MS5PQXV0aENvbmZpZ0gBiAEBIqkBCghTdHJhdGVneRIYChRTVFJBVEVHWV9VTlNQRUNJRklFRBAAEhIKDlNUUkFURUdZX09BVVRIEAESFAoQU1RSQVRFR1lfQVBJX0tFWRACEhoKFlNUUkFURUdZX1NIQVJFRF9TRUNSRVQQAxIUChBTVFJBVEVHWV9TU0hfS0VZEAQSEQoNU1RSQVRFR1lfTk9ORRAFEhQKEFNUUkFURUdZX01BTkFHRUQQBkIJCgdfc2NoZW1hQggKBl9vYXV0aCJMCgtPQXV0aENvbmZpZxIcChRhdXRob3JpemVfc3RhcnRfcGF0aBgBIAEoCRIfChdhdXRob3JpemVfY2FsbGJhY2tfcGF0aBgCIAEoCSJWCgdJbmJvdW5kEiEKB3dlYmhvb2sYASABKAsyEC5hcHBzLnYxLldlYmhvb2sSKAoHYWNjb3VudBgCIAEoCzIXLmFwcHMudjEuQWNjb3VudFdlYmhvb2siFwoHV2ViaG9vaxIMCgRwYXRoGAEgASgJIj8KDkFjY291bnRXZWJob29rEgwKBHBhdGgYASABKAkSDwoHc2V0dGluZxgCIAEoCRIOCgZzb3VyY2UYAyABKAki3QIKClNvdXJjZVR5cGUSDQoFbGFiZWwYASABKAkSLwoGZmllbGRzGAIgAygLMh8uYXBwcy52MS5Tb3VyY2VUeXBlLkZpZWxkc0VudHJ5EhMKC25hdHVyYWxfa2V5GAMgASgJEhAKCG9wdGlvbmFsGAQgASgIEhYKDnByb3Zpc2lvbl9vbmx5GAUgASgIEisKCXJlZmVyZW5jZRgGIAEoCzIYLmFwcHMudjEuU291cmNlUmVmZXJlbmNlEiQKBW93bmVyGAcgASgOMhUuYXBwcy52MS5TdG9yYWdlT3duZXISEwoLcmVjb21tZW5kZWQYCCABKAgSDgoGbG9va3VwGAkgAygJEhAKCGlkZW50aXR5GAogASgJGkYKC0ZpZWxkc0VudHJ5EgsKA2tleRgBIAEoCRImCgV2YWx1ZRgCIAEoCzIXLmFwcHMudjEuU3VnZ2VzdGVkRmllbGQ6AjgBIqoCCg9Tb3VyY2VSZWZlcmVuY2USEQoJa2V5X2ZpZWxkGAEgASgJEjQKBmZpZWxkcxgCIAMoCzIkLmFwcHMudjEuU291cmNlUmVmZXJlbmNlLkZpZWxkc0VudHJ5EhAKCGVuZHBvaW50GAMgASgJEg0KBWhvc3RzGAQgAygJEioKB3JlcXVlc3QYBSABKAsyGS5hcHBzLnYxLlJlZmVyZW5jZVJlcXVlc3QSGgoScmVzcG9uc2VfdHJhbnNmb3JtGAYgASgJEh0KFWNhY2hlX21heF9hZ2Vfc2Vjb25kcxgHIAEoBRpGCgtGaWVsZHNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKAsyFy5hcHBzLnYxLlN1Z2dlc3RlZEZpZWxkOgI4ASKzAgoQUmVmZXJlbmNlUmVxdWVzdBIOCgZtZXRob2QYASABKAkSFQoNcGF0aF90ZW1wbGF0ZRgCIAEoCRIzCgVxdWVyeRgDIAMoCzIkLmFwcHMudjEuUmVmZXJlbmNlUmVxdWVzdC5RdWVyeUVudHJ5EjcKB2hlYWRlcnMYBCADKAsyJi5hcHBzLnYxLlJlZmVyZW5jZVJlcXVlc3QuSGVhZGVyc0VudHJ5EhUKDWJvZHlfdGVtcGxhdGUYBSABKAkSFQoNYmF0Y2hfY2FwYWJsZRgGIAEoCBosCgpRdWVyeUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEaLgoMSGVhZGVyc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiugEKDFNpbmtDb250cmFjdBINCgVsYWJlbBgBIAEoCRIxCgZmaWVsZHMYAiADKAsyIS5hcHBzLnYxLlNpbmtDb250cmFjdC5GaWVsZHNFbnRyeRITCgtuYXR1cmFsX2tleRgDIAEoCRIQCghvcHRpb25hbBgEIAEoCBpBCgtGaWVsZHNFbnRyeRILCgNrZXkYASABKAkSIQoFdmFsdWUYAiABKAsyEi5hcHBzLnYxLlNpbmtGaWVsZDoCOAEilgIKDlN1Z2dlc3RlZEZpZWxkEgwKBHR5cGUYASABKAkSEgoFbGFiZWwYAiABKAlIAIgBARIVCghyZXF1aXJlZBgDIAEoCEgBiAEBEiwKBmNvbmZpZxgEIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAogBARI9ChNzdXBwb3J0ZWRfZGlyZWN0aW9uGAUgASgOMhsuYXBwcy52MS5GaWVsZFN5bmNEaXJlY3Rpb25IA4gBARIWCglxdWVyeWFibGUYBiABKAhIBIgBAUIICgZfbGFiZWxCCwoJX3JlcXVpcmVkQgkKB19jb25maWdCFgoUX3N1cHBvcnRlZF9kaXJlY3Rpb25CDAoKX3F1ZXJ5YWJsZSJbCglTaW5rRmllbGQSDAoEdHlwZRgBIAEoCRIQCghzZW1hbnRpYxgCIAEoCRIQCghyZXF1aXJlZBgDIAEoCBISCgVsYWJlbBgEIAEoCUgAiAEBQggKBl9sYWJlbCKYBAoJT3BlcmF0aW9uEjoKA2tleRgBIAEoCUItukgqcigYQDIkXihfXyk/W2Etel1bYS16MC05X10qKC1bYS16MC05X10rKSokEgwKBG5hbWUYAiABKAkSGAoLZGVzY3JpcHRpb24YAyABKAlIAIgBARIdCghlbmRwb2ludBgEIAEoCUILukgIcgYyBF4vLioSFAoMY2FwYWJpbGl0aWVzGAUgAygJEhcKCnRpbWVvdXRfbXMYBiABKAVIAYgBARIyCgxyZXRyeV9wb2xpY3kYByABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SAKIAQESMgoMaW5wdXRfc2NoZW1hGAggASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEgDiAEBEjMKDW91dHB1dF9zY2hlbWEYCSABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SASIAQESGwoOc3VwcG9ydHNfYXN5bmMYCiABKAhIBYgBARIZChFydW5fYWZ0ZXJfaW5zdGFsbBgLIAEoCBIeChZydW5zX29uX21hcHBlZF9zb3VyY2VzGAwgASgIQg4KDF9kZXNjcmlwdGlvbkINCgtfdGltZW91dF9tc0IPCg1fcmV0cnlfcG9saWN5Qg8KDV9pbnB1dF9zY2hlbWFCEAoOX291dHB1dF9zY2hlbWFCEQoPX3N1cHBvcnRzX2FzeW5jIj0KFk1hbmlmZXN0Q2FwYWJpbGl0eVNwZWMSEAoIZGVjbGFyZXMYASABKAkSEQoJcGVyX21vZGVsGAIgASgIIqYBCgRIb29rEjMKA2tleRgBIAEoCUImukgjciEYQDIdXlthLXpdW2EtejAtOV0qKC1bYS16MC05XSspKiQSDAoEbmFtZRgCIAEoCRIWCgVldmVudBgDIAEoCUIHukgEcgIQARInCgZmaWx0ZXIYBCABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EhoKCW9wZXJhdGlvbhgFIAEoCUIHukgEcgIQASI3CgJVSRIxCgpwbGFjZW1lbnRzGAEgAygLMh0uYXBwcy52MS5QbGFjZW1lbnREZWNsYXJhdGlvbiK2BAoUUGxhY2VtZW50RGVjbGFyYXRpb24SMwoDa2V5GAEgASgJQia6SCNyIRhAMh1eW2Etel1bYS16MC05XSooLVthLXowLTldKykqJBI0CgZ0YXJnZXQYAiABKA4yJC5hcHBzLnYxLlBsYWNlbWVudERlY2xhcmF0aW9uLlRhcmdldBISCgVtb2RlbBgDIAEoCUgAiAEBEhIKBWZpZWxkGAQgASgJSAGIAQESIQoZZmllbGRfc2VsZWN0ZWRfYXRfaW5zdGFsbBgFIAEoCBIQCgN0YWIYBiABKAlIAogBARIWCgV0aXRsZRgHIAEoCUIHukgEcgIQARIfCgN1cmwYCCABKAlCErpID3INMgteaHR0cHM6Ly8uKxIdChByZXBsYWNlc19kZWZhdWx0GAkgASgISAOIAQESKwoFaGludHMYCiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SASIAQESDgoGc2NvcGVzGAsgAygJEhAKCHNldHRpbmdzGAwgAygJInQKBlRhcmdldBIWChJUQVJHRVRfVU5TUEVDSUZJRUQQABIUChBUQVJHRVRfRlVMTF9QQUdFEAESFgoSVEFSR0VUX01BSU5fRURJVE9SEAISEgoOVEFSR0VUX1NJREVCQVIQAxIQCgxUQVJHRVRfRklFTEQQBEIICgZfbW9kZWxCCAoGX2ZpZWxkQgYKBF90YWJCEwoRX3JlcGxhY2VzX2RlZmF1bHRCCAoGX2hpbnRzKqwBChJGaWVsZFN5bmNEaXJlY3Rpb24SJAogRklFTERfU1lOQ19ESVJFQ1RJT05fVU5TUEVDSUZJRUQQABIkCiBGSUVMRF9TWU5DX0RJUkVDVElPTl9TT1VSQ0VfT05MWRABEiIKHkZJRUxEX1NZTkNfRElSRUNUSU9OX1NJTktfT05MWRACEiYKIkZJRUxEX1NZTkNfRElSRUNUSU9OX0JJRElSRUNUSU9OQUwQAyqEAQoMU3RvcmFnZU93bmVyEh0KGVNUT1JBR0VfT1dORVJfVU5TUEVDSUZJRUQQABIZChVTVE9SQUdFX09XTkVSX1BST0pFQ1QQARIeChpTVE9SQUdFX09XTkVSX09SR0FOSVpBVElPThACEhoKFlNUT1JBR0VfT1dORVJfQ1VTVE9NRVIQAyqUCwoSTWFuaWZlc3RDYXBhYmlsaXR5EiMKH01BTklGRVNUX0NBUEFCSUxJVFlfVU5TUEVDSUZJRUQQABI2Ch9NQU5JRkVTVF9DQVBBQklMSVRZX0NPTkZJR19SRUFEEAEaEZqmHQ0KC2NvbmZpZzpyZWFkEkAKJE1BTklGRVNUX0NBUEFCSUxJVFlfU0VDUkVUU19SRUFEX0FQUBACGhaaph0SChBzZWNyZXRzOnJlYWQuYXBwEj4KI01BTklGRVNUX0NBUEFCSUxJVFlfU0VDUkVUU19QVVRfQVBQEAMaFZqmHREKD3NlY3JldHM6cHV0LmFwcBJACiRNQU5JRkVTVF9DQVBBQklMSVRZX1NFQ1JFVFNfTElTVF9BUFAQBBoWmqYdEgoQc2VjcmV0czpsaXN0LmFwcBJECiZNQU5JRkVTVF9DQVBBQklMSVRZX1NFQ1JFVFNfREVMRVRFX0FQUBAFGhiaph0UChJzZWNyZXRzOmRlbGV0ZS5hcHASOAogTUFOSUZFU1RfQ0FQQUJJTElUWV9TVEFUVVNfV1JJVEUQBhoSmqYdDgoMc3RhdHVzOndyaXRlEjQKHk1BTklGRVNUX0NBUEFCSUxJVFlfRklMRVNfUkVBRBAHGhCaph0MCgpmaWxlczpyZWFkEjQKHk1BTklGRVNUX0NBUEFCSUxJVFlfRklMRVNfTElTVBAIGhCaph0MCgpmaWxlczpsaXN0EjYKH01BTklGRVNUX0NBUEFCSUxJVFlfRklMRVNfV1JJVEUQCRoRmqYdDQoLZmlsZXM6d3JpdGUSPgojTUFOSUZFU1RfQ0FQQUJJTElUWV9DVVNUT01FUlNfV1JJVEUQChoVmqYdEQoPY3VzdG9tZXJzOndyaXRlEkYKJ01BTklGRVNUX0NBUEFCSUxJVFlfTk9USUZJQ0FUSU9OU19XUklURRALGhmaph0VChNub3RpZmljYXRpb25zOndyaXRlEkoKKU1BTklGRVNUX0NBUEFCSUxJVFlfTk9USUZJQ0FUSU9OU19DT05TRU5UEAwaG5qmHRcKFW5vdGlmaWNhdGlvbnM6Y29uc2VudBI8CiJNQU5JRkVTVF9DQVBBQklMSVRZX0NVU1RPTUVSU19SRUFEEA4aFJqmHRAKDmN1c3RvbWVyczpyZWFkEkgKKE1BTklGRVNUX0NBUEFCSUxJVFlfQ1VTVE9NRVJTX1JFQURfTkFNRUQQDxoamqYdFgoUY3VzdG9tZXJzOnJlYWQ6bmFtZWQSTgorTUFOSUZFU1RfQ0FQQUJJTElUWV9DVVNUT01FUlNfUkVBRF9JREVOVElUWRAQGh2aph0ZChdjdXN0b21lcnM6cmVhZDppZGVudGl0eRJGCidNQU5JRkVTVF9DQVBBQklMSVRZX09QRVJBVElPTlNfQ09NUExFVEUQDRoZmqYdFQoTb3BlcmF0aW9uczpjb21wbGV0ZRI7CiBNQU5JRkVTVF9DQVBBQklMSVRZX1JFQ09SRFNfUkVBRBAUGhWaph0RCg1yZWNvcmRzOnJlYWQ6EAESPQohTUFOSUZFU1RfQ0FQQUJJTElUWV9SRUNPUkRTX1dSSVRFEBUaFpqmHRIKDnJlY29yZHM6d3JpdGU6EAESPwoiTUFOSUZFU1RfQ0FQQUJJTElUWV9SRUNPUkRTX0RFTEVURRAWGheaph0TCg9yZWNvcmRzOmRlbGV0ZToQARJBCiNNQU5JRkVTVF9DQVBBQklMSVRZX1JFQ09SRFNfUFVCTElTSBAXGhiaph0UChByZWNvcmRzOnB1Ymxpc2g6EAESRQolTUFOSUZFU1RfQ0FQQUJJTElUWV9SRUNPUkRTX0FUVFJJQlVURRAYGhqaph0WChJyZWNvcmRzOmF0dHJpYnV0ZToQATp1ChNtYW5pZmVzdF9jYXBhYmlsaXR5EiEuZ29vZ2xlLnByb3RvYnVmLkVudW1WYWx1ZU9wdGlvbnMY49QDIAEoCzIfLmFwcHMudjEuTWFuaWZlc3RDYXBhYmlsaXR5U3BlY1ISbWFuaWZlc3RDYXBhYmlsaXR5QjVaM2dpdGh1Yi5jb20vZWlkZXN0dWRpby9mb2lyL2dlbi9wcm90by9hcHBzL3YxO2FwcHN2MWIGcHJvdG8z", [file_buf_validate_validate, file_google_protobuf_descriptor2, file_google_protobuf_struct]);
 var AppConfigSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 0);
-var FeatureSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 1);
-var MetadataSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 2);
-var MiddlewareSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 3);
-var CredentialsSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 4);
-var Credentials_StrategySchema = /* @__PURE__ */ enumDesc2(file_apps_v1_apps, 4, 0);
+var CustomerSignInSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 1);
+var FeatureSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 2);
+var MetadataSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 3);
+var MiddlewareSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 4);
+var CredentialsSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 5);
+var Credentials_StrategySchema = /* @__PURE__ */ enumDesc2(file_apps_v1_apps, 5, 0);
 var Credentials_Strategy = /* @__PURE__ */ tsEnum2(Credentials_StrategySchema);
-var OAuthConfigSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 5);
-var InboundSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 6);
-var WebhookSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 7);
-var AccountWebhookSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 8);
-var SourceTypeSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 9);
-var SourceReferenceSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 10);
-var ReferenceRequestSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 11);
-var SinkContractSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 12);
-var SuggestedFieldSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 13);
-var SinkFieldSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 14);
-var OperationSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 15);
-var ManifestCapabilitySpecSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 16);
-var HookSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 17);
-var UISchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 18);
-var PlacementDeclarationSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 19);
-var PlacementDeclaration_TargetSchema = /* @__PURE__ */ enumDesc2(file_apps_v1_apps, 19, 0);
+var OAuthConfigSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 6);
+var InboundSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 7);
+var WebhookSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 8);
+var AccountWebhookSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 9);
+var SourceTypeSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 10);
+var SourceReferenceSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 11);
+var ReferenceRequestSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 12);
+var SinkContractSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 13);
+var SuggestedFieldSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 14);
+var SinkFieldSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 15);
+var OperationSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 16);
+var ManifestCapabilitySpecSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 17);
+var HookSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 18);
+var UISchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 19);
+var PlacementDeclarationSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 20);
+var PlacementDeclaration_TargetSchema = /* @__PURE__ */ enumDesc2(file_apps_v1_apps, 20, 0);
 var PlacementDeclaration_Target = /* @__PURE__ */ tsEnum2(PlacementDeclaration_TargetSchema);
 var FieldSyncDirectionSchema = /* @__PURE__ */ enumDesc2(file_apps_v1_apps, 0);
 var FieldSyncDirection = /* @__PURE__ */ tsEnum2(FieldSyncDirectionSchema);
@@ -75,6 +76,7 @@ export {
   CredentialsSchema,
   Credentials_Strategy,
   Credentials_StrategySchema,
+  CustomerSignInSchema,
   DiscoveredAccountSchema,
   DiscoveredCountSchema,
   DiscoveredFieldGroupSchema,

package/dist/app.js

@@ -497,7 +497,7 @@ function createAppClient(config) {
           "integrationConfig",
           `query AppInstallConfig {
             integrationConfig {
-              name enabled middlewareUrl targetModels webhookUrl config customerEmailUnavailable
+              name enabled middlewareUrl targetModels webhookUrl config customerEmailUnavailable customerSignIn
               sources { key model naturalKey mode fields { appField modelField direction } }
               sinks { key model naturalKey fields { appField modelField direction } }
             }
@@ -514,7 +514,8 @@ function createAppClient(config) {
           settings: got.config ?? {},
           sources: bindingsOf(got.sources),
           sinks: bindingsOf(got.sinks),
-          customerEmailUnavailable: customerEmailUnavailableReasonOf(got.customerEmailUnavailable)
+          customerEmailUnavailable: customerEmailUnavailableReasonOf(got.customerEmailUnavailable),
+          customerSignIn: typeof got.customerSignIn === "string" && got.customerSignIn !== "" ? got.customerSignIn : null
         };
       },
       async credentials() {
@@ -732,16 +733,6 @@ function createAppClient(config) {
             customerDeleted: answer.customerDeleted === true,
             customerKeptBecause: answer.customerKeptBecause ?? null
           };
-        },
-        async identities(model, customerId) {
-          if (customerId === "") refuse(`a customer's identities on ${model} were asked for with no customer`);
-          const answer = await field(
-            "customerIdentitiesById",
-            `query AppCustomerIdentities($modelKey: String!, $customerId: ID!) { customerIdentitiesById(modelKey: $modelKey, customerId: $customerId) }`,
-            { modelKey: model, customerId }
-          );
-          if (!Array.isArray(answer)) return refuse(`customerIdentitiesById reported no error and returned no list on ${model}`);
-          return answer.filter((identity) => typeof identity === "string");
         }
       }
     },
@@ -776,6 +767,25 @@ function createAppClient(config) {
         );
         return customerOf(customer);
       },
+      async byIdentity(identity) {
+        if (identity === "") refuse("a customer was asked for with no identity");
+        const answer = await field(
+          "customerByIdentity",
+          `query AppCustomerByIdentity($identity: String!) { customerByIdentity(identity: $identity) }`,
+          { identity }
+        );
+        return typeof answer === "string" && answer !== "" ? answer : null;
+      },
+      async identities(customerId) {
+        if (customerId === "") refuse("a customer's identities were asked for with no customer");
+        const answer = await field(
+          "customerIdentitiesById",
+          `query AppCustomerIdentities($customerId: ID!) { customerIdentitiesById(customerId: $customerId) }`,
+          { customerId }
+        );
+        if (!Array.isArray(answer)) return refuse("customerIdentitiesById reported no error and returned no list");
+        return answer.filter((identity) => typeof identity === "string");
+      },
       async list(query = {}) {
         const search = query.search?.trim() ?? "";
         const page = await field(
@@ -825,9 +835,11 @@ function createAppClient(config) {
         if (sent !== true) refuse("sendNotification reported no error and did not say the notification was sent");
       },
       async setConsent(change) {
-        if (change.customerId === "" || change.category === "") refuse("a consent change needs a customer and a category");
+        const subject = consentSubject(change);
+        if (subject === null) return refuse("a consent change names its customer by customerId or by email, not both");
+        if (subject.value === "" || change.category === "") return refuse("a consent change needs a customer and a category");
         const input = {
-          customerId: change.customerId,
+          [subject.by]: subject.value,
           category: change.category,
           channel: change.channel,
           enabled: change.enabled
@@ -876,6 +888,12 @@ function createAppClient(config) {
     }
   };
 }
+function consentSubject(change) {
+  const loose = change;
+  if (loose.email !== void 0 && loose.customerId !== void 0) return null;
+  if (loose.email !== void 0) return { by: "email", value: loose.email.trim() };
+  return { by: "customerId", value: loose.customerId ?? "" };
+}
 function directionOf(raw) {
   const name = (raw ?? "").replace(/^FIELD_SYNC_DIRECTION_/, "");
   return name === "SOURCE_ONLY" || name === "BIDIRECTIONAL" ? name : "SINK_ONLY";
@@ -1137,6 +1155,7 @@ var APP_CAPABILITIES = [
   "notifications:consent",
   "customers:read",
   "customers:read:named",
+  "customers:read:identity",
   "operations:complete"
 ];
 var APP_RECORD_CAPABILITY_PREFIXES = [

package/dist/data/compatibility.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Whether the surface being served can still answer what a generated module
+ * prints.
+ *
+ * A generated module records the surface version it came from, and that version
+ * is a hash over everything `foir types` reads. So it moves when a model gains
+ * a field, when a namespace gains an op, and when the platform adds a mutation
+ * to every model at once. None of those changes a document this client prints:
+ * the document names the fields and arguments the module knew about, and the
+ * server still has every one of them. Treating a moved version as a reason to
+ * refuse calls made every deployed client stop working the moment the surface
+ * grew, with nothing in its own project having changed.
+ *
+ * So the two are kept apart. A moved version is DRIFT, and it is reported. A
+ * call is refused only for an INCOMPATIBILITY: something that call prints, or
+ * sends, that the server no longer serves the way the module describes. The
+ * client holds both sides of that question once the manifest has arrived, since
+ * the generated trees and the served manifest are the same shape, and this file
+ * compares them.
+ *
+ * ---------------------------------------------------------------------------
+ * What "the same" means
+ * ---------------------------------------------------------------------------
+ *
+ * What `document.ts` reads, because a property the printer never reads cannot
+ * change a document:
+ *
+ *   - an op: its root `field`, whether it is a `mutation`, its `args` and
+ *     `argTypes`, and its `payload` (`kind`, `model`, `union`, `fields`);
+ *   - a selection field: its `key`, and which of the printer's branches it
+ *     takes (a relation, a stopping point, a `model` reference, a `union`
+ *     reference, an object with `fields`, or a leaf);
+ *   - a relation an `include` resolves: `target`, `targets` and `connection`,
+ *     and one property the printer does not read, `list`, because it decides
+ *     whether the same document answers with one record or an array;
+ *   - a model's `typeName`, which names the fragment a polymorphic relation
+ *     prints for it;
+ *   - a union's members, by `typeName`, and each member's fields.
+ *
+ * `cost`, `nullable`, `deprecated` and the buckets the generator does not emit
+ * are not compared. `alias` is not compared either, and that one is a decision:
+ * an alias is a name this client gives a field in its OWN document, so the
+ * server never sees the manifest's opinion of it. A new union member whose
+ * field collides with an existing one makes the server publish aliases for
+ * both, and the module's document, which selects only the members it knew,
+ * is as valid as it was.
+ *
+ * The comparison runs one way. Everything the module names must still be
+ * served; whatever the server has added is never looked at, with one
+ * exception: an argument the served op REQUIRES and the module does not know,
+ * since a call that cannot supply it cannot succeed.
+ */
+import { type FoirSelectionSource } from './document';
+/** One thing the generated module describes that the server no longer serves that way. */
+export interface FoirIncompatibility {
+    /**
+     * Where it sits, in the manifest's own keys:
+     * `models.order.selection.status`, `models.order.ops.update`,
+     * `namespaces.search.ops.searchRecords.args.query`.
+     */
+    path: string;
+    /** What happened to it, as a clause a message can put in brackets. */
+    reason: string;
+}
+/** The comparison, held by a client for as long as it lives. */
+export interface FoirSurfaceComparison {
+    /** Every incompatible path, sorted. Empty when the surface has only grown. */
+    readonly incompatible: readonly string[];
+    /** What `foir.<model>.<op>()` depends on that is incompatible. */
+    modelCall(model: string, op: string, include: unknown): readonly FoirIncompatibility[];
+    /** What `foir.ns.<namespace>.<op>()` depends on that is incompatible. */
+    namespaceCall(namespace: string, op: string, include: unknown): readonly FoirIncompatibility[];
+}
+/**
+ * Compare a generated module's trees with the manifest being served.
+ *
+ * Called once, when the manifest arrives, and off the response path. What it
+ * returns answers each later call from maps built here, so a call pays for a
+ * lookup and, when it has an `include`, a walk of the relations it names.
+ *
+ * How far a break reaches is decided per call rather than per model. A call
+ * depends on its op, on every tree its result prints (the model's own, the
+ * unions inside it, and so on down), and on the relations THIS call includes
+ * with the trees of their targets. A model whose relation points at a broken
+ * model is not refused for it until a call includes that relation, because
+ * until then the broken tree is not in the document. Refusing on the whole
+ * relation graph would let one field removed from one model stop every call in
+ * a project whose models all reach each other, which is most projects.
+ *
+ * It is not narrowed by `pick` or `omit`. A call that omits the one field that
+ * is gone is still refused: resolving a caller's paths against two trees, with
+ * aliases and union members in play, is the printer's work done a second time,
+ * and regenerating is the remedy either way.
+ */
+export declare function compareFoirSurfaces(generated: FoirSelectionSource, served: FoirSelectionSource): FoirSurfaceComparison;

package/dist/data/document.d.ts

@@ -51,7 +51,7 @@
  * inferring a literal would reinstate the defect above under a condition no
  * caller can see.
  */
-import type { FoirManifestOp, FoirManifestRelation, FoirManifestSelection, FoirManifestSelectionField, FoirManifestSelectionUnion } from './manifest';
+import type { FoirManifestOp, FoirManifestOpPayload, FoirManifestRelation, FoirManifestSelection, FoirManifestSelectionField, FoirManifestSelectionUnion } from './manifest';
 /**
  * One model, as the printer needs it.
  *
@@ -145,6 +145,16 @@ export interface FoirRecordPath {
     /** Model key whose published `selection` is printed at that position. */
     modelKey: string;
 }
+/**
+ * Every record position in a payload, in the order the tree declares them.
+ *
+ * ONE walk, and everything that needs to know where the records are reads it:
+ * `planCall` takes the model SET from it to decide where `pick`/`omit`/`include`
+ * land, and the plan carries the positions so the transport's caller can find
+ * the records in the response. A second walk would be correct on the day it was
+ * written and wrong on the day the payload format grew a case.
+ */
+export declare function payloadRecordPaths(payload: FoirManifestOpPayload): readonly FoirRecordPath[];
 /** One printed operation, and what the transport needs to route it. */
 export interface FoirDocumentPlan {
     /** The document text. Also the thing that gets hashed for APQ. */

package/dist/data/transport.d.ts

@@ -419,19 +419,33 @@ export interface FoirKeyClientConfig<S extends FoirSchemaDefinition = FoirSchema
     /** Called instead of `console.warn` when drift is detected. */
     onSchemaDrift?: (drift: FoirSchemaDrift) => void;
     /**
-     * Refuse typed calls once drift is detected, instead of serving the stale
-     * shape. **On by default**; pass `false` to opt out.
-     *
-     * The asymmetry this closes: an unknown ARGUMENT is refused client-side
-     * before the server sees it, while a field the server has and the generated
-     * selection does not is simply not requested. The second is the common case
-     * when a schema evolves, and it surfaces as absent data rather than as a
-     * tooling problem — so it is the one that needs to be loud.
-     *
-     * It is the default rather than an opt-in because the thing it prevents is
-     * SILENT. An opt-in guard against a silent failure only protects the people
-     * who already suspected the failure existed, and the warning it replaces is
-     * one more line to scroll past.
+     * Refuse a typed call that depends on something the server no longer serves
+     * the way the generated module describes. **On by default**; pass `false` to
+     * opt out.
+     *
+     * A drift by itself refuses nothing. The surface version moves whenever the
+     * surface grows (a field on a model, an op on a namespace, a mutation the
+     * platform adds to every model), and a document printed from the older trees
+     * is still answered in full. So once the manifest has arrived the client
+     * compares its generated trees with the served ones, and refuses only the
+     * calls whose own parts changed:
+     *
+     *   - the op is gone, or its root field or result kind changed;
+     *   - an argument the module declares is gone or has a type the generated
+     *     one no longer fits, or the op now requires an argument the module does
+     *     not know;
+     *   - a field the call's selection names is gone or has another shape, in the
+     *     model the op returns, in a union that model's tree embeds, or in the
+     *     target of a relation the call includes.
+     *
+     * Anything ADDED refuses nothing: a model, a namespace, an op, an optional
+     * argument, a field, a relation, a union member, a subscription.
+     *
+     * It is the default because the alternative is worse for the caller. A call
+     * that depends on a removed field is answered with a server error naming the
+     * field, and one whose relation changed from a record to a list is answered
+     * in a shape the types do not describe. Neither says the generated module is
+     * the thing to fix. `FoirSchemaDriftError` does, and names the part.
      *
      * Two things it deliberately does not do.
      *
@@ -441,20 +455,16 @@ export interface FoirKeyClientConfig<S extends FoirSchemaDefinition = FoirSchema
      * block every first call on a second round trip, which is the cost the
      * warning was designed to avoid.
      *
-     * It does not touch `raw`. A hand-written document asks for exactly the
-     * fields it names, so it cannot silently omit one — raw is immune to this
-     * class of bug by construction, and refusing it would punish the escape
-     * hatch people reach for precisely because it is immune.
+     * It does not touch `raw`. A hand-written document is not printed from the
+     * generated trees, so nothing compared here says anything about it.
      *
-     * Turning it off is never the remedy for a drift. The version it compares
-     * is the SURFACE the types were generated from, which moves only when
-     * regenerating would write a different file, so every drift it reports is a
-     * real one and the fix is `foir types`. The opt-out exists for an app that
-     * knowingly ships a stale module for a while, and it says so at the call
-     * site, where a reader can see it:
+     * Turning it off is never the remedy. A refusal names something that really
+     * is no longer served as generated, and the fix is `foir types`. The opt-out
+     * exists for an app that would rather send the call and handle the server's
+     * answer, and it says so at the call site, where a reader can see it:
      *
      * ```ts
-     * createFoirClient({ strictSchemaDrift: false })  // serve stale, warn only
+     * createFoirClient({ strictSchemaDrift: false })  // never refuse, warn only
      * ```
      */
     strictSchemaDrift?: boolean;
@@ -578,9 +588,23 @@ export interface FoirSchemaDrift {
      * too. Empty only when the module was wired without `surfaceHashes`.
      */
     changed: readonly string[];
+    /**
+     * What the generated module describes that the server no longer serves that
+     * way, as paths into the manifest, sorted:
+     * `models.order.selection.status`, `models.order.ops.update`,
+     * `namespaces.search.ops.searchRecords.args.query`,
+     * `models.order.relations.customer`, `selectionUnions.Block.HeroBlock.title`.
+     *
+     * `changed` says what moved; this says what BROKE. Empty when the surface
+     * only grew, which is the usual drift, and then no typed call is refused.
+     * Also empty for a client that prints from the served manifest rather than
+     * from generated trees, since it has nothing older to compare.
+     */
+    incompatible: readonly string[];
 }
 /**
- * Thrown by a typed call under `strictSchemaDrift` once drift is detected.
+ * Thrown by a typed call under `strictSchemaDrift` when the call depends on
+ * something in `drift.incompatible`. The message names which.
  *
  * A subclass rather than a plain `FoirRequestError` so an app can tell "your
  * generated module is stale" from "this request failed", which want different

package/dist/data.js

@@ -1008,6 +1008,304 @@ function isFoirMutationDocument(documentText) {
   return /\bmutation\b/.test(documentText);
 }
 
+// src/data/compatibility.ts
+var newPart = () => ({ broken: [], prints: /* @__PURE__ */ new Set() });
+var GONE = "no longer served";
+function shapeOf(field) {
+  if (field.relation) return "a relation";
+  if (field.truncated) {
+    return field.union ? `a stopping point before the union ${field.union}` : "a stopping point";
+  }
+  if (field.model) return `the model ${field.model}`;
+  if (field.union) return `the union ${field.union}`;
+  return field.fields?.length ? "an object" : "a leaf";
+}
+function compareFields(generated, served, path, part) {
+  const byKey = new Map((served ?? []).map((field) => [field.key, field]));
+  for (const field of generated) {
+    if (field.relation) continue;
+    const at = `${path}.${field.key}`;
+    const now = byKey.get(field.key);
+    if (!now) {
+      part.broken.push({ path: at, reason: GONE });
+      continue;
+    }
+    const was = shapeOf(field);
+    const is = shapeOf(now);
+    if (field.truncated) {
+      const composite = !now.relation && is !== "a leaf";
+      if (!composite || field.union && now.union !== field.union) {
+        part.broken.push({ path: at, reason: `generated as ${was}, served as ${is}` });
+        continue;
+      }
+      if (field.union) part.prints.add(`u:${field.union}`);
+      continue;
+    }
+    if (was !== is) {
+      part.broken.push({ path: at, reason: `generated as ${was}, served as ${is}` });
+      continue;
+    }
+    if (field.model) part.prints.add(`m:${field.model}`);
+    else if (field.union) part.prints.add(`u:${field.union}`);
+    else if (field.fields?.length) compareFields(field.fields, now.fields, at, part);
+  }
+}
+function variableFits(variable, position) {
+  if (position.endsWith("!")) {
+    return variable.endsWith("!") && variableFits(variable.slice(0, -1), position.slice(0, -1));
+  }
+  if (variable.endsWith("!")) return variableFits(variable.slice(0, -1), position);
+  if (position.startsWith("[")) {
+    return variable.startsWith("[") && variableFits(variable.slice(1, -1), position.slice(1, -1));
+  }
+  return variable === position;
+}
+function compareOp(generated, served, at) {
+  const part = newPart();
+  if (!served) {
+    part.broken.push({ path: at, reason: GONE });
+    return part;
+  }
+  if (generated.field !== served.field) {
+    part.broken.push({
+      path: `${at}.field`,
+      reason: `root field ${generated.field}, served as ${served.field}`
+    });
+  }
+  if (Boolean(generated.mutation) !== Boolean(served.mutation)) {
+    part.broken.push({
+      path: `${at}.mutation`,
+      reason: served.mutation ? "now a mutation" : "no longer a mutation"
+    });
+  }
+  const declared = generated.args ?? [];
+  for (const name of declared) {
+    const type = generated.argTypes?.[name];
+    if (!type) continue;
+    if (!served.args?.includes(name)) {
+      part.broken.push({ path: `${at}.args.${name}`, reason: "no longer accepted" });
+      continue;
+    }
+    const now2 = served.argTypes?.[name];
+    if (!now2 || !variableFits(type, now2)) {
+      part.broken.push({
+        path: `${at}.args.${name}`,
+        reason: `type ${type}, served as ${now2 ?? "no published type"}`
+      });
+    }
+  }
+  for (const name of served.args ?? []) {
+    if (declared.includes(name)) continue;
+    if (served.argTypes?.[name]?.endsWith("!")) {
+      part.broken.push({ path: `${at}.args.${name}`, reason: "a new required argument" });
+    }
+  }
+  const payload = generated.payload;
+  if (!payload || payload.error) return part;
+  const now = served.payload;
+  if (!now || now.error) {
+    part.broken.push({ path: `${at}.payload`, reason: "no result shape is served" });
+    return part;
+  }
+  if (payload.kind !== now.kind) {
+    part.broken.push({
+      path: `${at}.payload`,
+      reason: `result kind ${payload.kind}, served as ${String(now.kind)}`
+    });
+    return part;
+  }
+  if (payload.kind === "record" && payload.model) {
+    if (payload.model !== now.model) {
+      part.broken.push({
+        path: `${at}.payload`,
+        reason: `returns the model ${payload.model}, served as ${now.model ?? "none"}`
+      });
+    } else {
+      part.prints.add(`m:${payload.model}`);
+    }
+  } else if (payload.kind === "union" && payload.union) {
+    if (payload.union !== now.union) {
+      part.broken.push({
+        path: `${at}.payload`,
+        reason: `returns the union ${payload.union}, served as ${now.union ?? "none"}`
+      });
+    } else {
+      part.prints.add(`u:${payload.union}`);
+    }
+  } else if (payload.kind === "object") {
+    compareFields(payload.fields ?? [], now.fields, `${at}.payload`, part);
+  }
+  return part;
+}
+function compareRelation(generated, served, at) {
+  if (!served) return { path: at, reason: GONE };
+  const targets = generated.targets ?? [];
+  const nowTargets = served.targets ?? [];
+  if (targets.length) {
+    const dropped = targets.filter((target) => !nowTargets.includes(target));
+    if (dropped.length) {
+      return { path: at, reason: `no longer targets ${dropped.join(", ")}` };
+    }
+  } else if (nowTargets.length || (generated.target ?? "") !== (served.target ?? "")) {
+    return {
+      path: at,
+      reason: `targets ${generated.target ?? "nothing"}, served as ${nowTargets.length ? nowTargets.join(" | ") : served.target ?? "nothing"}`
+    };
+  }
+  if (Boolean(generated.connection) !== Boolean(served.connection)) {
+    return {
+      path: at,
+      reason: served.connection ? "now a connection" : "no longer a connection"
+    };
+  }
+  if (Boolean(generated.list) !== Boolean(served.list)) {
+    return { path: at, reason: served.list ? "now a list" : "no longer a list" };
+  }
+  return void 0;
+}
+var NOTHING = [];
+function compareFoirSurfaces(generated, served) {
+  const servedModels = served.models ?? {};
+  const servedNamespaces = served.namespaces ?? {};
+  const servedUnions = served.selectionUnions ?? {};
+  const trees = /* @__PURE__ */ new Map();
+  const ops = /* @__PURE__ */ new Map();
+  const relations = /* @__PURE__ */ new Map();
+  for (const [key, model] of Object.entries(generated.models ?? {})) {
+    const at = `models.${key}`;
+    const now = servedModels[key];
+    const tree = newPart();
+    trees.set(`m:${key}`, tree);
+    if (!now) {
+      const gone = { path: at, reason: GONE };
+      tree.broken.push(gone);
+      for (const op of Object.keys(model.ops ?? {})) {
+        ops.set(`${at}.ops.${op}`, { broken: [gone], prints: /* @__PURE__ */ new Set() });
+      }
+      for (const relation of model.relations ?? []) {
+        relations.set(`${key} ${relation.key}`, gone);
+      }
+      continue;
+    }
+    if (model.typeName !== now.typeName) {
+      tree.broken.push({
+        path: `${at}.typeName`,
+        reason: `type ${model.typeName}, served as ${now.typeName}`
+      });
+    }
+    if (model.selection) {
+      if (!now.selection) tree.broken.push({ path: `${at}.selection`, reason: GONE });
+      else compareFields(model.selection.fields, now.selection.fields, `${at}.selection`, tree);
+    }
+    for (const [op, def] of Object.entries(model.ops ?? {})) {
+      ops.set(`${at}.ops.${op}`, compareOp(def, now.ops?.[op], `${at}.ops.${op}`));
+    }
+    for (const relation of model.relations ?? []) {
+      const broken = compareRelation(
+        relation,
+        now.relations?.find((r) => r.key === relation.key),
+        `${at}.relations.${relation.key}`
+      );
+      if (broken) relations.set(`${key} ${relation.key}`, broken);
+    }
+  }
+  for (const [name, namespace] of Object.entries(generated.namespaces ?? {})) {
+    const at = `namespaces.${name}`;
+    const now = servedNamespaces[name];
+    const gone = now ? void 0 : { path: at, reason: GONE };
+    for (const [op, def] of Object.entries(namespace.ops ?? {})) {
+      ops.set(
+        `${at}.ops.${op}`,
+        gone ? { broken: [gone], prints: /* @__PURE__ */ new Set() } : compareOp(def, now?.ops?.[op], `${at}.ops.${op}`)
+      );
+    }
+  }
+  for (const [name, union] of Object.entries(generated.selectionUnions ?? {})) {
+    const at = `selectionUnions.${name}`;
+    const now = servedUnions[name];
+    const tree = newPart();
+    trees.set(`u:${name}`, tree);
+    if (!now) {
+      tree.broken.push({ path: at, reason: GONE });
+      continue;
+    }
+    for (const member of union.members) {
+      const nowMember = now.members?.find((m) => m.typeName === member.typeName);
+      if (!nowMember) {
+        tree.broken.push({ path: `${at}.${member.typeName}`, reason: "no longer a member" });
+        continue;
+      }
+      compareFields(member.fields, nowMember.fields, `${at}.${member.typeName}`, tree);
+    }
+  }
+  const paths = /* @__PURE__ */ new Set();
+  for (const part of [...trees.values(), ...ops.values()]) {
+    for (const broken of part.broken) paths.add(broken.path);
+  }
+  for (const broken of relations.values()) paths.add(broken.path);
+  const incompatible = [...paths].sort();
+  const reached = /* @__PURE__ */ new Map();
+  const reach = (start) => {
+    const held = reached.get(start);
+    if (held) return held;
+    const out = [];
+    const seen = /* @__PURE__ */ new Set();
+    const pending = [start];
+    while (pending.length) {
+      const id = pending.pop();
+      if (seen.has(id)) continue;
+      seen.add(id);
+      const tree = trees.get(id);
+      if (!tree) continue;
+      out.push(...tree.broken);
+      pending.push(...tree.prints);
+    }
+    reached.set(start, out);
+    return out;
+  };
+  const included = (modelKey, include, out) => {
+    if (!include || typeof include !== "object") return;
+    const model = generated.models[modelKey];
+    if (!model) return;
+    for (const [key, value] of Object.entries(include)) {
+      if (value === void 0 || value === false) continue;
+      const relation = model.relations?.find((r) => r.key === key);
+      if (!relation) continue;
+      const broken = relations.get(`${modelKey} ${key}`);
+      if (broken) out.push(broken);
+      const nested = value && typeof value === "object" ? value["include"] : void 0;
+      const targets = relation.targets?.length ? relation.targets : [relation.target ?? ""];
+      for (const target of targets) {
+        out.push(...reach(`m:${target}`));
+        included(target, nested, out);
+      }
+    }
+  };
+  const call = (address, def, include) => {
+    if (incompatible.length === 0) return NOTHING;
+    const op = ops.get(address);
+    if (!op || !def) return NOTHING;
+    const out = [...op.broken];
+    for (const id of op.prints) out.push(...reach(id));
+    if (include && def.payload) {
+      const records = new Set(payloadRecordPaths(def.payload).map((entry) => entry.modelKey));
+      if (records.size === 1) included([...records][0], include, out);
+    }
+    if (out.length === 0) return NOTHING;
+    const unique = new Map(out.map((broken) => [broken.path, broken]));
+    return [...unique.values()].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  };
+  return {
+    incompatible,
+    modelCall: (model, op, include) => call(`models.${model}.ops.${op}`, generated.models[model]?.ops?.[op], include),
+    namespaceCall: (namespace, op, include) => call(
+      `namespaces.${namespace}.ops.${op}`,
+      generated.namespaces?.[namespace]?.ops?.[op],
+      include
+    )
+  };
+}
+
 // src/data/subscription-document.ts
 function printSubscriptionDocument(input) {
   const args = input.args ?? [];
@@ -1863,6 +2161,15 @@ function describeDrift(drift) {
   const moved = describeChanged(drift.changed);
   return `the types were generated from surface ${drift.generated}, and the server is serving ${drift.server} (${drift.channel}).` + (moved ? ` Changed since: ${moved}.` : "");
 }
+var NAMED_INCOMPATIBLE_PARTS = 5;
+function nameParts(parts) {
+  const named = parts.slice(0, NAMED_INCOMPATIBLE_PARTS).join(", ");
+  const rest = parts.length - NAMED_INCOMPATIBLE_PARTS;
+  return rest > 0 ? `${named} and ${rest} more` : named;
+}
+function describeIncompatible(parts) {
+  return nameParts(parts.map((part) => `${part.path} (${part.reason})`));
+}
 function announceFallback(config) {
   if (config.generated !== void 0 || config.selections !== void 0) return;
   if (config.announceManifestFallback === false) return;
@@ -1881,6 +2188,7 @@ function createFoirClient(clientConfig) {
   announceFallback(config);
   let driftChecked = false;
   let detectedDrift;
+  let servedComparison;
   let manifestOnce;
   const manifest = () => {
     if (!manifestOnce) {
@@ -1909,32 +2217,51 @@ function createFoirClient(clientConfig) {
     driftChecked = true;
     void manifest().then((served) => {
       if (!served.surfaceVersion || served.surfaceVersion === generated) return;
+      const comparison = config.selections ? compareFoirSurfaces(
+        {
+          models: config.selections,
+          namespaces: config.namespaceSelections,
+          selectionUnions: config.selectionUnions
+        },
+        served
+      ) : void 0;
       const drift = {
         generated,
         server: served.surfaceVersion,
         channel: served.channel,
-        changed: changedSurfaceParts(config.surfaceHashes, served.surfaceHashes)
+        changed: changedSurfaceParts(config.surfaceHashes, served.surfaceHashes),
+        incompatible: comparison?.incompatible ?? []
       };
       detectedDrift = drift;
+      servedComparison = comparison;
       if (config.onSchemaDrift) {
         config.onSchemaDrift(drift);
         return;
       }
+      if (drift.incompatible.length === 0) {
+        console.warn(
+          `[foir] schema drift: ${describeDrift(drift)} Everything the generated module describes is still served as generated, so every typed call keeps working. The surface has grown: re-run \`foir types\` to pick up what is new, because a field added since is not merely untyped, it is not requested.`
+        );
+        return;
+      }
+      const those = drift.incompatible.length === 1 ? "it" : "them";
       console.warn(
-        `[foir] schema drift: ${describeDrift(drift)} Re-run \`foir types\`: the selection trees this client prints from are the ones that surface published, so a new field is not merely untyped, it is not requested.`
+        `[foir] schema drift: ${describeDrift(drift)} No longer served as the generated module describes: ${nameParts(drift.incompatible)}. ` + (config.strictSchemaDrift === false ? `Typed calls that depend on ${those} are still sent, and can fail or answer in another shape. ` : `Typed calls that depend on ${those} are refused. `) + `Re-run \`foir types\`.`
       );
     }).catch(() => {
     });
   };
-  const assertNoStaleSelections = (what) => {
-    if (config.strictSchemaDrift === false || !detectedDrift) return;
+  const assertStillServed = (what, dependsOn) => {
+    if (config.strictSchemaDrift === false || !detectedDrift || !servedComparison) return;
+    const broken = dependsOn(servedComparison);
+    if (broken.length === 0) return;
     throw new FoirSchemaDriftError(
-      `[foir] refusing ${what}: ${describeDrift(detectedDrift)} The selection trees this client prints from are the ones that surface published, so a field added since is not requested at all. Re-run \`foir types\`.`,
+      `[foir] refusing ${what}: ${describeDrift(detectedDrift)} This call depends on ${describeIncompatible(broken)}, which the server no longer serves as the generated module describes. Re-run \`foir types\`.`,
       detectedDrift
     );
   };
   const runModel = async (model, op, query) => {
-    assertNoStaleSelections(`${model}.${op}`);
+    assertStillServed(`${model}.${op}`, (served) => served.modelCall(model, op, query?.include));
     const { args, include, omit, pick, depth } = splitQuery(query);
     const source = await selectionSource();
     const plan = planFoirModelCall(source, {
@@ -1952,7 +2279,10 @@ function createFoirClient(clientConfig) {
     return result;
   };
   const runNamespace = async (namespace, op, query) => {
-    assertNoStaleSelections(`ns.${namespace}.${op}`);
+    assertStillServed(
+      `ns.${namespace}.${op}`,
+      (served) => served.namespaceCall(namespace, op, query?.include)
+    );
     const { args, include, omit, pick, depth } = splitQuery(query);
     const plan = planFoirNamespaceCall(await selectionSource(), {
       namespace,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {