@foir/sdk 0.19.0 → 0.21.0

package/dist/app/contract/proto/apps/v1/apps_pb.d.ts

@@ -2,9 +2,8 @@
 // @generated from file apps/v1/apps.proto (package apps.v1, syntax proto3)
 /* eslint-disable */
 
-import type { GenEnum, GenExtension, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
 import type { JsonObject, Message } from "@bufbuild/protobuf";
-import type { EnumValueOptions } from "@bufbuild/protobuf/wkt";
 
 /**
  * Describes the file apps/v1/apps.proto.
@@ -234,6 +233,22 @@ export declare type Feature = Message<"apps.v1.Feature"> & {
    * @generated from field: bool customer_sign_in = 6;
    */
   customerSignIn: boolean;
+
+  /**
+   * The notification category the feature sends under, when it sends
+   * notifications. See FeatureNotificationCategory.
+   *
+   * @generated from field: apps.v1.FeatureNotificationCategory notification_category = 7;
+   */
+  notificationCategory?: FeatureNotificationCategory | undefined;
+
+  /**
+   * The notification category the feature keeps consent in, when it reads or
+   * writes what a customer chose. See FeatureConsentCategory.
+   *
+   * @generated from field: apps.v1.FeatureConsentCategory consent_category = 8;
+   */
+  consentCategory?: FeatureConsentCategory | undefined;
 };
 
 /**
@@ -242,6 +257,141 @@ export declare type Feature = Message<"apps.v1.Feature"> & {
  */
 export declare const FeatureSchema: GenMessage<Feature>;
 
+/**
+ * The notification category a feature sends under.
+ *
+ * A project that declares notification categories takes every notification
+ * under one of them, so that what a customer chose about a category is
+ * honoured. An app that sends has to be given one the project has, and nobody
+ * should have to type its key to do that. So the feature says which of the
+ * app's settings holds the key, and proposes the category it would send under.
+ * The setup offers the project's own categories and the proposed one, makes the
+ * proposed one where the operator chooses it, and writes the chosen key to the
+ * setting. The app reads the setting and names that key on every send.
+ *
+ * The platform holds the setting to that: while the feature is on at a running
+ * install it names a category the install's level is served, or, at a level
+ * served none, the proposed key, which is made a category of that level
+ * together with its first.
+ *
+ * @generated from message apps.v1.FeatureNotificationCategory
+ */
+export declare type FeatureNotificationCategory = Message<"apps.v1.FeatureNotificationCategory"> & {
+  /**
+   * REQUIRED. The string property of settings_schema that holds the key.
+   *
+   * @generated from field: string setting = 1;
+   */
+  setting: string;
+
+  /**
+   * REQUIRED. The key of the category the app proposes: what the category is
+   * called in the project's API. Letters, digits and underscores, starting
+   * with a letter.
+   *
+   * @generated from field: string key = 2;
+   */
+  key: string;
+
+  /**
+   * REQUIRED. What the category is called to an operator and to a customer.
+   *
+   * @generated from field: string name = 3;
+   */
+  name: string;
+
+  /**
+   * What a customer is choosing about, in a sentence.
+   *
+   * @generated from field: string description = 4;
+   */
+  description: string;
+
+  /**
+   * A customer has to opt in before anything is sent to them under the
+   * proposed category. Left unset it is sent until a customer opts out.
+   *
+   * @generated from field: bool opt_in = 5;
+   */
+  optIn: boolean;
+};
+
+/**
+ * Describes the message apps.v1.FeatureNotificationCategory.
+ * Use `create(FeatureNotificationCategorySchema)` to create a new message.
+ */
+export declare const FeatureNotificationCategorySchema: GenMessage<FeatureNotificationCategory>;
+
+/**
+ * The notification category a feature keeps consent in.
+ *
+ * A feature that carries what a customer chose about a category to or from
+ * another system sends nothing itself. It reads and writes consent on one
+ * channel, and consent is what a category records where a customer opts in on
+ * that channel: nothing is sent there until they say yes. So the feature has
+ * to be given a category the project has and a customer opts in to on its
+ * channel, and nobody should have to type its key to do that. The feature says
+ * which of the app's settings holds the key and which channel's consent it
+ * keeps, and proposes the category it would keep it in. The setup offers the
+ * project's own categories a customer opts in to on that channel and the
+ * proposed one, makes the proposed one where the operator chooses it, and
+ * writes the chosen key to the setting. The app reads the setting.
+ *
+ * The platform holds the setting to that: while the feature is on at a running
+ * install it names a category the install's level is served and a customer
+ * opts in to on the channel, or, at a level served no category, the proposed
+ * key, which is made a category of that level together with its first, one a
+ * customer opts in to on every channel.
+ *
+ * @generated from message apps.v1.FeatureConsentCategory
+ */
+export declare type FeatureConsentCategory = Message<"apps.v1.FeatureConsentCategory"> & {
+  /**
+   * REQUIRED. The string property of settings_schema that holds the key.
+   *
+   * @generated from field: string setting = 1;
+   */
+  setting: string;
+
+  /**
+   * REQUIRED. The key of the category the app proposes: what the category is
+   * called in the project's API. Letters, digits and underscores, starting
+   * with a letter. The proposed category is always one a customer opts in to,
+   * on every channel.
+   *
+   * @generated from field: string key = 2;
+   */
+  key: string;
+
+  /**
+   * REQUIRED. What the category is called to an operator and to a customer.
+   *
+   * @generated from field: string name = 3;
+   */
+  name: string;
+
+  /**
+   * What a customer is agreeing to, in a sentence.
+   *
+   * @generated from field: string description = 4;
+   */
+  description: string;
+
+  /**
+   * REQUIRED. The channel whose consent the feature keeps: email, push or
+   * in_app.
+   *
+   * @generated from field: string channel = 5;
+   */
+  channel: string;
+};
+
+/**
+ * Describes the message apps.v1.FeatureConsentCategory.
+ * Use `create(FeatureConsentCategorySchema)` to create a new message.
+ */
+export declare const FeatureConsentCategorySchema: GenMessage<FeatureConsentCategory>;
+
 /**
  * @generated from message apps.v1.Metadata
  */
@@ -325,6 +475,17 @@ export declare type Credentials = Message<"apps.v1.Credentials"> & {
    * @generated from field: optional apps.v1.OAuthConfig oauth = 3;
    */
   oauth?: OAuthConfig | undefined;
+
+  /**
+   * What the operator is told before they connect their account, in the app's
+   * own words: anything connecting changes that they would not otherwise
+   * know. The setup shows it beside the step that connects, and an install the
+   * vendor started shows it before the install is confirmed, because that
+   * install goes on to connect by itself. Empty when there is nothing to say.
+   *
+   * @generated from field: string connect_notice = 4;
+   */
+  connectNotice: string;
 };
 
 /**
@@ -952,8 +1113,9 @@ export declare type Operation = Message<"apps.v1.Operation"> & {
   /**
    * REQUIRED. Kebab-case, unique within the manifest. Keys starting with
    * `__` are platform-reserved (currently __uninstall, __validate_credentials).
-   * On install the platform prefixes the stored key as `<appName>/<key>`
-   * for namespace isolation across apps.
+   * On install the platform stores it as `<appName>.<key>`, for namespace
+   * isolation across apps; the key holds no ".", so the stored key is one
+   * URL-safe segment.
    *
    * @generated from field: string key = 1;
    */
@@ -977,16 +1139,35 @@ export declare type Operation = Message<"apps.v1.Operation"> & {
   endpoint: string;
 
   /**
-   * REQUIRED. Capability set the platform mints the scoped token with.
-   * Each string is one of ManifestCapability, as its option spells it; a
-   * per-model capability with no model (bare records:read) is rejected.
-   * Placeholders `$<sourceType>` / `$<sinkContract>` inside model-scoped
-   * capabilities are resolved to concrete model keys at ConfirmInstallApp.
+   * Not read from a manifest an app serves. An operation declares its
+   * `grants`, and a manifest that declares this is refused, naming them. The
+   * field is kept so that a manifest stored before an operation was written by
+   * its grants can still be decoded, where it is read as what each capability
+   * was worth, until each stored manifest is rewritten.
    *
    * @generated from field: repeated string capabilities = 5;
    */
   capabilities: string[];
 
+  /**
+   * REQUIRED. What the operation may do, as grants in the permission
+   * catalogue's names. The token the operation is called with carries them,
+   * and whoever installs the app is shown them and approves them.
+   *
+   * A manifest may declare the grants the platform lists for one, which is
+   * fewer than a project's own operation may: an app's own settings, secrets
+   * and status, files, the project's users, notifications, and records a
+   * model at a time. A record permission names its model
+   * (`records:read:<model>`) and one with no model is refused. A placeholder
+   * (`$<sourceType>` or `$<sinkContract>`) in a model's place is resolved to
+   * the model mapped there at ConfirmInstallApp. Changing a record takes its
+   * write, and making one takes its create: an operation that upserts
+   * declares both.
+   *
+   * @generated from field: repeated string grants = 13;
+   */
+  grants: string[];
+
   /**
    * @generated from field: optional int32 timeout_ms = 6;
    */
@@ -1013,12 +1194,15 @@ export declare type Operation = Message<"apps.v1.Operation"> & {
   supportsAsync?: boolean | undefined;
 
   /**
-   * When true, platform auto-enqueues this operation after a successful
-   * ConfirmInstallApp (and, for apps declaring __validate_credentials, after
-   * that gate passes). Multiple operations with run_after_install=true are
-   * dispatched in manifest declaration order. A failure here emits the
-   * app_event `post_install_op_failed` but does NOT roll back the install;
-   * the admin retries via the standard op-dispatch UI.
+   * When true, the platform enqueues this operation each time the install
+   * becomes ready to run: turned on, connected, and mapped for what the
+   * operation runs on (with runs_on_mapped_sources, at least one source). The
+   * moments are the install itself (once), a connection made or made again, a
+   * turn on, and a mapping save that maps what it runs on. An app renewing its
+   * own token is not a connection. Multiple operations with
+   * run_after_install=true are dispatched in manifest declaration order. A
+   * failure here emits the app_event `post_install_op_failed` but does NOT roll
+   * back what triggered it; the admin retries via the standard op-dispatch UI.
    *
    * @generated from field: bool run_after_install = 11;
    */
@@ -1026,16 +1210,16 @@ export declare type Operation = Message<"apps.v1.Operation"> & {
 
   /**
    * When true, the operation works on whichever of its sources and sinks the
-   * install maps. A capability naming one left unmapped (an optional source
+   * install maps. A grant naming one left unmapped (an optional source
    * the operator declined, or a source of a held install still being set up)
    * is left out of the resolved set, and the operation is kept.
    *
    * When false, the default, such an operation is dropped instead: it is not
    * created, and nothing dispatches it. That is the safe answer for an
-   * operation that would fail holding fewer capabilities than it declared.
+   * operation that would fail holding fewer grants than it declared.
    *
    * An operation that sets this cannot find its models by their position in
-   * its capability list, because an entry may be missing. It finds each one by
+   * its list of grants, because an entry may be missing. It finds each one by
    * its source or sink name in the install's mappings.
    *
    * @generated from field: bool runs_on_mapped_sources = 12;
@@ -1049,36 +1233,6 @@ export declare type Operation = Message<"apps.v1.Operation"> & {
  */
 export declare const OperationSchema: GenMessage<Operation>;
 
-/**
- * ManifestCapabilitySpec is how one ManifestCapability is written in a manifest.
- *
- * @generated from message apps.v1.ManifestCapabilitySpec
- */
-export declare type ManifestCapabilitySpec = Message<"apps.v1.ManifestCapabilitySpec"> & {
-  /**
-   * The capability as declared. When per_model is set it is the prefix a model
-   * follows, colon included: `records:read:` is declared as
-   * `records:read:<model>`, or with a `$<source>` or `$<sink>` placeholder the
-   * install resolves to the model mapped there.
-   *
-   * @generated from field: string declares = 1;
-   */
-  declares: string;
-
-  /**
-   * Declared once per model. Without its model the capability is refused.
-   *
-   * @generated from field: bool per_model = 2;
-   */
-  perModel: boolean;
-};
-
-/**
- * Describes the message apps.v1.ManifestCapabilitySpec.
- * Use `create(ManifestCapabilitySpecSchema)` to create a new message.
- */
-export declare const ManifestCapabilitySpecSchema: GenMessage<ManifestCapabilitySpec>;
-
 /**
  * @generated from message apps.v1.Hook
  */
@@ -1111,7 +1265,7 @@ export declare type Hook = Message<"apps.v1.Hook"> & {
 
   /**
    * REQUIRED. Operation key from the same manifest's operations list.
-   * Resolved to the namespaced form (<appName>/<key>) at install.
+   * Resolved to the stored form (<appName>.<key>) at install.
    *
    * @generated from field: string operation = 5;
    */
@@ -1227,14 +1381,9 @@ export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration
   hints?: JsonObject | undefined;
 
   /**
-   * What a TARGET_FULL_PAGE page asks to act with: API scopes such as
-   * "records:read:order". The console hands the page a short-lived token that
-   * acts as the operator looking at it, at the install's level, carrying the
-   * overlap of these scopes with what that operator holds there and never more.
-   * An operator standing beneath the install is given the reads only. The
-   * install preview lists them, so installing the app is agreeing to them.
-   * Refused on every other target: a record-bound placement is handed its
-   * record, not a credential.
+   * Not read from a manifest an app serves: a placement declares grants, and
+   * one that still declares scopes is refused by name. Kept so that a manifest
+   * stored before still decodes, where each is read as what it was worth.
    *
    * @generated from field: repeated string scopes = 11;
    */
@@ -1246,12 +1395,28 @@ export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration
    * alert goes out or a preorder's deposit. The setup owns what the app is
    * given, so a feature's switch (Feature.setting), the setting that names the
    * external account, credentials and mappings are never among them. Changing
-   * or reading one needs apps:write, which the placement declares in scopes
+   * or reading one needs apps:write, which the placement declares in grants
    * and the operator holds at the install's level, as in the setup.
    *
    * @generated from field: repeated string settings = 12;
    */
   settings: string[];
+
+  /**
+   * What a TARGET_FULL_PAGE page asks to act with, as grants in the permission
+   * catalogue's names, such as "records:read.all:order" for every order in
+   * the project. Each is one a console user can hold, and none is a wildcard:
+   * installing the app is agreeing to the list, and a wildcard would grow
+   * after that. The console hands the page a short-lived token that acts as
+   * the operator looking at it, at the install's level, carrying the overlap
+   * of these grants with what that operator holds and never more. An operator
+   * standing beneath the install is given the reads only. Refused on every
+   * other target: a record-bound placement is handed its record, not a
+   * credential.
+   *
+   * @generated from field: repeated string grants = 13;
+   */
+  grants: string[];
 };
 
 /**
@@ -1392,156 +1557,3 @@ export enum StorageOwner {
  */
 export declare const StorageOwnerSchema: GenEnum<StorageOwner>;
 
-/**
- * @generated from enum apps.v1.ManifestCapability
- */
-export enum ManifestCapability {
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_UNSPECIFIED = 0;
-   */
-  UNSPECIFIED = 0,
-
-  /**
-   * The install's own surface: its settings and mappings, its credential, and
-   * the status it reports.
-   *
-   * @generated from enum value: MANIFEST_CAPABILITY_CONFIG_READ = 1;
-   */
-  CONFIG_READ = 1,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_SECRETS_READ_APP = 2;
-   */
-  SECRETS_READ_APP = 2,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_SECRETS_PUT_APP = 3;
-   */
-  SECRETS_PUT_APP = 3,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_SECRETS_LIST_APP = 4;
-   */
-  SECRETS_LIST_APP = 4,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_SECRETS_DELETE_APP = 5;
-   */
-  SECRETS_DELETE_APP = 5,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_STATUS_WRITE = 6;
-   */
-  STATUS_WRITE = 6,
-
-  /**
-   * Files.
-   *
-   * @generated from enum value: MANIFEST_CAPABILITY_FILES_READ = 7;
-   */
-  FILES_READ = 7,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_FILES_LIST = 8;
-   */
-  FILES_LIST = 8,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_FILES_WRITE = 9;
-   */
-  FILES_WRITE = 9,
-
-  /**
-   * Customers: making the customers an operation attributes records to,
-   * telling them something, and setting a named customer's consent.
-   *
-   * @generated from enum value: MANIFEST_CAPABILITY_CUSTOMERS_WRITE = 10;
-   */
-  CUSTOMERS_WRITE = 10,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_NOTIFICATIONS_WRITE = 11;
-   */
-  NOTIFICATIONS_WRITE = 11,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_NOTIFICATIONS_CONSENT = 12;
-   */
-  NOTIFICATIONS_CONSENT = 12,
-
-  /**
-   * Reading customers at the install's level. customers:read:named is one
-   * customer the operation names, by id or by their exact email address, and
-   * never the list. customers:read is that and the list. An operation that
-   * declares the whole read holds the named one too.
-   *
-   * @generated from enum value: MANIFEST_CAPABILITY_CUSTOMERS_READ = 14;
-   */
-  CUSTOMERS_READ = 14,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_CUSTOMERS_READ_NAMED = 15;
-   */
-  CUSTOMERS_READ_NAMED = 15,
-
-  /**
-   * The link between a customer and who they are at the app's own system, and
-   * nothing else about them: the customer who holds an identity, and the
-   * identities a customer the operation names by id holds, both through the
-   * customer sign-in the install pairs with the app and no other. An operation
-   * that declares customers:read holds it too; customers:read:named does not
-   * reach it, nor it what that reaches.
-   *
-   * @generated from enum value: MANIFEST_CAPABILITY_CUSTOMERS_READ_IDENTITY = 16;
-   */
-  CUSTOMERS_READ_IDENTITY = 16,
-
-  /**
-   * Reporting an ASYNC run's outcome.
-   *
-   * @generated from enum value: MANIFEST_CAPABILITY_OPERATIONS_COMPLETE = 13;
-   */
-  OPERATIONS_COMPLETE = 13,
-
-  /**
-   * Records, per model. Delete and publish are their own capabilities: write
-   * implies neither. Attribute is naming the customer a record belongs to.
-   *
-   * @generated from enum value: MANIFEST_CAPABILITY_RECORDS_READ = 20;
-   */
-  RECORDS_READ = 20,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_RECORDS_WRITE = 21;
-   */
-  RECORDS_WRITE = 21,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_RECORDS_DELETE = 22;
-   */
-  RECORDS_DELETE = 22,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_RECORDS_PUBLISH = 23;
-   */
-  RECORDS_PUBLISH = 23,
-
-  /**
-   * @generated from enum value: MANIFEST_CAPABILITY_RECORDS_ATTRIBUTE = 24;
-   */
-  RECORDS_ATTRIBUTE = 24,
-}
-
-/**
- * Describes the enum apps.v1.ManifestCapability.
- */
-export declare const ManifestCapabilitySchema: GenEnum<ManifestCapability>;
-
-/**
- * 60003 is in the organisation-internal extension range, beside the intent
- * option's 60001 and the config destination's 60002.
- *
- * @generated from extension: apps.v1.ManifestCapabilitySpec manifest_capability = 60003;
- */
-export declare const manifest_capability: GenExtension<EnumValueOptions, ManifestCapabilitySpec>;
-

package/dist/app/errors.d.ts

@@ -3,7 +3,7 @@
  *
  * Every call an app client makes fails with the package's one error,
  * `FoirRequestError`, carrying the platform's own answer. Nothing is checked
- * before the call: the token's capabilities are the platform's to hold it to,
+ * before the call: the token's grants are the platform's to hold it to,
  * and its refusal names the reason. The readers here pick out the refusals an
  * app acts on rather than reports, as data and never by the wording of a
  * message.
@@ -56,7 +56,7 @@ export declare function appCustomerEmailUnavailableOf(error: unknown): {
 } | null;
 /**
  * Whether a read failed because the token is not served the field it asked
- * for: the field is not on the schema this token's capabilities reach. That is
+ * for: the field is not on the schema this token's grants reach. That is
  * the platform's refusal of a read, as data: the selection it stripped.
  *
  * `field` narrows it to one root field. The platform names a stripped

package/dist/app/index.d.ts

@@ -16,12 +16,12 @@
  *   readCredentialProbe    and of the credential probe.
  *   redeemExchangeTicket   the token an OAuth callback writes a credential with.
  *   validateAppManifest    ask the platform whether it would accept a manifest.
- *   APP_CAPABILITIES…      the capabilities and hook events the contract lists.
+ *   APP_GRANTS…            the grants a manifest may declare, and the hook events.
  *
  * The manifest's own messages are on `@foir/sdk/app/contract`.
  */
 export { createAppClient } from './client';
-export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppCustomer, AppCustomerEraseResult, AppCustomerList, AppCustomerSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
+export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppCustomer, AppCustomerEraseResult, AppCustomerList, AppCustomerSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
 export { appCustomerEmailUnavailableOf, appCustomerUnlinkedOf, appLookupConflictOf, isAppFieldWithheld } from './errors';
 export type { AppCustomerEmailUnavailableReason, AppLookupConflict } from './errors';
 export { appModelFieldName, appModelTypeName, appSelectorEnumValue } from './naming';
@@ -32,8 +32,8 @@ export { redeemExchangeTicket } from './ticket';
 export type { RedeemedExchangeTicket } from './ticket';
 export { validateAppManifest, MAX_APP_MANIFEST_BYTES } from './manifest';
 export type { AppManifestIssue, AppManifestValidation, ValidateAppManifestOptions } from './manifest';
-export { APP_CAPABILITIES, APP_HOOK_EVENTS, APP_RECORD_CAPABILITY_PREFIXES } from './vocabulary.generated';
-export type { AppCapability, AppHookEvent, AppRecordCapabilityPrefix } from './vocabulary.generated';
+export { APP_GRANTS, APP_HOOK_EVENTS, APP_RECORD_GRANT_PREFIXES } from './vocabulary.generated';
+export type { AppGrant, AppHookEvent, AppRecordGrantPrefix } from './vocabulary.generated';
 export type { FoirDispatchCredential } from '../data/transport';
 export { FoirRequestError } from '../transport/foir-http';
 export type { FoirErrorCode, FoirErrorExtensions, FoirGraphQLErrorItem, FoirPrunedSelection } from '../transport/foir-http';

package/dist/app/manifest.d.ts

@@ -2,7 +2,7 @@
  * Ask the platform whether it would accept an app's manifest.
  *
  * A manifest is held to rules only the platform knows in full: which
- * capabilities exist, which events a hook may name, how a feature's storage
+ * grants an operation may declare, which events a hook may name, how a feature's storage
  * may be declared, what an install would refuse. Copying those rules into an
  * app's build means the copy and the platform disagree the first time either
  * changes. So the build asks instead. `validateAppManifest` sends the manifest

package/dist/app/vocabulary.generated.d.ts

@@ -3,18 +3,21 @@
  * manifest's hook may subscribe to (an event of the project, that something
  * emits) is the platform's to say: `validateAppManifest` answers it.
  */
-export declare const APP_HOOK_EVENTS: readonly ["RECORD_CREATED", "RECORD_UPDATED", "RECORD_DELETED", "RECORD_PUBLISHED", "RECORD_UNPUBLISHED", "CUSTOMER_CREATED", "CUSTOMER_UPDATED", "CUSTOMER_DELETED", "CUSTOMER_MERGED", "SESSION_REVOKED", "OPERATION_COMPLETED", "OPERATION_FAILED", "OPERATION_CANCELLED", "OPERATION_TIMED_OUT", "ADMIN_MEMBERSHIP_GRANTED", "ADMIN_MEMBERSHIP_REVOKED", "ADMIN_ROLE_CHANGED", "TENANT_PLAN_CHANGED", "TENANT_SUBSCRIPTION_STATUS_CHANGED", "PROJECT_CREATED", "PROJECT_ARCHIVED", "INVITATION_ACCEPTED", "IMPORT_COMPLETED", "MIGRATION_APPLIED", "BULK_UPDATE_COMPLETED", "BULK_PUBLISH_COMPLETED", "CUSTOMER_PREFERENCE_CHANGED", "ORGANIZATION_CREATED", "ORGANIZATION_UPDATED", "ORGANIZATION_MOVED", "ORGANIZATION_SUSPENDED", "ORGANIZATION_RESUMED", "ORGANIZATION_DELETION_SCHEDULED", "ORGANIZATION_DELETION_CANCELLED", "ORGANIZATION_DELETED", "ORGANIZATION_MEMBER_ADDED", "ORGANIZATION_MEMBER_REMOVED", "ORGANIZATION_MEMBER_ROLE_CHANGED"];
+export declare const APP_HOOK_EVENTS: readonly ["RECORD_CREATED", "RECORD_UPDATED", "RECORD_DELETED", "RECORD_PUBLISHED", "RECORD_UNPUBLISHED", "CUSTOMER_CREATED", "CUSTOMER_UPDATED", "CUSTOMER_DELETED", "CUSTOMER_MERGED", "SESSION_REVOKED", "OPERATION_COMPLETED", "OPERATION_FAILED", "OPERATION_CANCELLED", "OPERATION_TIMED_OUT", "ADMIN_MEMBERSHIP_GRANTED", "ADMIN_MEMBERSHIP_REVOKED", "ADMIN_ROLE_CHANGED", "TENANT_PLAN_CHANGED", "TENANT_SUBSCRIPTION_STATUS_CHANGED", "PROJECT_CREATED", "PROJECT_ARCHIVED", "INVITATION_ACCEPTED", "IMPORT_COMPLETED", "MIGRATION_APPLIED", "BULK_UPDATE_COMPLETED", "BULK_PUBLISH_COMPLETED", "CUSTOMER_PREFERENCE_CHANGED", "ORGANIZATION_CREATED", "ORGANIZATION_UPDATED", "ORGANIZATION_MOVED", "ORGANIZATION_SUSPENDED", "ORGANIZATION_RESUMED", "ORGANIZATION_DELETION_SCHEDULED", "ORGANIZATION_DELETION_CANCELLED", "ORGANIZATION_DELETED", "ORGANIZATION_MEMBER_ADDED", "ORGANIZATION_MEMBER_REMOVED", "ORGANIZATION_MEMBER_ROLE_CHANGED", "PROJECT_REACTIVATED"];
 /** An event a hook can name. */
 export type AppHookEvent = (typeof APP_HOOK_EVENTS)[number];
-/** The capabilities an operation declares as written. */
-export declare const APP_CAPABILITIES: readonly ["config:read", "secrets:read.app", "secrets:put.app", "secrets:list.app", "secrets:delete.app", "status:write", "files:read", "files:list", "files:write", "customers:write", "notifications:write", "notifications:consent", "customers:read", "customers:read:named", "customers:read:identity", "operations:complete"];
-/** A capability an operation declares as written. */
-export type AppCapability = (typeof APP_CAPABILITIES)[number];
 /**
- * The capabilities an operation declares once per model. Each is a prefix: a
- * model key follows it, or `$<name>` for the model an install maps one of the
+ * The grants an operation declares as written, in the permission catalogue's
+ * names.
+ */
+export declare const APP_GRANTS: readonly ["appconfig:read", "appsecrets:delete", "appsecrets:list", "appsecrets:put", "appsecrets:read", "files:delete", "files:delete.all", "files:read", "files:read.all", "files:write", "files:write.all", "identities:delete", "identities:read", "notifications:consent", "notifications:read", "notifications:write.named", "operations:complete", "organizations:create", "organizations:delete", "status:write", "users:create", "users:read.all", "users:read.named"];
+/** A grant an operation declares as written. */
+export type AppGrant = (typeof APP_GRANTS)[number];
+/**
+ * The grants an operation declares once per model. Each is a prefix: a model
+ * key follows it, or `$<name>` for the model an install maps one of the
  * app's sources or sinks onto.
  */
-export declare const APP_RECORD_CAPABILITY_PREFIXES: readonly ["records:read:", "records:write:", "records:delete:", "records:publish:", "records:attribute:"];
-/** A per-model capability's prefix. */
-export type AppRecordCapabilityPrefix = (typeof APP_RECORD_CAPABILITY_PREFIXES)[number];
+export declare const APP_RECORD_GRANT_PREFIXES: readonly ["records:attribute:", "records:create:", "records:delete.all:", "records:delete:", "records:publish.all:", "records:publish:", "records:read.all:", "records:read:", "records:write.all:", "records:write:"];
+/** A per-model grant's prefix. */
+export type AppRecordGrantPrefix = (typeof APP_RECORD_GRANT_PREFIXES)[number];