@foir/sdk 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -108,6 +108,89 @@ nobody asking for `@foir/sdk` gets it early. The push that carries the commit to
 
 Changes on `dev` that have not been published to npm.
 
+## [0.22.0] — 2026-10-15
+
+### Added
+
+- **A signed-in user manages their own account** (`@foir/sdk/auth`), in any
+  pool. `updateMyProfile` changes their name, picture or language and asks no
+  permission. `mySessions`, `endMySession` and `signOutEverywhere` list and end
+  their sessions. `createPersonalAccessToken` makes a token that begins
+  `foir_pat_`, answered once (`NewPersonalAccessToken`). `mySignInMethods`, `connectSignInMethod` and
+  `disconnectSignInMethod` list, add and remove the ways they sign in.
+  `myAuthorizedApps` and `revokeAuthorizedApp` list the apps they have let in
+  and take one back. New types: `MyProfile`, `MyProfileChange`, `MySession`,
+  `MySignInMethod`, `AuthorizedApp`.
+- **Second factors and recovery codes** (`@foir/sdk/auth`). `myFactors` lists
+  what a user holds. `beginStepUp` and `completeStepUp` prove a factor and
+  answer an elevated handle for one change in the next ten minutes, which
+  `beginFactorEnrollment`, `completeFactorEnrollment`, `removeFactor` and
+  `makeRecoveryCodes` take. A factor is `totp`, `webauthn` or `passkey`. New
+  types: `MyFactor`, `FactorEnrollment`, `StepUp`.
+- **An organisation that signs its own people in** (`@foir/sdk/app`).
+  `organizations.provision({ ..., ownPool: true })` starts a pool of its own
+  with the organisation, apart from its parent's and the project's; its
+  descendants share it unless one starts another.
+- All of the above need the platform release that serves them.
+
+### Changed
+
+- **Breaking: everyone who signs in is a user, and nothing says customer or
+  admin as a kind.** It needs the platform release that serves the same
+  names; an earlier platform refuses every call below by name.
+  - `@foir/sdk/auth`: the raw calls take the server's op names: `login`,
+    `register`, `requestOTP`, `loginWithOTP`, `refreshTokens` (the
+    `refreshToken` op), `logout`, `joinWaitlist`, `signupContext`,
+    `requestPasswordReset`, `resetPassword`, `updatePassword`, `verifyEmail`,
+    `loginWithProvider`, `providerCallback`, `providerVerifyOTP` (were
+    `customerLogin` and the rest), and `registerOrganization` founds an
+    organization over the `registerOrganization` op (was
+    `registerOperatorOrganization`). The helpers that save a session are
+    `signInWithPassword`, `signUpWithPassword` and `signInWithOTP` (were
+    `loginWithPassword`, `registerWithPassword`, `loginWithOTP`), beside
+    `signOut`. `getSessionCustomer` is `getSessionUser`, `customerAccess` is
+    `userAccess`, `CustomerAuthResult` is `AuthResult` and carries `userId`,
+    `FoirCustomer` is `FoirUser` (`{ id, email }`), and `FoirAccess.customerId`
+    is `userId`. A session is stored under `foir:userId`, so one saved by an
+    earlier version reads as signed out once.
+  - `@foir/sdk/auth`: a provider sign-in that names an address somebody
+    already holds waits for the code sent to it: `providerSignInRefusalOf`
+    reads the refusal (`link_code_sent` with its `pending`), and
+    `confirmProviderLink` and `resendProviderLinkCode` finish it.
+  - `@foir/sdk/auth`: the hosted session answers `userId`
+    (`HostedSession.userId`, `FoirSessionUser.userId`), from the platform's
+    `user_id`, and its cookie is `foir_session`.
+  - `@foir/sdk/react`: `useFoirSession()` answers `user` (was `customer`).
+  - `@foir/sdk/app`: `records.user` and `users` (were `records.customer` and
+    `customers`), over the platform's `saveUserRecord`, `userRecordByIdentity`,
+    `eraseUserRecord`, `createUser`, `user`, `users`, `userByIdentity` and
+    `userIdentitiesById`. `users.list()` answers `{ users }`. `AppUser`,
+    `AppUserList`, `AppUserSaveResult` (`userCreated`), `AppUserEraseResult`
+    (`userDeleted`, `userKeptBecause`), `AppUserEmailUnavailableReason`,
+    `appUserUnlinkedOf` and `appUserEmailUnavailableOf` replace the
+    `AppCustomer` names. A notification, a consent change and an
+    organization's first member name `userId`.
+  - `@foir/sdk/server`: an operation's context names who started the run as
+    `actorId` and the user it acts for as `userId` (was `userId` and
+    `customerId`). `ScopedTokenIngress.userId` was `customerId`.
+  - `@foir/sdk/data`: `FoirGranteeKind` is `'USER'`, a note's subject may be
+    `'user'`, `FoirUserNote` and `FoirUserNoteAttachment` replace the
+    `FoirCustomerNote` names, and `FoirAuthDowngrade.userToken` was
+    `customerToken`.
+
+### Removed
+
+- **Breaking: `selectOrganization` and `SelectedOrganization`**
+  (`@foir/sdk/auth`). Nothing stores where a user stands: a request names the
+  organization it acts in (`orgId` or `orgUrl`), and the platform checks they
+  stand there on that request. `myOrganizations` still lists where they may.
+- **Breaking: `requireAdmin` and `RequireAdminOptions`, and `isAdmin` on
+  `FoirUser`** (`@foir/sdk/auth`). What a user may do is a role or a scope:
+  guard on it with `requireRole` or `requireScope`. `requireAuth` takes the
+  type `resolveUser` answers, for a project that reads its own profile.
+
+## [0.21.0] — 2026-10-13
+
 ### Added
 
 - **An operation provisions an organization** (`@foir/sdk/app`).
@@ -131,14 +214,65 @@ Changes on `dev` that have not been published to npm.
   release that carries `writeNote`. `foir.ns.notes` answers any field the
   platform serves, so the call itself needs no new SDK.
 
+- **A server says where its visitor is** (`@foir/sdk/data`). `visitor` takes
+  an object as well as an address: `{ address, country, latitude, longitude }`,
+  or a function that yields one for each request. The address is sent as
+  `X-Foir-Visitor-IP`, as before. The country and the coordinates are attached
+  to every read, in its `contexts`, so location targeting is decided by where
+  the visitor is and not by where your server is. Coordinates are sent at two
+  decimal places, and latitude and longitude go together or not at all. The
+  visitor is resolved once for a request, so the header and the read name the
+  same one. A string is still the address alone. New type: `FoirVisitor`, and
+  `country` and `location` on `FoirResolveContext`. It needs a key holding
+  `visitors:forward`, and the platform release that takes `contexts.country`
+  and `contexts.location`: an earlier platform refuses a read that names them.
+
 ### Changed
 
+- **Breaking: an app client refuses an admin key** (`@foir/sdk/data`).
+  `createFoirClient` given a key that begins `foir_adm_` throws before any
+  request. An admin key is a machine's own: nobody signs in through it, and an
+  app never holds one. Build the client from a publishable key, or from a
+  server key on the server that renders your pages. A machine that acts for
+  itself uses `createServerClient` from `@foir/sdk/server`. A key minted
+  before a key had a kind (`sk_`) is not refused here.
+- **A key's kind is read from its prefix in one place.** A key is publishable
+  (`foir_pub_`), server (`foir_srv_`) or admin (`foir_adm_`), and a key minted
+  earlier is `pk_`, `sk_` or `tc_`. Only a publishable key, in either format,
+  is named in a URL and takes the shared cache lane. Earlier versions looked
+  for the letters `pk_` alone, so a `foir_pub_` key was sent to the origin and
+  missed the shared cache.
+- **`visitor` takes a server key** (`@foir/sdk/data`). A client that names the
+  visitor it calls for is built from a server key (`foir_srv_`), or from a
+  secret key minted before a key had a kind. Earlier versions looked for the
+  letters `sk_` alone and refused a server key. A publishable key is still
+  refused `visitor`, in either format.
+- **The events client takes an admin key** (`@foir/sdk/server`).
+  `createEventsClient` refuses a publishable key and a server key by name, and
+  takes an admin key (`foir_adm_`) or a secret key minted earlier.
 - **`FOIR_EVENTS_SCOPE` is `events:read`** (`@foir/sdk/server`). It was
   `events:list.project`, the name the event log's permission had when a key
   was written with scopes. A key is made with the permission catalogue's
   names, where it is `events:read`, and that is what a refusal names. A key
   minted under the older name holds `events:read` and needs no change.
 
+### Removed
+
+- **Breaking: `ScopedTokenClaims` has no `cap`, `rrm` or `rwm`**
+  (`@foir/sdk/server`). The platform no longer writes the claims a token
+  carried before it said its grants. Read `grants`, or `recordsReadModels`,
+  `recordsWriteModels` and `recordsCreateModels`.
+- **Breaking: `PlacementGrant` has no `grantedScopes` or `withheld`**
+  (`@foir/sdk/placement`). A console sends what a page's token carries as
+  `grants` and what it was refused as `withheldGrants`, and no longer sends
+  the same two lists under their older names. Read `session.grant.grants`, or
+  ask `session.can`.
+- **Breaking: `verifyScopedToken` refuses a token that does not say its
+  grants** (`@foir/sdk/server`), with `the token says no grants`, as the
+  platform refuses it. It used to read such a token as what its older claims
+  were worth. `requireScopedToken` answers it 401 like any token that does not
+  verify.
+
 ### Deprecated
 
 - **`FoirCreateMyNoteArgs`, `FoirSubmitAnonymousNoteArgs` and
@@ -1074,7 +1208,7 @@ returns a result object rather than `HostedSession | null`, and
   silent wrong answer for a thrown one that discards the answer. Nothing changes
   for a caller that does not pass it.
 
-- `registerOrganization(env, { key, name }, { bearerToken })` on `@foir/sdk/auth`: a customer founds an organization of their own and becomes its first member, holding the role the project's `operatorSignupRole` setting names. Returns the same `MyOrganization` entry `myOrganizations` lists. Present on the wire only while the project's `operatorSignupEnabled` setting is on.
+- `registerOrganization(env, { key, name }, { bearerToken })` on `@foir/sdk/auth`: a customer founds an organization of their own and becomes its first member, holding the role the project's `organizationSignupRole` setting names. Returns the same `MyOrganization` entry `myOrganizations` lists. Present on the wire only while the project's `organizationSignupEnabled` setting is on.
 - **The operator's organization context, on `@foir/sdk/auth`** — `myOrganizations`
   and `selectOrganization`, plus the types `MyOrganization` and
   `SelectedOrganization`, and two entries on `AUTH_OPS`.

package/README.md

@@ -1,6 +1,6 @@
 # @foir/sdk
 
-Official Foir SDK — client-agnostic typed GraphQL transport, customer auth,
+Official Foir SDK — client-agnostic typed GraphQL transport, sign-in for your app's users,
 progressive media, content rendering, realtime collaboration, and editor/server
 helpers for building apps on the [Foir](https://foir.dev) platform.
 
@@ -25,7 +25,7 @@ pnpm add yjs y-websocket    # for @foir/sdk/realtime
 | `@foir/sdk` | Editor iframe client — `EditorProvider`, `useEditor`, `useAutoResize`, `createPlatformClient`, host↔editor message protocol | `react` |
 | `@foir/sdk/client` | Client-agnostic GraphQL transport for SSR/edge loaders — `foirRequest`, `isFoirPreview`, `absolutiseFoirMediaUrl` | `graphql` |
 | `@foir/sdk/data` | Typed data client over `/graphql` — `createFoirClient`, per-key-shaped ops, `include`/`omit`, `fetchFoirManifest`; prints the document for you, so still no `graphql` | **none** |
-| `@foir/sdk/auth` | Framework-agnostic customer auth — login/register/OTP/provider flows, token lifecycle (`SessionAdapter`), `createFoirSessionClient` (Foir-hosted cookie sessions), `authedRequest`, guards | `graphql` |
+| `@foir/sdk/auth` | Framework-agnostic sign-in for your app's users: login/register/OTP/provider flows, token lifecycle (`SessionAdapter`), `createFoirSessionClient` (Foir-hosted cookie sessions), `authedRequest`, guards | `graphql` |
 | `@foir/sdk/react` | Drop-in React auth — `<FoirProvider>` (token or `hostedSession` mode), `useFoirSession`/`useFoirUser`/`useFoirAuth`, `<SignIn>`, `<OAuthButtons>`, `<UserButton>` | `react`, `graphql` |
 | `@foir/sdk/next` | Next.js App Router BFF auth — `createFoirCookieAdapter`, `getFoirSession`, `foirSignIn*`, `completeFoirProviderLogin`, `createFoirMiddleware` | `graphql` |
 | `@foir/sdk/server` | Server-side helpers for extension/config API backends — `createServerClient`, `verifyWebhookSignature`, `verifyScopedToken`, callback client | — |
@@ -120,13 +120,13 @@ that way; silence it with `announceManifestFallback: false`.
 Reads that can be shared are sent to `GET /cdn/graphql` with only the
 persisted-query hash in the URL, so a CDN in front of you can serve the next
 visitor without reaching origin. That is a query, on a `pk_` key, with no
-customer bearer, on the published channel; everything else is a `POST /graphql`.
+user bearer, on the published channel; everything else is a `POST /graphql`.
 
 `foir.raw()` is the escape hatch, and it takes a **GraphQL document** — it
 reaches anything the credential can, including root fields no model or namespace
 claims. It returns the whole `data` object.
 
-Namespaces (`search`, `customers`, `notifications`) live under `foir.ns` because
+Namespaces (`search`, `users`, `notifications`) live under `foir.ns` because
 the client carries no runtime schema to tell a namespace from a model. `ns` and
 `raw` are the only reserved names.
 
@@ -178,18 +178,18 @@ export async function loader({ context }: LoaderArgs) {
 }
 ```
 
-### Customer auth
+### Signing your users in
 
 ```ts
 import {
-  loginWithPassword,
+  signInWithPassword,
   authedRequest,
   type SessionAdapter,
 } from '@foir/sdk/auth';
 import { MyProfileDocument } from './generated/graphql';
 
 // SessionAdapter = { get, set, delete } over your session store (cookie, KV…).
-const customer = await loginWithPassword(adapter, env, { email, password });
+const user = await signInWithPassword(adapter, env, { email, password });
 
 // Bearer-authed request with automatic refresh-and-retry on expired sessions.
 const { myProfile } = await authedRequest(adapter, env, MyProfileDocument);
@@ -282,8 +282,8 @@ import { cookies } from 'next/headers';
 import { getFoirSession } from '@foir/sdk/next';
 
 export default async function Dashboard() {
-  const customer = await getFoirSession(await cookies());
-  return <p>Signed in as {customer?.email}</p>;
+  const user = await getFoirSession(await cookies());
+  return <p>Signed in as {user?.email}</p>;
 }
 ```
 

package/dist/app/client.d.ts

@@ -2,7 +2,7 @@
  * The client an installed app calls Foir with.
  *
  * An app is installed in many projects, and each install maps the app's
- * sources onto whichever models that project's operator chose. So an app has
+ * sources onto whichever models that project chose. So an app has
  * no schema to generate a client from: it learns the model keys at request
  * time, from the install's own configuration, and names them in each call.
  * `createFoirClient` is the client for an endpoint that knows its project;
@@ -28,7 +28,7 @@
  */
 import type { FoirDispatchCredential } from '../data/transport';
 import { type FoirRetryPolicy } from '../transport/retry';
-import type { AppCustomerEmailUnavailableReason } from './errors';
+import type { AppUserEmailUnavailableReason } from './errors';
 type Json = null | boolean | number | string | Json[] | {
     [key: string]: Json;
 };
@@ -65,18 +65,18 @@ export interface AppFieldMapping {
     /** The project model's field key. */
     modelField: string;
     /**
-     * SINK_ONLY means the operator has said Foir owns the field: a value from
+     * SINK_ONLY means the project has said Foir owns the field: a value from
      * the app's side must not be written over it. An unrecognised direction
      * reads as SINK_ONLY, which withholds the field rather than writing on a
      * guess.
      */
     direction: AppSyncDirection;
 }
-/** One of the operator's mappings: a source or sink of the app onto a model. */
+/** One of the install's mappings: a source or sink of the app onto a model. */
 export interface AppBinding {
     /** The app's source or sink name. */
     key: string;
-    /** The project model the operator mapped it onto. */
+    /** The project model it was mapped onto. */
     model: string;
     /** The model field the app's records are keyed on. Empty when the mapping names none. */
     naturalKey: string;
@@ -84,7 +84,7 @@ export interface AppBinding {
     /** REFERENCE: Foir reads the source's fields live. SYNC: it holds a copy. A sink is a copy. */
     mode: 'SYNC' | 'REFERENCE';
 }
-/** An install's own configuration, as the operator left it. */
+/** An install's own configuration, as the project left it. */
 export interface AppInstallConfig {
     name: string;
     enabled: boolean;
@@ -92,25 +92,25 @@ export interface AppInstallConfig {
     targetModels: string[];
     /** The address the app's vendor is told to deliver webhooks to. Empty when the app declares none. */
     webhookUrl: string;
-    /** The operator's answers to the manifest's settings schema. */
+    /** The project's answers to the manifest's settings schema. */
     settings: JsonObject;
     sources: AppBinding[];
     sinks: AppBinding[];
     /**
-     * Why the project cannot send a customer an email at the level this install
+     * Why the project cannot send a user an email at the level this install
      * sits at, or null when it can. While it is set, a notification that carries
      * an email and an opt-in to a category confirmed by email are refused
-     * (`appCustomerEmailUnavailableOf`), so say so before one is.
+     * (`appUserEmailUnavailableOf`), so say so before one is.
      */
-    customerEmailUnavailable: AppCustomerEmailUnavailableReason | null;
+    userEmailUnavailable: AppUserEmailUnavailableReason | null;
     /**
-     * The customer sign-in this install pairs with the app, by key, for an app
-     * whose own system has customers; null when it pairs none. Every identity
+     * The sign-in this install pairs with the app, by key, for an app whose own
+     * system has its own users; null when it pairs none. Every identity
      * the app names is resolved through it, so while it is null nothing finds a
-     * customer by identity: `customers.byIdentity` and `customers.identities`
+     * user by identity: `users.byIdentity` and `users.identities`
      * are refused, and an operation that needs them is not registered.
      */
-    customerSignIn: string | null;
+    userSignIn: string | null;
 }
 /**
  * The status an install reports. Leaving out `subscriptionHealth`,
@@ -136,7 +136,7 @@ export interface AppRecord {
     /** The platform's own id. What `records.delete` takes. */
     id: string;
     naturalKey: string | null;
-    /** The customer the record belongs to, or null. */
+    /** The user the record belongs to, or null. */
     ownerId: string | null;
     /** The fields that were asked for and could be read, by model field key. */
     fields: JsonObject;
@@ -163,21 +163,21 @@ export interface AppUpsertResult {
     /** True when nothing was written because Foir already holds a newer copy (`sourceModifiedAt`). */
     stale: boolean;
 }
-export type AppCustomerSaveResult = (AppUpsertResult & {
+export type AppUserSaveResult = (AppUpsertResult & {
     unlinked: false;
-    customerCreated: boolean;
+    userCreated: boolean;
 }) | {
     unlinked: true;
 };
-export interface AppCustomerEraseResult {
+export interface AppUserEraseResult {
     recordDeleted: boolean;
     identityRemoved: boolean;
-    customerDeleted: boolean;
-    /** Another sign-in method, or something else they own; null when the customer went or none was found. */
-    customerKeptBecause: string | null;
+    userDeleted: boolean;
+    /** Another sign-in method, or something else they own; null when the user went or none was found. */
+    userKeptBecause: string | null;
 }
 export interface AppNotification {
-    customerId: string;
+    userId: string;
     /** The in-app title, and the email's subject when `email` names none. */
     title: string;
     message?: string;
@@ -194,10 +194,10 @@ export interface AppNotification {
             url: string;
         }>;
     };
-    /** Makes the send safe to repeat: the same key from the same operation tells the customer once. */
+    /** Makes the send safe to repeat: the same key from the same operation tells the user once. */
     idempotencyKey?: string;
 }
-/** An organisation an operation makes for one of its customers. */
+/** An organisation an operation makes for one of its users. */
 export interface AppOrganizationProvision {
     /**
      * Yours to choose and to keep. Sending the same one again with the same
@@ -221,30 +221,36 @@ export interface AppOrganizationProvision {
         data: Record<string, unknown>;
     };
     /**
-     * The customer who becomes its first member. They are given the role the
+     * The user who becomes its first member. They are given the role the
      * project names for an organisation's founder, in its settings: the
      * operation chooses who, and the project decides what they hold.
      */
     firstMember?: {
-        customerId: string;
+        userId: string;
     };
+    /**
+     * The organisation signs its own people in, to a pool of its own, apart
+     * from its parent's and the project's. Its descendants share that pool
+     * unless one of them starts another. Chosen now, when it is made.
+     */
+    ownPool?: boolean;
 }
 /**
- * Who a consent change is for: a customer whose id the app holds, or an
+ * Who a consent change is for: a user whose id the app holds, or an
  * address.
  *
- * By `email`, the customer holding the address at the operation's level is
+ * By `email`, the user holding the address at the operation's level is
  * found, or made, together with the change, so a change the platform refuses
- * leaves no customer behind. It is for an opt-in from somebody who may have no
- * customer yet (a sign-up form), and the operation must declare
+ * leaves no user behind. It is for an opt-in from somebody who may not be a
+ * user yet (a sign-up form), and the operation must declare
  * `users:create` as well as `notifications:consent`.
  */
 export type AppConsentSubject = {
-    customerId: string;
+    userId: string;
     email?: undefined;
 } | {
     email: string;
-    customerId?: undefined;
+    userId?: undefined;
 };
 export type AppConsentChange = AppConsentSubject & {
     /** A notification category the project makes opt-in. */
@@ -259,19 +265,19 @@ export type AppConsentChange = AppConsentSubject & {
      */
     sourceModifiedAt?: string;
     /**
-     * True when the customer gave this consent in another system and the app is
+     * True when the user gave this consent in another system and the app is
      * carrying it over (a mirror). It is applied as it stands.
      *
      * Left out, the app collected the consent itself (a sign-up form), and an
      * opt-in is applied the way its category says: at once, or, in a category
-     * that confirms by email, only when the customer follows the link the
+     * that confirms by email, only when the user follows the link the
      * platform sends them. Until then nothing is written and the answer says
      * `confirmationPending`.
      */
     givenElsewhere?: boolean;
     /**
      * The language of the page the consent was collected on. The confirmation
-     * email is written in it when the customer has stated none of their own.
+     * email is written in it when the user has stated none of their own.
      */
     locale?: string;
 };
@@ -308,7 +314,7 @@ export interface AppClient {
     whoami(): Promise<AppWhoami>;
     /** The install this token acts for: its configuration, its credential, its status. */
     install: {
-        /** The operator's settings and mappings. Needs `appconfig:read`. */
+        /** The install's settings and mappings. Needs `appconfig:read`. */
         config(): Promise<AppInstallConfig>;
         /**
          * The install's credential, by the manifest's credential field names.
@@ -330,7 +336,7 @@ export interface AppClient {
          * Write the record at a natural key, making it when there is none.
          * Changing the record there needs `records:write:<model>` and making one
          * needs `records:create:<model>`, so an operation that does both declares
-         * both. `ownerId` names the customer it belongs to (needs
+         * both. `ownerId` names the user it belongs to (needs
          * `records:attribute:<model>`); `sourceModifiedAt` is when the object this
          * mirrors last changed at its source, so an older copy arriving late is
          * not written.
@@ -365,7 +371,7 @@ export interface AppClient {
          * other is refused, naming it. `hasMore` says the filter matched more than
          * were answered. Like `read`, it sees the PUBLISHED version.
          *
-         * The name of a model's list is the operator's to set, so the first list a
+         * The name of a model's list is the project's to set, so the first list a
          * client makes asks the data API what this token is served (`GET
          * /v1/manifest`), once.
          */
@@ -420,16 +426,16 @@ export interface AppClient {
             truncated: boolean;
         }>;
         /**
-         * The record of a customer the app names by identity: their id at the
+         * The record of a user the app names by identity: their id at the
          * external system, which is also the subject of their sign-in with it. For
-         * a source that declares an identity. The platform finds the customer
+         * a source that declares an identity. The platform finds the user
          * through the sign-in the install pairs with the source, at the install's
          * level, and never by email.
          */
-        customer: {
+        user: {
             /**
-             * Merge `data` into the customer's record, making the record when they
-             * have none, and the customer when `email` is given and nobody holds the
+             * Merge `data` into the user's record, making the record when they
+             * have none, and the user when `email` is given and nobody holds the
              * identity. An identity nobody holds, with no email, is `{ unlinked:
              * true }`: nothing was written, and they are known once they sign in.
              */
@@ -439,29 +445,29 @@ export interface AppClient {
                 data: JsonObject;
                 email?: string;
                 sourceModifiedAt?: string;
-            }): Promise<AppCustomerSaveResult>;
-            /** The customer's record, or null when nobody holds the identity or they hold no record. */
+            }): Promise<AppUserSaveResult>;
+            /** The user's record, or null when nobody holds the identity or they hold no record. */
             read(model: string, identity: string): Promise<AppRecord | null>;
             /**
-             * Erase what the app holds for the customer, as a privacy request asks:
-             * their record and the identity's link, and the customer when nothing
+             * Erase what the app holds for the user, as a privacy request asks:
+             * their record and the identity's link, and the user when nothing
              * else is attached to them. It removes a record, so it needs
              * `records:delete` and `records:read` for the model, and
              * `identities:delete`. The grant to save the record is not enough.
              */
-            erase(model: string, identity: string): Promise<AppCustomerEraseResult>;
+            erase(model: string, identity: string): Promise<AppUserEraseResult>;
         };
     };
-    customers: {
+    users: {
         /**
-         * The customer who has this email at the install's level, made when there
-         * is none. The same customer every time for one email. Needs
+         * The user who has this email at the install's level, made when there
+         * is none. The same user every time for one email. Needs
          * `users:create`.
          *
-         * `verified` says whether that address is one the customer has proved is
-         * theirs. A customer this call makes has not, and neither has one an
+         * `verified` says whether that address is one the user has proved is
+         * theirs. A user this call makes has not, and neither has one an
          * earlier call made: anybody can type an address. So what is written for
-         * an unverified customer is written for whoever holds the address, and
+         * an unverified user is written for whoever holds the address, and
          * anything that should wait for proof asks `verified` first.
          */
         ensure(email: string): Promise<{
@@ -470,53 +476,53 @@ export interface AppClient {
             verified: boolean;
         }>;
         /**
-         * One customer by id, or null when there is none at the install's level.
+         * One user by id, or null when there is none at the install's level.
          * Needs `users:read.named`, or `users:read.all`.
          */
-        get(id: string): Promise<AppCustomer | null>;
+        get(id: string): Promise<AppUser | null>;
         /**
-         * The customer who has this email at the install's level, or null. The
+         * The user who has this email at the install's level, or null. The
          * exact address, as `ensure` matches it, and nothing wider: it finds one
-         * customer and never searches. Needs `users:read.named`, or
+         * user and never searches. Needs `users:read.named`, or
          * `users:read.all`.
          */
-        byEmail(email: string): Promise<AppCustomer | null>;
+        byEmail(email: string): Promise<AppUser | null>;
         /**
-         * The id of the customer who holds this identity at the app's own system,
+         * The id of the user who holds this identity at the app's own system,
          * or null when nobody does: for an app hearing from its system about one
-         * of its customers. The identity is the subject of the customer's sign-in
-         * with that system, and it is resolved through the customer sign-in the
-         * install pairs (`install.config().customerSignIn`) and no other. Never
+         * of its own users. The identity is the subject of the user's sign-in
+         * with that system, and it is resolved through the sign-in the
+         * install pairs (`install.config().userSignIn`) and no other. Never
          * matched by email. Needs `identities:read`, declared by name:
          * `users:read.all` does not include it.
          */
         byIdentity(identity: string): Promise<string | null>;
         /**
-         * The other direction: the identities a customer the app names by id
+         * The other direction: the identities a user the app names by id
          * holds at the app's own system, most recently seen first, through the
          * same pairing. Empty when they have never signed in that way. For an app
-         * acting on an event that names the Foir customer. Needs
+         * acting on an event that names the Foir user. Needs
          * `identities:read`, declared by name.
          */
-        identities(customerId: string): Promise<string[]>;
+        identities(userId: string): Promise<string[]>;
         /**
-         * The customers at the install's level, a page at a time, newest first.
+         * The users at the install's level, a page at a time, newest first.
          * Needs `users:read.all`: an operation declaring only
-         * `users:read.named` reads the customers it names and is refused the
+         * `users:read.named` reads the users it names and is refused the
          * list.
          */
-        list(query?: AppCustomerList): Promise<{
-            customers: AppCustomer[];
+        list(query?: AppUserList): Promise<{
+            users: AppUser[];
             hasMore: boolean;
             endCursor: string | null;
         }>;
     };
     organizations: {
         /**
-         * Make an organisation, with its settings record and a customer as its
+         * Make an organisation, with its settings record and a user as its
          * first member. Needs `organizations:create`, and for `settings` the write
          * of the settings model. Sign-up is the use: one operation creates the
-         * customer (`customers.ensure`) and then the organisation that is theirs.
+         * user (`users.ensure`) and then the organisation that is theirs.
          *
          * The first member is given the role the project names for an
          * organisation's founder. A project that names none refuses it, saying
@@ -551,20 +557,20 @@ export interface AppClient {
         }>;
     };
     notifications: {
-        /** Tell a customer something. Needs `notifications:write.named`. */
+        /** Tell a user something. Needs `notifications:write.named`. */
         send(notification: AppNotification): Promise<void>;
         /**
-         * Set a named customer's consent in an opt-in category. Needs
+         * Set a named user's consent in an opt-in category. Needs
          * `notifications:consent`, which only an operation's token carries.
          *
          * `confirmationPending` is true when an opt-in the app collected was not
-         * applied because its category confirms by email first: the customer has
+         * applied because its category confirms by email first: the user has
          * been sent a link, or was sent one recently, and the preference turns on
-         * when they follow it. The answer is the same whether or not the address
-         * already had a customer.
+         * when they follow it. The answer is the same whether or not anybody
+         * held the address already.
          *
-         * Name the customer by `customerId`, or by `email` for somebody who may
-         * have no customer yet: the platform finds or makes them with the change,
+         * Name the user by `userId`, or by `email` for somebody who may not be
+         * a user yet: the platform finds or makes them with the change,
          * and that also needs `users:create`.
          */
         setConsent(change: AppConsentChange): Promise<{
@@ -580,7 +586,7 @@ export interface AppClient {
          *
          * For work a delivery cannot do in place. A delivery is not a run, so it
          * holds none of the authority the platform gives only inside one (setting
-         * a customer's consent is one), and it has the few seconds its vendor
+         * a user's consent is one), and it has the few seconds its vendor
          * waits. Hand the work to an operation and answer the vendor.
          *
          * Only the token a delivery arrived with may call it, for an operation
@@ -590,16 +596,16 @@ export interface AppClient {
         start(operationKey: string, options?: AppOperationStart): Promise<AppStartedOperation>;
     };
 }
-/** A customer, as an operation that declared a customer read sees them. */
-export interface AppCustomer {
+/** A user, as an operation that declared a user read sees them. */
+export interface AppUser {
     id: string;
     email: string;
-    /** Whether the customer has proved the address is theirs. */
+    /** Whether the user has proved the address is theirs. */
     verified: boolean;
     /** `ACTIVE`, `SUSPENDED` or `PENDING`, as the platform holds it. */
     status: string;
 }
-export interface AppCustomerList {
+export interface AppUserList {
     /** Part of an email address to look for. Absent lists everyone. */
     search?: string;
     /** How many to answer, at most. The platform's own page size when absent. */