@foir/sdk 0.21.0 → 0.22.0

package/dist/server/require-scoped-token.d.ts

@@ -120,12 +120,12 @@ export interface ScopedTokenIngress {
      */
     orgId: string | null;
     /**
-     * The customer the run acts for, when it acts for one: the signed-in
-     * customer who ran the operation, or the owner of the record whose event
+     * The user the run acts for, when it acts for one: the signed-in
+     * user who ran the operation, or the owner of the record whose event
      * fired it. Verified with the rest of the token, so it is the one to trust
      * over anything in the input.
      */
-    customerId?: string;
+    userId?: string;
     /** When the token stops being accepted. There is no refresh: finish, or report, before it. */
     expiresAt: Date;
     /** The token's own id (`jti`). The run's id on a dispatch that carries no other. */

package/dist/server/types.d.ts

@@ -16,7 +16,7 @@ export interface ServerClientOptions {
     configKey?: string;
 }
 /**
- * Where an editor iframe should appear in the admin record editor.
+ * Where an editor iframe should appear in the console's record editor.
  */
 export interface EditorPlacement {
     /** 'main-editor' replaces / augments the content tab; 'sidebar' renders in the sidebar. */

package/dist/server/verify-scoped-token.d.ts

@@ -38,9 +38,9 @@ export interface ScopedTokenClaims {
     iat: number;
     ctx?: Record<string, string>;
     /**
-     * The customer the token acts for, when it acts for one: the signed-in
-     * customer who ran the operation, or the owner of the record whose event
-     * fired it. `requireScopedToken` answers it as `customerId`.
+     * The user the token acts for, when it acts for one: the signed-in
+     * user who ran the operation, or the owner of the record whose event
+     * fired it. `requireScopedToken` answers it as `userId`.
      */
     cid?: string;
 }

package/dist/server.js

@@ -151,7 +151,8 @@ var GRANT_TABLE = [
   ["roles:write", false, [], []],
   ["projects:read", false, [], []],
   ["projects:write", false, [], []],
-  ["project:manage", false, [], ["records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:stand", false, [], []],
+  ["project:manage", false, [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", false, [], []],
   ["projects:delete", false, [], []],
   ["tenants:read", false, [], []],
@@ -164,12 +165,14 @@ var GRANT_TABLE = [
   ["usage:read", false, [], []],
   ["controlkeys:read", false, [], []],
   ["controlkeys:write", false, [], []],
+  ["tenantsigninproviders:read", false, [], []],
+  ["tenantsigninproviders:write", false, [], []],
   ["tenanthooks:read", false, [], []],
   ["tenanthooks:write", false, [], []],
   ["apps:install", false, [], []],
-  ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
+  ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "tenantsigninproviders:read", "tenantsigninproviders:write", "apps:install"]],
   ["platform:read", false, [], []],
-  ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace", "users:setup"]],
+  ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
   ["platform:create_workspace", false, [], []],
   ["users:read", false, ["own", "named", "all"], []],
   ["users:write", false, ["own", "all"], []],
@@ -577,7 +580,7 @@ async function requireScopedToken(request, options) {
     // header, so the client presents exactly what this guard accepted.
     dispatch: { token: () => token, context: rawContext },
     orgId: typeof level === "string" ? level : null,
-    ...typeof claims.cid === "string" && claims.cid !== "" ? { customerId: claims.cid } : {},
+    ...typeof claims.cid === "string" && claims.cid !== "" ? { userId: claims.cid } : {},
     expiresAt: new Date(claims.exp * 1e3),
     tokenId: claims.jti
   };
@@ -639,9 +642,9 @@ async function readDispatch(request) {
   if (!isObject(context)) refuse(`body.context is ${describe(context)}, expected an object`);
   requireString(context, "tenantId", "body.context");
   requireString(context, "projectId", "body.context");
-  requireString(context, "userId", "body.context", true);
+  requireString(context, "actorId", "body.context", true);
   requireString(context, "timestamp", "body.context");
-  if (context.customerId !== void 0) requireString(context, "customerId", "body.context");
+  if (context.userId !== void 0) requireString(context, "userId", "body.context");
   const input = body.input;
   if (input !== null && !isObject(input)) {
     refuse(`body.input is ${describe(input)}, expected an object`);
@@ -862,8 +865,8 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
   downgrade;
   constructor(downgrade) {
     super(
-      `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
-      { graphQLErrors: [{ message: "customer token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
+      `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
+      { graphQLErrors: [{ message: "user token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
     );
     this.name = "FoirAuthDowngradedError";
     this.downgrade = downgrade;
@@ -871,7 +874,7 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
 };
 var FoirSessionExpiredError = class extends FoirRequestError {
   constructor(options) {
-    super("[foir] the customer session has expired and could not be refreshed: sign in again", {
+    super("[foir] the user session has expired and could not be refreshed: sign in again", {
       cause: options?.cause,
       graphQLErrors: [{ message: "session expired", extensions: { code: "SESSION_EXPIRED" } }]
     });
@@ -1131,7 +1134,7 @@ var FoirSocketTransport = class {
   constructor(config) {
     if (config.dispatch !== void 0) {
       throw new FoirRequestError(
-        "[foir] a client built from a dispatch token cannot subscribe. The subscription socket authenticates an api key, an admin token or a customer bearer, and has no path for a dispatch token. Queries and mutations made as the operation go to /graphql and work as they are."
+        "[foir] a client built from a dispatch token cannot subscribe. The subscription socket authenticates an api key, a console token or a user bearer, and has no path for a dispatch token. Queries and mutations made as the operation go to /graphql and work as they are."
       );
     }
     this.config = config;
@@ -1495,12 +1498,12 @@ function assertOperatorKey(apiKey) {
   const kind = foirKeyKind(key);
   if (kind === "publishable" || kind === "server") {
     throw new FoirRequestError(
-      `[foir] createEventsClient: the event log is an OPERATOR surface and a ${kind} key can never hold ${FOIR_EVENTS_SCOPE}: it is not mintable on an app's key. Use an admin key from a machine of your own. The log names which customer acted on records that whoever reads an app's key cannot themselves read.`
+      `[foir] createEventsClient: the event log is a project surface and a ${kind} key can never hold ${FOIR_EVENTS_SCOPE}: it is not mintable on an app's key. Use an admin key from a machine of your own. The log names which user acted on records that whoever reads an app's key cannot themselves read.`
     );
   }
   if (kind === void 0) {
     throw new FoirRequestError(
-      `[foir] createEventsClient: apiKey must be an admin key, got a key starting "${key.slice(0, 4)}". The event log is reachable by an admin key or an admin session only.`
+      `[foir] createEventsClient: apiKey must be an admin key, got a key starting "${key.slice(0, 4)}". The event log is reachable by an admin key or a console session only.`
     );
   }
   return key;
@@ -1510,7 +1513,7 @@ function assertNoBearer(headers) {
   for (const name of Object.keys(headers)) {
     if (name.toLowerCase() === "authorization") {
       throw new FoirRequestError(
-        `[foir] createEventsClient: an Authorization header is not accepted. A customer bearer makes the customer the resolved authority on api-public, and no customer authority can contain ${FOIR_EVENTS_SCOPE}. The sk_ key alone is the credential for this surface.`
+        `[foir] createEventsClient: an Authorization header is not accepted. A user bearer makes the user the resolved authority on api-public, and no user authority can contain ${FOIR_EVENTS_SCOPE}. The sk_ key alone is the credential for this surface.`
       );
     }
   }

package/dist/transport/foir-http.d.ts

@@ -11,7 +11,7 @@
  *
  * The split exists so the second one is possible. The Foir-specific transport
  * concerns — which api key is in play, the preview schema channel header, the
- * optional customer bearer, and the `FoirRequestError` shape — are identical on
+ * optional user bearer, and the `FoirRequestError` shape — are identical on
  * both, and duplicating them is exactly how the two surfaces would drift. So
  * they live here once and `foir-request.ts` re-exports them unchanged; the only
  * thing that stayed behind is the part that needs `print`.
@@ -206,8 +206,8 @@ export declare function readFoirRateLimit(headers: Headers): FoirRateLimitSnapsh
 export declare function readFoirRetryAfterMs(headers: Headers): number | undefined;
 export interface FoirRequestOptions {
     /**
-     * Customer bearer token. api-public still needs the `x-api-key` to resolve
-     * the project; the bearer adds the customer identity for self-scoped reads
+     * User bearer token. api-public still needs the `x-api-key` to resolve
+     * the project; the bearer adds the user identity for self-scoped reads
      * (e.g. `myProfile`). Used by `@foir/sdk/auth`'s post-login profile fetch.
      */
     bearerToken?: string;
@@ -256,7 +256,7 @@ export interface FoirRequestOptions {
     onRateLimit?: (snapshot: FoirRateLimitSnapshot | undefined) => void;
 }
 /**
- * Supplies the current customer bearer. Sync or async so consumers can read a
+ * Supplies the current user bearer. Sync or async so consumers can read a
  * cookie session (Hydrogen/Remix), a KV store, an in-memory value, etc. Returns
  * the token when signed in, or `null`/`undefined` when signed out.
  *
@@ -265,7 +265,7 @@ export interface FoirRequestOptions {
  * they would end up accepting subtly different things.
  */
 export type FoirTokenProvider = () => string | null | undefined | Promise<string | null | undefined>;
-/** A request made with an api key, optionally for a signed-in customer. */
+/** A request made with an api key, optionally for a signed-in user. */
 export interface FoirKeyHeaderInput {
     apiKey: string;
     /**
@@ -305,7 +305,7 @@ export interface FoirKeyHeaderInput {
  *
  * The token is the whole credential. api-public takes the scoped path when
  * `X-Foir-Token` is present and never reads `x-api-key` on it, and the
- * organization, the customer and the schema channel all come from the token's
+ * organization, the user and the schema channel all come from the token's
  * own claims, so none of the key-side inputs has anything to say here.
  */
 export interface FoirDispatchHeaderInput {
@@ -337,7 +337,7 @@ export declare function refuseCredentialHeaders(extra: Readonly<Record<string, s
  * authorization difference nobody would notice until it mattered.
  *
  * Two credentials, and a request carries exactly one: an api key (with its
- * optional customer bearer, organization and channel), or an operation's
+ * optional user bearer, organization and channel), or an operation's
  * dispatch token. A dispatch request never writes `x-api-key`.
  */
 /** The header a server names the visitor it calls for in. */
@@ -412,7 +412,7 @@ export declare function foirApiEndpoint(apiUrl: string, path: `/${string}`): str
 /**
  * Foir DISCARDED a credential you sent, and served the request without it.
  *
- * A customer JWT is optional: if it fails to verify, the read is served as an
+ * A user JWT is optional: if it fails to verify, the read is served as an
  * ordinary anonymous one rather than refused, because plenty of reads
  * legitimately have nobody signed in. That is the right behaviour and it has a
  * sharp edge — a lapsed token and a genuinely anonymous request produce the
@@ -424,9 +424,9 @@ export declare function foirApiEndpoint(apiUrl: string, path: `/${string}`): str
  */
 export interface FoirAuthDowngrade {
     /** Always `"rejected"`. */
-    customerToken: string;
+    userToken: string;
     /**
-     * `expired` — re-exchange and retry. `invalid` — not a customer token for
+     * `expired` — re-exchange and retry. `invalid` — not a user token for
      * this environment. `wrong_project` — the token and the api-key name
      * different projects.
      */
@@ -435,7 +435,7 @@ export interface FoirAuthDowngrade {
     servedAs: string;
 }
 /**
- * A request that sent a customer token was served without it.
+ * A request that sent a user token was served without it.
  *
  * Thrown only to a caller that asked (`rejectDowngrade`): one that sent the
  * token because it wants the signed-in answer, and would otherwise be handed the
@@ -448,9 +448,9 @@ export declare class FoirAuthDowngradedError extends FoirRequestError {
     constructor(downgrade: FoirAuthDowngrade);
 }
 /**
- * The customer's session is over: its token was rejected and could not be
+ * The user's session is over: its token was rejected and could not be
  * refreshed. It is what a signed-in request gets in place of the anonymous
- * answer. Send the customer to sign in again.
+ * answer. Send the user to sign in again.
  */
 export declare class FoirSessionExpiredError extends FoirRequestError {
     constructor(options?: {

package/dist/types/index.d.ts

@@ -21,7 +21,7 @@ export interface EditorInit {
     apiUrl: string;
     /** Config connection domain (e.g. my-store.myshopify.com) */
     connectionDomain?: string;
-    /** How this editor is rendered in the admin UI. */
+    /** How this editor is rendered in the console. */
     configMode?: 'editor' | 'sidebar';
     /** Currently selected field keys (sidebar mode). */
     selectedFieldKeys?: string[];
@@ -67,7 +67,7 @@ export interface EditorContextValue {
     resize: (height: number) => void;
     /** Report dirty state (unsaved changes). */
     setDirty: (isDirty: boolean) => void;
-    /** Request the host to navigate to an admin path. */
+    /** Request the host to navigate to a console path. */
     requestNavigate: (path: string) => void;
     /** Request the host to execute a platform operation. Returns the result.
      * `mode` controls whether the platform waits for the operation to complete

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {
@@ -177,8 +177,8 @@
     "ws": "^8.18.0",
     "y-websocket": "^3.0.0",
     "yjs": "^13.6.30",
-    "@foir/access-vocab": "0.0.0",
-    "@foir/proto-ts": "0.109.0"
+    "@foir/proto-ts": "0.109.0",
+    "@foir/access-vocab": "0.0.0"
   },
   "engines": {
     "node": ">=18.0.0"