@foir/sdk 0.21.0 → 0.22.0

package/dist/react.js

@@ -205,8 +205,8 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
   downgrade;
   constructor(downgrade) {
     super(
-      `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
-      { graphQLErrors: [{ message: "customer token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
+      `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
+      { graphQLErrors: [{ message: "user token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
     );
     this.name = "FoirAuthDowngradedError";
     this.downgrade = downgrade;
@@ -214,7 +214,7 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
 };
 var FoirSessionExpiredError = class extends FoirRequestError {
   constructor(options) {
-    super("[foir] the customer session has expired and could not be refreshed: sign in again", {
+    super("[foir] the user session has expired and could not be refreshed: sign in again", {
       cause: options?.cause,
       graphQLErrors: [{ message: "session expired", extensions: { code: "SESSION_EXPIRED" } }]
     });
@@ -231,7 +231,7 @@ function reportAuthDowngrade(envelope) {
   if (warnedDowngrade === downgrade.reason) return;
   warnedDowngrade = downgrade.reason;
   console.warn(
-    `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
+    `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
   );
 }
 function refusePrunedDocument(json, options) {
@@ -950,42 +950,63 @@ var AUTH_OPS = {
   authConfig: "authConfig",
   authProviders: "authProviders",
   defaultAuthProvider: "defaultAuthProvider",
-  customerSignupContext: "customerSignupContext",
+  signupContext: "signupContext",
   // Post-credential self reads.
   currentUser: "currentUser",
   myProviderToken: "myProviderToken",
-  // What the calling credential may do, and for a signed-in customer the roles
+  // What the calling credential may do, and for a signed-in user the roles
   // they hold. `./access` reads it.
   whoami: "whoami",
   // Methods.
-  customerLogin: "customerLogin",
-  customerRegister: "customerRegister",
-  customerRequestOTP: "customerRequestOTP",
-  customerLoginOTP: "customerLoginOTP",
+  login: "login",
+  register: "register",
+  requestOTP: "requestOTP",
+  loginWithOTP: "loginWithOTP",
   // Session lifecycle.
-  customerRefreshToken: "customerRefreshToken",
-  customerLogout: "customerLogout",
-  customerJoinWaitlist: "customerJoinWaitlist",
-  // Password management and account lifecycle — the block that had no path.
-  customerRequestPasswordReset: "customerRequestPasswordReset",
-  customerResetPassword: "customerResetPassword",
-  customerUpdatePassword: "customerUpdatePassword",
-  customerVerifyEmail: "customerVerifyEmail",
+  refreshToken: "refreshToken",
+  logout: "logout",
+  joinWaitlist: "joinWaitlist",
+  // Password management and account lifecycle.
+  requestPasswordReset: "requestPasswordReset",
+  resetPassword: "resetPassword",
+  updatePassword: "updatePassword",
+  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
-  // The operator's organization context. TWO ops and no third: one to read
-  // which organizations the caller may stand in, one to say which. There is
-  // deliberately no per-call org argument anywhere in this SDK — the claim the
-  // row layer reads is resolved from the caller's own membership row on every
-  // request, so an application that never names an org cannot name the wrong
-  // one.
+  // The user's own profile, and the apps they have agreed may act for them.
+  updateMyProfile: "updateMyProfile",
+  myAuthorizedApps: "myAuthorizedApps",
+  revokeAuthorizedApp: "revokeAuthorizedApp",
+  // Where they are signed in, their personal access tokens, and the
+  // providers they sign in with.
+  mySessions: "mySessions",
+  endMySession: "endMySession",
+  signOutEverywhere: "signOutEverywhere",
+  createPersonalAccessToken: "createPersonalAccessToken",
+  mySignInMethods: "mySignInMethods",
+  connectSignInMethod: "connectSignInMethod",
+  disconnectSignInMethod: "disconnectSignInMethod",
+  // Their second factors. A change needs one proven first, by a step-up.
+  myFactors: "myFactors",
+  beginStepUp: "beginStepUp",
+  completeStepUp: "completeStepUp",
+  beginFactorEnrollment: "beginFactorEnrollment",
+  completeFactorEnrollment: "completeFactorEnrollment",
+  removeFactor: "removeFactor",
+  makeRecoveryCodes: "makeRecoveryCodes",
+  // The organizations the caller may stand in. Nothing selects one: a request
+  // names the organization it acts in (`orgId` or `orgUrl` below), and the
+  // platform checks the caller stands there every time.
   myOrganizations: "myOrganizations",
-  selectMyOrganization: "selectMyOrganization",
   // Founding one. Present in a manifest only when the project opted in.
-  registerOperatorOrganization: "registerOperatorOrganization",
+  registerOrganization: "registerOrganization",
   // External identity providers.
-  customerLoginWithProvider: "customerLoginWithProvider",
-  customerProviderCallback: "customerProviderCallback",
-  customerProviderVerifyOTP: "customerProviderVerifyOTP"
+  loginWithProvider: "loginWithProvider",
+  providerCallback: "providerCallback",
+  providerVerifyOTP: "providerVerifyOTP",
+  // A provider sign-in that names an address somebody already holds, waiting
+  // for the code sent to it.
+  confirmProviderLink: "confirmProviderLink",
+  resendProviderLinkCode: "resendProviderLinkCode"
 };
 function authClientConfig(env, options) {
   const apiKey = resolveFoirApiKey(env);
@@ -1048,28 +1069,28 @@ function stripUndefined(args) {
 // src/auth/auth.ts
 var TOKEN_KEY = "foir:token";
 var REFRESH_KEY = "foir:refreshToken";
-var CUSTOMER_ID_KEY = "foir:customerId";
+var USER_ID_KEY = "foir:userId";
 var EMAIL_KEY = "foir:email";
-async function customerLogin(env, vars) {
-  return authOp(env, AUTH_OPS.customerLogin, vars);
+async function login(env, vars) {
+  return authOp(env, AUTH_OPS.login, vars);
 }
-async function customerRegister(env, vars) {
-  return authOp(env, AUTH_OPS.customerRegister, vars);
+async function register(env, vars) {
+  return authOp(env, AUTH_OPS.register, vars);
 }
-async function customerRequestOTP(env, email) {
-  return authOp(env, AUTH_OPS.customerRequestOTP, { email });
+async function requestOTP(env, email) {
+  return authOp(env, AUTH_OPS.requestOTP, { email });
 }
-async function customerLoginOTP(env, vars) {
-  return authOp(env, AUTH_OPS.customerLoginOTP, vars);
+async function loginWithOTP(env, vars) {
+  return authOp(env, AUTH_OPS.loginWithOTP, vars);
 }
-async function customerRefreshToken(env, refreshToken) {
-  return authOp(env, AUTH_OPS.customerRefreshToken, { refreshToken });
+async function refreshTokens(env, refreshToken) {
+  return authOp(env, AUTH_OPS.refreshToken, { refreshToken });
 }
-async function customerLoginWithProvider(env, input) {
-  return authOp(env, AUTH_OPS.customerLoginWithProvider, { input });
+async function loginWithProvider(env, input) {
+  return authOp(env, AUTH_OPS.loginWithProvider, { input });
 }
-async function customerProviderCallback(env, input) {
-  return authOp(env, AUTH_OPS.customerProviderCallback, { input });
+async function providerCallback(env, input) {
+  return authOp(env, AUTH_OPS.providerCallback, { input });
 }
 async function getAuthProviders(env) {
   return authOp(env, AUTH_OPS.authProviders);
@@ -1077,42 +1098,42 @@ async function getAuthProviders(env) {
 async function saveSession(adapter, result) {
   await adapter.set(TOKEN_KEY, result.token);
   await adapter.set(REFRESH_KEY, result.refreshToken);
-  if (!result.customerId) {
-    return await getSessionCustomer(adapter) ?? { id: "", email: "" };
+  if (!result.userId) {
+    return await getSessionUser(adapter) ?? { id: "", email: "" };
   }
-  await adapter.set(CUSTOMER_ID_KEY, result.customerId);
+  await adapter.set(USER_ID_KEY, result.userId);
   await adapter.set(EMAIL_KEY, result.email);
-  return { id: result.customerId, email: result.email };
+  return { id: result.userId, email: result.email };
 }
 async function clearSession(adapter) {
   await adapter.unset(TOKEN_KEY);
   await adapter.unset(REFRESH_KEY);
-  await adapter.unset(CUSTOMER_ID_KEY);
+  await adapter.unset(USER_ID_KEY);
   await adapter.unset(EMAIL_KEY);
 }
 async function getSessionToken(adapter) {
   return await adapter.get(TOKEN_KEY) ?? null;
 }
-async function getSessionCustomer(adapter) {
-  const id = await adapter.get(CUSTOMER_ID_KEY) ?? null;
+async function getSessionUser(adapter) {
+  const id = await adapter.get(USER_ID_KEY) ?? null;
   const email = await adapter.get(EMAIL_KEY) ?? null;
   if (!id) return null;
   return { id, email: email ?? "" };
 }
-async function loginWithPassword(adapter, env, vars) {
-  return saveSession(adapter, await customerLogin(env, vars));
+async function signInWithPassword(adapter, env, vars) {
+  return saveSession(adapter, await login(env, vars));
 }
-async function registerWithPassword(adapter, env, vars) {
-  return saveSession(adapter, await customerRegister(env, vars));
+async function signUpWithPassword(adapter, env, vars) {
+  return saveSession(adapter, await register(env, vars));
 }
-async function loginWithOTP(adapter, env, vars) {
-  return saveSession(adapter, await customerLoginOTP(env, vars));
+async function signInWithOTP(adapter, env, vars) {
+  return saveSession(adapter, await loginWithOTP(env, vars));
 }
 async function refreshSession(adapter, env) {
   const refreshToken = await adapter.get(REFRESH_KEY) ?? null;
   if (!refreshToken) return null;
   try {
-    const result = await customerRefreshToken(env, refreshToken);
+    const result = await refreshTokens(env, refreshToken);
     await saveSession(adapter, result);
     return { token: result.token, refreshToken: result.refreshToken };
   } catch {
@@ -1256,7 +1277,8 @@ var GRANT_TABLE = [
   ["roles:write", false, [], []],
   ["projects:read", false, [], []],
   ["projects:write", false, [], []],
-  ["project:manage", false, [], ["records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:stand", false, [], []],
+  ["project:manage", false, [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", false, [], []],
   ["projects:delete", false, [], []],
   ["tenants:read", false, [], []],
@@ -1269,12 +1291,14 @@ var GRANT_TABLE = [
   ["usage:read", false, [], []],
   ["controlkeys:read", false, [], []],
   ["controlkeys:write", false, [], []],
+  ["tenantsigninproviders:read", false, [], []],
+  ["tenantsigninproviders:write", false, [], []],
   ["tenanthooks:read", false, [], []],
   ["tenanthooks:write", false, [], []],
   ["apps:install", false, [], []],
-  ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
+  ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "tenantsigninproviders:read", "tenantsigninproviders:write", "apps:install"]],
   ["platform:read", false, [], []],
-  ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace", "users:setup"]],
+  ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
   ["platform:create_workspace", false, [], []],
   ["users:read", false, ["own", "named", "all"], []],
   ["users:write", false, ["own", "all"], []],
@@ -1373,15 +1397,15 @@ function holds(held, required) {
 
 // src/auth/access.ts
 function accessFrom(who) {
-  const customer = who?.credential?.customer;
-  if (!customer?.id) return null;
+  const user = who?.credential?.user;
+  if (!user?.id) return null;
   return {
-    customerId: customer.id,
-    roles: Array.isArray(customer.roles) ? [...customer.roles] : null,
+    userId: user.id,
+    roles: Array.isArray(user.roles) ? [...user.roles] : null,
     scopes: [...who?.authority?.effective ?? []]
   };
 }
-async function customerAccess(env, options) {
+async function userAccess(env, options) {
   return accessFrom(await authOp(env, AUTH_OPS.whoami, void 0, options));
 }
 async function getSessionAccess(adapter, env) {
@@ -1461,14 +1485,14 @@ function createFoirSessionClient(config) {
       } catch {
         return cached;
       }
-      if (!json.access_token || !json.customer_id) return cached;
+      if (!json.access_token || !json.user_id) return cached;
       const expiresIn = typeof json.expires_in === "number" ? json.expires_in : 0;
       const next = {
         token: json.access_token,
         expiresAt: Date.now() + expiresIn * 1e3,
-        user: { customerId: json.customer_id, email: json.email ?? "" }
+        user: { userId: json.user_id, email: json.email ?? "" }
       };
-      const changed = cached?.user.customerId !== next.user.customerId;
+      const changed = cached?.user.userId !== next.user.userId;
       cached = next;
       scheduleRefresh(next.expiresAt);
       if (changed) emit(next.user);
@@ -1569,13 +1593,13 @@ function FoirProvider({
   const adapterRef = useRef(adapter ?? createLocalStorageAdapter());
   if (adapter && adapter !== adapterRef.current) adapterRef.current = adapter;
   const [status, setStatus] = useState("loading");
-  const [customer, setCustomer] = useState(null);
+  const [user, setUser] = useState(null);
   const [access, setAccess] = useState(null);
   const [accessStatus, setAccessStatus] = useState("idle");
   const accessRead = useRef(0);
   const accessPending = useRef(null);
   const apply = useCallback((c) => {
-    setCustomer(c);
+    setUser(c);
     setStatus(c ? "authenticated" : "unauthenticated");
     accessRead.current += 1;
     setAccess(null);
@@ -1600,10 +1624,10 @@ function FoirProvider({
     void (async () => {
       if (hosted) {
         const u = await hosted.getUser();
-        if (!cancelled) apply(u ? { id: u.customerId, email: u.email } : null);
+        if (!cancelled) apply(u ? { id: u.userId, email: u.email } : null);
         return;
       }
-      const c = await getSessionCustomer(adapterRef.current);
+      const c = await getSessionUser(adapterRef.current);
       if (!cancelled) apply(c);
     })();
     return () => {
@@ -1618,7 +1642,7 @@ function FoirProvider({
     (action) => {
       if (hosted) {
         throw new Error(
-          `[foir] ${action}() is not available in hostedSession mode \u2014 the customer signs in at your Foir login domain. Redirect to hostedSignInUrl() instead.`
+          `[foir] ${action}() is not available in hostedSession mode \u2014 the user signs in at your Foir login domain. Redirect to hostedSignInUrl() instead.`
         );
       }
     },
@@ -1627,16 +1651,16 @@ function FoirProvider({
   const signIn = useCallback(
     async (vars) => {
       assertTokenMode("signIn");
-      const c = await loginWithPassword(adapterRef.current, envRef.current, vars);
+      const c = await signInWithPassword(adapterRef.current, envRef.current, vars);
       apply(c);
       return c;
     },
     [apply, assertTokenMode]
   );
-  const register = useCallback(
+  const register2 = useCallback(
     async (vars) => {
       assertTokenMode("register");
-      const c = await registerWithPassword(adapterRef.current, envRef.current, vars);
+      const c = await signUpWithPassword(adapterRef.current, envRef.current, vars);
       apply(c);
       return c;
     },
@@ -1645,14 +1669,14 @@ function FoirProvider({
   const requestOtp = useCallback(
     (email) => {
       assertTokenMode("requestOtp");
-      return customerRequestOTP(envRef.current, email);
+      return requestOTP(envRef.current, email);
     },
     [assertTokenMode]
   );
   const signInWithOtp = useCallback(
     async (vars) => {
       assertTokenMode("signInWithOtp");
-      const c = await loginWithOTP(adapterRef.current, envRef.current, vars);
+      const c = await signInWithOTP(adapterRef.current, envRef.current, vars);
       apply(c);
       return c;
     },
@@ -1661,7 +1685,7 @@ function FoirProvider({
   const signInWithProvider = useCallback(
     async (providerKey, opts) => {
       assertTokenMode("signInWithProvider");
-      const res = await customerLoginWithProvider(envRef.current, {
+      const res = await loginWithProvider(envRef.current, {
         providerKey,
         ...opts
       });
@@ -1674,7 +1698,7 @@ function FoirProvider({
   const completeProviderLogin = useCallback(
     async (input) => {
       assertTokenMode("completeProviderLogin");
-      const result = await customerProviderCallback(envRef.current, input);
+      const result = await providerCallback(envRef.current, input);
       const c = await saveSession(adapterRef.current, result);
       apply(c);
       return c;
@@ -1710,7 +1734,7 @@ function FoirProvider({
     const pending = (async () => {
       try {
         const next = hosted ? await hosted.getToken().then(
-          (bearerToken) => bearerToken ? customerAccess(envRef.current, { bearerToken }) : null
+          (bearerToken) => bearerToken ? userAccess(envRef.current, { bearerToken }) : null
         ) : await getSessionAccess(adapterRef.current, envRef.current);
         if (accessRead.current !== read) return;
         setAccess(next);
@@ -1745,7 +1769,7 @@ function FoirProvider({
   const value = useMemo(
     () => ({
       status,
-      customer,
+      user,
       access,
       accessStatus,
       loadAccess,
@@ -1753,7 +1777,7 @@ function FoirProvider({
       env,
       adapter: adapterRef.current,
       signIn,
-      register,
+      register: register2,
       requestOtp,
       signInWithOtp,
       signInWithProvider,
@@ -1766,14 +1790,14 @@ function FoirProvider({
     }),
     [
       status,
-      customer,
+      user,
       access,
       accessStatus,
       loadAccess,
       ensureAccess,
       env,
       signIn,
-      register,
+      register2,
       requestOtp,
       signInWithOtp,
       signInWithProvider,
@@ -1795,16 +1819,16 @@ function useFoirContext() {
   return ctx;
 }
 function useFoirSession() {
-  const { status, customer } = useFoirContext();
+  const { status, user } = useFoirContext();
   return {
     status,
-    customer,
+    user,
     isLoading: status === "loading",
     isAuthenticated: status === "authenticated"
   };
 }
 function useFoirUser() {
-  return useFoirContext().customer;
+  return useFoirContext().user;
 }
 function useFoirAccess() {
   const { status, access, accessStatus, loadAccess, ensureAccess } = useFoirContext();
@@ -1827,7 +1851,7 @@ function useFoirAccess() {
 function useFoirAuth() {
   const {
     signIn,
-    register,
+    register: register2,
     requestOtp,
     signInWithOtp,
     signInWithProvider,
@@ -1840,7 +1864,7 @@ function useFoirAuth() {
   } = useFoirContext();
   return {
     signIn,
-    register,
+    register: register2,
     requestOtp,
     signInWithOtp,
     signInWithProvider,
@@ -1948,8 +1972,8 @@ function SignIn({
   if (hostedUrl) {
     return /* @__PURE__ */ jsx3("div", { className, "data-foir-signin": true, children: /* @__PURE__ */ jsx3("a", { href: hostedUrl, "data-foir-hosted-login": true, style: styled ? submitStyle : void 0, children: "Sign in" }) });
   }
-  const finish = (customer) => {
-    onSignIn?.(customer);
+  const finish = (user) => {
+    onSignIn?.(user);
     if (afterSignInUrl && typeof window !== "undefined") {
       window.location.assign(afterSignInUrl);
     }
@@ -2225,7 +2249,7 @@ async function uploadFeedbackAttachment(client, screenshot, fetchImpl = globalTh
   const files = client.ns.files;
   if (!files) {
     throw new Error(
-      "[foir] this client cannot reach the files namespace, so a screenshot cannot be uploaded. Attaching one needs `files:write` on the key and on the signed-in customer's role."
+      "[foir] this client cannot reach the files namespace, so a screenshot cannot be uploaded. Attaching one needs `files:write` on the key and on the signed-in user's role."
     );
   }
   const ticket = readUploadTicket(
@@ -2617,7 +2641,7 @@ function failureCopy(fault) {
 function reportFault(fault, err, action) {
   if (fault.kind === "scope") {
     console.error(
-      `[foir] <FoirFeedback>: the API refused with "missing required scope: ${fault.scope}". This is not a bad API key: the key reached the surface. The signed-in CUSTOMER's role does not grant ${fault.scope}, and a new project's default customer role does not carry the notes scopes. Add it to the role that customer holds, or to the project's default customer role, and this works with no code change.`,
+      `[foir] <FoirFeedback>: the API refused with "missing required scope: ${fault.scope}". This is not a bad API key: the key reached the surface. The signed-in USER's role does not grant ${fault.scope}, and a new project's default user role does not carry the notes scopes. Add it to the role that user holds, or to the project's default user role, and this works with no code change.`,
       err
     );
     return;

package/dist/realtime/index.d.ts

@@ -11,7 +11,7 @@
  * provider's url params current for whenever it next reconnects.
  *
  * Agnostic by design: token-agnostic (caller supplies `getToken` — an internal
- * mint for admin, a customer access token for an app), persistence-agnostic
+ * mint for the console, a user access token for an app), persistence-agnostic
  * (never persists), doc-schema-agnostic (caller owns the `Y.Doc` + shared types).
  *
  * `yjs` + `y-websocket` are OPTIONAL peer deps gated to this subpath, so a

package/dist/server/callback-client.d.ts

@@ -12,8 +12,8 @@
  *     pushes a DLQ entry.
  *   - `progress({pct, message, metadata})` — non-terminal update; the
  *     monotonic guard at the platform DB layer drops out-of-order packets.
- *   - `cancel()` — extension self-cancels (rare; admins normally drive
- *     cancel via the admin app's ConnectRPC path).
+ *   - `cancel()`: the extension cancels itself (rare; a run is normally
+ *     cancelled from the console).
  *
  * Each call carries:
  *   - `Authorization: Bearer <callback.token>` — Ed25519 scoped token.
@@ -42,7 +42,7 @@ export interface CallbackResult {
      */
     status: string;
     /**
-     * True when the admin cancelled the execution while the extension was
+     * True when someone cancelled the execution while the extension was
      * processing — the platform refused to overwrite the cancelled state.
      * Extensions should stop work and (optionally) call `fail('CANCELLED')`.
      */
@@ -66,7 +66,7 @@ export interface CallbackClient<TResult = unknown> {
         details?: Record<string, unknown>;
     }): Promise<CallbackResult>;
     /**
-     * Returns `{cancelled: true}` when the admin has cancelled — extension
+     * Returns `{cancelled: true}` when someone has cancelled it: the extension
      * must stop work. `applied: false` means the monotonic guard dropped
      * the update because pct was lower than the persisted value.
      */

package/dist/server/events-client.d.ts

@@ -18,12 +18,12 @@
  * ```
  *
  * ---------------------------------------------------------------------------
- * OPERATOR SURFACE. This is not a customer-facing capability.
+ * PROJECT SURFACE. Your app's users do not reach it.
  * ---------------------------------------------------------------------------
  *
  * DECIDED 2026-08-04. The event log is reachable by an `sk_` api key
- * and by an admin session. It is NOT reachable by a customer token, there is no
- * customer lane for it on api-public, and a `pk_` key can never be minted
+ * and by a console session. It is NOT reachable by a user token, there is no
+ * user lane for it on api-public, and a `pk_` key can never be minted
  * holding `events:read` at all.
  *
  * The reason is a predicate asymmetry rather than a policy preference.
@@ -31,7 +31,7 @@
  * owner, admin_owner, access_mode, grantee, comp_parent, read_borrow and
  * slice_parent terms on top of it. A containment-only read over the log
  * therefore describes rows whose underlying records the same caller could not
- * read — and every row carries `actor`, naming which OTHER customer acted. In a
+ * read — and every row carries `actor`, naming which OTHER user acted. In a
  * project with owner confinement that is a per-record activity feed of other
  * people's actions.
  *
@@ -51,13 +51,13 @@
  *      built the client.
  *
  *   3. **There is no `bearerToken` option, and an `Authorization` header is
- *      refused.** On api-public a request presenting `sk_` plus a customer
- *      bearer resolves the CUSTOMER as the authority, and `events` is stripped
- *      from every customer authority upstream — so attaching a signed-in
- *      shopper's token to an operator read turns a working call into a 403 that
+ *      refused.** On api-public a request presenting `sk_` plus a user
+ *      bearer resolves the USER as the authority, and `events` is stripped
+ *      from every user authority upstream — so attaching a signed-in
+ *      shopper's token to a project read turns a working call into a 403 that
  *      reads like a scope problem. Refusing it here says what actually happened.
  *
- * Widening this later is easy. Teaching customers a capability they do not have
+ * Widening this later is easy. Teaching users a capability they do not have
  * is a support burden that cannot be retracted.
  *
  * ---------------------------------------------------------------------------
@@ -79,7 +79,7 @@ export declare const FOIR_EVENTS_PATH = "/v1/events";
 /**
  * The scope an `sk_` key must hold. Never mintable on a `pk_` — `events` is
  * absent from the platform's `publicSafeScopeResources` — and never present in a
- * customer's resolved authority.
+ * user's resolved authority.
  */
 export declare const FOIR_EVENTS_SCOPE = "events:read";
 /**
@@ -91,9 +91,9 @@ export declare const FOIR_EVENTS_SCOPE = "events:read";
 export declare const FOIR_EVENTS_RETENTION_DAYS = 90;
 /** Who caused an event. `null` when the emit site attributed nobody. */
 export interface FoirEventActor {
-    /** e.g. `"customer"`, `"admin"`, `"api_key"`, `"system"`. */
+    /** e.g. `"user"`, `"api_key"`, `"system"`. */
     kind?: string;
-    /** e.g. `"customer:cus_123"`. */
+    /** e.g. `"user:usr_123"`. */
     ref?: string;
     [key: string]: unknown;
 }
@@ -119,7 +119,7 @@ export interface FoirEvent {
      * The event's own flat keys, plus `state` and `stateSchema`.
      *
      * `state` is the resource AS OF the event — self-contained, not a pointer to
-     * current state — for the customer, session, operation and workspace-plane
+     * current state — for the user, session, operation and workspace-plane
      * families. It is null for `record.*` events, deliberately and permanently:
      * `events.view` is plain tenant/project containment while `record.view`
      * carries owner, grant, borrow and per-field terms, so a copy of record data
@@ -203,12 +203,12 @@ export interface FoirEventsClientConfig {
      * An admin key holding `events:read`.
      *
      * A publishable or a server key is refused here rather than at the server:
-     * see the operator note at the top of this file.
+     * see the note at the top of this file.
      */
     apiKey: string;
     /**
-     * Extra headers. An `Authorization` header is refused: a customer bearer
-     * flips api-public's resolved authority to the customer, and no customer
+     * Extra headers. An `Authorization` header is refused: a user bearer
+     * flips api-public's resolved authority to the user, and no user
      * authority can contain `events:read`.
      */
     headers?: Readonly<Record<string, string>>;

package/dist/server/operation-types.d.ts

@@ -147,17 +147,17 @@ export interface OperationContext {
     /** Project ID */
     projectId: string;
     /**
-     * The principal that started the run. Always present, and the empty string
-     * when the run has none, as a hook's run does.
+     * Who started the run. Always present, and the empty string when nobody
+     * did, as for a hook's run.
      */
-    userId: string;
+    actorId: string;
     /**
-     * The customer the run acts for, when it acts for one: the signed-in
-     * customer who ran it, or the owner of the record whose event fired the
-     * hook. The dispatch token carries the same customer, so a client built from
-     * it acts for them too.
+     * The user the run acts for, when it acts for one: the signed-in user who
+     * ran it, or the owner of the record whose event fired the hook. The
+     * dispatch token carries the same user, so a client built from it acts for
+     * them too.
      */
-    customerId?: string;
+    userId?: string;
     /** When the platform built this body, RFC 3339 in UTC to the second. */
     timestamp: string;
 }