@foir/sdk 0.21.0 → 0.23.0

package/dist/realtime/index.d.ts

@@ -11,7 +11,7 @@
  * provider's url params current for whenever it next reconnects.
  *
  * Agnostic by design: token-agnostic (caller supplies `getToken` — an internal
- * mint for admin, a customer access token for an app), persistence-agnostic
+ * mint for the console, a user access token for an app), persistence-agnostic
  * (never persists), doc-schema-agnostic (caller owns the `Y.Doc` + shared types).
  *
  * `yjs` + `y-websocket` are OPTIONAL peer deps gated to this subpath, so a

package/dist/server/callback-client.d.ts

@@ -12,8 +12,8 @@
  *     pushes a DLQ entry.
  *   - `progress({pct, message, metadata})` — non-terminal update; the
  *     monotonic guard at the platform DB layer drops out-of-order packets.
- *   - `cancel()` — extension self-cancels (rare; admins normally drive
- *     cancel via the admin app's ConnectRPC path).
+ *   - `cancel()`: the extension cancels itself (rare; a run is normally
+ *     cancelled from the console).
  *
  * Each call carries:
  *   - `Authorization: Bearer <callback.token>` — Ed25519 scoped token.
@@ -42,7 +42,7 @@ export interface CallbackResult {
      */
     status: string;
     /**
-     * True when the admin cancelled the execution while the extension was
+     * True when someone cancelled the execution while the extension was
      * processing — the platform refused to overwrite the cancelled state.
      * Extensions should stop work and (optionally) call `fail('CANCELLED')`.
      */
@@ -66,7 +66,7 @@ export interface CallbackClient<TResult = unknown> {
         details?: Record<string, unknown>;
     }): Promise<CallbackResult>;
     /**
-     * Returns `{cancelled: true}` when the admin has cancelled — extension
+     * Returns `{cancelled: true}` when someone has cancelled it: the extension
      * must stop work. `applied: false` means the monotonic guard dropped
      * the update because pct was lower than the persisted value.
      */

package/dist/server/events-client.d.ts

@@ -7,7 +7,7 @@
  *
  * const events = createEventsClient({
  *   apiUrl: process.env.PLATFORM_API_URL!,
- *   apiKey: process.env.FOIR_SECRET_KEY!, // sk_…, holding events:read
+ *   apiKey: process.env.FOIR_SECRET_KEY!, // an admin key, holding events:read
  * });
  *
  * const page = await events.list({ after: lastSeq, limit: 500 });
@@ -18,12 +18,12 @@
  * ```
  *
  * ---------------------------------------------------------------------------
- * OPERATOR SURFACE. This is not a customer-facing capability.
+ * PROJECT SURFACE. Your app's users do not reach it.
  * ---------------------------------------------------------------------------
  *
- * DECIDED 2026-08-04. The event log is reachable by an `sk_` api key
- * and by an admin session. It is NOT reachable by a customer token, there is no
- * customer lane for it on api-public, and a `pk_` key can never be minted
+ * DECIDED 2026-08-04. The event log is reachable by an admin key
+ * and by a console session. It is NOT reachable by a user token, there is no
+ * user lane for it on api-public, and a publishable key can never be minted
  * holding `events:read` at all.
  *
  * The reason is a predicate asymmetry rather than a policy preference.
@@ -31,7 +31,7 @@
  * owner, admin_owner, access_mode, grantee, comp_parent, read_borrow and
  * slice_parent terms on top of it. A containment-only read over the log
  * therefore describes rows whose underlying records the same caller could not
- * read — and every row carries `actor`, naming which OTHER customer acted. In a
+ * read — and every row carries `actor`, naming which OTHER user acted. In a
  * project with owner confinement that is a per-record activity feed of other
  * people's actions.
  *
@@ -39,25 +39,25 @@
  *
  *   1. **It lives on `@foir/sdk/server` and nowhere else.** Not `./data`, not
  *      `./client`, not `./react`. Those subpaths are the ones a storefront
- *      bundles, and `./data` in particular is routinely constructed with a `pk_`
+ *      bundles, and `./data` in particular is routinely constructed with a publishable key
  *      key in browser-reachable code. `src/server/__tests__/events-client.test.ts`
  *      walks the import graph of every published subpath and fails if this
  *      module becomes reachable from one that ships to a browser — because
  *      "we only documented it on the server" is not a property anything checks.
  *
- *   2. **A `pk_` key is refused at construction**, before a request is made. The
+ *   2. **A publishable key is refused at construction**, before a request is made. The
  *      server would refuse it anyway (403), but a 403 at 3am in a deploy log is
  *      a worse teacher than a thrown error naming the key type at the line that
  *      built the client.
  *
  *   3. **There is no `bearerToken` option, and an `Authorization` header is
- *      refused.** On api-public a request presenting `sk_` plus a customer
- *      bearer resolves the CUSTOMER as the authority, and `events` is stripped
- *      from every customer authority upstream — so attaching a signed-in
- *      shopper's token to an operator read turns a working call into a 403 that
+ *      refused.** On api-public a request presenting an admin key plus a user
+ *      bearer resolves the USER as the authority, and `events` is stripped
+ *      from every user authority upstream — so attaching a signed-in
+ *      shopper's token to a project read turns a working call into a 403 that
  *      reads like a scope problem. Refusing it here says what actually happened.
  *
- * Widening this later is easy. Teaching customers a capability they do not have
+ * Widening this later is easy. Teaching users a capability they do not have
  * is a support burden that cannot be retracted.
  *
  * ---------------------------------------------------------------------------
@@ -77,9 +77,9 @@ import { type FoirReconnectPolicy, type FoirSubscription, type FoirSubscriptionH
 /** The path `GET /v1/events` is mounted on, inside api-public's api-key group. */
 export declare const FOIR_EVENTS_PATH = "/v1/events";
 /**
- * The scope an `sk_` key must hold. Never mintable on a `pk_` — `events` is
+ * The scope an admin key must hold. Never mintable on a publishable key: `events` is
  * absent from the platform's `publicSafeScopeResources` — and never present in a
- * customer's resolved authority.
+ * user's resolved authority.
  */
 export declare const FOIR_EVENTS_SCOPE = "events:read";
 /**
@@ -91,9 +91,9 @@ export declare const FOIR_EVENTS_SCOPE = "events:read";
 export declare const FOIR_EVENTS_RETENTION_DAYS = 90;
 /** Who caused an event. `null` when the emit site attributed nobody. */
 export interface FoirEventActor {
-    /** e.g. `"customer"`, `"admin"`, `"api_key"`, `"system"`. */
+    /** e.g. `"user"`, `"api_key"`, `"system"`. */
     kind?: string;
-    /** e.g. `"customer:cus_123"`. */
+    /** e.g. `"user:usr_123"`. */
     ref?: string;
     [key: string]: unknown;
 }
@@ -119,7 +119,7 @@ export interface FoirEvent {
      * The event's own flat keys, plus `state` and `stateSchema`.
      *
      * `state` is the resource AS OF the event — self-contained, not a pointer to
-     * current state — for the customer, session, operation and workspace-plane
+     * current state — for the user, session, operation and workspace-plane
      * families. It is null for `record.*` events, deliberately and permanently:
      * `events.view` is plain tenant/project containment while `record.view`
      * carries owner, grant, borrow and per-field terms, so a copy of record data
@@ -203,12 +203,12 @@ export interface FoirEventsClientConfig {
      * An admin key holding `events:read`.
      *
      * A publishable or a server key is refused here rather than at the server:
-     * see the operator note at the top of this file.
+     * see the note at the top of this file.
      */
     apiKey: string;
     /**
-     * Extra headers. An `Authorization` header is refused: a customer bearer
-     * flips api-public's resolved authority to the customer, and no customer
+     * Extra headers. An `Authorization` header is refused: a user bearer
+     * flips api-public's resolved authority to the user, and no user
      * authority can contain `events:read`.
      */
     headers?: Readonly<Record<string, string>>;

package/dist/server/operation-types.d.ts

@@ -147,17 +147,17 @@ export interface OperationContext {
     /** Project ID */
     projectId: string;
     /**
-     * The principal that started the run. Always present, and the empty string
-     * when the run has none, as a hook's run does.
+     * Who started the run. Always present, and the empty string when nobody
+     * did, as for a hook's run.
      */
-    userId: string;
+    actorId: string;
     /**
-     * The customer the run acts for, when it acts for one: the signed-in
-     * customer who ran it, or the owner of the record whose event fired the
-     * hook. The dispatch token carries the same customer, so a client built from
-     * it acts for them too.
+     * The user the run acts for, when it acts for one: the signed-in user who
+     * ran it, or the owner of the record whose event fired the hook. The
+     * dispatch token carries the same user, so a client built from it acts for
+     * them too.
      */
-    customerId?: string;
+    userId?: string;
     /** When the platform built this body, RFC 3339 in UTC to the second. */
     timestamp: string;
 }

package/dist/server/require-scoped-token.d.ts

@@ -120,12 +120,12 @@ export interface ScopedTokenIngress {
      */
     orgId: string | null;
     /**
-     * The customer the run acts for, when it acts for one: the signed-in
-     * customer who ran the operation, or the owner of the record whose event
+     * The user the run acts for, when it acts for one: the signed-in
+     * user who ran the operation, or the owner of the record whose event
      * fired it. Verified with the rest of the token, so it is the one to trust
      * over anything in the input.
      */
-    customerId?: string;
+    userId?: string;
     /** When the token stops being accepted. There is no refresh: finish, or report, before it. */
     expiresAt: Date;
     /** The token's own id (`jti`). The run's id on a dispatch that carries no other. */

package/dist/server/types.d.ts

@@ -7,7 +7,7 @@
 export interface ServerClientOptions {
     /** Base URL for the platform API (e.g., 'https://api.example.com'). */
     baseUrl: string;
-    /** Project-scoped API key (sk_* format). */
+    /** A project's admin key (foir_adm_). */
     apiKey: string;
     /**
      * Optional config key. Retained for backwards compatibility with older
@@ -16,7 +16,7 @@ export interface ServerClientOptions {
     configKey?: string;
 }
 /**
- * Where an editor iframe should appear in the admin record editor.
+ * Where an editor iframe should appear in the console's record editor.
  */
 export interface EditorPlacement {
     /** 'main-editor' replaces / augments the content tab; 'sidebar' renders in the sidebar. */

package/dist/server/verify-scoped-token.d.ts

@@ -38,9 +38,9 @@ export interface ScopedTokenClaims {
     iat: number;
     ctx?: Record<string, string>;
     /**
-     * The customer the token acts for, when it acts for one: the signed-in
-     * customer who ran the operation, or the owner of the record whose event
-     * fired it. `requireScopedToken` answers it as `customerId`.
+     * The user the token acts for, when it acts for one: the signed-in
+     * user who ran the operation, or the owner of the record whose event
+     * fired it. `requireScopedToken` answers it as `userId`.
      */
     cid?: string;
 }

package/dist/server.js

@@ -74,120 +74,123 @@ async function verifyWebhookSignature(payload, signature, secret) {
 
 // src/auth/grant-table.generated.ts
 var GRANT_TABLE = [
-  ["records:read", true, ["own", "all"], []],
-  ["records:create", true, [], []],
-  ["records:write", true, ["own", "all"], []],
-  ["records:delete", true, ["own", "all"], []],
-  ["records:publish", true, ["own", "all"], []],
-  ["records:attribute", true, [], []],
-  ["search:read", true, [], []],
-  ["embeddings:read", false, [], []],
-  ["embeddings:write", false, [], []],
-  ["schemas:read", false, [], []],
-  ["drafts:read", false, [], []],
-  ["files:read", false, ["own", "all"], []],
-  ["files:write", false, ["own", "all"], []],
-  ["files:delete", false, ["own", "all"], []],
-  ["notifications:read", false, ["own", "all"], []],
-  ["notifications:write", false, ["own", "named", "all"], []],
-  ["notifications:consent", false, [], []],
-  ["pushcredentials:read", false, [], []],
-  ["pushcredentials:write", false, [], []],
-  ["notes:read", false, ["own", "all"], []],
-  ["notes:write", false, ["own", "all"], []],
-  ["notes:create", false, [], []],
-  ["approvals:read", false, [], []],
-  ["approvals:write", false, [], []],
-  ["rooms:read", true, [], []],
-  ["rooms:write", true, [], []],
-  ["presence:read", true, [], []],
-  ["operations:read", false, [], []],
-  ["operations:execute", true, [], []],
-  ["operations:write", false, [], []],
-  ["operations:complete", false, [], []],
-  ["status:write", false, [], []],
-  ["appconfig:read", false, [], []],
-  ["schedules:read", false, [], []],
-  ["schedules:write", false, [], []],
-  ["hooks:read", false, [], []],
-  ["hooks:write", false, [], []],
-  ["relyingparties:read", false, [], []],
-  ["relyingparties:write", false, [], []],
-  ["domains:read", false, [], []],
-  ["domains:write", false, [], []],
-  ["secrets:read", false, [], []],
-  ["secrets:list", false, [], []],
-  ["secrets:put", false, [], []],
-  ["secrets:delete", false, [], []],
-  ["appsecrets:read", false, [], []],
-  ["appsecrets:list", false, [], []],
-  ["appsecrets:put", false, [], []],
-  ["appsecrets:delete", false, [], []],
-  ["opsecrets:read", false, [], []],
-  ["opsecrets:write", false, [], []],
-  ["settings:read", false, [], []],
-  ["settings:write", false, [], []],
-  ["designtokens:read", false, [], []],
-  ["designtokens:write", false, [], []],
-  ["models:read", false, [], []],
-  ["models:write", false, [], []],
-  ["configs:read", false, [], []],
-  ["configs:write", false, [], []],
-  ["apps:read", false, [], []],
-  ["apps:write", false, [], []],
-  ["events:read", false, [], []],
-  ["targeting:debug", false, [], []],
-  ["visitors:forward", false, [], []],
-  ["apikeys:read", false, [], []],
-  ["apikeys:write", false, [], []],
-  ["organizations:read", false, [], []],
-  ["organizations:write", false, [], []],
-  ["organizations:create", false, [], []],
-  ["organizations:delete", false, [], []],
-  ["organizations:reach", false, [], []],
-  ["members:read", false, [], []],
-  ["members:write", false, [], []],
-  ["roles:read", false, [], []],
-  ["roles:write", false, [], []],
-  ["projects:read", false, [], []],
-  ["projects:write", false, [], []],
-  ["project:manage", false, [], ["records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
-  ["projects:create", false, [], []],
-  ["projects:delete", false, [], []],
-  ["tenants:read", false, [], []],
-  ["tenants:write", false, [], []],
-  ["tenants:delete", false, [], []],
-  ["audit:read", false, [], []],
-  ["export:run", false, [], []],
-  ["billing:read", false, [], []],
-  ["billing:manage", false, [], []],
-  ["usage:read", false, [], []],
-  ["controlkeys:read", false, [], []],
-  ["controlkeys:write", false, [], []],
-  ["tenanthooks:read", false, [], []],
-  ["tenanthooks:write", false, [], []],
-  ["apps:install", false, [], []],
-  ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
-  ["platform:read", false, [], []],
-  ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace", "users:setup"]],
-  ["platform:create_workspace", false, [], []],
-  ["users:read", false, ["own", "named", "all"], []],
-  ["users:write", false, ["own", "all"], []],
-  ["users:setup", false, [], []],
-  ["users:delete", false, ["own", "all"], []],
-  ["users:create", false, [], []],
-  ["identities:read", false, [], []],
-  ["identities:delete", false, [], []],
-  ["usersecrets:read", false, [], []],
-  ["usersecrets:list", false, [], []],
-  ["usersecrets:put", false, [], []],
-  ["usersecrets:delete", false, [], []],
-  ["auth:login_with_foir", false, [], []],
-  ["signinproviders:read", false, [], []],
-  ["signinproviders:write", false, [], []]
+  ["records:read", "model", ["own", "all"], []],
+  ["records:create", "model", [], []],
+  ["records:write", "model", ["own", "all"], []],
+  ["records:delete", "model", ["own", "all"], []],
+  ["records:publish", "model", ["own", "all"], []],
+  ["records:attribute", "model", [], []],
+  ["search:read", "model", [], []],
+  ["embeddings:read", "none", [], []],
+  ["embeddings:write", "none", [], []],
+  ["schemas:read", "none", [], []],
+  ["drafts:read", "none", [], []],
+  ["files:read", "none", ["own", "all"], []],
+  ["files:write", "none", ["own", "all"], []],
+  ["files:delete", "none", ["own", "all"], []],
+  ["notifications:read", "none", ["own", "all"], []],
+  ["notifications:write", "none", ["own", "named", "all"], []],
+  ["notifications:consent", "none", [], []],
+  ["pushcredentials:read", "none", [], []],
+  ["pushcredentials:write", "none", [], []],
+  ["notes:read", "none", ["own", "all"], []],
+  ["notes:write", "none", ["own", "all"], []],
+  ["notes:create", "none", [], []],
+  ["approvals:read", "none", [], []],
+  ["approvals:write", "none", [], []],
+  ["rooms:read", "model", [], []],
+  ["rooms:write", "model", [], []],
+  ["presence:read", "model", [], []],
+  ["operations:read", "none", [], []],
+  ["operations:execute", "operation", [], []],
+  ["operations:write", "none", [], []],
+  ["operations:complete", "none", [], []],
+  ["status:write", "none", [], []],
+  ["appconfig:read", "none", [], []],
+  ["schedules:read", "none", [], []],
+  ["schedules:write", "none", [], []],
+  ["hooks:read", "none", [], []],
+  ["hooks:write", "none", [], []],
+  ["authclients:read", "none", [], []],
+  ["authclients:write", "none", [], []],
+  ["domains:read", "none", [], []],
+  ["domains:write", "none", [], []],
+  ["secrets:read", "none", [], []],
+  ["secrets:list", "none", [], []],
+  ["secrets:put", "none", [], []],
+  ["secrets:delete", "none", [], []],
+  ["appsecrets:read", "none", [], []],
+  ["appsecrets:list", "none", [], []],
+  ["appsecrets:put", "none", [], []],
+  ["appsecrets:delete", "none", [], []],
+  ["opsecrets:read", "none", [], []],
+  ["opsecrets:write", "none", [], []],
+  ["settings:read", "none", [], []],
+  ["settings:write", "none", [], []],
+  ["designtokens:read", "none", [], []],
+  ["designtokens:write", "none", [], []],
+  ["models:read", "none", [], []],
+  ["models:write", "none", [], []],
+  ["configs:read", "none", [], []],
+  ["configs:write", "none", [], []],
+  ["apps:read", "none", [], []],
+  ["apps:write", "none", [], []],
+  ["events:read", "none", [], []],
+  ["targeting:debug", "none", [], []],
+  ["visitors:forward", "none", [], []],
+  ["apikeys:read", "none", [], []],
+  ["apikeys:write", "none", [], []],
+  ["organizations:read", "none", [], []],
+  ["organizations:write", "none", [], []],
+  ["organizations:create", "none", [], []],
+  ["organizations:delete", "none", [], []],
+  ["organizations:reach", "none", [], []],
+  ["members:read", "none", [], []],
+  ["members:write", "none", [], []],
+  ["roles:read", "none", [], []],
+  ["roles:write", "none", [], []],
+  ["projects:read", "none", [], []],
+  ["projects:write", "none", [], []],
+  ["project:stand", "none", [], []],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["projects:create", "none", [], []],
+  ["projects:delete", "none", [], []],
+  ["tenants:read", "none", [], []],
+  ["tenants:write", "none", [], []],
+  ["tenants:delete", "none", [], []],
+  ["audit:read", "none", [], []],
+  ["export:run", "none", [], []],
+  ["billing:read", "none", [], []],
+  ["billing:manage", "none", [], []],
+  ["usage:read", "none", [], []],
+  ["controlkeys:read", "none", [], []],
+  ["controlkeys:write", "none", [], []],
+  ["tenanthooks:read", "none", [], []],
+  ["tenanthooks:write", "none", [], []],
+  ["apps:install", "none", [], []],
+  ["tenant:manage", "none", [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
+  ["platform:read", "none", [], []],
+  ["platform:manage", "none", [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
+  ["platform:create_workspace", "none", [], []],
+  ["users:read", "none", ["own", "named", "all"], []],
+  ["users:write", "none", ["own", "all"], []],
+  ["users:setup", "none", [], []],
+  ["users:delete", "none", ["own", "all"], []],
+  ["users:create", "none", [], []],
+  ["identities:read", "none", [], []],
+  ["identities:delete", "none", [], []],
+  ["usersecrets:read", "none", [], []],
+  ["usersecrets:list", "none", [], []],
+  ["usersecrets:put", "none", [], []],
+  ["usersecrets:delete", "none", [], []],
+  ["auth:login_with_foir", "none", [], []],
+  ["signinproviders:read", "none", [], []],
+  ["signinproviders:write", "none", [], []]
 ];
 
 // src/auth/grants.ts
+var FIELD_PERMISSIONS = ["records:read", "records:write"];
+var FIELD_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var index;
 function catalogue() {
   if (!index) {
@@ -223,8 +226,12 @@ function parseGrant(s) {
     let target = "";
     if (rest.startsWith(":")) {
       target = rest.slice(1);
-      if (!permission[1]) return null;
+      if (permission[1] === "none") return null;
       if (target === "" || /[: \t\n*]/.test(target)) return null;
+      const dot = target.indexOf(".");
+      if (permission[1] === "model" && dot >= 0) {
+        if (!FIELD_PERMISSIONS.includes(name) || dot === 0 || !FIELD_KEY.test(target.slice(dot + 1))) return null;
+      }
     }
     return { permission, reach, target };
   }
@@ -577,7 +584,7 @@ async function requireScopedToken(request, options) {
     // header, so the client presents exactly what this guard accepted.
     dispatch: { token: () => token, context: rawContext },
     orgId: typeof level === "string" ? level : null,
-    ...typeof claims.cid === "string" && claims.cid !== "" ? { customerId: claims.cid } : {},
+    ...typeof claims.cid === "string" && claims.cid !== "" ? { userId: claims.cid } : {},
     expiresAt: new Date(claims.exp * 1e3),
     tokenId: claims.jti
   };
@@ -639,9 +646,9 @@ async function readDispatch(request) {
   if (!isObject(context)) refuse(`body.context is ${describe(context)}, expected an object`);
   requireString(context, "tenantId", "body.context");
   requireString(context, "projectId", "body.context");
-  requireString(context, "userId", "body.context", true);
+  requireString(context, "actorId", "body.context", true);
   requireString(context, "timestamp", "body.context");
-  if (context.customerId !== void 0) requireString(context, "customerId", "body.context");
+  if (context.userId !== void 0) requireString(context, "userId", "body.context");
   const input = body.input;
   if (input !== null && !isObject(input)) {
     refuse(`body.input is ${describe(input)}, expected an object`);
@@ -862,8 +869,8 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
   downgrade;
   constructor(downgrade) {
     super(
-      `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
-      { graphQLErrors: [{ message: "customer token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
+      `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
+      { graphQLErrors: [{ message: "user token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
     );
     this.name = "FoirAuthDowngradedError";
     this.downgrade = downgrade;
@@ -871,7 +878,7 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
 };
 var FoirSessionExpiredError = class extends FoirRequestError {
   constructor(options) {
-    super("[foir] the customer session has expired and could not be refreshed: sign in again", {
+    super("[foir] the user session has expired and could not be refreshed: sign in again", {
       cause: options?.cause,
       graphQLErrors: [{ message: "session expired", extensions: { code: "SESSION_EXPIRED" } }]
     });
@@ -1037,10 +1044,7 @@ async function hmacSha256Hex(secret, body) {
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 function foirKeyKind(apiKey) {
   if (typeof apiKey !== "string") return void 0;
@@ -1131,7 +1135,7 @@ var FoirSocketTransport = class {
   constructor(config) {
     if (config.dispatch !== void 0) {
       throw new FoirRequestError(
-        "[foir] a client built from a dispatch token cannot subscribe. The subscription socket authenticates an api key, an admin token or a customer bearer, and has no path for a dispatch token. Queries and mutations made as the operation go to /graphql and work as they are."
+        "[foir] a client built from a dispatch token cannot subscribe. The subscription socket authenticates an api key, a console token or a user bearer, and has no path for a dispatch token. Queries and mutations made as the operation go to /graphql and work as they are."
       );
     }
     this.config = config;
@@ -1495,12 +1499,12 @@ function assertOperatorKey(apiKey) {
   const kind = foirKeyKind(key);
   if (kind === "publishable" || kind === "server") {
     throw new FoirRequestError(
-      `[foir] createEventsClient: the event log is an OPERATOR surface and a ${kind} key can never hold ${FOIR_EVENTS_SCOPE}: it is not mintable on an app's key. Use an admin key from a machine of your own. The log names which customer acted on records that whoever reads an app's key cannot themselves read.`
+      `[foir] createEventsClient: the event log is a project surface and a ${kind} key can never hold ${FOIR_EVENTS_SCOPE}: it is not mintable on an app's key. Use an admin key from a machine of your own. The log names which user acted on records that whoever reads an app's key cannot themselves read.`
     );
   }
   if (kind === void 0) {
     throw new FoirRequestError(
-      `[foir] createEventsClient: apiKey must be an admin key, got a key starting "${key.slice(0, 4)}". The event log is reachable by an admin key or an admin session only.`
+      `[foir] createEventsClient: apiKey must be an admin key, got a key starting "${key.slice(0, 4)}". The event log is reachable by an admin key or a console session only.`
     );
   }
   return key;
@@ -1510,7 +1514,7 @@ function assertNoBearer(headers) {
   for (const name of Object.keys(headers)) {
     if (name.toLowerCase() === "authorization") {
       throw new FoirRequestError(
-        `[foir] createEventsClient: an Authorization header is not accepted. A customer bearer makes the customer the resolved authority on api-public, and no customer authority can contain ${FOIR_EVENTS_SCOPE}. The sk_ key alone is the credential for this surface.`
+        `[foir] createEventsClient: an Authorization header is not accepted. A user bearer makes the user the resolved authority on api-public, and no user authority can contain ${FOIR_EVENTS_SCOPE}. The admin key alone is the credential for this surface.`
       );
     }
   }