@foir/sdk 0.21.0 → 0.23.0

package/dist/app/client.d.ts

@@ -2,7 +2,7 @@
  * The client an installed app calls Foir with.
  *
  * An app is installed in many projects, and each install maps the app's
- * sources onto whichever models that project's operator chose. So an app has
+ * sources onto whichever models that project chose. So an app has
  * no schema to generate a client from: it learns the model keys at request
  * time, from the install's own configuration, and names them in each call.
  * `createFoirClient` is the client for an endpoint that knows its project;
@@ -28,7 +28,7 @@
  */
 import type { FoirDispatchCredential } from '../data/transport';
 import { type FoirRetryPolicy } from '../transport/retry';
-import type { AppCustomerEmailUnavailableReason } from './errors';
+import type { AppUserEmailUnavailableReason } from './errors';
 type Json = null | boolean | number | string | Json[] | {
     [key: string]: Json;
 };
@@ -65,18 +65,18 @@ export interface AppFieldMapping {
     /** The project model's field key. */
     modelField: string;
     /**
-     * SINK_ONLY means the operator has said Foir owns the field: a value from
+     * SINK_ONLY means the project has said Foir owns the field: a value from
      * the app's side must not be written over it. An unrecognised direction
      * reads as SINK_ONLY, which withholds the field rather than writing on a
      * guess.
      */
     direction: AppSyncDirection;
 }
-/** One of the operator's mappings: a source or sink of the app onto a model. */
+/** One of the install's mappings: a source or sink of the app onto a model. */
 export interface AppBinding {
     /** The app's source or sink name. */
     key: string;
-    /** The project model the operator mapped it onto. */
+    /** The project model it was mapped onto. */
     model: string;
     /** The model field the app's records are keyed on. Empty when the mapping names none. */
     naturalKey: string;
@@ -84,7 +84,7 @@ export interface AppBinding {
     /** REFERENCE: Foir reads the source's fields live. SYNC: it holds a copy. A sink is a copy. */
     mode: 'SYNC' | 'REFERENCE';
 }
-/** An install's own configuration, as the operator left it. */
+/** An install's own configuration, as the project left it. */
 export interface AppInstallConfig {
     name: string;
     enabled: boolean;
@@ -92,25 +92,26 @@ export interface AppInstallConfig {
     targetModels: string[];
     /** The address the app's vendor is told to deliver webhooks to. Empty when the app declares none. */
     webhookUrl: string;
-    /** The operator's answers to the manifest's settings schema. */
+    /** The project's answers to the manifest's settings schema. */
     settings: JsonObject;
     sources: AppBinding[];
     sinks: AppBinding[];
     /**
-     * Why the project cannot send a customer an email at the level this install
-     * sits at, or null when it can. While it is set, a notification that carries
-     * an email and an opt-in to a category confirmed by email are refused
-     * (`appCustomerEmailUnavailableOf`), so say so before one is.
+     * Why the app's emails to users cannot link into the app at the level this
+     * install sits at, or null when they can. While it is set, a notification
+     * whose email links into the app with `{base}` is refused
+     * (`appUserEmailUnavailableOf`), so say so before one is. Every other email
+     * is sent.
      */
-    customerEmailUnavailable: AppCustomerEmailUnavailableReason | null;
+    userEmailUnavailable: AppUserEmailUnavailableReason | null;
     /**
-     * The customer sign-in this install pairs with the app, by key, for an app
-     * whose own system has customers; null when it pairs none. Every identity
+     * The sign-in this install pairs with the app, by key, for an app whose own
+     * system has its own users; null when it pairs none. Every identity
      * the app names is resolved through it, so while it is null nothing finds a
-     * customer by identity: `customers.byIdentity` and `customers.identities`
+     * user by identity: `users.byIdentity` and `users.identities`
      * are refused, and an operation that needs them is not registered.
      */
-    customerSignIn: string | null;
+    userSignIn: string | null;
 }
 /**
  * The status an install reports. Leaving out `subscriptionHealth`,
@@ -136,7 +137,7 @@ export interface AppRecord {
     /** The platform's own id. What `records.delete` takes. */
     id: string;
     naturalKey: string | null;
-    /** The customer the record belongs to, or null. */
+    /** The user the record belongs to, or null. */
     ownerId: string | null;
     /** The fields that were asked for and could be read, by model field key. */
     fields: JsonObject;
@@ -163,21 +164,21 @@ export interface AppUpsertResult {
     /** True when nothing was written because Foir already holds a newer copy (`sourceModifiedAt`). */
     stale: boolean;
 }
-export type AppCustomerSaveResult = (AppUpsertResult & {
+export type AppUserSaveResult = (AppUpsertResult & {
     unlinked: false;
-    customerCreated: boolean;
+    userCreated: boolean;
 }) | {
     unlinked: true;
 };
-export interface AppCustomerEraseResult {
+export interface AppUserEraseResult {
     recordDeleted: boolean;
     identityRemoved: boolean;
-    customerDeleted: boolean;
-    /** Another sign-in method, or something else they own; null when the customer went or none was found. */
-    customerKeptBecause: string | null;
+    userDeleted: boolean;
+    /** Another sign-in method, or something else they own; null when the user went or none was found. */
+    userKeptBecause: string | null;
 }
 export interface AppNotification {
-    customerId: string;
+    userId: string;
     /** The in-app title, and the email's subject when `email` names none. */
     title: string;
     message?: string;
@@ -194,10 +195,10 @@ export interface AppNotification {
             url: string;
         }>;
     };
-    /** Makes the send safe to repeat: the same key from the same operation tells the customer once. */
+    /** Makes the send safe to repeat: the same key from the same operation tells the user once. */
     idempotencyKey?: string;
 }
-/** An organisation an operation makes for one of its customers. */
+/** An organisation an operation makes for one of its users. */
 export interface AppOrganizationProvision {
     /**
      * Yours to choose and to keep. Sending the same one again with the same
@@ -221,30 +222,36 @@ export interface AppOrganizationProvision {
         data: Record<string, unknown>;
     };
     /**
-     * The customer who becomes its first member. They are given the role the
+     * The user who becomes its first member. They are given the role the
      * project names for an organisation's founder, in its settings: the
      * operation chooses who, and the project decides what they hold.
      */
     firstMember?: {
-        customerId: string;
+        userId: string;
     };
+    /**
+     * The organisation signs its own people in, to a pool of its own, apart
+     * from its parent's and the project's. Its descendants share that pool
+     * unless one of them starts another. Chosen now, when it is made.
+     */
+    ownPool?: boolean;
 }
 /**
- * Who a consent change is for: a customer whose id the app holds, or an
+ * Who a consent change is for: a user whose id the app holds, or an
  * address.
  *
- * By `email`, the customer holding the address at the operation's level is
+ * By `email`, the user holding the address at the operation's level is
  * found, or made, together with the change, so a change the platform refuses
- * leaves no customer behind. It is for an opt-in from somebody who may have no
- * customer yet (a sign-up form), and the operation must declare
+ * leaves no user behind. It is for an opt-in from somebody who may not be a
+ * user yet (a sign-up form), and the operation must declare
  * `users:create` as well as `notifications:consent`.
  */
 export type AppConsentSubject = {
-    customerId: string;
+    userId: string;
     email?: undefined;
 } | {
     email: string;
-    customerId?: undefined;
+    userId?: undefined;
 };
 export type AppConsentChange = AppConsentSubject & {
     /** A notification category the project makes opt-in. */
@@ -259,19 +266,19 @@ export type AppConsentChange = AppConsentSubject & {
      */
     sourceModifiedAt?: string;
     /**
-     * True when the customer gave this consent in another system and the app is
+     * True when the user gave this consent in another system and the app is
      * carrying it over (a mirror). It is applied as it stands.
      *
      * Left out, the app collected the consent itself (a sign-up form), and an
      * opt-in is applied the way its category says: at once, or, in a category
-     * that confirms by email, only when the customer follows the link the
+     * that confirms by email, only when the user follows the link the
      * platform sends them. Until then nothing is written and the answer says
      * `confirmationPending`.
      */
     givenElsewhere?: boolean;
     /**
      * The language of the page the consent was collected on. The confirmation
-     * email is written in it when the customer has stated none of their own.
+     * email is written in it when the user has stated none of their own.
      */
     locale?: string;
 };
@@ -308,7 +315,7 @@ export interface AppClient {
     whoami(): Promise<AppWhoami>;
     /** The install this token acts for: its configuration, its credential, its status. */
     install: {
-        /** The operator's settings and mappings. Needs `appconfig:read`. */
+        /** The install's settings and mappings. Needs `appconfig:read`. */
         config(): Promise<AppInstallConfig>;
         /**
          * The install's credential, by the manifest's credential field names.
@@ -330,7 +337,7 @@ export interface AppClient {
          * Write the record at a natural key, making it when there is none.
          * Changing the record there needs `records:write:<model>` and making one
          * needs `records:create:<model>`, so an operation that does both declares
-         * both. `ownerId` names the customer it belongs to (needs
+         * both. `ownerId` names the user it belongs to (needs
          * `records:attribute:<model>`); `sourceModifiedAt` is when the object this
          * mirrors last changed at its source, so an older copy arriving late is
          * not written.
@@ -365,7 +372,7 @@ export interface AppClient {
          * other is refused, naming it. `hasMore` says the filter matched more than
          * were answered. Like `read`, it sees the PUBLISHED version.
          *
-         * The name of a model's list is the operator's to set, so the first list a
+         * The name of a model's list is the project's to set, so the first list a
          * client makes asks the data API what this token is served (`GET
          * /v1/manifest`), once.
          */
@@ -420,16 +427,16 @@ export interface AppClient {
             truncated: boolean;
         }>;
         /**
-         * The record of a customer the app names by identity: their id at the
+         * The record of a user the app names by identity: their id at the
          * external system, which is also the subject of their sign-in with it. For
-         * a source that declares an identity. The platform finds the customer
+         * a source that declares an identity. The platform finds the user
          * through the sign-in the install pairs with the source, at the install's
          * level, and never by email.
          */
-        customer: {
+        user: {
             /**
-             * Merge `data` into the customer's record, making the record when they
-             * have none, and the customer when `email` is given and nobody holds the
+             * Merge `data` into the user's record, making the record when they
+             * have none, and the user when `email` is given and nobody holds the
              * identity. An identity nobody holds, with no email, is `{ unlinked:
              * true }`: nothing was written, and they are known once they sign in.
              */
@@ -439,29 +446,29 @@ export interface AppClient {
                 data: JsonObject;
                 email?: string;
                 sourceModifiedAt?: string;
-            }): Promise<AppCustomerSaveResult>;
-            /** The customer's record, or null when nobody holds the identity or they hold no record. */
+            }): Promise<AppUserSaveResult>;
+            /** The user's record, or null when nobody holds the identity or they hold no record. */
             read(model: string, identity: string): Promise<AppRecord | null>;
             /**
-             * Erase what the app holds for the customer, as a privacy request asks:
-             * their record and the identity's link, and the customer when nothing
+             * Erase what the app holds for the user, as a privacy request asks:
+             * their record and the identity's link, and the user when nothing
              * else is attached to them. It removes a record, so it needs
              * `records:delete` and `records:read` for the model, and
              * `identities:delete`. The grant to save the record is not enough.
              */
-            erase(model: string, identity: string): Promise<AppCustomerEraseResult>;
+            erase(model: string, identity: string): Promise<AppUserEraseResult>;
         };
     };
-    customers: {
+    users: {
         /**
-         * The customer who has this email at the install's level, made when there
-         * is none. The same customer every time for one email. Needs
+         * The user who has this email at the install's level, made when there
+         * is none. The same user every time for one email. Needs
          * `users:create`.
          *
-         * `verified` says whether that address is one the customer has proved is
-         * theirs. A customer this call makes has not, and neither has one an
+         * `verified` says whether that address is one the user has proved is
+         * theirs. A user this call makes has not, and neither has one an
          * earlier call made: anybody can type an address. So what is written for
-         * an unverified customer is written for whoever holds the address, and
+         * an unverified user is written for whoever holds the address, and
          * anything that should wait for proof asks `verified` first.
          */
         ensure(email: string): Promise<{
@@ -470,53 +477,53 @@ export interface AppClient {
             verified: boolean;
         }>;
         /**
-         * One customer by id, or null when there is none at the install's level.
+         * One user by id, or null when there is none at the install's level.
          * Needs `users:read.named`, or `users:read.all`.
          */
-        get(id: string): Promise<AppCustomer | null>;
+        get(id: string): Promise<AppUser | null>;
         /**
-         * The customer who has this email at the install's level, or null. The
+         * The user who has this email at the install's level, or null. The
          * exact address, as `ensure` matches it, and nothing wider: it finds one
-         * customer and never searches. Needs `users:read.named`, or
+         * user and never searches. Needs `users:read.named`, or
          * `users:read.all`.
          */
-        byEmail(email: string): Promise<AppCustomer | null>;
+        byEmail(email: string): Promise<AppUser | null>;
         /**
-         * The id of the customer who holds this identity at the app's own system,
+         * The id of the user who holds this identity at the app's own system,
          * or null when nobody does: for an app hearing from its system about one
-         * of its customers. The identity is the subject of the customer's sign-in
-         * with that system, and it is resolved through the customer sign-in the
-         * install pairs (`install.config().customerSignIn`) and no other. Never
+         * of its own users. The identity is the subject of the user's sign-in
+         * with that system, and it is resolved through the sign-in the
+         * install pairs (`install.config().userSignIn`) and no other. Never
          * matched by email. Needs `identities:read`, declared by name:
          * `users:read.all` does not include it.
          */
         byIdentity(identity: string): Promise<string | null>;
         /**
-         * The other direction: the identities a customer the app names by id
+         * The other direction: the identities a user the app names by id
          * holds at the app's own system, most recently seen first, through the
          * same pairing. Empty when they have never signed in that way. For an app
-         * acting on an event that names the Foir customer. Needs
+         * acting on an event that names the Foir user. Needs
          * `identities:read`, declared by name.
          */
-        identities(customerId: string): Promise<string[]>;
+        identities(userId: string): Promise<string[]>;
         /**
-         * The customers at the install's level, a page at a time, newest first.
+         * The users at the install's level, a page at a time, newest first.
          * Needs `users:read.all`: an operation declaring only
-         * `users:read.named` reads the customers it names and is refused the
+         * `users:read.named` reads the users it names and is refused the
          * list.
          */
-        list(query?: AppCustomerList): Promise<{
-            customers: AppCustomer[];
+        list(query?: AppUserList): Promise<{
+            users: AppUser[];
             hasMore: boolean;
             endCursor: string | null;
         }>;
     };
     organizations: {
         /**
-         * Make an organisation, with its settings record and a customer as its
+         * Make an organisation, with its settings record and a user as its
          * first member. Needs `organizations:create`, and for `settings` the write
          * of the settings model. Sign-up is the use: one operation creates the
-         * customer (`customers.ensure`) and then the organisation that is theirs.
+         * user (`users.ensure`) and then the organisation that is theirs.
          *
          * The first member is given the role the project names for an
          * organisation's founder. A project that names none refuses it, saying
@@ -551,20 +558,20 @@ export interface AppClient {
         }>;
     };
     notifications: {
-        /** Tell a customer something. Needs `notifications:write.named`. */
+        /** Tell a user something. Needs `notifications:write.named`. */
         send(notification: AppNotification): Promise<void>;
         /**
-         * Set a named customer's consent in an opt-in category. Needs
+         * Set a named user's consent in an opt-in category. Needs
          * `notifications:consent`, which only an operation's token carries.
          *
          * `confirmationPending` is true when an opt-in the app collected was not
-         * applied because its category confirms by email first: the customer has
+         * applied because its category confirms by email first: the user has
          * been sent a link, or was sent one recently, and the preference turns on
-         * when they follow it. The answer is the same whether or not the address
-         * already had a customer.
+         * when they follow it. The answer is the same whether or not anybody
+         * held the address already.
          *
-         * Name the customer by `customerId`, or by `email` for somebody who may
-         * have no customer yet: the platform finds or makes them with the change,
+         * Name the user by `userId`, or by `email` for somebody who may not be
+         * a user yet: the platform finds or makes them with the change,
          * and that also needs `users:create`.
          */
         setConsent(change: AppConsentChange): Promise<{
@@ -580,7 +587,7 @@ export interface AppClient {
          *
          * For work a delivery cannot do in place. A delivery is not a run, so it
          * holds none of the authority the platform gives only inside one (setting
-         * a customer's consent is one), and it has the few seconds its vendor
+         * a user's consent is one), and it has the few seconds its vendor
          * waits. Hand the work to an operation and answer the vendor.
          *
          * Only the token a delivery arrived with may call it, for an operation
@@ -590,16 +597,16 @@ export interface AppClient {
         start(operationKey: string, options?: AppOperationStart): Promise<AppStartedOperation>;
     };
 }
-/** A customer, as an operation that declared a customer read sees them. */
-export interface AppCustomer {
+/** A user, as an operation that declared a user read sees them. */
+export interface AppUser {
     id: string;
     email: string;
-    /** Whether the customer has proved the address is theirs. */
+    /** Whether the user has proved the address is theirs. */
     verified: boolean;
     /** `ACTIVE`, `SUSPENDED` or `PENDING`, as the platform holds it. */
     status: string;
 }
-export interface AppCustomerList {
+export interface AppUserList {
     /** Part of an email address to look for. Absent lists everyone. */
     search?: string;
     /** How many to answer, at most. The platform's own page size when absent. */

package/dist/app/contract/proto/apps/v1/apps_pb.d.ts

@@ -121,9 +121,9 @@ export declare type AppConfig = Message<"apps.v1.AppConfig"> & {
    * OPTIONAL. The app's own system has customers who sign in to it. See
    * CustomerSignIn.
    *
-   * @generated from field: apps.v1.CustomerSignIn customer_sign_in = 14;
+   * @generated from field: apps.v1.UserSignIn user_sign_in = 14;
    */
-  customerSignIn?: CustomerSignIn | undefined;
+  userSignIn?: UserSignIn | undefined;
 };
 
 /**
@@ -150,9 +150,9 @@ export declare const AppConfigSchema: GenMessage<AppConfig>;
  * feature that finds customers through it (Feature.customer_sign_in), and an
  * operation that asks who holds an identity (customers:read:identity).
  *
- * @generated from message apps.v1.CustomerSignIn
+ * @generated from message apps.v1.UserSignIn
  */
-export declare type CustomerSignIn = Message<"apps.v1.CustomerSignIn"> & {
+export declare type UserSignIn = Message<"apps.v1.UserSignIn"> & {
   /**
    * What the setup tells the operator they are choosing, in a sentence: which
    * customers these are and what identifies them.
@@ -163,10 +163,10 @@ export declare type CustomerSignIn = Message<"apps.v1.CustomerSignIn"> & {
 };
 
 /**
- * Describes the message apps.v1.CustomerSignIn.
- * Use `create(CustomerSignInSchema)` to create a new message.
+ * Describes the message apps.v1.UserSignIn.
+ * Use `create(UserSignInSchema)` to create a new message.
  */
-export declare const CustomerSignInSchema: GenMessage<CustomerSignIn>;
+export declare const UserSignInSchema: GenMessage<UserSignIn>;
 
 /**
  * A feature of the app: something the operator turns on or off as a whole at
@@ -230,9 +230,9 @@ export declare type Feature = Message<"apps.v1.Feature"> & {
    * be on at an install that pairs none: the setup asks for the sign-in at the
    * switch, and the platform refuses the switch without one.
    *
-   * @generated from field: bool customer_sign_in = 6;
+   * @generated from field: bool user_sign_in = 6;
    */
-  customerSignIn: boolean;
+  userSignIn: boolean;
 
   /**
    * The notification category the feature sends under, when it sends
@@ -1520,7 +1520,7 @@ export declare const FieldSyncDirectionSchema: GenEnum<FieldSyncDirection>;
 
 /**
  * The level that owns each row of an app's storage: the three levels a model
- * can be owned at, less the operator-private one, which no app writes.
+ * can be owned at.
  *
  * @generated from enum apps.v1.StorageOwner
  */
@@ -1545,11 +1545,12 @@ export enum StorageOwner {
   ORGANIZATION = 2,
 
   /**
-   * Each row belongs to a customer, and only they and the project read it.
+   * Each row belongs to a user, and only they and whoever holds every user's
+   * rows read it.
    *
-   * @generated from enum value: STORAGE_OWNER_CUSTOMER = 3;
+   * @generated from enum value: STORAGE_OWNER_USER = 4;
    */
-  CUSTOMER = 3,
+  USER = 4,
 }
 
 /**

package/dist/app/dispatch.d.ts

@@ -10,14 +10,14 @@
  *                         and every run a hook, a schedule or `execute<Op>`
  *                         starts.
  *   a direct call       `{ project, app, operation, triggered_by,
- *                         execution_id, input? }`: an operator running a SYNC
+ *                         execution_id, input? }`: somebody running a SYNC
  *                         operation from the console, discovery during setup,
  *                         and the uninstall teardown. Nothing is queued, so
  *                         `execution_id` is the id of the token the call
  *                         carried and no execution holds it.
  *   the credential probe `{ project, app, operation, values }`: the reserved
  *                         `__validate_credentials` operation, sent the
- *                         credential an operator is about to save.
+ *                         credential somebody is about to save.
  *
  * `readAppDispatch` reads the first two as one shape. `readCredentialProbe`
  * reads the third.
@@ -44,19 +44,19 @@ export interface AppDispatch {
  * Read an app operation's dispatch body, already parsed from JSON.
  *
  * It does not refuse a body it cannot place: a direct call may carry no input
- * and no id, and an endpoint that answered 4xx to one would fail an operator's
+ * and no id, and an endpoint that answered 4xx to one would fail somebody's
  * action over a field it does not need. What is absent is absent on the
  * answer.
  */
 export declare function readAppDispatch(body: unknown): AppDispatch;
 /**
- * Read the credential probe's body: the values an operator submitted, by the
+ * Read the credential probe's body: the values somebody submitted, by the
  * manifest's credential field names. Every value the credential store accepts
  * is a string, so anything else is left out rather than handed on as a
  * surprise.
  *
  * The probe carries no `X-Foir-Context`, and whatever answers it with a
- * non-2xx blocks the operator's save. So answer 400 only for a value they can
+ * non-2xx blocks their save. So answer 400 only for a value they can
  * retype, and 200 for everything else, including a check you could not run.
  */
 export declare function readCredentialProbe(body: unknown): {

package/dist/app/errors.d.ts

@@ -25,34 +25,36 @@ export interface AppLookupConflict {
  */
 export declare function appLookupConflictOf(error: unknown): AppLookupConflict | null;
 /**
- * A save to a customer's record refused because no customer holds the
+ * A save to a user's record refused because no user holds the
  * identity at the install's level and no email came to make one, or null for
- * any other failure. Nothing is wrong with the row: the customer is known once
+ * any other failure. Nothing is wrong with the row: the user is known once
  * they sign in with the sign-in the install pairs with the source.
  */
-export declare function appCustomerUnlinkedOf(error: unknown): {
+export declare function appUserUnlinkedOf(error: unknown): {
     model: string;
     identityProvider: string;
 } | null;
 /**
- * Why a project cannot send a customer an email. `NO_APP_BASE_URL`: no App base
- * URL is set for the project, or for the customer's organization. A reason
- * this build does not know arrives as the platform spelled it.
+ * Why a project cannot send a user an email. `NO_APP_BASE_URL`: the email
+ * links into the app with `{base}`, and no App base URL is set for the project
+ * or for the user's organization. A reason this build does not know arrives as
+ * the platform spelled it.
  */
-export type AppCustomerEmailUnavailableReason = 'NO_APP_BASE_URL' | (string & {});
+export type AppUserEmailUnavailableReason = 'NO_APP_BASE_URL' | (string & {});
 /** The reason as the platform sent it, or null when it sent none. */
-export declare function customerEmailUnavailableReasonOf(value: unknown): AppCustomerEmailUnavailableReason | null;
+export declare function userEmailUnavailableReasonOf(value: unknown): AppUserEmailUnavailableReason | null;
 /**
- * A request refused because it would send a customer an email the project
- * cannot send, or null for any other failure. Nothing was written and nothing
- * was queued. An opt-in to a category confirmed by email is refused this way,
- * and so is a notification that carries an email.
+ * A request refused because it would send a user an email the project
+ * cannot build, or null for any other failure. Nothing was written and nothing
+ * was queued. A notification whose email links into the app with `{base}` is
+ * refused this way where no App base URL is set, and so is an opt-in whose
+ * confirmation email the project's copy links into the app.
  *
- * It is about the project, not the customer: the project's operator fixes it,
+ * It is about the project, not the user: the project's team fixes it,
  * and the same request goes once they have.
  */
-export declare function appCustomerEmailUnavailableOf(error: unknown): {
-    reason: AppCustomerEmailUnavailableReason;
+export declare function appUserEmailUnavailableOf(error: unknown): {
+    reason: AppUserEmailUnavailableReason;
 } | null;
 /**
  * Whether a read failed because the token is not served the field it asked

package/dist/app/index.d.ts

@@ -10,7 +10,7 @@
  *
  *   createAppClient        call Foir as the install, with the token a dispatch
  *                          carried: its configuration, credential and status,
- *                          records of the models it maps, customers and
+ *                          records of the models it maps, users and
  *                          notifications.
  *   readAppDispatch        the body of a dispatch, whichever way it arrived,
  *   readCredentialProbe    and of the credential probe.
@@ -21,9 +21,9 @@
  * The manifest's own messages are on `@foir/sdk/app/contract`.
  */
 export { createAppClient } from './client';
-export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppCustomer, AppCustomerEraseResult, AppCustomerList, AppCustomerSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
-export { appCustomerEmailUnavailableOf, appCustomerUnlinkedOf, appLookupConflictOf, isAppFieldWithheld } from './errors';
-export type { AppCustomerEmailUnavailableReason, AppLookupConflict } from './errors';
+export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppUser, AppUserEraseResult, AppUserList, AppUserSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
+export { appUserEmailUnavailableOf, appUserUnlinkedOf, appLookupConflictOf, isAppFieldWithheld } from './errors';
+export type { AppUserEmailUnavailableReason, AppLookupConflict } from './errors';
 export { appModelFieldName, appModelTypeName, appSelectorEnumValue } from './naming';
 export { RECORD_KEY_RULE, recordKeyRefusal } from './record-key';
 export { readAppDispatch, readCredentialProbe } from './dispatch';

package/dist/app/naming.d.ts

@@ -5,7 +5,7 @@
  * model's key: the singular query, `delete<Type>`, `<Type>WhereInput` and the
  * rest. A client generated for one project reads those names off the schema.
  * An app installed in many projects cannot, because the model is whichever one
- * each operator mapped, so it derives them from the key the same way the
+ * each project mapped, so it derives them from the key the same way the
  * schema does.
  *
  * The rule: split the key on every run of characters that are not letters or

package/dist/app/ticket.d.ts

@@ -2,7 +2,7 @@
  * The exchange ticket: how an app's own OAuth callback gets to write the
  * credential it was just granted.
  *
- * An install that needs a vendor's consent sends the operator to the app's
+ * An install that needs a vendor's consent sends whoever is installing it to the app's
  * authorize route with a single-use ticket. When the vendor returns them, the
  * app redeems the ticket for a short-lived token that can do one thing: write
  * this install's credential. It cannot read the configuration, report status
@@ -26,7 +26,7 @@ export interface RedeemedExchangeTicket {
 /**
  * Redeem an exchange ticket. ONE ATTEMPT, on purpose: the ticket is single-use,
  * so repeating a call whose answer was lost would find the ticket spent, and
- * the operator's only way forward would be to start the install again. A
+ * their only way forward would be to start the install again. A
  * failure here is the answer.
  */
 export declare function redeemExchangeTicket(options: {