@foir/sdk 0.21.0 → 0.23.0

package/dist/app/vocabulary.generated.d.ts

@@ -3,14 +3,14 @@
  * manifest's hook may subscribe to (an event of the project, that something
  * emits) is the platform's to say: `validateAppManifest` answers it.
  */
-export declare const APP_HOOK_EVENTS: readonly ["RECORD_CREATED", "RECORD_UPDATED", "RECORD_DELETED", "RECORD_PUBLISHED", "RECORD_UNPUBLISHED", "CUSTOMER_CREATED", "CUSTOMER_UPDATED", "CUSTOMER_DELETED", "CUSTOMER_MERGED", "SESSION_REVOKED", "OPERATION_COMPLETED", "OPERATION_FAILED", "OPERATION_CANCELLED", "OPERATION_TIMED_OUT", "ADMIN_MEMBERSHIP_GRANTED", "ADMIN_MEMBERSHIP_REVOKED", "ADMIN_ROLE_CHANGED", "TENANT_PLAN_CHANGED", "TENANT_SUBSCRIPTION_STATUS_CHANGED", "PROJECT_CREATED", "PROJECT_ARCHIVED", "INVITATION_ACCEPTED", "IMPORT_COMPLETED", "MIGRATION_APPLIED", "BULK_UPDATE_COMPLETED", "BULK_PUBLISH_COMPLETED", "CUSTOMER_PREFERENCE_CHANGED", "ORGANIZATION_CREATED", "ORGANIZATION_UPDATED", "ORGANIZATION_MOVED", "ORGANIZATION_SUSPENDED", "ORGANIZATION_RESUMED", "ORGANIZATION_DELETION_SCHEDULED", "ORGANIZATION_DELETION_CANCELLED", "ORGANIZATION_DELETED", "ORGANIZATION_MEMBER_ADDED", "ORGANIZATION_MEMBER_REMOVED", "ORGANIZATION_MEMBER_ROLE_CHANGED", "PROJECT_REACTIVATED"];
+export declare const APP_HOOK_EVENTS: readonly ["RECORD_CREATED", "RECORD_UPDATED", "RECORD_DELETED", "RECORD_PUBLISHED", "RECORD_UNPUBLISHED", "USER_CREATED", "USER_UPDATED", "USER_DELETED", "USER_MERGED", "SESSION_REVOKED", "OPERATION_COMPLETED", "OPERATION_FAILED", "OPERATION_CANCELLED", "OPERATION_TIMED_OUT", "MEMBERSHIP_GRANTED", "MEMBERSHIP_REVOKED", "MEMBERSHIP_ROLE_CHANGED", "TENANT_PLAN_CHANGED", "TENANT_SUBSCRIPTION_STATUS_CHANGED", "PROJECT_CREATED", "PROJECT_ARCHIVED", "INVITATION_ACCEPTED", "IMPORT_COMPLETED", "MIGRATION_APPLIED", "BULK_UPDATE_COMPLETED", "BULK_PUBLISH_COMPLETED", "USER_PREFERENCE_CHANGED", "ORGANIZATION_CREATED", "ORGANIZATION_UPDATED", "ORGANIZATION_MOVED", "ORGANIZATION_SUSPENDED", "ORGANIZATION_RESUMED", "ORGANIZATION_DELETION_SCHEDULED", "ORGANIZATION_DELETION_CANCELLED", "ORGANIZATION_DELETED", "ORGANIZATION_MEMBER_ADDED", "ORGANIZATION_MEMBER_REMOVED", "ORGANIZATION_MEMBER_ROLE_CHANGED", "PROJECT_REACTIVATED"];
 /** An event a hook can name. */
 export type AppHookEvent = (typeof APP_HOOK_EVENTS)[number];
 /**
  * The grants an operation declares as written, in the permission catalogue's
  * names.
  */
-export declare const APP_GRANTS: readonly ["appconfig:read", "appsecrets:delete", "appsecrets:list", "appsecrets:put", "appsecrets:read", "files:delete", "files:delete.all", "files:read", "files:read.all", "files:write", "files:write.all", "identities:delete", "identities:read", "notifications:consent", "notifications:read", "notifications:write.named", "operations:complete", "organizations:create", "organizations:delete", "status:write", "users:create", "users:read.all", "users:read.named"];
+export declare const APP_GRANTS: readonly ["appconfig:read", "appsecrets:delete", "appsecrets:list", "appsecrets:put", "appsecrets:read", "files:delete", "files:delete.all", "files:read", "files:read.all", "files:write", "files:write.all", "identities:delete", "identities:read", "notifications:consent", "notifications:read", "notifications:write.named", "operations:complete", "organizations:create", "organizations:delete", "project:stand", "status:write", "users:create", "users:read.all", "users:read.named"];
 /** A grant an operation declares as written. */
 export type AppGrant = (typeof APP_GRANTS)[number];
 /**

package/dist/app-contract.js

@@ -8,9 +8,9 @@ var file_buf_validate_validate = /* @__PURE__ */ fileDesc("ChtidWYvdmFsaWRhdGUvd
 
 // ../proto-ts/src/apps/v1/apps_pb.js
 import { file_google_protobuf_struct } from "@bufbuild/protobuf/wkt";
-var file_apps_v1_apps = /* @__PURE__ */ fileDesc2("ChJhcHBzL3YxL2FwcHMucHJvdG8SB2FwcHMudjEiyQUKCUFwcENvbmZpZxI0CgRuYW1lGAEgASgJQia6SCNyIRhAMh1eW2Etel1bYS16MC05XSooLVthLXowLTldKykqJBIYCgd2ZXJzaW9uGAIgASgJQge6SARyAhABEiMKCG1ldGFkYXRhGAMgASgLMhEuYXBwcy52MS5NZXRhZGF0YRInCgptaWRkbGV3YXJlGAQgASgLMhMuYXBwcy52MS5NaWRkbGV3YXJlEikKC2NyZWRlbnRpYWxzGAUgASgLMhQuYXBwcy52MS5DcmVkZW50aWFscxIwCg9zZXR0aW5nc19zY2hlbWEYBiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EjAKB3NvdXJjZXMYByADKAsyHy5hcHBzLnYxLkFwcENvbmZpZy5Tb3VyY2VzRW50cnkSLAoFc2lua3MYCCADKAsyHS5hcHBzLnYxLkFwcENvbmZpZy5TaW5rc0VudHJ5EiYKCm9wZXJhdGlvbnMYCSADKAsyEi5hcHBzLnYxLk9wZXJhdGlvbhIcCgVob29rcxgKIAMoCzINLmFwcHMudjEuSG9vaxIXCgJ1aRgLIAEoCzILLmFwcHMudjEuVUkSIQoHaW5ib3VuZBgMIAEoCzIQLmFwcHMudjEuSW5ib3VuZBIiCghmZWF0dXJlcxgNIAMoCzIQLmFwcHMudjEuRmVhdHVyZRIxChBjdXN0b21lcl9zaWduX2luGA4gASgLMhcuYXBwcy52MS5DdXN0b21lclNpZ25JbhpDCgxTb3VyY2VzRW50cnkSCwoDa2V5GAEgASgJEiIKBXZhbHVlGAIgASgLMhMuYXBwcy52MS5Tb3VyY2VUeXBlOgI4ARpDCgpTaW5rc0VudHJ5EgsKA2tleRgBIAEoCRIkCgV2YWx1ZRgCIAEoCzIVLmFwcHMudjEuU2lua0NvbnRyYWN0OgI4ASIlCg5DdXN0b21lclNpZ25JbhITCgtkZXNjcmlwdGlvbhgBIAEoCSKnAgoHRmVhdHVyZRIzCgNrZXkYASABKAlCJrpII3IhGEAyHV5bYS16XVthLXowLTldKigtW2EtejAtOV0rKSokEhYKBXRpdGxlGAIgASgJQge6SARyAhABEhMKC2Rlc2NyaXB0aW9uGAMgASgJEg8KB3NldHRpbmcYBCABKAkSDwoHc291cmNlcxgFIAMoCRIYChBjdXN0b21lcl9zaWduX2luGAYgASgIEkMKFW5vdGlmaWNhdGlvbl9jYXRlZ29yeRgHIAEoCzIkLmFwcHMudjEuRmVhdHVyZU5vdGlmaWNhdGlvbkNhdGVnb3J5EjkKEGNvbnNlbnRfY2F0ZWdvcnkYCCABKAsyHy5hcHBzLnYxLkZlYXR1cmVDb25zZW50Q2F0ZWdvcnkinAEKG0ZlYXR1cmVOb3RpZmljYXRpb25DYXRlZ29yeRIYCgdzZXR0aW5nGAEgASgJQge6SARyAhABEicKA2tleRgCIAEoCUIaukgXchUYQDIRXlthLXpdW2EtejAtOV9dKiQSFQoEbmFtZRgDIAEoCUIHukgEcgIQARITCgtkZXNjcmlwdGlvbhgEIAEoCRIOCgZvcHRfaW4YBSABKAgitAEKFkZlYXR1cmVDb25zZW50Q2F0ZWdvcnkSGAoHc2V0dGluZxgBIAEoCUIHukgEcgIQARInCgNrZXkYAiABKAlCGrpIF3IVGEAyEV5bYS16XVthLXowLTlfXSokEhUKBG5hbWUYAyABKAlCB7pIBHICEAESEwoLZGVzY3JpcHRpb24YBCABKAkSKwoHY2hhbm5lbBgFIAEoCUIaukgXchVSBWVtYWlsUgRwdXNoUgZpbl9hcHAiZQoITWV0YWRhdGESFAoMZGlzcGxheV9uYW1lGAEgASgJEhMKC2Rlc2NyaXB0aW9uGAIgASgJEgwKBGljb24YAyABKAkSDgoGYXV0aG9yGAQgASgJEhAKCGhvbWVwYWdlGAUgASgJIi0KCk1pZGRsZXdhcmUSHwoDdXJsGAEgASgJQhK6SA9yDTILXmh0dHBzOi8vLisi7wIKC0NyZWRlbnRpYWxzEi8KCHN0cmF0ZWd5GAEgASgOMh0uYXBwcy52MS5DcmVkZW50aWFscy5TdHJhdGVneRIsCgZzY2hlbWEYAiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SACIAQESKAoFb2F1dGgYAyABKAsyFC5hcHBzLnYxLk9BdXRoQ29uZmlnSAGIAQESFgoOY29ubmVjdF9ub3RpY2UYBCABKAkiqQEKCFN0cmF0ZWd5EhgKFFNUUkFURUdZX1VOU1BFQ0lGSUVEEAASEgoOU1RSQVRFR1lfT0FVVEgQARIUChBTVFJBVEVHWV9BUElfS0VZEAISGgoWU1RSQVRFR1lfU0hBUkVEX1NFQ1JFVBADEhQKEFNUUkFURUdZX1NTSF9LRVkQBBIRCg1TVFJBVEVHWV9OT05FEAUSFAoQU1RSQVRFR1lfTUFOQUdFRBAGQgkKB19zY2hlbWFCCAoGX29hdXRoIkwKC09BdXRoQ29uZmlnEhwKFGF1dGhvcml6ZV9zdGFydF9wYXRoGAEgASgJEh8KF2F1dGhvcml6ZV9jYWxsYmFja19wYXRoGAIgASgJIlYKB0luYm91bmQSIQoHd2ViaG9vaxgBIAEoCzIQLmFwcHMudjEuV2ViaG9vaxIoCgdhY2NvdW50GAIgASgLMhcuYXBwcy52MS5BY2NvdW50V2ViaG9vayIXCgdXZWJob29rEgwKBHBhdGgYASABKAkiPwoOQWNjb3VudFdlYmhvb2sSDAoEcGF0aBgBIAEoCRIPCgdzZXR0aW5nGAIgASgJEg4KBnNvdXJjZRgDIAEoCSLdAgoKU291cmNlVHlwZRINCgVsYWJlbBgBIAEoCRIvCgZmaWVsZHMYAiADKAsyHy5hcHBzLnYxLlNvdXJjZVR5cGUuRmllbGRzRW50cnkSEwoLbmF0dXJhbF9rZXkYAyABKAkSEAoIb3B0aW9uYWwYBCABKAgSFgoOcHJvdmlzaW9uX29ubHkYBSABKAgSKwoJcmVmZXJlbmNlGAYgASgLMhguYXBwcy52MS5Tb3VyY2VSZWZlcmVuY2USJAoFb3duZXIYByABKA4yFS5hcHBzLnYxLlN0b3JhZ2VPd25lchITCgtyZWNvbW1lbmRlZBgIIAEoCBIOCgZsb29rdXAYCSADKAkSEAoIaWRlbnRpdHkYCiABKAkaRgoLRmllbGRzRW50cnkSCwoDa2V5GAEgASgJEiYKBXZhbHVlGAIgASgLMhcuYXBwcy52MS5TdWdnZXN0ZWRGaWVsZDoCOAEiqgIKD1NvdXJjZVJlZmVyZW5jZRIRCglrZXlfZmllbGQYASABKAkSNAoGZmllbGRzGAIgAygLMiQuYXBwcy52MS5Tb3VyY2VSZWZlcmVuY2UuRmllbGRzRW50cnkSEAoIZW5kcG9pbnQYAyABKAkSDQoFaG9zdHMYBCADKAkSKgoHcmVxdWVzdBgFIAEoCzIZLmFwcHMudjEuUmVmZXJlbmNlUmVxdWVzdBIaChJyZXNwb25zZV90cmFuc2Zvcm0YBiABKAkSHQoVY2FjaGVfbWF4X2FnZV9zZWNvbmRzGAcgASgFGkYKC0ZpZWxkc0VudHJ5EgsKA2tleRgBIAEoCRImCgV2YWx1ZRgCIAEoCzIXLmFwcHMudjEuU3VnZ2VzdGVkRmllbGQ6AjgBIrMCChBSZWZlcmVuY2VSZXF1ZXN0Eg4KBm1ldGhvZBgBIAEoCRIVCg1wYXRoX3RlbXBsYXRlGAIgASgJEjMKBXF1ZXJ5GAMgAygLMiQuYXBwcy52MS5SZWZlcmVuY2VSZXF1ZXN0LlF1ZXJ5RW50cnkSNwoHaGVhZGVycxgEIAMoCzImLmFwcHMudjEuUmVmZXJlbmNlUmVxdWVzdC5IZWFkZXJzRW50cnkSFQoNYm9keV90ZW1wbGF0ZRgFIAEoCRIVCg1iYXRjaF9jYXBhYmxlGAYgASgIGiwKClF1ZXJ5RW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ARouCgxIZWFkZXJzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASK6AQoMU2lua0NvbnRyYWN0Eg0KBWxhYmVsGAEgASgJEjEKBmZpZWxkcxgCIAMoCzIhLmFwcHMudjEuU2lua0NvbnRyYWN0LkZpZWxkc0VudHJ5EhMKC25hdHVyYWxfa2V5GAMgASgJEhAKCG9wdGlvbmFsGAQgASgIGkEKC0ZpZWxkc0VudHJ5EgsKA2tleRgBIAEoCRIhCgV2YWx1ZRgCIAEoCzISLmFwcHMudjEuU2lua0ZpZWxkOgI4ASKWAgoOU3VnZ2VzdGVkRmllbGQSDAoEdHlwZRgBIAEoCRISCgVsYWJlbBgCIAEoCUgAiAEBEhUKCHJlcXVpcmVkGAMgASgISAGIAQESLAoGY29uZmlnGAQgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEgCiAEBEj0KE3N1cHBvcnRlZF9kaXJlY3Rpb24YBSABKA4yGy5hcHBzLnYxLkZpZWxkU3luY0RpcmVjdGlvbkgDiAEBEhYKCXF1ZXJ5YWJsZRgGIAEoCEgEiAEBQggKBl9sYWJlbEILCglfcmVxdWlyZWRCCQoHX2NvbmZpZ0IWChRfc3VwcG9ydGVkX2RpcmVjdGlvbkIMCgpfcXVlcnlhYmxlIlsKCVNpbmtGaWVsZBIMCgR0eXBlGAEgASgJEhAKCHNlbWFudGljGAIgASgJEhAKCHJlcXVpcmVkGAMgASgIEhIKBWxhYmVsGAQgASgJSACIAQFCCAoGX2xhYmVsIqgECglPcGVyYXRpb24SOgoDa2V5GAEgASgJQi26SCpyKBhAMiReKF9fKT9bYS16XVthLXowLTlfXSooLVthLXowLTlfXSspKiQSDAoEbmFtZRgCIAEoCRIYCgtkZXNjcmlwdGlvbhgDIAEoCUgAiAEBEh0KCGVuZHBvaW50GAQgASgJQgu6SAhyBjIEXi8uKhIUCgxjYXBhYmlsaXRpZXMYBSADKAkSDgoGZ3JhbnRzGA0gAygJEhcKCnRpbWVvdXRfbXMYBiABKAVIAYgBARIyCgxyZXRyeV9wb2xpY3kYByABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SAKIAQESMgoMaW5wdXRfc2NoZW1hGAggASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEgDiAEBEjMKDW91dHB1dF9zY2hlbWEYCSABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SASIAQESGwoOc3VwcG9ydHNfYXN5bmMYCiABKAhIBYgBARIZChFydW5fYWZ0ZXJfaW5zdGFsbBgLIAEoCBIeChZydW5zX29uX21hcHBlZF9zb3VyY2VzGAwgASgIQg4KDF9kZXNjcmlwdGlvbkINCgtfdGltZW91dF9tc0IPCg1fcmV0cnlfcG9saWN5Qg8KDV9pbnB1dF9zY2hlbWFCEAoOX291dHB1dF9zY2hlbWFCEQoPX3N1cHBvcnRzX2FzeW5jIqYBCgRIb29rEjMKA2tleRgBIAEoCUImukgjciEYQDIdXlthLXpdW2EtejAtOV0qKC1bYS16MC05XSspKiQSDAoEbmFtZRgCIAEoCRIWCgVldmVudBgDIAEoCUIHukgEcgIQARInCgZmaWx0ZXIYBCABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EhoKCW9wZXJhdGlvbhgFIAEoCUIHukgEcgIQASI3CgJVSRIxCgpwbGFjZW1lbnRzGAEgAygLMh0uYXBwcy52MS5QbGFjZW1lbnREZWNsYXJhdGlvbiLGBAoUUGxhY2VtZW50RGVjbGFyYXRpb24SMwoDa2V5GAEgASgJQia6SCNyIRhAMh1eW2Etel1bYS16MC05XSooLVthLXowLTldKykqJBI0CgZ0YXJnZXQYAiABKA4yJC5hcHBzLnYxLlBsYWNlbWVudERlY2xhcmF0aW9uLlRhcmdldBISCgVtb2RlbBgDIAEoCUgAiAEBEhIKBWZpZWxkGAQgASgJSAGIAQESIQoZZmllbGRfc2VsZWN0ZWRfYXRfaW5zdGFsbBgFIAEoCBIQCgN0YWIYBiABKAlIAogBARIWCgV0aXRsZRgHIAEoCUIHukgEcgIQARIfCgN1cmwYCCABKAlCErpID3INMgteaHR0cHM6Ly8uKxIdChByZXBsYWNlc19kZWZhdWx0GAkgASgISAOIAQESKwoFaGludHMYCiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SASIAQESDgoGc2NvcGVzGAsgAygJEhAKCHNldHRpbmdzGAwgAygJEg4KBmdyYW50cxgNIAMoCSJ0CgZUYXJnZXQSFgoSVEFSR0VUX1VOU1BFQ0lGSUVEEAASFAoQVEFSR0VUX0ZVTExfUEFHRRABEhYKElRBUkdFVF9NQUlOX0VESVRPUhACEhIKDlRBUkdFVF9TSURFQkFSEAMSEAoMVEFSR0VUX0ZJRUxEEARCCAoGX21vZGVsQggKBl9maWVsZEIGCgRfdGFiQhMKEV9yZXBsYWNlc19kZWZhdWx0QggKBl9oaW50cyqsAQoSRmllbGRTeW5jRGlyZWN0aW9uEiQKIEZJRUxEX1NZTkNfRElSRUNUSU9OX1VOU1BFQ0lGSUVEEAASJAogRklFTERfU1lOQ19ESVJFQ1RJT05fU09VUkNFX09OTFkQARIiCh5GSUVMRF9TWU5DX0RJUkVDVElPTl9TSU5LX09OTFkQAhImCiJGSUVMRF9TWU5DX0RJUkVDVElPTl9CSURJUkVDVElPTkFMEAMqhAEKDFN0b3JhZ2VPd25lchIdChlTVE9SQUdFX09XTkVSX1VOU1BFQ0lGSUVEEAASGQoVU1RPUkFHRV9PV05FUl9QUk9KRUNUEAESHgoaU1RPUkFHRV9PV05FUl9PUkdBTklaQVRJT04QAhIaChZTVE9SQUdFX09XTkVSX0NVU1RPTUVSEANCNVozZ2l0aHViLmNvbS9laWRlc3R1ZGlvL2ZvaXIvZ2VuL3Byb3RvL2FwcHMvdjE7YXBwc3YxYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_struct]);
+var file_apps_v1_apps = /* @__PURE__ */ fileDesc2("ChJhcHBzL3YxL2FwcHMucHJvdG8SB2FwcHMudjEiwQUKCUFwcENvbmZpZxI0CgRuYW1lGAEgASgJQia6SCNyIRhAMh1eW2Etel1bYS16MC05XSooLVthLXowLTldKykqJBIYCgd2ZXJzaW9uGAIgASgJQge6SARyAhABEiMKCG1ldGFkYXRhGAMgASgLMhEuYXBwcy52MS5NZXRhZGF0YRInCgptaWRkbGV3YXJlGAQgASgLMhMuYXBwcy52MS5NaWRkbGV3YXJlEikKC2NyZWRlbnRpYWxzGAUgASgLMhQuYXBwcy52MS5DcmVkZW50aWFscxIwCg9zZXR0aW5nc19zY2hlbWEYBiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EjAKB3NvdXJjZXMYByADKAsyHy5hcHBzLnYxLkFwcENvbmZpZy5Tb3VyY2VzRW50cnkSLAoFc2lua3MYCCADKAsyHS5hcHBzLnYxLkFwcENvbmZpZy5TaW5rc0VudHJ5EiYKCm9wZXJhdGlvbnMYCSADKAsyEi5hcHBzLnYxLk9wZXJhdGlvbhIcCgVob29rcxgKIAMoCzINLmFwcHMudjEuSG9vaxIXCgJ1aRgLIAEoCzILLmFwcHMudjEuVUkSIQoHaW5ib3VuZBgMIAEoCzIQLmFwcHMudjEuSW5ib3VuZBIiCghmZWF0dXJlcxgNIAMoCzIQLmFwcHMudjEuRmVhdHVyZRIpCgx1c2VyX3NpZ25faW4YDiABKAsyEy5hcHBzLnYxLlVzZXJTaWduSW4aQwoMU291cmNlc0VudHJ5EgsKA2tleRgBIAEoCRIiCgV2YWx1ZRgCIAEoCzITLmFwcHMudjEuU291cmNlVHlwZToCOAEaQwoKU2lua3NFbnRyeRILCgNrZXkYASABKAkSJAoFdmFsdWUYAiABKAsyFS5hcHBzLnYxLlNpbmtDb250cmFjdDoCOAEiIQoKVXNlclNpZ25JbhITCgtkZXNjcmlwdGlvbhgBIAEoCSKjAgoHRmVhdHVyZRIzCgNrZXkYASABKAlCJrpII3IhGEAyHV5bYS16XVthLXowLTldKigtW2EtejAtOV0rKSokEhYKBXRpdGxlGAIgASgJQge6SARyAhABEhMKC2Rlc2NyaXB0aW9uGAMgASgJEg8KB3NldHRpbmcYBCABKAkSDwoHc291cmNlcxgFIAMoCRIUCgx1c2VyX3NpZ25faW4YBiABKAgSQwoVbm90aWZpY2F0aW9uX2NhdGVnb3J5GAcgASgLMiQuYXBwcy52MS5GZWF0dXJlTm90aWZpY2F0aW9uQ2F0ZWdvcnkSOQoQY29uc2VudF9jYXRlZ29yeRgIIAEoCzIfLmFwcHMudjEuRmVhdHVyZUNvbnNlbnRDYXRlZ29yeSKcAQobRmVhdHVyZU5vdGlmaWNhdGlvbkNhdGVnb3J5EhgKB3NldHRpbmcYASABKAlCB7pIBHICEAESJwoDa2V5GAIgASgJQhq6SBdyFRhAMhFeW2Etel1bYS16MC05X10qJBIVCgRuYW1lGAMgASgJQge6SARyAhABEhMKC2Rlc2NyaXB0aW9uGAQgASgJEg4KBm9wdF9pbhgFIAEoCCK0AQoWRmVhdHVyZUNvbnNlbnRDYXRlZ29yeRIYCgdzZXR0aW5nGAEgASgJQge6SARyAhABEicKA2tleRgCIAEoCUIaukgXchUYQDIRXlthLXpdW2EtejAtOV9dKiQSFQoEbmFtZRgDIAEoCUIHukgEcgIQARITCgtkZXNjcmlwdGlvbhgEIAEoCRIrCgdjaGFubmVsGAUgASgJQhq6SBdyFVIFZW1haWxSBHB1c2hSBmluX2FwcCJlCghNZXRhZGF0YRIUCgxkaXNwbGF5X25hbWUYASABKAkSEwoLZGVzY3JpcHRpb24YAiABKAkSDAoEaWNvbhgDIAEoCRIOCgZhdXRob3IYBCABKAkSEAoIaG9tZXBhZ2UYBSABKAkiLQoKTWlkZGxld2FyZRIfCgN1cmwYASABKAlCErpID3INMgteaHR0cHM6Ly8uKyLvAgoLQ3JlZGVudGlhbHMSLwoIc3RyYXRlZ3kYASABKA4yHS5hcHBzLnYxLkNyZWRlbnRpYWxzLlN0cmF0ZWd5EiwKBnNjaGVtYRgCIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAIgBARIoCgVvYXV0aBgDIAEoCzIULmFwcHMudjEuT0F1dGhDb25maWdIAYgBARIWCg5jb25uZWN0X25vdGljZRgEIAEoCSKpAQoIU3RyYXRlZ3kSGAoUU1RSQVRFR1lfVU5TUEVDSUZJRUQQABISCg5TVFJBVEVHWV9PQVVUSBABEhQKEFNUUkFURUdZX0FQSV9LRVkQAhIaChZTVFJBVEVHWV9TSEFSRURfU0VDUkVUEAMSFAoQU1RSQVRFR1lfU1NIX0tFWRAEEhEKDVNUUkFURUdZX05PTkUQBRIUChBTVFJBVEVHWV9NQU5BR0VEEAZCCQoHX3NjaGVtYUIICgZfb2F1dGgiTAoLT0F1dGhDb25maWcSHAoUYXV0aG9yaXplX3N0YXJ0X3BhdGgYASABKAkSHwoXYXV0aG9yaXplX2NhbGxiYWNrX3BhdGgYAiABKAkiVgoHSW5ib3VuZBIhCgd3ZWJob29rGAEgASgLMhAuYXBwcy52MS5XZWJob29rEigKB2FjY291bnQYAiABKAsyFy5hcHBzLnYxLkFjY291bnRXZWJob29rIhcKB1dlYmhvb2sSDAoEcGF0aBgBIAEoCSI/Cg5BY2NvdW50V2ViaG9vaxIMCgRwYXRoGAEgASgJEg8KB3NldHRpbmcYAiABKAkSDgoGc291cmNlGAMgASgJIt0CCgpTb3VyY2VUeXBlEg0KBWxhYmVsGAEgASgJEi8KBmZpZWxkcxgCIAMoCzIfLmFwcHMudjEuU291cmNlVHlwZS5GaWVsZHNFbnRyeRITCgtuYXR1cmFsX2tleRgDIAEoCRIQCghvcHRpb25hbBgEIAEoCBIWCg5wcm92aXNpb25fb25seRgFIAEoCBIrCglyZWZlcmVuY2UYBiABKAsyGC5hcHBzLnYxLlNvdXJjZVJlZmVyZW5jZRIkCgVvd25lchgHIAEoDjIVLmFwcHMudjEuU3RvcmFnZU93bmVyEhMKC3JlY29tbWVuZGVkGAggASgIEg4KBmxvb2t1cBgJIAMoCRIQCghpZGVudGl0eRgKIAEoCRpGCgtGaWVsZHNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKAsyFy5hcHBzLnYxLlN1Z2dlc3RlZEZpZWxkOgI4ASKqAgoPU291cmNlUmVmZXJlbmNlEhEKCWtleV9maWVsZBgBIAEoCRI0CgZmaWVsZHMYAiADKAsyJC5hcHBzLnYxLlNvdXJjZVJlZmVyZW5jZS5GaWVsZHNFbnRyeRIQCghlbmRwb2ludBgDIAEoCRINCgVob3N0cxgEIAMoCRIqCgdyZXF1ZXN0GAUgASgLMhkuYXBwcy52MS5SZWZlcmVuY2VSZXF1ZXN0EhoKEnJlc3BvbnNlX3RyYW5zZm9ybRgGIAEoCRIdChVjYWNoZV9tYXhfYWdlX3NlY29uZHMYByABKAUaRgoLRmllbGRzRW50cnkSCwoDa2V5GAEgASgJEiYKBXZhbHVlGAIgASgLMhcuYXBwcy52MS5TdWdnZXN0ZWRGaWVsZDoCOAEiswIKEFJlZmVyZW5jZVJlcXVlc3QSDgoGbWV0aG9kGAEgASgJEhUKDXBhdGhfdGVtcGxhdGUYAiABKAkSMwoFcXVlcnkYAyADKAsyJC5hcHBzLnYxLlJlZmVyZW5jZVJlcXVlc3QuUXVlcnlFbnRyeRI3CgdoZWFkZXJzGAQgAygLMiYuYXBwcy52MS5SZWZlcmVuY2VSZXF1ZXN0LkhlYWRlcnNFbnRyeRIVCg1ib2R5X3RlbXBsYXRlGAUgASgJEhUKDWJhdGNoX2NhcGFibGUYBiABKAgaLAoKUXVlcnlFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBGi4KDEhlYWRlcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIroBCgxTaW5rQ29udHJhY3QSDQoFbGFiZWwYASABKAkSMQoGZmllbGRzGAIgAygLMiEuYXBwcy52MS5TaW5rQ29udHJhY3QuRmllbGRzRW50cnkSEwoLbmF0dXJhbF9rZXkYAyABKAkSEAoIb3B0aW9uYWwYBCABKAgaQQoLRmllbGRzRW50cnkSCwoDa2V5GAEgASgJEiEKBXZhbHVlGAIgASgLMhIuYXBwcy52MS5TaW5rRmllbGQ6AjgBIpYCCg5TdWdnZXN0ZWRGaWVsZBIMCgR0eXBlGAEgASgJEhIKBWxhYmVsGAIgASgJSACIAQESFQoIcmVxdWlyZWQYAyABKAhIAYgBARIsCgZjb25maWcYBCABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SAKIAQESPQoTc3VwcG9ydGVkX2RpcmVjdGlvbhgFIAEoDjIbLmFwcHMudjEuRmllbGRTeW5jRGlyZWN0aW9uSAOIAQESFgoJcXVlcnlhYmxlGAYgASgISASIAQFCCAoGX2xhYmVsQgsKCV9yZXF1aXJlZEIJCgdfY29uZmlnQhYKFF9zdXBwb3J0ZWRfZGlyZWN0aW9uQgwKCl9xdWVyeWFibGUiWwoJU2lua0ZpZWxkEgwKBHR5cGUYASABKAkSEAoIc2VtYW50aWMYAiABKAkSEAoIcmVxdWlyZWQYAyABKAgSEgoFbGFiZWwYBCABKAlIAIgBAUIICgZfbGFiZWwiqAQKCU9wZXJhdGlvbhI6CgNrZXkYASABKAlCLbpIKnIoGEAyJF4oX18pP1thLXpdW2EtejAtOV9dKigtW2EtejAtOV9dKykqJBIMCgRuYW1lGAIgASgJEhgKC2Rlc2NyaXB0aW9uGAMgASgJSACIAQESHQoIZW5kcG9pbnQYBCABKAlCC7pICHIGMgReLy4qEhQKDGNhcGFiaWxpdGllcxgFIAMoCRIOCgZncmFudHMYDSADKAkSFwoKdGltZW91dF9tcxgGIAEoBUgBiAEBEjIKDHJldHJ5X3BvbGljeRgHIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAogBARIyCgxpbnB1dF9zY2hlbWEYCCABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SAOIAQESMwoNb3V0cHV0X3NjaGVtYRgJIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIBIgBARIbCg5zdXBwb3J0c19hc3luYxgKIAEoCEgFiAEBEhkKEXJ1bl9hZnRlcl9pbnN0YWxsGAsgASgIEh4KFnJ1bnNfb25fbWFwcGVkX3NvdXJjZXMYDCABKAhCDgoMX2Rlc2NyaXB0aW9uQg0KC190aW1lb3V0X21zQg8KDV9yZXRyeV9wb2xpY3lCDwoNX2lucHV0X3NjaGVtYUIQCg5fb3V0cHV0X3NjaGVtYUIRCg9fc3VwcG9ydHNfYXN5bmMipgEKBEhvb2sSMwoDa2V5GAEgASgJQia6SCNyIRhAMh1eW2Etel1bYS16MC05XSooLVthLXowLTldKykqJBIMCgRuYW1lGAIgASgJEhYKBWV2ZW50GAMgASgJQge6SARyAhABEicKBmZpbHRlchgEIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSGgoJb3BlcmF0aW9uGAUgASgJQge6SARyAhABIjcKAlVJEjEKCnBsYWNlbWVudHMYASADKAsyHS5hcHBzLnYxLlBsYWNlbWVudERlY2xhcmF0aW9uIsYEChRQbGFjZW1lbnREZWNsYXJhdGlvbhIzCgNrZXkYASABKAlCJrpII3IhGEAyHV5bYS16XVthLXowLTldKigtW2EtejAtOV0rKSokEjQKBnRhcmdldBgCIAEoDjIkLmFwcHMudjEuUGxhY2VtZW50RGVjbGFyYXRpb24uVGFyZ2V0EhIKBW1vZGVsGAMgASgJSACIAQESEgoFZmllbGQYBCABKAlIAYgBARIhChlmaWVsZF9zZWxlY3RlZF9hdF9pbnN0YWxsGAUgASgIEhAKA3RhYhgGIAEoCUgCiAEBEhYKBXRpdGxlGAcgASgJQge6SARyAhABEh8KA3VybBgIIAEoCUISukgPcg0yC15odHRwczovLy4rEh0KEHJlcGxhY2VzX2RlZmF1bHQYCSABKAhIA4gBARIrCgVoaW50cxgKIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIBIgBARIOCgZzY29wZXMYCyADKAkSEAoIc2V0dGluZ3MYDCADKAkSDgoGZ3JhbnRzGA0gAygJInQKBlRhcmdldBIWChJUQVJHRVRfVU5TUEVDSUZJRUQQABIUChBUQVJHRVRfRlVMTF9QQUdFEAESFgoSVEFSR0VUX01BSU5fRURJVE9SEAISEgoOVEFSR0VUX1NJREVCQVIQAxIQCgxUQVJHRVRfRklFTEQQBEIICgZfbW9kZWxCCAoGX2ZpZWxkQgYKBF90YWJCEwoRX3JlcGxhY2VzX2RlZmF1bHRCCAoGX2hpbnRzKqwBChJGaWVsZFN5bmNEaXJlY3Rpb24SJAogRklFTERfU1lOQ19ESVJFQ1RJT05fVU5TUEVDSUZJRUQQABIkCiBGSUVMRF9TWU5DX0RJUkVDVElPTl9TT1VSQ0VfT05MWRABEiIKHkZJRUxEX1NZTkNfRElSRUNUSU9OX1NJTktfT05MWRACEiYKIkZJRUxEX1NZTkNfRElSRUNUSU9OX0JJRElSRUNUSU9OQUwQAyqeAQoMU3RvcmFnZU93bmVyEh0KGVNUT1JBR0VfT1dORVJfVU5TUEVDSUZJRUQQABIZChVTVE9SQUdFX09XTkVSX1BST0pFQ1QQARIeChpTVE9SQUdFX09XTkVSX09SR0FOSVpBVElPThACEhYKElNUT1JBR0VfT1dORVJfVVNFUhAEIgQIAxADKhZTVE9SQUdFX09XTkVSX0NVU1RPTUVSQjVaM2dpdGh1Yi5jb20vZWlkZXN0dWRpby9mb2lyL2dlbi9wcm90by9hcHBzL3YxO2FwcHN2MWIGcHJvdG8z", [file_buf_validate_validate, file_google_protobuf_struct]);
 var AppConfigSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 0);
-var CustomerSignInSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 1);
+var UserSignInSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 1);
 var FeatureSchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 2);
 var FeatureNotificationCategorySchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 3);
 var FeatureConsentCategorySchema = /* @__PURE__ */ messageDesc2(file_apps_v1_apps, 4);
@@ -74,7 +74,6 @@ export {
   CredentialsSchema,
   Credentials_Strategy,
   Credentials_StrategySchema,
-  CustomerSignInSchema,
   DiscoveredAccountSchema,
   DiscoveredCountSchema,
   DiscoveredFieldGroupSchema,
@@ -116,6 +115,7 @@ export {
   StorageOwnerSchema,
   SuggestedFieldSchema,
   UISchema,
+  UserSignInSchema,
   WebhookSchema,
   file_apps_v1_apps,
   file_apps_v1_discovery

package/dist/app.js

@@ -138,8 +138,8 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
   downgrade;
   constructor(downgrade) {
     super(
-      `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
-      { graphQLErrors: [{ message: "customer token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
+      `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
+      { graphQLErrors: [{ message: "user token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
     );
     this.name = "FoirAuthDowngradedError";
     this.downgrade = downgrade;
@@ -155,7 +155,7 @@ function reportAuthDowngrade(envelope) {
   if (warnedDowngrade === downgrade.reason) return;
   warnedDowngrade = downgrade.reason;
   console.warn(
-    `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
+    `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
   );
 }
 function refusePrunedDocument(json, options) {
@@ -244,18 +244,18 @@ function appLookupConflictOf(error) {
   if (!keyBy.every((field) => typeof field === "string")) return null;
   return { model, lookup, keyBy };
 }
-function appCustomerUnlinkedOf(error) {
-  const unlinked = extensionOf(error, "customerUnlinked");
+function appUserUnlinkedOf(error) {
+  const unlinked = extensionOf(error, "userUnlinked");
   if (!unlinked) return null;
   const { model, identityProvider } = unlinked;
   if (typeof model !== "string" || typeof identityProvider !== "string") return null;
   return { model, identityProvider };
 }
-function customerEmailUnavailableReasonOf(value) {
+function userEmailUnavailableReasonOf(value) {
   return typeof value === "string" && value !== "" ? value : null;
 }
-function appCustomerEmailUnavailableOf(error) {
-  const reason = customerEmailUnavailableReasonOf(extensionOf(error, "customerEmailUnavailable")?.reason);
+function appUserEmailUnavailableOf(error) {
+  const reason = userEmailUnavailableReasonOf(extensionOf(error, "userEmailUnavailable")?.reason);
   return reason ? { reason } : null;
 }
 function isAppFieldWithheld(error, field) {
@@ -286,13 +286,13 @@ function isSelectableFieldKey(fieldKey) {
 }
 
 // src/app/client.ts
-var CUSTOMER_FIELDS = "id email status emailVerifiedAt";
-function isVerified(customer) {
-  return typeof customer.emailVerifiedAt === "string" && customer.emailVerifiedAt !== "";
+var USER_FIELDS = "id email status emailVerifiedAt";
+function isVerified(user) {
+  return typeof user.emailVerifiedAt === "string" && user.emailVerifiedAt !== "";
 }
-function customerOf(customer) {
-  if (!customer?.id) return null;
-  return { id: customer.id, email: customer.email ?? "", verified: isVerified(customer), status: customer.status ?? "" };
+function userOf(user) {
+  if (!user?.id) return null;
+  return { id: user.id, email: user.email ?? "", verified: isVerified(user), status: user.status ?? "" };
 }
 var RECORD_ID_FIELD = "_id";
 var RECORD_NATURAL_KEY_FIELD = "_naturalKey";
@@ -498,7 +498,7 @@ function createAppClient(config) {
           "integrationConfig",
           `query AppInstallConfig {
             integrationConfig {
-              name enabled middlewareUrl targetModels webhookUrl config customerEmailUnavailable customerSignIn
+              name enabled middlewareUrl targetModels webhookUrl config userEmailUnavailable userSignIn
               sources { key model naturalKey mode fields { appField modelField direction } }
               sinks { key model naturalKey fields { appField modelField direction } }
             }
@@ -515,8 +515,8 @@ function createAppClient(config) {
           settings: got.config ?? {},
           sources: bindingsOf(got.sources),
           sinks: bindingsOf(got.sinks),
-          customerEmailUnavailable: customerEmailUnavailableReasonOf(got.customerEmailUnavailable),
-          customerSignIn: typeof got.customerSignIn === "string" && got.customerSignIn !== "" ? got.customerSignIn : null
+          userEmailUnavailable: userEmailUnavailableReasonOf(got.userEmailUnavailable),
+          userSignIn: typeof got.userSignIn === "string" && got.userSignIn !== "" ? got.userSignIn : null
         };
       },
       async credentials() {
@@ -670,10 +670,10 @@ function createAppClient(config) {
           truncated: answer.truncated === true
         };
       },
-      customer: {
+      user: {
         async save(input) {
           const { model, identity, data, email, sourceModifiedAt } = input;
-          if (identity === "") refuse(`a customer's record on ${model} was saved with no identity`);
+          if (identity === "") refuse(`a user's record on ${model} was saved with no identity`);
           const variables = { modelKey: model, identity, data };
           if (email !== void 0 && email !== "") variables.email = email;
           const timed = sourceModifiedAt !== void 0;
@@ -681,17 +681,17 @@ function createAppClient(config) {
           let answer;
           try {
             answer = await field(
-              "saveCustomerRecord",
-              timed ? `mutation AppSaveCustomerRecord($modelKey: String!, $identity: String!, $email: String, $data: JSON!, $sourceModifiedAt: String) { saveCustomerRecord(modelKey: $modelKey, identity: $identity, email: $email, data: $data, sourceModifiedAt: $sourceModifiedAt) { record created customerCreated stale } }` : `mutation AppSaveCustomerRecord($modelKey: String!, $identity: String!, $email: String, $data: JSON!) { saveCustomerRecord(modelKey: $modelKey, identity: $identity, email: $email, data: $data) { record created customerCreated } }`,
+              "saveUserRecord",
+              timed ? `mutation AppSaveUserRecord($modelKey: String!, $identity: String!, $email: String, $data: JSON!, $sourceModifiedAt: String) { saveUserRecord(modelKey: $modelKey, identity: $identity, email: $email, data: $data, sourceModifiedAt: $sourceModifiedAt) { record created userCreated stale } }` : `mutation AppSaveUserRecord($modelKey: String!, $identity: String!, $email: String, $data: JSON!) { saveUserRecord(modelKey: $modelKey, identity: $identity, email: $email, data: $data) { record created userCreated } }`,
               variables
             );
           } catch (error) {
-            if (appCustomerUnlinkedOf(error)) return { unlinked: true };
+            if (appUserUnlinkedOf(error)) return { unlinked: true };
             throw error;
           }
           const record = answer?.record;
           if (!record || typeof record !== "object" || Array.isArray(record)) {
-            return refuse(`saveCustomerRecord reported no error and returned no record on ${model}`);
+            return refuse(`saveUserRecord reported no error and returned no record on ${model}`);
           }
           return {
             unlinked: false,
@@ -699,20 +699,20 @@ function createAppClient(config) {
             id: recordIdOf(record),
             created: answer?.created === true,
             fieldsWithheld: record.fieldsWithheld === true,
-            customerCreated: answer?.customerCreated === true,
+            userCreated: answer?.userCreated === true,
             stale: answer?.stale === true
           };
         },
         async read(model, identity) {
-          if (identity === "") refuse(`a customer's record on ${model} was read with no identity`);
+          if (identity === "") refuse(`a user's record on ${model} was read with no identity`);
           const record = await field(
-            "customerRecordByIdentity",
-            `query AppCustomerRecord($modelKey: String!, $identity: String!) { customerRecordByIdentity(modelKey: $modelKey, identity: $identity) }`,
+            "userRecordByIdentity",
+            `query AppUserRecord($modelKey: String!, $identity: String!) { userRecordByIdentity(modelKey: $modelKey, identity: $identity) }`,
             { modelKey: model, identity }
           );
           if (!record) return null;
           const id = recordIdOf(record);
-          if (!id) return refuse(`customerRecordByIdentity answered a record with no id on ${model}`);
+          if (!id) return refuse(`userRecordByIdentity answered a record with no id on ${model}`);
           const data = record.data;
           return {
             id,
@@ -723,79 +723,79 @@ function createAppClient(config) {
           };
         },
         async erase(model, identity) {
-          if (identity === "") refuse(`a customer's record on ${model} was erased with no identity`);
+          if (identity === "") refuse(`a user's record on ${model} was erased with no identity`);
           const answer = await field(
-            "eraseCustomerRecord",
-            `mutation AppEraseCustomerRecord($modelKey: String!, $identity: String!) { eraseCustomerRecord(modelKey: $modelKey, identity: $identity) { recordDeleted identityRemoved customerDeleted customerKeptBecause } }`,
+            "eraseUserRecord",
+            `mutation AppEraseUserRecord($modelKey: String!, $identity: String!) { eraseUserRecord(modelKey: $modelKey, identity: $identity) { recordDeleted identityRemoved userDeleted userKeptBecause } }`,
             { modelKey: model, identity }
           );
-          if (!answer) return refuse(`eraseCustomerRecord reported no error and returned no answer on ${model}`);
+          if (!answer) return refuse(`eraseUserRecord reported no error and returned no answer on ${model}`);
           return {
             recordDeleted: answer.recordDeleted === true,
             identityRemoved: answer.identityRemoved === true,
-            customerDeleted: answer.customerDeleted === true,
-            customerKeptBecause: answer.customerKeptBecause ?? null
+            userDeleted: answer.userDeleted === true,
+            userKeptBecause: answer.userKeptBecause ?? null
           };
         }
       }
     },
-    customers: {
+    users: {
       async ensure(email) {
         const address = email.trim();
-        if (address === "") refuse("a customer was asked for with an empty email");
-        const customer = await field(
-          "createCustomer",
-          `mutation AppEnsureCustomer($input: CreateCustomerInput!) { createCustomer(input: $input) { id email emailVerifiedAt } }`,
+        if (address === "") refuse("a user was asked for with an empty email");
+        const user = await field(
+          "createUser",
+          `mutation AppEnsureUser($input: CreateAuthUserInput!) { createUser(input: $input) { id email emailVerifiedAt } }`,
           { input: { email: address, returnExisting: true } }
         );
-        if (!customer?.id) return refuse("createCustomer reported no error and returned no customer");
-        return { id: customer.id, email: customer.email ?? address, verified: isVerified(customer) };
+        if (!user?.id) return refuse("createUser reported no error and returned no user");
+        return { id: user.id, email: user.email ?? address, verified: isVerified(user) };
       },
       async get(id) {
-        if (id.trim() === "") refuse("a customer was asked for with an empty id");
-        const customer = await field(
-          "customer",
-          `query AppCustomer($id: String) { customer(id: $id) { ${CUSTOMER_FIELDS} } }`,
+        if (id.trim() === "") refuse("a user was asked for with an empty id");
+        const user = await field(
+          "user",
+          `query AppUser($id: String) { user(id: $id) { ${USER_FIELDS} } }`,
           { id }
         );
-        return customerOf(customer);
+        return userOf(user);
       },
       async byEmail(email) {
         const address = email.trim();
-        if (address === "") refuse("a customer was asked for with an empty email");
-        const customer = await field(
-          "customer",
-          `query AppCustomerByEmail($email: String) { customer(email: $email) { ${CUSTOMER_FIELDS} } }`,
+        if (address === "") refuse("a user was asked for with an empty email");
+        const user = await field(
+          "user",
+          `query AppUserByEmail($email: String) { user(email: $email) { ${USER_FIELDS} } }`,
           { email: address }
         );
-        return customerOf(customer);
+        return userOf(user);
       },
       async byIdentity(identity) {
-        if (identity === "") refuse("a customer was asked for with no identity");
+        if (identity === "") refuse("a user was asked for with no identity");
         const answer = await field(
-          "customerByIdentity",
-          `query AppCustomerByIdentity($identity: String!) { customerByIdentity(identity: $identity) }`,
+          "userByIdentity",
+          `query AppUserByIdentity($identity: String!) { userByIdentity(identity: $identity) }`,
           { identity }
         );
         return typeof answer === "string" && answer !== "" ? answer : null;
       },
-      async identities(customerId) {
-        if (customerId === "") refuse("a customer's identities were asked for with no customer");
+      async identities(userId) {
+        if (userId === "") refuse("a user's identities were asked for with no user");
         const answer = await field(
-          "customerIdentitiesById",
-          `query AppCustomerIdentities($customerId: ID!) { customerIdentitiesById(customerId: $customerId) }`,
-          { customerId }
+          "userIdentitiesById",
+          `query AppUserIdentities($userId: ID!) { userIdentitiesById(userId: $userId) }`,
+          { userId }
         );
-        if (!Array.isArray(answer)) return refuse("customerIdentitiesById reported no error and returned no list");
+        if (!Array.isArray(answer)) return refuse("userIdentitiesById reported no error and returned no list");
         return answer.filter((identity) => typeof identity === "string");
       },
       async list(query = {}) {
         const search = query.search?.trim() ?? "";
         const page = await field(
-          "customers",
-          `query AppCustomers($first: Int, $after: String, $filter: CustomersFilterInput) {
-            customers(first: $first, after: $after, filter: $filter) {
-              edges { node { ${CUSTOMER_FIELDS} } }
+          "users",
+          `query AppUsers($first: Int, $after: String, $filter: AuthUsersFilterInput) {
+            users(first: $first, after: $after, filter: $filter) {
+              edges { node { ${USER_FIELDS} } }
               pageInfo { hasNextPage endCursor }
             }
           }`,
@@ -805,12 +805,12 @@ function createAppClient(config) {
             ...search !== "" ? { filter: { search } } : {}
           }
         );
-        const customers = [];
+        const users = [];
         for (const edge of page?.edges ?? []) {
-          const customer = customerOf(edge?.node ?? null);
-          if (customer) customers.push(customer);
+          const user = userOf(edge?.node ?? null);
+          if (user) users.push(user);
         }
-        return { customers, hasMore: page?.pageInfo?.hasNextPage === true, endCursor: page?.pageInfo?.endCursor ?? null };
+        return { users, hasMore: page?.pageInfo?.hasNextPage === true, endCursor: page?.pageInfo?.endCursor ?? null };
       }
     },
     organizations: {
@@ -826,9 +826,10 @@ function createAppClient(config) {
           input.settings = { modelKey: settings.modelKey.trim(), data: settings.data };
         }
         if (organization.firstMember !== void 0) {
-          if (organization.firstMember.customerId === "") return refuse("a first member names a customer");
-          input.firstMember = { customerId: organization.firstMember.customerId };
+          if (organization.firstMember.userId === "") return refuse("a first member names a user");
+          input.firstMember = { userId: organization.firstMember.userId };
         }
+        if (organization.ownPool === true) input.ownPool = true;
         const answered = settings === void 0 ? "organizationId status" : "organizationId settingsRecordId status";
         const answer = await field(
           "provisionOrganization",
@@ -856,10 +857,10 @@ function createAppClient(config) {
     },
     notifications: {
       async send(notification) {
-        if (notification.customerId === "" || notification.title.trim() === "") {
-          refuse("a notification needs a customer and a title");
+        if (notification.userId === "" || notification.title.trim() === "") {
+          refuse("a notification needs a user and a title");
         }
-        const input = { customerId: notification.customerId, title: notification.title };
+        const input = { userId: notification.userId, title: notification.title };
         if (notification.message !== void 0) input.message = notification.message;
         if (notification.category !== void 0) input.category = notification.category;
         if (notification.actionUrl !== void 0) input.actionUrl = notification.actionUrl;
@@ -880,8 +881,8 @@ function createAppClient(config) {
       },
       async setConsent(change) {
         const subject = consentSubject(change);
-        if (subject === null) return refuse("a consent change names its customer by customerId or by email, not both");
-        if (subject.value === "" || change.category === "") return refuse("a consent change needs a customer and a category");
+        if (subject === null) return refuse("a consent change names its user by userId or by email, not both");
+        if (subject.value === "" || change.category === "") return refuse("a consent change needs a user and a category");
         const input = {
           [subject.by]: subject.value,
           category: change.category,
@@ -892,11 +893,11 @@ function createAppClient(config) {
         if (change.givenElsewhere !== void 0) input.givenElsewhere = change.givenElsewhere;
         if (change.locale !== void 0) input.locale = change.locale;
         const answer = await field(
-          "setCustomerConsent",
-          `mutation AppSetCustomerConsent($input: SetCustomerConsentInput!) { setCustomerConsent(input: $input) { stale confirmationPending } }`,
+          "setUserConsent",
+          `mutation AppSetUserConsent($input: SetUserConsentInput!) { setUserConsent(input: $input) { stale confirmationPending } }`,
           { input }
         );
-        if (!answer) return refuse("setCustomerConsent reported no error and answered nothing");
+        if (!answer) return refuse("setUserConsent reported no error and answered nothing");
         return { stale: answer.stale === true, confirmationPending: answer.confirmationPending === true };
       }
     },
@@ -934,9 +935,9 @@ function createAppClient(config) {
 }
 function consentSubject(change) {
   const loose = change;
-  if (loose.email !== void 0 && loose.customerId !== void 0) return null;
+  if (loose.email !== void 0 && loose.userId !== void 0) return null;
   if (loose.email !== void 0) return { by: "email", value: loose.email.trim() };
-  return { by: "customerId", value: loose.customerId ?? "" };
+  return { by: "userId", value: loose.userId ?? "" };
 }
 function directionOf(raw) {
   const name = (raw ?? "").replace(/^FIELD_SYNC_DIRECTION_/, "");
@@ -1150,18 +1151,18 @@ var APP_HOOK_EVENTS = [
   "RECORD_DELETED",
   "RECORD_PUBLISHED",
   "RECORD_UNPUBLISHED",
-  "CUSTOMER_CREATED",
-  "CUSTOMER_UPDATED",
-  "CUSTOMER_DELETED",
-  "CUSTOMER_MERGED",
+  "USER_CREATED",
+  "USER_UPDATED",
+  "USER_DELETED",
+  "USER_MERGED",
   "SESSION_REVOKED",
   "OPERATION_COMPLETED",
   "OPERATION_FAILED",
   "OPERATION_CANCELLED",
   "OPERATION_TIMED_OUT",
-  "ADMIN_MEMBERSHIP_GRANTED",
-  "ADMIN_MEMBERSHIP_REVOKED",
-  "ADMIN_ROLE_CHANGED",
+  "MEMBERSHIP_GRANTED",
+  "MEMBERSHIP_REVOKED",
+  "MEMBERSHIP_ROLE_CHANGED",
   "TENANT_PLAN_CHANGED",
   "TENANT_SUBSCRIPTION_STATUS_CHANGED",
   "PROJECT_CREATED",
@@ -1171,7 +1172,7 @@ var APP_HOOK_EVENTS = [
   "MIGRATION_APPLIED",
   "BULK_UPDATE_COMPLETED",
   "BULK_PUBLISH_COMPLETED",
-  "CUSTOMER_PREFERENCE_CHANGED",
+  "USER_PREFERENCE_CHANGED",
   "ORGANIZATION_CREATED",
   "ORGANIZATION_UPDATED",
   "ORGANIZATION_MOVED",
@@ -1205,6 +1206,7 @@ var APP_GRANTS = [
   "operations:complete",
   "organizations:create",
   "organizations:delete",
+  "project:stand",
   "status:write",
   "users:create",
   "users:read.all",
@@ -1229,12 +1231,12 @@ export {
   FoirRequestError,
   MAX_APP_MANIFEST_BYTES,
   RECORD_KEY_RULE,
-  appCustomerEmailUnavailableOf,
-  appCustomerUnlinkedOf,
   appLookupConflictOf,
   appModelFieldName,
   appModelTypeName,
   appSelectorEnumValue,
+  appUserEmailUnavailableOf,
+  appUserUnlinkedOf,
   createAppClient,
   isAppFieldWithheld,
   readAppDispatch,

package/dist/auth/access.d.ts

@@ -1,5 +1,5 @@
 /**
- * What the signed-in customer may see: the roles they hold and the scopes those
+ * What the signed-in user may see: the roles they hold and the scopes those
  * roles resolve to, as the platform resolved them for the request that asked.
  *
  * Use it to decide what to SHOW: a staff menu, an edit button. It guards
@@ -14,48 +14,48 @@ import { type AuthOpOptions } from './ops';
 import { type SessionAdapter } from './auth';
 import type { FoirEnv } from '../graphql/foir-request';
 /**
- * A signed-in customer's access, as the platform resolved it. Plain data, so it
+ * A signed-in user's access, as the platform resolved it. Plain data, so it
  * can be returned from a loader or a server component and read on the other
  * side with {@link hasRole} and {@link hasScope}.
  */
 export interface FoirAccess {
-    /** The signed-in customer. */
-    customerId: string;
+    /** The signed-in user. */
+    userId: string;
     /**
-     * The keys of the roles the customer holds here, now: across the project, and
+     * The keys of the roles the user holds here, now: across the project, and
      * in the organization they stand in. An empty list means they hold none.
      *
      * `null` means the platform did not say, which is not the same thing: treat it
      * as not known, never as "holds no role". {@link hasRole} answers false for
      * it, and {@link requireRole} refuses with `roles_unknown` so an outage is not
-     * mistaken for a customer who is not staff.
+     * mistaken for a user who holds no role.
      */
     roles: string[] | null;
     /**
-     * Everything the customer may do through this key: the set the platform's own
+     * Everything the user may do through this key: the set the platform's own
      * checks read for the request. Ask it with {@link hasScope} and not by looking
      * for a string, because a wider grant covers a narrower one.
      */
     scopes: string[];
 }
 /**
- * The access of the customer a token belongs to, or `null` when the request
- * carries no customer. Pass the customer's access token as
+ * The access of the user a token belongs to, or `null` when the request
+ * carries no user. Pass the user's access token as
  * `options.bearerToken`.
  */
-export declare function customerAccess(env: FoirEnv, options?: AuthOpOptions): Promise<FoirAccess | null>;
+export declare function userAccess(env: FoirEnv, options?: AuthOpOptions): Promise<FoirAccess | null>;
 /**
- * The access of the session's customer, or `null` when nobody is signed in.
+ * The access of the session's user, or `null` when nobody is signed in.
  * Renews a lapsed session once, as every signed-in read does.
  */
 export declare function getSessionAccess(adapter: SessionAdapter, env: FoirEnv): Promise<FoirAccess | null>;
 /**
- * Whether the customer holds the role with this key. False when nobody is
+ * Whether the user holds the role with this key. False when nobody is
  * signed in, and false when their roles are not known.
  */
 export declare function hasRole(access: FoirAccess | null | undefined, key: string): boolean;
 /**
- * Whether the customer's scopes cover this one, by the platform's rule: a wider
+ * Whether the user's scopes cover this one, by the platform's rule: a wider
  * reach covers a narrower one (`records:read.all` covers `records:read`), a
  * grant for every model covers one model (`records:write` covers
  * `records:write:post`), and never the other way round. A scope that is not a
@@ -66,11 +66,11 @@ export declare function hasScope(access: FoirAccess | null | undefined, scope: s
 export type FoirAccessDenial = 
 /** Nobody is signed in. */
 'signed_out'
-/** The customer does not hold the role. */
+/** The user does not hold the role. */
  | 'role_not_held'
-/** The platform did not say which roles the customer holds. */
+/** The platform did not say which roles the user holds. */
  | 'roles_unknown'
-/** The customer's scopes do not cover the scope. */
+/** The user's scopes do not cover the scope. */
  | 'scope_not_held';
 /**
  * What {@link requireRole} and {@link requireScope} throw. Catch it by class or
@@ -90,16 +90,16 @@ export declare class FoirAccessDeniedError extends Error {
     });
 }
 /**
- * Require a signed-in customer who holds the role with this key, in a server
+ * Require a signed-in user who holds the role with this key, in a server
  * route or a loader. Returns their access; throws
  * {@link FoirAccessDeniedError} otherwise.
  *
- * This keeps a page from rendering for the wrong customer. It is not what
+ * This keeps a page from rendering for the wrong user. It is not what
  * protects the data: the platform checks every request the page then makes.
  */
 export declare function requireRole(adapter: SessionAdapter, env: FoirEnv, key: string): Promise<FoirAccess>;
 /**
- * Require a signed-in customer whose scopes cover this one, by the rule
+ * Require a signed-in user whose scopes cover this one, by the rule
  * {@link hasScope} reads. Returns their access; throws
  * {@link FoirAccessDeniedError} otherwise.
  */