@foir/sdk 0.21.0 → 0.23.0

package/dist/auth/hosted.d.ts

@@ -1,11 +1,11 @@
 /**
  * Hosted-login bridge — for storefronts that delegate sign-in to a Foir
- * white-label front door (the `customerLoginWithFoir` flow) instead of
+ * white-label front door (the `loginWithFoir` flow) instead of
  * rendering their own login UI.
  *
  * The front door sets a first-party session cookie on the registrable domain;
  * because that domain is shared, the cookie reaches the storefront, which
- * exchanges it server-side for a short-lived customer bearer + identity. The
+ * exchanges it server-side for a short-lived user bearer + identity. The
  * cookie is the durable credential (re-exchanged on bearer expiry) — there's
  * no separate refresh token in this flow.
  *
@@ -15,7 +15,7 @@
 export interface HostedLoginConfig {
     /** White-label front-door origin, e.g. `https://login.example.com`. */
     loginOrigin: string;
-    /** Session cookie name set on the registrable domain. Default `foir_customer_session`. */
+    /** Session cookie name set on the registrable domain. Default `foir_session`. */
     cookieName?: string;
     /** Session-exchange path on the front door. Default `/session/token`. */
     sessionPath?: string;
@@ -29,13 +29,13 @@ export interface HostedLoginConfig {
 export declare function hostedLoginUrl(config: HostedLoginConfig, returnTo?: string): string;
 /**
  * Build the redirect URL that ENDS the hosted session — the mirror of
- * `hostedLoginUrl`, and the only thing that actually signs a customer out on
+ * `hostedLoginUrl`, and the only thing that actually signs a user out on
  * this flow.
  *
  * The cookie is the durable credential. Disposing of a bearer, clearing a
- * local session, or calling the `customerLogout` mutation (which clears
+ * local session, or calling the `logout` mutation (which clears
  * upstream provider tokens and nothing else) all leave it in place, and the
- * next request re-establishes the customer from it. This URL points at the
+ * next request re-establishes the user from it. This URL points at the
  * front door's end-session endpoint, which revokes the session row and clears
  * the cookie before returning the browser to `returnTo`.
  *
@@ -50,7 +50,7 @@ export declare function hostedLogoutUrl(config: HostedLoginConfig, clientId: str
 /** The identity + bearer returned by a successful hosted-session exchange. */
 export interface HostedSession {
     token: string;
-    customerId: string;
+    userId: string;
     email: string;
     /**
      * Seconds until `token` lapses, from the endpoint's `expires_in`.
@@ -61,7 +61,7 @@ export interface HostedSession {
      * lifetime (coupling a storefront to a server constant it cannot see) or to
      * decode `exp` off the JWT. Both re-derive a number the response already
      * carried, and a consumer that does neither treats a 15-minute bearer as good
-     * forever — which reads as a customer being signed out mid-session.
+     * forever — which reads as a user being signed out mid-session.
      *
      * Store the death date, not this number: it is seconds from when the exchange
      * ANSWERED, and a value held across requests is already stale.
@@ -76,9 +76,9 @@ export interface HostedSession {
  * reason says what happened.
  *
  * Collapsing all of this to `null` is what made a transient blip on
- * `/session/token` indistinguishable from a genuinely signed-out customer. The
+ * `/session/token` indistinguishable from a genuinely signed-out user. The
  * only safe-looking action on a bare `null` is to clear the session and send
- * the customer to the front door, so one 502 signed out a customer whose 30-day
+ * the user to the front door, so one 502 signed out a user whose 30-day
  * cookie was perfectly valid — and the route's rate limiter is deliberately
  * fail-open for exactly the opposite reason ("a Redis outage should degrade an
  * authenticated app, not log it out").
@@ -90,7 +90,7 @@ export type HostedSessionResult =
     session: HostedSession;
 }
 /**
- * The customer is signed out. Act on it: clear any local session and send
+ * The user is signed out. Act on it: clear any local session and send
  * them to `hostedLoginUrl`.
  *
  * `no-cookie` — nothing to exchange. `rejected` — the front door refused the
@@ -102,12 +102,12 @@ export type HostedSessionResult =
 }
 /**
  * The exchange could not be completed, and it says NOTHING about whether the
- * customer is signed in. KEEP the existing session, serve the request, try
+ * user is signed in. KEEP the existing session, serve the request, try
  * again on the next one.
  *
  * `forbidden` is the odd one: a 403 means the CSRF header did not arrive
  * (a proxy stripping it, most likely), which is a misconfiguration rather
- * than a blip. Retrying will not fix it — but signing the customer out would
+ * than a blip. Retrying will not fix it — but signing the user out would
  * be wrong, so the safe action is the same and it is grouped by that.
  */
  | {
@@ -119,7 +119,7 @@ export type HostedSessionResult =
     cause?: unknown;
 };
 /**
- * Exchange the hosted-login cookie on an incoming request for a customer
+ * Exchange the hosted-login cookie on an incoming request for a user
  * bearer + identity (server-to-server: forwards the cookie to the front door's
  * session endpoint with the CSRF header).
  *
@@ -127,3 +127,27 @@ export type HostedSessionResult =
  * returning `null` for everything that is not a success.
  */
 export declare function fetchHostedSession(request: Request, config: HostedLoginConfig): Promise<HostedSessionResult>;
+/**
+ * What the hosted login said beside the code when it sent someone back to your
+ * app. A sign-in it refused carries a stable code (`foir_error`); one that
+ * connected a provider to the person's account on the way in names the
+ * provider (`foir_connected`). Each comes with a sentence your app can show as
+ * it is, so an app that does nothing more still shows words and never a code.
+ * Show your own words for a code by switching on `code`.
+ */
+export type HostedSignInNotice = {
+    kind: 'refused';
+    code: string;
+    message: string;
+} | {
+    kind: 'connected';
+    provider: string;
+    message: string;
+};
+/**
+ * Reads the notice off the address the hosted login sent the browser back to:
+ * your callback URL, its search string, or its parameters. `names` maps a
+ * provider's key to the name to show (from `getAuthProviders`); without it the
+ * key is shown. Null when the hosted login said nothing.
+ */
+export declare function hostedSignInNoticeOf(location: string | URL | URLSearchParams, names?: Record<string, string>): HostedSignInNotice | null;

package/dist/auth/index.d.ts

@@ -1,8 +1,8 @@
 /**
- * `@foir/sdk/auth` — framework-agnostic Foir customer auth.
+ * `@foir/sdk/auth`: framework-agnostic sign-in for your app's users.
  *
- * The whole customer auth surface — login, register, OTP, external providers,
- * refresh, password management, email verification and account deletion — over
+ * The whole sign-in surface (login, register, OTP, external providers,
+ * refresh, password management, email verification and account deletion) over
  * the server's generated `auth` namespace, plus token lifecycle with an
  * injected `SessionAdapter`, guards, and the optional hosted-login bridge.
  *
@@ -10,15 +10,15 @@
  * the caller's own manifest advertises, through the same op transport
  * `@foir/sdk/data` uses, so `graphql` is not on this module's path at all.
  */
-export { customerLogin, customerRegister, customerRequestOTP, customerLoginOTP, customerRefreshToken, customerLoginWithProvider, customerProviderCallback, customerProviderVerifyOTP, getAuthProviders, getAuthConfig, getDefaultAuthProvider, customerSignupContext, customerJoinWaitlist, customerRequestPasswordReset, customerResetPassword, customerUpdatePassword, customerVerifyEmail, currentUser, myProviderToken, customerLogout, deleteMyAccount, myOrganizations, selectOrganization, registerOrganization, saveSession, clearSession, getSessionToken, getSessionCustomer, loginWithPassword, registerWithPassword, loginWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, requireAdmin, } from './auth';
-export type { FoirAuthTokens, FoirCustomer, FoirUser, SessionAdapter, RequireAuthOptions, RequireAdminOptions, } from './auth';
-export { customerAccess, getSessionAccess, hasRole, hasScope, requireRole, requireScope, FoirAccessDeniedError, } from './access';
+export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, verifyEmail, currentUser, myProviderToken, logout, deleteMyAccount, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, makeRecoveryCodes, myOrganizations, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
+export type { FoirAuthTokens, FoirUser, SessionAdapter, RequireAuthOptions, } from './auth';
+export { userAccess, getSessionAccess, hasRole, hasScope, requireRole, requireScope, FoirAccessDeniedError, } from './access';
 export type { FoirAccess, FoirAccessDenial } from './access';
 export { FoirAuthDowngradedError, FoirSessionExpiredError } from '../graphql/foir-request';
 export { AUTH_OPS } from './ops';
 export type { AuthOpName, AuthOpOptions } from './ops';
-export { hostedLoginUrl, hostedLogoutUrl, fetchHostedSession } from './hosted';
-export type { HostedLoginConfig, HostedSession, HostedSessionResult } from './hosted';
+export { hostedLoginUrl, hostedLogoutUrl, fetchHostedSession, hostedSignInNoticeOf } from './hosted';
+export type { HostedLoginConfig, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
 export { createFoirSessionClient } from './session-client';
 export type { FoirSessionClient, FoirSessionConfig, FoirSessionUser, } from './session-client';
-export type { CustomerAuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, WaitlistJoinResult, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, DeleteAccountResult, MyOrganization, SelectedOrganization, } from './operations';
+export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, WaitlistJoinResult, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';

package/dist/auth/operations.d.ts

@@ -1,5 +1,5 @@
 /**
- * Foir customer-auth result and input types.
+ * Foir sign-in result and input types.
  *
  * These are PLATFORM-STABLE primitives — login / register / refresh / OTP /
  * provider login / password management / account lifecycle are fixed-shape
@@ -25,15 +25,15 @@
  *     and they are the reason `@foir/sdk/auth/session` had to exist as a
  *     separate graphql-free door.
  *
- * The project-specific customer PROFILE (e.g. `myProfile.isAdmin`) is still NOT
- * here — that shape varies per project, so it stays consumer-injected (see
+ * Anything project-specific about the user (a profile record, say) is NOT
+ * here: that shape varies per project, so it stays consumer-injected (see
  * `requireAuth`'s `resolveUser`).
  */
 /** The common auth result every login/register/refresh mutation returns. */
-export interface CustomerAuthResult {
+export interface AuthResult {
     token: string;
     refreshToken: string;
-    customerId: string;
+    userId: string;
     email: string;
 }
 /** Result of initiating a provider login — a redirect URL or an inline token. */
@@ -70,7 +70,7 @@ export interface ProviderOTPVerifyInput {
     email: string;
     otp: string;
 }
-/** The project's customer signup mode. */
+/** The project's signup mode. */
 export type SignupMode = 'PUBLIC' | 'RESTRICTED' | 'WAITLIST' | 'CLOSED';
 /** The signup surface a self-hosted frontend reads to render the right UI. */
 export interface SignupContext {
@@ -93,7 +93,7 @@ export interface AuthConfigProvider {
 /**
  * The project's public auth configuration: which built-in methods are on, and
  * which external providers a login screen should offer. Readable before any
- * customer token exists — it is what a login screen renders itself from.
+ * user token exists: it is what a login screen renders itself from.
  */
 export interface AuthConfig {
     passwordEnabled: boolean;
@@ -110,8 +110,8 @@ export interface DefaultAuthProvider {
     type: string | null;
 }
 /**
- * The calling customer, resolved from the bearer token. `null` when the request
- * carried no customer token — an absent session is an answer, not a failure.
+ * The calling user, resolved from the bearer token. `null` when the request
+ * carried no user token: an absent session is an answer, not a failure.
  */
 export interface CurrentUser {
     id: string;
@@ -123,18 +123,33 @@ export interface CurrentUser {
     /** ISO-8601. */
     createdAt: string;
 }
+/** What a provider token read did about the token's freshness. */
+export type ProviderTokenRefresh = 'NOT_ATTEMPTED' | 'REFRESHED' | 'FAILED' | 'HELD_BACK';
 /**
- * A stored upstream provider token for the calling customer. `null` when there
- * is no customer token on the request, or none stored for that provider.
+ * A stored upstream provider token for the calling user. `myProviderToken`
+ * answers `null` when there is no user token on the request, and
+ * `linked: false` when the user has none stored for that provider.
  */
 export interface ProviderToken {
     providerKey: string;
-    accessToken: string;
+    /** False when the user has no token for the provider; every token field is then null. */
+    linked: boolean;
+    accessToken: string | null;
     refreshToken: string | null;
     /** ISO-8601. */
     expiresAt: string | null;
     /** Space-separated provider scopes, as the provider issued them. */
     scopes: string | null;
+    /**
+     * What the read did: `REFRESHED` renewed it, `FAILED` tried and served the
+     * stored token, `HELD_BACK` had tried within the last minute, and
+     * `NOT_ATTEMPTED` found it fresh or had nothing to renew it with.
+     */
+    refresh: ProviderTokenRefresh | null;
+    /** Where a failed refresh failed, such as `"refresh grant"`. */
+    refreshFailure: string | null;
+    /** Only the user signing in with the provider again mends the connection. */
+    reauthenticate: boolean;
 }
 /** What a self-serve account deletion removed. */
 export interface DeleteAccountResult {
@@ -142,11 +157,122 @@ export interface DeleteAccountResult {
     recordsDeleted: number;
     filesDeleted: number;
 }
+/** The calling user's own profile, as `updateMyProfile` answers it. */
+export interface MyProfile {
+    id: string;
+    email: string;
+    firstName: string | null;
+    lastName: string | null;
+    avatarUrl: string | null;
+    /** BCP47, or null where they follow the project default. */
+    preferredLocale: string | null;
+}
 /**
- * One organization the calling operator may stand in, as `myOrganizations`
+ * What `updateMyProfile` changes. A field left out stays as it is; an empty
+ * string clears it.
+ */
+export type MyProfileChange = {
+    firstName?: string;
+    lastName?: string;
+    avatarUrl?: string;
+    /** A locale the project publishes. */
+    preferredLocale?: string;
+};
+/** Somewhere the calling user is signed in, or a personal access token they hold. */
+export interface MySession {
+    /** The session's handle, which {@link endMySession} takes. It signs nobody in. */
+    id: string;
+    /** `browser` for a sign-in, `personal_access_token` for a token. */
+    kind: string;
+    /** A personal access token's name. */
+    name: string | null;
+    /** The first characters of a personal access token's value. */
+    tokenPrefix: string | null;
+    /** The app it was signed in through. */
+    appName: string | null;
+    /** ISO-8601. */
+    createdAt: string | null;
+    /** ISO-8601. */
+    lastSeenAt: string | null;
+    /** ISO-8601. */
+    expiresAt: string | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    /** Whether it is the session making the request. */
+    current: boolean;
+}
+/** A personal access token just made: its value is shown here once. */
+export interface NewPersonalAccessToken {
+    token: MySession;
+    value: string;
+}
+/** A provider the calling user signs in with. */
+export interface MySignInMethod {
+    provider: string;
+    /** The address the provider gave when it was connected. */
+    email: string | null;
+    /** ISO-8601. */
+    connectedAt: string | null;
+}
+/** A second factor, passkey or set of recovery codes the calling user holds. */
+export interface MyFactor {
+    /** `totp`, `security_key`, `passkey` or `recovery_codes`. */
+    kind: string;
+    /** What {@link removeFactor} takes. */
+    id: string;
+    /**
+     * A security key's or passkey's name. A passkey made on the project's own
+     * login domain is named by that domain, the only one it signs in on.
+     */
+    name: string | null;
+    /** ISO-8601. */
+    addedAt: string | null;
+    /** For recovery codes: how many are left unused. */
+    remaining: number | null;
+}
+/**
+ * A step-up begun with the calling user's password: waiting for a second
+ * factor, or, for a user who holds none, already proven by the password.
+ */
+export interface StepUp {
+    /** What {@link completeStepUp} takes, for a user who holds a second factor. */
+    handle: string | null;
+    /** For a user who holds no second factor: the proof their password is, for one change to their factors. */
+    elevatedHandle: string | null;
+    /** Whether a security key or passkey can prove it. */
+    webauthn: boolean;
+    /** Whether an authenticator app's code can prove it. */
+    totp: boolean;
+    /** The publicKey options for `navigator.credentials.get`, as JSON. */
+    webauthnOptionsJson: string | null;
+}
+/** A second factor being added, waiting for the browser or the authenticator app. */
+export interface FactorEnrollment {
+    /** What {@link completeFactorEnrollment} takes. */
+    handle: string;
+    /** For a security key or passkey: the publicKey options for `navigator.credentials.create`, as JSON. */
+    webauthnOptionsJson: string | null;
+    /** For an authenticator app: the key to enter by hand. */
+    totpSecret: string | null;
+    /** For an authenticator app: a QR code of the key, as a data URI. */
+    totpQr: string | null;
+}
+/** An app the calling user has agreed may act for them. */
+export interface AuthorizedApp {
+    /** The consent's id, which {@link revokeAuthorizedApp} takes. */
+    id: string;
+    clientId: string;
+    clientName: string;
+    /** What the app may carry for them, in the permission catalogue's names. */
+    grants: string[];
+    /** ISO-8601. */
+    grantedAt: string | null;
+}
+/**
+ * One organization the calling user may stand in, as `myOrganizations`
  * returns it.
  *
- * Identity, not configuration: the id to hand to {@link selectOrganization}, a
+ * Identity, not configuration: the id a request names to act there, a
  * name to render, the status, and where it sits. Only active organizations are
  * returned today; `status` is here so that a widening is visible to the caller
  * rather than silent.
@@ -157,7 +283,7 @@ export interface DeleteAccountResult {
  * this surface's to hand out.
  *
  * THE LIST IS A SUBTREE. A membership at an organization reaches everything
- * beneath it, so an operator who runs a group is offered the group and every
+ * beneath it, so someone who runs a group is offered the group and every
  * client under it. Draw it flat and a reseller's clients render as its
  * siblings, which is what the three position fields are for.
  */
@@ -168,7 +294,7 @@ export interface MyOrganization {
     /**
      * The immediate parent, or null for a root.
      *
-     * A root OF THE PROJECT, not of the caller's view: an operator whose
+     * A root OF THE PROJECT, not of the caller's view: a member whose
      * membership sits three levels down sees their own organization with a parent
      * they cannot read. Null means there is no parent; it is never the empty
      * string, because that is a third value with no reading.
@@ -179,16 +305,16 @@ export interface MyOrganization {
      * project root.
      *
      * IDS, not names, and the whole path — including ancestors this caller cannot
-     * read. An id is disclosed to everything below it; a name is row content an
-     * operator further down may not be entitled to. A path trimmed to the
-     * readable ancestors would have gaps or a false root, and two operators of
+     * read. An id is disclosed to everything below it; a name is row content a
+     * member further down may not be entitled to. A path trimmed to the
+     * readable ancestors would have gaps or a false root, and two members of
      * one organization would then see different paths to it.
      */
     ancestorIds: string[];
     /**
      * Levels above this organization in the PROJECT's tree: 0 is a project root.
      *
-     * The project's depth rather than the caller's, so two operators looking at
+     * The project's depth rather than the caller's, so two members looking at
      * the same organization agree about where it is. Indent by the difference
      * from the shallowest entry in the list if you want the caller's own view.
      */
@@ -197,7 +323,7 @@ export interface MyOrganization {
      * The caller's own role in this organization, or null when their
      * membership carries none (or a disabled one). Never another member's role.
      *
-     * ONE ROLE, NOT THE WHOLE AUTHORITY. The platform resolves the operator's
+     * ONE ROLE, NOT THE WHOLE AUTHORITY. The platform resolves the member's
      * authority per request as the union of the roles on every membership that
      * reaches this organization (one held in it and every one held above it),
      * together with their own roles in the project. This field is the role of
@@ -206,6 +332,12 @@ export interface MyOrganization {
      * sees part of what the next request is allowed and not the whole of it.
      */
     role: MyOrganizationRole | null;
+    /**
+     * Where the list goes on from: pass the last entry's cursor as `after` to
+     * read the next page. Null on an entry no list gave, such as the one
+     * `registerOrganization` returns.
+     */
+    cursor: string | null;
 }
 /** A role as `myOrganizations` reports it: enough to match a policy and to render. */
 export interface MyOrganizationRole {
@@ -219,15 +351,3 @@ export interface MyOrganizationRole {
      */
     grants: string[];
 }
-/**
- * Where the caller now stands, as `selectMyOrganization` returns it.
- *
- * Two fields, because two are all there is to say. It is NOT a session context:
- * an operator is a customer, and the platform's admin session shape — user,
- * available tenants, effective permissions — describes a population this level
- * exists to keep them out of.
- */
-export interface SelectedOrganization {
-    orgId: string;
-    orgName: string;
-}

package/dist/auth/ops.d.ts

@@ -41,37 +41,55 @@ export declare const AUTH_OPS: {
     readonly authConfig: "authConfig";
     readonly authProviders: "authProviders";
     readonly defaultAuthProvider: "defaultAuthProvider";
-    readonly customerSignupContext: "customerSignupContext";
+    readonly signupContext: "signupContext";
     readonly currentUser: "currentUser";
     readonly myProviderToken: "myProviderToken";
     readonly whoami: "whoami";
-    readonly customerLogin: "customerLogin";
-    readonly customerRegister: "customerRegister";
-    readonly customerRequestOTP: "customerRequestOTP";
-    readonly customerLoginOTP: "customerLoginOTP";
-    readonly customerRefreshToken: "customerRefreshToken";
-    readonly customerLogout: "customerLogout";
-    readonly customerJoinWaitlist: "customerJoinWaitlist";
-    readonly customerRequestPasswordReset: "customerRequestPasswordReset";
-    readonly customerResetPassword: "customerResetPassword";
-    readonly customerUpdatePassword: "customerUpdatePassword";
-    readonly customerVerifyEmail: "customerVerifyEmail";
+    readonly login: "login";
+    readonly register: "register";
+    readonly requestOTP: "requestOTP";
+    readonly loginWithOTP: "loginWithOTP";
+    readonly refreshToken: "refreshToken";
+    readonly logout: "logout";
+    readonly joinWaitlist: "joinWaitlist";
+    readonly requestPasswordReset: "requestPasswordReset";
+    readonly resetPassword: "resetPassword";
+    readonly updatePassword: "updatePassword";
+    readonly verifyEmail: "verifyEmail";
     readonly deleteMyAccount: "deleteMyAccount";
+    readonly updateMyProfile: "updateMyProfile";
+    readonly myAuthorizedApps: "myAuthorizedApps";
+    readonly revokeAuthorizedApp: "revokeAuthorizedApp";
+    readonly mySessions: "mySessions";
+    readonly endMySession: "endMySession";
+    readonly signOutEverywhere: "signOutEverywhere";
+    readonly createPersonalAccessToken: "createPersonalAccessToken";
+    readonly mySignInMethods: "mySignInMethods";
+    readonly connectSignInMethod: "connectSignInMethod";
+    readonly disconnectSignInMethod: "disconnectSignInMethod";
+    readonly myFactors: "myFactors";
+    readonly beginStepUp: "beginStepUp";
+    readonly completeStepUp: "completeStepUp";
+    readonly beginFactorEnrollment: "beginFactorEnrollment";
+    readonly completeFactorEnrollment: "completeFactorEnrollment";
+    readonly removeFactor: "removeFactor";
+    readonly makeRecoveryCodes: "makeRecoveryCodes";
     readonly myOrganizations: "myOrganizations";
-    readonly selectMyOrganization: "selectMyOrganization";
-    readonly registerOperatorOrganization: "registerOperatorOrganization";
-    readonly customerLoginWithProvider: "customerLoginWithProvider";
-    readonly customerProviderCallback: "customerProviderCallback";
-    readonly customerProviderVerifyOTP: "customerProviderVerifyOTP";
+    readonly registerOrganization: "registerOrganization";
+    readonly loginWithProvider: "loginWithProvider";
+    readonly providerCallback: "providerCallback";
+    readonly providerVerifyOTP: "providerVerifyOTP";
+    readonly confirmProviderLink: "confirmProviderLink";
+    readonly resendProviderLinkCode: "resendProviderLinkCode";
 };
 /** One of the auth namespace's root field names. */
 export type AuthOpName = (typeof AUTH_OPS)[keyof typeof AUTH_OPS];
 /** Per-call overrides for an auth op. */
 export interface AuthOpOptions {
     /**
-     * Customer bearer token. api-public still needs the `x-api-key` to resolve
-     * the project; the bearer adds the customer identity the post-credential ops
-     * (`currentUser`, `customerUpdatePassword`, `deleteMyAccount`, …) are
+     * User bearer token. api-public still needs the `x-api-key` to resolve
+     * the project; the bearer adds the user identity the post-credential ops
+     * (`currentUser`, `updatePassword`, `deleteMyAccount`, …) are
      * authorised by. Ignored by the pre-credential ops, which mint it.
      */
     bearerToken?: string;
@@ -85,7 +103,7 @@ export interface AuthOpOptions {
     /**
      * The organization the call acts in, named by the address of the page it is
      * for, sent as `X-Org-Url`: same contract as `FoirClientConfig.orgUrl`. A
-     * storefront on a path per organization signs its customers in on those
+     * storefront on a path per organization signs its users in on those
      * pages, and names the organization the way every other request from them
      * does.
      */

package/dist/auth/session-client.d.ts

@@ -19,7 +19,7 @@
  * There is no refresh token in this flow. Re-exchanging the cookie IS the
  * refresh, which is why nothing here needs rotation or reuse-detection: the
  * durable credential is an opaque server-side session handle, revocable at any
- * time from the admin panel or `signOut()`.
+ * time from the console or `signOut()`.
  *
  * REQUIRES a verified custom login domain that shares a registrable domain with
  * your app (app.acme.com + login.acme.com). That is what makes the cookie
@@ -47,7 +47,7 @@ export interface FoirSessionConfig {
 }
 /** The identity behind the current session. */
 export interface FoirSessionUser {
-    customerId: string;
+    userId: string;
     email: string;
 }
 export interface FoirSessionClient {
@@ -57,7 +57,7 @@ export interface FoirSessionClient {
      * exchange. Call this before each API request — do not cache the result.
      */
     getToken(): Promise<string | null>;
-    /** The signed-in customer, or null. Exchanges if the session isn't loaded yet. */
+    /** The signed-in user, or null. Exchanges if the session isn't loaded yet. */
     getUser(): Promise<FoirSessionUser | null>;
     /** Revoke the session server-side and clear the cookie. Idempotent. */
     signOut(): Promise<void>;

package/dist/auth-session.js

@@ -64,14 +64,14 @@ function createFoirSessionClient(config) {
       } catch {
         return cached;
       }
-      if (!json.access_token || !json.customer_id) return cached;
+      if (!json.access_token || !json.user_id) return cached;
       const expiresIn = typeof json.expires_in === "number" ? json.expires_in : 0;
       const next = {
         token: json.access_token,
         expiresAt: Date.now() + expiresIn * 1e3,
-        user: { customerId: json.customer_id, email: json.email ?? "" }
+        user: { userId: json.user_id, email: json.email ?? "" }
       };
-      const changed = cached?.user.customerId !== next.user.customerId;
+      const changed = cached?.user.userId !== next.user.userId;
       cached = next;
       scheduleRefresh(next.expiresAt);
       if (changed) emit(next.user);