@foir/sdk 0.21.0 → 0.23.0

package/dist/auth.js

@@ -5,10 +5,7 @@ import { print as print2 } from "graphql";
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 var FOIR_CREDENTIALS_DOC = "https://docs.foir.dev/credentials";
 function foirKeyKind(apiKey) {
@@ -217,8 +214,8 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
   downgrade;
   constructor(downgrade) {
     super(
-      `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
-      { graphQLErrors: [{ message: "customer token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
+      `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
+      { graphQLErrors: [{ message: "user token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
     );
     this.name = "FoirAuthDowngradedError";
     this.downgrade = downgrade;
@@ -226,7 +223,7 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
 };
 var FoirSessionExpiredError = class extends FoirRequestError {
   constructor(options) {
-    super("[foir] the customer session has expired and could not be refreshed: sign in again", {
+    super("[foir] the user session has expired and could not be refreshed: sign in again", {
       cause: options?.cause,
       graphQLErrors: [{ message: "session expired", extensions: { code: "SESSION_EXPIRED" } }]
     });
@@ -243,7 +240,7 @@ function reportAuthDowngrade(envelope) {
   if (warnedDowngrade === downgrade.reason) return;
   warnedDowngrade = downgrade.reason;
   console.warn(
-    `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
+    `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
   );
 }
 function refusePrunedDocument(json, options) {
@@ -1076,42 +1073,63 @@ var AUTH_OPS = {
   authConfig: "authConfig",
   authProviders: "authProviders",
   defaultAuthProvider: "defaultAuthProvider",
-  customerSignupContext: "customerSignupContext",
+  signupContext: "signupContext",
   // Post-credential self reads.
   currentUser: "currentUser",
   myProviderToken: "myProviderToken",
-  // What the calling credential may do, and for a signed-in customer the roles
+  // What the calling credential may do, and for a signed-in user the roles
   // they hold. `./access` reads it.
   whoami: "whoami",
   // Methods.
-  customerLogin: "customerLogin",
-  customerRegister: "customerRegister",
-  customerRequestOTP: "customerRequestOTP",
-  customerLoginOTP: "customerLoginOTP",
+  login: "login",
+  register: "register",
+  requestOTP: "requestOTP",
+  loginWithOTP: "loginWithOTP",
   // Session lifecycle.
-  customerRefreshToken: "customerRefreshToken",
-  customerLogout: "customerLogout",
-  customerJoinWaitlist: "customerJoinWaitlist",
-  // Password management and account lifecycle — the block that had no path.
-  customerRequestPasswordReset: "customerRequestPasswordReset",
-  customerResetPassword: "customerResetPassword",
-  customerUpdatePassword: "customerUpdatePassword",
-  customerVerifyEmail: "customerVerifyEmail",
+  refreshToken: "refreshToken",
+  logout: "logout",
+  joinWaitlist: "joinWaitlist",
+  // Password management and account lifecycle.
+  requestPasswordReset: "requestPasswordReset",
+  resetPassword: "resetPassword",
+  updatePassword: "updatePassword",
+  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
-  // The operator's organization context. TWO ops and no third: one to read
-  // which organizations the caller may stand in, one to say which. There is
-  // deliberately no per-call org argument anywhere in this SDK — the claim the
-  // row layer reads is resolved from the caller's own membership row on every
-  // request, so an application that never names an org cannot name the wrong
-  // one.
+  // The user's own profile, and the apps they have agreed may act for them.
+  updateMyProfile: "updateMyProfile",
+  myAuthorizedApps: "myAuthorizedApps",
+  revokeAuthorizedApp: "revokeAuthorizedApp",
+  // Where they are signed in, their personal access tokens, and the
+  // providers they sign in with.
+  mySessions: "mySessions",
+  endMySession: "endMySession",
+  signOutEverywhere: "signOutEverywhere",
+  createPersonalAccessToken: "createPersonalAccessToken",
+  mySignInMethods: "mySignInMethods",
+  connectSignInMethod: "connectSignInMethod",
+  disconnectSignInMethod: "disconnectSignInMethod",
+  // Their second factors. A change needs one proven first, by a step-up.
+  myFactors: "myFactors",
+  beginStepUp: "beginStepUp",
+  completeStepUp: "completeStepUp",
+  beginFactorEnrollment: "beginFactorEnrollment",
+  completeFactorEnrollment: "completeFactorEnrollment",
+  removeFactor: "removeFactor",
+  makeRecoveryCodes: "makeRecoveryCodes",
+  // The organizations the caller may stand in. Nothing selects one: a request
+  // names the organization it acts in (`orgId` or `orgUrl` below), and the
+  // platform checks the caller stands there every time.
   myOrganizations: "myOrganizations",
-  selectMyOrganization: "selectMyOrganization",
   // Founding one. Present in a manifest only when the project opted in.
-  registerOperatorOrganization: "registerOperatorOrganization",
+  registerOrganization: "registerOrganization",
   // External identity providers.
-  customerLoginWithProvider: "customerLoginWithProvider",
-  customerProviderCallback: "customerProviderCallback",
-  customerProviderVerifyOTP: "customerProviderVerifyOTP"
+  loginWithProvider: "loginWithProvider",
+  providerCallback: "providerCallback",
+  providerVerifyOTP: "providerVerifyOTP",
+  // A provider sign-in that names an address somebody already holds, waiting
+  // for the code sent to it.
+  confirmProviderLink: "confirmProviderLink",
+  resendProviderLinkCode: "resendProviderLinkCode"
 };
 function authClientConfig(env, options) {
   const apiKey = resolveFoirApiKey(env);
@@ -1174,31 +1192,58 @@ function stripUndefined(args) {
 // src/auth/auth.ts
 var TOKEN_KEY = "foir:token";
 var REFRESH_KEY = "foir:refreshToken";
-var CUSTOMER_ID_KEY = "foir:customerId";
+var USER_ID_KEY = "foir:userId";
 var EMAIL_KEY = "foir:email";
-async function customerLogin(env, vars) {
-  return authOp(env, AUTH_OPS.customerLogin, vars);
+async function login(env, vars) {
+  return authOp(env, AUTH_OPS.login, vars);
 }
-async function customerRegister(env, vars) {
-  return authOp(env, AUTH_OPS.customerRegister, vars);
+async function register(env, vars) {
+  return authOp(env, AUTH_OPS.register, vars);
 }
-async function customerRequestOTP(env, email) {
-  return authOp(env, AUTH_OPS.customerRequestOTP, { email });
+async function requestOTP(env, email) {
+  return authOp(env, AUTH_OPS.requestOTP, { email });
 }
-async function customerLoginOTP(env, vars) {
-  return authOp(env, AUTH_OPS.customerLoginOTP, vars);
+async function loginWithOTP(env, vars) {
+  return authOp(env, AUTH_OPS.loginWithOTP, vars);
 }
-async function customerRefreshToken(env, refreshToken) {
-  return authOp(env, AUTH_OPS.customerRefreshToken, { refreshToken });
+async function refreshTokens(env, refreshToken) {
+  return authOp(env, AUTH_OPS.refreshToken, { refreshToken });
 }
-async function customerLoginWithProvider(env, input) {
-  return authOp(env, AUTH_OPS.customerLoginWithProvider, { input });
+async function loginWithProvider(env, input) {
+  return authOp(env, AUTH_OPS.loginWithProvider, { input });
 }
-async function customerProviderCallback(env, input) {
-  return authOp(env, AUTH_OPS.customerProviderCallback, { input });
+async function providerCallback(env, input) {
+  return authOp(env, AUTH_OPS.providerCallback, { input });
 }
-async function customerProviderVerifyOTP(env, input) {
-  return authOp(env, AUTH_OPS.customerProviderVerifyOTP, { input });
+async function providerVerifyOTP(env, input) {
+  return authOp(env, AUTH_OPS.providerVerifyOTP, { input });
+}
+function providerSignInRefusalOf(error) {
+  if (!(error instanceof FoirRequestError)) return null;
+  for (const entry of error.graphQLErrors ?? []) {
+    const value = entry.extensions?.providerSignIn;
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const { code, pending } = value;
+    if (typeof code !== "string") continue;
+    return typeof pending === "string" && pending !== "" ? { code, pending } : { code };
+  }
+  return null;
+}
+function signInRefusalOf(error) {
+  if (!(error instanceof FoirRequestError)) return null;
+  for (const entry of error.graphQLErrors ?? []) {
+    const value = entry.extensions?.signIn;
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const { code } = value;
+    if (typeof code === "string") return { code };
+  }
+  return null;
+}
+async function confirmProviderLink(env, input) {
+  return authOp(env, AUTH_OPS.confirmProviderLink, { input });
+}
+async function resendProviderLinkCode(env, input) {
+  return authOp(env, AUTH_OPS.resendProviderLinkCode, { input });
 }
 async function getAuthProviders(env) {
   return authOp(env, AUTH_OPS.authProviders);
@@ -1209,87 +1254,137 @@ async function getAuthConfig(env) {
 async function getDefaultAuthProvider(env) {
   return authOp(env, AUTH_OPS.defaultAuthProvider);
 }
-async function customerSignupContext(env) {
-  return authOp(env, AUTH_OPS.customerSignupContext);
+async function signupContext(env) {
+  return authOp(env, AUTH_OPS.signupContext);
 }
-async function customerJoinWaitlist(env, email) {
-  return authOp(env, AUTH_OPS.customerJoinWaitlist, { email });
+async function joinWaitlist(env, email) {
+  return authOp(env, AUTH_OPS.joinWaitlist, { email });
 }
-async function customerRequestPasswordReset(env, email) {
-  return authOp(env, AUTH_OPS.customerRequestPasswordReset, { email });
+async function requestPasswordReset(env, email, options) {
+  return authOp(env, AUTH_OPS.requestPasswordReset, { email, clientId: options?.clientId });
 }
-async function customerResetPassword(env, vars) {
-  return authOp(env, AUTH_OPS.customerResetPassword, vars);
+async function resetPassword(env, vars) {
+  return authOp(env, AUTH_OPS.resetPassword, vars);
 }
-async function customerVerifyEmail(env, token) {
-  return authOp(env, AUTH_OPS.customerVerifyEmail, { token });
+async function verifyEmail(env, token) {
+  return authOp(env, AUTH_OPS.verifyEmail, { token });
 }
-async function customerUpdatePassword(env, vars, options) {
-  return authOp(env, AUTH_OPS.customerUpdatePassword, vars, options);
+async function updatePassword(env, vars, options) {
+  return authOp(env, AUTH_OPS.updatePassword, vars, options);
 }
 async function currentUser(env, options) {
   return authOp(env, AUTH_OPS.currentUser, void 0, options);
 }
 async function myProviderToken(env, providerKey, options) {
-  return authOp(env, AUTH_OPS.myProviderToken, { providerKey }, options);
+  const { forceRefresh, ...rest } = options ?? {};
+  const vars = forceRefresh ? { providerKey, forceRefresh: true } : { providerKey };
+  return authOp(env, AUTH_OPS.myProviderToken, vars, rest);
 }
-async function customerLogout(env, options) {
-  return authOp(env, AUTH_OPS.customerLogout, void 0, options);
+async function logout(env, options) {
+  return authOp(env, AUTH_OPS.logout, void 0, options);
 }
 async function deleteMyAccount(env, vars, options) {
   return authOp(env, AUTH_OPS.deleteMyAccount, vars, options);
 }
+async function updateMyProfile(env, change, options) {
+  return authOp(env, AUTH_OPS.updateMyProfile, change, options);
+}
+async function myAuthorizedApps(env, options) {
+  return authOp(env, AUTH_OPS.myAuthorizedApps, void 0, options);
+}
+async function revokeAuthorizedApp(env, id, options) {
+  return authOp(env, AUTH_OPS.revokeAuthorizedApp, { id }, options);
+}
+async function mySessions(env, options) {
+  return authOp(env, AUTH_OPS.mySessions, void 0, options);
+}
+async function endMySession(env, id, options) {
+  return authOp(env, AUTH_OPS.endMySession, { id }, options);
+}
+async function signOutEverywhere(env, vars = {}, options) {
+  return authOp(env, AUTH_OPS.signOutEverywhere, vars, options);
+}
+async function createPersonalAccessToken(env, vars, options) {
+  return authOp(env, AUTH_OPS.createPersonalAccessToken, vars, options);
+}
+async function mySignInMethods(env, options) {
+  return authOp(env, AUTH_OPS.mySignInMethods, void 0, options);
+}
+async function connectSignInMethod(env, vars, options) {
+  return authOp(env, AUTH_OPS.connectSignInMethod, vars, options);
+}
+async function disconnectSignInMethod(env, provider, options) {
+  return authOp(env, AUTH_OPS.disconnectSignInMethod, { provider }, options);
+}
+async function myFactors(env, options) {
+  return authOp(env, AUTH_OPS.myFactors, void 0, options);
+}
+async function beginStepUp(env, password, options) {
+  return authOp(env, AUTH_OPS.beginStepUp, { password }, options);
+}
+async function completeStepUp(env, vars, options) {
+  return authOp(env, AUTH_OPS.completeStepUp, vars, options);
+}
+async function beginFactorEnrollment(env, vars, options) {
+  return authOp(env, AUTH_OPS.beginFactorEnrollment, vars, options);
+}
+async function completeFactorEnrollment(env, vars, options) {
+  return authOp(env, AUTH_OPS.completeFactorEnrollment, vars, options);
+}
+async function removeFactor(env, vars, options) {
+  return authOp(env, AUTH_OPS.removeFactor, vars, options);
+}
+async function makeRecoveryCodes(env, elevatedHandle, options) {
+  return authOp(env, AUTH_OPS.makeRecoveryCodes, { elevatedHandle }, options);
+}
 async function myOrganizations(env, vars, options) {
   return authOp(env, AUTH_OPS.myOrganizations, vars ?? {}, options);
 }
-async function selectOrganization(env, vars, options) {
-  return authOp(env, AUTH_OPS.selectMyOrganization, vars, options);
-}
 async function registerOrganization(env, vars, options) {
-  return authOp(env, AUTH_OPS.registerOperatorOrganization, vars, options);
+  return authOp(env, AUTH_OPS.registerOrganization, vars, options);
 }
 async function saveSession(adapter, result) {
   await adapter.set(TOKEN_KEY, result.token);
   await adapter.set(REFRESH_KEY, result.refreshToken);
-  if (!result.customerId) {
-    return await getSessionCustomer(adapter) ?? { id: "", email: "" };
+  if (!result.userId) {
+    return await getSessionUser(adapter) ?? { id: "", email: "" };
   }
-  await adapter.set(CUSTOMER_ID_KEY, result.customerId);
+  await adapter.set(USER_ID_KEY, result.userId);
   await adapter.set(EMAIL_KEY, result.email);
-  return { id: result.customerId, email: result.email };
+  return { id: result.userId, email: result.email };
 }
 async function clearSession(adapter) {
   await adapter.unset(TOKEN_KEY);
   await adapter.unset(REFRESH_KEY);
-  await adapter.unset(CUSTOMER_ID_KEY);
+  await adapter.unset(USER_ID_KEY);
   await adapter.unset(EMAIL_KEY);
 }
 async function getSessionToken(adapter) {
   return await adapter.get(TOKEN_KEY) ?? null;
 }
-async function getSessionCustomer(adapter) {
-  const id = await adapter.get(CUSTOMER_ID_KEY) ?? null;
+async function getSessionUser(adapter) {
+  const id = await adapter.get(USER_ID_KEY) ?? null;
   const email = await adapter.get(EMAIL_KEY) ?? null;
   if (!id) return null;
   return { id, email: email ?? "" };
 }
-async function loginWithPassword(adapter, env, vars) {
-  return saveSession(adapter, await customerLogin(env, vars));
+async function signInWithPassword(adapter, env, vars) {
+  return saveSession(adapter, await login(env, vars));
 }
-async function registerWithPassword(adapter, env, vars) {
-  return saveSession(adapter, await customerRegister(env, vars));
+async function signUpWithPassword(adapter, env, vars) {
+  return saveSession(adapter, await register(env, vars));
 }
-async function loginWithOTP(adapter, env, vars) {
-  return saveSession(adapter, await customerLoginOTP(env, vars));
+async function signInWithOTP(adapter, env, vars) {
+  return saveSession(adapter, await loginWithOTP(env, vars));
 }
 async function resetPasswordAndSignIn(adapter, env, vars) {
-  return saveSession(adapter, await customerResetPassword(env, vars));
+  return saveSession(adapter, await resetPassword(env, vars));
 }
 async function signOut(adapter, env) {
   const token = await getSessionToken(adapter);
   if (token) {
     try {
-      await customerLogout(env, { bearerToken: token });
+      await logout(env, { bearerToken: token });
     } catch {
     }
   }
@@ -1299,7 +1394,7 @@ async function refreshSession(adapter, env) {
   const refreshToken = await adapter.get(REFRESH_KEY) ?? null;
   if (!refreshToken) return null;
   try {
-    const result = await customerRefreshToken(env, refreshToken);
+    const result = await refreshTokens(env, refreshToken);
     await saveSession(adapter, result);
     return { token: result.token, refreshToken: result.refreshToken };
   } catch {
@@ -1372,20 +1467,20 @@ async function authedOp(adapter, env, op, args) {
 }
 async function requireAuth(adapter, options) {
   const token = await getSessionToken(adapter);
-  let customer = await getSessionCustomer(adapter);
-  if (token && !customer && options.env) {
-    customer = await recoverSessionCustomer(adapter, options.env, token);
+  let user = await getSessionUser(adapter);
+  if (token && !user && options.env) {
+    user = await recoverSessionUser(adapter, options.env, token);
   }
-  if (!token || !customer) {
+  if (!token || !user) {
     await options.onUnauthenticated();
     throw new Error("[foir] onUnauthenticated must not return");
   }
   if (options.resolveUser) {
-    return options.resolveUser({ token, customer });
+    return options.resolveUser({ token, user });
   }
-  return { id: customer.id, email: customer.email, isAdmin: false };
+  return user;
 }
-async function recoverSessionCustomer(adapter, env, token) {
+async function recoverSessionUser(adapter, env, token) {
   let me;
   try {
     me = await currentUser(env, { bearerToken: token });
@@ -1393,137 +1488,132 @@ async function recoverSessionCustomer(adapter, env, token) {
     return null;
   }
   if (!me?.id) return null;
-  await adapter.set(CUSTOMER_ID_KEY, me.id);
+  await adapter.set(USER_ID_KEY, me.id);
   await adapter.set(EMAIL_KEY, me.email);
   return { id: me.id, email: me.email };
 }
-async function requireAdmin(adapter, options) {
-  const user = await requireAuth(adapter, options);
-  if (!user.isAdmin) {
-    await options.onForbidden();
-    throw new Error("[foir] onForbidden must not return");
-  }
-  return user;
-}
 
 // src/auth/grant-table.generated.ts
 var GRANT_TABLE = [
-  ["records:read", true, ["own", "all"], []],
-  ["records:create", true, [], []],
-  ["records:write", true, ["own", "all"], []],
-  ["records:delete", true, ["own", "all"], []],
-  ["records:publish", true, ["own", "all"], []],
-  ["records:attribute", true, [], []],
-  ["search:read", true, [], []],
-  ["embeddings:read", false, [], []],
-  ["embeddings:write", false, [], []],
-  ["schemas:read", false, [], []],
-  ["drafts:read", false, [], []],
-  ["files:read", false, ["own", "all"], []],
-  ["files:write", false, ["own", "all"], []],
-  ["files:delete", false, ["own", "all"], []],
-  ["notifications:read", false, ["own", "all"], []],
-  ["notifications:write", false, ["own", "named", "all"], []],
-  ["notifications:consent", false, [], []],
-  ["pushcredentials:read", false, [], []],
-  ["pushcredentials:write", false, [], []],
-  ["notes:read", false, ["own", "all"], []],
-  ["notes:write", false, ["own", "all"], []],
-  ["notes:create", false, [], []],
-  ["approvals:read", false, [], []],
-  ["approvals:write", false, [], []],
-  ["rooms:read", true, [], []],
-  ["rooms:write", true, [], []],
-  ["presence:read", true, [], []],
-  ["operations:read", false, [], []],
-  ["operations:execute", true, [], []],
-  ["operations:write", false, [], []],
-  ["operations:complete", false, [], []],
-  ["status:write", false, [], []],
-  ["appconfig:read", false, [], []],
-  ["schedules:read", false, [], []],
-  ["schedules:write", false, [], []],
-  ["hooks:read", false, [], []],
-  ["hooks:write", false, [], []],
-  ["relyingparties:read", false, [], []],
-  ["relyingparties:write", false, [], []],
-  ["domains:read", false, [], []],
-  ["domains:write", false, [], []],
-  ["secrets:read", false, [], []],
-  ["secrets:list", false, [], []],
-  ["secrets:put", false, [], []],
-  ["secrets:delete", false, [], []],
-  ["appsecrets:read", false, [], []],
-  ["appsecrets:list", false, [], []],
-  ["appsecrets:put", false, [], []],
-  ["appsecrets:delete", false, [], []],
-  ["opsecrets:read", false, [], []],
-  ["opsecrets:write", false, [], []],
-  ["settings:read", false, [], []],
-  ["settings:write", false, [], []],
-  ["designtokens:read", false, [], []],
-  ["designtokens:write", false, [], []],
-  ["models:read", false, [], []],
-  ["models:write", false, [], []],
-  ["configs:read", false, [], []],
-  ["configs:write", false, [], []],
-  ["apps:read", false, [], []],
-  ["apps:write", false, [], []],
-  ["events:read", false, [], []],
-  ["targeting:debug", false, [], []],
-  ["visitors:forward", false, [], []],
-  ["apikeys:read", false, [], []],
-  ["apikeys:write", false, [], []],
-  ["organizations:read", false, [], []],
-  ["organizations:write", false, [], []],
-  ["organizations:create", false, [], []],
-  ["organizations:delete", false, [], []],
-  ["organizations:reach", false, [], []],
-  ["members:read", false, [], []],
-  ["members:write", false, [], []],
-  ["roles:read", false, [], []],
-  ["roles:write", false, [], []],
-  ["projects:read", false, [], []],
-  ["projects:write", false, [], []],
-  ["project:manage", false, [], ["records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
-  ["projects:create", false, [], []],
-  ["projects:delete", false, [], []],
-  ["tenants:read", false, [], []],
-  ["tenants:write", false, [], []],
-  ["tenants:delete", false, [], []],
-  ["audit:read", false, [], []],
-  ["export:run", false, [], []],
-  ["billing:read", false, [], []],
-  ["billing:manage", false, [], []],
-  ["usage:read", false, [], []],
-  ["controlkeys:read", false, [], []],
-  ["controlkeys:write", false, [], []],
-  ["tenanthooks:read", false, [], []],
-  ["tenanthooks:write", false, [], []],
-  ["apps:install", false, [], []],
-  ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
-  ["platform:read", false, [], []],
-  ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace", "users:setup"]],
-  ["platform:create_workspace", false, [], []],
-  ["users:read", false, ["own", "named", "all"], []],
-  ["users:write", false, ["own", "all"], []],
-  ["users:setup", false, [], []],
-  ["users:delete", false, ["own", "all"], []],
-  ["users:create", false, [], []],
-  ["identities:read", false, [], []],
-  ["identities:delete", false, [], []],
-  ["usersecrets:read", false, [], []],
-  ["usersecrets:list", false, [], []],
-  ["usersecrets:put", false, [], []],
-  ["usersecrets:delete", false, [], []],
-  ["auth:login_with_foir", false, [], []],
-  ["signinproviders:read", false, [], []],
-  ["signinproviders:write", false, [], []]
+  ["records:read", "model", ["own", "all"], []],
+  ["records:create", "model", [], []],
+  ["records:write", "model", ["own", "all"], []],
+  ["records:delete", "model", ["own", "all"], []],
+  ["records:publish", "model", ["own", "all"], []],
+  ["records:attribute", "model", [], []],
+  ["search:read", "model", [], []],
+  ["embeddings:read", "none", [], []],
+  ["embeddings:write", "none", [], []],
+  ["schemas:read", "none", [], []],
+  ["drafts:read", "none", [], []],
+  ["files:read", "none", ["own", "all"], []],
+  ["files:write", "none", ["own", "all"], []],
+  ["files:delete", "none", ["own", "all"], []],
+  ["notifications:read", "none", ["own", "all"], []],
+  ["notifications:write", "none", ["own", "named", "all"], []],
+  ["notifications:consent", "none", [], []],
+  ["pushcredentials:read", "none", [], []],
+  ["pushcredentials:write", "none", [], []],
+  ["notes:read", "none", ["own", "all"], []],
+  ["notes:write", "none", ["own", "all"], []],
+  ["notes:create", "none", [], []],
+  ["approvals:read", "none", [], []],
+  ["approvals:write", "none", [], []],
+  ["rooms:read", "model", [], []],
+  ["rooms:write", "model", [], []],
+  ["presence:read", "model", [], []],
+  ["operations:read", "none", [], []],
+  ["operations:execute", "operation", [], []],
+  ["operations:write", "none", [], []],
+  ["operations:complete", "none", [], []],
+  ["status:write", "none", [], []],
+  ["appconfig:read", "none", [], []],
+  ["schedules:read", "none", [], []],
+  ["schedules:write", "none", [], []],
+  ["hooks:read", "none", [], []],
+  ["hooks:write", "none", [], []],
+  ["authclients:read", "none", [], []],
+  ["authclients:write", "none", [], []],
+  ["domains:read", "none", [], []],
+  ["domains:write", "none", [], []],
+  ["secrets:read", "none", [], []],
+  ["secrets:list", "none", [], []],
+  ["secrets:put", "none", [], []],
+  ["secrets:delete", "none", [], []],
+  ["appsecrets:read", "none", [], []],
+  ["appsecrets:list", "none", [], []],
+  ["appsecrets:put", "none", [], []],
+  ["appsecrets:delete", "none", [], []],
+  ["opsecrets:read", "none", [], []],
+  ["opsecrets:write", "none", [], []],
+  ["settings:read", "none", [], []],
+  ["settings:write", "none", [], []],
+  ["designtokens:read", "none", [], []],
+  ["designtokens:write", "none", [], []],
+  ["models:read", "none", [], []],
+  ["models:write", "none", [], []],
+  ["configs:read", "none", [], []],
+  ["configs:write", "none", [], []],
+  ["apps:read", "none", [], []],
+  ["apps:write", "none", [], []],
+  ["events:read", "none", [], []],
+  ["targeting:debug", "none", [], []],
+  ["visitors:forward", "none", [], []],
+  ["apikeys:read", "none", [], []],
+  ["apikeys:write", "none", [], []],
+  ["organizations:read", "none", [], []],
+  ["organizations:write", "none", [], []],
+  ["organizations:create", "none", [], []],
+  ["organizations:delete", "none", [], []],
+  ["organizations:reach", "none", [], []],
+  ["members:read", "none", [], []],
+  ["members:write", "none", [], []],
+  ["roles:read", "none", [], []],
+  ["roles:write", "none", [], []],
+  ["projects:read", "none", [], []],
+  ["projects:write", "none", [], []],
+  ["project:stand", "none", [], []],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["projects:create", "none", [], []],
+  ["projects:delete", "none", [], []],
+  ["tenants:read", "none", [], []],
+  ["tenants:write", "none", [], []],
+  ["tenants:delete", "none", [], []],
+  ["audit:read", "none", [], []],
+  ["export:run", "none", [], []],
+  ["billing:read", "none", [], []],
+  ["billing:manage", "none", [], []],
+  ["usage:read", "none", [], []],
+  ["controlkeys:read", "none", [], []],
+  ["controlkeys:write", "none", [], []],
+  ["tenanthooks:read", "none", [], []],
+  ["tenanthooks:write", "none", [], []],
+  ["apps:install", "none", [], []],
+  ["tenant:manage", "none", [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
+  ["platform:read", "none", [], []],
+  ["platform:manage", "none", [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
+  ["platform:create_workspace", "none", [], []],
+  ["users:read", "none", ["own", "named", "all"], []],
+  ["users:write", "none", ["own", "all"], []],
+  ["users:setup", "none", [], []],
+  ["users:delete", "none", ["own", "all"], []],
+  ["users:create", "none", [], []],
+  ["identities:read", "none", [], []],
+  ["identities:delete", "none", [], []],
+  ["usersecrets:read", "none", [], []],
+  ["usersecrets:list", "none", [], []],
+  ["usersecrets:put", "none", [], []],
+  ["usersecrets:delete", "none", [], []],
+  ["auth:login_with_foir", "none", [], []],
+  ["signinproviders:read", "none", [], []],
+  ["signinproviders:write", "none", [], []]
 ];
 
 // src/auth/grants.ts
 var WILDCARD = "*";
 var RESOURCE_WILDCARD = ":*";
+var FIELD_PERMISSIONS = ["records:read", "records:write"];
+var FIELD_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var index;
 function catalogue() {
   if (!index) {
@@ -1564,15 +1654,23 @@ function parseGrant(s) {
     let target = "";
     if (rest.startsWith(":")) {
       target = rest.slice(1);
-      if (!permission[1]) return null;
+      if (permission[1] === "none") return null;
       if (target === "" || /[: \t\n*]/.test(target)) return null;
+      const dot = target.indexOf(".");
+      if (permission[1] === "model" && dot >= 0) {
+        if (!FIELD_PERMISSIONS.includes(name) || dot === 0 || !FIELD_KEY.test(target.slice(dot + 1))) return null;
+      }
     }
     return { permission, reach, target };
   }
   return null;
 }
 function covers(held, required) {
-  return held.permission === required.permission && reachRank[held.reach] >= reachRank[required.reach] && (held.target === "" || held.target === required.target);
+  if (held.permission !== required.permission || reachRank[held.reach] < reachRank[required.reach]) return false;
+  if (required.permission[1] === "model" && required.target.includes(".")) {
+    return held.target === required.target || held.target === "" && held.reach === "all";
+  }
+  return held.target === "" || held.target === required.target;
 }
 function resourceWildcard(held) {
   if (!held.endsWith(RESOURCE_WILDCARD)) return null;
@@ -1602,15 +1700,15 @@ function holds(held, required) {
 
 // src/auth/access.ts
 function accessFrom(who) {
-  const customer = who?.credential?.customer;
-  if (!customer?.id) return null;
+  const user = who?.credential?.user;
+  if (!user?.id) return null;
   return {
-    customerId: customer.id,
-    roles: Array.isArray(customer.roles) ? [...customer.roles] : null,
+    userId: user.id,
+    roles: Array.isArray(user.roles) ? [...user.roles] : null,
     scopes: [...who?.authority?.effective ?? []]
   };
 }
-async function customerAccess(env, options) {
+async function userAccess(env, options) {
   return accessFrom(await authOp(env, AUTH_OPS.whoami, void 0, options));
 }
 async function getSessionAccess(adapter, env) {
@@ -1643,11 +1741,11 @@ function denialMessage(reason, required) {
     case "signed_out":
       return "[foir] nobody is signed in";
     case "role_not_held":
-      return `[foir] the signed-in customer does not hold the role "${required.role}"`;
+      return `[foir] the signed-in user does not hold the role "${required.role}"`;
     case "roles_unknown":
-      return `[foir] the platform did not say which roles the signed-in customer holds, so "${required.role}" could not be checked`;
+      return `[foir] the platform did not say which roles the signed-in user holds, so "${required.role}" could not be checked`;
     case "scope_not_held":
-      return `[foir] the signed-in customer's scopes do not cover "${required.scope}"`;
+      return `[foir] the signed-in user's scopes do not cover "${required.scope}"`;
   }
 }
 async function requireRole(adapter, env, key) {
@@ -1665,7 +1763,7 @@ async function requireScope(adapter, env, scope) {
 }
 
 // src/auth/hosted.ts
-var DEFAULT_COOKIE_NAME = "foir_customer_session";
+var DEFAULT_COOKIE_NAME = "foir_session";
 var DEFAULT_SESSION_PATH = "/session/token";
 var DEFAULT_END_SESSION_PATH = "/session/end-session";
 function hostedLoginUrl(config, returnTo) {
@@ -1721,14 +1819,14 @@ async function fetchHostedSession(request, config) {
   } catch {
     return { outcome: "unavailable", reason: "malformed", httpStatus: res.status };
   }
-  if (!json.access_token || !json.customer_id) {
+  if (!json.access_token || !json.user_id) {
     return { outcome: "unavailable", reason: "malformed", httpStatus: res.status };
   }
   return {
     outcome: "active",
     session: {
       token: json.access_token,
-      customerId: json.customer_id,
+      userId: json.user_id,
       email: json.email ?? "",
       expiresIn: typeof json.expires_in === "number" ? json.expires_in : 0
     }
@@ -1737,6 +1835,38 @@ async function fetchHostedSession(request, config) {
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function hostedSignInNoticeOf(location, names) {
+  const params = location instanceof URLSearchParams ? location : location instanceof URL ? location.searchParams : new URL(location, "https://callback.invalid").searchParams;
+  const code = params.get("foir_error") ?? (params.get("error") ? params.get("error_description") : null);
+  if (code) {
+    return { kind: "refused", code, message: refusalMessage(code) };
+  }
+  const provider = params.get("foir_connected");
+  if (provider) {
+    const name = names?.[provider] ?? provider;
+    return { kind: "connected", provider, message: `Your ${name} sign-in is now connected to your account.` };
+  }
+  return null;
+}
+var REFUSAL_MESSAGES = {
+  account_unavailable: "This account can\u2019t sign in right now.",
+  account_not_here: "That account doesn\u2019t sign in here.",
+  email_unavailable: "This app can\u2019t send email yet, so no code was sent. Sign in another way.",
+  signup_closed: "There\u2019s no account for that address here, and it can\u2019t be made by signing in.",
+  user_cap_reached: "This app can\u2019t take any more people right now.",
+  provider_named_no_subject: "The provider didn\u2019t say who you are, so it can\u2019t sign you in. Try another way.",
+  provider_has_no_issuer: "The provider didn\u2019t say who you are, so it can\u2019t sign you in. Try another way.",
+  provider_named_no_address: "The provider didn\u2019t share an email address, so it can\u2019t sign you in. Try another way.",
+  provider_refused: "The provider didn\u2019t finish the sign-in.",
+  provider_unavailable: "The provider couldn\u2019t be reached. Try again in a moment.",
+  provider_exchange_failed: "The provider couldn\u2019t be reached. Try again in a moment.",
+  two_step_sign_in: "This account uses two-step sign-in. Sign in with your password or a passkey.",
+  mfa_required: "This app needs a second factor, which a provider sign-in can\u2019t give. Sign in with your password instead.",
+  sign_in_expired: "This sign-in has expired. Start again."
+};
+function refusalMessage(code) {
+  return REFUSAL_MESSAGES[code] ?? "The sign-in couldn\u2019t be finished. Try again.";
+}
 
 // src/auth/session-client.ts
 var DEFAULT_SESSION_PATH2 = "/session/token";
@@ -1804,14 +1934,14 @@ function createFoirSessionClient(config) {
       } catch {
         return cached;
       }
-      if (!json.access_token || !json.customer_id) return cached;
+      if (!json.access_token || !json.user_id) return cached;
       const expiresIn = typeof json.expires_in === "number" ? json.expires_in : 0;
       const next = {
         token: json.access_token,
         expiresAt: Date.now() + expiresIn * 1e3,
-        user: { customerId: json.customer_id, email: json.email ?? "" }
+        user: { userId: json.user_id, email: json.email ?? "" }
       };
-      const changed = cached?.user.customerId !== next.user.customerId;
+      const changed = cached?.user.userId !== next.user.userId;
       cached = next;
       scheduleRefresh(next.expiresAt);
       if (changed) emit(next.user);
@@ -1879,51 +2009,71 @@ export {
   FoirSessionExpiredError,
   authedOp,
   authedRequest,
+  beginFactorEnrollment,
+  beginStepUp,
   clearSession,
+  completeFactorEnrollment,
+  completeStepUp,
+  confirmProviderLink,
+  connectSignInMethod,
   createFoirSessionClient,
+  createPersonalAccessToken,
   currentUser,
-  customerAccess,
-  customerJoinWaitlist,
-  customerLogin,
-  customerLoginOTP,
-  customerLoginWithProvider,
-  customerLogout,
-  customerProviderCallback,
-  customerProviderVerifyOTP,
-  customerRefreshToken,
-  customerRegister,
-  customerRequestOTP,
-  customerRequestPasswordReset,
-  customerResetPassword,
-  customerSignupContext,
-  customerUpdatePassword,
-  customerVerifyEmail,
   deleteMyAccount,
+  disconnectSignInMethod,
+  endMySession,
   fetchHostedSession,
   getAuthConfig,
   getAuthProviders,
   getDefaultAuthProvider,
   getSessionAccess,
-  getSessionCustomer,
   getSessionToken,
+  getSessionUser,
   hasRole,
   hasScope,
   hostedLoginUrl,
   hostedLogoutUrl,
+  hostedSignInNoticeOf,
+  joinWaitlist,
+  login,
   loginWithOTP,
-  loginWithPassword,
+  loginWithProvider,
+  logout,
+  makeRecoveryCodes,
+  myAuthorizedApps,
+  myFactors,
   myOrganizations,
   myProviderToken,
+  mySessions,
+  mySignInMethods,
+  providerCallback,
+  providerSignInRefusalOf,
+  providerVerifyOTP,
   refreshSession,
   refreshSessionOnce,
+  refreshTokens,
+  register,
   registerOrganization,
-  registerWithPassword,
-  requireAdmin,
+  removeFactor,
+  requestOTP,
+  requestPasswordReset,
   requireAuth,
   requireRole,
   requireScope,
+  resendProviderLinkCode,
+  resetPassword,
   resetPasswordAndSignIn,
+  revokeAuthorizedApp,
   saveSession,
-  selectOrganization,
-  signOut
+  signInRefusalOf,
+  signInWithOTP,
+  signInWithPassword,
+  signOut,
+  signOutEverywhere,
+  signUpWithPassword,
+  signupContext,
+  updateMyProfile,
+  updatePassword,
+  userAccess,
+  verifyEmail
 };