@foir/sdk 0.21.0 → 0.23.0

package/dist/client.js

@@ -5,10 +5,7 @@ import { print as print2 } from "graphql";
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 var FOIR_CREDENTIALS_DOC = "https://docs.foir.dev/credentials";
 function foirKeyKind(apiKey) {
@@ -200,8 +197,8 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
   downgrade;
   constructor(downgrade) {
     super(
-      `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
-      { graphQLErrors: [{ message: "customer token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
+      `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
+      { graphQLErrors: [{ message: "user token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
     );
     this.name = "FoirAuthDowngradedError";
     this.downgrade = downgrade;
@@ -209,7 +206,7 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
 };
 var FoirSessionExpiredError = class extends FoirRequestError {
   constructor(options) {
-    super("[foir] the customer session has expired and could not be refreshed: sign in again", {
+    super("[foir] the user session has expired and could not be refreshed: sign in again", {
       cause: options?.cause,
       graphQLErrors: [{ message: "session expired", extensions: { code: "SESSION_EXPIRED" } }]
     });
@@ -226,7 +223,7 @@ function reportAuthDowngrade(envelope) {
   if (warnedDowngrade === downgrade.reason) return;
   warnedDowngrade = downgrade.reason;
   console.warn(
-    `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
+    `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
   );
 }
 function refusePrunedDocument(json, options) {

package/dist/codegen/preset.d.ts

@@ -16,7 +16,7 @@ export interface FoirCodegenOptions {
     /** Foir public API GraphQL endpoint. */
     apiUrl: string;
     /**
-     * Public (`pk_`) API key. Reads the published schema. Used as the fallback
+     * Publishable API key. Reads the published schema. Used as the fallback
      * when no preview key is set.
      */
     apiKey?: string;

package/dist/data/builtins.d.ts

@@ -398,7 +398,7 @@ export type FoirUnexpandedRecord = FoirDegraded;
 export type FoirVisibility = 'PRIVATE' | 'PUBLIC';
 export type FoirAccessLevel = 'READ' | 'WRITE' | 'DELETE';
 export type FoirAccessSource = 'PUBLIC' | 'OWNER' | 'GRANT' | 'ROLE';
-export type FoirGranteeKind = 'CUSTOMER' | 'ADMIN';
+export type FoirGranteeKind = 'USER';
 /** `myAccess` — this principal's effective access to one record. */
 export interface FoirMyAccess {
     access: FoirAccessLevel;
@@ -435,9 +435,9 @@ export interface FoirUpdateManyPayload {
 }
 /**
  * `setOwner`: who the record belongs to after an operation handed it to
- * another customer. It carries the owner and not the record, because the
+ * another user. It carries the owner and not the record, because the
  * operation may have been acting for the previous holder, who can no longer
- * read it. `ownerKind` is always `'customer'` from this op.
+ * read it. `ownerKind` is always `'user'` from this op.
  */
 export interface FoirRecordOwner {
     id: string;
@@ -445,7 +445,7 @@ export interface FoirRecordOwner {
     ownerKind: string;
 }
 /**
- * What a customer's note can be ABOUT: the customer-plane subset of the closed
+ * What a user's note can be ABOUT: the user-plane subset of the closed
  * set the platform's write path enforces.
  *
  * On the wire it is `String!`, not a GraphQL enum, so the manifest publishes no
@@ -458,23 +458,23 @@ export interface FoirRecordOwner {
  * record is `'record'` plus the model key on `subjectModelKey`.
  *
  * The platform set also holds `project` and `organization`, and this union
- * deliberately does not. Both are operator constructs: the platform answers a
- * note about either through a row policy no customer claim passes, so no note
+ * deliberately does not. Both are the project's own constructs: the platform answers a
+ * note about either through a row policy no user claim passes, so no note
  * this surface reads or writes can carry them. This mirrors the part of the
- * platform set a customer can reach, and the obligation that comes with a mirror
- * (see the file header) applies: a kind the platform opens to customers widens
+ * platform set a user can reach, and the obligation that comes with a mirror
+ * (see the file header) applies: a kind the platform opens to users widens
  * this union in a minor release, and until then a value outside it is a row no
- * customer writer could have produced.
+ * user writer could have produced.
  */
-export type FoirNoteSubjectType = 'record' | 'file' | 'model' | 'operation' | 'schedule' | 'customer';
+export type FoirNoteSubjectType = 'record' | 'file' | 'model' | 'operation' | 'schedule' | 'user';
 /**
- * One file the customer submitted with their note.
+ * One file the user submitted with their note.
  *
  * The file's own facts, and nothing about the platform's handling of it: when
  * the link row was written and which retention clock it starts are not the
  * author's business. What is here is enough to render "you sent this".
  */
-export interface FoirCustomerNoteAttachment {
+export interface FoirUserNoteAttachment {
     /** The file's id — the same one `createMyNote` was given. */
     fileId: string;
     filename: string;
@@ -484,15 +484,15 @@ export interface FoirCustomerNoteAttachment {
     url: string;
 }
 /**
- * One note on the customer plane — `foir.ns.notes.myNotes` and
+ * One note on the user plane — `foir.ns.notes.myNotes` and
  * `foir.ns.notes.createMyNote`.
  *
  * Deliberately narrower than the note your team sees in the dashboard. There is
  * no visibility, no resolution note, no mentions and no metadata: those are the
- * project's view of a thread, not the author's, and the customer-facing type
+ * project's view of a thread, not the author's, and the user-facing type
  * does not merely omit them from the document — the surface does not carry them.
  */
-export interface FoirCustomerNote {
+export interface FoirUserNote {
     id: string;
     /** The note's prose. */
     body: string | null;
@@ -507,12 +507,12 @@ export interface FoirCustomerNote {
     /**
      * The files submitted with this note. Empty when there are none.
      *
-     * The one place the customer surface is WIDER than "the author's own prose",
+     * The one place the user surface is WIDER than "the author's own prose",
      * and deliberately: an author who attached a screenshot has to be able to see
      * that it arrived, or the only readings left to them are that it failed
      * silently or that it was taken away.
      */
-    attachments: FoirCustomerNoteAttachment[];
+    attachments: FoirUserNoteAttachment[];
     /** ISO-8601. */
     createdAt: string;
 }
@@ -521,7 +521,7 @@ export interface FoirCustomerNote {
  * — `foir.ns.notes.noteConfig`.
  *
  * Charged `notes:create` rather than `notes:read`, and refused to a caller with
- * no customer session, because the only caller it is useful to is one that can
+ * no user session, because the only caller it is useful to is one that can
  * submit. So a composer can read it as its single readiness probe: an answer
  * means this visitor may write, and a refusal names which half is missing.
  */
@@ -546,16 +546,16 @@ export interface FoirMyNotesArgs {
     threadRootId?: string;
 }
 /**
- * `myNotes` — the notes this customer wrote, plus the replies your team
- * deliberately sent them. Never another customer's, and never an operator's
+ * `myNotes` — the notes this user wrote, plus the replies your team
+ * deliberately sent them. Never another user's, and never your team's
  * internal ones.
  */
-export type FoirMyNotesResult = FoirConnection<FoirCustomerNote>;
+export type FoirMyNotesResult = FoirConnection<FoirUserNote>;
 /**
- * `writeNote` arguments: the one note create, for a signed-in customer and for
+ * `writeNote` arguments: the one note create, for a signed-in user and for
  * a visitor alike. It asks `notes:create` of both.
  *
- * A signed-in customer's note is theirs and comes back in `myNotes`. A
+ * A signed-in user's note is theirs and comes back in `myNotes`. A
  * visitor's, through a key that gives `notes:create` to whoever comes through
  * it, on a project that takes visitors' notes, is nobody's: ask for its `id`
  * and `createdAt` and nothing else, because nothing reads it back.
@@ -584,8 +584,8 @@ export interface FoirWriteNoteArgs {
      */
     attachmentFileIds?: string[];
     /**
-     * Where the operators may reply to a visitor. Refused from a signed-in
-     * customer, whose note has an author.
+     * Where your team may reply to a visitor. Refused from a signed-in
+     * user, whose note has an author.
      *
      * Captured as typed and NEVER verified: it is not treated as proof of who
      * wrote the note, and nothing is sent to it to confirm it. Do not build a
@@ -597,7 +597,7 @@ export interface FoirWriteNoteArgs {
  * `createMyNote` arguments.
  *
  * @deprecated `createMyNote` is the older name of `writeNote` for a signed-in
- * customer. Use `writeNote` and {@link FoirWriteNoteArgs}.
+ * user. Use `writeNote` and {@link FoirWriteNoteArgs}.
  */
 export interface FoirCreateMyNoteArgs {
     subjectType: FoirNoteSubjectType;

package/dist/data/client.d.ts

@@ -166,7 +166,7 @@ export interface FoirRawOptions {
 }
 export interface FoirClientCore<S extends FoirSchemaDefinition> {
     /**
-     * Non-model root namespaces (`search`, `customers`, `notifications`).
+     * Non-model root namespaces (`search`, `users`, `notifications`).
      * Separate accessor because the addressing has to distinguish a model from a
      * namespace and the client has no runtime schema to disambiguate with.
      */
@@ -181,7 +181,7 @@ export interface FoirClientCore<S extends FoirSchemaDefinition> {
      * hatch that could only say what the JSON op could say would be an escape from
      * nothing. As a document it reaches everything the credential can reach —
      * including the root fields no model or namespace claims (`designTokens`,
-     * `record`, `locales`, `resolvedLocale`, the whole customer-auth mutation
+     * `record`, `locales`, `resolvedLocale`, the whole user-auth mutation
      * set), which the JSON op could not address at all.
      *
      * Returns the whole `data` object rather than a single root field, because a
@@ -221,7 +221,7 @@ export interface FoirClientCore<S extends FoirSchemaDefinition> {
 /**
  * The client, shaped by the credential's manifest. An op that is not in
  * `FoirSchema` is not on this type, so `foir.tilly_block.create(...)` under a
- * read-only `pk_` key is a compile error rather than a 400.
+ * read-only publishable key is a compile error rather than a 400.
  */
 export type FoirClient<S extends FoirSchemaDefinition> = FoirClientCore<S> & {
     [MK in keyof S['models']]: FoirModelClient<S, S['models'][MK]>;

package/dist/data/decimal.d.ts

@@ -53,7 +53,7 @@
  *
  * TypeScript already rejects `price + tax` at compile time. The throw is for
  * JavaScript callers and for anything that reaches this through `any`, where a
- * silent `"19.992.00"` would otherwise reach a customer. Loud beats quiet: the
+ * silent `"19.992.00"` would otherwise reach a user. Loud beats quiet: the
  * whole reason this type exists is that the float bug was silent.
  *
  * `JSON.stringify` is answered by `toJSON`, so a decimal serialises back to the

package/dist/data/index.d.ts

@@ -59,7 +59,7 @@ export { planFoirModelCall, planFoirNamespaceCall } from './document';
 export type { FoirCall, FoirDocumentPlan, FoirNamespaceCall, FoirNamespaceSelections, FoirRecordPath, FoirSelectionModel, FoirSelectionNamespace, FoirSelections, FoirSelectionSource, FoirSelectionUnions, } from './document';
 export { createFoirSubjectRegistry, recordFoirSubjects } from './subjects';
 export type { FoirSubject, FoirSubjectEntry, FoirSubjectOptions, FoirSubjectOrigin, FoirSubjectRegistry, } from './subjects';
-export type { CollabInfo, FileValue, FoirAccessGrant, FoirAccessLevel, FoirAccessSource, FoirAccessor, FoirCreateMyNoteArgs, FoirWriteNoteArgs, FoirCustomerNote, FoirCustomerNoteAttachment, FoirDegraded, FoirDepthBelow, FoirDepthLevel, FoirDeviceType, FoirGranteeKind, FoirJsonValue, FoirMyAccess, FoirMyNotesArgs, FoirMyNotesResult, FoirNoteConfig, FoirNoteSubjectType, FoirPlatformType, FoirRecordOwner, FoirResolveContext, FoirResourceAccess, FoirUnexpandedRecord, FoirUpdateManyPayload, FoirVisibility, GeoPoint, Image, ImageFormat, ImageVariant, ImageVariantSet, MediaValue, Passage, Prose, ProseSpan, RecordAncestor, Reference, Richtext, Video, } from './builtins';
+export type { CollabInfo, FileValue, FoirAccessGrant, FoirAccessLevel, FoirAccessSource, FoirAccessor, FoirCreateMyNoteArgs, FoirWriteNoteArgs, FoirUserNote, FoirUserNoteAttachment, FoirDegraded, FoirDepthBelow, FoirDepthLevel, FoirDeviceType, FoirGranteeKind, FoirJsonValue, FoirMyAccess, FoirMyNotesArgs, FoirMyNotesResult, FoirNoteConfig, FoirNoteSubjectType, FoirPlatformType, FoirRecordOwner, FoirResolveContext, FoirResourceAccess, FoirUnexpandedRecord, FoirUpdateManyPayload, FoirVisibility, GeoPoint, Image, ImageFormat, ImageVariant, ImageVariantSet, MediaValue, Passage, Prose, ProseSpan, RecordAncestor, Reference, Richtext, Video, } from './builtins';
 /**
  * Pre-rename spellings. The `<Name>Block` wrappers and the `<Name>Value`
  * split are the same thing as the types above — an item IS its value — so each

package/dist/data/manifest.d.ts

@@ -303,7 +303,7 @@ export interface FoirManifest {
     composedFor?: string;
     models: Record<string, FoirManifestModel>;
     /**
-     * Keyed by namespace name (`auth`, `customers`, `files`, `notifications`,
+     * Keyed by namespace name (`auth`, `users`, `files`, `notifications`,
      * `operations`, `schedules`, `search`, `secrets`). Deliberately an open
      * record rather than the eight names: a namespace the platform adds must
      * reach the generator, and a closed union would silently drop it.

package/dist/data/schema.d.ts

@@ -130,7 +130,7 @@
  * 3. **Emit only what the manifest returned.** The manifest is already the
  *    per-caller projection of `SchemaForCaller(scopes)`, so "only the ops this
  *    credential can perform" needs no extra filtering — it is what arrives. A
- *    `pk_` key's generated schema simply has no `create`, and
+ *    publishable key's generated schema simply has no `create`, and
  *    `foir.tilly_block.create(...)` is then a compile error, which is the
  *    entire point of per-key shaping.
  *
@@ -272,7 +272,7 @@ export interface FoirModelDefinition {
     readonly ops: Readonly<Record<string, FoirOpDefinition>>;
 }
 /**
- * One op on a non-model namespace (`search`, `customers`, `notifications`).
+ * One op on a non-model namespace (`search`, `users`, `notifications`).
  * Namespaces have no model behind them, so there is no `include`/`omit` and
  * the result type is used verbatim.
  */

package/dist/data/transport.d.ts

@@ -5,12 +5,12 @@
  * Where a call goes
  * ---------------------------------------------------------------------------
  *
- *   read + `pk_` key + no customer bearer + published channel
- *     → `GET /cdn/graphql?key=pk_…&extensions={"persistedQuery":{"sha256Hash":…}}`
+ *   read + publishable key + no user bearer + published channel
+ *     → `GET /cdn/graphql?key=foir_pub_…&extensions={"persistedQuery":{"sha256Hash":…}}`
  *       A shared cache in front of the caller stores the response, because the
  *       request is a GET and the credential is in the URL.
  *
- *   anything else — `sk_`, a customer bearer, a mutation, the draft channel
+ *   anything else: a server or admin key, a user bearer, a mutation, the draft channel
  *     → `POST /graphql` with the `x-api-key` header and the APQ body.
  *
  *   a call made AS an operation, with its dispatch token
@@ -158,7 +158,7 @@ export type FoirOperationGeneratedModule<S extends FoirSchemaDefinition = FoirSc
  * The endpoint calls Foir AS the operation, with the grants the operation
  * declared, and holds no key of its own. api-public accepts the token as a
  * caller in its own right: it builds the schema overlay from the token's
- * grants, and it reads the organization and the customer from the
+ * grants, and it reads the organization and the user from the
  * token's claims. So nothing a key client configures beside its key
  * (`bearerToken`, `orgId`, `channel`) means anything here, and none of it is
  * accepted.
@@ -182,8 +182,9 @@ export interface FoirDispatchCredential {
     context?: string | null;
 }
 /**
- * A client that calls Foir with an api key: a storefront's `pk_`, a server's
- * `sk_`, optionally for a signed-in customer.
+ * A client that calls Foir with an api key: a storefront's publishable key, or
+ * the server key of the server that renders its pages, optionally for a
+ * signed-in user.
  */
 export interface FoirKeyClientConfig<S extends FoirSchemaDefinition = FoirSchemaDefinition> {
     /**
@@ -194,7 +195,7 @@ export interface FoirKeyClientConfig<S extends FoirSchemaDefinition = FoirSchema
      * a trailing `/graphql` is stripped before a path is appended.
      */
     apiUrl: string;
-    /** `pk_…` or `sk_…`. The manifest, and therefore the generated types, are shaped by it. */
+    /** `foir_pub_…` or `foir_srv_…`. The manifest, and therefore the generated types, are shaped by it. */
     apiKey: string;
     /** A key client has no dispatch token; see {@link FoirDispatchClientConfig}. */
     dispatch?: never;
@@ -206,13 +207,13 @@ export interface FoirKeyClientConfig<S extends FoirSchemaDefinition = FoirSchema
      */
     channel?: 'published' | 'draft';
     /**
-     * Customer bearer for self-scoped reads (`myProfile`, `myTillyNotes`). A
+     * User bearer for self-scoped reads (`myProfile`, `myTillyNotes`). A
      * function is resolved before every request so a cookie session can be read
      * per-request; a bare string is used as-is.
      */
     bearerToken?: string | FoirTokenProvider;
     /**
-     * Renew the customer bearer when an answer comes back served without it
+     * Renew the user bearer when an answer comes back served without it
      * because it expired. Resolve the new token, or null when the session is
      * over. It is called at most once per request, and one call is shared by the
      * client's requests that find the bearer lapsed at the same time.
@@ -247,8 +248,8 @@ export interface FoirKeyClientConfig<S extends FoirSchemaDefinition = FoirSchema
      *
      * A credential already confined to an organization may only name its own
      * (`PERMISSION_DENIED` otherwise), so this cannot steer an organization key
-     * elsewhere. And a request that also carries a customer bearer is refused
-     * unless that customer stands in the named organization. The storefront
+     * elsewhere. And a request that also carries a user bearer is refused
+     * unless that user stands in the named organization. The storefront
      * pattern is still the confined credential, one per organization; this is
      * for the side of the product that holds the project key and has to choose.
      *
@@ -527,7 +528,7 @@ export interface FoirKeyClientConfig<S extends FoirSchemaDefinition = FoirSchema
 }
 /**
  * The options that belong to a key: the key itself, what it is presented with
- * (a customer bearer, an organization, a channel), and the subscription socket,
+ * (a user bearer, an organization, a channel), and the subscription socket,
  * which only a key can open.
  */
 type FoirKeySideOption = 'apiKey' | 'dispatch' | 'channel' | 'bearerToken' | 'refreshBearer' | 'orgId' | 'orgUrl' | 'visitor' | 'wsUrl' | 'webSocketImpl' | 'reconnect' | 'connectionParams';
@@ -600,7 +601,7 @@ export interface FoirSchemaDrift {
      * way, as paths into the manifest, sorted:
      * `models.order.selection.status`, `models.order.ops.update`,
      * `namespaces.search.ops.searchRecords.args.query`,
-     * `models.order.relations.customer`, `selectionUnions.Block.HeroBlock.title`.
+     * `models.order.relations.user`, `selectionUnions.Block.HeroBlock.title`.
      *
      * `changed` says what moved; this says what BROKE. Empty when the surface
      * only grew, which is the usual drift, and then no typed call is refused.

package/dist/data/ws-transport.d.ts

@@ -43,7 +43,7 @@
  * being replayed after it expired.
  *
  * An operation's dispatch token is not one of them. The server's
- * `connection_init` authenticates a key, an admin token or a customer bearer
+ * `connection_init` authenticates a key, a console token or a user bearer
  * and has no path for a dispatch token, so a client built from one is refused
  * here, by name, rather than opening a socket the server will close as "Not
  * authenticated".

package/dist/data.js

@@ -166,8 +166,8 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
   downgrade;
   constructor(downgrade) {
     super(
-      `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
-      { graphQLErrors: [{ message: "customer token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
+      `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
+      { graphQLErrors: [{ message: "user token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
     );
     this.name = "FoirAuthDowngradedError";
     this.downgrade = downgrade;
@@ -175,7 +175,7 @@ var FoirAuthDowngradedError = class extends FoirRequestError {
 };
 var FoirSessionExpiredError = class extends FoirRequestError {
   constructor(options) {
-    super("[foir] the customer session has expired and could not be refreshed: sign in again", {
+    super("[foir] the user session has expired and could not be refreshed: sign in again", {
       cause: options?.cause,
       graphQLErrors: [{ message: "session expired", extensions: { code: "SESSION_EXPIRED" } }]
     });
@@ -192,7 +192,7 @@ function reportAuthDowngrade(envelope) {
   if (warnedDowngrade === downgrade.reason) return;
   warnedDowngrade = downgrade.reason;
   console.warn(
-    `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
+    `[foir] your user token was ${downgrade.userToken} (${downgrade.reason}) \u2014 this request was served as ${downgrade.servedAs}, so auth-targeted content resolved to its anonymous variant. ` + (downgrade.reason === "expired" ? "Re-exchange the token and retry." : "Check which credential you are sending.")
   );
 }
 function refusePrunedDocument(json, options) {
@@ -240,10 +240,7 @@ function readFoirEnvelope(json, options) {
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 var FOIR_CREDENTIALS_DOC = "https://docs.foir.dev/credentials";
 function foirKeyKind(apiKey) {
@@ -356,7 +353,7 @@ function assertFoirCredential(config) {
     if (kind === "admin") {
       throw new FoirRequestError(adminKeyRefusal("createFoirClient"));
     }
-    if (loose.visitor !== void 0 && kind !== "server" && kind !== "older") {
+    if (loose.visitor !== void 0 && kind !== "server") {
       throw new FoirRequestError(
         `[foir] createFoirClient: \`visitor\` names the visitor a server calls for, and only a server key holding visitors:forward may send it. A publishable key already calls as its visitor, and cannot hold the permission. Drop \`visitor\`, or build this client from your server key on the server that renders your pages. See ${FOIR_CREDENTIALS_DOC}`
       );
@@ -383,7 +380,7 @@ function assertFoirCredential(config) {
   ].filter((name) => loose[name] !== void 0);
   if (keySide.length > 0) {
     throw new FoirRequestError(
-      `[foir] createFoirClient was given \`dispatch\` and ${keySide.map((n) => `\`${n}\``).join(", ")}. A dispatch token and an api key are different actors, and the dispatch token carries its own customer, organization and channel. Pass one credential: \`dispatch\` inside an operation endpoint, \`apiKey\` everywhere else.`
+      `[foir] createFoirClient was given \`dispatch\` and ${keySide.map((n) => `\`${n}\``).join(", ")}. A dispatch token and an api key are different actors, and the dispatch token carries its own user, organization and channel. Pass one credential: \`dispatch\` inside an operation endpoint, \`apiKey\` everywhere else.`
     );
   }
   const dispatch = loose.dispatch;
@@ -1411,7 +1408,7 @@ var FoirSocketTransport = class {
   constructor(config) {
     if (config.dispatch !== void 0) {
       throw new FoirRequestError(
-        "[foir] a client built from a dispatch token cannot subscribe. The subscription socket authenticates an api key, an admin token or a customer bearer, and has no path for a dispatch token. Queries and mutations made as the operation go to /graphql and work as they are."
+        "[foir] a client built from a dispatch token cannot subscribe. The subscription socket authenticates an api key, a console token or a user bearer, and has no path for a dispatch token. Queries and mutations made as the operation go to /graphql and work as they are."
       );
     }
     this.config = config;

package/dist/graphql/content-client.d.ts

@@ -1,19 +1,19 @@
 /**
- * Session-bound content client — forwards the customer bearer on every read
- * when one is available, so auth/segment-targeted variants and customer-scoped
+ * Session-bound content client — forwards the user bearer on every read
+ * when one is available, so auth/segment-targeted variants and user-scoped
  * records resolve out of the box, with no per-query wiring to forget.
  *
  * Resolution keys off the request's principal (see the platform's two-gate
  * model): the `x-api-key` alone resolves the *anonymous baseline*
- * (`context.authStatus = ""`); adding the customer bearer resolves the request
- * as that customer (`context.authStatus = "authenticated"`, `customer_id` set).
+ * (`context.authStatus = ""`); adding the user bearer resolves the request
+ * as that user (`context.authStatus = "authenticated"`, `user_id` set).
  *
  * Caching: an api-key-only read is identical for every anonymous visitor and is
- * shared-cacheable; a bearer-bearing read resolves per-customer and is not.
- * Because the bearer only exists once a customer signs in, anonymous traffic
+ * shared-cacheable; a bearer-bearing read resolves per-user and is not.
+ * Because the bearer only exists once a user signs in, anonymous traffic
  * keeps hitting the shared-cacheable baseline — only signed-in reads become
- * per-customer. Bind this client wherever content is personalized (for most
- * apps, everywhere the customer may be signed in) and use plain `foirRequest`
+ * per-user. Bind this client wherever content is personalized (for most
+ * apps, everywhere the user may be signed in) and use plain `foirRequest`
  * for reads that must stay anonymous regardless of session.
  */
 import type { TypedDocumentNode } from '@graphql-typed-document-node/core';
@@ -25,9 +25,9 @@ import type { FoirTokenProvider } from '../transport/foir-http';
 export interface FoirContentClientConfig {
     env: FoirEnv;
     /**
-     * Resolves the current customer bearer before every request. When it yields a
+     * Resolves the current user bearer before every request. When it yields a
      * token the token is forwarded, so `authStatus`/segment targeting and
-     * customer-scoped records resolve as that customer; when it yields
+     * user-scoped records resolve as that user; when it yields
      * null/undefined the read hits the anonymous baseline. Omit for a client that
      * is always anonymous (equivalent to calling `foirRequest` directly).
      */
@@ -51,7 +51,7 @@ export interface FoirContentClientConfig {
 }
 export interface FoirContentClient {
     /**
-     * Run a typed document, forwarding the bound customer bearer when available.
+     * Run a typed document, forwarding the bound user bearer when available.
      * An explicit `options.bearerToken` still wins, so a single call can override
      * the bound token (or force anonymous by passing `undefined` — the bound
      * token only fills in when `options.bearerToken` is not supplied).
@@ -60,7 +60,7 @@ export interface FoirContentClient {
 }
 /**
  * Create a {@link FoirContentClient} bound to an env + token source. Every
- * `request` forwards the customer bearer when `getToken` yields one, upgrading
- * that read from the anonymous baseline to the signed-in customer.
+ * `request` forwards the user bearer when `getToken` yields one, upgrading
+ * that read from the anonymous baseline to the signed-in user.
  */
 export declare function createFoirContentClient(config: FoirContentClientConfig): FoirContentClient;

package/dist/index.js

@@ -98,10 +98,7 @@ function isValidHostMessage(data) {
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 var FOIR_CREDENTIALS_DOC = "https://docs.foir.dev/credentials";
 function foirKeyKind(apiKey) {

package/dist/live/drift.d.ts

@@ -12,7 +12,7 @@ import type { FoirSchemaDrift } from '../data/transport';
  * Nothing else catches it. The dependency graph is about records, and no record
  * changed. `seq` is about ordering, and nothing is out of order. The entry is
  * fresh, correctly tagged, correctly stamped, and describes a schema that no
- * longer exists — until the tab is reloaded, which on a long-lived admin
+ * longer exists — until the tab is reloaded, which on a long-lived console
  * session can be days.
  *
  * The SDK already detects this: the data client compares the surface version

package/dist/media/screen-capture.d.ts

@@ -6,7 +6,7 @@
  * ---------------------------------------------------------------------------
  *
  * Two surfaces need the same picture: the console's own bug report, and the
- * feedback widget a customer's visitors use (`@foir/sdk/react`). One of those
+ * feedback widget a user's visitors use (`@foir/sdk/react`). One of those
  * ships to npm and the other does not, so the shared half has to sit in the
  * published package — a copy in each would be two answers to "how big is a
  * screenshot", free to drift, and the drift would only show up as an upload the

package/dist/next/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * `@foir/sdk/next` — server-side Foir customer auth for the Next.js App Router
+ * `@foir/sdk/next` — server-side Foir user auth for the Next.js App Router
  * (the BFF pattern): an HttpOnly-cookie session adapter, server-side session
  * helpers, a provider-callback exchange, and a route-protection middleware.
  *
@@ -18,5 +18,5 @@ export { readFoirCacheTags, foirCacheTags, createFoirTaggingFetch, foirTagsForRe
 export type { FoirHeaderSource, FoirCacheTags, FoirCacheTagsOptions, FoirTaggingReport, FoirTaggingFetchOptions, FoirRecordChange, } from './cacheTags';
 export { createFoirMiddleware } from './middleware';
 export type { FoirMiddlewareConfig, FoirMiddlewareRequest } from './middleware';
-export type { FoirCustomer, SessionAdapter } from '../auth';
+export type { FoirUser, SessionAdapter } from '../auth';
 export type { FoirEnv } from '../graphql/foir-request';

package/dist/next/session.d.ts

@@ -1,4 +1,4 @@
-import type { FoirCustomer } from '../auth';
+import type { FoirUser } from '../auth';
 import type { FoirEnv } from '../graphql/foir-request';
 import type { CookieAdapterOptions, FoirCookieStore } from './cookieAdapter';
 /**
@@ -6,14 +6,14 @@ import type { CookieAdapterOptions, FoirCookieStore } from './cookieAdapter';
  * cookie store (`await cookies()` in a route handler / server action, or the
  * read-only `cookies()` in a Server Component for reads).
  *
- * Note on "verification": the customer access token is opaque to your app and
+ * Note on "verification": the user access token is opaque to your app and
  * validated by the Foir API on use, so `getFoirSession` returns the identity
  * stored in the cookies rather than locally verifying a JWT. A rejected/expired
  * bearer surfaces when you call the API (and `@foir/sdk/auth`'s `authedRequest`
  * transparently refreshes it).
  */
-/** The signed-in customer from the session cookies, or null. */
-export declare function getFoirSession(store: FoirCookieStore): Promise<FoirCustomer | null>;
+/** The signed-in user from the session cookies, or null. */
+export declare function getFoirSession(store: FoirCookieStore): Promise<FoirUser | null>;
 /** The current access token from the session cookies, or null. */
 export declare function getFoirToken(store: FoirCookieStore): Promise<string | null>;
 /** Clear the session cookies (sign out). */
@@ -26,9 +26,9 @@ interface PasswordArgs {
     cookieOptions?: CookieAdapterOptions['cookieOptions'];
 }
 /** Password sign-in in a route handler; persists the session to cookies. */
-export declare function foirSignInWithPassword({ env, store, email, password, cookieOptions, }: PasswordArgs): Promise<FoirCustomer>;
-/** Register a customer in a route handler; persists the session to cookies. */
-export declare function foirRegisterWithPassword({ env, store, email, password, cookieOptions, }: PasswordArgs): Promise<FoirCustomer>;
+export declare function foirSignInWithPassword({ env, store, email, password, cookieOptions, }: PasswordArgs): Promise<FoirUser>;
+/** Register a user in a route handler; persists the session to cookies. */
+export declare function foirRegisterWithPassword({ env, store, email, password, cookieOptions, }: PasswordArgs): Promise<FoirUser>;
 /** Complete an OTP sign-in in a route handler; persists the session to cookies. */
 export declare function foirSignInWithOtp({ env, store, email, otp, cookieOptions, }: {
     env: FoirEnv;
@@ -36,11 +36,11 @@ export declare function foirSignInWithOtp({ env, store, email, otp, cookieOption
     email: string;
     otp: string;
     cookieOptions?: CookieAdapterOptions['cookieOptions'];
-}): Promise<FoirCustomer>;
+}): Promise<FoirUser>;
 /**
  * Complete a provider (OAuth/OIDC) login in your callback route handler:
  * exchange the `code` + `state` for tokens and persist them to the session
- * cookies. Returns the customer.
+ * cookies. Returns the user.
  */
 export declare function completeFoirProviderLogin(opts: {
     env: FoirEnv;
@@ -49,5 +49,5 @@ export declare function completeFoirProviderLogin(opts: {
     code?: string;
     state?: string;
     cookieOptions?: CookieAdapterOptions['cookieOptions'];
-}): Promise<FoirCustomer>;
+}): Promise<FoirUser>;
 export {};