@foir/sdk 0.22.0 → 0.24.0

package/dist/auth.js

@@ -5,10 +5,7 @@ import { print as print2 } from "graphql";
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 var FOIR_CREDENTIALS_DOC = "https://docs.foir.dev/credentials";
 function foirKeyKind(apiKey) {
@@ -1096,7 +1093,6 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
@@ -1232,6 +1228,16 @@ function providerSignInRefusalOf(error) {
   }
   return null;
 }
+function signInRefusalOf(error) {
+  if (!(error instanceof FoirRequestError)) return null;
+  for (const entry of error.graphQLErrors ?? []) {
+    const value = entry.extensions?.signIn;
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const { code } = value;
+    if (typeof code === "string") return { code };
+  }
+  return null;
+}
 async function confirmProviderLink(env, input) {
   return authOp(env, AUTH_OPS.confirmProviderLink, { input });
 }
@@ -1253,15 +1259,12 @@ async function signupContext(env) {
 async function joinWaitlist(env, email) {
   return authOp(env, AUTH_OPS.joinWaitlist, { email });
 }
-async function requestPasswordReset(env, email) {
-  return authOp(env, AUTH_OPS.requestPasswordReset, { email });
+async function requestPasswordReset(env, email, options) {
+  return authOp(env, AUTH_OPS.requestPasswordReset, { email, clientId: options?.clientId });
 }
 async function resetPassword(env, vars) {
   return authOp(env, AUTH_OPS.resetPassword, vars);
 }
-async function verifyEmail(env, token) {
-  return authOp(env, AUTH_OPS.verifyEmail, { token });
-}
 async function updatePassword(env, vars, options) {
   return authOp(env, AUTH_OPS.updatePassword, vars, options);
 }
@@ -1269,7 +1272,9 @@ async function currentUser(env, options) {
   return authOp(env, AUTH_OPS.currentUser, void 0, options);
 }
 async function myProviderToken(env, providerKey, options) {
-  return authOp(env, AUTH_OPS.myProviderToken, { providerKey }, options);
+  const { forceRefresh, ...rest } = options ?? {};
+  const vars = forceRefresh ? { providerKey, forceRefresh: true } : { providerKey };
+  return authOp(env, AUTH_OPS.myProviderToken, vars, rest);
 }
 async function logout(env, options) {
   return authOp(env, AUTH_OPS.logout, void 0, options);
@@ -1486,125 +1491,125 @@ async function recoverSessionUser(adapter, env, token) {
 
 // src/auth/grant-table.generated.ts
 var GRANT_TABLE = [
-  ["records:read", true, ["own", "all"], []],
-  ["records:create", true, [], []],
-  ["records:write", true, ["own", "all"], []],
-  ["records:delete", true, ["own", "all"], []],
-  ["records:publish", true, ["own", "all"], []],
-  ["records:attribute", true, [], []],
-  ["search:read", true, [], []],
-  ["embeddings:read", false, [], []],
-  ["embeddings:write", false, [], []],
-  ["schemas:read", false, [], []],
-  ["drafts:read", false, [], []],
-  ["files:read", false, ["own", "all"], []],
-  ["files:write", false, ["own", "all"], []],
-  ["files:delete", false, ["own", "all"], []],
-  ["notifications:read", false, ["own", "all"], []],
-  ["notifications:write", false, ["own", "named", "all"], []],
-  ["notifications:consent", false, [], []],
-  ["pushcredentials:read", false, [], []],
-  ["pushcredentials:write", false, [], []],
-  ["notes:read", false, ["own", "all"], []],
-  ["notes:write", false, ["own", "all"], []],
-  ["notes:create", false, [], []],
-  ["approvals:read", false, [], []],
-  ["approvals:write", false, [], []],
-  ["rooms:read", true, [], []],
-  ["rooms:write", true, [], []],
-  ["presence:read", true, [], []],
-  ["operations:read", false, [], []],
-  ["operations:execute", true, [], []],
-  ["operations:write", false, [], []],
-  ["operations:complete", false, [], []],
-  ["status:write", false, [], []],
-  ["appconfig:read", false, [], []],
-  ["schedules:read", false, [], []],
-  ["schedules:write", false, [], []],
-  ["hooks:read", false, [], []],
-  ["hooks:write", false, [], []],
-  ["relyingparties:read", false, [], []],
-  ["relyingparties:write", false, [], []],
-  ["domains:read", false, [], []],
-  ["domains:write", false, [], []],
-  ["secrets:read", false, [], []],
-  ["secrets:list", false, [], []],
-  ["secrets:put", false, [], []],
-  ["secrets:delete", false, [], []],
-  ["appsecrets:read", false, [], []],
-  ["appsecrets:list", false, [], []],
-  ["appsecrets:put", false, [], []],
-  ["appsecrets:delete", false, [], []],
-  ["opsecrets:read", false, [], []],
-  ["opsecrets:write", false, [], []],
-  ["settings:read", false, [], []],
-  ["settings:write", false, [], []],
-  ["designtokens:read", false, [], []],
-  ["designtokens:write", false, [], []],
-  ["models:read", false, [], []],
-  ["models:write", false, [], []],
-  ["configs:read", false, [], []],
-  ["configs:write", false, [], []],
-  ["apps:read", false, [], []],
-  ["apps:write", false, [], []],
-  ["events:read", false, [], []],
-  ["targeting:debug", false, [], []],
-  ["visitors:forward", false, [], []],
-  ["apikeys:read", false, [], []],
-  ["apikeys:write", false, [], []],
-  ["organizations:read", false, [], []],
-  ["organizations:write", false, [], []],
-  ["organizations:create", false, [], []],
-  ["organizations:delete", false, [], []],
-  ["organizations:reach", false, [], []],
-  ["members:read", false, [], []],
-  ["members:write", false, [], []],
-  ["roles:read", false, [], []],
-  ["roles:write", false, [], []],
-  ["projects:read", false, [], []],
-  ["projects:write", false, [], []],
-  ["project:stand", false, [], []],
-  ["project:manage", false, [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "relyingparties:read", "relyingparties:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
-  ["projects:create", false, [], []],
-  ["projects:delete", false, [], []],
-  ["tenants:read", false, [], []],
-  ["tenants:write", false, [], []],
-  ["tenants:delete", false, [], []],
-  ["audit:read", false, [], []],
-  ["export:run", false, [], []],
-  ["billing:read", false, [], []],
-  ["billing:manage", false, [], []],
-  ["usage:read", false, [], []],
-  ["controlkeys:read", false, [], []],
-  ["controlkeys:write", false, [], []],
-  ["tenantsigninproviders:read", false, [], []],
-  ["tenantsigninproviders:write", false, [], []],
-  ["tenanthooks:read", false, [], []],
-  ["tenanthooks:write", false, [], []],
-  ["apps:install", false, [], []],
-  ["tenant:manage", false, [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "tenantsigninproviders:read", "tenantsigninproviders:write", "apps:install"]],
-  ["platform:read", false, [], []],
-  ["platform:manage", false, [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
-  ["platform:create_workspace", false, [], []],
-  ["users:read", false, ["own", "named", "all"], []],
-  ["users:write", false, ["own", "all"], []],
-  ["users:setup", false, [], []],
-  ["users:delete", false, ["own", "all"], []],
-  ["users:create", false, [], []],
-  ["identities:read", false, [], []],
-  ["identities:delete", false, [], []],
-  ["usersecrets:read", false, [], []],
-  ["usersecrets:list", false, [], []],
-  ["usersecrets:put", false, [], []],
-  ["usersecrets:delete", false, [], []],
-  ["auth:login_with_foir", false, [], []],
-  ["signinproviders:read", false, [], []],
-  ["signinproviders:write", false, [], []]
+  ["records:read", "model", ["own", "all"], []],
+  ["records:create", "model", [], []],
+  ["records:write", "model", ["own", "all"], []],
+  ["records:delete", "model", ["own", "all"], []],
+  ["records:publish", "model", ["own", "all"], []],
+  ["records:attribute", "model", [], []],
+  ["search:read", "model", [], []],
+  ["embeddings:read", "none", [], []],
+  ["embeddings:write", "none", [], []],
+  ["schemas:read", "none", [], []],
+  ["drafts:read", "none", [], []],
+  ["files:read", "none", ["own", "all"], []],
+  ["files:write", "none", ["own", "all"], []],
+  ["files:delete", "none", ["own", "all"], []],
+  ["notifications:read", "none", ["own", "all"], []],
+  ["notifications:write", "none", ["own", "named", "all"], []],
+  ["notifications:consent", "none", [], []],
+  ["pushcredentials:read", "none", [], []],
+  ["pushcredentials:write", "none", [], []],
+  ["notes:read", "none", ["own", "all"], []],
+  ["notes:write", "none", ["own", "all"], []],
+  ["notes:create", "none", [], []],
+  ["approvals:read", "none", [], []],
+  ["approvals:write", "none", [], []],
+  ["rooms:read", "model", [], []],
+  ["rooms:write", "model", [], []],
+  ["presence:read", "model", [], []],
+  ["operations:read", "none", [], []],
+  ["operations:execute", "operation", [], []],
+  ["operations:write", "none", [], []],
+  ["operations:complete", "none", [], []],
+  ["status:write", "none", [], []],
+  ["appconfig:read", "none", [], []],
+  ["schedules:read", "none", [], []],
+  ["schedules:write", "none", [], []],
+  ["hooks:read", "none", [], []],
+  ["hooks:write", "none", [], []],
+  ["authclients:read", "none", [], []],
+  ["authclients:write", "none", [], []],
+  ["domains:read", "none", [], []],
+  ["domains:write", "none", [], []],
+  ["secrets:read", "none", [], []],
+  ["secrets:list", "none", [], []],
+  ["secrets:put", "none", [], []],
+  ["secrets:delete", "none", [], []],
+  ["appsecrets:read", "none", [], []],
+  ["appsecrets:list", "none", [], []],
+  ["appsecrets:put", "none", [], []],
+  ["appsecrets:delete", "none", [], []],
+  ["opsecrets:read", "none", [], []],
+  ["opsecrets:write", "none", [], []],
+  ["settings:read", "none", [], []],
+  ["settings:write", "none", [], []],
+  ["designtokens:read", "none", [], []],
+  ["designtokens:write", "none", [], []],
+  ["models:read", "none", [], []],
+  ["models:write", "none", [], []],
+  ["configs:read", "none", [], []],
+  ["configs:write", "none", [], []],
+  ["apps:read", "none", [], []],
+  ["apps:write", "none", [], []],
+  ["events:read", "none", [], []],
+  ["targeting:debug", "none", [], []],
+  ["visitors:forward", "none", [], []],
+  ["apikeys:read", "none", [], []],
+  ["apikeys:write", "none", [], []],
+  ["organizations:read", "none", [], []],
+  ["organizations:write", "none", [], []],
+  ["organizations:create", "none", [], []],
+  ["organizations:delete", "none", [], []],
+  ["organizations:reach", "none", [], []],
+  ["members:read", "none", [], []],
+  ["members:write", "none", [], []],
+  ["roles:read", "none", [], []],
+  ["roles:write", "none", [], []],
+  ["projects:read", "none", [], []],
+  ["projects:write", "none", [], []],
+  ["project:stand", "none", [], []],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["projects:create", "none", [], []],
+  ["projects:delete", "none", [], []],
+  ["tenants:read", "none", [], []],
+  ["tenants:write", "none", [], []],
+  ["tenants:delete", "none", [], []],
+  ["audit:read", "none", [], []],
+  ["export:run", "none", [], []],
+  ["billing:read", "none", [], []],
+  ["billing:manage", "none", [], []],
+  ["usage:read", "none", [], []],
+  ["controlkeys:read", "none", [], []],
+  ["controlkeys:write", "none", [], []],
+  ["tenanthooks:read", "none", [], []],
+  ["tenanthooks:write", "none", [], []],
+  ["apps:install", "none", [], []],
+  ["tenant:manage", "none", [], ["project:manage", "projects:create", "projects:delete", "tenants:read", "tenants:write", "tenants:delete", "export:run", "billing:read", "billing:manage", "usage:read", "controlkeys:read", "controlkeys:write", "tenanthooks:read", "tenanthooks:write", "apps:install"]],
+  ["platform:read", "none", [], []],
+  ["platform:manage", "none", [], ["tenant:manage", "platform:read", "platform:create_workspace"]],
+  ["platform:create_workspace", "none", [], []],
+  ["users:read", "none", ["own", "named", "all"], []],
+  ["users:write", "none", ["own", "all"], []],
+  ["users:setup", "none", [], []],
+  ["users:delete", "none", ["own", "all"], []],
+  ["users:create", "none", [], []],
+  ["identities:read", "none", [], []],
+  ["identities:delete", "none", [], []],
+  ["usersecrets:read", "none", [], []],
+  ["usersecrets:list", "none", [], []],
+  ["usersecrets:put", "none", [], []],
+  ["usersecrets:delete", "none", [], []],
+  ["auth:login_with_foir", "none", [], []],
+  ["signinproviders:read", "none", [], []],
+  ["signinproviders:write", "none", [], []]
 ];
 
 // src/auth/grants.ts
 var WILDCARD = "*";
 var RESOURCE_WILDCARD = ":*";
+var FIELD_PERMISSIONS = ["records:read", "records:write"];
+var FIELD_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var index;
 function catalogue() {
   if (!index) {
@@ -1645,15 +1650,23 @@ function parseGrant(s) {
     let target = "";
     if (rest.startsWith(":")) {
       target = rest.slice(1);
-      if (!permission[1]) return null;
+      if (permission[1] === "none") return null;
       if (target === "" || /[: \t\n*]/.test(target)) return null;
+      const dot = target.indexOf(".");
+      if (permission[1] === "model" && dot >= 0) {
+        if (!FIELD_PERMISSIONS.includes(name) || dot === 0 || !FIELD_KEY.test(target.slice(dot + 1))) return null;
+      }
     }
     return { permission, reach, target };
   }
   return null;
 }
 function covers(held, required) {
-  return held.permission === required.permission && reachRank[held.reach] >= reachRank[required.reach] && (held.target === "" || held.target === required.target);
+  if (held.permission !== required.permission || reachRank[held.reach] < reachRank[required.reach]) return false;
+  if (required.permission[1] === "model" && required.target.includes(".")) {
+    return held.target === required.target || held.target === "" && held.reach === "all";
+  }
+  return held.target === "" || held.target === required.target;
 }
 function resourceWildcard(held) {
   if (!held.endsWith(RESOURCE_WILDCARD)) return null;
@@ -1775,7 +1788,7 @@ async function fetchHostedSession(request, config) {
   if (!match) return { outcome: "signed-out", reason: "no-cookie" };
   let res;
   try {
-    res = await fetch(`${config.loginOrigin}${sessionPath}`, {
+    res = await fetch(`${config.loginOrigin}${sessionPath}${forApp(config.clientId)}`, {
       headers: {
         Cookie: `${cookieName}=${match[1]}`,
         "X-Foir-Session": "1"
@@ -1818,6 +1831,41 @@ async function fetchHostedSession(request, config) {
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function hostedSignInNoticeOf(location, names) {
+  const params = location instanceof URLSearchParams ? location : location instanceof URL ? location.searchParams : new URL(location, "https://callback.invalid").searchParams;
+  const code = params.get("foir_error") ?? (params.get("error") ? params.get("error_description") : null);
+  if (code) {
+    return { kind: "refused", code, message: refusalMessage(code) };
+  }
+  const provider = params.get("foir_connected");
+  if (provider) {
+    const name = names?.[provider] ?? provider;
+    return { kind: "connected", provider, message: `Your ${name} sign-in is now connected to your account.` };
+  }
+  return null;
+}
+var REFUSAL_MESSAGES = {
+  account_unavailable: "This account can\u2019t sign in right now.",
+  account_not_here: "That account doesn\u2019t sign in here.",
+  email_unavailable: "This app can\u2019t send email yet, so no code was sent. Sign in another way.",
+  signup_closed: "There\u2019s no account for that address here, and it can\u2019t be made by signing in.",
+  user_cap_reached: "This app can\u2019t take any more people right now.",
+  provider_named_no_subject: "The provider didn\u2019t say who you are, so it can\u2019t sign you in. Try another way.",
+  provider_has_no_issuer: "The provider didn\u2019t say who you are, so it can\u2019t sign you in. Try another way.",
+  provider_named_no_address: "The provider didn\u2019t share an email address, so it can\u2019t sign you in. Try another way.",
+  provider_refused: "The provider didn\u2019t finish the sign-in.",
+  provider_unavailable: "The provider couldn\u2019t be reached. Try again in a moment.",
+  provider_exchange_failed: "The provider couldn\u2019t be reached. Try again in a moment.",
+  two_step_sign_in: "This account uses two-step sign-in. Sign in with your password or a passkey.",
+  mfa_required: "This app needs a second factor, which a provider sign-in can\u2019t give. Sign in with your password instead.",
+  sign_in_expired: "This sign-in has expired. Start again."
+};
+function refusalMessage(code) {
+  return REFUSAL_MESSAGES[code] ?? "The sign-in couldn\u2019t be finished. Try again.";
+}
+function forApp(clientId) {
+  return clientId ? `?client_id=${encodeURIComponent(clientId)}` : "";
+}
 
 // src/auth/session-client.ts
 var DEFAULT_SESSION_PATH2 = "/session/token";
@@ -1826,8 +1874,9 @@ var DEFAULT_REFRESH_SKEW_SECONDS = 60;
 var MIN_REFRESH_DELAY_MS = 5e3;
 var CSRF_HEADER = { "X-Foir-Session": "1" };
 function createFoirSessionClient(config) {
-  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH2}`;
-  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}`;
+  const forApp2 = config.clientId ? `?client_id=${encodeURIComponent(config.clientId)}` : "";
+  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH2}${forApp2}`;
+  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}${forApp2}`;
   const skewMs = (config.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS) * 1e3;
   let cached = null;
   let inflight = null;
@@ -1984,6 +2033,7 @@ export {
   hasScope,
   hostedLoginUrl,
   hostedLogoutUrl,
+  hostedSignInNoticeOf,
   joinWaitlist,
   login,
   loginWithOTP,
@@ -2015,6 +2065,7 @@ export {
   resetPasswordAndSignIn,
   revokeAuthorizedApp,
   saveSession,
+  signInRefusalOf,
   signInWithOTP,
   signInWithPassword,
   signOut,
@@ -2023,6 +2074,5 @@ export {
   signupContext,
   updateMyProfile,
   updatePassword,
-  userAccess,
-  verifyEmail
+  userAccess
 };

package/dist/client.js

@@ -5,10 +5,7 @@ import { print as print2 } from "graphql";
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 var FOIR_CREDENTIALS_DOC = "https://docs.foir.dev/credentials";
 function foirKeyKind(apiKey) {

package/dist/codegen/preset.d.ts

@@ -16,7 +16,7 @@ export interface FoirCodegenOptions {
     /** Foir public API GraphQL endpoint. */
     apiUrl: string;
     /**
-     * Public (`pk_`) API key. Reads the published schema. Used as the fallback
+     * Publishable API key. Reads the published schema. Used as the fallback
      * when no preview key is set.
      */
     apiKey?: string;

package/dist/components/EditorProvider.d.ts

@@ -11,7 +11,7 @@ export interface EditorProviderProps {
     children: ReactNode;
     /**
      * Parent window origin for postMessage validation.
-     * Must be an explicit origin (e.g., 'https://admin.example.com').
+     * Must be an explicit origin (e.g., 'https://console.example.com').
      * Falls back to VITE_PARENT_ORIGIN or NEXT_PUBLIC_PARENT_ORIGIN env var.
      */
     parentOrigin?: string;

package/dist/data/client.d.ts

@@ -221,7 +221,7 @@ export interface FoirClientCore<S extends FoirSchemaDefinition> {
 /**
  * The client, shaped by the credential's manifest. An op that is not in
  * `FoirSchema` is not on this type, so `foir.tilly_block.create(...)` under a
- * read-only `pk_` key is a compile error rather than a 400.
+ * read-only publishable key is a compile error rather than a 400.
  */
 export type FoirClient<S extends FoirSchemaDefinition> = FoirClientCore<S> & {
     [MK in keyof S['models']]: FoirModelClient<S, S['models'][MK]>;

package/dist/data/schema.d.ts

@@ -130,7 +130,7 @@
  * 3. **Emit only what the manifest returned.** The manifest is already the
  *    per-caller projection of `SchemaForCaller(scopes)`, so "only the ops this
  *    credential can perform" needs no extra filtering — it is what arrives. A
- *    `pk_` key's generated schema simply has no `create`, and
+ *    publishable key's generated schema simply has no `create`, and
  *    `foir.tilly_block.create(...)` is then a compile error, which is the
  *    entire point of per-key shaping.
  *

package/dist/data/transport.d.ts

@@ -5,12 +5,12 @@
  * Where a call goes
  * ---------------------------------------------------------------------------
  *
- *   read + `pk_` key + no user bearer + published channel
- *     → `GET /cdn/graphql?key=pk_…&extensions={"persistedQuery":{"sha256Hash":…}}`
+ *   read + publishable key + no user bearer + published channel
+ *     → `GET /cdn/graphql?key=foir_pub_…&extensions={"persistedQuery":{"sha256Hash":…}}`
  *       A shared cache in front of the caller stores the response, because the
  *       request is a GET and the credential is in the URL.
  *
- *   anything else — `sk_`, a user bearer, a mutation, the draft channel
+ *   anything else: a server or admin key, a user bearer, a mutation, the draft channel
  *     → `POST /graphql` with the `x-api-key` header and the APQ body.
  *
  *   a call made AS an operation, with its dispatch token
@@ -182,8 +182,9 @@ export interface FoirDispatchCredential {
     context?: string | null;
 }
 /**
- * A client that calls Foir with an api key: a storefront's `pk_`, a server's
- * `sk_`, optionally for a signed-in user.
+ * A client that calls Foir with an api key: a storefront's publishable key, or
+ * the server key of the server that renders its pages, optionally for a
+ * signed-in user.
  */
 export interface FoirKeyClientConfig<S extends FoirSchemaDefinition = FoirSchemaDefinition> {
     /**
@@ -194,7 +195,7 @@ export interface FoirKeyClientConfig<S extends FoirSchemaDefinition = FoirSchema
      * a trailing `/graphql` is stripped before a path is appended.
      */
     apiUrl: string;
-    /** `pk_…` or `sk_…`. The manifest, and therefore the generated types, are shaped by it. */
+    /** `foir_pub_…` or `foir_srv_…`. The manifest, and therefore the generated types, are shaped by it. */
     apiKey: string;
     /** A key client has no dispatch token; see {@link FoirDispatchClientConfig}. */
     dispatch?: never;

package/dist/data.js

@@ -240,10 +240,7 @@ function readFoirEnvelope(json, options) {
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 var FOIR_CREDENTIALS_DOC = "https://docs.foir.dev/credentials";
 function foirKeyKind(apiKey) {
@@ -356,7 +353,7 @@ function assertFoirCredential(config) {
     if (kind === "admin") {
       throw new FoirRequestError(adminKeyRefusal("createFoirClient"));
     }
-    if (loose.visitor !== void 0 && kind !== "server" && kind !== "older") {
+    if (loose.visitor !== void 0 && kind !== "server") {
       throw new FoirRequestError(
         `[foir] createFoirClient: \`visitor\` names the visitor a server calls for, and only a server key holding visitors:forward may send it. A publishable key already calls as its visitor, and cannot hold the permission. Drop \`visitor\`, or build this client from your server key on the server that renders your pages. See ${FOIR_CREDENTIALS_DOC}`
       );

package/dist/index.js

@@ -98,10 +98,7 @@ function isValidHostMessage(data) {
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 var FOIR_CREDENTIALS_DOC = "https://docs.foir.dev/credentials";
 function foirKeyKind(apiKey) {

package/dist/next.js

@@ -24,10 +24,7 @@ import { print as print2 } from "graphql";
 var KEY_PREFIXES = [
   ["foir_pub_", "publishable"],
   ["foir_srv_", "server"],
-  ["foir_adm_", "admin"],
-  ["pk_", "publishable"],
-  ["sk_", "older"],
-  ["tc_", "older"]
+  ["foir_adm_", "admin"]
 ];
 function foirKeyKind(apiKey) {
   if (typeof apiKey !== "string") return void 0;
@@ -976,7 +973,6 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",