@foir/sdk 0.23.0 → 0.24.0

package/dist/app/contract/proto/apps/v1/apps_pb.d.ts

@@ -33,7 +33,7 @@ export declare type AppConfig = Message<"apps.v1.AppConfig"> & {
   version: string;
 
   /**
-   * OPTIONAL. Display metadata for admin UI.
+   * OPTIONAL. Display metadata for the console.
    *
    * @generated from field: apps.v1.Metadata metadata = 3;
    */
@@ -110,16 +110,16 @@ export declare type AppConfig = Message<"apps.v1.AppConfig"> & {
   inbound?: Inbound | undefined;
 
   /**
-   * What the operator turns on and off as a whole, each with the storage it
-   * keeps. See Feature.
+   * What the person setting it up turns on and off as a whole, each with the
+   * storage it keeps. See Feature.
    *
    * @generated from field: repeated apps.v1.Feature features = 13;
    */
   features: Feature[];
 
   /**
-   * OPTIONAL. The app's own system has customers who sign in to it. See
-   * CustomerSignIn.
+   * OPTIONAL. The app's own system has users who sign in to it. See
+   * UserSignIn.
    *
    * @generated from field: apps.v1.UserSignIn user_sign_in = 14;
    */
@@ -133,29 +133,29 @@ export declare type AppConfig = Message<"apps.v1.AppConfig"> & {
 export declare const AppConfigSchema: GenMessage<AppConfig>;
 
 /**
- * The app's own system has customers, and the app names each by the subject of
- * their sign-in with that system: a store's customer number, which is also who
- * they are when they sign in to the project through the store's sign-in.
+ * The app's own system has users, and the app names each by the subject of
+ * their sign-in with that system: the id the store knows them by, which is also
+ * who they are when they sign in to the project through the store's sign-in.
  *
- * Declaring it lets an install pair ONE of the project's customer sign-ins with
- * the app (ConfirmInstallAppRequest.customer_sign_in): the operator says which
- * sign-in the app's customers come through, and the platform resolves every
- * identity the app names through that sign-in and no other. The pairing is the
- * operator's, never inferred: the install knows the external account it
- * connects, not which of the project's sign-ins its customers use, and a wrong
+ * Declaring it lets an install pair ONE of the project's sign-ins with
+ * the app (ConfirmInstallAppRequest.user_sign_in): the person installing says
+ * which sign-in the app's users come through, and the platform resolves every
+ * identity the app names through that sign-in and no other. The pairing is that
+ * person's choice, never inferred: the install knows the external account it
+ * connects, not which of the project's sign-ins its users use, and a wrong
  * pairing would attach one person's data to another.
  *
  * The pairing is optional. What needs it says so, and cannot be on without it:
- * a source that names its customers by identity (SourceType.identity), a
- * feature that finds customers through it (Feature.customer_sign_in), and an
- * operation that asks who holds an identity (customers:read:identity).
+ * a source that names its users by identity (SourceType.identity), a
+ * feature that finds users through it (Feature.user_sign_in), and an
+ * operation that asks who holds an identity (identities:read).
  *
  * @generated from message apps.v1.UserSignIn
  */
 export declare type UserSignIn = Message<"apps.v1.UserSignIn"> & {
   /**
-   * What the setup tells the operator they are choosing, in a sentence: which
-   * customers these are and what identifies them.
+   * What the setup tells the person installing they are choosing, in a
+   * sentence: which users these are and what identifies them.
    *
    * @generated from field: string description = 1;
    */
@@ -169,15 +169,15 @@ export declare type UserSignIn = Message<"apps.v1.UserSignIn"> & {
 export declare const UserSignInSchema: GenMessage<UserSignIn>;
 
 /**
- * A feature of the app: something the operator turns on or off as a whole at
- * setup, such as a store's preorders or its back-in-stock alerts.
+ * A feature of the app: something the person installing turns on or off as a
+ * whole at setup, such as a store's preorders or its back-in-stock alerts.
  *
  * A feature KEEPS its storage. The sources it names are the storage it writes,
  * and they exist only while it is on: turning it on is what creates them, which
- * the operator approves at setup, and while it is off they are declined, so no
- * model is made and the operations that need them are not registered. Each of
- * them is optional, since switching the feature off drops it, and belongs to
- * no other feature.
+ * the person installing approves at setup, and while it is off they are
+ * declined, so no model is made and the operations that need them are not
+ * registered. Each of them is optional, since switching the feature off drops
+ * it, and belongs to no other feature.
  *
  * A feature may also name a setting, when the app itself has to know whether
  * it is on: for example because it changes the access the app asks its vendor
@@ -225,8 +225,8 @@ export declare type Feature = Message<"apps.v1.Feature"> & {
   sources: string[];
 
   /**
-   * The feature finds customers through the install's customer sign-in
-   * (AppConfig.customer_sign_in), which the manifest must declare. It cannot
+   * The feature finds users through the install's paired sign-in
+   * (AppConfig.user_sign_in), which the manifest must declare. It cannot
    * be on at an install that pairs none: the setup asks for the sign-in at the
    * switch, and the platform refuses the switch without one.
    *
@@ -244,7 +244,7 @@ export declare type Feature = Message<"apps.v1.Feature"> & {
 
   /**
    * The notification category the feature keeps consent in, when it reads or
-   * writes what a customer chose. See FeatureConsentCategory.
+   * writes what a user chose. See FeatureConsentCategory.
    *
    * @generated from field: apps.v1.FeatureConsentCategory consent_category = 8;
    */
@@ -261,12 +261,12 @@ export declare const FeatureSchema: GenMessage<Feature>;
  * The notification category a feature sends under.
  *
  * A project that declares notification categories takes every notification
- * under one of them, so that what a customer chose about a category is
- * honoured. An app that sends has to be given one the project has, and nobody
- * should have to type its key to do that. So the feature says which of the
- * app's settings holds the key, and proposes the category it would send under.
- * The setup offers the project's own categories and the proposed one, makes the
- * proposed one where the operator chooses it, and writes the chosen key to the
+ * under one of them, so that what a user chose about a category is honoured. An
+ * app that sends has to be given one the project has, and nobody should have to
+ * type its key to do that. So the feature says which of the app's settings
+ * holds the key, and proposes the category it would send under. The setup
+ * offers the project's own categories and the proposed one, makes the proposed
+ * one where the person installing chooses it, and writes the chosen key to the
  * setting. The app reads the setting and names that key on every send.
  *
  * The platform holds the setting to that: while the feature is on at a running
@@ -294,22 +294,23 @@ export declare type FeatureNotificationCategory = Message<"apps.v1.FeatureNotifi
   key: string;
 
   /**
-   * REQUIRED. What the category is called to an operator and to a customer.
+   * REQUIRED. What the category is called, in the console and to the project's
+   * users.
    *
    * @generated from field: string name = 3;
    */
   name: string;
 
   /**
-   * What a customer is choosing about, in a sentence.
+   * What a user is choosing about, in a sentence.
    *
    * @generated from field: string description = 4;
    */
   description: string;
 
   /**
-   * A customer has to opt in before anything is sent to them under the
-   * proposed category. Left unset it is sent until a customer opts out.
+   * A user has to opt in before anything is sent to them under the
+   * proposed category. Left unset it is sent until a user opts out.
    *
    * @generated from field: bool opt_in = 5;
    */
@@ -325,23 +326,23 @@ export declare const FeatureNotificationCategorySchema: GenMessage<FeatureNotifi
 /**
  * The notification category a feature keeps consent in.
  *
- * A feature that carries what a customer chose about a category to or from
+ * A feature that carries what a user chose about a category to or from
  * another system sends nothing itself. It reads and writes consent on one
- * channel, and consent is what a category records where a customer opts in on
+ * channel, and consent is what a category records where a user opts in on
  * that channel: nothing is sent there until they say yes. So the feature has
- * to be given a category the project has and a customer opts in to on its
+ * to be given a category the project has and a user opts in to on its
  * channel, and nobody should have to type its key to do that. The feature says
  * which of the app's settings holds the key and which channel's consent it
  * keeps, and proposes the category it would keep it in. The setup offers the
- * project's own categories a customer opts in to on that channel and the
- * proposed one, makes the proposed one where the operator chooses it, and
+ * project's own categories a user opts in to on that channel and the
+ * proposed one, makes the proposed one where the person installing chooses it, and
  * writes the chosen key to the setting. The app reads the setting.
  *
  * The platform holds the setting to that: while the feature is on at a running
- * install it names a category the install's level is served and a customer
+ * install it names a category the install's level is served and a user
  * opts in to on the channel, or, at a level served no category, the proposed
  * key, which is made a category of that level together with its first, one a
- * customer opts in to on every channel.
+ * user opts in to on every channel.
  *
  * @generated from message apps.v1.FeatureConsentCategory
  */
@@ -356,7 +357,7 @@ export declare type FeatureConsentCategory = Message<"apps.v1.FeatureConsentCate
   /**
    * REQUIRED. The key of the category the app proposes: what the category is
    * called in the project's API. Letters, digits and underscores, starting
-   * with a letter. The proposed category is always one a customer opts in to,
+   * with a letter. The proposed category is always one a user opts in to,
    * on every channel.
    *
    * @generated from field: string key = 2;
@@ -364,14 +365,15 @@ export declare type FeatureConsentCategory = Message<"apps.v1.FeatureConsentCate
   key: string;
 
   /**
-   * REQUIRED. What the category is called to an operator and to a customer.
+   * REQUIRED. What the category is called, in the console and to the project's
+   * users.
    *
    * @generated from field: string name = 3;
    */
   name: string;
 
   /**
-   * What a customer is agreeing to, in a sentence.
+   * What a user is agreeing to, in a sentence.
    *
    * @generated from field: string description = 4;
    */
@@ -462,7 +464,7 @@ export declare type Credentials = Message<"apps.v1.Credentials"> & {
   strategy: Credentials_Strategy;
 
   /**
-   * Shape of the admin form for strategies that take structured values.
+   * Shape of the console's form for strategies that take structured values.
    * JSON Schema.
    *
    * @generated from field: optional google.protobuf.Struct schema = 2;
@@ -477,11 +479,12 @@ export declare type Credentials = Message<"apps.v1.Credentials"> & {
   oauth?: OAuthConfig | undefined;
 
   /**
-   * What the operator is told before they connect their account, in the app's
-   * own words: anything connecting changes that they would not otherwise
-   * know. The setup shows it beside the step that connects, and an install the
-   * vendor started shows it before the install is confirmed, because that
-   * install goes on to connect by itself. Empty when there is nothing to say.
+   * What the person installing is told before they connect their account, in
+   * the app's own words: anything connecting changes that they would not
+   * otherwise know. The setup shows it beside the step that connects, and an
+   * install the vendor started shows it before the install is confirmed,
+   * because that install goes on to connect by itself. Empty when there is
+   * nothing to say.
    *
    * @generated from field: string connect_notice = 4;
    */
@@ -643,7 +646,7 @@ export declare type AccountWebhook = Message<"apps.v1.AccountWebhook"> & {
   /**
    * Which setting holds the account identifier, as a key of the app's own
    * settings. For a store integration that is the store's domain, supplied by
-   * the operator at install.
+   * the person installing it.
    *
    * ONE WORD. This key is read from stored manifest JSON by SQL, and protojson
    * accepts both snake_case and camelCase on input, so a two-word name would
@@ -671,9 +674,9 @@ export declare type AccountWebhook = Message<"apps.v1.AccountWebhook"> & {
 export declare const AccountWebhookSchema: GenMessage<AccountWebhook>;
 
 /**
- * A source type the app can deliver inbound. At install, admin maps this
- * type onto a project model key and maps each suggested field onto a model
- * field key.
+ * A source type the app can deliver inbound. At install, the person installing
+ * maps this type onto a project model key and maps each suggested field onto a
+ * model field key.
  *
  * @generated from message apps.v1.SourceType
  */
@@ -699,10 +702,10 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
    * $placeholders reference it are DROPPED rather than failing to resolve.
    * Default false, so every existing manifest keeps today's behaviour.
    *
-   * This is what makes "sync customers, or don't" expressible. Without it an
-   * app either forces the operator to map a model they do not want — and the
-   * operation carries records:write:<model> regardless — or cannot offer the
-   * source at all.
+   * This is what makes "sync this source, or don't" expressible. Without it an
+   * app either forces the person installing to map a model they do not want —
+   * and the operation carries records:write:<model> regardless — or cannot
+   * offer the source at all.
    *
    * @generated from field: bool optional = 4;
    */
@@ -713,14 +716,14 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
    * against it, but expects NO inbound sync: the app owns the write path and
    * there is no external system on the other end.
    *
-   * Still mapped — the operator chooses which model it targets, because
+   * Still mapped — the person installing chooses which model it targets, because
    * capability resolution needs that answer. What it is not is SYNCED, which
    * is the whole distinction from `optional` above; the two compose freely.
    *
    * AppInstallPreview must present it as storage the app needs rather than as
    * something the external system will send. Presenting it as a sync mapping
    * is not a cosmetic slip: it is a false statement in the one screen whose
-   * job is to tell the operator what the app will do.
+   * job is to tell the person installing what the app will do.
    *
    * @generated from field: bool provision_only = 5;
    */
@@ -741,15 +744,15 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
    * Who each row of this source's model belongs to. Unset says nothing, and
    * the source maps onto a model owned at any level, as before.
    *
-   * Set, it is a requirement the install holds the operator to: the source may
-   * only be mapped onto a model owned at this level, and the guided setup
-   * creates the model that way. It exists for storage whose meaning depends on
-   * who can read it. A wishlist the app writes for each customer is private to
-   * that customer only if its model is customer-owned; mapped onto a
+   * Set, it is a requirement the install holds the person installing to: the
+   * source may only be mapped onto a model owned at this level, and the guided
+   * setup creates the model that way. It exists for storage whose meaning
+   * depends on who can read it. A wishlist the app writes for each user is
+   * private to that user only if its model is user-owned; mapped onto a
    * project-owned model, every row is readable by the project's public key.
    *
-   * CUSTOMER requires provision_only or `identity`: a sync writes what the
-   * external system sends, and only `identity` gives each row a customer to
+   * USER requires provision_only or `identity`: a sync writes what the
+   * external system sends, and only `identity` gives each row a user to
    * own it.
    *
    * @generated from field: apps.v1.StorageOwner owner = 7;
@@ -757,8 +760,8 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
   owner: StorageOwner;
 
   /**
-   * The app's word that this storage starts on in the guided setup. The
-   * operator can still decline it, and declining still drops what references
+   * The app's word that this storage starts on in the guided setup. The person
+   * installing can still decline it, and declining still drops what references
    * it: this is a default, not a requirement.
    *
    * Only for a source that is both `optional` and `provision_only`, and a
@@ -794,17 +797,17 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
   lookup: string[];
 
   /**
-   * The field that names the customer each row belongs to, as the external
-   * system identifies them: a customer's id there, which is also the subject
+   * The field that names the user each row belongs to, as the external
+   * system identifies them: their id there, which is also the subject
    * of their sign-in with it. One of this source's `fields`, a required scalar,
-   * and only on a customer-owned source (`owner` CUSTOMER).
-   *
-   * It is what lets a sync write customer-owned rows. The platform resolves the
-   * value to a Foir customer through the customer sign-in the install pairs
-   * with the app (AppConfig.customer_sign_in, which the manifest must then
-   * declare), at the install's level: the customer who signs in with that
-   * identity, or one made for it. Each customer holds one row of the source,
-   * their profile, so the source has no natural key; the customer is the key.
+   * and only on a user-owned source (`owner` USER).
+   *
+   * It is what lets a sync write user-owned rows. The platform resolves the
+   * value to a Foir user through the sign-in the install pairs
+   * with the app (AppConfig.user_sign_in, which the manifest must then
+   * declare), at the install's level: the user who signs in with that
+   * identity, or one made for it. Each user holds one row of the source,
+   * their profile, so the source has no natural key; the user is the key.
    * Never matched by email.
    *
    * @generated from field: string identity = 10;
@@ -833,7 +836,7 @@ export declare const SourceTypeSchema: GenMessage<SourceType>;
  * for where it stands, as an operation's request template is.
  *
  * A live field is not filterable or sortable: nothing about it is stored. An
- * operator who needs to filter on host fields inside Foir keeps a copy.
+ * project that needs to filter on host fields inside Foir keeps a copy.
  *
  * @generated from message apps.v1.SourceReference
  */
@@ -950,8 +953,9 @@ export declare type ReferenceRequest = Message<"apps.v1.ReferenceRequest"> & {
 export declare const ReferenceRequestSchema: GenMessage<ReferenceRequest>;
 
 /**
- * A sink contract the app needs outbound. At install, admin maps this
- * contract onto a project model and maps each field onto a model field.
+ * A sink contract the app needs outbound. At install, the person installing
+ * maps this contract onto a project model and maps each field onto a model
+ * field.
  *
  * @generated from message apps.v1.SinkContract
  */
@@ -1021,7 +1025,7 @@ export declare type SuggestedField = Message<"apps.v1.SuggestedField"> & {
    * SOURCE_ONLY.
    *
    * READ IT AS A SET OF LEGS, NOT AS A RANK: SOURCE_ONLY is {inbound},
-   * SINK_ONLY is {outbound}, BIDIRECTIONAL is both. The operator's choice must
+   * SINK_ONLY is {outbound}, BIDIRECTIONAL is both. The install's choice must
    * be a SUBSET of what is declared here, so a SINK_ONLY declaration permits
    * only SINK_ONLY — it does not permit SOURCE_ONLY as some lesser option.
    *
@@ -1033,7 +1037,7 @@ export declare type SuggestedField = Message<"apps.v1.SuggestedField"> & {
    * Declared by the app author because they are the only party who knows.
    * Stripe's Price.unit_amount is the canonical case: it is immutable, so
    * writing an edit back is not a slow path, it is a thing that cannot happen.
-   * An operator choosing BIDIRECTIONAL for such a field has to be refused at
+   * Choosing BIDIRECTIONAL for such a field has to be refused at
    * configuration time rather than discovering it when the first edit fails
    * somewhere they are not looking.
    *
@@ -1050,7 +1054,7 @@ export declare type SuggestedField = Message<"apps.v1.SuggestedField"> & {
    * what lets it ask the platform for the count rather than read every row.
    *
    * It says what the app needs of a model the setup creates, and nothing
-   * stricter: filtering needs no index, and an operator mapping onto a model
+   * stricter: filtering needs no index, and a person mapping onto a model
    * of their own may index it or not. An app asking to count by a field that
    * is not indexed is refused by the aggregate, naming the field.
    *
@@ -1202,7 +1206,8 @@ export declare type Operation = Message<"apps.v1.Operation"> & {
    * own token is not a connection. Multiple operations with
    * run_after_install=true are dispatched in manifest declaration order. A
    * failure here emits the app_event `post_install_op_failed` but does NOT roll
-   * back what triggered it; the admin retries via the standard op-dispatch UI.
+   * back what triggered it; a person retries it from the console's op-dispatch
+   * view.
    *
    * @generated from field: bool run_after_install = 11;
    */
@@ -1210,9 +1215,9 @@ export declare type Operation = Message<"apps.v1.Operation"> & {
 
   /**
    * When true, the operation works on whichever of its sources and sinks the
-   * install maps. A grant naming one left unmapped (an optional source
-   * the operator declined, or a source of a held install still being set up)
-   * is left out of the resolved set, and the operation is kept.
+   * install maps. A grant naming one left unmapped (an optional source the
+   * person installing declined, or a source of a held install still being set
+   * up) is left out of the resolved set, and the operation is kept.
    *
    * When false, the default, such an operation is dropped instead: it is not
    * created, and nothing dispatches it. That is the safe answer for an
@@ -1306,7 +1311,7 @@ export declare const UISchema: GenMessage<UI>;
 export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration"> & {
   /**
    * REQUIRED. Kebab-case. Unique within this manifest's ui.placements.
-   * Stable identifier used by admin UI for keying mapping choices
+   * Stable identifier the console uses for keying mapping choices
    * (field_selected_at_install), by update-diff matching, and by the
    * persisted placements row's UNIQUE (config_id, key).
    *
@@ -1338,7 +1343,7 @@ export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration
   field?: string | undefined;
 
   /**
-   * FIELD-only. When true, the admin chooses the specific field during
+   * FIELD-only. When true, the person installing chooses the specific field during
    * the mapping step (keyed by placement.key).
    *
    * @generated from field: bool field_selected_at_install = 5;
@@ -1396,7 +1401,7 @@ export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration
    * given, so a feature's switch (Feature.setting), the setting that names the
    * external account, credentials and mappings are never among them. Changing
    * or reading one needs apps:write, which the placement declares in grants
-   * and the operator holds at the install's level, as in the setup.
+   * and the user holds at the install's level, as in the setup.
    *
    * @generated from field: repeated string settings = 12;
    */
@@ -1408,8 +1413,8 @@ export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration
    * the project. Each is one a console user can hold, and none is a wildcard:
    * installing the app is agreeing to the list, and a wildcard would grow
    * after that. The console hands the page a short-lived token that acts as
-   * the operator looking at it, at the install's level, carrying the overlap
-   * of these grants with what that operator holds and never more. An operator
+   * the user looking at it, at the install's level, carrying the overlap
+   * of these grants with what that user holds and never more. A user
    * standing beneath the install is given the reads only. Refused on every
    * other target: a record-bound placement is handed its record, not a
    * credential.
@@ -1435,7 +1440,7 @@ export enum PlacementDeclaration_Target {
   UNSPECIFIED = 0,
 
   /**
-   * top-level admin page
+   * top-level console page
    *
    * @generated from enum value: TARGET_FULL_PAGE = 1;
    */

package/dist/app/contract/proto/apps/v1/discovery_pb.d.ts

@@ -28,7 +28,7 @@ export declare type DiscoveryRequest = Message<"apps.v1.DiscoveryRequest"> & {
 
   /**
    * The install's current settings, when it has any. A discovery run again
-   * keeps what the operator already confirmed as its suggestion, rather than
+   * keeps what the user already confirmed as its suggestion, rather than
    * proposing something new each time.
    *
    * @generated from field: google.protobuf.Struct current_settings = 2;
@@ -61,7 +61,7 @@ export declare type DiscoveryResult = Message<"apps.v1.DiscoveryResult"> & {
   complete: boolean;
 
   /**
-   * The account the app is connected to, as the operator knows it.
+   * The account the app is connected to, as the user knows it.
    *
    * @generated from field: apps.v1.DiscoveredAccount account = 3;
    */
@@ -84,7 +84,7 @@ export declare type DiscoveryResult = Message<"apps.v1.DiscoveryResult"> & {
 
   /**
    * Values for the app's own settings (its manifest's settings_schema),
-   * suggested from what was found. The operator confirms each; nothing here is
+   * suggested from what was found. The user confirms each; nothing here is
    * applied on its own.
    *
    * @generated from field: google.protobuf.Struct suggested_settings = 6;
@@ -92,7 +92,7 @@ export declare type DiscoveryResult = Message<"apps.v1.DiscoveryResult"> & {
   suggestedSettings?: JsonObject | undefined;
 
   /**
-   * What the operator should know, most severe first.
+   * What the user should know, most severe first.
    *
    * @generated from field: repeated apps.v1.DiscoveryNotice notices = 7;
    */
@@ -125,7 +125,7 @@ export declare type DiscoveredAccount = Message<"apps.v1.DiscoveredAccount"> & {
   name: string;
 
   /**
-   * Where the account lives, for the operator to recognise it: a store's
+   * Where the account lives, for the user to recognise it: a store's
    * domain, a workspace's address.
    *
    * @generated from field: string url = 2;
@@ -157,14 +157,14 @@ export declare type DiscoveredSource = Message<"apps.v1.DiscoveredSource"> & {
 
   /**
    * The fields a record can be keyed by, the app's recommendation first. The
-   * setup offers the first unless the operator chooses another.
+   * setup offers the first unless the user chooses another.
    *
    * @generated from field: repeated apps.v1.NaturalKeyCandidate natural_keys = 3;
    */
   naturalKeys: NaturalKeyCandidate[];
 
   /**
-   * How the fields below are grouped for the operator, in order.
+   * How the fields below are grouped for the user, in order.
    *
    * @generated from field: repeated apps.v1.DiscoveredFieldGroup field_groups = 4;
    */
@@ -499,7 +499,7 @@ export declare type DiscoveryNotice = Message<"apps.v1.DiscoveryNotice"> & {
   subject: string;
 
   /**
-   * What the operator can do about it, when there is something.
+   * What the user can do about it, when there is something.
    *
    * @generated from field: optional apps.v1.NoticeRemedy remedy = 6;
    */
@@ -597,7 +597,7 @@ export enum AvailabilityState {
   BLOCKED = 2,
 
   /**
-   * The app could not tell. The reason says why, and the operator decides.
+   * The app could not tell. The reason says why, and the user decides.
    *
    * @generated from enum value: AVAILABILITY_STATE_UNDETERMINED = 3;
    */
@@ -664,7 +664,7 @@ export enum RemedyAction {
   RERUN_DISCOVERY = 2,
 
   /**
-   * Nothing the operator can do here; the app's support can.
+   * Nothing the user can do here; the app's support can.
    *
    * @generated from enum value: REMEDY_ACTION_CONTACT_SUPPORT = 3;
    */

package/dist/auth/auth.d.ts

@@ -17,7 +17,7 @@
  */
 import { type FoirEnv } from '../graphql/foir-request';
 import { type AuthOpName, type AuthOpOptions } from './ops';
-import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyProfile, type MyProfileChange, type MySession, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext, type WaitlistJoinResult } from './operations';
+import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyProfile, type MyProfileChange, type MySession, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext } from './operations';
 import type { TypedDocumentNode } from '@graphql-typed-document-node/core';
 /** An access token + its rotating refresh token. */
 export interface FoirAuthTokens {
@@ -125,8 +125,14 @@ export declare function getDefaultAuthProvider(env: FoirEnv): Promise<DefaultAut
  * so a self-hosted frontend can render the right signup surface proactively.
  */
 export declare function signupContext(env: FoirEnv): Promise<SignupContext>;
-/** Join the project's signup waitlist. The project must be in waitlist mode. */
-export declare function joinWaitlist(env: FoirEnv, email: string): Promise<WaitlistJoinResult>;
+/**
+ * Join the project's sign-up waitlist. The project must be in waitlist mode.
+ * Resolves `true` for every address: the server answers identically whether
+ * the address was queued, was already let in, or already has an account, on
+ * purpose, so this endpoint cannot be used to test what an address holds. What
+ * differs is only the email the address is sent.
+ */
+export declare function joinWaitlist(env: FoirEnv, email: string): Promise<boolean>;
 /**
  * Send a password-reset email. Resolves `true` whether or not the address has
  * an account: the server answers identically either way, on purpose, so this
@@ -148,8 +154,6 @@ export declare function resetPassword(env: FoirEnv, vars: {
     token: string;
     newPassword: string;
 }): Promise<AuthResult>;
-/** Redeem an emailed verification token. */
-export declare function verifyEmail(env: FoirEnv, token: string): Promise<boolean>;
 /**
  * Change the calling user's password. Requires the current password as well
  * as the bearer, so a stolen token alone cannot take the account over.
@@ -164,10 +168,12 @@ export declare function updatePassword(env: FoirEnv, vars: {
  */
 export declare function currentUser(env: FoirEnv, options?: AuthOpOptions): Promise<CurrentUser | null>;
 /**
- * The stored upstream provider token for the calling user, renewed by the
- * server when it is due: near its stated expiry, or with no expiry stated.
- * `null` when there is no user token on the request; `linked: false` when the
- * user has none stored for that provider.
+ * The token of the provider the calling user signed in through, kept for the
+ * sign-in the request belongs to and renewed by the server when it is due:
+ * near its stated expiry, or with no expiry stated. `null` when there is no
+ * user token on the request; `linked: false` with `reauthenticate: true` when
+ * nothing is kept for this sign-in (it did not pass through the provider, or
+ * its token was ended), and the user signs in through the provider again.
  *
  * Pass `forceRefresh` after the provider refused the token it was last given:
  * the server renews it then, at most once a minute for one user and provider.
@@ -178,8 +184,9 @@ export declare function myProviderToken(env: FoirEnv, providerKey: string, optio
     forceRefresh?: boolean;
 }): Promise<ProviderToken | null>;
 /**
- * End the session server-side, revoking stored provider tokens. This does NOT
- * clear local session state — {@link signOut} is the pairing that does both.
+ * End the sign-in's provider tokens server-side: this device's, and no other
+ * device's. This does NOT clear local session state — {@link signOut} is the
+ * pairing that does both.
  */
 export declare function logout(env: FoirEnv, options?: AuthOpOptions): Promise<boolean>;
 /**
@@ -328,7 +335,7 @@ export declare function myOrganizations(env: FoirEnv, vars?: {
  * membership together.
  *
  * `parentId` FOUNDS A CHILD, which is what lets the people you serve create their own
- * sub-tenants with no administrator in the loop — a reseller adding a client, a
+ * sub-tenants with no manager in the loop — a reseller adding a client, a
  * franchise adding a branch. It is resolved against the caller's own
  * MEMBERSHIPS, not merely against the project: on this lane "an organization
  * that exists" is not the question, "one you operate" is, and anything else is

package/dist/auth/hosted.d.ts

@@ -21,6 +21,11 @@ export interface HostedLoginConfig {
     sessionPath?: string;
     /** RP-initiated logout path on the front door. Default `/session/end-session`. */
     endSessionPath?: string;
+    /**
+     * The app the bearer is for, when it is not the app the login domain fronts.
+     * Default: the domain's own app.
+     */
+    clientId?: string;
 }
 /**
  * Build the redirect URL to the hosted front door, forwarding a best-effort