@foir/sdk 0.23.0 → 0.24.0

package/dist/auth/index.d.ts

@@ -10,7 +10,7 @@
  * the caller's own manifest advertises, through the same op transport
  * `@foir/sdk/data` uses, so `graphql` is not on this module's path at all.
  */
-export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, verifyEmail, currentUser, myProviderToken, logout, deleteMyAccount, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, makeRecoveryCodes, myOrganizations, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
+export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, currentUser, myProviderToken, logout, deleteMyAccount, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, makeRecoveryCodes, myOrganizations, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
 export type { FoirAuthTokens, FoirUser, SessionAdapter, RequireAuthOptions, } from './auth';
 export { userAccess, getSessionAccess, hasRole, hasScope, requireRole, requireScope, FoirAccessDeniedError, } from './access';
 export type { FoirAccess, FoirAccessDenial } from './access';
@@ -21,4 +21,4 @@ export { hostedLoginUrl, hostedLogoutUrl, fetchHostedSession, hostedSignInNotice
 export type { HostedLoginConfig, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
 export { createFoirSessionClient } from './session-client';
 export type { FoirSessionClient, FoirSessionConfig, FoirSessionUser, } from './session-client';
-export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, WaitlistJoinResult, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';
+export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';

package/dist/auth/operations.d.ts

@@ -76,13 +76,6 @@ export type SignupMode = 'PUBLIC' | 'RESTRICTED' | 'WAITLIST' | 'CLOSED';
 export interface SignupContext {
     signupMode: SignupMode;
 }
-/** The queued (or existing pending) entry a waitlist join returns. */
-export interface WaitlistJoinResult {
-    id: string;
-    email: string;
-    /** Waitlist lifecycle status; PENDING on a fresh join. */
-    status: string;
-}
 /** One provider as it appears inside {@link AuthConfig}. */
 export interface AuthConfigProvider {
     key: string;
@@ -126,13 +119,15 @@ export interface CurrentUser {
 /** What a provider token read did about the token's freshness. */
 export type ProviderTokenRefresh = 'NOT_ATTEMPTED' | 'REFRESHED' | 'FAILED' | 'HELD_BACK';
 /**
- * A stored upstream provider token for the calling user. `myProviderToken`
- * answers `null` when there is no user token on the request, and
- * `linked: false` when the user has none stored for that provider.
+ * The token of the provider the calling user signed in through. It belongs to
+ * the sign-in that obtained it: a sign-in on another device keeps its own, and
+ * signing out ends it. `myProviderToken` answers `null` when there is no user
+ * token on the request, and `linked: false` with `reauthenticate: true` when
+ * nothing is kept for this sign-in.
  */
 export interface ProviderToken {
     providerKey: string;
-    /** False when the user has no token for the provider; every token field is then null. */
+    /** False when nothing is kept for the sign-in the request belongs to; every token field is then null. */
     linked: boolean;
     accessToken: string | null;
     refreshToken: string | null;
@@ -148,7 +143,11 @@ export interface ProviderToken {
     refresh: ProviderTokenRefresh | null;
     /** Where a failed refresh failed, such as `"refresh grant"`. */
     refreshFailure: string | null;
-    /** Only the user signing in with the provider again mends the connection. */
+    /**
+     * Only the user signing in with the provider again mends the connection:
+     * nothing is kept for this sign-in, or the provider will not renew it. Show
+     * them the way to sign in through the provider, not an empty page.
+     */
     reauthenticate: boolean;
 }
 /** What a self-serve account deletion removed. */

package/dist/auth/ops.d.ts

@@ -55,7 +55,6 @@ export declare const AUTH_OPS: {
     readonly requestPasswordReset: "requestPasswordReset";
     readonly resetPassword: "resetPassword";
     readonly updatePassword: "updatePassword";
-    readonly verifyEmail: "verifyEmail";
     readonly deleteMyAccount: "deleteMyAccount";
     readonly updateMyProfile: "updateMyProfile";
     readonly myAuthorizedApps: "myAuthorizedApps";

package/dist/auth/session-client.d.ts

@@ -37,6 +37,11 @@ export interface FoirSessionConfig {
     sessionPath?: string;
     /** Logout path. Default `/session/logout`. */
     logoutPath?: string;
+    /**
+     * The app the bearer is for, when it is not the app the login domain fronts.
+     * Default: the domain's own app.
+     */
+    clientId?: string;
     /** Seconds before expiry to re-exchange. Default 60. */
     refreshSkewSeconds?: number;
     /**

package/dist/auth-session.js

@@ -5,8 +5,9 @@ var DEFAULT_REFRESH_SKEW_SECONDS = 60;
 var MIN_REFRESH_DELAY_MS = 5e3;
 var CSRF_HEADER = { "X-Foir-Session": "1" };
 function createFoirSessionClient(config) {
-  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH}`;
-  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}`;
+  const forApp = config.clientId ? `?client_id=${encodeURIComponent(config.clientId)}` : "";
+  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH}${forApp}`;
+  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}${forApp}`;
   const skewMs = (config.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS) * 1e3;
   let cached = null;
   let inflight = null;

package/dist/auth.js

@@ -1093,7 +1093,6 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
@@ -1266,9 +1265,6 @@ async function requestPasswordReset(env, email, options) {
 async function resetPassword(env, vars) {
   return authOp(env, AUTH_OPS.resetPassword, vars);
 }
-async function verifyEmail(env, token) {
-  return authOp(env, AUTH_OPS.verifyEmail, { token });
-}
 async function updatePassword(env, vars, options) {
   return authOp(env, AUTH_OPS.updatePassword, vars, options);
 }
@@ -1792,7 +1788,7 @@ async function fetchHostedSession(request, config) {
   if (!match) return { outcome: "signed-out", reason: "no-cookie" };
   let res;
   try {
-    res = await fetch(`${config.loginOrigin}${sessionPath}`, {
+    res = await fetch(`${config.loginOrigin}${sessionPath}${forApp(config.clientId)}`, {
       headers: {
         Cookie: `${cookieName}=${match[1]}`,
         "X-Foir-Session": "1"
@@ -1867,6 +1863,9 @@ var REFUSAL_MESSAGES = {
 function refusalMessage(code) {
   return REFUSAL_MESSAGES[code] ?? "The sign-in couldn\u2019t be finished. Try again.";
 }
+function forApp(clientId) {
+  return clientId ? `?client_id=${encodeURIComponent(clientId)}` : "";
+}
 
 // src/auth/session-client.ts
 var DEFAULT_SESSION_PATH2 = "/session/token";
@@ -1875,8 +1874,9 @@ var DEFAULT_REFRESH_SKEW_SECONDS = 60;
 var MIN_REFRESH_DELAY_MS = 5e3;
 var CSRF_HEADER = { "X-Foir-Session": "1" };
 function createFoirSessionClient(config) {
-  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH2}`;
-  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}`;
+  const forApp2 = config.clientId ? `?client_id=${encodeURIComponent(config.clientId)}` : "";
+  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH2}${forApp2}`;
+  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}${forApp2}`;
   const skewMs = (config.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS) * 1e3;
   let cached = null;
   let inflight = null;
@@ -2074,6 +2074,5 @@ export {
   signupContext,
   updateMyProfile,
   updatePassword,
-  userAccess,
-  verifyEmail
+  userAccess
 };

package/dist/components/EditorProvider.d.ts

@@ -11,7 +11,7 @@ export interface EditorProviderProps {
     children: ReactNode;
     /**
      * Parent window origin for postMessage validation.
-     * Must be an explicit origin (e.g., 'https://admin.example.com').
+     * Must be an explicit origin (e.g., 'https://console.example.com').
      * Falls back to VITE_PARENT_ORIGIN or NEXT_PUBLIC_PARENT_ORIGIN env var.
      */
     parentOrigin?: string;

package/dist/next.js

@@ -973,7 +973,6 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",

package/dist/push.js

@@ -1093,7 +1093,6 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",

package/dist/react.js

@@ -967,7 +967,6 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
@@ -1431,8 +1430,9 @@ var DEFAULT_REFRESH_SKEW_SECONDS = 60;
 var MIN_REFRESH_DELAY_MS = 5e3;
 var CSRF_HEADER = { "X-Foir-Session": "1" };
 function createFoirSessionClient(config) {
-  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH}`;
-  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}`;
+  const forApp = config.clientId ? `?client_id=${encodeURIComponent(config.clientId)}` : "";
+  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH}${forApp}`;
+  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}${forApp}`;
   const skewMs = (config.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS) * 1e3;
   let cached = null;
   let inflight = null;

package/dist/server/events-client.d.ts

@@ -28,8 +28,8 @@
  *
  * The reason is a predicate asymmetry rather than a policy preference.
  * `events.view` is plain tenant+project containment; `record.view` carries
- * owner, admin_owner, access_mode, grantee, comp_parent, read_borrow and
- * slice_parent terms on top of it. A containment-only read over the log
+ * ownership, access-mode, grantee, composition, read-borrow and slice terms
+ * on top of it. A containment-only read over the log
  * therefore describes rows whose underlying records the same caller could not
  * read — and every row carries `actor`, naming which OTHER user acted. In a
  * project with owner confinement that is a per-record activity feed of other

package/dist/server.js

@@ -1489,7 +1489,7 @@ function parseResumeFrom(message) {
   const n = Number(m[1]);
   return Number.isSafeInteger(n) ? n : void 0;
 }
-function assertOperatorKey(apiKey) {
+function assertAdminKey(apiKey) {
   const key = apiKey?.trim() ?? "";
   if (!key) {
     throw new FoirRequestError(
@@ -1576,7 +1576,7 @@ async function readErrorMessage(res) {
   }
 }
 function createEventsClient(config) {
-  const apiKey = assertOperatorKey(config.apiKey);
+  const apiKey = assertAdminKey(config.apiKey);
   assertNoBearer(config.headers);
   const url = foirApiEndpoint(config.apiUrl, FOIR_EVENTS_PATH);
   async function list(params = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {
@@ -177,8 +177,8 @@
     "ws": "^8.18.0",
     "y-websocket": "^3.0.0",
     "yjs": "^13.6.30",
-    "@foir/access-vocab": "0.0.0",
-    "@foir/proto-ts": "0.109.0"
+    "@foir/proto-ts": "0.109.0",
+    "@foir/access-vocab": "0.0.0"
   },
   "engines": {
     "node": ">=18.0.0"