@foir/sdk 0.23.0 → 0.25.0

package/dist/app/client.d.ts

@@ -222,20 +222,42 @@ export interface AppOrganizationProvision {
         data: Record<string, unknown>;
     };
     /**
-     * The user who becomes its first member. They are given the role the
-     * project names for an organisation's founder, in its settings: the
-     * operation chooses who, and the project decides what they hold.
+     * Who becomes its first member: a user the project has, by `userId`, or
+     * somebody the provision makes by `email` in the pool that serves the new
+     * organisation, which is its own with `ownPool`. That is how an organisation
+     * that signs its own people in gets its first person; making one also needs
+     * `users:create`. They are given the role the project names for an
+     * organisation's founder, in its settings: the operation chooses who, and
+     * the project decides what they hold.
      */
     firstMember?: {
         userId: string;
+    } | {
+        email: string;
+        firstName?: string;
+        lastName?: string;
     };
     /**
      * The organisation signs its own people in, to a pool of its own, apart
      * from its parent's and the project's. Its descendants share that pool
-     * unless one of them starts another. Chosen now, when it is made.
+     * unless one of them starts another. One that exists already starts one
+     * with `organizations.startPool`.
      */
     ownPool?: boolean;
 }
+/**
+ * The pool an organisation's people sign in to, and where it comes from: its
+ * own, the nearest organisation above it that started one, or the project's.
+ */
+export interface AppOrganizationPool {
+    organizationId: string;
+    poolId: string;
+    source: 'OWN' | 'ANCESTOR' | 'PROJECT';
+    /** The organisation whose own pool it is. Null for the project's. */
+    sourceOrganizationId: string | null;
+    /** How many people the pool holds, when it is the organisation's own. Null for any other. */
+    people: number | null;
+}
 /**
  * Who a consent change is for: a user whose id the app holds, or an
  * address.
@@ -556,6 +578,32 @@ export interface AppClient {
                 name: string;
             }[];
         }>;
+        /**
+         * Which pool the people of the organisation this run acts in sign in to.
+         * Needs `organizations:read`. Like every call here it takes no
+         * organisation: the run acts in the one whoever triggered it stands in.
+         */
+        pool(): Promise<AppOrganizationPool>;
+        /**
+         * Start the own pool of the organisation this run acts in, which it and
+         * everything beneath it sign their people in to. Needs
+         * `organizations:write`. Refused while
+         * anybody of the pool it signs in to now holds a membership in it or
+         * beneath it, or an invitation there is open to that pool, and the
+         * refusal says how many: nobody is moved between pools, so those
+         * memberships are removed first and those people sign up again in the
+         * new pool. Its apps, and those beneath it, then sign their people in
+         * there, and anybody signed in through them is signed out. Safe to run
+         * again: it answers the pool it has.
+         */
+        startPool(): Promise<AppOrganizationPool>;
+        /**
+         * Drop the own pool of the organisation this run acts in, so it signs its
+         * people in to the pool above it. Needs `organizations:write`. Refused
+         * while the pool holds anybody or an invitation is open to it: dropping a
+         * pool deletes nobody.
+         */
+        dropPool(): Promise<AppOrganizationPool>;
     };
     notifications: {
         /** Tell a user something. Needs `notifications:write.named`. */

package/dist/app/contract/proto/apps/v1/apps_pb.d.ts

@@ -33,7 +33,7 @@ export declare type AppConfig = Message<"apps.v1.AppConfig"> & {
   version: string;
 
   /**
-   * OPTIONAL. Display metadata for admin UI.
+   * OPTIONAL. Display metadata for the console.
    *
    * @generated from field: apps.v1.Metadata metadata = 3;
    */
@@ -110,16 +110,16 @@ export declare type AppConfig = Message<"apps.v1.AppConfig"> & {
   inbound?: Inbound | undefined;
 
   /**
-   * What the operator turns on and off as a whole, each with the storage it
-   * keeps. See Feature.
+   * What the person setting it up turns on and off as a whole, each with the
+   * storage it keeps. See Feature.
    *
    * @generated from field: repeated apps.v1.Feature features = 13;
    */
   features: Feature[];
 
   /**
-   * OPTIONAL. The app's own system has customers who sign in to it. See
-   * CustomerSignIn.
+   * OPTIONAL. The app's own system has users who sign in to it. See
+   * UserSignIn.
    *
    * @generated from field: apps.v1.UserSignIn user_sign_in = 14;
    */
@@ -133,29 +133,29 @@ export declare type AppConfig = Message<"apps.v1.AppConfig"> & {
 export declare const AppConfigSchema: GenMessage<AppConfig>;
 
 /**
- * The app's own system has customers, and the app names each by the subject of
- * their sign-in with that system: a store's customer number, which is also who
- * they are when they sign in to the project through the store's sign-in.
+ * The app's own system has users, and the app names each by the subject of
+ * their sign-in with that system: the id the store knows them by, which is also
+ * who they are when they sign in to the project through the store's sign-in.
  *
- * Declaring it lets an install pair ONE of the project's customer sign-ins with
- * the app (ConfirmInstallAppRequest.customer_sign_in): the operator says which
- * sign-in the app's customers come through, and the platform resolves every
- * identity the app names through that sign-in and no other. The pairing is the
- * operator's, never inferred: the install knows the external account it
- * connects, not which of the project's sign-ins its customers use, and a wrong
+ * Declaring it lets an install pair ONE of the project's sign-ins with
+ * the app (ConfirmInstallAppRequest.user_sign_in): the person installing says
+ * which sign-in the app's users come through, and the platform resolves every
+ * identity the app names through that sign-in and no other. The pairing is that
+ * person's choice, never inferred: the install knows the external account it
+ * connects, not which of the project's sign-ins its users use, and a wrong
  * pairing would attach one person's data to another.
  *
  * The pairing is optional. What needs it says so, and cannot be on without it:
- * a source that names its customers by identity (SourceType.identity), a
- * feature that finds customers through it (Feature.customer_sign_in), and an
- * operation that asks who holds an identity (customers:read:identity).
+ * a source that names its users by identity (SourceType.identity), a
+ * feature that finds users through it (Feature.user_sign_in), and an
+ * operation that asks who holds an identity (identities:read).
  *
  * @generated from message apps.v1.UserSignIn
  */
 export declare type UserSignIn = Message<"apps.v1.UserSignIn"> & {
   /**
-   * What the setup tells the operator they are choosing, in a sentence: which
-   * customers these are and what identifies them.
+   * What the setup tells the person installing they are choosing, in a
+   * sentence: which users these are and what identifies them.
    *
    * @generated from field: string description = 1;
    */
@@ -169,15 +169,15 @@ export declare type UserSignIn = Message<"apps.v1.UserSignIn"> & {
 export declare const UserSignInSchema: GenMessage<UserSignIn>;
 
 /**
- * A feature of the app: something the operator turns on or off as a whole at
- * setup, such as a store's preorders or its back-in-stock alerts.
+ * A feature of the app: something the person installing turns on or off as a
+ * whole at setup, such as a store's preorders or its back-in-stock alerts.
  *
  * A feature KEEPS its storage. The sources it names are the storage it writes,
  * and they exist only while it is on: turning it on is what creates them, which
- * the operator approves at setup, and while it is off they are declined, so no
- * model is made and the operations that need them are not registered. Each of
- * them is optional, since switching the feature off drops it, and belongs to
- * no other feature.
+ * the person installing approves at setup, and while it is off they are
+ * declined, so no model is made and the operations that need them are not
+ * registered. Each of them is optional, since switching the feature off drops
+ * it, and belongs to no other feature.
  *
  * A feature may also name a setting, when the app itself has to know whether
  * it is on: for example because it changes the access the app asks its vendor
@@ -225,8 +225,8 @@ export declare type Feature = Message<"apps.v1.Feature"> & {
   sources: string[];
 
   /**
-   * The feature finds customers through the install's customer sign-in
-   * (AppConfig.customer_sign_in), which the manifest must declare. It cannot
+   * The feature finds users through the install's paired sign-in
+   * (AppConfig.user_sign_in), which the manifest must declare. It cannot
    * be on at an install that pairs none: the setup asks for the sign-in at the
    * switch, and the platform refuses the switch without one.
    *
@@ -244,7 +244,7 @@ export declare type Feature = Message<"apps.v1.Feature"> & {
 
   /**
    * The notification category the feature keeps consent in, when it reads or
-   * writes what a customer chose. See FeatureConsentCategory.
+   * writes what a user chose. See FeatureConsentCategory.
    *
    * @generated from field: apps.v1.FeatureConsentCategory consent_category = 8;
    */
@@ -261,12 +261,12 @@ export declare const FeatureSchema: GenMessage<Feature>;
  * The notification category a feature sends under.
  *
  * A project that declares notification categories takes every notification
- * under one of them, so that what a customer chose about a category is
- * honoured. An app that sends has to be given one the project has, and nobody
- * should have to type its key to do that. So the feature says which of the
- * app's settings holds the key, and proposes the category it would send under.
- * The setup offers the project's own categories and the proposed one, makes the
- * proposed one where the operator chooses it, and writes the chosen key to the
+ * under one of them, so that what a user chose about a category is honoured. An
+ * app that sends has to be given one the project has, and nobody should have to
+ * type its key to do that. So the feature says which of the app's settings
+ * holds the key, and proposes the category it would send under. The setup
+ * offers the project's own categories and the proposed one, makes the proposed
+ * one where the person installing chooses it, and writes the chosen key to the
  * setting. The app reads the setting and names that key on every send.
  *
  * The platform holds the setting to that: while the feature is on at a running
@@ -294,22 +294,23 @@ export declare type FeatureNotificationCategory = Message<"apps.v1.FeatureNotifi
   key: string;
 
   /**
-   * REQUIRED. What the category is called to an operator and to a customer.
+   * REQUIRED. What the category is called, in the console and to the project's
+   * users.
    *
    * @generated from field: string name = 3;
    */
   name: string;
 
   /**
-   * What a customer is choosing about, in a sentence.
+   * What a user is choosing about, in a sentence.
    *
    * @generated from field: string description = 4;
    */
   description: string;
 
   /**
-   * A customer has to opt in before anything is sent to them under the
-   * proposed category. Left unset it is sent until a customer opts out.
+   * A user has to opt in before anything is sent to them under the
+   * proposed category. Left unset it is sent until a user opts out.
    *
    * @generated from field: bool opt_in = 5;
    */
@@ -325,23 +326,23 @@ export declare const FeatureNotificationCategorySchema: GenMessage<FeatureNotifi
 /**
  * The notification category a feature keeps consent in.
  *
- * A feature that carries what a customer chose about a category to or from
+ * A feature that carries what a user chose about a category to or from
  * another system sends nothing itself. It reads and writes consent on one
- * channel, and consent is what a category records where a customer opts in on
+ * channel, and consent is what a category records where a user opts in on
  * that channel: nothing is sent there until they say yes. So the feature has
- * to be given a category the project has and a customer opts in to on its
+ * to be given a category the project has and a user opts in to on its
  * channel, and nobody should have to type its key to do that. The feature says
  * which of the app's settings holds the key and which channel's consent it
  * keeps, and proposes the category it would keep it in. The setup offers the
- * project's own categories a customer opts in to on that channel and the
- * proposed one, makes the proposed one where the operator chooses it, and
+ * project's own categories a user opts in to on that channel and the
+ * proposed one, makes the proposed one where the person installing chooses it, and
  * writes the chosen key to the setting. The app reads the setting.
  *
  * The platform holds the setting to that: while the feature is on at a running
- * install it names a category the install's level is served and a customer
+ * install it names a category the install's level is served and a user
  * opts in to on the channel, or, at a level served no category, the proposed
  * key, which is made a category of that level together with its first, one a
- * customer opts in to on every channel.
+ * user opts in to on every channel.
  *
  * @generated from message apps.v1.FeatureConsentCategory
  */
@@ -356,7 +357,7 @@ export declare type FeatureConsentCategory = Message<"apps.v1.FeatureConsentCate
   /**
    * REQUIRED. The key of the category the app proposes: what the category is
    * called in the project's API. Letters, digits and underscores, starting
-   * with a letter. The proposed category is always one a customer opts in to,
+   * with a letter. The proposed category is always one a user opts in to,
    * on every channel.
    *
    * @generated from field: string key = 2;
@@ -364,14 +365,15 @@ export declare type FeatureConsentCategory = Message<"apps.v1.FeatureConsentCate
   key: string;
 
   /**
-   * REQUIRED. What the category is called to an operator and to a customer.
+   * REQUIRED. What the category is called, in the console and to the project's
+   * users.
    *
    * @generated from field: string name = 3;
    */
   name: string;
 
   /**
-   * What a customer is agreeing to, in a sentence.
+   * What a user is agreeing to, in a sentence.
    *
    * @generated from field: string description = 4;
    */
@@ -462,7 +464,7 @@ export declare type Credentials = Message<"apps.v1.Credentials"> & {
   strategy: Credentials_Strategy;
 
   /**
-   * Shape of the admin form for strategies that take structured values.
+   * Shape of the console's form for strategies that take structured values.
    * JSON Schema.
    *
    * @generated from field: optional google.protobuf.Struct schema = 2;
@@ -477,11 +479,12 @@ export declare type Credentials = Message<"apps.v1.Credentials"> & {
   oauth?: OAuthConfig | undefined;
 
   /**
-   * What the operator is told before they connect their account, in the app's
-   * own words: anything connecting changes that they would not otherwise
-   * know. The setup shows it beside the step that connects, and an install the
-   * vendor started shows it before the install is confirmed, because that
-   * install goes on to connect by itself. Empty when there is nothing to say.
+   * What the person installing is told before they connect their account, in
+   * the app's own words: anything connecting changes that they would not
+   * otherwise know. The setup shows it beside the step that connects, and an
+   * install the vendor started shows it before the install is confirmed,
+   * because that install goes on to connect by itself. Empty when there is
+   * nothing to say.
    *
    * @generated from field: string connect_notice = 4;
    */
@@ -643,7 +646,7 @@ export declare type AccountWebhook = Message<"apps.v1.AccountWebhook"> & {
   /**
    * Which setting holds the account identifier, as a key of the app's own
    * settings. For a store integration that is the store's domain, supplied by
-   * the operator at install.
+   * the person installing it.
    *
    * ONE WORD. This key is read from stored manifest JSON by SQL, and protojson
    * accepts both snake_case and camelCase on input, so a two-word name would
@@ -671,9 +674,9 @@ export declare type AccountWebhook = Message<"apps.v1.AccountWebhook"> & {
 export declare const AccountWebhookSchema: GenMessage<AccountWebhook>;
 
 /**
- * A source type the app can deliver inbound. At install, admin maps this
- * type onto a project model key and maps each suggested field onto a model
- * field key.
+ * A source type the app can deliver inbound. At install, the person installing
+ * maps this type onto a project model key and maps each suggested field onto a
+ * model field key.
  *
  * @generated from message apps.v1.SourceType
  */
@@ -699,10 +702,10 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
    * $placeholders reference it are DROPPED rather than failing to resolve.
    * Default false, so every existing manifest keeps today's behaviour.
    *
-   * This is what makes "sync customers, or don't" expressible. Without it an
-   * app either forces the operator to map a model they do not want — and the
-   * operation carries records:write:<model> regardless — or cannot offer the
-   * source at all.
+   * This is what makes "sync this source, or don't" expressible. Without it an
+   * app either forces the person installing to map a model they do not want —
+   * and the operation carries records:write:<model> regardless — or cannot
+   * offer the source at all.
    *
    * @generated from field: bool optional = 4;
    */
@@ -713,14 +716,14 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
    * against it, but expects NO inbound sync: the app owns the write path and
    * there is no external system on the other end.
    *
-   * Still mapped — the operator chooses which model it targets, because
+   * Still mapped — the person installing chooses which model it targets, because
    * capability resolution needs that answer. What it is not is SYNCED, which
    * is the whole distinction from `optional` above; the two compose freely.
    *
    * AppInstallPreview must present it as storage the app needs rather than as
    * something the external system will send. Presenting it as a sync mapping
    * is not a cosmetic slip: it is a false statement in the one screen whose
-   * job is to tell the operator what the app will do.
+   * job is to tell the person installing what the app will do.
    *
    * @generated from field: bool provision_only = 5;
    */
@@ -741,15 +744,15 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
    * Who each row of this source's model belongs to. Unset says nothing, and
    * the source maps onto a model owned at any level, as before.
    *
-   * Set, it is a requirement the install holds the operator to: the source may
-   * only be mapped onto a model owned at this level, and the guided setup
-   * creates the model that way. It exists for storage whose meaning depends on
-   * who can read it. A wishlist the app writes for each customer is private to
-   * that customer only if its model is customer-owned; mapped onto a
+   * Set, it is a requirement the install holds the person installing to: the
+   * source may only be mapped onto a model owned at this level, and the guided
+   * setup creates the model that way. It exists for storage whose meaning
+   * depends on who can read it. A wishlist the app writes for each user is
+   * private to that user only if its model is user-owned; mapped onto a
    * project-owned model, every row is readable by the project's public key.
    *
-   * CUSTOMER requires provision_only or `identity`: a sync writes what the
-   * external system sends, and only `identity` gives each row a customer to
+   * USER requires provision_only or `identity`: a sync writes what the
+   * external system sends, and only `identity` gives each row a user to
    * own it.
    *
    * @generated from field: apps.v1.StorageOwner owner = 7;
@@ -757,8 +760,8 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
   owner: StorageOwner;
 
   /**
-   * The app's word that this storage starts on in the guided setup. The
-   * operator can still decline it, and declining still drops what references
+   * The app's word that this storage starts on in the guided setup. The person
+   * installing can still decline it, and declining still drops what references
    * it: this is a default, not a requirement.
    *
    * Only for a source that is both `optional` and `provision_only`, and a
@@ -794,17 +797,17 @@ export declare type SourceType = Message<"apps.v1.SourceType"> & {
   lookup: string[];
 
   /**
-   * The field that names the customer each row belongs to, as the external
-   * system identifies them: a customer's id there, which is also the subject
+   * The field that names the user each row belongs to, as the external
+   * system identifies them: their id there, which is also the subject
    * of their sign-in with it. One of this source's `fields`, a required scalar,
-   * and only on a customer-owned source (`owner` CUSTOMER).
-   *
-   * It is what lets a sync write customer-owned rows. The platform resolves the
-   * value to a Foir customer through the customer sign-in the install pairs
-   * with the app (AppConfig.customer_sign_in, which the manifest must then
-   * declare), at the install's level: the customer who signs in with that
-   * identity, or one made for it. Each customer holds one row of the source,
-   * their profile, so the source has no natural key; the customer is the key.
+   * and only on a user-owned source (`owner` USER).
+   *
+   * It is what lets a sync write user-owned rows. The platform resolves the
+   * value to a Foir user through the sign-in the install pairs
+   * with the app (AppConfig.user_sign_in, which the manifest must then
+   * declare), at the install's level: the user who signs in with that
+   * identity, or one made for it. Each user holds one row of the source,
+   * their profile, so the source has no natural key; the user is the key.
    * Never matched by email.
    *
    * @generated from field: string identity = 10;
@@ -833,7 +836,7 @@ export declare const SourceTypeSchema: GenMessage<SourceType>;
  * for where it stands, as an operation's request template is.
  *
  * A live field is not filterable or sortable: nothing about it is stored. An
- * operator who needs to filter on host fields inside Foir keeps a copy.
+ * project that needs to filter on host fields inside Foir keeps a copy.
  *
  * @generated from message apps.v1.SourceReference
  */
@@ -950,8 +953,9 @@ export declare type ReferenceRequest = Message<"apps.v1.ReferenceRequest"> & {
 export declare const ReferenceRequestSchema: GenMessage<ReferenceRequest>;
 
 /**
- * A sink contract the app needs outbound. At install, admin maps this
- * contract onto a project model and maps each field onto a model field.
+ * A sink contract the app needs outbound. At install, the person installing
+ * maps this contract onto a project model and maps each field onto a model
+ * field.
  *
  * @generated from message apps.v1.SinkContract
  */
@@ -1021,7 +1025,7 @@ export declare type SuggestedField = Message<"apps.v1.SuggestedField"> & {
    * SOURCE_ONLY.
    *
    * READ IT AS A SET OF LEGS, NOT AS A RANK: SOURCE_ONLY is {inbound},
-   * SINK_ONLY is {outbound}, BIDIRECTIONAL is both. The operator's choice must
+   * SINK_ONLY is {outbound}, BIDIRECTIONAL is both. The install's choice must
    * be a SUBSET of what is declared here, so a SINK_ONLY declaration permits
    * only SINK_ONLY — it does not permit SOURCE_ONLY as some lesser option.
    *
@@ -1033,7 +1037,7 @@ export declare type SuggestedField = Message<"apps.v1.SuggestedField"> & {
    * Declared by the app author because they are the only party who knows.
    * Stripe's Price.unit_amount is the canonical case: it is immutable, so
    * writing an edit back is not a slow path, it is a thing that cannot happen.
-   * An operator choosing BIDIRECTIONAL for such a field has to be refused at
+   * Choosing BIDIRECTIONAL for such a field has to be refused at
    * configuration time rather than discovering it when the first edit fails
    * somewhere they are not looking.
    *
@@ -1050,7 +1054,7 @@ export declare type SuggestedField = Message<"apps.v1.SuggestedField"> & {
    * what lets it ask the platform for the count rather than read every row.
    *
    * It says what the app needs of a model the setup creates, and nothing
-   * stricter: filtering needs no index, and an operator mapping onto a model
+   * stricter: filtering needs no index, and a person mapping onto a model
    * of their own may index it or not. An app asking to count by a field that
    * is not indexed is refused by the aggregate, naming the field.
    *
@@ -1202,7 +1206,8 @@ export declare type Operation = Message<"apps.v1.Operation"> & {
    * own token is not a connection. Multiple operations with
    * run_after_install=true are dispatched in manifest declaration order. A
    * failure here emits the app_event `post_install_op_failed` but does NOT roll
-   * back what triggered it; the admin retries via the standard op-dispatch UI.
+   * back what triggered it; a person retries it from the console's op-dispatch
+   * view.
    *
    * @generated from field: bool run_after_install = 11;
    */
@@ -1210,9 +1215,9 @@ export declare type Operation = Message<"apps.v1.Operation"> & {
 
   /**
    * When true, the operation works on whichever of its sources and sinks the
-   * install maps. A grant naming one left unmapped (an optional source
-   * the operator declined, or a source of a held install still being set up)
-   * is left out of the resolved set, and the operation is kept.
+   * install maps. A grant naming one left unmapped (an optional source the
+   * person installing declined, or a source of a held install still being set
+   * up) is left out of the resolved set, and the operation is kept.
    *
    * When false, the default, such an operation is dropped instead: it is not
    * created, and nothing dispatches it. That is the safe answer for an
@@ -1306,7 +1311,7 @@ export declare const UISchema: GenMessage<UI>;
 export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration"> & {
   /**
    * REQUIRED. Kebab-case. Unique within this manifest's ui.placements.
-   * Stable identifier used by admin UI for keying mapping choices
+   * Stable identifier the console uses for keying mapping choices
    * (field_selected_at_install), by update-diff matching, and by the
    * persisted placements row's UNIQUE (config_id, key).
    *
@@ -1338,7 +1343,7 @@ export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration
   field?: string | undefined;
 
   /**
-   * FIELD-only. When true, the admin chooses the specific field during
+   * FIELD-only. When true, the person installing chooses the specific field during
    * the mapping step (keyed by placement.key).
    *
    * @generated from field: bool field_selected_at_install = 5;
@@ -1396,7 +1401,7 @@ export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration
    * given, so a feature's switch (Feature.setting), the setting that names the
    * external account, credentials and mappings are never among them. Changing
    * or reading one needs apps:write, which the placement declares in grants
-   * and the operator holds at the install's level, as in the setup.
+   * and the user holds at the install's level, as in the setup.
    *
    * @generated from field: repeated string settings = 12;
    */
@@ -1408,8 +1413,8 @@ export declare type PlacementDeclaration = Message<"apps.v1.PlacementDeclaration
    * the project. Each is one a console user can hold, and none is a wildcard:
    * installing the app is agreeing to the list, and a wildcard would grow
    * after that. The console hands the page a short-lived token that acts as
-   * the operator looking at it, at the install's level, carrying the overlap
-   * of these grants with what that operator holds and never more. An operator
+   * the user looking at it, at the install's level, carrying the overlap
+   * of these grants with what that user holds and never more. A user
    * standing beneath the install is given the reads only. Refused on every
    * other target: a record-bound placement is handed its record, not a
    * credential.
@@ -1435,7 +1440,7 @@ export enum PlacementDeclaration_Target {
   UNSPECIFIED = 0,
 
   /**
-   * top-level admin page
+   * top-level console page
    *
    * @generated from enum value: TARGET_FULL_PAGE = 1;
    */

package/dist/app/contract/proto/apps/v1/discovery_pb.d.ts

@@ -28,7 +28,7 @@ export declare type DiscoveryRequest = Message<"apps.v1.DiscoveryRequest"> & {
 
   /**
    * The install's current settings, when it has any. A discovery run again
-   * keeps what the operator already confirmed as its suggestion, rather than
+   * keeps what the user already confirmed as its suggestion, rather than
    * proposing something new each time.
    *
    * @generated from field: google.protobuf.Struct current_settings = 2;
@@ -61,7 +61,7 @@ export declare type DiscoveryResult = Message<"apps.v1.DiscoveryResult"> & {
   complete: boolean;
 
   /**
-   * The account the app is connected to, as the operator knows it.
+   * The account the app is connected to, as the user knows it.
    *
    * @generated from field: apps.v1.DiscoveredAccount account = 3;
    */
@@ -84,7 +84,7 @@ export declare type DiscoveryResult = Message<"apps.v1.DiscoveryResult"> & {
 
   /**
    * Values for the app's own settings (its manifest's settings_schema),
-   * suggested from what was found. The operator confirms each; nothing here is
+   * suggested from what was found. The user confirms each; nothing here is
    * applied on its own.
    *
    * @generated from field: google.protobuf.Struct suggested_settings = 6;
@@ -92,7 +92,7 @@ export declare type DiscoveryResult = Message<"apps.v1.DiscoveryResult"> & {
   suggestedSettings?: JsonObject | undefined;
 
   /**
-   * What the operator should know, most severe first.
+   * What the user should know, most severe first.
    *
    * @generated from field: repeated apps.v1.DiscoveryNotice notices = 7;
    */
@@ -125,7 +125,7 @@ export declare type DiscoveredAccount = Message<"apps.v1.DiscoveredAccount"> & {
   name: string;
 
   /**
-   * Where the account lives, for the operator to recognise it: a store's
+   * Where the account lives, for the user to recognise it: a store's
    * domain, a workspace's address.
    *
    * @generated from field: string url = 2;
@@ -157,14 +157,14 @@ export declare type DiscoveredSource = Message<"apps.v1.DiscoveredSource"> & {
 
   /**
    * The fields a record can be keyed by, the app's recommendation first. The
-   * setup offers the first unless the operator chooses another.
+   * setup offers the first unless the user chooses another.
    *
    * @generated from field: repeated apps.v1.NaturalKeyCandidate natural_keys = 3;
    */
   naturalKeys: NaturalKeyCandidate[];
 
   /**
-   * How the fields below are grouped for the operator, in order.
+   * How the fields below are grouped for the user, in order.
    *
    * @generated from field: repeated apps.v1.DiscoveredFieldGroup field_groups = 4;
    */
@@ -499,7 +499,7 @@ export declare type DiscoveryNotice = Message<"apps.v1.DiscoveryNotice"> & {
   subject: string;
 
   /**
-   * What the operator can do about it, when there is something.
+   * What the user can do about it, when there is something.
    *
    * @generated from field: optional apps.v1.NoticeRemedy remedy = 6;
    */
@@ -597,7 +597,7 @@ export enum AvailabilityState {
   BLOCKED = 2,
 
   /**
-   * The app could not tell. The reason says why, and the operator decides.
+   * The app could not tell. The reason says why, and the user decides.
    *
    * @generated from enum value: AVAILABILITY_STATE_UNDETERMINED = 3;
    */
@@ -664,7 +664,7 @@ export enum RemedyAction {
   RERUN_DISCOVERY = 2,
 
   /**
-   * Nothing the operator can do here; the app's support can.
+   * Nothing the user can do here; the app's support can.
    *
    * @generated from enum value: REMEDY_ACTION_CONTACT_SUPPORT = 3;
    */

package/dist/app/index.d.ts

@@ -21,7 +21,7 @@
  * The manifest's own messages are on `@foir/sdk/app/contract`.
  */
 export { createAppClient } from './client';
-export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppUser, AppUserEraseResult, AppUserList, AppUserSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
+export type { AppBinding, AppClient, AppClientConfig, AppConsentChange, AppConsentSubject, AppUser, AppUserEraseResult, AppUserList, AppUserSaveResult, AppFieldMapping, AppInstallConfig, AppNotification, AppOperationStart, AppOrganizationPool, AppOrganizationProvision, AppRecord, AppRecordList, AppStartedOperation, AppStatusReport, AppSyncDirection, AppUpsertResult, AppWhoami, } from './client';
 export { appUserEmailUnavailableOf, appUserUnlinkedOf, appLookupConflictOf, isAppFieldWithheld } from './errors';
 export type { AppUserEmailUnavailableReason, AppLookupConflict } from './errors';
 export { appModelFieldName, appModelTypeName, appSelectorEnumValue } from './naming';