@foir/sdk 0.23.0 → 0.25.0

package/dist/app.js

@@ -352,6 +352,20 @@ function createAppClient(config) {
   const refuse = (message) => {
     throw new FoirRequestError(`[foir] ${message}`);
   };
+  const POOL_FIELDS = "organizationId poolId source sourceOrganizationId people";
+  async function poolOf(name, document) {
+    const answer = await field(name, document, {});
+    if (!answer?.poolId || !answer.organizationId || answer.source !== "OWN" && answer.source !== "ANCESTOR" && answer.source !== "PROJECT") {
+      return refuse(`${name} reported no error and answered no pool`);
+    }
+    return {
+      organizationId: answer.organizationId,
+      poolId: answer.poolId,
+      source: answer.source,
+      sourceOrganizationId: answer.sourceOrganizationId ?? null,
+      people: answer.people ?? null
+    };
+  }
   let surface;
   function served() {
     surface ??= withFoirRetry(async () => {
@@ -825,9 +839,20 @@ function createAppClient(config) {
           if (settings.modelKey.trim() === "") return refuse("an organisation's settings name the model they are a record of");
           input.settings = { modelKey: settings.modelKey.trim(), data: settings.data };
         }
-        if (organization.firstMember !== void 0) {
-          if (organization.firstMember.userId === "") return refuse("a first member names a user");
-          input.firstMember = { userId: organization.firstMember.userId };
+        const first = organization.firstMember;
+        if (first !== void 0) {
+          if ("email" in first) {
+            const email = first.email.trim();
+            if (email === "") return refuse("a first member made by address names the address");
+            input.firstMember = {
+              email,
+              ...first.firstName !== void 0 ? { firstName: first.firstName } : {},
+              ...first.lastName !== void 0 ? { lastName: first.lastName } : {}
+            };
+          } else {
+            if (first.userId === "") return refuse("a first member names a user");
+            input.firstMember = { userId: first.userId };
+          }
         }
         if (organization.ownPool === true) input.ownPool = true;
         const answered = settings === void 0 ? "organizationId status" : "organizationId settingsRecordId status";
@@ -853,6 +878,15 @@ function createAppClient(config) {
           deletionScheduledAt: answer.deletionScheduledAt ?? null,
           organizations: (answer.organizations ?? []).map((o) => ({ id: o.id, name: o.name }))
         };
+      },
+      async pool() {
+        return poolOf("organizationPool", `query AppOrganizationPool { organizationPool { ${POOL_FIELDS} } }`);
+      },
+      async startPool() {
+        return poolOf("startOrganizationPool", `mutation AppStartOrganizationPool { startOrganizationPool { ${POOL_FIELDS} } }`);
+      },
+      async dropPool() {
+        return poolOf("dropOrganizationPool", `mutation AppDropOrganizationPool { dropOrganizationPool { ${POOL_FIELDS} } }`);
       }
     },
     notifications: {

package/dist/auth/auth.d.ts

@@ -17,7 +17,7 @@
  */
 import { type FoirEnv } from '../graphql/foir-request';
 import { type AuthOpName, type AuthOpOptions } from './ops';
-import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyProfile, type MyProfileChange, type MySession, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext, type WaitlistJoinResult } from './operations';
+import { type AuthConfig, type AuthProviderPublic, type CurrentUser, type AuthResult, type DefaultAuthProvider, type AuthorizedApp, type DeleteAccountResult, type MyOrganization, type MyProfile, type MyProfileChange, type MySession, type MyAddress, type MyDataExport, type MyFactor, type StepUp, type FactorEnrollment, type MySignInMethod, type NewPersonalAccessToken, type ProviderCallbackInput, type ProviderLoginInput, type ProviderLoginResult, type ProviderOTPVerifyInput, type ProviderToken, type SignupContext } from './operations';
 import type { TypedDocumentNode } from '@graphql-typed-document-node/core';
 /** An access token + its rotating refresh token. */
 export interface FoirAuthTokens {
@@ -125,8 +125,14 @@ export declare function getDefaultAuthProvider(env: FoirEnv): Promise<DefaultAut
  * so a self-hosted frontend can render the right signup surface proactively.
  */
 export declare function signupContext(env: FoirEnv): Promise<SignupContext>;
-/** Join the project's signup waitlist. The project must be in waitlist mode. */
-export declare function joinWaitlist(env: FoirEnv, email: string): Promise<WaitlistJoinResult>;
+/**
+ * Join the project's sign-up waitlist. The project must be in waitlist mode.
+ * Resolves `true` for every address: the server answers identically whether
+ * the address was queued, was already let in, or already has an account, on
+ * purpose, so this endpoint cannot be used to test what an address holds. What
+ * differs is only the email the address is sent.
+ */
+export declare function joinWaitlist(env: FoirEnv, email: string): Promise<boolean>;
 /**
  * Send a password-reset email. Resolves `true` whether or not the address has
  * an account: the server answers identically either way, on purpose, so this
@@ -148,8 +154,6 @@ export declare function resetPassword(env: FoirEnv, vars: {
     token: string;
     newPassword: string;
 }): Promise<AuthResult>;
-/** Redeem an emailed verification token. */
-export declare function verifyEmail(env: FoirEnv, token: string): Promise<boolean>;
 /**
  * Change the calling user's password. Requires the current password as well
  * as the bearer, so a stolen token alone cannot take the account over.
@@ -164,10 +168,12 @@ export declare function updatePassword(env: FoirEnv, vars: {
  */
 export declare function currentUser(env: FoirEnv, options?: AuthOpOptions): Promise<CurrentUser | null>;
 /**
- * The stored upstream provider token for the calling user, renewed by the
- * server when it is due: near its stated expiry, or with no expiry stated.
- * `null` when there is no user token on the request; `linked: false` when the
- * user has none stored for that provider.
+ * The token of the provider the calling user signed in through, kept for the
+ * sign-in the request belongs to and renewed by the server when it is due:
+ * near its stated expiry, or with no expiry stated. `null` when there is no
+ * user token on the request; `linked: false` with `reauthenticate: true` when
+ * nothing is kept for this sign-in (it did not pass through the provider, or
+ * its token was ended), and the user signs in through the provider again.
  *
  * Pass `forceRefresh` after the provider refused the token it was last given:
  * the server renews it then, at most once a minute for one user and provider.
@@ -178,20 +184,33 @@ export declare function myProviderToken(env: FoirEnv, providerKey: string, optio
     forceRefresh?: boolean;
 }): Promise<ProviderToken | null>;
 /**
- * End the session server-side, revoking stored provider tokens. This does NOT
- * clear local session state — {@link signOut} is the pairing that does both.
+ * End the sign-in's provider tokens server-side: this device's, and no other
+ * device's. This does NOT clear local session state — {@link signOut} is the
+ * pairing that does both.
  */
 export declare function logout(env: FoirEnv, options?: AuthOpOptions): Promise<boolean>;
 /**
  * Delete the calling user's account and their owned records and files.
- * Irreversible. `password` is required for password accounts and omitted for
- * provider-only ones; the server enforces the actual re-auth gate and fails
- * closed, so omitting it is refused rather than allowed.
+ * Irreversible. `password` is required for an account that holds one. An
+ * account with none sets `confirm`, on a sign-in made in the last ten minutes:
+ * an older one is refused, and the user signs in again. The server enforces
+ * the re-auth gate and fails closed.
  */
 export declare function deleteMyAccount(env: FoirEnv, vars: {
     confirm: boolean;
     password?: string;
 }, options?: AuthOpOptions): Promise<DeleteAccountResult>;
+/**
+ * End the calling user's own membership where the request stands: the
+ * organization `orgId` names, or, with none, the project's own. Every role
+ * they hold there ends with it; their account and what they made stay.
+ * `false` when they held no membership there.
+ *
+ * Refused where it would leave an organization with nobody who can staff it,
+ * or leave them nowhere to sign in: a person keeps one membership in the
+ * project, and {@link deleteMyAccount} is how they leave altogether.
+ */
+export declare function leaveMembership(env: FoirEnv, options?: AuthOpOptions): Promise<boolean>;
 /**
  * Change the calling user's own name, picture or language. It asks no
  * permission: these are theirs.
@@ -228,6 +247,41 @@ export declare function createPersonalAccessToken(env: FoirEnv, vars: {
     name: string;
     expiresInDays: number;
 }, options?: AuthOpOptions): Promise<NewPersonalAccessToken>;
+/** The email addresses the calling user is known by, the one their account uses first. */
+export declare function myAddresses(env: FoirEnv, options?: AuthOpOptions): Promise<MyAddress[]>;
+/**
+ * Send a code to an address the calling user is adding to their account, and
+ * answer when it stops working (ISO-8601, ten minutes on). The address is kept
+ * by {@link proveMyAddress}. `password` is their current one; an account with
+ * none needs a sign-in in the last ten minutes instead. At most five codes an
+ * hour.
+ */
+export declare function addMyAddress(env: FoirEnv, vars: {
+    email: string;
+    password?: string;
+}, options?: AuthOpOptions): Promise<string>;
+/**
+ * Keep the address a code was sent to, as proven. Refused where another
+ * account in the project holds the address: nobody's address is taken.
+ */
+export declare function proveMyAddress(env: FoirEnv, vars: {
+    email: string;
+    code: string;
+}, options?: AuthOpOptions): Promise<MyAddress>;
+/** Make one of the calling user's proven addresses the one their account uses. */
+export declare function makeMyAddressPrimary(env: FoirEnv, email: string, options?: AuthOpOptions): Promise<MyAddress>;
+/**
+ * Remove one of the calling user's addresses. The one their account uses
+ * stays: make another primary first.
+ */
+export declare function removeMyAddress(env: FoirEnv, email: string, options?: AuthOpOptions): Promise<boolean>;
+/**
+ * A copy of the calling user's own data: their account (profile, addresses,
+ * memberships and roles, sign-in providers, authorised apps, sessions and
+ * notification preferences) and everything deleting it would erase, the
+ * records and files they own.
+ */
+export declare function exportMyData(env: FoirEnv, options?: AuthOpOptions): Promise<MyDataExport>;
 /** The providers the calling user signs in with. */
 export declare function mySignInMethods(env: FoirEnv, options?: AuthOpOptions): Promise<MySignInMethod[]>;
 /**
@@ -288,6 +342,15 @@ export declare function removeFactor(env: FoirEnv, vars: {
     kind: string;
     id: string;
 }, options?: AuthOpOptions): Promise<boolean>;
+/**
+ * Rename one of the calling user's security keys or passkeys. A name proves
+ * nothing and admits nobody, so no step-up is asked.
+ */
+export declare function renameFactor(env: FoirEnv, vars: {
+    kind: 'security_key' | 'passkey';
+    id: string;
+    name: string;
+}, options?: AuthOpOptions): Promise<MyFactor>;
 /**
  * Make the calling user new recovery codes, with an elevated handle from
  * {@link completeStepUp}. They replace any held and are answered here once.
@@ -328,7 +391,7 @@ export declare function myOrganizations(env: FoirEnv, vars?: {
  * membership together.
  *
  * `parentId` FOUNDS A CHILD, which is what lets the people you serve create their own
- * sub-tenants with no administrator in the loop — a reseller adding a client, a
+ * sub-tenants with no manager in the loop — a reseller adding a client, a
  * franchise adding a branch. It is resolved against the caller's own
  * MEMBERSHIPS, not merely against the project: on this lane "an organization
  * that exists" is not the question, "one you operate" is, and anything else is

package/dist/auth/hosted.d.ts

@@ -21,6 +21,11 @@ export interface HostedLoginConfig {
     sessionPath?: string;
     /** RP-initiated logout path on the front door. Default `/session/end-session`. */
     endSessionPath?: string;
+    /**
+     * The app the bearer is for, when it is not the app the login domain fronts.
+     * Default: the domain's own app.
+     */
+    clientId?: string;
 }
 /**
  * Build the redirect URL to the hosted front door, forwarding a best-effort

package/dist/auth/index.d.ts

@@ -10,7 +10,7 @@
  * the caller's own manifest advertises, through the same op transport
  * `@foir/sdk/data` uses, so `graphql` is not on this module's path at all.
  */
-export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, verifyEmail, currentUser, myProviderToken, logout, deleteMyAccount, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, makeRecoveryCodes, myOrganizations, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
+export { login, register, requestOTP, loginWithOTP, refreshTokens, loginWithProvider, providerCallback, providerVerifyOTP, providerSignInRefusalOf, signInRefusalOf, confirmProviderLink, resendProviderLinkCode, getAuthProviders, getAuthConfig, getDefaultAuthProvider, signupContext, joinWaitlist, requestPasswordReset, resetPassword, updatePassword, currentUser, myProviderToken, logout, deleteMyAccount, leaveMembership, updateMyProfile, myAuthorizedApps, revokeAuthorizedApp, mySessions, endMySession, myAddresses, addMyAddress, proveMyAddress, makeMyAddressPrimary, removeMyAddress, exportMyData, signOutEverywhere, createPersonalAccessToken, mySignInMethods, connectSignInMethod, disconnectSignInMethod, myFactors, beginStepUp, completeStepUp, beginFactorEnrollment, completeFactorEnrollment, removeFactor, renameFactor, makeRecoveryCodes, myOrganizations, registerOrganization, saveSession, clearSession, getSessionToken, getSessionUser, signInWithPassword, signUpWithPassword, signInWithOTP, resetPasswordAndSignIn, refreshSession, refreshSessionOnce, signOut, authedRequest, authedOp, requireAuth, } from './auth';
 export type { FoirAuthTokens, FoirUser, SessionAdapter, RequireAuthOptions, } from './auth';
 export { userAccess, getSessionAccess, hasRole, hasScope, requireRole, requireScope, FoirAccessDeniedError, } from './access';
 export type { FoirAccess, FoirAccessDenial } from './access';
@@ -21,4 +21,4 @@ export { hostedLoginUrl, hostedLogoutUrl, fetchHostedSession, hostedSignInNotice
 export type { HostedLoginConfig, HostedSession, HostedSessionResult, HostedSignInNotice } from './hosted';
 export { createFoirSessionClient } from './session-client';
 export type { FoirSessionClient, FoirSessionConfig, FoirSessionUser, } from './session-client';
-export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, WaitlistJoinResult, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';
+export type { AuthResult, ProviderLoginResult, AuthProviderPublic, ProviderLoginInput, ProviderCallbackInput, ProviderOTPVerifyInput, SignupContext, SignupMode, AuthConfig, AuthConfigProvider, DefaultAuthProvider, CurrentUser, ProviderToken, ProviderTokenRefresh, DeleteAccountResult, MyOrganization, MyProfile, MyProfileChange, AuthorizedApp, MySession, MyAddress, MyDataExport, NewPersonalAccessToken, MySignInMethod, MyFactor, StepUp, FactorEnrollment, } from './operations';

package/dist/auth/operations.d.ts

@@ -76,13 +76,6 @@ export type SignupMode = 'PUBLIC' | 'RESTRICTED' | 'WAITLIST' | 'CLOSED';
 export interface SignupContext {
     signupMode: SignupMode;
 }
-/** The queued (or existing pending) entry a waitlist join returns. */
-export interface WaitlistJoinResult {
-    id: string;
-    email: string;
-    /** Waitlist lifecycle status; PENDING on a fresh join. */
-    status: string;
-}
 /** One provider as it appears inside {@link AuthConfig}. */
 export interface AuthConfigProvider {
     key: string;
@@ -126,13 +119,15 @@ export interface CurrentUser {
 /** What a provider token read did about the token's freshness. */
 export type ProviderTokenRefresh = 'NOT_ATTEMPTED' | 'REFRESHED' | 'FAILED' | 'HELD_BACK';
 /**
- * A stored upstream provider token for the calling user. `myProviderToken`
- * answers `null` when there is no user token on the request, and
- * `linked: false` when the user has none stored for that provider.
+ * The token of the provider the calling user signed in through. It belongs to
+ * the sign-in that obtained it: a sign-in on another device keeps its own, and
+ * signing out ends it. `myProviderToken` answers `null` when there is no user
+ * token on the request, and `linked: false` with `reauthenticate: true` when
+ * nothing is kept for this sign-in.
  */
 export interface ProviderToken {
     providerKey: string;
-    /** False when the user has no token for the provider; every token field is then null. */
+    /** False when nothing is kept for the sign-in the request belongs to; every token field is then null. */
     linked: boolean;
     accessToken: string | null;
     refreshToken: string | null;
@@ -148,7 +143,11 @@ export interface ProviderToken {
     refresh: ProviderTokenRefresh | null;
     /** Where a failed refresh failed, such as `"refresh grant"`. */
     refreshFailure: string | null;
-    /** Only the user signing in with the provider again mends the connection. */
+    /**
+     * Only the user signing in with the provider again mends the connection:
+     * nothing is kept for this sign-in, or the provider will not renew it. Show
+     * them the way to sign in through the provider, not an empty page.
+     */
     reauthenticate: boolean;
 }
 /** What a self-serve account deletion removed. */
@@ -201,6 +200,61 @@ export interface MySession {
     /** Whether it is the session making the request. */
     current: boolean;
 }
+/** An email address the calling user is known by. */
+export interface MyAddress {
+    email: string;
+    /** Whether it is the address their account uses: shown for them, and where mail to them goes. */
+    primary: boolean;
+    /** Whether they proved they hold it. Every address they added is proven. */
+    proven: boolean;
+    /** ISO-8601. */
+    addedAt: string | null;
+}
+/**
+ * The calling user's copy of their own data, the `foir.my-data.v1` document:
+ * their account and everything deleting it would erase. No password, code or
+ * token value is in it.
+ */
+export interface MyDataExport {
+    format: 'foir.my-data.v1';
+    /** ISO-8601. */
+    exportedAt: string;
+    account: Record<string, unknown> & {
+        id: string;
+        pool: string;
+        poolKind: string;
+        status: string;
+    };
+    addresses: Array<{
+        email: string;
+        primary: boolean;
+        proven: boolean;
+        addedAt?: string;
+    }>;
+    memberships: Array<Record<string, unknown> & {
+        roles: string[];
+    }>;
+    signInMethods: Array<Record<string, unknown>>;
+    authorizedApps: Array<Record<string, unknown>>;
+    sessions: Array<Record<string, unknown>>;
+    notificationPreferences: Array<Record<string, unknown>>;
+    /** The records the user owns, each with the content it holds now. */
+    records: Array<{
+        id: string;
+        model: string;
+        key?: string;
+        project: string;
+        data: Record<string, unknown>;
+    }>;
+    /** The files the user owns; their bytes are fetched from `url`. */
+    files: Array<{
+        id: string;
+        name: string;
+        mimeType: string;
+        size: number;
+        url: string;
+    }>;
+}
 /** A personal access token just made: its value is shown here once. */
 export interface NewPersonalAccessToken {
     token: MySession;

package/dist/auth/ops.d.ts

@@ -55,14 +55,20 @@ export declare const AUTH_OPS: {
     readonly requestPasswordReset: "requestPasswordReset";
     readonly resetPassword: "resetPassword";
     readonly updatePassword: "updatePassword";
-    readonly verifyEmail: "verifyEmail";
     readonly deleteMyAccount: "deleteMyAccount";
+    readonly leaveMembership: "leaveMembership";
     readonly updateMyProfile: "updateMyProfile";
     readonly myAuthorizedApps: "myAuthorizedApps";
     readonly revokeAuthorizedApp: "revokeAuthorizedApp";
     readonly mySessions: "mySessions";
     readonly endMySession: "endMySession";
     readonly signOutEverywhere: "signOutEverywhere";
+    readonly myAddresses: "myAddresses";
+    readonly addMyAddress: "addMyAddress";
+    readonly proveMyAddress: "proveMyAddress";
+    readonly makeMyAddressPrimary: "makeMyAddressPrimary";
+    readonly removeMyAddress: "removeMyAddress";
+    readonly exportMyData: "exportMyData";
     readonly createPersonalAccessToken: "createPersonalAccessToken";
     readonly mySignInMethods: "mySignInMethods";
     readonly connectSignInMethod: "connectSignInMethod";
@@ -73,6 +79,7 @@ export declare const AUTH_OPS: {
     readonly beginFactorEnrollment: "beginFactorEnrollment";
     readonly completeFactorEnrollment: "completeFactorEnrollment";
     readonly removeFactor: "removeFactor";
+    readonly renameFactor: "renameFactor";
     readonly makeRecoveryCodes: "makeRecoveryCodes";
     readonly myOrganizations: "myOrganizations";
     readonly registerOrganization: "registerOrganization";

package/dist/auth/session-client.d.ts

@@ -37,6 +37,11 @@ export interface FoirSessionConfig {
     sessionPath?: string;
     /** Logout path. Default `/session/logout`. */
     logoutPath?: string;
+    /**
+     * The app the bearer is for, when it is not the app the login domain fronts.
+     * Default: the domain's own app.
+     */
+    clientId?: string;
     /** Seconds before expiry to re-exchange. Default 60. */
     refreshSkewSeconds?: number;
     /**

package/dist/auth-session.js

@@ -5,8 +5,9 @@ var DEFAULT_REFRESH_SKEW_SECONDS = 60;
 var MIN_REFRESH_DELAY_MS = 5e3;
 var CSRF_HEADER = { "X-Foir-Session": "1" };
 function createFoirSessionClient(config) {
-  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH}`;
-  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}`;
+  const forApp = config.clientId ? `?client_id=${encodeURIComponent(config.clientId)}` : "";
+  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH}${forApp}`;
+  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}${forApp}`;
   const skewMs = (config.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS) * 1e3;
   let cached = null;
   let inflight = null;

package/dist/auth.js

@@ -1093,8 +1093,9 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
+  // Ending their own membership where the request stands.
+  leaveMembership: "leaveMembership",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
   myAuthorizedApps: "myAuthorizedApps",
@@ -1104,6 +1105,14 @@ var AUTH_OPS = {
   mySessions: "mySessions",
   endMySession: "endMySession",
   signOutEverywhere: "signOutEverywhere",
+  // Their email addresses: one added is kept once the code it was sent proves it.
+  myAddresses: "myAddresses",
+  addMyAddress: "addMyAddress",
+  proveMyAddress: "proveMyAddress",
+  makeMyAddressPrimary: "makeMyAddressPrimary",
+  removeMyAddress: "removeMyAddress",
+  // A copy of their own data.
+  exportMyData: "exportMyData",
   createPersonalAccessToken: "createPersonalAccessToken",
   mySignInMethods: "mySignInMethods",
   connectSignInMethod: "connectSignInMethod",
@@ -1115,6 +1124,7 @@ var AUTH_OPS = {
   beginFactorEnrollment: "beginFactorEnrollment",
   completeFactorEnrollment: "completeFactorEnrollment",
   removeFactor: "removeFactor",
+  renameFactor: "renameFactor",
   makeRecoveryCodes: "makeRecoveryCodes",
   // The organizations the caller may stand in. Nothing selects one: a request
   // names the organization it acts in (`orgId` or `orgUrl` below), and the
@@ -1266,9 +1276,6 @@ async function requestPasswordReset(env, email, options) {
 async function resetPassword(env, vars) {
   return authOp(env, AUTH_OPS.resetPassword, vars);
 }
-async function verifyEmail(env, token) {
-  return authOp(env, AUTH_OPS.verifyEmail, { token });
-}
 async function updatePassword(env, vars, options) {
   return authOp(env, AUTH_OPS.updatePassword, vars, options);
 }
@@ -1286,6 +1293,9 @@ async function logout(env, options) {
 async function deleteMyAccount(env, vars, options) {
   return authOp(env, AUTH_OPS.deleteMyAccount, vars, options);
 }
+async function leaveMembership(env, options) {
+  return authOp(env, AUTH_OPS.leaveMembership, void 0, options);
+}
 async function updateMyProfile(env, change, options) {
   return authOp(env, AUTH_OPS.updateMyProfile, change, options);
 }
@@ -1307,6 +1317,24 @@ async function signOutEverywhere(env, vars = {}, options) {
 async function createPersonalAccessToken(env, vars, options) {
   return authOp(env, AUTH_OPS.createPersonalAccessToken, vars, options);
 }
+async function myAddresses(env, options) {
+  return authOp(env, AUTH_OPS.myAddresses, void 0, options);
+}
+async function addMyAddress(env, vars, options) {
+  return authOp(env, AUTH_OPS.addMyAddress, vars, options);
+}
+async function proveMyAddress(env, vars, options) {
+  return authOp(env, AUTH_OPS.proveMyAddress, vars, options);
+}
+async function makeMyAddressPrimary(env, email, options) {
+  return authOp(env, AUTH_OPS.makeMyAddressPrimary, { email }, options);
+}
+async function removeMyAddress(env, email, options) {
+  return authOp(env, AUTH_OPS.removeMyAddress, { email }, options);
+}
+async function exportMyData(env, options) {
+  return authOp(env, AUTH_OPS.exportMyData, void 0, options);
+}
 async function mySignInMethods(env, options) {
   return authOp(env, AUTH_OPS.mySignInMethods, void 0, options);
 }
@@ -1334,6 +1362,9 @@ async function completeFactorEnrollment(env, vars, options) {
 async function removeFactor(env, vars, options) {
   return authOp(env, AUTH_OPS.removeFactor, vars, options);
 }
+async function renameFactor(env, vars, options) {
+  return authOp(env, AUTH_OPS.renameFactor, vars, options);
+}
 async function makeRecoveryCodes(env, elevatedHandle, options) {
   return authOp(env, AUTH_OPS.makeRecoveryCodes, { elevatedHandle }, options);
 }
@@ -1792,7 +1823,7 @@ async function fetchHostedSession(request, config) {
   if (!match) return { outcome: "signed-out", reason: "no-cookie" };
   let res;
   try {
-    res = await fetch(`${config.loginOrigin}${sessionPath}`, {
+    res = await fetch(`${config.loginOrigin}${sessionPath}${forApp(config.clientId)}`, {
       headers: {
         Cookie: `${cookieName}=${match[1]}`,
         "X-Foir-Session": "1"
@@ -1867,6 +1898,9 @@ var REFUSAL_MESSAGES = {
 function refusalMessage(code) {
   return REFUSAL_MESSAGES[code] ?? "The sign-in couldn\u2019t be finished. Try again.";
 }
+function forApp(clientId) {
+  return clientId ? `?client_id=${encodeURIComponent(clientId)}` : "";
+}
 
 // src/auth/session-client.ts
 var DEFAULT_SESSION_PATH2 = "/session/token";
@@ -1875,8 +1909,9 @@ var DEFAULT_REFRESH_SKEW_SECONDS = 60;
 var MIN_REFRESH_DELAY_MS = 5e3;
 var CSRF_HEADER = { "X-Foir-Session": "1" };
 function createFoirSessionClient(config) {
-  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH2}`;
-  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}`;
+  const forApp2 = config.clientId ? `?client_id=${encodeURIComponent(config.clientId)}` : "";
+  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH2}${forApp2}`;
+  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}${forApp2}`;
   const skewMs = (config.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS) * 1e3;
   let cached = null;
   let inflight = null;
@@ -2007,6 +2042,7 @@ export {
   FoirAccessDeniedError,
   FoirAuthDowngradedError,
   FoirSessionExpiredError,
+  addMyAddress,
   authedOp,
   authedRequest,
   beginFactorEnrollment,
@@ -2022,6 +2058,7 @@ export {
   deleteMyAccount,
   disconnectSignInMethod,
   endMySession,
+  exportMyData,
   fetchHostedSession,
   getAuthConfig,
   getAuthProviders,
@@ -2035,17 +2072,21 @@ export {
   hostedLogoutUrl,
   hostedSignInNoticeOf,
   joinWaitlist,
+  leaveMembership,
   login,
   loginWithOTP,
   loginWithProvider,
   logout,
+  makeMyAddressPrimary,
   makeRecoveryCodes,
+  myAddresses,
   myAuthorizedApps,
   myFactors,
   myOrganizations,
   myProviderToken,
   mySessions,
   mySignInMethods,
+  proveMyAddress,
   providerCallback,
   providerSignInRefusalOf,
   providerVerifyOTP,
@@ -2055,6 +2096,8 @@ export {
   register,
   registerOrganization,
   removeFactor,
+  removeMyAddress,
+  renameFactor,
   requestOTP,
   requestPasswordReset,
   requireAuth,
@@ -2074,6 +2117,5 @@ export {
   signupContext,
   updateMyProfile,
   updatePassword,
-  userAccess,
-  verifyEmail
+  userAccess
 };

package/dist/components/EditorProvider.d.ts

@@ -11,7 +11,7 @@ export interface EditorProviderProps {
     children: ReactNode;
     /**
      * Parent window origin for postMessage validation.
-     * Must be an explicit origin (e.g., 'https://admin.example.com').
+     * Must be an explicit origin (e.g., 'https://console.example.com').
      * Falls back to VITE_PARENT_ORIGIN or NEXT_PUBLIC_PARENT_ORIGIN env var.
      */
     parentOrigin?: string;

package/dist/next.js

@@ -973,8 +973,9 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
+  // Ending their own membership where the request stands.
+  leaveMembership: "leaveMembership",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
   myAuthorizedApps: "myAuthorizedApps",
@@ -984,6 +985,14 @@ var AUTH_OPS = {
   mySessions: "mySessions",
   endMySession: "endMySession",
   signOutEverywhere: "signOutEverywhere",
+  // Their email addresses: one added is kept once the code it was sent proves it.
+  myAddresses: "myAddresses",
+  addMyAddress: "addMyAddress",
+  proveMyAddress: "proveMyAddress",
+  makeMyAddressPrimary: "makeMyAddressPrimary",
+  removeMyAddress: "removeMyAddress",
+  // A copy of their own data.
+  exportMyData: "exportMyData",
   createPersonalAccessToken: "createPersonalAccessToken",
   mySignInMethods: "mySignInMethods",
   connectSignInMethod: "connectSignInMethod",
@@ -995,6 +1004,7 @@ var AUTH_OPS = {
   beginFactorEnrollment: "beginFactorEnrollment",
   completeFactorEnrollment: "completeFactorEnrollment",
   removeFactor: "removeFactor",
+  renameFactor: "renameFactor",
   makeRecoveryCodes: "makeRecoveryCodes",
   // The organizations the caller may stand in. Nothing selects one: a request
   // names the organization it acts in (`orgId` or `orgUrl` below), and the