@foir/sdk 0.23.0 → 0.25.0

package/dist/push.js

@@ -1093,8 +1093,9 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
+  // Ending their own membership where the request stands.
+  leaveMembership: "leaveMembership",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
   myAuthorizedApps: "myAuthorizedApps",
@@ -1104,6 +1105,14 @@ var AUTH_OPS = {
   mySessions: "mySessions",
   endMySession: "endMySession",
   signOutEverywhere: "signOutEverywhere",
+  // Their email addresses: one added is kept once the code it was sent proves it.
+  myAddresses: "myAddresses",
+  addMyAddress: "addMyAddress",
+  proveMyAddress: "proveMyAddress",
+  makeMyAddressPrimary: "makeMyAddressPrimary",
+  removeMyAddress: "removeMyAddress",
+  // A copy of their own data.
+  exportMyData: "exportMyData",
   createPersonalAccessToken: "createPersonalAccessToken",
   mySignInMethods: "mySignInMethods",
   connectSignInMethod: "connectSignInMethod",
@@ -1115,6 +1124,7 @@ var AUTH_OPS = {
   beginFactorEnrollment: "beginFactorEnrollment",
   completeFactorEnrollment: "completeFactorEnrollment",
   removeFactor: "removeFactor",
+  renameFactor: "renameFactor",
   makeRecoveryCodes: "makeRecoveryCodes",
   // The organizations the caller may stand in. Nothing selects one: a request
   // names the organization it acts in (`orgId` or `orgUrl` below), and the

package/dist/react.js

@@ -967,8 +967,9 @@ var AUTH_OPS = {
   requestPasswordReset: "requestPasswordReset",
   resetPassword: "resetPassword",
   updatePassword: "updatePassword",
-  verifyEmail: "verifyEmail",
   deleteMyAccount: "deleteMyAccount",
+  // Ending their own membership where the request stands.
+  leaveMembership: "leaveMembership",
   // The user's own profile, and the apps they have agreed may act for them.
   updateMyProfile: "updateMyProfile",
   myAuthorizedApps: "myAuthorizedApps",
@@ -978,6 +979,14 @@ var AUTH_OPS = {
   mySessions: "mySessions",
   endMySession: "endMySession",
   signOutEverywhere: "signOutEverywhere",
+  // Their email addresses: one added is kept once the code it was sent proves it.
+  myAddresses: "myAddresses",
+  addMyAddress: "addMyAddress",
+  proveMyAddress: "proveMyAddress",
+  makeMyAddressPrimary: "makeMyAddressPrimary",
+  removeMyAddress: "removeMyAddress",
+  // A copy of their own data.
+  exportMyData: "exportMyData",
   createPersonalAccessToken: "createPersonalAccessToken",
   mySignInMethods: "mySignInMethods",
   connectSignInMethod: "connectSignInMethod",
@@ -989,6 +998,7 @@ var AUTH_OPS = {
   beginFactorEnrollment: "beginFactorEnrollment",
   completeFactorEnrollment: "completeFactorEnrollment",
   removeFactor: "removeFactor",
+  renameFactor: "renameFactor",
   makeRecoveryCodes: "makeRecoveryCodes",
   // The organizations the caller may stand in. Nothing selects one: a request
   // names the organization it acts in (`orgId` or `orgUrl` below), and the
@@ -1431,8 +1441,9 @@ var DEFAULT_REFRESH_SKEW_SECONDS = 60;
 var MIN_REFRESH_DELAY_MS = 5e3;
 var CSRF_HEADER = { "X-Foir-Session": "1" };
 function createFoirSessionClient(config) {
-  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH}`;
-  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}`;
+  const forApp = config.clientId ? `?client_id=${encodeURIComponent(config.clientId)}` : "";
+  const sessionUrl = `${trimSlash(config.loginOrigin)}${config.sessionPath ?? DEFAULT_SESSION_PATH}${forApp}`;
+  const logoutUrl = `${trimSlash(config.loginOrigin)}${config.logoutPath ?? DEFAULT_LOGOUT_PATH}${forApp}`;
   const skewMs = (config.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS) * 1e3;
   let cached = null;
   let inflight = null;

package/dist/server/events-client.d.ts

@@ -28,8 +28,8 @@
  *
  * The reason is a predicate asymmetry rather than a policy preference.
  * `events.view` is plain tenant+project containment; `record.view` carries
- * owner, admin_owner, access_mode, grantee, comp_parent, read_borrow and
- * slice_parent terms on top of it. A containment-only read over the log
+ * ownership, access-mode, grantee, composition, read-borrow and slice terms
+ * on top of it. A containment-only read over the log
  * therefore describes rows whose underlying records the same caller could not
  * read — and every row carries `actor`, naming which OTHER user acted. In a
  * project with owner confinement that is a per-record activity feed of other

package/dist/server.js

@@ -1489,7 +1489,7 @@ function parseResumeFrom(message) {
   const n = Number(m[1]);
   return Number.isSafeInteger(n) ? n : void 0;
 }
-function assertOperatorKey(apiKey) {
+function assertAdminKey(apiKey) {
   const key = apiKey?.trim() ?? "";
   if (!key) {
     throw new FoirRequestError(
@@ -1576,7 +1576,7 @@ async function readErrorMessage(res) {
   }
 }
 function createEventsClient(config) {
-  const apiKey = assertOperatorKey(config.apiKey);
+  const apiKey = assertAdminKey(config.apiKey);
   assertNoBearer(config.headers);
   const url = foirApiEndpoint(config.apiUrl, FOIR_EVENTS_PATH);
   async function list(params = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {