@foir/sdk 0.28.0 → 0.30.0

package/dist/react.js

@@ -1133,8 +1133,8 @@ async function getSessionUser(adapter) {
 async function signInWithPassword(adapter, env, vars) {
   return saveSession(adapter, await login(env, vars));
 }
-async function signUpWithPassword(adapter, env, vars) {
-  return saveSession(adapter, await register(env, vars));
+async function signUpWithPassword(env, vars) {
+  await register(env, vars);
 }
 async function signInWithOTP(adapter, env, vars) {
   return saveSession(adapter, await loginWithOTP(env, vars));
@@ -1242,6 +1242,12 @@ var GRANT_TABLE = [
   ["operations:write", "none", [], []],
   ["operations:complete", "none", [], []],
   ["status:write", "none", [], []],
+  ["agents:read", "none", [], []],
+  ["agents:execute", "agent", [], []],
+  ["agents:write", "none", [], []],
+  ["agenttools:execute", "agent_tool", [], []],
+  ["brief:read", "none", [], []],
+  ["brief:write", "none", [], []],
   ["appconfig:read", "none", [], []],
   ["schedules:read", "none", [], []],
   ["schedules:write", "none", [], []],
@@ -1280,6 +1286,7 @@ var GRANT_TABLE = [
   ["apikeys:write", "none", [], []],
   ["organizations:read", "none", [], []],
   ["organizations:write", "none", [], []],
+  ["orgsettings:write", "none", [], []],
   ["organizations:create", "none", [], []],
   ["organizations:delete", "none", [], []],
   ["organizations:reach", "none", [], []],
@@ -1290,7 +1297,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "agents:read", "agents:execute", "agents:write", "agenttools:execute", "brief:read", "brief:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "orgsettings:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -1321,7 +1328,6 @@ var GRANT_TABLE = [
   ["usersecrets:list", "none", [], []],
   ["usersecrets:put", "none", [], []],
   ["usersecrets:delete", "none", [], []],
-  ["auth:login_with_foir", "none", [], []],
   ["signinproviders:read", "none", [], []],
   ["signinproviders:write", "none", [], []]
 ];
@@ -1680,13 +1686,11 @@ function FoirProvider({
     [apply, assertTokenMode]
   );
   const register2 = useCallback(
-    async (vars) => {
+    (vars) => {
       assertTokenMode("register");
-      const c = await signUpWithPassword(adapterRef.current, envRef.current, vars);
-      apply(c);
-      return c;
+      return signUpWithPassword(envRef.current, vars);
     },
-    [apply, assertTokenMode]
+    [assertTokenMode]
   );
   const requestOtp = useCallback(
     (email) => {
@@ -2265,7 +2269,7 @@ async function submitFeedbackNote(client, submission) {
       await uploadFeedbackAttachment(client, submission.screenshot, submission.fetch)
     );
   }
-  const args = noteArgs(submission.subject, submission.body);
+  const args = noteArgs(submission.subject, submission.body, submission.anchorField);
   if (attachmentFileIds.length > 0) args.attachmentFileIds = attachmentFileIds;
   const { notes } = client.ns;
   return readCreatedNote(
@@ -2279,7 +2283,11 @@ async function submitVisitorNote(client, submission) {
       "[foir] this client has no `notes.writeNote`, which is the only create that takes a note from a visitor who is not signed in. Re-run `foir types`."
     );
   }
-  const args = noteArgs(submission.subject, submission.body);
+  const args = noteArgs(
+    submission.subject,
+    submission.body,
+    submission.anchorField
+  );
   const contactEmail = submission.contactEmail?.trim();
   if (contactEmail) args.contactEmail = contactEmail;
   args.pick = ["id", "createdAt"];
@@ -2294,13 +2302,15 @@ async function submitVisitorNote(client, submission) {
     createdAt: typeof result.createdAt === "string" ? result.createdAt : ""
   };
 }
-function noteArgs(subject, body) {
-  return {
+function noteArgs(subject, body, anchorField) {
+  const args = {
     subjectType: "record",
     subjectId: subject.recordId,
     subjectModelKey: subject.modelKey,
     body
   };
+  if (anchorField) args.anchorField = anchorField;
+  return args;
 }
 async function uploadFeedbackAttachment(client, screenshot, fetchImpl = globalThis.fetch) {
   const files = client.ns.files;
@@ -2424,7 +2434,11 @@ var COPY = {
   captureFailed: "The screenshot could not be taken. You can still send your feedback.",
   screenshotAlt: "The screenshot that will be sent with your feedback",
   removeScreenshot: "Remove screenshot",
-  about: "About"
+  about: "About",
+  point: "Point at what you mean",
+  pointAgain: "Point at something else",
+  pointHint: "Click the part of the page you mean, or use Tab and Enter. Escape cancels.",
+  pointCancel: "Cancel"
 };
 var border = "1px solid var(--foir-feedback-border, currentColor)";
 var radius = "var(--foir-feedback-radius, 8px)";
@@ -2531,6 +2545,8 @@ function FoirFeedback({
   onSignIn,
   signIn = true,
   layout = "inline",
+  launcher,
+  pointing = false,
   appearance,
   onSubmitted,
   onVisitorSubmitted,
@@ -2546,10 +2562,32 @@ function FoirFeedback({
   const [busy, setBusy] = useState4(false);
   const [failure, setFailure] = useState4(null);
   const [sent, setSent] = useState4(false);
+  const [pointed, setPointed] = useState4(null);
+  const [pointingNow, setPointingNow] = useState4(false);
+  const [canPoint, setCanPoint] = useState4(false);
   const onErrorRef = useRef2(onError);
   onErrorRef.current = onError;
-  const resolved = useResolvedSubject(subjects, subject);
+  const fetched = useResolvedSubject(subjects, subject);
+  const offersPointing = pointing && subjects !== void 0 && subject !== null;
+  const resolved = offersPointing && pointed ? pointed.subject : fetched;
   const styled = !className;
+  useEffect3(() => {
+    if (!open || !offersPointing || !subjects) return;
+    setCanPoint(markedFields(subjects).length > 0);
+  }, [open, offersPointing, subjects]);
+  const highlight = usePointing(pointingNow ? subjects : void 0, {
+    onPick: (mark) => {
+      setPointed(mark);
+      setPointingNow(false);
+      setSent(false);
+      setFailure(null);
+      setOpen(true);
+    },
+    onCancel: () => {
+      setPointingNow(false);
+      setOpen(true);
+    }
+  });
   useNoSubjectNotice(open, resolved, subjects !== void 0, subject !== void 0);
   useEffect3(() => {
     if (!open) return;
@@ -2615,6 +2653,7 @@ function FoirFeedback({
         const note = await submitFeedbackNote(client, {
           subject: resolved,
           body: prose,
+          anchorField: pointed?.field,
           screenshot
         });
         setBody("");
@@ -2625,6 +2664,7 @@ function FoirFeedback({
         const written = await submitVisitorNote(client, {
           subject: resolved,
           body: prose,
+          anchorField: pointed?.field,
           contactEmail
         });
         setBody("");
@@ -2656,9 +2696,11 @@ function FoirFeedback({
     }
     setSent(false);
     setFailure(null);
+    setPointed(null);
     setOpen(true);
   };
-  const subjectName = resolved ? label ?? resolved.label : void 0;
+  const recordName = resolved ? pointed ? resolved.label : label ?? resolved.label : void 0;
+  const subjectName = [recordName, pointed?.label].filter(Boolean).join(" \xB7 ") || void 0;
   const dialog = layout === "dialog";
   const heading = /* @__PURE__ */ jsx5("h2", { "data-foir-feedback-title": true, style: styled ? headingStyle : void 0, children: title });
   const panel = open && /* @__PURE__ */ jsxs4(
@@ -2686,6 +2728,19 @@ function FoirFeedback({
           ": ",
           subjectName
         ] }),
+        offersPointing && canPoint && probe.status === "ready" && /* @__PURE__ */ jsx5(
+          "button",
+          {
+            type: "button",
+            "data-foir-feedback-point": true,
+            onClick: () => {
+              setOpen(false);
+              setPointingNow(true);
+            },
+            style: styled ? buttonStyle : void 0,
+            children: pointed ? COPY.pointAgain : COPY.point
+          }
+        ),
         probe.status === "loading" && /* @__PURE__ */ jsx5(
           "p",
           {
@@ -2800,12 +2855,19 @@ function FoirFeedback({
       ]
     }
   );
+  const launcherPlace = launcher ? {
+    position: "fixed",
+    bottom: 16,
+    [launcher === "bottom-left" ? "left" : "right"]: 16,
+    zIndex: LAUNCHER_LAYER
+  } : void 0;
   return /* @__PURE__ */ jsxs4(
     "div",
     {
       className,
       "data-foir-feedback": true,
       "data-foir-feedback-layout": layout,
+      "data-foir-feedback-launcher": launcher,
       style: styled ? wrapperStyle(appearance) : void 0,
       children: [
         /* @__PURE__ */ jsx5(
@@ -2816,10 +2878,25 @@ function FoirFeedback({
             "aria-expanded": open,
             "aria-haspopup": dialog ? "dialog" : void 0,
             onClick: toggle,
-            style: styled ? buttonStyle : void 0,
+            style: {
+              ...styled ? buttonStyle : void 0,
+              ...styled && launcher ? launcherStyle : void 0,
+              ...launcherPlace
+            },
             children: triggerLabel
           }
         ),
+        pointingNow && /* @__PURE__ */ jsx5(
+          PointingChrome,
+          {
+            highlight,
+            styled,
+            onCancel: () => {
+              setPointingNow(false);
+              setOpen(true);
+            }
+          }
+        ),
         dialog ? /* @__PURE__ */ jsx5(
           "dialog",
           {
@@ -2833,11 +2910,184 @@ function FoirFeedback({
             style: styled ? dialogStyle : void 0,
             children: panel
           }
+        ) : launcher && panel ? /* @__PURE__ */ jsx5(
+          "div",
+          {
+            "data-foir-feedback-launcher-panel": true,
+            style: {
+              position: "fixed",
+              bottom: 64,
+              [launcher === "bottom-left" ? "left" : "right"]: 16,
+              zIndex: LAUNCHER_LAYER,
+              ...styled ? { background: "var(--foir-feedback-background, Canvas)" } : void 0
+            },
+            children: panel
+          }
         ) : panel
       ]
     }
   );
 }
+var LAUNCHER_LAYER = 2147483e3;
+var POINTING_LAYER = 2147483600;
+var launcherStyle = {
+  background: "var(--foir-feedback-primary, Canvas)",
+  color: "var(--foir-feedback-primary-text, CanvasText)",
+  boxShadow: "0 4px 16px rgb(0 0 0 / 0.18)",
+  padding: "10px 14px",
+  fontWeight: 600
+};
+function markedFields(subjects) {
+  if (typeof document === "undefined") return [];
+  return Array.from(document.querySelectorAll("[data-foir-field]")).filter(
+    (el) => subjects.pointedAt(el.getAttribute("data-foir-field") ?? "") !== void 0 && el.getClientRects().length > 0
+  );
+}
+function markedFieldAt(target, subjects) {
+  if (!(target instanceof Element)) return null;
+  const el = target.closest("[data-foir-field]");
+  if (!el) return null;
+  const mark = subjects.pointedAt(el.getAttribute("data-foir-field") ?? "");
+  return mark ? { el, mark } : null;
+}
+function usePointing(subjects, handlers) {
+  const [highlight, setHighlight] = useState4(null);
+  const handlersRef = useRef2(handlers);
+  handlersRef.current = handlers;
+  useEffect3(() => {
+    if (!subjects) return;
+    let current = null;
+    let index2 = -1;
+    const show = (el) => {
+      current = el;
+      if (!el) {
+        setHighlight(null);
+        return;
+      }
+      const box = el.getBoundingClientRect();
+      setHighlight({ top: box.top, left: box.left, width: box.width, height: box.height });
+    };
+    const ours = (target) => target instanceof Element && target.closest("[data-foir-feedback-pointing]") !== null;
+    const onMove = (event) => {
+      if (ours(event.target)) return;
+      show(markedFieldAt(event.target, subjects)?.el ?? null);
+    };
+    const onClick = (event) => {
+      if (ours(event.target)) return;
+      event.preventDefault();
+      event.stopPropagation();
+      const hit = markedFieldAt(event.target, subjects);
+      if (hit) handlersRef.current.onPick(hit.mark);
+    };
+    const onKey = (event) => {
+      if (event.key === "Escape") {
+        event.preventDefault();
+        handlersRef.current.onCancel();
+        return;
+      }
+      if (event.key === "Tab") {
+        const fields = markedFields(subjects);
+        if (fields.length === 0) return;
+        event.preventDefault();
+        index2 = (index2 + (event.shiftKey ? -1 : 1) + fields.length) % fields.length;
+        const el = fields[index2];
+        el.scrollIntoView?.({ block: "nearest" });
+        show(el);
+        return;
+      }
+      if (event.key === "Enter" && current) {
+        const mark = subjects.pointedAt(current.getAttribute("data-foir-field") ?? "");
+        if (!mark) return;
+        event.preventDefault();
+        handlersRef.current.onPick(mark);
+      }
+    };
+    const onScroll = () => show(current);
+    const root = document.documentElement;
+    const cursor = root.style.cursor;
+    root.style.cursor = "crosshair";
+    document.addEventListener("pointermove", onMove, true);
+    document.addEventListener("click", onClick, true);
+    document.addEventListener("keydown", onKey, true);
+    window.addEventListener("scroll", onScroll, true);
+    return () => {
+      root.style.cursor = cursor;
+      document.removeEventListener("pointermove", onMove, true);
+      document.removeEventListener("click", onClick, true);
+      document.removeEventListener("keydown", onKey, true);
+      window.removeEventListener("scroll", onScroll, true);
+      setHighlight(null);
+    };
+  }, [subjects]);
+  return highlight;
+}
+function PointingChrome({
+  highlight,
+  styled,
+  onCancel
+}) {
+  return /* @__PURE__ */ jsxs4(Fragment2, { children: [
+    highlight && /* @__PURE__ */ jsx5(
+      "div",
+      {
+        "aria-hidden": "true",
+        "data-foir-feedback-highlight": true,
+        style: {
+          position: "fixed",
+          top: highlight.top - 4,
+          left: highlight.left - 4,
+          width: highlight.width + 8,
+          height: highlight.height + 8,
+          pointerEvents: "none",
+          zIndex: POINTING_LAYER,
+          ...styled ? {
+            outline: "2px solid var(--foir-feedback-primary, Highlight)",
+            borderRadius: "var(--foir-feedback-radius, 8px)"
+          } : void 0
+        }
+      }
+    ),
+    /* @__PURE__ */ jsxs4(
+      "div",
+      {
+        role: "status",
+        "data-foir-feedback-pointing": true,
+        style: {
+          position: "fixed",
+          bottom: 16,
+          left: "50%",
+          transform: "translateX(-50%)",
+          zIndex: POINTING_LAYER,
+          cursor: "auto",
+          ...styled ? {
+            display: "flex",
+            alignItems: "center",
+            gap: 12,
+            padding: "10px 14px",
+            borderRadius: radius,
+            border,
+            background: "var(--foir-feedback-background, Canvas)",
+            color: "var(--foir-feedback-text, CanvasText)",
+            boxShadow: "0 4px 16px rgb(0 0 0 / 0.18)"
+          } : void 0
+        },
+        children: [
+          /* @__PURE__ */ jsx5("span", { children: COPY.pointHint }),
+          /* @__PURE__ */ jsx5(
+            "button",
+            {
+              type: "button",
+              "data-foir-feedback-point-cancel": true,
+              onClick: onCancel,
+              style: styled ? closeStyle : void 0,
+              children: COPY.pointCancel
+            }
+          )
+        ]
+      }
+    )
+  ] });
+}
 async function probeRefusal(client) {
   try {
     await readNoteConfig(client);

package/dist/realtime/index.d.ts

@@ -71,6 +71,12 @@ export interface CreateCollabSessionOptions {
     room: RoomAddress | string;
     /** Async token source. Invoked before the first connect and on each refresh tick. */
     getToken: () => string | Promise<string>;
+    /**
+     * The organization the signed-in user stands at in the room, as a request
+     * names it. Omit for the project. The platform admits the join only where
+     * the user is a member.
+     */
+    orgId?: string;
     /** Caller-owned `Y.Doc` carrying the app-defined shared types. */
     doc: Y.Doc;
     /** Local presence. Sets awareness under the `user` field (contract shape). Omit for no presence. */

package/dist/realtime.js

@@ -39,12 +39,13 @@ function createCollabSession(options) {
     refreshMs = 4 * 60 * 1e3,
     connect = true,
     params: extraParams,
+    orgId,
     WebSocketPolyfill
   } = options;
   const room = roomPath(options.room);
   const provider = new WebsocketProvider(url, room, doc, {
     connect: false,
-    params: { ...extraParams },
+    params: { ...extraParams, ...orgId ? { org: orgId } : {} },
     ...WebSocketPolyfill ? { WebSocketPolyfill } : {}
   });
   const awareness = provider.awareness;

package/dist/server/webhook-helpers.d.ts

@@ -15,7 +15,9 @@
  *
  * The platform signs webhook payloads with HMAC-SHA256 using the
  * extension's webhook secret. The signature is sent in the
- * `x-foir-signature` header as a hex-encoded string.
+ * `x-foir-signature` header as a hex-encoded string. A base64 signature of
+ * the same HMAC is accepted too, so a header that carries one (Shopify's
+ * `X-Shopify-Hmac-Sha256`, for one) verifies as it arrives.
  *
  * @example
  * ```ts

package/dist/server.js

@@ -63,14 +63,35 @@ async function verifyWebhookSignature(payload, signature, secret) {
     key,
     encoder.encode(payload)
   );
-  const computed = Array.from(new Uint8Array(signatureBytes)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  if (computed.length !== signature.length) return false;
+  const computed = new Uint8Array(signatureBytes);
+  const presented = signatureBytesOf(signature.trim());
+  if (!presented || presented.length !== computed.length) return false;
   let mismatch = 0;
   for (let i = 0; i < computed.length; i++) {
-    mismatch |= computed.charCodeAt(i) ^ signature.charCodeAt(i);
+    mismatch |= computed[i] ^ presented[i];
   }
   return mismatch === 0;
 }
+function signatureBytesOf(signature) {
+  if (/^[0-9a-fA-F]+$/.test(signature) && signature.length % 2 === 0) {
+    const out = new Uint8Array(signature.length / 2);
+    for (let i = 0; i < out.length; i++) {
+      out[i] = parseInt(signature.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+  }
+  if (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(signature)) return null;
+  const standard = signature.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = standard + "=".repeat((4 - standard.length % 4) % 4);
+  try {
+    const binary = atob(padded);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
 
 // src/auth/grant-table.generated.ts
 var GRANT_TABLE = [
@@ -106,6 +127,12 @@ var GRANT_TABLE = [
   ["operations:write", "none", [], []],
   ["operations:complete", "none", [], []],
   ["status:write", "none", [], []],
+  ["agents:read", "none", [], []],
+  ["agents:execute", "agent", [], []],
+  ["agents:write", "none", [], []],
+  ["agenttools:execute", "agent_tool", [], []],
+  ["brief:read", "none", [], []],
+  ["brief:write", "none", [], []],
   ["appconfig:read", "none", [], []],
   ["schedules:read", "none", [], []],
   ["schedules:write", "none", [], []],
@@ -144,6 +171,7 @@ var GRANT_TABLE = [
   ["apikeys:write", "none", [], []],
   ["organizations:read", "none", [], []],
   ["organizations:write", "none", [], []],
+  ["orgsettings:write", "none", [], []],
   ["organizations:create", "none", [], []],
   ["organizations:delete", "none", [], []],
   ["organizations:reach", "none", [], []],
@@ -154,7 +182,7 @@ var GRANT_TABLE = [
   ["projects:read", "none", [], []],
   ["projects:write", "none", [], []],
   ["project:stand", "none", [], []],
-  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "auth:login_with_foir", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
+  ["project:manage", "none", [], ["project:stand", "records:read.all", "records:create", "records:write.all", "records:delete.all", "records:publish.all", "records:attribute", "search:read", "embeddings:read", "embeddings:write", "schemas:read", "drafts:read", "files:read.all", "files:write.all", "files:delete.all", "users:read.all", "identities:read", "users:create", "identities:delete", "users:write.all", "users:setup", "users:delete.all", "notifications:read.all", "notifications:write.all", "notifications:consent", "pushcredentials:read", "pushcredentials:write", "notes:read.all", "notes:write.all", "notes:create", "approvals:read", "approvals:write", "rooms:read", "rooms:write", "presence:read", "operations:read", "operations:execute", "operations:write", "agents:read", "agents:execute", "agents:write", "agenttools:execute", "brief:read", "brief:write", "appconfig:read", "schedules:read", "schedules:write", "hooks:read", "hooks:write", "authclients:read", "authclients:write", "domains:read", "domains:write", "loginpages:read", "loginpages:write", "secrets:read", "secrets:list", "secrets:put", "secrets:delete", "appsecrets:read", "appsecrets:list", "appsecrets:put", "appsecrets:delete", "usersecrets:read", "usersecrets:list", "usersecrets:put", "usersecrets:delete", "opsecrets:read", "opsecrets:write", "settings:read", "settings:write", "designtokens:read", "designtokens:write", "models:read", "models:write", "configs:read", "configs:write", "signinproviders:read", "signinproviders:write", "apps:read", "apps:write", "events:read", "targeting:debug", "visitors:forward", "apikeys:read", "apikeys:write", "organizations:read", "organizations:create", "organizations:delete", "organizations:write", "orgsettings:write", "organizations:reach", "members:read", "members:write", "roles:read", "roles:write", "projects:read", "projects:write", "audit:read"]],
   ["projects:create", "none", [], []],
   ["projects:delete", "none", [], []],
   ["tenants:read", "none", [], []],
@@ -185,7 +213,6 @@ var GRANT_TABLE = [
   ["usersecrets:list", "none", [], []],
   ["usersecrets:put", "none", [], []],
   ["usersecrets:delete", "none", [], []],
-  ["auth:login_with_foir", "none", [], []],
   ["signinproviders:read", "none", [], []],
   ["signinproviders:write", "none", [], []]
 ];
@@ -1107,8 +1134,18 @@ async function resolveFoirAuth(config) {
     key: { apiKey: config.apiKey, bearerToken }
   };
 }
+var renewing = /* @__PURE__ */ new WeakMap();
+function renewBearerOnce(refresh) {
+  const running = renewing.get(refresh);
+  if (running) return running;
+  const next = refresh().finally(() => renewing.delete(refresh));
+  renewing.set(refresh, next);
+  return next;
+}
 
 // src/data/ws-transport.ts
+var CLOSE_CREDENTIAL_ENDED = 4402;
+var CLOSE_FORBIDDEN = 4403;
 var GQL = {
   connectionInit: "connection_init",
   connectionAck: "connection_ack",
@@ -1143,6 +1180,9 @@ var FoirSocketTransport = class {
   disposed = false;
   keepAlive = null;
   retryTimer = null;
+  // A bearer renewed after the socket's lapsed (4402), presented from the next
+  // connect on in place of the client's own.
+  renewedBearer = null;
   constructor(config) {
     if (config.dispatch !== void 0) {
       throw new FoirRequestError(
@@ -1215,12 +1255,14 @@ var FoirSocketTransport = class {
     socket.onmessage = (event) => this.receive(event.data);
     socket.onerror = () => {
     };
-    socket.onclose = () => this.handleClose();
+    socket.onclose = (event) => this.handleClose(event);
   }
   async sendConnectionInit(socket) {
     this.connecting = false;
     try {
-      const { headers } = await resolveFoirAuth(this.config);
+      const { headers } = await resolveFoirAuth(
+        this.renewedBearer ? { ...this.config, bearerToken: this.renewedBearer } : this.config
+      );
       const { "Content-Type": _contentType, ...params } = headers;
       const extra = await this.config.connectionParams?.() ?? {};
       this.send(socket, {
@@ -1234,19 +1276,53 @@ var FoirSocketTransport = class {
       this.teardownSocket(true);
     }
   }
-  handleClose() {
+  handleClose(event) {
+    const code = event?.code;
     const wasAcknowledged = this.acknowledged;
     this.teardownSocket(false);
     if (this.disposed || this.registrations.size === 0) return;
     for (const registration of this.registrations.values()) {
       registration.sent = false;
     }
+    if (code === CLOSE_FORBIDDEN) {
+      this.failAll(
+        new FoirRequestError(
+          "[foir] the subscription socket was refused where it asked to stand: the signed-in user is no member of the organization this client names"
+        )
+      );
+      return;
+    }
+    if (code === CLOSE_CREDENTIAL_ENDED) {
+      void this.reconnectWithARenewedBearer();
+      return;
+    }
     this.scheduleReconnect(
       new FoirRequestError(
         wasAcknowledged ? "[foir] the subscription socket closed and could not be re-established" : "[foir] the subscription socket closed before the credential was accepted"
       )
     );
   }
+  /**
+   * Reconnect after the socket's credential lapsed: with the bearer renewed
+   * through the client's `refreshBearer` where it has one, failing every
+   * subscription with `FoirSessionExpiredError` when the session is over. A
+   * client without one reconnects at once, presenting what its bearer
+   * provider gives now.
+   */
+  async reconnectWithARenewedBearer() {
+    const refresh = this.config.refreshBearer;
+    if (refresh) {
+      const token = await renewBearerOnce(refresh).catch(() => null);
+      if (this.disposed) return;
+      if (!token) {
+        this.failAll(new FoirSessionExpiredError());
+        return;
+      }
+      this.renewedBearer = token;
+    }
+    this.attempt = 0;
+    this.ensureConnected();
+  }
   scheduleReconnect(error) {
     if (this.disposed || this.registrations.size === 0) return;
     if (this.attempt >= this.policy.maxAttempts) {