@eide/foir-cli 0.24.0 → 0.25.1

package/dist/cli.js

@@ -1281,6 +1281,7 @@ import {
   FieldSchema as ProtoFieldSchema,
   SharingConfigSchema as ProtoSharingConfigSchema,
   ModelConfigSchema as ProtoModelConfigSchema,
+  LookupDefinitionSchema as ProtoLookupDefinitionSchema,
   CreateModelRequestSchema,
   GetModelRequestSchema,
   GetModelByKeyRequestSchema,
@@ -1328,7 +1329,13 @@ function jsConfigToProto(c) {
     naturalKeyField: c.naturalKeyField,
     systemEntity: c.systemEntity ?? false,
     deletable: c.deletable,
-    editable: c.editable
+    editable: c.editable,
+    lookups: c.lookups ? c.lookups.map(
+      (l) => create3(ProtoLookupDefinitionSchema, {
+        keyBy: l.keyBy ?? [],
+        name: l.name
+      })
+    ) : []
   });
 }
 function createModelsMethods(client) {
@@ -1383,7 +1390,8 @@ function createModelsMethods(client) {
           config: params.config ? jsConfigToProto(params.config) : void 0,
           changeDescription: params.changeDescription,
           updatePushSnapshot: params.updatePushSnapshot ?? false,
-          snapshotOnly: params.snapshotOnly ?? false
+          snapshotOnly: params.snapshotOnly ?? false,
+          allowLookupRebuild: params.allowLookupRebuild ?? false
         })
       );
       return resp.model ?? null;
@@ -2748,7 +2756,8 @@ function createOperationsMethods(client) {
           precondition: params.precondition,
           configId: params.configId,
           supportsAsync: params.supportsAsync,
-          callbackTtlSeconds: params.callbackTtlSeconds
+          callbackTtlSeconds: params.callbackTtlSeconds,
+          capabilities: params.capabilities ?? []
         })
       );
       return resp.operation ?? null;
@@ -2769,7 +2778,8 @@ function createOperationsMethods(client) {
           precondition: params.precondition,
           isActive: params.isActive,
           supportsAsync: params.supportsAsync,
-          callbackTtlSeconds: params.callbackTtlSeconds
+          callbackTtlSeconds: params.callbackTtlSeconds,
+          capabilities: params.capabilities
         })
       );
       return resp.operation ?? null;
@@ -5063,7 +5073,15 @@ async function reconcileConfig(client, configId, manifest, options = {}) {
   const operationBaseUrl = manifest.operationBaseUrl ?? "";
   const modelConflicts = [];
   const mappingConflicts = [];
-  await reconcileModels(client, configId, manifest.models ?? [], summary, options.force ?? false, modelConflicts);
+  await reconcileModels(
+    client,
+    configId,
+    manifest.models ?? [],
+    summary,
+    options.force ?? false,
+    options.allowLookupRebuild ?? false,
+    modelConflicts
+  );
   await reconcileOperations(client, configId, manifest.operations ?? [], operationBaseUrl, summary);
   await reconcileHooks(client, configId, manifest.hooks ?? [], summary);
   await reconcileSegments(client, configId, manifest.segments ?? [], summary);
@@ -5094,7 +5112,7 @@ async function reconcileConfig(client, configId, manifest, options = {}) {
   }
   return summary;
 }
-async function reconcileModels(client, configId, models, summary, force, conflictOut) {
+async function reconcileModels(client, configId, models, summary, force, allowLookupRebuild, conflictOut) {
   const existing = await client.models.listModels({ limit: 200 });
   const allByKey = new Map(
     existing.items.map((m) => [m.key, m])
@@ -5111,6 +5129,7 @@ async function reconcileModels(client, configId, models, summary, force, conflic
     if (m.pluralName) config2.pluralName = m.pluralName;
     if (m.pluralKey) config2.pluralKey = m.pluralKey;
     if (m.description) config2.description = m.description;
+    if (m.lookups !== void 0) config2.lookups = m.lookups;
     const ex = allByKey.get(m.key);
     if (!ex) {
       plans.push({ kind: "create", model: m, config: config2 });
@@ -5179,7 +5198,8 @@ async function reconcileModels(client, configId, models, summary, force, conflic
         name: p.name,
         fields: fieldsToWrite,
         config: p.config,
-        updatePushSnapshot: true
+        updatePushSnapshot: true,
+        allowLookupRebuild
       });
       summary.models.updated++;
       summary.updatedModelIds.push(p.id);
@@ -5219,6 +5239,7 @@ async function reconcileOperations(client, configId, operations, operationBaseUr
         `\u26A0 operation "${op.key}": mode=async but timeoutMs=${op.timeoutMs} \u2014 ack should return in <10s; long timeouts mask slow extensions`
       );
     }
+    const capabilities = op.capabilities ?? [];
     if (ex) {
       const empty = {};
       await client.operations.updateOperation({
@@ -5235,7 +5256,8 @@ async function reconcileOperations(client, configId, operations, operationBaseUr
         precondition: op.precondition ?? empty,
         isActive: op.isActive,
         supportsAsync,
-        callbackTtlSeconds: op.callbackTtlSeconds
+        callbackTtlSeconds: op.callbackTtlSeconds,
+        capabilities
       });
       summary.operations.updated++;
       summary.updatedOperationIds.push(ex.id);
@@ -5257,7 +5279,8 @@ async function reconcileOperations(client, configId, operations, operationBaseUr
         precondition: op.precondition,
         configId,
         supportsAsync,
-        callbackTtlSeconds: op.callbackTtlSeconds
+        callbackTtlSeconds: op.callbackTtlSeconds,
+        capabilities
       });
       summary.operations.created++;
     }
@@ -5802,6 +5825,10 @@ function registerPushCommand(program2, globalOpts) {
     "--publish",
     "Promote updated models, operations, auth providers, profile schema, and design tokens to the published channel after the push. New resources auto-publish; this flag covers updates, which are otherwise left as drafts.",
     false
+  ).option(
+    "--rebuild",
+    "Accept lookup renames. A lookup with the same keyBy and a changed `name` override rebuilds its projection rows (old rows are dropped, new rows are re-emitted from records). Without this flag, the server rejects renames with a pointer here. Pure add / remove on lookups does not require this flag.",
+    false
   ).option("--env <path>", "Path to .env file (default: .env)").action(
     withErrorHandler(
       globalOpts,
@@ -5862,7 +5889,8 @@ function registerPushCommand(program2, globalOpts) {
             tenantId: resolved?.project.tenantId,
             projectId: resolved?.project.id,
             force: opts.force ?? false,
-            publishDesignTokens: opts.publish ?? false
+            publishDesignTokens: opts.publish ?? false,
+            allowLookupRebuild: opts.rebuild ?? false
           });
         } catch (e) {
           if (e instanceof PushConflictError) {

package/dist/lib/config-helpers.d.ts

@@ -67,6 +67,23 @@ type GenericFieldDefinitionInput = BaseFieldDefinitionInput & {
     };
 };
 type FieldDefinitionInput = SelectFieldDefinitionInput | EnumFieldDefinitionInput | GenericFieldDefinitionInput;
+/**
+ * Lookup definition — declares one indexed access path on a model.
+ *
+ * `keyBy` is the ordered list of top-level scalar field keys that make
+ * up the lookup key. Single-field lookups are common; composites are
+ * first-class (e.g. `['fromHost', 'fromPath']` for a redirect model).
+ * `name` overrides the generated GraphQL query field name; omit it to
+ * use `<typeLowerCamel>By<PascalCaseKeyFields>`.
+ *
+ * Validation runs server-side via the platform's config-write RPC —
+ * see RFC §Data model → Constraints. The CLI does no local validation
+ * here; the server's structured error surfaces verbatim on failure.
+ */
+interface LookupDefinitionInput {
+    keyBy: string[];
+    name?: string;
+}
 interface ApplyConfigModelInput {
     key: string;
     name: string;
@@ -75,6 +92,12 @@ interface ApplyConfigModelInput {
     description?: string;
     fields?: FieldDefinitionInput[];
     config?: Record<string, unknown>;
+    /**
+     * Lookup definitions for this model. Server validates: existence /
+     * scalar-type / top-level-only / caps (4 lookups, 4 fields) / GraphQL
+     * field-name regex for `name`. See RFC §Data model (config surface).
+     */
+    lookups?: LookupDefinitionInput[];
 }
 interface QuotaRule {
     /** Segment key to target (empty string or omitted = default/fallback). */
@@ -168,6 +191,28 @@ interface ApplyConfigOperationInput {
     callbackTimeoutRetryPolicy?: {
         maxRetries?: number;
     };
+    /**
+     * Capability strings stamped onto the scoped dispatch token (and its
+     * callback-window successor) so the extension can call back into
+     * api-public with the precise authorities it needs — nothing more.
+     *
+     * Per-model record access is three-part: `records:read:<model_key>`,
+     * `records:write:<model_key>`, `records:delete:<model_key>`,
+     * `records:publish:<model_key>`. List every model the operation
+     * touches; the unscoped two-part forms (`records:read` etc.) only
+     * work for admin API keys and won't satisfy customer-scoped tokens.
+     *
+     * Cross-cutting caps: `embeddings:read`, `embeddings:write`,
+     * `shares:read`, `shares:write`, `files:read`, `files:write`,
+     * `config:read`, `status:write`, and the secrets:* family. See
+     * `services/internal/scopedtoken/capabilities.go` for the full enum.
+     *
+     * `operations:complete` is auto-injected on callback tokens — never
+     * declare it here. Omitting `capabilities` (or passing an empty array)
+     * mints an authentic-but-unprivileged token; useful for operations
+     * whose extension makes no back-channel calls.
+     */
+    capabilities?: string[];
 }
 interface ApplyConfigSegmentInput {
     key: string;
@@ -453,4 +498,4 @@ interface FoirSecretsConfig {
  */
 declare function defineSecrets(config: FoirSecretsConfig): FoirSecretsConfig;
 
-export { type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigScheduleInput, type ApplyConfigSegmentInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type ExpressionPrecondition, type FieldDefinitionInput, type FoirSecretsConfig, type Precondition, type QuotaRule, type SecretDeclaration, type SecretOwnerKind, type SegmentPrecondition, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineDesignTokens, defineEnumField, defineField, defineHook, defineModel, defineOperation, definePlacement, defineSchedule, defineSecrets, defineSegment, defineSelectField };
+export { type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigScheduleInput, type ApplyConfigSegmentInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type ExpressionPrecondition, type FieldDefinitionInput, type FoirSecretsConfig, type LookupDefinitionInput, type Precondition, type QuotaRule, type SecretDeclaration, type SecretOwnerKind, type SegmentPrecondition, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineDesignTokens, defineEnumField, defineField, defineHook, defineModel, defineOperation, definePlacement, defineSchedule, defineSecrets, defineSegment, defineSelectField };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eide/foir-cli",
-  "version": "0.24.0",
+  "version": "0.25.1",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -50,7 +50,7 @@
     "@bufbuild/protovalidate": "^1.1.1",
     "@connectrpc/connect": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
-    "@eide/foir-proto-ts": "^0.59.0",
+    "@eide/foir-proto-ts": "^0.66.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "dotenv": "^16.4.5",