@eide/foir-cli 0.42.0 → 0.44.0

package/dist/cli.js

@@ -980,7 +980,8 @@ function createIdentityMethods(client) {
           rateLimitPerHour: params.rateLimitPerHour,
           allowedModels: params.allowedModels,
           allowedFileTypes: params.allowedFileTypes,
-          scopes: params.scopes
+          scopes: params.scopes,
+          configId: params.configId
         })
       );
       return { apiKey: resp.apiKey ?? null };
@@ -1339,7 +1340,11 @@ function jsFieldToProto(f) {
     itemType: f.itemType,
     storage: f.storage,
     templateZone: f.templateZone,
-    zoneOrder: f.zoneOrder
+    zoneOrder: f.zoneOrder,
+    // Per-field {read, write} principal policy. foir.config.ts authors set
+    // e.g. access: { write: ['service', 'admin'] } to lock a field; the
+    // platform enforces it on every write path.
+    access: f.access
   });
 }
 function jsConfigToProto(c) {
@@ -2421,7 +2426,10 @@ function createSettingsMethods(client) {
             required: f.required,
             helpText: f.helpText,
             placeholder: f.placeholder,
-            config: f.config
+            config: f.config,
+            // Per-field write/read principal policy — e.g. lock `plan` to
+            // write:[service, admin] so a customer can't self-grant.
+            access: f.access
           })),
           publicFields: params.publicFields
         })
@@ -5192,6 +5200,7 @@ async function reconcileConfig(client, configId, manifest, options = {}) {
   await reconcileDesignTokens(client, manifest, summary, options.publishDesignTokens ?? false);
   await reconcileApiKeys(
     client,
+    configId,
     manifest.key,
     manifest.apiKeys ?? [],
     summary,
@@ -5645,7 +5654,7 @@ async function reconcileDesignTokens(client, manifest, summary, publishAfterAppl
     summary.designTokensPublished = true;
   }
 }
-async function reconcileApiKeys(client, configKey, apiKeys, summary, rotateKeys) {
+async function reconcileApiKeys(client, configId, configKey, apiKeys, summary, rotateKeys) {
   if (apiKeys.length === 0) return;
   const existing = await client.identity.listApiKeys({ first: 200 });
   const existingByName = new Map(
@@ -5677,7 +5686,8 @@ async function reconcileApiKeys(client, configKey, apiKeys, summary, rotateKeys)
         keyType: key.keyType === "secret" ? 2 : 1,
         allowedModels: key.allowedModels,
         allowedFileTypes: key.allowedFileTypes,
-        scopes: key.scopes
+        scopes: key.scopes,
+        configId
       });
       rawKey = result?.apiKey?.rawKey;
     }

package/dist/lib/config-helpers.d.ts

@@ -40,6 +40,17 @@ interface EnumFieldConfig {
     multiple?: boolean;
     default?: string | string[];
 }
+/**
+ * Per-field {read, write} principal allow-lists. A non-empty `write` names
+ * the only principals permitted to write the field — "public" | "self" |
+ * "scoped" | "service" | "admin" — and any other principal is rejected by the
+ * platform on every write path. Omit for the default (writable by any
+ * authenticated principal). `read` governs client API exposure only.
+ */
+interface FieldAccessInput {
+    read?: string[];
+    write?: string[];
+}
 interface BaseFieldDefinitionInput {
     key: string;
     label?: string;
@@ -51,6 +62,7 @@ interface BaseFieldDefinitionInput {
     storage?: string;
     templateZone?: string;
     zoneOrder?: number;
+    access?: FieldAccessInput;
 }
 type SelectFieldDefinitionInput = BaseFieldDefinitionInput & {
     type: 'select';
@@ -554,4 +566,4 @@ interface FoirSecretsConfig {
  */
 declare function defineSecrets(config: FoirSecretsConfig): FoirSecretsConfig;
 
-export { type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigScheduleInput, type ApplyConfigSegmentInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type ExpressionPrecondition, type FieldDefinitionInput, type FoirSecretsConfig, type LookupDefinitionInput, type Precondition, type QuotaRule, type SecretDeclaration, type SecretOwnerKind, type SegmentPrecondition, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineDesignTokens, defineEnumField, defineField, defineHook, defineModel, defineOperation, definePlacement, defineSchedule, defineSecrets, defineSegment, defineSelectField };
+export { type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigScheduleInput, type ApplyConfigSegmentInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type ExpressionPrecondition, type FieldAccessInput, type FieldDefinitionInput, type FoirSecretsConfig, type LookupDefinitionInput, type Precondition, type QuotaRule, type SecretDeclaration, type SecretOwnerKind, type SegmentPrecondition, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineDesignTokens, defineEnumField, defineField, defineHook, defineModel, defineOperation, definePlacement, defineSchedule, defineSecrets, defineSegment, defineSelectField };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eide/foir-cli",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -50,7 +50,7 @@
     "@bufbuild/protovalidate": "^1.1.1",
     "@connectrpc/connect": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
-    "@eide/foir-proto-ts": "^0.97.0",
+    "@eide/foir-proto-ts": "^0.100.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "dotenv": "^16.4.5",