@eide/foir-cli 0.43.0 → 0.45.0

package/dist/cli.js

@@ -1326,6 +1326,20 @@ import {
   RestoreModelVersionRequestSchema,
   PublishModelRequestSchema
 } from "@eide/foir-proto-ts/models/v1/models_pb";
+function buildModelWhere(p) {
+  const clauses = [];
+  if (p.search) {
+    clauses.push({
+      OR: [{ name: { contains: p.search } }, { key: { contains: p.search } }]
+    });
+  }
+  if (p.category) clauses.push({ category: { eq: p.category } });
+  if (p.configId) clauses.push({ configId: { eq: p.configId } });
+  if (p.inline !== void 0) clauses.push({ inline: { eq: p.inline } });
+  if (clauses.length === 0) return void 0;
+  if (clauses.length === 1) return clauses[0];
+  return { AND: clauses };
+}
 function jsFieldToProto(f) {
   return create3(ProtoFieldSchema, {
     id: f.id,
@@ -1340,7 +1354,11 @@ function jsFieldToProto(f) {
     itemType: f.itemType,
     storage: f.storage,
     templateZone: f.templateZone,
-    zoneOrder: f.zoneOrder
+    zoneOrder: f.zoneOrder,
+    // Per-field {read, write} principal policy. foir.config.ts authors set
+    // e.g. access: { write: ['service', 'admin'] } to lock a field; the
+    // platform enforces it on every write path.
+    access: f.access
   });
 }
 function jsConfigToProto(c) {
@@ -1403,9 +1421,7 @@ function createModelsMethods(client) {
     async listModels(params = {}) {
       const resp = await client.listModels(
         create3(ListModelsRequestSchema, {
-          search: params.search,
-          category: params.category,
-          configId: params.configId,
+          where: buildModelWhere(params),
           first: params.first ?? DEFAULT_PAGE_SIZE,
           after: params?.after
         })
@@ -2422,7 +2438,10 @@ function createSettingsMethods(client) {
             required: f.required,
             helpText: f.helpText,
             placeholder: f.placeholder,
-            config: f.config
+            config: f.config,
+            // Per-field write/read principal policy — e.g. lock `plan` to
+            // write:[service, admin] so a customer can't self-grant.
+            access: f.access
           })),
           publicFields: params.publicFields
         })

package/dist/lib/config-helpers.d.ts

@@ -40,6 +40,17 @@ interface EnumFieldConfig {
     multiple?: boolean;
     default?: string | string[];
 }
+/**
+ * Per-field {read, write} principal allow-lists. A non-empty `write` names
+ * the only principals permitted to write the field — "public" | "self" |
+ * "scoped" | "service" | "admin" — and any other principal is rejected by the
+ * platform on every write path. Omit for the default (writable by any
+ * authenticated principal). `read` governs client API exposure only.
+ */
+interface FieldAccessInput {
+    read?: string[];
+    write?: string[];
+}
 interface BaseFieldDefinitionInput {
     key: string;
     label?: string;
@@ -51,6 +62,7 @@ interface BaseFieldDefinitionInput {
     storage?: string;
     templateZone?: string;
     zoneOrder?: number;
+    access?: FieldAccessInput;
 }
 type SelectFieldDefinitionInput = BaseFieldDefinitionInput & {
     type: 'select';
@@ -554,4 +566,4 @@ interface FoirSecretsConfig {
  */
 declare function defineSecrets(config: FoirSecretsConfig): FoirSecretsConfig;
 
-export { type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigScheduleInput, type ApplyConfigSegmentInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type ExpressionPrecondition, type FieldDefinitionInput, type FoirSecretsConfig, type LookupDefinitionInput, type Precondition, type QuotaRule, type SecretDeclaration, type SecretOwnerKind, type SegmentPrecondition, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineDesignTokens, defineEnumField, defineField, defineHook, defineModel, defineOperation, definePlacement, defineSchedule, defineSecrets, defineSegment, defineSelectField };
+export { type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigScheduleInput, type ApplyConfigSegmentInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type ExpressionPrecondition, type FieldAccessInput, type FieldDefinitionInput, type FoirSecretsConfig, type LookupDefinitionInput, type Precondition, type QuotaRule, type SecretDeclaration, type SecretOwnerKind, type SegmentPrecondition, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineDesignTokens, defineEnumField, defineField, defineHook, defineModel, defineOperation, definePlacement, defineSchedule, defineSecrets, defineSegment, defineSelectField };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eide/foir-cli",
-  "version": "0.43.0",
+  "version": "0.45.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -50,7 +50,7 @@
     "@bufbuild/protovalidate": "^1.1.1",
     "@connectrpc/connect": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
-    "@eide/foir-proto-ts": "^0.99.0",
+    "@eide/foir-proto-ts": "^0.101.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "dotenv": "^16.4.5",