@foir/cli 0.63.0 → 0.64.0

package/dist/lib/config-helpers.d.ts

@@ -449,6 +449,23 @@ interface ApplyConfigRelyingPartyInput {
      * callback. Empty falls back to the redirect URI. Customer-lane only.
      */
     postLoginUrl?: string;
+    /**
+     * Browser origins allowed to exchange the first-party session cookie for an
+     * access token — i.e. the origins your SPA runs on, e.g.
+     * `['https://app.eide.clothing']`. Exact origins: scheme + host + optional
+     * port, https only, no wildcards and no paths.
+     *
+     * This is the WHOLE allowlist for the credentialed session endpoints, matched
+     * exactly the way `redirectUris` are. List none and the SPA session does not
+     * work — there is no domain-wide default, deliberately: one would grant every
+     * origin on your domain, including a subdomain takeover or anything serving
+     * user content there.
+     *
+     * Absent leaves the list untouched; `[]` clears it. Customer-lane only, and
+     * only meaningful alongside a verified `customDomains` entry (the cookie is
+     * only ever issued on one).
+     */
+    allowedOrigins?: string[];
 }
 interface ApplyConfigPlacementInput {
     type: string;
@@ -468,14 +485,10 @@ interface ApplyConfigHookInput {
     description?: string;
     /** Lifecycle event that triggers this hook. */
     event: string;
-    /** Target type — defaults to 'operation'. */
-    type?: string;
     /** Key of the operation to execute. */
     operationKey?: string;
     /** Filter to scope the hook (e.g., `{ modelKey: 'redirect' }`). */
     filter?: Record<string, unknown>;
-    /** Notification config for notification-type hooks. */
-    notificationConfig?: Record<string, unknown>;
     /** Whether the hook is active. Defaults to true. */
     isActive?: boolean;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/cli",
-  "version": "0.63.0",
+  "version": "0.64.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {