@foir/cli 0.63.0 → 0.64.1

package/dist/lib/config-helpers.d.ts

@@ -153,12 +153,16 @@ interface AccessInput {
     ownerPlane: 'customer' | 'admin' | 'project';
     /**
      * Visibility new records start at (the record descriptor modes):
-     *  - `'private'` — only the owner and explicit grants. The default.
-     *  - `'public_project'` — readable by anyone in the project.
-     *  - `'public_world'` — readable by anyone (public API).
-     * Omit to use the platform default (private).
-     */
-    defaultVisibility?: 'private' | 'public_project' | 'public_world';
+     *  - `'private'` — only the owner and explicit grants.
+     *  - `'public'` — readable by anyone in the project (CMS-style content;
+     *    including authenticated customers on the public API).
+     * On a PROJECT-plane model, omitting this defaults to `'public'` — project
+     * content is meant to be read, so it is customer-readable by default; set
+     * `'private'` explicitly to opt a project model out. Owned planes
+     * (customer/admin) are always private (the platform rejects a public default
+     * there), regardless of this value.
+     */
+    defaultVisibility?: 'private' | 'public';
 }
 interface ApplyConfigModelInput {
     key: string;
@@ -216,8 +220,17 @@ interface ApplyConfigOperationInput {
     };
     /** Retry policy for failed executions. */
     retryPolicy?: Record<string, unknown>;
-    /** Roles allowed to execute this operation. */
-    allowedRoles?: string[];
+    /**
+     * Admin permission verbs required to execute this operation.
+     *
+     * CONJUNCTIVE: the caller must hold EVERY verb listed, so adding one always
+     * narrows who may execute. Omit or pass `[]` for no gate. Entries are verbs
+     * from the admin permission vocabulary, e.g. `['content:write']`.
+     *
+     * Replaced `allowedRoles` (TTS-1049), which named role KEYS. Role keys are
+     * yours to choose, so renaming a role silently changed who could execute.
+     */
+    allowedPermissions?: string[];
     /** Precondition that must be met before execution (e.g., segment membership). */
     precondition?: Precondition;
     /**
@@ -358,6 +371,37 @@ interface ApplyConfigContextDimensionInput {
     sourceModelKey?: string;
     defaultRecordKey?: string;
 }
+/**
+ * A project locale. Natural key is the locale `code` (e.g. "en-GB").
+ * Reconciled by `foir push` — declared locales are created / updated. Locales
+ * are also admin-editable and carry no config ownership, so a push never
+ * DELETES a locale it did not declare (create/update only).
+ */
+interface ApplyConfigLocaleInput {
+    /** BCP-47 locale code, immutable after create (e.g. "en", "fr-CA"). */
+    locale: string;
+    displayName: string;
+    nativeName?: string;
+    isDefault?: boolean;
+    isActive?: boolean;
+    isRtl?: boolean;
+    /** Locale code to fall back to when a translation is missing. */
+    fallbackLocale?: string;
+}
+/**
+ * A variant-catalog entry — a named targeting definition. Natural key is `key`.
+ * Reconciled by `foir push` (create/update only, same rationale as locales).
+ */
+interface ApplyConfigVariantCatalogEntryInput {
+    key: string;
+    name: string;
+    description?: string;
+    /** RuleExpression object evaluated to decide whether this variant applies. */
+    targetingRules?: Record<string, unknown>;
+    priority?: number;
+    isDefault?: boolean;
+    isActive?: boolean;
+}
 interface ApplyConfigScheduleInput {
     /** Unique key for this schedule. Defaults to operationKey if not provided. */
     key?: string;
@@ -449,6 +493,23 @@ interface ApplyConfigRelyingPartyInput {
      * callback. Empty falls back to the redirect URI. Customer-lane only.
      */
     postLoginUrl?: string;
+    /**
+     * Browser origins allowed to exchange the first-party session cookie for an
+     * access token — i.e. the origins your SPA runs on, e.g.
+     * `['https://app.eide.clothing']`. Exact origins: scheme + host + optional
+     * port, https only, no wildcards and no paths.
+     *
+     * This is the WHOLE allowlist for the credentialed session endpoints, matched
+     * exactly the way `redirectUris` are. List none and the SPA session does not
+     * work — there is no domain-wide default, deliberately: one would grant every
+     * origin on your domain, including a subdomain takeover or anything serving
+     * user content there.
+     *
+     * Absent leaves the list untouched; `[]` clears it. Customer-lane only, and
+     * only meaningful alongside a verified `customDomains` entry (the cookie is
+     * only ever issued on one).
+     */
+    allowedOrigins?: string[];
 }
 interface ApplyConfigPlacementInput {
     type: string;
@@ -468,14 +529,10 @@ interface ApplyConfigHookInput {
     description?: string;
     /** Lifecycle event that triggers this hook. */
     event: string;
-    /** Target type — defaults to 'operation'. */
-    type?: string;
     /** Key of the operation to execute. */
     operationKey?: string;
     /** Filter to scope the hook (e.g., `{ modelKey: 'redirect' }`). */
     filter?: Record<string, unknown>;
-    /** Notification config for notification-type hooks. */
-    notificationConfig?: Record<string, unknown>;
     /** Whether the hook is active. Defaults to true. */
     isActive?: boolean;
 }
@@ -599,11 +656,20 @@ interface ApplyConfigProjectSettingsInput {
      */
     customerWelcomeEmailEnabled?: boolean;
     /**
-     * Whether the public CustomerRegister mutation is allowed. Default true.
-     * When false, customers can only be created via secret-key admin paths
-     * (CreateCustomer, CreateCustomerInvitation).
+     * Self-serve customer signup mode. Default `public`. `restricted` accepts only
+     * invited emails, `waitlist` queues signups for approval, `closed` disables
+     * self-serve signup entirely.
      */
-    customerSignupEnabled?: boolean;
+    signupMode?: SignupModeName;
+    /**
+     * Email hygiene + allow/block restrictions applied to `public`-mode signups.
+     * `blockSubaddresses` requires the canonical inbox form (rejects subaddress
+     * tags, Gmail dots, and the googlemail alias domain). An allowlist, when
+     * non-empty, is exclusive and beats the blocklist. List patterns: exact
+     * `user@domain.com`, whole domain (`domain.com`), wildcard subdomains
+     * (`*.domain.com`).
+     */
+    signupRestrictions?: SignupRestrictionsInput;
     /**
      * Whether email/password customer login is exposed. Default true. Disable
      * for a passwordless project (one-time codes or single sign-on only).
@@ -614,6 +680,15 @@ interface ApplyConfigProjectSettingsInput {
      */
     customerOtpEnabled?: boolean;
 }
+/** Self-serve signup mode, as authored in config-as-code. */
+type SignupModeName = 'public' | 'restricted' | 'waitlist' | 'closed';
+/** Email hygiene + allow/block restrictions, as authored in config-as-code. */
+interface SignupRestrictionsInput {
+    blockSubaddresses?: boolean;
+    blockDisposable?: boolean;
+    allowlist?: string[];
+    blocklist?: string[];
+}
 /**
  * Project pin + declarative settings. The pin (id / tenantId) is a guard
  * against pushing one folder's config into another folder's project; the
@@ -670,6 +745,10 @@ interface ApplyConfigInput {
     models?: ApplyConfigModelInput[];
     operations?: ApplyConfigOperationInput[];
     contextDimensions?: ApplyConfigContextDimensionInput[];
+    /** Project locales, reconciled by `foir push` (create/update only). */
+    locales?: ApplyConfigLocaleInput[];
+    /** Variant-catalog entries, reconciled by `foir push` (create/update only). */
+    variantCatalog?: ApplyConfigVariantCatalogEntryInput[];
     schedules?: ApplyConfigScheduleInput[];
     hooks?: ApplyConfigHookInput[];
     authProviders?: ApplyConfigAuthProviderInput[];
@@ -714,6 +793,10 @@ declare function defineEnumField(field: EnumFieldDefinitionInput): FieldDefiniti
 declare function defineOperation(operation: ApplyConfigOperationInput): ApplyConfigOperationInput;
 /** Define a context dimension (segment rule / model source) with type safety. */
 declare function defineContextDimension(dimension: ApplyConfigContextDimensionInput): ApplyConfigContextDimensionInput;
+/** Define a project locale. */
+declare function defineLocale(locale: ApplyConfigLocaleInput): ApplyConfigLocaleInput;
+/** Define a variant-catalog entry (targeting definition). */
+declare function defineVariantCatalogEntry(entry: ApplyConfigVariantCatalogEntryInput): ApplyConfigVariantCatalogEntryInput;
 /** Define a cron schedule for an operation. */
 declare function defineSchedule(schedule: ApplyConfigScheduleInput): ApplyConfigScheduleInput;
 /** Define an auth provider. */
@@ -758,4 +841,4 @@ interface FoirSecretsConfig {
  */
 declare function defineSecrets(config: FoirSecretsConfig): FoirSecretsConfig;
 
-export { type AccessInput, type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigContextDimensionInput, type ApplyConfigCustomerRoleInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigRelyingPartyInput, type ApplyConfigRelyingPartyLoginMethods, type ApplyConfigScheduleInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type FieldAccessInput, type FieldDefinitionInput, type FieldRelationshipInput, type FoirSecretsConfig, type LookupDefinitionInput, type QuotaRule, type ReferenceFieldConfig, type ReferenceFieldDefinitionInput, type SecretDeclaration, type SecretOwnerKind, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineContextDimension, defineDesignTokens, defineEnumField, defineField, defineHook, defineModel, defineOperation, definePlacement, defineRelyingParty, defineSchedule, defineSecrets, defineSelectField };
+export { type AccessInput, type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigContextDimensionInput, type ApplyConfigCustomerRoleInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigLocaleInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigRelyingPartyInput, type ApplyConfigRelyingPartyLoginMethods, type ApplyConfigScheduleInput, type ApplyConfigVariantCatalogEntryInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type FieldAccessInput, type FieldDefinitionInput, type FieldRelationshipInput, type FoirSecretsConfig, type LookupDefinitionInput, type QuotaRule, type ReferenceFieldConfig, type ReferenceFieldDefinitionInput, type SecretDeclaration, type SecretOwnerKind, type SelectFieldConfig, type SelectFieldDefinitionInput, type SignupModeName, type SignupRestrictionsInput, defineAuthProvider, defineConfig, defineContextDimension, defineDesignTokens, defineEnumField, defineField, defineHook, defineLocale, defineModel, defineOperation, definePlacement, defineRelyingParty, defineSchedule, defineSecrets, defineSelectField, defineVariantCatalogEntry };

package/dist/lib/config-helpers.js

@@ -23,6 +23,12 @@ function defineOperation(operation) {
 function defineContextDimension(dimension) {
   return dimension;
 }
+function defineLocale(locale) {
+  return locale;
+}
+function defineVariantCatalogEntry(entry) {
+  return entry;
+}
 function defineSchedule(schedule) {
   return schedule;
 }
@@ -49,11 +55,13 @@ export {
   defineEnumField,
   defineField,
   defineHook,
+  defineLocale,
   defineModel,
   defineOperation,
   definePlacement,
   defineRelyingParty,
   defineSchedule,
   defineSecrets,
-  defineSelectField
+  defineSelectField,
+  defineVariantCatalogEntry
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/cli",
-  "version": "0.63.0",
+  "version": "0.64.1",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -37,6 +37,7 @@
     "@bufbuild/protovalidate": "^1.1.1",
     "@connectrpc/connect": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "dotenv": "^16.4.5",
@@ -55,8 +56,10 @@
     "tsx": "^4.20.0",
     "typescript": "5.9.2",
     "vitest": "^3.2.4",
+    "@foir/console-routes": "0.0.0",
+    "@foir/proto-ts": "0.109.0",
     "@foir/rpc-node": "0.0.0",
-    "@foir/proto-ts": "0.109.0"
+    "@foir/sdk": "0.7.0"
   },
   "engines": {
     "node": ">=18.0.0"