@foir/cli 0.64.0 → 0.65.0

package/dist/lib/config-helpers.d.ts

@@ -153,12 +153,23 @@ interface AccessInput {
     ownerPlane: 'customer' | 'admin' | 'project';
     /**
      * Visibility new records start at (the record descriptor modes):
-     *  - `'private'` — only the owner and explicit grants. The default.
-     *  - `'public_project'` — readable by anyone in the project.
-     *  - `'public_world'` — readable by anyone (public API).
-     * Omit to use the platform default (private).
+     *  - `'private'` — only the owner and explicit grants.
+     *  - `'public'` — readable by anyone with API access, including signed-in
+     *    customers on the public API.
+     *
+     * On a PROJECT-plane model, omitting this defaults to `'public'` at
+     * CREATION — project content is meant to be read, and `'private'` there does
+     * not mean what it looks like: a project record has no owner, so it stays
+     * readable by anonymous and server-side callers while being hidden from
+     * signed-in customers. Set `'private'` explicitly to opt a project model out.
+     *
+     * The default is applied by the platform, at the create path only. Omitting it
+     * on a model that already exists means "leave it alone" — it will not reset a
+     * visibility you changed in the console. Owned planes (customer/admin) are
+     * always private (the platform rejects a public default there) regardless of
+     * this value.
      */
-    defaultVisibility?: 'private' | 'public_project' | 'public_world';
+    defaultVisibility?: 'private' | 'public';
 }
 interface ApplyConfigModelInput {
     key: string;
@@ -216,8 +227,17 @@ interface ApplyConfigOperationInput {
     };
     /** Retry policy for failed executions. */
     retryPolicy?: Record<string, unknown>;
-    /** Roles allowed to execute this operation. */
-    allowedRoles?: string[];
+    /**
+     * Admin permission verbs required to execute this operation.
+     *
+     * CONJUNCTIVE: the caller must hold EVERY verb listed, so adding one always
+     * narrows who may execute. Omit or pass `[]` for no gate. Entries are verbs
+     * from the admin permission vocabulary, e.g. `['content:write']`.
+     *
+     * Replaced `allowedRoles` (TTS-1049), which named role KEYS. Role keys are
+     * yours to choose, so renaming a role silently changed who could execute.
+     */
+    allowedPermissions?: string[];
     /** Precondition that must be met before execution (e.g., segment membership). */
     precondition?: Precondition;
     /**
@@ -358,6 +378,37 @@ interface ApplyConfigContextDimensionInput {
     sourceModelKey?: string;
     defaultRecordKey?: string;
 }
+/**
+ * A project locale. Natural key is the locale `code` (e.g. "en-GB").
+ * Reconciled by `foir push` — declared locales are created / updated. Locales
+ * are also admin-editable and carry no config ownership, so a push never
+ * DELETES a locale it did not declare (create/update only).
+ */
+interface ApplyConfigLocaleInput {
+    /** BCP-47 locale code, immutable after create (e.g. "en", "fr-CA"). */
+    locale: string;
+    displayName: string;
+    nativeName?: string;
+    isDefault?: boolean;
+    isActive?: boolean;
+    isRtl?: boolean;
+    /** Locale code to fall back to when a translation is missing. */
+    fallbackLocale?: string;
+}
+/**
+ * A variant-catalog entry — a named targeting definition. Natural key is `key`.
+ * Reconciled by `foir push` (create/update only, same rationale as locales).
+ */
+interface ApplyConfigVariantCatalogEntryInput {
+    key: string;
+    name: string;
+    description?: string;
+    /** RuleExpression object evaluated to decide whether this variant applies. */
+    targetingRules?: Record<string, unknown>;
+    priority?: number;
+    isDefault?: boolean;
+    isActive?: boolean;
+}
 interface ApplyConfigScheduleInput {
     /** Unique key for this schedule. Defaults to operationKey if not provided. */
     key?: string;
@@ -612,11 +663,20 @@ interface ApplyConfigProjectSettingsInput {
      */
     customerWelcomeEmailEnabled?: boolean;
     /**
-     * Whether the public CustomerRegister mutation is allowed. Default true.
-     * When false, customers can only be created via secret-key admin paths
-     * (CreateCustomer, CreateCustomerInvitation).
+     * Self-serve customer signup mode. Default `public`. `restricted` accepts only
+     * invited emails, `waitlist` queues signups for approval, `closed` disables
+     * self-serve signup entirely.
      */
-    customerSignupEnabled?: boolean;
+    signupMode?: SignupModeName;
+    /**
+     * Email hygiene + allow/block restrictions applied to `public`-mode signups.
+     * `blockSubaddresses` requires the canonical inbox form (rejects subaddress
+     * tags, Gmail dots, and the googlemail alias domain). An allowlist, when
+     * non-empty, is exclusive and beats the blocklist. List patterns: exact
+     * `user@domain.com`, whole domain (`domain.com`), wildcard subdomains
+     * (`*.domain.com`).
+     */
+    signupRestrictions?: SignupRestrictionsInput;
     /**
      * Whether email/password customer login is exposed. Default true. Disable
      * for a passwordless project (one-time codes or single sign-on only).
@@ -627,6 +687,15 @@ interface ApplyConfigProjectSettingsInput {
      */
     customerOtpEnabled?: boolean;
 }
+/** Self-serve signup mode, as authored in config-as-code. */
+type SignupModeName = 'public' | 'restricted' | 'waitlist' | 'closed';
+/** Email hygiene + allow/block restrictions, as authored in config-as-code. */
+interface SignupRestrictionsInput {
+    blockSubaddresses?: boolean;
+    blockDisposable?: boolean;
+    allowlist?: string[];
+    blocklist?: string[];
+}
 /**
  * Project pin + declarative settings. The pin (id / tenantId) is a guard
  * against pushing one folder's config into another folder's project; the
@@ -683,6 +752,10 @@ interface ApplyConfigInput {
     models?: ApplyConfigModelInput[];
     operations?: ApplyConfigOperationInput[];
     contextDimensions?: ApplyConfigContextDimensionInput[];
+    /** Project locales, reconciled by `foir push` (create/update only). */
+    locales?: ApplyConfigLocaleInput[];
+    /** Variant-catalog entries, reconciled by `foir push` (create/update only). */
+    variantCatalog?: ApplyConfigVariantCatalogEntryInput[];
     schedules?: ApplyConfigScheduleInput[];
     hooks?: ApplyConfigHookInput[];
     authProviders?: ApplyConfigAuthProviderInput[];
@@ -727,6 +800,10 @@ declare function defineEnumField(field: EnumFieldDefinitionInput): FieldDefiniti
 declare function defineOperation(operation: ApplyConfigOperationInput): ApplyConfigOperationInput;
 /** Define a context dimension (segment rule / model source) with type safety. */
 declare function defineContextDimension(dimension: ApplyConfigContextDimensionInput): ApplyConfigContextDimensionInput;
+/** Define a project locale. */
+declare function defineLocale(locale: ApplyConfigLocaleInput): ApplyConfigLocaleInput;
+/** Define a variant-catalog entry (targeting definition). */
+declare function defineVariantCatalogEntry(entry: ApplyConfigVariantCatalogEntryInput): ApplyConfigVariantCatalogEntryInput;
 /** Define a cron schedule for an operation. */
 declare function defineSchedule(schedule: ApplyConfigScheduleInput): ApplyConfigScheduleInput;
 /** Define an auth provider. */
@@ -771,4 +848,4 @@ interface FoirSecretsConfig {
  */
 declare function defineSecrets(config: FoirSecretsConfig): FoirSecretsConfig;
 
-export { type AccessInput, type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigContextDimensionInput, type ApplyConfigCustomerRoleInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigRelyingPartyInput, type ApplyConfigRelyingPartyLoginMethods, type ApplyConfigScheduleInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type FieldAccessInput, type FieldDefinitionInput, type FieldRelationshipInput, type FoirSecretsConfig, type LookupDefinitionInput, type QuotaRule, type ReferenceFieldConfig, type ReferenceFieldDefinitionInput, type SecretDeclaration, type SecretOwnerKind, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineContextDimension, defineDesignTokens, defineEnumField, defineField, defineHook, defineModel, defineOperation, definePlacement, defineRelyingParty, defineSchedule, defineSecrets, defineSelectField };
+export { type AccessInput, type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigContextDimensionInput, type ApplyConfigCustomerRoleInput, type ApplyConfigDesignTokensInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigLocaleInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigRelyingPartyInput, type ApplyConfigRelyingPartyLoginMethods, type ApplyConfigScheduleInput, type ApplyConfigVariantCatalogEntryInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type FieldAccessInput, type FieldDefinitionInput, type FieldRelationshipInput, type FoirSecretsConfig, type LookupDefinitionInput, type QuotaRule, type ReferenceFieldConfig, type ReferenceFieldDefinitionInput, type SecretDeclaration, type SecretOwnerKind, type SelectFieldConfig, type SelectFieldDefinitionInput, type SignupModeName, type SignupRestrictionsInput, defineAuthProvider, defineConfig, defineContextDimension, defineDesignTokens, defineEnumField, defineField, defineHook, defineLocale, defineModel, defineOperation, definePlacement, defineRelyingParty, defineSchedule, defineSecrets, defineSelectField, defineVariantCatalogEntry };

package/dist/lib/config-helpers.js

@@ -23,6 +23,12 @@ function defineOperation(operation) {
 function defineContextDimension(dimension) {
   return dimension;
 }
+function defineLocale(locale) {
+  return locale;
+}
+function defineVariantCatalogEntry(entry) {
+  return entry;
+}
 function defineSchedule(schedule) {
   return schedule;
 }
@@ -49,11 +55,13 @@ export {
   defineEnumField,
   defineField,
   defineHook,
+  defineLocale,
   defineModel,
   defineOperation,
   definePlacement,
   defineRelyingParty,
   defineSchedule,
   defineSecrets,
-  defineSelectField
+  defineSelectField,
+  defineVariantCatalogEntry
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/cli",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -37,6 +37,8 @@
     "@bufbuild/protovalidate": "^1.1.1",
     "@connectrpc/connect": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "ai": "^7.0.29",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "dotenv": "^16.4.5",
@@ -55,8 +57,11 @@
     "tsx": "^4.20.0",
     "typescript": "5.9.2",
     "vitest": "^3.2.4",
+    "@foir/assistant": "0.0.0",
+    "@foir/proto-ts": "0.109.0",
+    "@foir/console-routes": "0.0.0",
     "@foir/rpc-node": "0.0.0",
-    "@foir/proto-ts": "0.109.0"
+    "@foir/sdk": "0.9.0"
   },
   "engines": {
     "node": ">=18.0.0"