@foir/cli 0.72.0 → 0.73.0

package/dist/lib/config-helpers.d.ts

@@ -363,7 +363,11 @@ interface ApplyConfigOperationInput {
      *
      * Cross-cutting caps: `embeddings:read`, `embeddings:write`,
      * `files:read`, `files:write`, `customers:write` (create a customer,
-     * such as the buyer at a guest checkout),
+     * such as the buyer at a guest checkout), `customers:read:named` (read one
+     * customer the operation names, by id or by their exact email address),
+     * `customers:read` (that, and the list), `notifications:write` (notify the
+     * project's customers; an operation acting for a customer notifies that
+     * customer alone, and one at an organisation reaches only its customers),
      * `config:read`, `status:write`, and the secrets:* family. A capability
      * outside this vocabulary is refused at push, by name. See
      * `services/internal/scopedtoken/capabilities.go` for the full enum.
@@ -381,7 +385,8 @@ interface ApplyConfigOperationInput {
      * registers a root Query field resolved synchronously in-process.
      * `field` attaches a resolver field to `attachedToModel`, batched per
      * request. QUERY/FIELD operations are the new "resolver" kind and use
-     * `requestTemplate` / `responseTransform` to call an upstream endpoint.
+     * `requestTemplate` / `responseTransform` to call an upstream endpoint. A
+     * `mutation` with a `requestTemplate` is a pass-through write, called SYNC.
      */
     kind?: 'mutation' | 'query' | 'field';
     /**
@@ -412,10 +417,14 @@ interface ApplyConfigOperationInput {
         secretRef: string;
     }>;
     /**
-     * Shapes the outbound HTTP request for QUERY / FIELD operations. Template
-     * variables `{{input.X}}`, `{{parent.X}}`, `{{secret.NAME}}`,
-     * `{{context.X}}` are interpolated at dispatch time. Set `batchCapable`
-     * to send one upstream request for the whole deduped input set.
+     * The request Foir makes to a third-party host itself, for QUERY / FIELD
+     * operations and for a `mutation` called SYNC (a pass-through write, which
+     * cannot run ASYNC or from a hook). Template variables `{{input.X}}`,
+     * `{{parent.X}}`, `{{secret.NAME}}`, `{{context.X}}` are filled in at call
+     * time, each escaped for where it stands; `{{context.idempotencyKey}}` is
+     * the key the caller sent. The host is sent only what the template writes:
+     * no Foir token. Set `batchCapable` to send one upstream request for the
+     * whole deduped input set.
      */
     requestTemplate?: {
         method?: string;
@@ -427,7 +436,8 @@ interface ApplyConfigOperationInput {
     };
     /**
      * jq-style transform applied to the upstream response before it is
-     * returned to the caller. QUERY / FIELD only.
+     * returned to the caller: a QUERY / FIELD operation's, or a templated
+     * mutation's.
      */
     responseTransform?: string;
 }
@@ -772,6 +782,14 @@ interface AppSourceMappingInput {
     toModel: string;
     naturalKey: string;
     fields: Record<string, string>;
+    /**
+     * How the install holds this source, when the app offers to read it live:
+     * `'reference'` reads the host's fields live and stores the record and its
+     * key; `'sync'` keeps a copy. Omit it to leave the choice alone: a new install
+     * reads live wherever the app offers it, and a push never moves an existing
+     * install's choice unless it names one.
+     */
+    mode?: 'sync' | 'reference';
 }
 /**
  * Sink-contract mapping entry for an app install.
@@ -799,6 +817,16 @@ interface AppInput {
     source: string;
     /** Opaque settings forwarded to the app's middleware. */
     settings?: Record<string, unknown>;
+    /**
+     * The customer sign-in this install pairs with the app, for an app whose own
+     * system has customers: the key of one of the project's OAuth or OIDC
+     * customer sign-ins, declared under `authProviders`. Every identity the app
+     * names is resolved through it.
+     *
+     * `false` pairs none. Leave it out to leave the install's pairing alone: a
+     * push never removes a pairing it was not told about.
+     */
+    customerSignIn?: string | false;
     mappings?: {
         /** `false` declines an OPTIONAL source. See AppMappingDeclined. */
         sources?: Record<string, AppSourceMappingInput | AppMappingDeclined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/cli",
-  "version": "0.72.0",
+  "version": "0.73.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -65,7 +65,7 @@
     "@foir/console-routes": "0.0.0",
     "@foir/proto-ts": "0.109.0",
     "@foir/rpc-node": "0.0.0",
-    "@foir/sdk": "0.11.0"
+    "@foir/sdk": "0.18.0"
   },
   "engines": {
     "node": ">=18.0.0"