@foir/cli 0.77.0 → 0.78.0

package/dist/lib/config-helpers.d.ts

@@ -704,14 +704,30 @@ interface ApplyConfigHookInput {
 interface ApplyConfigApiKeyInput {
     /** Name for this API key (e.g. "Tilly iOS", "Tilly CRM sync"). */
     name: string;
-    /** Key type: 'public' for your app, 'secret' for a third-party client's own server. */
-    keyType: 'public' | 'secret';
+    /**
+     * What the key is for. You choose it, and the platform holds the key to what
+     * that kind may hold and give:
+     *
+     *  - `'publishable'` sits in a web page or an app, where anyone can read it.
+     *    It gives a visitor only what is safe to give everyone.
+     *  - `'server'` is held by the server that renders your pages. It is a
+     *    publishable key that may also say who and where its visitor is
+     *    (`visitors:forward`), and it never goes to a browser.
+     *  - `'admin'` is a machine's own: a sync job, a pipeline, a tool. It does
+     *    what it holds, gives nobody anything, and nobody signs in through it.
+     *    It expires.
+     *
+     * A key's kind never changes. A config that declares another kind for a key
+     * that already exists is refused: declare a new key under a new name.
+     */
+    kind: 'publishable' | 'server' | 'admin';
     /** Environment variable name to write the key to in .env (e.g. "FOIR_PUBLIC_KEY"). */
     envVar: string;
     /**
-     * What the key holds: the most anyone may do through it, in the permission
-     * catalogue's names (e.g. ["records:read", "records:write"]). A secret key
-     * may hold ["*"].
+     * What the key holds, in the permission catalogue's names (e.g.
+     * ["records:read", "records:write"]): for a publishable or a server key the
+     * most a signed-in user may do through it, and for an admin key what it
+     * does. An admin key may hold ["*"].
      *
      * Declared for every key. Nothing is filled in, so a key declared without
      * it would be minted holding nothing, and a push refuses one.
@@ -721,13 +737,14 @@ interface ApplyConfigApiKeyInput {
      */
     grants: string[];
     /**
-     * What the key gives whoever comes through it, in the same names: a visitor
-     * with no sign-in, on a public key, and a signed-in user beneath their role,
-     * on either kind.
+     * What a publishable or a server key gives whoever comes through it, in the
+     * same names: a visitor with no sign-in, and a signed-in user beneath their
+     * role. An admin key gives nobody anything, and one declared with this list
+     * is refused.
      *
      * NOTHING IS FILLED IN. A key declared without this list gives a visitor
-     * nothing, whatever it holds: a public key holding `records:read` and no
-     * list here is a key no visitor can read with. Name each read a visitor
+     * nothing, whatever it holds: a publishable key holding `records:read` and
+     * no list here is a key no visitor can read with. Name each read a visitor
      * needs. A visitor may also be given one model to submit into
      * (`records:create:<model>`) and one operation to run
      * (`operations:execute:<operation>`), each naming something this config
@@ -737,6 +754,17 @@ interface ApplyConfigApiKeyInput {
      * place. Left out, a push leaves what the key gives as it is.
      */
     baselineGrants?: string[];
+    /**
+     * An admin key only: how long it lives from the push that makes it, in days
+     * (e.g. "90d", which is what it is given when nothing is said, up to
+     * "365d"). A publishable or a server key never expires, and one declared
+     * with this is refused.
+     *
+     * It is read when the key is made. A push never renews a key that exists:
+     * renew it with `foir api-keys renew`, so that a key is kept alive by
+     * somebody deciding to and not by a pipeline that happens to run.
+     */
+    expiresIn?: string;
     /** Restrict the key to specific model keys (e.g. ["tilly_note", "tilly_block"]). */
     allowedModels?: string[];
     /** Restrict file uploads: a MIME type ("image/png"), a whole type ("image/*"), or IMAGE, VIDEO, FILE. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/cli",
-  "version": "0.77.0",
+  "version": "0.78.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -65,7 +65,7 @@
     "@foir/assistant": "0.0.0",
     "@foir/proto-ts": "0.109.0",
     "@foir/rpc-node": "0.0.0",
-    "@foir/sdk": "0.20.0",
+    "@foir/sdk": "0.21.0",
     "@foir/console-routes": "0.0.0"
   },
   "engines": {