@vxil/cli 0.16.1 → 0.17.0

package/dist/config.d.ts

@@ -106,6 +106,21 @@ export interface CollectionDef {
      *  with a regression test on each — an attribute read by no enforcing path ships
      *  inert (the validation.unique / owner_field precedent). */
     public?: boolean;
+    /** What a VERIFIED end user (a thin-client key + a session) may do on this
+     *  collection (https://vxil.com/docs/guide/09-security-and-multitenancy):
+     *    'readwrite' (default) — read and write (owner-scoped when ownerField is set);
+     *    'read'      — read only (owner-scoped as above); every end-user write
+     *                  (create, update, $inc, delete, publish, transaction step,
+     *                  filtered delete, batch write — and a delete elsewhere
+     *                  whose on_delete cascade / set_null would change a row
+     *                  here) is `403 server_only`;
+     *    'none'      — no end-user reads or writes at all, even with ownerField.
+     *  Server keys (and platform writes such as a jobs status mirror) are never
+     *  affected. Stored on the collection (model data, not a config leaf) and
+     *  carried by BOTH push paths; widening ('read'/'none' → 'readwrite') needs
+     *  `vxil push --allow-destructive`. Any other value fails `vxil plan` /
+     *  `vxil push` (it never falls back to 'readwrite'). */
+    endUserAccess?: 'readwrite' | 'read' | 'none';
     /** Per-record action buttons (guide ch. 4): `[{ key, label, fn }]`, stored on
      *  the collection (model data, not a config leaf). The dashboard renders one
      *  button per action on each record row; `POST /v1/cms/items/:coll/:id/actions/

package/dist/vxil.js

@@ -4543,9 +4543,9 @@ function lowerAllTriggerBindings(def, name) {
   return bindings;
 }
 var CONFIG_FILENAMES = ["vxil.config.ts", "vxil.config.mjs", "vxil.config.js"];
-var VXIL_CONFIG_PKG_VERSION = "0.10.1";
-var VXIL_SDK_PKG_VERSION = "0.16.1";
-var VXIL_CLI_PKG_VERSION = "0.16.1";
+var VXIL_CONFIG_PKG_VERSION = "0.11.0";
+var VXIL_SDK_PKG_VERSION = "0.17.0";
+var VXIL_CLI_PKG_VERSION = "0.17.0";
 function ensureScaffoldPackageJson(cwd, opts = {}) {
   const file = resolve(cwd, "package.json");
   const wanted = {
@@ -8240,6 +8240,12 @@ function indexArmNote(rows) {
   if (rows === null) return "arms inline or through the re-index push runs (live row count unavailable)";
   return rows <= EQ_INDEX_INLINE_MAX_ROWS ? `arms inline (${rows} rows)` : `needs reindex (${rows} rows; push runs it)`;
 }
+function endUserAccessOf(v) {
+  return v === "read" || v === "none" ? v : "readwrite";
+}
+function endUserAccessRank(m) {
+  return m === "none" ? 0 : m === "read" ? 1 : 2;
+}
 function normalizeActions(raw) {
   if (!Array.isArray(raw)) return [];
   return raw.filter((a) => !!a && typeof a === "object").map((a) => ({ key: String(a.key), label: String(a.label), fn: String(a.fn) }));
@@ -8334,6 +8340,7 @@ async function readRemote2(api) {
       collection: c.collection,
       ownerField: c.owner_field ?? null,
       public: c.public === true,
+      endUserAccess: endUserAccessOf(c.end_user_access),
       actions: normalizeActions(c.actions),
       fields: Array.isArray(c.fields) ? c.fields : []
     });
@@ -8382,6 +8389,12 @@ async function reindexCollection({ api, collection, field, onProgress }) {
   return { scanned, updated, pages, skipped, ...indexCertify ? { indexCertify } : {} };
 }
 async function planCmsSchema({ api, collections, apply, allowDestructive = false, onProgress }) {
+  for (const [name, def] of Object.entries(collections)) {
+    const v = def.endUserAccess;
+    if (v !== void 0 && v !== "readwrite" && v !== "read" && v !== "none") {
+      throw new Error(`cms.collections.${name}.endUserAccess must be 'readwrite' | 'read' | 'none' (got ${JSON.stringify(v)})`);
+    }
+  }
   const read = await readRemote2(api);
   if (read.unavailable) {
     if (apply) {
@@ -8526,6 +8539,23 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
         detail: `${name} public \u2192 ${declaredPublic} (keyless public delivery ${declaredPublic ? "ON" : "OFF"})`
       });
     }
+    const declaredAccess = endUserAccessOf(def.endUserAccess);
+    if (declaredAccess !== rc.endUserAccess) {
+      const widens = endUserAccessRank(declaredAccess) > endUserAccessRank(rc.endUserAccess);
+      if (!widens || allowDestructive) {
+        collChanges.push({
+          collection: name,
+          kind: "set-end-user-access",
+          detail: `${name} endUserAccess \u2192 '${declaredAccess}' (was '${rc.endUserAccess}')` + (widens ? " \u2014 WIDENS end-user access (full-config reconciliation)" : " (narrows end-user access)")
+        });
+      } else {
+        collChanges.push({
+          collection: name,
+          kind: "warn",
+          detail: `${name}: endUserAccess is '${rc.endUserAccess}' remotely but '${declaredAccess}' in config \u2014 that WIDENS what end users may do, so it is NOT applied. Declare endUserAccess: '${rc.endUserAccess}' to keep it, or re-run with --allow-destructive to widen.`
+        });
+      }
+    }
     const declaredActions = normalizeActions(def.actions);
     if (stableStringify(declaredActions) !== stableStringify(rc.actions)) {
       collChanges.push({
@@ -8597,6 +8627,8 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
         if (def.singular) body.singular = def.singular;
         if (def.ownerField) body.owner_field = def.ownerField;
         if (def.public === true) body.public = true;
+        const access = endUserAccessOf(def.endUserAccess);
+        if (access !== "readwrite") body.end_user_access = access;
         if (def.actions && def.actions.length > 0) body.actions = normalizeActions(def.actions);
         const res = await api("POST", "/v1/cms/collections", body);
         if (res.status !== 201 && res.status !== 200 && res.body.error?.code !== "collection_exists") {
@@ -8636,6 +8668,14 @@ async function planCmsSchema({ api, collections, apply, allowDestructive = false
           throw new Error(`cms: set public on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
         }
         applied++;
+      } else if (c.kind === "set-end-user-access") {
+        const target = endUserAccessOf(collections[c.collection].endUserAccess);
+        const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`, { end_user_access: target });
+        if (res.status !== 200 && res.status !== 201) {
+          const e = res.body.error ?? {};
+          throw new Error(`cms: set endUserAccess on ${c.collection} failed: ${e.code ?? res.status} ${e.message ?? ""}`);
+        }
+        applied++;
       } else if (c.kind === "set-actions") {
         const target = normalizeActions(collections[c.collection].actions);
         const res = await api("POST", `/v1/cms/collections/${encodeURIComponent(c.collection)}/fields`, { actions: target });
@@ -8701,7 +8741,7 @@ function formatCmsChanges(changes) {
     if (c.kind === "destructive") return `  ! ${c.detail}`;
     if (c.kind === "warn") return `  \u26A0 ${c.detail}`;
     if (c.kind === "reindex") return `  \u21BB ${c.detail}`;
-    if (c.kind === "alter-flags" || c.kind === "set-owner-field") return `  ~ ${c.detail}`;
+    if (c.kind === "alter-flags" || c.kind === "set-owner-field" || c.kind === "set-end-user-access") return `  ~ ${c.detail}`;
     return `  + ${c.detail}`;
   }).join("\n");
 }
@@ -12093,7 +12133,7 @@ var TOOLS = [
   {
     name: "cms_list_collections",
     feature: "cms",
-    description: "List the tenant's content model: collections with their typed field definitions (the schema items are validated against). Each field row carries its attributes \u2014 required, validation, index_slot, relation_to, computed/compute, is_unique, on_delete, read_roles (the end-user org roles allowed to READ that field; null = ungated), and on an equality-indexed field indexed: true + index_ready (equality filters on it are index-served once ready; until then, and on unindexed unslotted fields, they are a bounded scan \u2014 same results). A field with read_roles is omitted from end-user reads without a matching role and is never served on the public lane, so a missing key in an item's data may be a read gate rather than an unset value.",
+    description: "List the tenant's content model: collections with their typed field definitions (the schema items are validated against). Each field row carries its attributes \u2014 required, validation, index_slot, relation_to, computed/compute, is_unique, on_delete, read_roles (the end-user org roles allowed to READ that field; null = ungated), and on an equality-indexed field indexed: true + index_ready (equality filters on it are index-served once ready; until then, and on unindexed unslotted fields, they are a bounded scan \u2014 same results). A field with read_roles is omitted from end-user reads without a matching role and is never served on the public lane, so a missing key in an item's data may be a read gate rather than an unset value. Each collection row also carries end_user_access: 'readwrite' (default), 'read' (a verified end user \u2014 a thin-client key with a session \u2014 may read but every write answers 403 server_only) or 'none' (end-user reads and writes are 403 server_only); server keys are never affected.",
     inputSchema: { type: "object", properties: {} },
     method: "GET",
     path: "/v1/cms/collections"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/cli",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "private": false,
   "description": "The vxil CLI — init, quickstart, push, gen, secrets, keys, migrate, doctor, diff, functions, payments; installs the `vxil` command (npm i -g @vxil/cli).",
   "license": "MIT",
@@ -46,9 +46,9 @@
   },
   "devDependencies": {
     "miniflare": "^4.20260611.0",
-    "@vxil/config": "0.10.1",
-    "@vxil/feature-configs": "0.9.1",
+    "@vxil/config": "0.11.0",
     "@vxil/runtime": "0.0.1",
+    "@vxil/feature-configs": "0.9.1",
     "@vxil/types": "0.0.1"
   },
   "scripts": {