@vxil/cli 0.18.0 → 0.20.0

package/dist/_vxil-feature-configs-hooks.d.ts

@@ -10,12 +10,16 @@ export declare const HOOK_LIMITS: {
     readonly maxReadHooksPerCollection: 10;
 };
 /** The ONLY root variables an expression may reference. `caller` is the VERIFIED
- *  end-user principal (https://vxil.com/docs/guide/09-security-and-multitenancy) — read-only and
- *  populated ONLY on the READ path (runReadHooks); on the write path and in
- *  server-caller mode it is null, exactly like `before` on a create. It carries
- *  `caller.endUserId` (the verified session sub, or null) and `caller.principal`
- *  ('end_user' | 'tenant'). It is the missing "caller/session context" a read
- *  hook keys on to redact/derive per-viewer. */
+ *  end-user principal (https://vxil.com/docs/guide/09-security-and-multitenancy) — read-only.
+ *  It carries `caller.endUserId` (the verified session sub, or null),
+ *  `caller.principal` ('end_user' | 'tenant') and `caller.roles` (the VERIFIED
+ *  session role claims of the signed-in session — never a body or header
+ *  value; null in server-caller mode). READ hooks always get it
+ *  (server mode: `{ endUserId: null, principal: 'tenant', roles: null }`).
+ *  WRITE hooks get it in verified end-user mode only; on a
+ *  server write it is null, exactly like `before` on a create — so a role rule
+ *  reads `isNull(caller) || contains(caller.roles, 'manager')`. `contains` on
+ *  an array is exact element membership. */
 export declare const HOOK_ROOT_VARS: readonly ["item", "before", "now", "caller"];
 /** The ONLY callable functions. Each is pure + deterministic + bounded. */
 export declare const HOOK_FUNCTIONS: readonly ["min", "max", "abs", "round", "floor", "ceil", "sqrt", "pow", "sign", "len", "lower", "upper", "trim", "substr", "contains", "startsWith", "endsWith", "concat", "coalesce", "ifNull", "not", "isNull", "number", "string", "bool", "daysBetween", "yearsBetween"];
@@ -80,20 +84,25 @@ export declare function parseExpr(src: string): Node;
 /** Walk the AST and reject anything outside the allow-list, plus depth bounds.
  *  Returns an array of human-readable errors (empty = safe). Pure, no eval. */
 export declare function validateAst(root: Node): string[];
-/** The VERIFIED caller/session context for read hooks (guide ch. 7). Read-only;
- *  present only on the read path in end-user mode. In server mode / write path
- *  the whole object is null. */
+/** The VERIFIED caller/session context for Lane-A hooks (guide ch. 7).
+ *  Read-only. Read hooks always get it; write hooks get it in verified end-user
+ *  mode only (a server write passes null — see HOOK_ROOT_VARS). */
 export interface HookCaller {
     /** the verified end-user session sub, or null in server-caller mode. */
     endUserId: string | null;
     /** 'end_user' when a session was verified at the edge, else 'tenant'. */
     principal: 'end_user' | 'tenant';
+    /** the VERIFIED session role claims of the signed-in session; `[]` for a
+     *  session without roles, null in server-caller mode. Optional so an older
+     *  caller object still reads
+     *  as "no roles". */
+    roles?: readonly string[] | null;
 }
 export interface HookContext {
     item: Record<string, unknown>;
     before: Record<string, unknown> | null;
     now: string;
-    /** verified caller/session context (read path only); null otherwise. */
+    /** verified caller/session context; null on a server write. */
     caller?: HookCaller | null;
 }
 /** A mutable step counter SHARED across many evalExpr calls (the read path's
@@ -127,7 +136,10 @@ export interface HookRunResult {
  *  Mutates a CLONE: derive hooks set fields; a validate hook that returns falsy
  *  throws HookRejection (→ the caller maps to a 422 and the tx rolls back).
  *  Throws HookEvalError on a runtime fault (also a clean 422, never a 500). */
-export declare function runWriteHooks(hooks: Record<string, HookDef> | undefined, collection: string, phase: 'create' | 'update', data: Record<string, unknown>, before: Record<string, unknown> | null, now: string): HookRunResult;
+export declare function runWriteHooks(hooks: Record<string, HookDef> | undefined, collection: string, phase: 'create' | 'update', data: Record<string, unknown>, before: Record<string, unknown> | null, now: string, 
+/** the VERIFIED end-user caller (endUserId + principal + roles) in
+ *  end-user mode; omitted / null on a server write (expressions see null). */
+caller?: HookCaller | null): HookRunResult;
 export interface ReadHookResult {
     /** Surviving rows in input order. Each is a SHALLOW COPY with a copied `data`
      *  bag — the caller's rows are never mutated and nothing here is persisted. */
@@ -154,8 +166,8 @@ export interface ReadHookResult {
  *  fire here, and read events never fire in runWriteHooks. */
 export declare function runReadHooks(hooks: Record<string, HookDef> | undefined, collection: string, rows: ReadonlyArray<Record<string, unknown>>, now: string, 
 /** verified caller/session context (guide ch. 7) — read-only, exposed to
- *  expressions as `caller.endUserId` / `caller.principal`. Omitted ⇒ null
- *  (server-caller mode). */
+ *  expressions as `caller.endUserId` / `caller.principal` / `caller.roles`.
+ *  Omitted ⇒ null (server-caller mode). */
 caller?: HookCaller | null): ReadHookResult;
 export interface ExprRef {
     root: 'item' | 'before' | 'now' | 'caller';

package/dist/_vxil-feature-configs-readmodels.d.ts

@@ -35,4 +35,22 @@ interface CdcRuleLike {
 }
 /** Cross-field rule for CmsConfig.cdc (called from validateFeatureConfig). */
 export declare function validateCdcConfig(cdc: Record<string, CdcRuleLike> | undefined): string[];
+/** What a payload:'full' change-data rule must know about its target
+ *  collection's read gates. `readRoleFields`: fields with a non-empty
+ *  `readRoles`; `endUserAccess`: the collection's end-user access mode. */
+export interface CdcCollectionGates {
+    readRoleFields?: readonly string[];
+    endUserAccess?: 'readwrite' | 'read' | 'none';
+}
+/**
+ * A `payload: 'full'` change-data rule inlines the stored row into a realtime
+ * frame that every subscriber of the channel receives — it does not go through
+ * the read projection. So it must never target a collection whose reads are
+ * gated: a field with `readRoles` (the frame would carry the gated value), or
+ * an `endUserAccess` of 'read' / 'none' (the frame would bypass the
+ * collection's end-user gate). Pure; one problem line per offending ENABLED
+ * rule (an unknown collection is skipped). The safe shape is `payload: 'ids'`
+ * and a re-read through the cms, where every gate applies.
+ */
+export declare function cdcFullFramesOverGatedCollections(cdc: unknown, collections: Record<string, CdcCollectionGates>): string[];
 export {};

package/dist/_vxil-feature-configs.d.ts

@@ -218,6 +218,7 @@ declare const OidcProviderSchema: import("@sinclair/typebox").TObject<{
         email: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         name: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         roles: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        rolePrefix: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>>;
     allowedDomains: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     autoLink: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
@@ -275,6 +276,7 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
                 email: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
                 name: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
                 roles: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+                rolePrefix: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
             }>>;
             allowedDomains: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
             autoLink: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
@@ -319,6 +321,8 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
         breachedPasswords: import("@sinclair/typebox").TBoolean;
         captchaSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         allowedRedirectOrigins: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        inviteOnly: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        allowedEmailDomains: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
     }>>;
 }>;
 /** The security bag as persisted (present ⇒ leaf defaults applied). */
@@ -633,6 +637,7 @@ export declare const RagConfigSchema: import("@sinclair/typebox").TObject<{
         topK: import("@sinclair/typebox").TInteger;
         mode: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"hybrid">, import("@sinclair/typebox").TLiteral<"vector">, import("@sinclair/typebox").TLiteral<"keyword">]>;
         minScore: import("@sinclair/typebox").TNumber;
+        minSimilarity: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TNumber>;
         rerank: import("@sinclair/typebox").TBoolean;
     }>;
     boosts: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{

package/dist/config.d.ts

@@ -121,6 +121,17 @@ export interface CollectionDef {
      *  `vxil push --allow-destructive`. Any other value fails `vxil plan` /
      *  `vxil push` (it never falls back to 'readwrite'). */
     endUserAccess?: 'readwrite' | 'read' | 'none';
+    /** Role slugs one of which a VERIFIED end user must hold to WRITE this
+     *  collection (create, update, $inc, delete, publish, transaction step,
+     *  filtered delete, batch write, and an end-user delete's cascade into it) —
+     *  otherwise `403 role_required`. Reads are unaffected. Roles are the
+     *  session's verified role claims (its orgs roles — the
+     *  same ones `readRoles` and `caller.roles` in hooks see). Server keys are
+     *  never affected. Absent / `[]` = ungated. Up to 16 slugs
+     *  (`^[a-z0-9][a-z0-9_-]{0,31}$`). Stored on the collection (model data, not
+     *  a config leaf) and carried by BOTH push paths; widening (clearing, or
+     *  adding a role) needs `vxil push --allow-destructive`. */
+    writeRoles?: string[];
     /** Per-record action buttons (guide ch. 4): `[{ key, label, fn }]`, stored on
      *  the collection (model data, not a config leaf). The dashboard renders one
      *  button per action on each record row; `POST /v1/cms/items/:coll/:id/actions/