@vxil/cli 0.25.0 → 0.26.0

package/dist/_vxil-feature-configs-apiState.d.ts

@@ -155,7 +155,11 @@ export interface LiveSearchCollection {
     provider?: string | null;
     model?: string | null;
     api_key_ref?: string | null;
+    /** 'arabic' | 'none'; absent on an older server (then not compared). */
+    keyword_normalize?: string | null;
     documents?: number;
+    /** WORKSPACE-ROWS Phase 2: listed (true) only on an orgScoped collection */
+    org_scoped?: boolean;
 }
 /** The POST /v1/search/collections body an update sends: always the live
  *  dimensions (immutable — an omitted width would fall back to the tenant
@@ -172,6 +176,11 @@ export interface SearchCollectionBody {
         model?: string;
         apiKeyRef?: string;
     };
+    /** sent only when declared (the route keeps the live fold when omitted) */
+    keywordNormalize?: 'arabic' | 'none';
+    /** create only — immutable after create (an update never sends it, so the
+     *  server keeps the live value) */
+    org_scoped?: boolean;
 }
 export interface SearchCollectionPlan {
     create: SearchCollectionBody[];
@@ -243,7 +252,18 @@ export interface ApiStateSummary {
         key: string;
         error: string;
     }>;
+    /** follow-up the operator must act on for a row that DID converge (e.g. a
+     *  search collection whose keyword fold was turned on needs a re-ingest);
+     *  absent = none (older servers never send it) */
+    notes?: Array<{
+        key: string;
+        note: string;
+    }>;
 }
+/** The note a converge reports when it turned the keyword fold ON for a
+ *  search collection that already holds documents (the server answered
+ *  keyword_reindex_required: true). */
+export declare const SEARCH_KEYWORD_REINDEX_NOTE = "keyword fold turned on \u2014 chunks indexed before it match only their exact spelling until re-ingested (re-ingest, or reset the sync source)";
 export declare function emptyApiStateSummary(datum: ApiStateDatum): ApiStateSummary;
 /** The `api_state` object a config-write response carries (`PUT /v1/config/
  *  :feature` and its dashboard twin, dry-run included — control-plane

package/dist/_vxil-feature-configs-readmodels.d.ts

@@ -33,16 +33,37 @@ interface CdcRuleLike {
     payload?: unknown;
     enabled?: boolean;
 }
+/** The template token: one WHOLE colon-separated segment of a cdc `channel`. */
+export declare const CDC_ORG_TOKEN = "{org}";
+/** Every resolved workspace channel starts with this prefix; realtime-v1 binds
+ *  an end-user connect token for such a channel to the verified `org_id` claim
+ *  (its own copy: `workers/realtime-v1/src/token.ts` ORG_CHANNEL_PREFIX; the
+ *  `cdc-gated-fields` gate pins both copies equal). */
+export declare const ORG_CHANNEL_PREFIX = "org:";
+/** An org id that may enter a channel name: no ':' (it would shift the segment
+ *  realtime compares), the realtime channel alphabet, ≤ 64 chars (orgs ids are
+ *  `org_…`, at most 64 chars). */
+export declare const ORG_CHANNEL_ID_RE: RegExp;
+/** Is `channel` an org template — exactly one segment equal to `{org}`, every
+ *  other segment a non-empty channel-alphabet run, ≤ 128 chars in all? */
+export declare function isOrgChannelTemplate(channel: string): boolean;
+/** Resolve a template for one row's workspace: drop the `{org}` segment and
+ *  prefix `org:<id>:` (`notes:{org}` → `org:<id>:notes`; a bare `{org}` →
+ *  `org:<id>`). Null (publish nothing) for a non-template or an org id that is
+ *  not a string matching ORG_CHANNEL_ID_RE — fail closed. */
+export declare function resolveOrgChannel(template: string, orgId: unknown): string | null;
 /** Cross-field rule for CmsConfig.cdc (called from validateFeatureConfig). */
 export declare function validateCdcConfig(cdc: Record<string, CdcRuleLike> | undefined): string[];
 /** What a payload:'full' change-data rule must know about its target
  *  collection's read gates. `readRoleFields`: fields with a non-empty
  *  `readRoles`; `endUserAccess`: the collection's end-user access mode;
- *  `ownerField`: the end-user owner-scope field (null/absent = none). */
+ *  `ownerField`: the end-user owner-scope field (null/absent = none);
+ *  `orgField`: the workspace-scope field (null/absent = none). */
 export interface CdcCollectionGates {
     readRoleFields?: readonly string[];
     endUserAccess?: 'readwrite' | 'read' | 'none';
     ownerField?: string | null;
+    orgField?: string | null;
 }
 /**
  * A `payload: 'full'` change-data rule inlines the stored row into a realtime
@@ -52,9 +73,21 @@ export interface CdcCollectionGates {
  * an `endUserAccess` of 'read' / 'none' (the frame would bypass the
  * collection's end-user gate), or an `ownerField` (end users read only their
  * own rows, but the frame would carry every user's row to every subscriber —
- * CDC-FULL-OWNER-SCOPED). Pure; one problem line per offending ENABLED
+ * CDC-FULL-OWNER-SCOPED), or an `orgField` (a workspace's rows to every
+ * subscriber — `{org}` frames stay ids-only). Pure; one problem line per offending ENABLED
  * rule (an unknown collection is skipped). The safe shape is `payload: 'ids'`
  * and a re-read through the cms, where every gate applies.
  */
 export declare function cdcFullFramesOverGatedCollections(cdc: unknown, collections: Record<string, CdcCollectionGates>): string[];
+/**
+ * WORKSPACE-ROWS Phase 2: a FIXED-channel change-data rule on a workspace
+ * collection (live `orgField`) sends every workspace's change ids, status and
+ * timing to ONE channel any end user may subscribe to — only the `{org}`
+ * template (`<collection>:{org}` → `org:<org_id>:<collection>`) is valid there.
+ * The config PUT / draft-publish twin of the `workspaceManifestErrors` rule
+ * (which judges only DECLARED collections); the cms runtime floor
+ * (cdc.ts cdcChannelFor) drops such a rule for every door that cannot check.
+ * Pure; one problem line per offending ENABLED rule.
+ */
+export declare function cdcFixedChannelsOverOrgCollections(cdc: unknown, collections: Record<string, CdcCollectionGates>): string[];
 export {};

package/dist/_vxil-feature-configs.d.ts

@@ -333,6 +333,7 @@ export declare const AuthConfigSchema: import("@sinclair/typebox").TObject<{
         }>>;
         breachedPasswords: import("@sinclair/typebox").TBoolean;
         captchaSecretRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        captchaOnReset: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         allowedRedirectOrigins: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
         inviteOnly: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
         verifyLinkEvicts: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
@@ -412,6 +413,10 @@ export declare const FilesConfigSchema: import("@sinclair/typebox").TObject<{
             q: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
         }>>>;
     }>>;
+    orgScope: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        readRoles: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        writeRoles: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    }>>;
 }>;
 export type FilesConfig = Static<typeof FilesConfigSchema>;
 export declare const DeclaredWebhookSubscriptionSchema: import("@sinclair/typebox").TObject<{
@@ -601,6 +606,8 @@ export declare const DeclaredSearchCollectionSchema: import("@sinclair/typebox")
         model: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         apiKeyRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>>;
+    keywordNormalize: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"arabic">, import("@sinclair/typebox").TLiteral<"none">]>>;
+    orgScoped: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
 export type DeclaredSearchCollection = Static<typeof DeclaredSearchCollectionSchema>;
 export declare const VectorSearchConfigSchema: import("@sinclair/typebox").TObject<{
@@ -648,6 +655,8 @@ export declare const VectorSearchConfigSchema: import("@sinclair/typebox").TObje
             model: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
             apiKeyRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         }>>;
+        keywordNormalize: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"arabic">, import("@sinclair/typebox").TLiteral<"none">]>>;
+        orgScoped: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
     }>>>;
 }>;
 export type VectorSearchConfig = Static<typeof VectorSearchConfigSchema>;

package/dist/config.d.ts

@@ -193,8 +193,15 @@ export interface WorkspaceManifestInput {
  *  CLI push evaluates it) and by control-plane `/v1/apply` (the server-side
  *  authority). Returns every violation (empty = valid):
  *   - orgField needs `features.auth.orgClaims.enabled` AND `.activeOrg`;
- *   - no `features.cms.cdc` rule on an orgField collection (Phase 1);
- *   - no vector-search `sync[]` source reading an orgField collection (Phase 1);
+ *   - a `features.cms.cdc` rule on an orgField collection must use the
+ *     `{org}` channel template (Phase 2), stay ids-only, and not target a
+ *     collection with `orgReadRoles` (the channel admits every member); a
+ *     template on a declared collection WITHOUT orgField is refused;
+ *   - a vector-search `sync[]` source reading an orgField collection must
+ *     target a collection declared in `vector-search.collections[]` with
+ *     `orgScoped: true` (Phase 2 — each document takes the row's orgField as
+ *     its org), and an unscoped source never feeds an orgScoped collection;
+ *   - an orgScoped search collection needs `auth.orgClaims.activeOrg` too;
  *   - a read model materializing an orgField source must target an orgField
  *     collection whose orgField has the SAME name, and group (or partition) by
  *     the source orgField — so each rollup row lands in its own workspace;

package/dist/config.js

@@ -80,6 +80,12 @@ function assertWorkspaceCollection(name, def) {
   const errs = workspaceCollectionErrors(name, def);
   if (errs.length) throw new Error(`vxil.config: ${errs[0]}`);
 }
+var isOrgTemplateChannel = (ch) => typeof ch === "string" && ch.split(":").includes("{org}");
+var orgReadRolesOfDef = (def) => isObj(def) ? def.orgReadRoles ?? def.org_read_roles : void 0;
+var ownerFieldOfDef = (def) => {
+  const v = isObj(def) ? def.ownerField ?? def.owner_field : void 0;
+  return typeof v === "string" && v.length > 0;
+};
 var asList = (v) => Array.isArray(v) ? v : v === void 0 || v === null ? [] : [v];
 var stringsOf = (v) => asList(v).filter((s) => typeof s === "string");
 function workspaceManifestErrors(config, opts = {}) {
@@ -91,24 +97,48 @@ function workspaceManifestErrors(config, opts = {}) {
     const of = declaredOrgField(def);
     if (of) orgCols.set(name, of);
   }
-  if (orgCols.size === 0) return errs;
   const features = isObj(config.features) ? config.features : {};
+  const cms = isObj(features.cms) ? features.cms : {};
+  const cdcRules = Object.entries(isObj(cms.cdc) ? cms.cdc : {});
+  for (const [rule, r] of cdcRules) {
+    if (isObj(r) && typeof r.collection === "string" && isOrgTemplateChannel(r.channel) && Object.prototype.hasOwnProperty.call(collections, r.collection) && !orgCols.has(r.collection)) {
+      errs.push(`features.cms.cdc.${rule}: a '{org}' channel needs an orgField collection \u2014 '${r.collection}' declares no orgField, so no row has a workspace to publish to`);
+    }
+  }
+  const vs = isObj(features["vector-search"]) ? features["vector-search"] : {};
+  const orgScopedTargets = new Set(asList(vs.collections).filter((c) => isObj(c) && (c.orgScoped === true || c.org_scoped === true) && typeof c.collection === "string").map((c) => c.collection));
+  if (orgCols.size === 0 && orgScopedTargets.size === 0) return errs;
   const names = [...orgCols.keys()].join(", ");
   const auth = isObj(features.auth) ? features.auth : {};
   const oc = isObj(auth.orgClaims) ? auth.orgClaims : {};
   if (opts.checkAuth !== false && (oc.enabled !== true || oc.activeOrg !== true)) {
-    errs.push(`cms.collections ${names} set orgField, which needs features.auth.orgClaims { enabled: true, activeOrg: true } \u2014 without an active org the session carries no stable workspace`);
+    if (orgCols.size) {
+      errs.push(`cms.collections ${names} set orgField, which needs features.auth.orgClaims { enabled: true, activeOrg: true } \u2014 without an active org the session carries no stable workspace`);
+    }
+    if (orgScopedTargets.size) {
+      errs.push(`vector-search.collections ${[...orgScopedTargets].join(", ")} set orgScoped, which needs features.auth.orgClaims { enabled: true, activeOrg: true } \u2014 without an active org no end user can read them`);
+    }
   }
-  const cms = isObj(features.cms) ? features.cms : {};
-  for (const [rule, r] of Object.entries(isObj(cms.cdc) ? cms.cdc : {})) {
-    if (isObj(r) && typeof r.collection === "string" && orgCols.has(r.collection)) {
-      errs.push(`features.cms.cdc.${rule}: collection '${r.collection}' is workspace-scoped (orgField) \u2014 a cdc channel is not access control, so it is refused until org channels ship (Phase 2); fan out from a function with per-workspace channel names meanwhile`);
+  for (const [rule, r] of cdcRules) {
+    if (!isObj(r) || typeof r.collection !== "string" || !orgCols.has(r.collection)) continue;
+    if (!isOrgTemplateChannel(r.channel)) {
+      errs.push(`features.cms.cdc.${rule}: collection '${r.collection}' is workspace-scoped (orgField) \u2014 a fixed cdc channel is not access control; use a workspace channel template, e.g. channel: '${r.collection}:{org}' (each row publishes to org:<its org id>:${r.collection}, which only members of that workspace can subscribe to)`);
+    } else if (r.payload === "full") {
+      errs.push(`features.cms.cdc.${rule}: collection '${r.collection}' is workspace-scoped (orgField) \u2014 frames stay ids-only (payload: 'ids'); subscribers re-read through cms, where the workspace predicate applies`);
+    } else if (stringsOf(orgReadRolesOfDef(collections[r.collection])).length > 0) {
+      errs.push(`features.cms.cdc.${rule}: collection '${r.collection}' sets orgReadRoles \u2014 an org:<id> channel admits every member of the workspace, so its frames (item ids, status, timing) would reach roles that cannot read the collection; drop the rule or the orgReadRoles`);
     }
   }
-  const vs = isObj(features["vector-search"]) ? features["vector-search"] : {};
   asList(vs.sync).forEach((s, i) => {
-    if (isObj(s) && typeof s.cmsCollection === "string" && orgCols.has(s.cmsCollection)) {
-      errs.push(`features.vector-search.sync[${i}]: cmsCollection '${s.cmsCollection}' is workspace-scoped (orgField) \u2014 workspace-scoped sync arrives with orgScoped (Phase 2); search through a function meanwhile`);
+    if (!isObj(s) || typeof s.cmsCollection !== "string") return;
+    const target = typeof s.collection === "string" ? s.collection : "";
+    if (orgCols.has(s.cmsCollection) && !orgScopedTargets.has(target)) {
+      errs.push(`features.vector-search.sync[${i}]: cmsCollection '${s.cmsCollection}' is workspace-scoped (orgField) \u2014 the target '${target}' must be declared in vector-search.collections[] with orgScoped: true, or every workspace's rows become searchable by any end user`);
+    } else if (orgCols.has(s.cmsCollection) && (stringsOf(orgReadRolesOfDef(collections[s.cmsCollection])).length > 0 || ownerFieldOfDef(collections[s.cmsCollection]))) {
+      const which = stringsOf(orgReadRolesOfDef(collections[s.cmsCollection])).length > 0 ? "orgReadRoles" : "ownerField";
+      errs.push(`features.vector-search.sync[${i}]: cmsCollection '${s.cmsCollection}' sets ${which} \u2014 synced documents are shared by every member of the workspace, so a member could search rows cms refuses them; drop the sync or the ${which}`);
+    } else if (!orgCols.has(s.cmsCollection) && orgScopedTargets.has(target)) {
+      errs.push(`features.vector-search.sync[${i}]: target '${target}' is orgScoped but cmsCollection '${s.cmsCollection}' is not workspace-scoped (orgField) \u2014 its documents would carry no workspace`);
     }
   });
   for (const [rmName, rm] of Object.entries(isObj(cms.readModels) ? cms.readModels : {})) {