@vxil/config 0.10.1 → 0.11.0

package/dist/index.d.ts

@@ -106,6 +106,21 @@ export interface CollectionDef {
      *  with a regression test on each — an attribute read by no enforcing path ships
      *  inert (the validation.unique / owner_field precedent). */
     public?: boolean;
+    /** What a VERIFIED end user (a thin-client key + a session) may do on this
+     *  collection (https://vxil.com/docs/guide/09-security-and-multitenancy):
+     *    'readwrite' (default) — read and write (owner-scoped when ownerField is set);
+     *    'read'      — read only (owner-scoped as above); every end-user write
+     *                  (create, update, $inc, delete, publish, transaction step,
+     *                  filtered delete, batch write — and a delete elsewhere
+     *                  whose on_delete cascade / set_null would change a row
+     *                  here) is `403 server_only`;
+     *    'none'      — no end-user reads or writes at all, even with ownerField.
+     *  Server keys (and platform writes such as a jobs status mirror) are never
+     *  affected. Stored on the collection (model data, not a config leaf) and
+     *  carried by BOTH push paths; widening ('read'/'none' → 'readwrite') needs
+     *  `vxil push --allow-destructive`. Any other value fails `vxil plan` /
+     *  `vxil push` (it never falls back to 'readwrite'). */
+    endUserAccess?: 'readwrite' | 'read' | 'none';
     /** Per-record action buttons (guide ch. 4): `[{ key, label, fn }]`, stored on
      *  the collection (model data, not a config leaf). The dashboard renders one
      *  button per action on each record row; `POST /v1/cms/items/:coll/:id/actions/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/config",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "Typed vxil.config.ts authoring for the vxil backend platform — defineConfig, feature and cms field definitions (published for @vxil/cli).",
   "license": "MIT",
   "homepage": "https://vxil.com",

package/src/index.ts

@@ -145,6 +145,21 @@ export interface CollectionDef {
    *  with a regression test on each — an attribute read by no enforcing path ships
    *  inert (the validation.unique / owner_field precedent). */
   public?: boolean;
+  /** What a VERIFIED end user (a thin-client key + a session) may do on this
+   *  collection (https://vxil.com/docs/guide/09-security-and-multitenancy):
+   *    'readwrite' (default) — read and write (owner-scoped when ownerField is set);
+   *    'read'      — read only (owner-scoped as above); every end-user write
+   *                  (create, update, $inc, delete, publish, transaction step,
+   *                  filtered delete, batch write — and a delete elsewhere
+   *                  whose on_delete cascade / set_null would change a row
+   *                  here) is `403 server_only`;
+   *    'none'      — no end-user reads or writes at all, even with ownerField.
+   *  Server keys (and platform writes such as a jobs status mirror) are never
+   *  affected. Stored on the collection (model data, not a config leaf) and
+   *  carried by BOTH push paths; widening ('read'/'none' → 'readwrite') needs
+   *  `vxil push --allow-destructive`. Any other value fails `vxil plan` /
+   *  `vxil push` (it never falls back to 'readwrite'). */
+  endUserAccess?: 'readwrite' | 'read' | 'none';
   /** Per-record action buttons (guide ch. 4): `[{ key, label, fn }]`, stored on
    *  the collection (model data, not a config leaf). The dashboard renders one
    *  button per action on each record row; `POST /v1/cms/items/:coll/:id/actions/