@xcitedbs/client 0.3.5 → 0.3.6

package/dist/client.d.ts

@@ -125,6 +125,58 @@ export declare class XCiteDBClient {
     destroyTestSessionByToken(token: string): Promise<{
         message: string;
     }>;
+    /**
+     * Create a long-lived developer sandbox via `POST /api/v1/sandboxes`. Returns the server's
+     * `SandboxInfo`. To start using the sandbox immediately, follow up with `client.useSandbox(name)`,
+     * or mint a sandbox-bound API key with `mintSandboxApiKey` and route subsequent requests through
+     * a fresh client constructed with that key (no header threading needed).
+     */
+    createSandbox(opts: import('./types').CreateSandboxOptions): Promise<import('./types').SandboxInfo>;
+    /** List sandboxes for the current project (`GET /api/v1/sandboxes`). */
+    listSandboxes(): Promise<import('./types').SandboxInfo[]>;
+    /** Fetch a sandbox's detail by name (`GET /api/v1/sandboxes/{name}`). */
+    getSandbox(name: string): Promise<import('./types').SandboxInfo>;
+    /** Update mutable sandbox fields (`PATCH /api/v1/sandboxes/{name}`). */
+    updateSandbox(name: string, patch: Partial<Pick<import('./types').SandboxInfo, 'description' | 'pinned' | 'expires_at' | 'effects_policy'>>): Promise<import('./types').SandboxInfo>;
+    /** Drop overlay writes for a sandbox while preserving membership and bound keys. */
+    resetSandbox(name: string): Promise<{
+        message: string;
+        session_token: string;
+    }>;
+    /** Destroy a sandbox; revokes bound API keys and removes membership rows. Owner only. */
+    destroySandbox(name: string): Promise<{
+        message: string;
+        session_token: string;
+    }>;
+    listSandboxMembers(name: string): Promise<import('./types').SandboxMember[]>;
+    addSandboxMember(name: string, member_id: string, role: 'editor' | 'viewer'): Promise<{
+        message: string;
+    }>;
+    removeSandboxMember(name: string, member_id: string): Promise<{
+        message: string;
+    }>;
+    /**
+     * Mint an API key bound to the given sandbox. Requests presenting this key automatically route
+     * into the sandbox without an `X-Test-Session` header — paste it into your dev `.env` and
+     * existing client/curl/SDK calls just work. The `api_key` field is shown once; persist it now.
+     */
+    mintSandboxApiKey(name: string, opts?: {
+        name?: string;
+        role?: 'admin' | 'editor' | 'viewer';
+        key_type?: 'secret' | 'public';
+        expires_at?: number;
+    }): Promise<import('./types').SandboxApiKeyMintResult>;
+    /**
+     * Pin this client to a named sandbox: subsequent requests carry `X-Test-Session: <token>`.
+     * Returns the sandbox info. Throws if the name does not resolve.
+     *
+     * If you instead want zero-header DX, mint a sandbox-bound API key with
+     * `mintSandboxApiKey(name)` and construct a fresh client with that `apiKey` — the server
+     * pre-filter resolves the binding without touching the test-session header.
+     */
+    useSandbox(name: string): Promise<import('./types').SandboxInfo>;
+    /** Clear any pinned test/sandbox session token from this client (subsequent requests hit production). */
+    clearSandbox(): void;
     /** True if this client would send API key or Bearer credentials on a normal request. */
     private sentAuthCredentials;
     /** 401 on these paths is an expected auth flow outcome, not a dead session. */

package/dist/client.js

@@ -699,6 +699,73 @@ class XCiteDBClient {
         const enc = encodeURIComponent(token);
         return this.request('DELETE', `/api/v1/test/sessions/${enc}`, undefined, undefined, { suppressTestSessionHeader: true, no401Retry: true });
     }
+    /**
+     * Create a long-lived developer sandbox via `POST /api/v1/sandboxes`. Returns the server's
+     * `SandboxInfo`. To start using the sandbox immediately, follow up with `client.useSandbox(name)`,
+     * or mint a sandbox-bound API key with `mintSandboxApiKey` and route subsequent requests through
+     * a fresh client constructed with that key (no header threading needed).
+     */
+    async createSandbox(opts) {
+        return this.request('POST', '/api/v1/sandboxes', opts, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+    }
+    /** List sandboxes for the current project (`GET /api/v1/sandboxes`). */
+    async listSandboxes() {
+        const r = await this.request('GET', '/api/v1/sandboxes', undefined, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+        return r.sandboxes ?? [];
+    }
+    /** Fetch a sandbox's detail by name (`GET /api/v1/sandboxes/{name}`). */
+    async getSandbox(name) {
+        return this.request('GET', `/api/v1/sandboxes/${encodeURIComponent(name)}`, undefined, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+    }
+    /** Update mutable sandbox fields (`PATCH /api/v1/sandboxes/{name}`). */
+    async updateSandbox(name, patch) {
+        return this.request('PATCH', `/api/v1/sandboxes/${encodeURIComponent(name)}`, patch, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+    }
+    /** Drop overlay writes for a sandbox while preserving membership and bound keys. */
+    async resetSandbox(name) {
+        return this.request('POST', `/api/v1/sandboxes/${encodeURIComponent(name)}/reset`, undefined, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+    }
+    /** Destroy a sandbox; revokes bound API keys and removes membership rows. Owner only. */
+    async destroySandbox(name) {
+        return this.request('DELETE', `/api/v1/sandboxes/${encodeURIComponent(name)}`, undefined, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+    }
+    async listSandboxMembers(name) {
+        const r = await this.request('GET', `/api/v1/sandboxes/${encodeURIComponent(name)}/members`, undefined, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+        return r.members ?? [];
+    }
+    async addSandboxMember(name, member_id, role) {
+        return this.request('POST', `/api/v1/sandboxes/${encodeURIComponent(name)}/members`, { member_id, role }, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+    }
+    async removeSandboxMember(name, member_id) {
+        return this.request('DELETE', `/api/v1/sandboxes/${encodeURIComponent(name)}/members/${encodeURIComponent(member_id)}`, undefined, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+    }
+    /**
+     * Mint an API key bound to the given sandbox. Requests presenting this key automatically route
+     * into the sandbox without an `X-Test-Session` header — paste it into your dev `.env` and
+     * existing client/curl/SDK calls just work. The `api_key` field is shown once; persist it now.
+     */
+    async mintSandboxApiKey(name, opts = {}) {
+        return this.request('POST', `/api/v1/sandboxes/${encodeURIComponent(name)}/api-keys`, opts, undefined, { suppressTestSessionHeader: true, no401Retry: true });
+    }
+    /**
+     * Pin this client to a named sandbox: subsequent requests carry `X-Test-Session: <token>`.
+     * Returns the sandbox info. Throws if the name does not resolve.
+     *
+     * If you instead want zero-header DX, mint a sandbox-bound API key with
+     * `mintSandboxApiKey(name)` and construct a fresh client with that `apiKey` — the server
+     * pre-filter resolves the binding without touching the test-session header.
+     */
+    async useSandbox(name) {
+        const info = await this.getSandbox(name);
+        if (!info.session_token)
+            throw new Error(`useSandbox: server returned no session_token for "${name}"`);
+        this.testSessionToken = info.session_token;
+        return info;
+    }
+    /** Clear any pinned test/sandbox session token from this client (subsequent requests hit production). */
+    clearSandbox() {
+        this.testSessionToken = undefined;
+    }
     /** True if this client would send API key or Bearer credentials on a normal request. */
     sentAuthCredentials() {
         return !!(this.apiKey || this.accessToken || this.appUserAccessToken);
@@ -2497,8 +2564,8 @@ class XCiteDBClient {
         }
         const ct = opts.contentType.trim() || 'application/octet-stream';
         const qParts = [];
-        if (opts.scope === 'public') {
-            qParts.push('scope=public');
+        if (opts.scope === 'shared') {
+            qParts.push('scope=shared');
         }
         if (opts.identifier !== undefined && opts.identifier !== '') {
             qParts.push(`identifier=${encodeURIComponent(opts.identifier)}`);

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { XCiteDBClient } from './client';
 export { parseAssetUri, formatAssetUri, collectIdentifiersFromText, ASSET_URI_PREFIX } from './assetUri';
 export { WebSocketSubscription } from './websocket';
-export type { AccessCheckResult, ApiKeyInfo, AppAuthConfig, AppEmailConfig, AppEmailSmtpConfig, AppEmailTemplateEntry, AppEmailTemplates, AppEmailWebhookConfig, AppUser, AppUserTokenPair, EmailTestResponse, ForgotPasswordResponse, SendVerificationResponse, BookmarkRecord, BranchInfo, BranchListItem, CheckpointRecord, CommitRecord, CompareEntry, CompareRef, CompareResult, DatabaseContext, DiffEntry, DiffRef, DiffResult, SmartDiffRef, SmartDiffResult, SmartDiffStats, DocumentBatchResponse, DocumentBatchResultRow, DocumentExportFormat, DocumentImportFormat, ExportDocumentResult, Flags, ImportDocumentOptions, ImportDocumentResult, JsonDocumentData, JsonDocumentBatchItem, IdentifierChildNode, ListIdentifierChildrenResult, ListIdentifiersResult, LockInfo, AcquireLockOptions, LockConflictBody, LockExpiredBody, LockUnknownBody, MergeConflict, MergeResult, OAuthProviderInfo, OAuthProvidersResponse, OwnedTenantInfo, ProjectInfo, PlatformRegistrationConfig, PlatformWorkspaceOrg, PlatformWorkspacesResponse, ProjectSearchSettings, ProjectSearchSettingsUpdate, ProjectDocConfResponse, AssetGcDryRunResult, AssetHeadResult, AssetListItem, AssetListResponse, AssetMagicLinkListResponse, AssetMagicLinkRecord, AssetMagicLinkResult, AssetShareListEntry, AssetShareListResponse, AssetShareRequest, AssetStorageImport, AssetStorageMount, AssetStorageTarget, AssetStorageTargetType, AssetUnshareRequest, AssetUploadResult, CreateAssetMagicLinkRequest, ListAssetsOptions, ProjectAssetStorageConfig, UploadAssetOptions, PlatformDefaultDocConfResponse, LogEntry, MetaValue, PlatformRegisterResult, PolicyUpdateResponse, PublishConflict, PublishResult, RebaseUserWorkspaceResult, PolicyConditions, PolicyIdentifierPattern, PolicyResources, PolicySubjectInput, PolicySubjects, RagQueryOptions, RagQueryResult, RagStreamEvent, RealtimeEvent, SearchIndexingProgress, SecurityConfig, SecurityPolicy, StoredPolicyResponse, StoredTriggerResponse, SubscriptionOptions, TagRecord, TextSearchHit, TextSearchQuery, TextSearchResult, TriggerDefinition, TriggerEvent, TriggerEventsResponse, TxnOperation, TxnOperationResult, TxnPrecondition, TxnPreconditionResult, TxnRequest, TxnResponse, JwksKey, JwksResponse, VerifyAppUserTokenOptions, TokenPair, UserInfo, UserIsolationConfig, UserIsolationCreateShareParams, UserIsolationOptions, UserIsolationShareMode, UserIsolationShareResult, WorkspaceInfo, WriteDocumentOptions, XmlDocumentBatchItem, CreateTestSessionOptions, TestSessionBootstrap, TestSessionBootstrapSummary, TestSessionInfo, XCiteDBClientOptions, XCiteDBErrorExtras, XCiteDBJwtClaims, UnqueryResult, UnqueryTemplate, XCiteQuery, } from './types';
+export type { AccessCheckResult, ApiKeyInfo, AppAuthConfig, AppEmailConfig, AppEmailSmtpConfig, AppEmailTemplateEntry, AppEmailTemplates, AppEmailWebhookConfig, AppUser, AppUserTokenPair, EmailTestResponse, ForgotPasswordResponse, SendVerificationResponse, BookmarkRecord, BranchInfo, BranchListItem, CheckpointRecord, CommitRecord, CompareEntry, CompareRef, CompareResult, DatabaseContext, DiffEntry, DiffRef, DiffResult, SmartDiffRef, SmartDiffResult, SmartDiffStats, DocumentBatchResponse, DocumentBatchResultRow, DocumentExportFormat, DocumentImportFormat, ExportDocumentResult, Flags, ImportDocumentOptions, ImportDocumentResult, JsonDocumentData, JsonDocumentBatchItem, IdentifierChildNode, ListIdentifierChildrenResult, ListIdentifiersResult, LockInfo, AcquireLockOptions, LockConflictBody, LockExpiredBody, LockUnknownBody, MergeConflict, MergeResult, OAuthProviderInfo, OAuthProvidersResponse, OwnedTenantInfo, ProjectInfo, PlatformRegistrationConfig, PlatformWorkspaceOrg, PlatformWorkspacesResponse, ProjectSearchSettings, ProjectSearchSettingsUpdate, ProjectDocConfResponse, AssetGcDryRunResult, AssetHeadResult, AssetListItem, AssetListResponse, AssetMagicLinkListResponse, AssetMagicLinkRecord, AssetMagicLinkResult, AssetShareListEntry, AssetShareListResponse, AssetShareRequest, AssetStorageImport, AssetStorageMount, AssetStorageTarget, AssetStorageTargetType, AssetUnshareRequest, AssetUploadResult, CreateAssetMagicLinkRequest, ListAssetsOptions, ProjectAssetStorageConfig, UploadAssetOptions, PlatformDefaultDocConfResponse, LogEntry, MetaValue, PlatformRegisterResult, PolicyUpdateResponse, PublishConflict, PublishResult, RebaseUserWorkspaceResult, PolicyConditions, PolicyIdentifierPattern, PolicyResources, PolicySubjectInput, PolicySubjects, RagQueryOptions, RagQueryResult, RagStreamEvent, RealtimeEvent, SandboxApiKeyMintResult, SandboxInfo, SandboxMember, SearchIndexingProgress, SecurityConfig, SecurityPolicy, StoredPolicyResponse, StoredTriggerResponse, SubscriptionOptions, TagRecord, TextSearchHit, TextSearchQuery, TextSearchResult, TriggerDefinition, TriggerEvent, TriggerEventsResponse, TxnOperation, TxnOperationResult, TxnPrecondition, TxnPreconditionResult, TxnRequest, TxnResponse, JwksKey, JwksResponse, VerifyAppUserTokenOptions, TokenPair, UserInfo, UserIsolationConfig, UserIsolationCreateShareParams, UserIsolationOptions, UserIsolationShareMode, UserIsolationShareResult, WorkspaceInfo, WriteDocumentOptions, XmlDocumentBatchItem, CreateSandboxOptions, CreateTestSessionOptions, TestSessionBootstrap, TestSessionBootstrapSummary, TestSessionInfo, XCiteDBClientOptions, XCiteDBErrorExtras, XCiteDBJwtClaims, UnqueryResult, UnqueryTemplate, XCiteQuery, } from './types';
 export { XCiteDBError, XCiteDBForbiddenError, XCiteDBNotFoundError, XCiteDBAuthError, XCiteDBLockConflictError, } from './types';

package/dist/types.d.ts

@@ -192,8 +192,10 @@ export interface UploadAssetOptions {
     contentType: string;
     /** When set (with default scope), uploaded to this path after user-isolation prefixing rules on the server. */
     identifier?: string;
-    /** `public` writes under `/public/assets/…`. Default project/user scope when omitted. */
-    scope?: 'project' | 'public';
+    /** `shared` writes under `/shared/assets/…` (tenant-common, readable by all logged-in app users).
+     *  Default project/user scope when omitted. To publish anonymously, upload normally and use the
+     *  share API with `target_user_id: "#anonymous"`. */
+    scope?: 'project' | 'shared';
 }
 /** Result of {@link XCiteDBClient.headAsset}. */
 export interface AssetHeadResult {
@@ -800,6 +802,53 @@ export interface CreateTestSessionOptions {
     userIsolation?: UserIsolationOptions;
     requestTimeoutMs?: number;
 }
+/** A long-lived developer sandbox: named overlay on a project + branch. */
+export interface SandboxInfo {
+    session_token: string;
+    name: string;
+    description: string;
+    org_id: string;
+    project_id: string;
+    base_branch: string;
+    pinned: boolean;
+    effects_policy: 'real' | 'log' | 'mock';
+    created_at: number;
+    last_used: number;
+    expires_at: number;
+    reset_generation: number;
+    owner_member_id: string;
+    /** Present in list responses: the requesting member's role in this sandbox, or "" if not a member. */
+    my_role?: 'owner' | 'editor' | 'viewer' | '';
+}
+/** Options for {@link XCiteDBClient.createSandbox}. */
+export interface CreateSandboxOptions {
+    /** Required. Kebab-case, 1-64 chars, must start with a-z, no consecutive hyphens. */
+    name: string;
+    description?: string;
+    /** Pinned sandboxes are not garbage-collected by idle TTL. */
+    pinned?: boolean;
+    /** Unix seconds; 0 = no explicit expiry. */
+    expires_at?: number;
+    base_branch?: string;
+    /** Defaults to "log" — webhooks/auth-emails get captured instead of firing. */
+    effects_policy?: 'real' | 'log' | 'mock';
+}
+/** Response from {@link XCiteDBClient.mintSandboxApiKey}. The `api_key` value is shown once. */
+export interface SandboxApiKeyMintResult {
+    api_key: string;
+    key_id: string;
+    prefix: string;
+    key_type: 'secret' | 'public';
+    bound_sandbox_id: string;
+    sandbox_name: string;
+    message: string;
+}
+export interface SandboxMember {
+    member_id: string;
+    role: 'owner' | 'editor' | 'viewer';
+    added_at: number;
+    added_by: string;
+}
 /** Application user (tenant-scoped), distinct from developer users. */
 export interface AppUser {
     user_id: string;
@@ -978,7 +1027,17 @@ export interface PolicyUpdateResponse {
 export interface TriggerMatch {
     /** Non-empty array of identifier patterns (same shape as policy `resources.identifiers`). */
     identifiers: PolicyIdentifierPattern[];
+    /**
+     * Single meta path pattern (exact, or `prefix*`). Mutually exclusive with `match_meta_paths`;
+     * the server rejects writes that set both fields.
+     */
     match_meta_path?: string;
+    /**
+     * Array of meta path patterns (anyOf). Each entry is exact or `prefix*`. Useful for one
+     * trigger gating multiple fields of the same shape (e.g. role-restricted profile fields).
+     * Empty array means no constraint. Mutually exclusive with `match_meta_path`.
+     */
+    match_meta_paths?: string[];
     match_operation?: 'set' | 'append' | 'delete';
 }
 /** `action` block: run unquery and write result to target meta. */
@@ -992,10 +1051,21 @@ export interface TriggerAction {
 /** Stored trigger document under /_xcitedb/triggers. */
 export interface TriggerDefinition {
     enabled?: boolean;
+    /**
+     * `"after"` (default): run after the write commits, may run actions. `"before"`:
+     * predicate-only — runs before the write applies and rejects with HTTP 422 when matched.
+     * BEFORE triggers must not have `action` or `actions`.
+     */
+    phase?: 'before' | 'after';
     event: 'meta_changed' | 'document_written' | 'document_deleted';
     match: TriggerMatch;
     conditions?: PolicyConditions;
-    action: TriggerAction;
+    /** AFTER-trigger single action (legacy). Mutually exclusive with `actions`. Forbidden on BEFORE triggers. */
+    action?: TriggerAction;
+    /** AFTER-trigger multi-action variant. Mutually exclusive with `action`. Forbidden on BEFORE triggers. */
+    actions?: TriggerAction[];
+    /** BEFORE-trigger reject message surfaced to clients on HTTP 422. */
+    reject_reason?: string;
 }
 export interface StoredTriggerResponse {
     trigger_id: string;

package/llms-full.txt

@@ -1157,18 +1157,55 @@ Definitions are stored as JSON under **`/_xcitedb/triggers`**. After a matching
 | Field | Required | Description |
 |--------|----------|-------------|
 | `enabled` | No (default true) | If false, trigger is skipped. |
+| `phase` | No (default `"after"`) | `"after"` runs post-write actions; `"before"` is predicate-only and rejects the write with HTTP 422 when matched. BEFORE triggers must not have `action` or `actions`. |
 | `event` | Yes | `meta_changed`, `document_written`, or `document_deleted`. |
-| `match` | Yes | Must include **`identifiers`**: non-empty array of identifier patterns (`exact`, `match_start`, `match_end`, `contains`, `regex`). Optional **`match_meta_path`**: exact path or prefix ending with `*`. Optional **`match_operation`**: `set`, `append`, or `delete` (meta / delete ops). |
+| `match` | Yes | Must include **`identifiers`**: non-empty array of identifier patterns (`exact`, `match_start`, `match_end`, `contains`, `regex`). Optional **`match_meta_path`** (single exact path or `prefix*`) **or** **`match_meta_paths`** (array of patterns, anyOf — useful for one trigger gating multiple fields; mutually exclusive with `match_meta_path`). Optional **`match_operation`**: `set`, `append`, or `delete`. |
 | `conditions` | No | Optional **`branches`** (same as policies) and **`expression`** (see below). |
-| `action` | Yes | **`query`** (`XCiteQuery`), **`unquery`** (Unquery DSL template), **`target_identifier`** (literal or `"$trigger_identifier"`), **`meta_path`**, optional **`mode`**: `set` (default), `append` (strict — unquery output must be a JSON array, stored target must be an array; trigger logs and skips on misuse), or `merge_append` (deep — recurses into objects to extend nested arrays). |
+| `action` | AFTER only | **`query`** (`XCiteQuery`), **`unquery`** (Unquery DSL template), **`target_identifier`** (literal or `"$trigger_identifier"`), **`meta_path`**, optional **`mode`**: `set` (default), `append` (strict — unquery output must be a JSON array, stored target must be an array; trigger logs and skips on misuse), or `merge_append` (deep — recurses into objects to extend nested arrays). Mutually exclusive with `actions`. |
+| `actions` | AFTER only | Array of action objects for multi-op fan-out. Each `kind` is one of `WriteMeta`, `AppendMeta`, `WriteJson`, `DeleteIdentifier`, `AddIdentifier`, `ClearMetaPath`. Mutually exclusive with `action`. |
+| `reject_reason` | BEFORE only | Message returned to clients on HTTP 422 when the trigger matches. |
 
-### Expression context for **triggers** (`conditions.expression`)
+### BEFORE triggers (predicate-only)
+
+`phase: "before"` triggers run *before* the write applies and reject it with **HTTP 422** when the match and conditions both hold. They are predicate-only — no `action` / `actions`. Fired only on writes routed through **`/api/v1/txn`** (regular `/api/v1/meta` and `/api/v1/json-documents` writes do not invoke BEFORE triggers).
+
+The expression sees **`prior`** alongside `value`:
+
+- **`prior`** (BEFORE + `meta_changed` only) — value at the same `meta_path` before the write. Bound only when at least one BEFORE trigger's expression references `prior`. JSON `null` when the path is currently absent.
+
+Common patterns (the expression grammar uses `=` / `!=` / `<` / `>`, and single `&` / `|` for boolean):
+
+- **Immutability after first set**: `prior is_literal & value != prior` — rejects only when a literal value already exists and differs.
+- **Monotonic non-decreasing**: `prior is_literal & value < prior`.
+- **Role-gated field**: `subject.role != 'system'` (no `prior` needed).
+
+Example (`song.id` immutable once set):
+
+```json
+{
+  "trigger_id": "song_id_immutable",
+  "trigger": {
+    "phase": "before",
+    "event": "meta_changed",
+    "match": {
+      "identifiers": [{ "match_start": "/spaces/" }],
+      "match_meta_path": "id"
+    },
+    "conditions": {
+      "expression": "prior is_literal & value != prior"
+    },
+    "reject_reason": "song id is immutable once set"
+  }
+}
+```
 
-Not the same as policies: there is **no `subject`**. Context object:
+### Expression context for **triggers** (`conditions.expression`)
 
 - **`trigger`**: `{ "event", "meta_path", "operation" }` (`operation`: `set` / `append` / `delete`)
 - **`value`**: JSON written at `meta_path` for `meta_changed`, or null
+- **`prior`** (BEFORE + `meta_changed` only): value at `meta_path` before the write, or `null` if absent
 - **`resource`**: `{ "identifier", "path" }` for the firing identifier
+- **`subject`**: `{ "id", "user_id", "email", "type", "role", "groups", "attr" }` (BEFORE only — AFTER triggers historically have no subject)
 - **`env`**: `{ "branch" }`
 
 ### Unquery variables injected for triggers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xcitedbs/client",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "XCiteDB BaaS client SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",