nucleus-core-ts 0.9.950 → 0.9.951

package/dist/src/ElysiaPlugin/routes/auth/assignDefaultRole.d.ts

@@ -19,6 +19,39 @@ type PgTable = ReturnType<typeof import('drizzle-orm/pg-core').pgTable>;
  * - **Schema-aware**: caller passes the schema-resolved `rolesTable` and
  *   `userRolesTable`, so this helper works correctly under multi-tenancy.
  */
+/**
+ * The role names a new account should receive, from the two config shapes.
+ *
+ * `defaultRoles` (a list) is what an operator edits in the admin panel; a
+ * baseline account usually needs more than one role, and the single
+ * `defaultRole` string could not express that. The string is still honoured so
+ * an installation that predates the list keeps working, and both are merged
+ * rather than one shadowing the other — an operator who adds a list has not
+ * asked for the role their config has always granted to stop being granted.
+ *
+ * Blanks and duplicates are dropped: an empty box in the panel is "nothing",
+ * not a role named "".
+ */
+export declare function resolveDefaultRoleNames(authentication: {
+    defaultRole?: string | null;
+    defaultRoles?: readonly string[] | null;
+} | null | undefined): string[];
+/**
+ * Assigns every configured default role to a newly created user.
+ *
+ * Each name is handled independently: a role that no longer exists is logged
+ * and skipped, and the rest are still granted. The alternative — abandoning the
+ * whole list on the first bad name — would silently downgrade every new account
+ * because one role was renamed.
+ */
+export declare function assignDefaultRoles(params: {
+    db: NodePgDatabase;
+    userId: string;
+    roleNames: readonly string[];
+    rolesTable: PgTable | null | undefined;
+    userRolesTable: PgTable | null | undefined;
+    logger: Logger;
+}): Promise<void>;
 export declare function assignDefaultRole(params: {
     db: NodePgDatabase;
     userId: string;

package/dist/src/ElysiaPlugin/routes/auth/cohort/types.d.ts

@@ -11,6 +11,8 @@ export type CohortRouteConfig = {
     profilesTable: PgTable | null;
     basePath: string;
     defaultRole?: string;
+    /** List form of `defaultRole`; merged with it. See NucleusConfigOptions.authentication. */
+    defaultRoles?: string[];
     emailExemptDomains?: string[];
     passwordPolicy?: {
         minLength?: number;

package/dist/src/ElysiaPlugin/routes/auth/types.d.ts

@@ -33,6 +33,12 @@ export interface AuthRouteConfig {
          * of blocking sign-up.
          */
         defaultRole?: string;
+        /**
+         * The list form of `defaultRole` (see NucleusConfigOptions). Merged with it,
+         * never replacing it. Read per request so the admin panel's write applies to
+         * the next sign-up.
+         */
+        defaultRoles?: string[];
         cookieMaxAgeBufferSeconds?: number;
         cookieDomain?: string;
         emailExemptDomains?: string[];

package/dist/src/types.d.ts

@@ -328,6 +328,24 @@ export interface NucleusConfigOptions {
          * Example: "user-free"
          */
         defaultRole?: string;
+        /**
+         * Role names to assign automatically to every newly created user — the
+         * list form of `defaultRole`, for the common case where a baseline account
+         * needs several roles (e.g. chat + knowledge + a spend cap).
+         *
+         * Merged with `defaultRole` rather than replacing it, so adding a list
+         * never silently revokes the role an installation has always granted. Each
+         * name is resolved independently and a missing one is skipped with a
+         * warning — one renamed role must not downgrade every new account.
+         *
+         * Settable at runtime through the config write-path (`PATCH
+         * /nucleus/config/authentication`), which is how the portal's "roles for
+         * new SSO accounts" panel writes it. Read per request, so a change applies
+         * on the next sign-up rather than the next deployment.
+         *
+         * Example: ["vorion-chat-basic", "vorion-knowledge-manager"]
+         */
+        defaultRoles?: string[];
         /**
          * URL of the IDP service for consumer-mode services to call POST /auth/check.
          * Required when mode="consumer" and authorization.enabled=true for scope-based checks.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.950",
+	"version": "0.9.951",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",

package/scripts/build.ts

@@ -16,6 +16,17 @@ const BLUE = '\x1b[34m'
 const RED = '\x1b[31m'
 const NC = '\x1b[0m'
 
+/**
+ * A path fit to be pasted into a shell command.
+ *
+ * `join()` returns `dist\client.js` on Windows, and the backslash is an ESCAPE
+ * character to the shell — `--outfile=dist\client.js` silently became
+ * `--outfile=distclient.js`, so `dist/client.js` was simply absent from a build
+ * that reported success. Every consumer importing `nucleus-core-ts/client`
+ * would then fail to resolve at install time, from a package that looked fine.
+ */
+const shellPath = (p: string) => p.replaceAll('\\', '/')
+
 const log = {
   info: (msg: string) => console.log(`${BLUE}ℹ️  ${msg}${NC}`),
   success: (msg: string) => console.log(`${GREEN}✅ ${msg}${NC}`),
@@ -69,7 +80,7 @@ async function buildClientEntries() {
 
   for (const [exportPath, entry] of Object.entries(clientEntries)) {
     const outFile = entry.replace(/\.ts$/, '.js').replace('./', '')
-    const outPath = join(config.build.outDir, outFile)
+    const outPath = shellPath(join(config.build.outDir, outFile))
 
     const clientMinifyVal = config.build.minify
     const clientMinifyFlags =
@@ -134,7 +145,7 @@ async function transpileClientModules() {
     } else {
       // Single file transpilation
       const outFile = entry.replace(/\.ts$/, '.js').replace('./', '')
-      const outPath = join(config.build.outDir, outFile)
+      const outPath = shellPath(join(config.build.outDir, outFile))
 
       const outDir = outPath.substring(0, outPath.lastIndexOf('/'))
       if (outDir) {