@askdb/core 1.0.0-beta.44 → 1.0.0-beta.46

package/dist/schema/v2/mentions.js

@@ -1,6 +1,9 @@
 // A match's ends may not touch a letter, digit, or `_` of any script.
 const BEFORE = "(?<![\\p{L}\\p{N}_])";
 const AFTER = "(?![\\p{L}\\p{N}_])";
+// Between a qualified name's table and column: a tight dot, or spaces or tabs
+// on both sides ("users. Org_id" ends a sentence).
+const QUALIFIER = "(?:\\.|[ \\t]+\\.[ \\t]+)";
 /**
  * Compiles the "mentions a sensitive column by name" rule of the schema v2
  * contract (`docs/contracts/schema-v2.md`, Sensitive propagation) for
@@ -8,16 +11,40 @@ const AFTER = "(?![\\p{L}\\p{N}_])";
  * checks every describable text of a schema against the same list.
  */
 export function createMentionMatcher(names) {
-    const entries = names
-        .filter((name) => (typeof name === "string" ? name !== "" : name.table !== "" && name.column !== ""))
-        .map((name) => ({ name, source: namePattern(name) }));
-    const each = entries.map(({ name, source }) => ({ name, pattern: new RegExp(`${BEFORE}${source}${AFTER}`, "iu") }));
-    const any = entries.length === 0
-        ? undefined
-        : new RegExp(`${BEFORE}(?:${entries.map((e) => e.source).join("|")})${AFTER}`, "iu");
+    const entries = names.filter((name) => typeof name === "string" ? name !== "" : name.table !== "" && name.column !== "");
+    // One alternative per bare name, and one per table for its qualified names
+    // (`table` + separator + any of its columns): the same matches as one
+    // alternative per name.
+    const bare = [];
+    const columnsByTable = new Map();
+    for (const name of entries) {
+        if (typeof name === "string")
+            bare.push(partPattern(name));
+        else {
+            const columns = columnsByTable.get(name.table) ?? [];
+            columns.push(partPattern(name.column));
+            columnsByTable.set(name.table, columns);
+        }
+    }
+    const tables = [...columnsByTable.keys()].map(partPattern);
+    const alternatives = [
+        ...bare,
+        ...[...columnsByTable.values()].map((columns, i) => `${tables[i]}${QUALIFIER}(?:${columns.join("|")})`),
+    ];
+    if (alternatives.length === 0)
+        return { mentionsAny: () => false, find: () => [] };
+    const any = new RegExp(`${BEFORE}(?:${alternatives.join("|")})${AFTER}`, "iu");
+    // A first pass whose size follows the number of tables, not of their columns: a
+    // qualified mention needs one of its tables followed by the separator. Every
+    // text passes through it, and only a hit runs the full pattern, whose size
+    // slows some engines (Node 22's) on every text otherwise.
+    const firstPass = new RegExp(`${BEFORE}(?:${[...bare.map((b) => `${b}${AFTER}`), ...tables.map((t) => `${t}${QUALIFIER}`)].join("|")})`, "iu");
+    // Compiled on the first `find`: the prompt builders only ask `mentionsAny`.
+    let each;
+    const patterns = () => (each ??= entries.map((name) => ({ name, pattern: new RegExp(`${BEFORE}${namePattern(name)}${AFTER}`, "iu") })));
     return {
-        mentionsAny: (text) => Boolean(text) && any !== undefined && any.test(text),
-        find: (text) => (text ? each.filter(({ pattern }) => pattern.test(text)).map(({ name }) => name) : []),
+        mentionsAny: (text) => Boolean(text) && firstPass.test(text) && any.test(text),
+        find: (text) => (text ? patterns().filter(({ pattern }) => pattern.test(text)).map(({ name }) => name) : []),
     };
 }
 /**
@@ -30,6 +57,34 @@ export function createMentionMatcher(names) {
 export function findMentionedNames(text, names) {
     return createMentionMatcher(names).find(text);
 }
+/**
+ * The names whose mention marks text as naming a sensitive column, for the
+ * whole schema (ADR 0017; how they match is the schema v2 contract's mention
+ * rule). A column marked sensitive itself counts by its bare name; a column
+ * of a sensitive table that is sensitive only through it
+ * (`sensitiveFromTable`) counts only qualified, since its bare name is often
+ * generic (`id`, `org_id`, `name`). Untracked tables' columns count too.
+ * `@askdb/rag`'s chunker and both NL→SQL prompt builders check describable
+ * text against this list.
+ */
+export function sensitiveMentionNames(schema) {
+    const names = [];
+    const bare = new Set();
+    for (const t of schema.tables) {
+        for (const c of t.columns) {
+            if (!c.sensitive && !t.sensitive)
+                continue;
+            if (t.sensitive && c.sensitiveFromTable === true) {
+                names.push({ table: t.name, column: c.name });
+            }
+            else if (!bare.has(c.name)) {
+                bare.add(c.name);
+                names.push(c.name);
+            }
+        }
+    }
+    return names;
+}
 /** A bare name, or a qualified one's table and column parts: as written, or wrapped in one matching pair of quotes or brackets. */
 function partPattern(part) {
     const p = escapeRegex(part);
@@ -38,8 +93,7 @@ function partPattern(part) {
 function namePattern(name) {
     if (typeof name === "string")
         return partPattern(name);
-    // A tight dot, or spaces or tabs on both sides: "users. Org_id" ends a sentence.
-    return `${partPattern(name.table)}(?:\\.|[ \\t]+\\.[ \\t]+)${partPattern(name.column)}`;
+    return `${partPattern(name.table)}${QUALIFIER}${partPattern(name.column)}`;
 }
 function escapeRegex(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

package/dist/schema/v2/mentions.js.map

@@ -1 +1 @@
-{"version":3,"file":"mentions.js","sourceRoot":"","sources":["../../../src/schema/v2/mentions.ts"],"names":[],"mappings":"AAcA,sEAAsE;AACtE,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,KAAK,GAAG,qBAAqB,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA6B;IAChE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;SACpG,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACpH,MAAM,GAAG,GACP,OAAO,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzF,OAAO;QACL,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3E,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAwB,IAAY,EAAE,KAAmB;IACzF,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAQ,CAAC;AACvD,CAAC;AAED,mIAAmI;AACnI,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,IAAiB;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACvD,iFAAiF;IACjF,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,4BAA4B,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"mentions.js","sourceRoot":"","sources":["../../../src/schema/v2/mentions.ts"],"names":[],"mappings":"AAgBA,sEAAsE;AACtE,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,8EAA8E;AAC9E,mDAAmD;AACnD,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA6B;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACpC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,CACjF,CAAC;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,wBAAwB;IACxB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;aACtD,CAAC;YACJ,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI;QACP,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;KACxG,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACnF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAC1G,IAAI,CACL,CAAC;IACF,4EAA4E;IAC5E,IAAI,IAA0D,CAAC;IAC/D,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnH,OAAO;QACL,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9E,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7G,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAwB,IAAY,EAAE,KAAmB;IACzF,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAQ,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS;gBAAE,SAAS;YAC3C,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mIAAmI;AACnI,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,IAAiB;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC"}

package/dist/schema/v2/save-file.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Write `content` (a string, written as UTF-8, or bytes written as given) to a file
+ * inside a schema directory so that no link can redirect the write out of it
+ * (ADR 0028). `relativePath` names the file from `schemaDir`
+ * with `/` between its parts (`schema.json`, `tables/orders.md`). Every AskDB writer
+ * into a schema directory goes through here: `@askdb/enrich`'s saves, Studio's
+ * Playground history and `.gitignore`, and `@askdb/introspect`'s `schema.json`. A
+ * schema directory can come from an untrusted checkout (git stores symbolic links,
+ * tar archives also store hard links), and Studio saves into it for as long as it
+ * runs.
+ *
+ * Errors read `Refusing to write <relativePath> outside the schema directory: <why>`.
+ *
+ * - `relativePath` must name a file below `schemaDir`: an empty part, `.`, `..`, a
+ *   NUL byte, or (on Windows) `\` in a part is refused, and so is an absolute path.
+ * - No directory between the schema directory and the target (`tables/`), and not
+ *   the target itself, may be a symbolic link; either one is refused. The schema
+ *   directory itself may be one: it is the path the user chose. Directories are not
+ *   created.
+ * - The content goes to a new temp file next to the target (`O_EXCL`, so it never
+ *   opens an existing path), which is then renamed over the target. `rename`
+ *   replaces the directory entry instead of writing into the existing file, so a
+ *   hard link to a file elsewhere is detached, not written through, and a symbolic
+ *   link planted at the target after the check is replaced, not followed. This
+ *   holds on Windows too, which has no `O_NOFOLLOW`.
+ * - A target the caller can't write is refused with `EACCES`, as a plain write
+ *   would be. `rename` needs only write access to the directory, so without this
+ *   check a read-only file (how Perforce and ClearCase mark files not checked out)
+ *   would be replaced on macOS and Linux. The temp file needs write access to the
+ *   directory too, so a save into a directory the caller can't write fails with
+ *   `EACCES` even when the file itself is writable.
+ * - The temp file gets the target's owner, group, and permission bits before any
+ *   content is written, so a `0600` file's new content is never readable by others
+ *   and a `0660` file stays shared with its own group, not the group a new file in
+ *   the directory would get (`keepOwnerAndGroup`). It is `fsync`ed before the
+ *   rename. Readers, and a crash or power loss, see either the old file or the new
+ *   one, never a partial write.
+ *
+ * Not covered: a directory between the schema directory and the target (`tables/`)
+ * being swapped for a link after the check and before the rename, since the temp
+ * path and the rename still resolve through it. That needs a concurrent local
+ * writer racing a save. And only root can give a file to another user, so on macOS
+ * and Linux a save by someone other than the file's owner (a member of a group that
+ * may write it) makes the saver its owner. On Windows, the rename fails with `EPERM`
+ * while another process holds the target open without delete sharing.
+ */
+export declare function saveSchemaFile(schemaDir: string, relativePath: string, content: string | Uint8Array): void;
+/**
+ * `mode` for a file whose group could not be kept: the group and others both get
+ * only what both had before, so neither the group the file lands in nor the old
+ * group's non-members gain access (`0660` becomes `0600`, `0604` becomes `0600`).
+ *
+ * @internal Exported for its tests; `index.ts` doesn't re-export it.
+ */
+export declare function modeWhenGroupLost(mode: number): number;
+//# sourceMappingURL=save-file.d.ts.map

package/dist/schema/v2/save-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-file.d.ts","sourceRoot":"","sources":["../../../src/schema/v2/save-file.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GAAG,UAAU,GAC3B,IAAI,CAwDN;AAsBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGtD"}

package/dist/schema/v2/save-file.js

@@ -0,0 +1,138 @@
+import { randomBytes } from "node:crypto";
+import { accessSync, closeSync, constants as fsConstants, fchmodSync, fchownSync, fstatSync, fsyncSync, lstatSync, openSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+/**
+ * Write `content` (a string, written as UTF-8, or bytes written as given) to a file
+ * inside a schema directory so that no link can redirect the write out of it
+ * (ADR 0028). `relativePath` names the file from `schemaDir`
+ * with `/` between its parts (`schema.json`, `tables/orders.md`). Every AskDB writer
+ * into a schema directory goes through here: `@askdb/enrich`'s saves, Studio's
+ * Playground history and `.gitignore`, and `@askdb/introspect`'s `schema.json`. A
+ * schema directory can come from an untrusted checkout (git stores symbolic links,
+ * tar archives also store hard links), and Studio saves into it for as long as it
+ * runs.
+ *
+ * Errors read `Refusing to write <relativePath> outside the schema directory: <why>`.
+ *
+ * - `relativePath` must name a file below `schemaDir`: an empty part, `.`, `..`, a
+ *   NUL byte, or (on Windows) `\` in a part is refused, and so is an absolute path.
+ * - No directory between the schema directory and the target (`tables/`), and not
+ *   the target itself, may be a symbolic link; either one is refused. The schema
+ *   directory itself may be one: it is the path the user chose. Directories are not
+ *   created.
+ * - The content goes to a new temp file next to the target (`O_EXCL`, so it never
+ *   opens an existing path), which is then renamed over the target. `rename`
+ *   replaces the directory entry instead of writing into the existing file, so a
+ *   hard link to a file elsewhere is detached, not written through, and a symbolic
+ *   link planted at the target after the check is replaced, not followed. This
+ *   holds on Windows too, which has no `O_NOFOLLOW`.
+ * - A target the caller can't write is refused with `EACCES`, as a plain write
+ *   would be. `rename` needs only write access to the directory, so without this
+ *   check a read-only file (how Perforce and ClearCase mark files not checked out)
+ *   would be replaced on macOS and Linux. The temp file needs write access to the
+ *   directory too, so a save into a directory the caller can't write fails with
+ *   `EACCES` even when the file itself is writable.
+ * - The temp file gets the target's owner, group, and permission bits before any
+ *   content is written, so a `0600` file's new content is never readable by others
+ *   and a `0660` file stays shared with its own group, not the group a new file in
+ *   the directory would get (`keepOwnerAndGroup`). It is `fsync`ed before the
+ *   rename. Readers, and a crash or power loss, see either the old file or the new
+ *   one, never a partial write.
+ *
+ * Not covered: a directory between the schema directory and the target (`tables/`)
+ * being swapped for a link after the check and before the rename, since the temp
+ * path and the rename still resolve through it. That needs a concurrent local
+ * writer racing a save. And only root can give a file to another user, so on macOS
+ * and Linux a save by someone other than the file's owner (a member of a group that
+ * may write it) makes the saver its owner. On Windows, the rename fails with `EPERM`
+ * while another process holds the target open without delete sharing.
+ */
+export function saveSchemaFile(schemaDir, relativePath, content) {
+    const refuse = (why) => new Error(`Refusing to write ${relativePath} outside the schema directory: ${why}`);
+    const dirs = relativePath.split("/");
+    for (const part of dirs) {
+        if (part === "" ||
+            part === "." ||
+            part === ".." ||
+            part.includes("\0") ||
+            (process.platform === "win32" && part.includes("\\"))) {
+            throw refuse(`${JSON.stringify(part)} is not a file or directory name`);
+        }
+    }
+    const filename = dirs.pop();
+    let dir = schemaDir;
+    for (const [i, part] of dirs.entries()) {
+        dir = join(dir, part);
+        if (lstatSync(dir).isSymbolicLink()) {
+            throw refuse(`${dirs.slice(0, i + 1).join("/")}/ is a symbolic link`);
+        }
+    }
+    const filePath = join(dir, filename);
+    const existing = lstatSync(filePath, { throwIfNoEntry: false });
+    if (existing?.isSymbolicLink())
+        throw refuse(`${JSON.stringify(filename)} is a symbolic link`);
+    if (existing)
+        accessSync(filePath, fsConstants.W_OK);
+    const tempPath = join(dir, `.askdb-save-${randomBytes(8).toString("hex")}.tmp`);
+    const fd = openSync(tempPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 0o666);
+    try {
+        try {
+            // Keep the replaced file's owner, group, and permission bits, before the content lands.
+            if (existing) {
+                const mode = existing.mode & 0o777;
+                const groupKept = keepOwnerAndGroup(fd, existing);
+                fchmodSync(fd, groupKept ? mode : modeWhenGroupLost(mode));
+            }
+            writeFileSync(fd, content);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tempPath, filePath);
+    }
+    catch (e) {
+        try {
+            rmSync(tempPath, { force: true });
+        }
+        catch {
+            // Report the save's own error, not a failed cleanup (e.g. Windows EPERM).
+        }
+        throw e;
+    }
+}
+/**
+ * Give the file open at `fd` the owner and group of `existing`, as far as the
+ * process may: only root can change a file's owner, and anyone else can set only
+ * a group they belong to. Returns whether the group now matches; Windows has no
+ * POSIX owner or group, so there it is always true.
+ */
+function keepOwnerAndGroup(fd, existing) {
+    if (process.platform === "win32")
+        return true;
+    const tryChown = (uid, gid) => {
+        try {
+            fchownSync(fd, uid, gid);
+        }
+        catch {
+            // Not permitted (or not supported by this file system); checked below.
+        }
+    };
+    if (fstatSync(fd).uid !== existing.uid)
+        tryChown(existing.uid, existing.gid);
+    if (fstatSync(fd).gid !== existing.gid)
+        tryChown(-1, existing.gid);
+    return fstatSync(fd).gid === existing.gid;
+}
+/**
+ * `mode` for a file whose group could not be kept: the group and others both get
+ * only what both had before, so neither the group the file lands in nor the old
+ * group's non-members gain access (`0660` becomes `0600`, `0604` becomes `0600`).
+ *
+ * @internal Exported for its tests; `index.ts` doesn't re-export it.
+ */
+export function modeWhenGroupLost(mode) {
+    const shared = (mode >> 3) & mode & 0o007;
+    return (mode & 0o700) | (shared << 3) | shared;
+}
+//# sourceMappingURL=save-file.js.map

package/dist/schema/v2/save-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-file.js","sourceRoot":"","sources":["../../../src/schema/v2/save-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,UAAU,EACV,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,UAAU,EACV,MAAM,EACN,aAAa,GAEd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,YAAoB,EACpB,OAA4B;IAE5B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,IAAI,KAAK,CAAC,qBAAqB,YAAY,kCAAkC,GAAG,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IACE,IAAI,KAAK,EAAE;YACX,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,IAAI;YACb,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACrD,CAAC;YACD,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAG,CAAC;IAC7B,IAAI,GAAG,GAAG,SAAS,CAAC;IACpB,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACvC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACpC,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,QAAQ,EAAE,cAAc,EAAE;QAAE,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC/F,IAAI,QAAQ;QAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,EAAE,GAAG,QAAQ,CACjB,QAAQ,EACR,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAC/D,KAAK,CACN,CAAC;IACF,IAAI,CAAC;QACH,IAAI,CAAC;YACH,wFAAwF;YACxF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC;gBACnC,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAClD,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC3B,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,EAAU,EAAE,QAAe;IACpD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,GAAW,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;IACH,CAAC,CAAC;IACF,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;QAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;QAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC;IAC1C,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;AACjD,CAAC"}

package/dist/schema/v2/tenant-policy-loader.d.ts

@@ -1,13 +1,4 @@
-import { type ParsedTenantPolicyMarkdown, type NormalizedTenantPolicy, type ScopeThrough } from "./tenant-policy.js";
+import { type ParsedTenantPolicyMarkdown, type NormalizedTenantPolicy } from "./tenant-policy.js";
 export declare function parseTenantPolicyMarkdown(content: string, filePath?: string): ParsedTenantPolicyMarkdown;
 export declare function normalizeTenantPolicy(parsed: ParsedTenantPolicyMarkdown, physicalTableIds: Set<string>, physicalColumnIds: Set<string>): NormalizedTenantPolicy;
-export declare function isScopeThroughColumn(s: ScopeThrough): s is ScopeThrough & {
-    column: string;
-};
-export declare function isScopeThroughJoin(s: ScopeThrough): s is ScopeThrough & {
-    join: Array<{
-        from: string;
-        to: string;
-    }>;
-};
 //# sourceMappingURL=tenant-policy-loader.d.ts.map

package/dist/schema/v2/tenant-policy-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-policy-loader.d.ts","sourceRoot":"","sources":["../../../src/schema/v2/tenant-policy-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,0BAA0B,EAG/B,KAAK,sBAAsB,EAI3B,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAM5B,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,0BAA0B,CAiB5B;AAyBD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,0BAA0B,EAClC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAC7B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,sBAAsB,CAqKxB;AAyDD,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAE5F;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAErH"}
+{"version":3,"file":"tenant-policy-loader.d.ts","sourceRoot":"","sources":["../../../src/schema/v2/tenant-policy-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,0BAA0B,EAG/B,KAAK,sBAAsB,EAI5B,MAAM,oBAAoB,CAAC;AAM5B,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,0BAA0B,CAiB5B;AAiCD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,0BAA0B,EAClC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAC7B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC7B,sBAAsB,CAwLxB"}

package/dist/schema/v2/tenant-policy-loader.js

@@ -1,6 +1,6 @@
 import { SchemaParseError } from "../../errors.js";
 import { readFrontMatter } from "./parser.js";
-import { assertDistinctRootPlaceholders, tenantPolicyFrontmatterSchema, TENANT_POLICY_H2_SECTIONS, } from "./tenant-policy.js";
+import { assertDistinctRootPlaceholders, formatTenantPolicyWarning, tenantPolicyFrontmatterSchema, TENANT_POLICY_H2_SECTIONS, } from "./tenant-policy.js";
 // ---------------------------------------------------------------------------
 // Parsing
 // ---------------------------------------------------------------------------
@@ -34,18 +34,28 @@ function extractTenantPolicySections(body) {
 // ---------------------------------------------------------------------------
 // Cross-reference validation & normalization
 // ---------------------------------------------------------------------------
+/** Problems that stay warnings in every mode: an entry for a table schema.json no longer has. */
+const TABLE_REMOVED_KINDS = new Set([
+    "orphaned_root_id",
+    "orphaned_scoped_table_id",
+    "orphaned_polymorphic_table_id",
+    "orphaned_global_table_id",
+]);
 export function normalizeTenantPolicy(parsed, physicalTableIds, physicalColumnIds) {
     const fm = parsed.frontmatter;
     const warnings = [];
     // A shared placeholder would bind one root's IDs where another root's column is compared.
     assertDistinctRootPlaceholders(fm.roots);
     const rootIds = new Set(fm.roots.map((r) => r.id));
+    // An entry whose own table schema.json no longer has reports only that table: its
+    // columns went with it, and the entry scopes nothing, so they are not checked.
+    const tableRemoved = (tableId) => !physicalTableIds.has(tableId);
     // Validate root table IDs exist in physical schema
     for (const root of fm.roots) {
-        if (!physicalTableIds.has(root.id)) {
+        if (tableRemoved(root.id)) {
             warnings.push({ kind: "orphaned_root_id", id: root.id });
         }
-        if (!physicalColumnIds.has(root.tenantIdColumn)) {
+        else if (!physicalColumnIds.has(root.tenantIdColumn)) {
             warnings.push({
                 kind: "orphaned_column_id",
                 id: root.tenantIdColumn,
@@ -60,7 +70,7 @@ export function normalizeTenantPolicy(parsed, physicalTableIds, physicalColumnId
                     context: `parent of root ${root.id}`,
                 });
             }
-            if (!physicalColumnIds.has(root.parent.foreignKey)) {
+            if (!tableRemoved(root.id) && !physicalColumnIds.has(root.parent.foreignKey)) {
                 warnings.push({
                     kind: "orphaned_fk_id",
                     id: root.parent.foreignKey,
@@ -85,7 +95,8 @@ export function normalizeTenantPolicy(parsed, physicalTableIds, physicalColumnId
                 context: `hierarchy child`,
             });
         }
-        if (!physicalColumnIds.has(edge.foreignKey)) {
+        // The edge's foreign key sits on the child's table.
+        if (!tableRemoved(edge.child) && !physicalColumnIds.has(edge.foreignKey)) {
             warnings.push({
                 kind: "orphaned_fk_id",
                 id: edge.foreignKey,
@@ -100,7 +111,8 @@ export function normalizeTenantPolicy(parsed, physicalTableIds, physicalColumnId
     }
     // Validate scoped tables
     for (const st of fm.scopedTables ?? []) {
-        if (!physicalTableIds.has(st.id)) {
+        const removed = tableRemoved(st.id);
+        if (removed) {
             warnings.push({ kind: "orphaned_scoped_table_id", id: st.id });
         }
         for (const path of st.scopeThrough) {
@@ -111,6 +123,8 @@ export function normalizeTenantPolicy(parsed, physicalTableIds, physicalColumnId
                     context: `scopeThrough on ${st.id}`,
                 });
             }
+            if (removed)
+                continue;
             if ("column" in path) {
                 if (!physicalColumnIds.has(path.column)) {
                     warnings.push({
@@ -142,17 +156,18 @@ export function normalizeTenantPolicy(parsed, physicalTableIds, physicalColumnId
     }
     // Validate polymorphic tables
     for (const pt of fm.polymorphicTables ?? []) {
-        if (!physicalTableIds.has(pt.id)) {
+        const removed = tableRemoved(pt.id);
+        if (removed) {
             warnings.push({ kind: "orphaned_polymorphic_table_id", id: pt.id });
         }
-        if (!physicalColumnIds.has(pt.typeColumn)) {
+        if (!removed && !physicalColumnIds.has(pt.typeColumn)) {
             warnings.push({
                 kind: "orphaned_column_id",
                 id: pt.typeColumn,
                 context: `polymorphic typeColumn on ${pt.id}`,
             });
         }
-        if (!physicalColumnIds.has(pt.idColumn)) {
+        if (!removed && !physicalColumnIds.has(pt.idColumn)) {
             warnings.push({
                 kind: "orphaned_column_id",
                 id: pt.idColumn,
@@ -171,10 +186,20 @@ export function normalizeTenantPolicy(parsed, physicalTableIds, physicalColumnId
     }
     // Validate global tables
     for (const gt of fm.globalTables ?? []) {
-        if (!physicalTableIds.has(gt)) {
+        if (tableRemoved(gt)) {
             warnings.push({ kind: "orphaned_global_table_id", id: gt });
         }
     }
+    // Under strict, a policy that doesn't match schema.json fails the load: tenancy
+    // must not run on a policy with a renamed column or a cycle (ADR 0023). Only a
+    // removed table's entry stays a warning, since it scopes nothing.
+    if (fm.enforcement === "strict") {
+        const errors = warnings.filter((w) => !TABLE_REMOVED_KINDS.has(w.kind));
+        if (errors.length > 0) {
+            throw new SchemaParseError(`the tenant policy doesn't match schema.json, and enforcement is strict: ` +
+                `${errors.map(formatTenantPolicyWarning).join("; ")}. Update tenant-policy.md to match schema.json.`);
+        }
+    }
     // Build coverage report
     const coverage = buildCoverage(fm, physicalTableIds);
     return {
@@ -232,54 +257,43 @@ function buildCoverage(fm, physicalTableIds) {
     return entries;
 }
 // ---------------------------------------------------------------------------
-// Helpers — scope-through classification for mixed tables
-// ---------------------------------------------------------------------------
-export function isScopeThroughColumn(s) {
-    return "column" in s;
-}
-export function isScopeThroughJoin(s) {
-    return "join" in s;
-}
-// ---------------------------------------------------------------------------
 // Cycle detection in hierarchy
 // ---------------------------------------------------------------------------
 function detectHierarchyCycles(fm) {
-    const parentMap = new Map();
+    // Every parent of every child: the hierarchy is a DAG, so a root may have several
+    // parents, and keeping one per child would hide a cycle behind a later edge.
+    const parents = new Map();
+    const addEdge = (child, parent) => {
+        const set = parents.get(child) ?? new Set();
+        set.add(parent);
+        parents.set(child, set);
+    };
     for (const root of fm.roots) {
-        if (root.parent) {
-            parentMap.set(root.id, root.parent.root);
-        }
-    }
-    // Also use hierarchy edges
-    for (const edge of fm.hierarchy ?? []) {
-        parentMap.set(edge.child, edge.parent);
+        if (root.parent)
+            addEdge(root.id, root.parent.root);
     }
-    // Walk each node up — if we revisit a node, there's a cycle
-    const visited = new Set();
-    const inStack = new Set();
+    for (const edge of fm.hierarchy ?? [])
+        addEdge(edge.child, edge.parent);
+    // Depth-first walk up the parent edges; reaching a node still on the stack closes a cycle.
+    const state = new Map();
+    const stack = [];
     const cycleNodes = [];
-    for (const node of parentMap.keys()) {
-        if (visited.has(node))
-            continue;
-        const path = [];
-        let current = node;
-        while (current && !visited.has(current)) {
-            if (inStack.has(current)) {
-                // Found a cycle — collect the cycle nodes
-                const cycleStart = path.indexOf(current);
-                if (cycleStart !== -1) {
-                    cycleNodes.push(...path.slice(cycleStart));
-                }
-                break;
-            }
-            inStack.add(current);
-            path.push(current);
-            current = parentMap.get(current);
-        }
-        for (const n of path) {
-            visited.add(n);
-            inStack.delete(n);
+    const visit = (node) => {
+        state.set(node, "open");
+        stack.push(node);
+        for (const parent of parents.get(node) ?? []) {
+            const seen = state.get(parent);
+            if (seen === "open")
+                cycleNodes.push(...stack.slice(stack.indexOf(parent)));
+            else if (seen === undefined)
+                visit(parent);
         }
+        stack.pop();
+        state.set(node, "done");
+    };
+    for (const node of parents.keys()) {
+        if (!state.has(node))
+            visit(node);
     }
     return [...new Set(cycleNodes)];
 }

package/dist/schema/v2/tenant-policy-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-policy-loader.js","sourceRoot":"","sources":["../../../src/schema/v2/tenant-policy-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,yBAAyB,GAS1B,MAAM,oBAAoB,CAAC;AAE5B,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAiB;IAEjB,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,gBAAgB,CACxB,qCAAqC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACnE,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;IAC1B,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAY;IAEZ,MAAM,QAAQ,GAAmD,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CACjD,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CACnC,MAAkC,EAClC,gBAA6B,EAC7B,iBAA8B;IAE9B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IAC9B,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAE3C,0FAA0F;IAC1F,8BAA8B,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnD,mDAAmD;IACnD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,EAAE,EAAE,IAAI,CAAC,cAAc;gBACvB,OAAO,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,2BAA2B;oBACjC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACpB,OAAO,EAAE,kBAAkB,IAAI,CAAC,EAAE,EAAE;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;oBAC1B,OAAO,EAAE,qBAAqB,IAAI,CAAC,EAAE,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,2BAA2B;gBACjC,EAAE,EAAE,IAAI,CAAC,MAAM;gBACf,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,2BAA2B;gBACjC,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,OAAO,EAAE,iBAAiB;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,IAAI,CAAC,UAAU;gBACnB,OAAO,EAAE,kBAAkB,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,KAAK,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,EAAE,EAAE,IAAI,CAAC,IAAI;oBACb,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,EAAE,EAAE,IAAI,CAAC,MAAM;wBACf,OAAO,EAAE,0BAA0B,EAAE,CAAC,EAAE,EAAE;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC7B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACtC,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,gBAAgB;4BACtB,EAAE,EAAE,IAAI,CAAC,IAAI;4BACb,OAAO,EAAE,wBAAwB,EAAE,CAAC,EAAE,EAAE;yBACzC,CAAC,CAAC;oBACL,CAAC;oBACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;wBACpC,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,gBAAgB;4BACtB,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,OAAO,EAAE,wBAAwB,EAAE,CAAC,EAAE,EAAE;yBACzC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,EAAE,EAAE,EAAE,CAAC,UAAU;gBACjB,OAAO,EAAE,6BAA6B,EAAE,CAAC,EAAE,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ;gBACf,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAAE,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,yBAAyB;oBAC/B,EAAE,EAAE,UAAU;oBACd,OAAO,EAAE,wBAAwB,OAAO,QAAQ,EAAE,CAAC,EAAE,EAAE;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAErD,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE;QAC7B,YAAY,EAAE,EAAE,CAAC,YAAY,IAAI,EAAE;QACnC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,IAAI,EAAE;QAC7C,YAAY,EAAE,EAAE,CAAC,YAAY,IAAI,EAAE;QACnC,QAAQ;QACR,QAAQ;QACR,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,SAAS,aAAa,CACpB,EAA2B,EAC3B,gBAA6B;IAE7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgF,CAAC;IAE3G,cAAc;IACd,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,gBAAgB;IAChB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAA8B,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnF,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,gBAAgB;IAChB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,wCAAwC;IACxC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB,CAAC,CAAe;IAClD,OAAO,QAAQ,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,CAAe;IAChD,OAAO,MAAM,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,EAA2B;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACtC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAuB,IAAI,CAAC;QACvC,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,0CAA0C;gBAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;oBACtB,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM;YACR,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"tenant-policy-loader.js","sourceRoot":"","sources":["../../../src/schema/v2/tenant-policy-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,GAQ1B,MAAM,oBAAoB,CAAC;AAE5B,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,QAAiB;IAEjB,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,gBAAgB,CACxB,qCAAqC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACnE,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;IAC1B,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,2BAA2B,CAClC,IAAY;IAEZ,MAAM,QAAQ,GAAmD,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CACjD,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,iGAAiG;AACjG,MAAM,mBAAmB,GAA6C,IAAI,GAAG,CAAC;IAC5E,kBAAkB;IAClB,0BAA0B;IAC1B,+BAA+B;IAC/B,0BAA0B;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAkC,EAClC,gBAA6B,EAC7B,iBAA8B;IAE9B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IAC9B,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAE3C,0FAA0F;IAC1F,8BAA8B,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,kFAAkF;IAClF,+EAA+E;IAC/E,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEzE,mDAAmD;IACnD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,EAAE,EAAE,IAAI,CAAC,cAAc;gBACvB,OAAO,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,2BAA2B;oBACjC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACpB,OAAO,EAAE,kBAAkB,IAAI,CAAC,EAAE,EAAE;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7E,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;oBAC1B,OAAO,EAAE,qBAAqB,IAAI,CAAC,EAAE,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,2BAA2B;gBACjC,EAAE,EAAE,IAAI,CAAC,MAAM;gBACf,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,2BAA2B;gBACjC,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,OAAO,EAAE,iBAAiB;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,oDAAoD;QACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,IAAI,CAAC,UAAU;gBACnB,OAAO,EAAE,kBAAkB,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,KAAK,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,EAAE,EAAE,IAAI,CAAC,IAAI;oBACb,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO;gBAAE,SAAS;YACtB,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxC,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,EAAE,EAAE,IAAI,CAAC,MAAM;wBACf,OAAO,EAAE,0BAA0B,EAAE,CAAC,EAAE,EAAE;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC7B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACtC,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,gBAAgB;4BACtB,EAAE,EAAE,IAAI,CAAC,IAAI;4BACb,OAAO,EAAE,wBAAwB,EAAE,CAAC,EAAE,EAAE;yBACzC,CAAC,CAAC;oBACL,CAAC;oBACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;wBACpC,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,gBAAgB;4BACtB,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,OAAO,EAAE,wBAAwB,EAAE,CAAC,EAAE,EAAE;yBACzC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,EAAE,EAAE,EAAE,CAAC,UAAU;gBACjB,OAAO,EAAE,6BAA6B,EAAE,CAAC,EAAE,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ;gBACf,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAAE,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,yBAAyB;oBAC/B,EAAE,EAAE,UAAU;oBACd,OAAO,EAAE,wBAAwB,OAAO,QAAQ,EAAE,CAAC,EAAE,EAAE;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,+EAA+E;IAC/E,kEAAkE;IAClE,IAAI,EAAE,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CACxB,0EAA0E;gBACxE,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAErD,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,WAAW,EAAE,EAAE,CAAC,WAAW;QAC3B,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE;QAC7B,YAAY,EAAE,EAAE,CAAC,YAAY,IAAI,EAAE;QACnC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,IAAI,EAAE;QAC7C,YAAY,EAAE,EAAE,CAAC,YAAY,IAAI,EAAE;QACnC,QAAQ;QACR,QAAQ;QACR,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,SAAS,aAAa,CACpB,EAA2B,EAC3B,gBAA6B;IAE7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgF,CAAC;IAE3G,cAAc;IACd,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,gBAAgB;IAChB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,GAA8B,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnF,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,gBAAgB;IAChB,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,wCAAwC;IACxC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,EAA2B;IACxD,kFAAkF;IAClF,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,SAAS,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAExE,2FAA2F;IAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,MAAM;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACvE,IAAI,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,CAAC;QACZ,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/schema/v2/tenant-policy.d.ts

@@ -43,14 +43,14 @@ export declare const polymorphicTableSchema: z.ZodObject<{
     mapping: z.ZodRecord<z.ZodString, z.ZodString>;
 }, z.core.$strict>;
 export declare const enforcementModeSchema: z.ZodEnum<{
-    strict: "strict";
     warn: "warn";
+    strict: "strict";
 }>;
 export declare const tenantPolicyFrontmatterSchema: z.ZodObject<{
     schemaId: z.ZodString;
     enforcement: z.ZodEnum<{
-        strict: "strict";
         warn: "warn";
+        strict: "strict";
     }>;
     roots: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
@@ -254,6 +254,11 @@ export type TenantPolicyWarning = {
     id: string;
     context: string;
 };
+/**
+ * One line describing a tenant policy problem, naming the IDs involved. The strict
+ * load error, the `askdb.tenant.policy_warnings` log message and the CLI all use it.
+ */
+export declare function formatTenantPolicyWarning(warning: TenantPolicyWarning): string;
 export type NormalizedTenantPolicy = {
     schemaId: string;
     enforcement: EnforcementMode;