@contember/cli 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/lib/tenant/TenantConfigApplier.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConfigApplier.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConfigApplier.ts"],"sourcesContent":["import { Output } from '@contember/cli-common'\nimport { authPolicyKey, describeAuthPolicy } from './authPolicy.js'\nimport { type RemoteAuthPolicy, TenantPolicyClient, TenantProjectClient } from './clients/index.js'\nimport { TenantConfig } from './tenantConfig.js'\n\nexport interface TenantConfigApplyOptions {\n\tdryRun?: boolean\n}\n\n/** The slice of the domain clients the applier drives — structural, so a test can pass a fake. */\nexport interface TenantConfigApplierClients {\n\treadonly project: Pick<TenantProjectClient, 'configure' | 'listIdentityProviders' | 'addIdp' | 'updateIdp' | 'enableIdp' | 'disableIdp'>\n\treadonly policy: Pick<\n\t\tTenantPolicyClient,\n\t\t'addMailTemplate' | 'listAuthPolicies' | 'createAuthPolicy' | 'updateAuthPolicy' | 'listCustomRoles' | 'createCustomRole' | 'updateCustomRole'\n\t>\n}\n\nexport type TenantConfigActionType =\n\t| 'configure'\n\t| 'addIdp'\n\t| 'updateIdp'\n\t| 'enableIdp'\n\t| 'disableIdp'\n\t| 'addMailTemplate'\n\t| 'createAuthPolicy'\n\t| 'updateAuthPolicy'\n\t| 'createCustomRole'\n\t| 'updateCustomRole'\n\n/** One step of the apply plan. In a dry run it is what would be done, otherwise what was done. */\nexport interface TenantConfigAction {\n\taction: TenantConfigActionType\n\ttarget: string | null\n}\n\nexport type TenantConfigWarningCode = 'UNMANAGED_AUTH_POLICY'\n\n/** Server-side state the config does not cover. Nothing is pruned, so it stays in effect. */\nexport interface TenantConfigWarning {\n\tcode: TenantConfigWarningCode\n\ttarget: string\n\tmessage: string\n}\n\n/**\n * The outcome of an apply. Warnings are returned rather than only printed: `output.warn` is silent\n * outside human mode, and an unmanaged policy is exactly what an agent running `--json` needs to see.\n */\nexport interface TenantConfigPlan {\n\tactions: TenantConfigAction[]\n\twarnings: TenantConfigWarning[]\n}\n\n/**\n * Applies a {@link TenantConfig} to a tenant idempotently:\n * - `configure` is a partial merge and is sent only when the schema maps at least one value to a database change.\n * - identity providers are added or updated based on the current state, then\n *   enabled/disabled to match `disabled`.\n * - mail templates are upserted server-side by `addMailTemplate`.\n * - auth policies are matched to existing rows by what they target (scope,\n *   project, role set) and created or updated accordingly; every policy the\n *   config does not cover is warned about, including when the config lists none.\n * - custom roles are created or updated by slug.\n *\n * Nothing is ever removed — entries missing from the config are left untouched.\n *\n * Returns the plan as data; the caller prints it. The applier itself only reports each action on stderr.\n */\nexport class TenantConfigApplier {\n\tconstructor(\n\t\tprivate readonly output: Output = new Output(),\n\t) {\n\t}\n\n\tpublic async apply(\n\t\tclients: TenantConfigApplierClients,\n\t\tconfig: TenantConfig,\n\t\toptions: TenantConfigApplyOptions = {},\n\t): Promise<TenantConfigPlan> {\n\t\tconst dryRun = options.dryRun === true\n\t\tconst actions: TenantConfigAction[] = []\n\t\tconst warnings: TenantConfigWarning[] = []\n\t\tconst warn = (code: TenantConfigWarningCode, target: string, message: string) => {\n\t\t\twarnings.push({ code, target, message })\n\t\t\tthis.output.warn(message)\n\t\t}\n\t\tconst run = async (action: TenantConfigActionType, target: string | null, execute: () => Promise<void>) => {\n\t\t\tactions.push({ action, target })\n\t\t\tif (dryRun) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// info, not progress: `tenant apply` mostly runs in CI, where a non-TTY progress line would leave no record of what was touched\n\t\t\tthis.output.info(target === null ? action : `${action}: ${target}`)\n\t\t\tawait execute()\n\t\t}\n\n\t\t// Up front, before anything has been written: two entries targeting the same\n\t\t// scope/project/roles are one policy to the applier but two rows server-side.\n\t\tassertDistinctAuthPolicies(config.authPolicies)\n\t\tconst existingAuthPolicies = config.authPolicies === undefined ? undefined : await clients.policy.listAuthPolicies()\n\t\tassertDistinctExistingAuthPolicies(existingAuthPolicies)\n\n\t\tif (config.config && hasEffectiveConfigValue(config.config)) {\n\t\t\tconst globalConfig = config.config\n\t\t\tawait run('configure', null, () => clients.project.configure(globalConfig))\n\t\t}\n\n\t\tif (config.identityProviders && Object.keys(config.identityProviders).length > 0) {\n\t\t\tconst existing = await clients.project.listIdentityProviders()\n\t\t\tconst existingBySlug = new Map(existing.map(it => [it.slug, it]))\n\n\t\t\tfor (const [slug, idp] of Object.entries(config.identityProviders)) {\n\t\t\t\tconst current = existingBySlug.get(slug)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('addIdp', slug, () => clients.project.addIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateIdp', slug, () => clients.project.updateIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t}\n\n\t\t\t\tconst wantDisabled = idp.disabled === true\n\t\t\t\tconst isDisabled = current ? current.disabledAt !== null : false\n\t\t\t\tif (wantDisabled && !isDisabled) {\n\t\t\t\t\tawait run('disableIdp', slug, () => clients.project.disableIdp(slug))\n\t\t\t\t} else if (!wantDisabled && isDisabled) {\n\t\t\t\t\tawait run('enableIdp', slug, () => clients.project.enableIdp(slug))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.mailTemplates && config.mailTemplates.length > 0) {\n\t\t\tfor (const template of config.mailTemplates) {\n\t\t\t\tconst target = `${template.type}${template.variant ? `/${template.variant}` : ''}`\n\t\t\t\tawait run('addMailTemplate', target, () => clients.policy.addMailTemplate(template))\n\t\t\t}\n\t\t}\n\n\t\t// `[]` is meaningful here, unlike for the other sections: it says \"I manage\n\t\t// policies and there are none\", which is exactly when the warning below matters.\n\t\tif (config.authPolicies) {\n\t\t\tconst existing = existingAuthPolicies ?? []\n\t\t\tconst existingByKey = new Map(existing.map(it => [authPolicyKey(it), it]))\n\t\t\tconst managedKeys = new Set(config.authPolicies.map(authPolicyKey))\n\n\t\t\tfor (const policy of config.authPolicies) {\n\t\t\t\tconst current = existingByKey.get(authPolicyKey(policy))\n\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('createAuthPolicy', target, async () => {\n\t\t\t\t\t\tawait clients.policy.createAuthPolicy(policy)\n\t\t\t\t\t})\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateAuthPolicy', target, () => clients.policy.updateAuthPolicy(current.id, policy))\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Policies are aggregated strictest-wins, so one left behind by a config\n\t\t\t// edit keeps enforcing. Nothing is pruned, but silence would hide it.\n\t\t\tfor (const policy of existing) {\n\t\t\t\tif (!managedKeys.has(authPolicyKey(policy))) {\n\t\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\t\twarn('UNMANAGED_AUTH_POLICY', target, `Auth policy ${target} exists but is not in the config; it stays in effect.`)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.customRoles && Object.keys(config.customRoles).length > 0) {\n\t\t\tconst existing = await clients.policy.listCustomRoles()\n\t\t\tconst existingSlugs = new Set(existing.map(role => role.slug))\n\t\t\tconst configuredRoles = Object.entries(config.customRoles)\n\t\t\tconst missingRoles = configuredRoles.filter(([slug]) => !existingSlugs.has(slug))\n\n\t\t\t// Create all slugs first so grants may reference roles declared later or cyclically.\n\t\t\tfor (const [slug, role] of missingRoles) {\n\t\t\t\tawait run('createCustomRole', slug, () =>\n\t\t\t\t\tclients.policy.createCustomRole(slug, {\n\t\t\t\t\t\tdescription: role.description,\n\t\t\t\t\t\tgrants: [],\n\t\t\t\t\t}))\n\t\t\t}\n\n\t\t\tfor (const [slug, role] of configuredRoles) {\n\t\t\t\tawait run('updateCustomRole', slug, () => clients.policy.updateCustomRole(slug, role))\n\t\t\t}\n\t\t}\n\n\t\treturn { actions, warnings }\n\t}\n}\n\nconst assertDistinctExistingAuthPolicies = (policies: readonly RemoteAuthPolicy[] | undefined): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Duplicate existing auth policy: ${describeAuthPolicy(policy)}. Resolve duplicate rows before applying the tenant config.`,\n\t\t\t)\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/**\n * A policy's identity is its target, so two config entries with the same\n * scope/project/roles are indistinguishable to the applier but produce two rows\n * server-side — the second of which would then be silently orphaned on the next\n * run. Cheaper to reject than to reconcile.\n */\nconst assertDistinctAuthPolicies = (policies: TenantConfig['authPolicies']): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow `Duplicate auth policy in the config: ${describeAuthPolicy(policy)}. Policies are identified by scope, project and role set.`\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/** Null clears only the fields that the tenant update command maps to a nullable database column. */\nconst nullableConfigClearPaths = new Set([\n\t'passwordless.url',\n\t'password.pattern',\n\t'login.maxTokenExpiration',\n\t'captcha.provider',\n\t'captcha.threshold',\n])\n\nconst hasEffectiveConfigValue = (value: unknown, path: readonly string[] = []): boolean => {\n\tif (value === undefined) {\n\t\treturn false\n\t}\n\tif (value === null) {\n\t\treturn nullableConfigClearPaths.has(path.join('.'))\n\t}\n\tif (typeof value !== 'object') {\n\t\treturn true\n\t}\n\treturn Object.entries(value).some(([key, item]) => hasEffectiveConfigValue(item, [...path, key]))\n}\n"],"names":["Output","authPolicyKey","describeAuthPolicy"],"mappings":";;;;AAqEO,MAAM,oBAAoB;AAAA,EAChC,YACkB,SAAiB,IAAIA,UAAAA,UACrC;AADgB,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,MACZ,SACA,QACA,UAAoC,CAAA,GACR;AAC5B,UAAM,SAAS,QAAQ,WAAW;AAClC,UAAM,UAAgC,CAAA;AACtC,UAAM,WAAkC,CAAA;AACxC,UAAM,OAAO,CAAC,MAA+B,QAAgB,YAAoB;AAChF,eAAS,KAAK,EAAE,MAAM,QAAQ,SAAS;AACvC,WAAK,OAAO,KAAK,OAAO;AAAA,IACzB;AACA,UAAM,MAAM,OAAO,QAAgC,QAAuB,YAAiC;AAC1G,cAAQ,KAAK,EAAE,QAAQ,OAAA,CAAQ;AAC/B,UAAI,QAAQ;AACX;AAAA,MACD;AAEA,WAAK,OAAO,KAAK,WAAW,OAAO,SAAS,GAAG,MAAM,KAAK,MAAM,EAAE;AAClE,YAAM,QAAA;AAAA,IACP;AAIA,+BAA2B,OAAO,YAAY;AAC9C,UAAM,uBAAuB,OAAO,iBAAiB,SAAY,SAAY,MAAM,QAAQ,OAAO,iBAAA;AAClG,uCAAmC,oBAAoB;AAEvD,QAAI,OAAO,UAAU,wBAAwB,OAAO,MAAM,GAAG;AAC5D,YAAM,eAAe,OAAO;AAC5B,YAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,YAAY,CAAC;AAAA,IAC3E;AAEA,QAAI,OAAO,qBAAqB,OAAO,KAAK,OAAO,iBAAiB,EAAE,SAAS,GAAG;AACjF,YAAM,WAAW,MAAM,QAAQ,QAAQ,sBAAA;AACvC,YAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;AAEhE,iBAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,iBAAiB,GAAG;AACnE,cAAM,UAAU,eAAe,IAAI,IAAI;AACvC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,UAAU,MAAM,MAAM,QAAQ,QAAQ,OAAO,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QACvG,OAAO;AACN,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QAC7G;AAEA,cAAM,eAAe,IAAI,aAAa;AACtC,cAAM,aAAa,UAAU,QAAQ,eAAe,OAAO;AAC3D,YAAI,gBAAgB,CAAC,YAAY;AAChC,gBAAM,IAAI,cAAc,MAAM,MAAM,QAAQ,QAAQ,WAAW,IAAI,CAAC;AAAA,QACrE,WAAW,CAAC,gBAAgB,YAAY;AACvC,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,IAAI,CAAC;AAAA,QACnE;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,iBAAiB,OAAO,cAAc,SAAS,GAAG;AAC5D,iBAAW,YAAY,OAAO,eAAe;AAC5C,cAAM,SAAS,GAAG,SAAS,IAAI,GAAG,SAAS,UAAU,IAAI,SAAS,OAAO,KAAK,EAAE;AAChF,cAAM,IAAI,mBAAmB,QAAQ,MAAM,QAAQ,OAAO,gBAAgB,QAAQ,CAAC;AAAA,MACpF;AAAA,IACD;AAIA,QAAI,OAAO,cAAc;AACxB,YAAM,WAAW,wBAAwB,CAAA;AACzC,YAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAACC,yBAAc,EAAE,GAAG,EAAE,CAAC,CAAC;AACzE,YAAM,cAAc,IAAI,IAAI,OAAO,aAAa,IAAIA,WAAAA,aAAa,CAAC;AAElE,iBAAW,UAAU,OAAO,cAAc;AACzC,cAAM,UAAU,cAAc,IAAIA,WAAAA,cAAc,MAAM,CAAC;AACvD,cAAM,SAASC,WAAAA,mBAAmB,MAAM;AACxC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,oBAAoB,QAAQ,YAAY;AACjD,kBAAM,QAAQ,OAAO,iBAAiB,MAAM;AAAA,UAC7C,CAAC;AAAA,QACF,OAAO;AACN,gBAAM,IAAI,oBAAoB,QAAQ,MAAM,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,MAAM,CAAC;AAAA,QAChG;AAAA,MACD;AAIA,iBAAW,UAAU,UAAU;AAC9B,YAAI,CAAC,YAAY,IAAID,WAAAA,cAAc,MAAM,CAAC,GAAG;AAC5C,gBAAM,SAASC,WAAAA,mBAAmB,MAAM;AACxC,eAAK,yBAAyB,QAAQ,eAAe,MAAM,uDAAuD;AAAA,QACnH;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,eAAe,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,GAAG;AACrE,YAAM,WAAW,MAAM,QAAQ,OAAO,gBAAA;AACtC,YAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAA,SAAQ,KAAK,IAAI,CAAC;AAC7D,YAAM,kBAAkB,OAAO,QAAQ,OAAO,WAAW;AACzD,YAAM,eAAe,gBAAgB,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;AAGhF,iBAAW,CAAC,MAAM,IAAI,KAAK,cAAc;AACxC,cAAM,IAAI,oBAAoB,MAAM,MACnC,QAAQ,OAAO,iBAAiB,MAAM;AAAA,UACrC,aAAa,KAAK;AAAA,UAClB,QAAQ,CAAA;AAAA,QAAC,CACT,CAAC;AAAA,MACJ;AAEA,iBAAW,CAAC,MAAM,IAAI,KAAK,iBAAiB;AAC3C,cAAM,IAAI,oBAAoB,MAAM,MAAM,QAAQ,OAAO,iBAAiB,MAAM,IAAI,CAAC;AAAA,MACtF;AAAA,IACD;AAEA,WAAO,EAAE,SAAS,SAAA;AAAA,EACnB;AACD;AAEA,MAAM,qCAAqC,CAAC,aAA4D;AACvG,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAMD,WAAAA,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,IAAI;AAAA,QACT,mCAAmCC,WAAAA,mBAAmB,MAAM,CAAC;AAAA,MAAA;AAAA,IAE/D;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAQA,MAAM,6BAA6B,CAAC,aAAiD;AACpF,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAMD,WAAAA,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,wCAAwCC,WAAAA,mBAAmB,MAAM,CAAC;AAAA,IACzE;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAGA,MAAM,+CAA+B,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,MAAM,0BAA0B,CAAC,OAAgB,OAA0B,OAAgB;AAC1F,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AACA,MAAI,UAAU,MAAM;AACnB,WAAO,yBAAyB,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,EACnD;AACA,MAAI,OAAO,UAAU,UAAU;AAC9B,WAAO;AAAA,EACR;AACA,SAAO,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,wBAAwB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACjG;;"}

package/dist/development/src/lib/tenant/TenantConfigApplier.js

@@ -0,0 +1,139 @@
+import { Output } from "@contember/cli-common";
+import { authPolicyKey, describeAuthPolicy } from "./authPolicy.js";
+class TenantConfigApplier {
+  constructor(output = new Output()) {
+    this.output = output;
+  }
+  async apply(clients, config, options = {}) {
+    const dryRun = options.dryRun === true;
+    const actions = [];
+    const warnings = [];
+    const warn = (code, target, message) => {
+      warnings.push({ code, target, message });
+      this.output.warn(message);
+    };
+    const run = async (action, target, execute) => {
+      actions.push({ action, target });
+      if (dryRun) {
+        return;
+      }
+      this.output.info(target === null ? action : `${action}: ${target}`);
+      await execute();
+    };
+    assertDistinctAuthPolicies(config.authPolicies);
+    const existingAuthPolicies = config.authPolicies === void 0 ? void 0 : await clients.policy.listAuthPolicies();
+    assertDistinctExistingAuthPolicies(existingAuthPolicies);
+    if (config.config && hasEffectiveConfigValue(config.config)) {
+      const globalConfig = config.config;
+      await run("configure", null, () => clients.project.configure(globalConfig));
+    }
+    if (config.identityProviders && Object.keys(config.identityProviders).length > 0) {
+      const existing = await clients.project.listIdentityProviders();
+      const existingBySlug = new Map(existing.map((it) => [it.slug, it]));
+      for (const [slug, idp] of Object.entries(config.identityProviders)) {
+        const current = existingBySlug.get(slug);
+        if (!current) {
+          await run("addIdp", slug, () => clients.project.addIdp(slug, idp.type, idp.configuration, idp.options));
+        } else {
+          await run("updateIdp", slug, () => clients.project.updateIdp(slug, idp.type, idp.configuration, idp.options));
+        }
+        const wantDisabled = idp.disabled === true;
+        const isDisabled = current ? current.disabledAt !== null : false;
+        if (wantDisabled && !isDisabled) {
+          await run("disableIdp", slug, () => clients.project.disableIdp(slug));
+        } else if (!wantDisabled && isDisabled) {
+          await run("enableIdp", slug, () => clients.project.enableIdp(slug));
+        }
+      }
+    }
+    if (config.mailTemplates && config.mailTemplates.length > 0) {
+      for (const template of config.mailTemplates) {
+        const target = `${template.type}${template.variant ? `/${template.variant}` : ""}`;
+        await run("addMailTemplate", target, () => clients.policy.addMailTemplate(template));
+      }
+    }
+    if (config.authPolicies) {
+      const existing = existingAuthPolicies ?? [];
+      const existingByKey = new Map(existing.map((it) => [authPolicyKey(it), it]));
+      const managedKeys = new Set(config.authPolicies.map(authPolicyKey));
+      for (const policy of config.authPolicies) {
+        const current = existingByKey.get(authPolicyKey(policy));
+        const target = describeAuthPolicy(policy);
+        if (!current) {
+          await run("createAuthPolicy", target, async () => {
+            await clients.policy.createAuthPolicy(policy);
+          });
+        } else {
+          await run("updateAuthPolicy", target, () => clients.policy.updateAuthPolicy(current.id, policy));
+        }
+      }
+      for (const policy of existing) {
+        if (!managedKeys.has(authPolicyKey(policy))) {
+          const target = describeAuthPolicy(policy);
+          warn("UNMANAGED_AUTH_POLICY", target, `Auth policy ${target} exists but is not in the config; it stays in effect.`);
+        }
+      }
+    }
+    if (config.customRoles && Object.keys(config.customRoles).length > 0) {
+      const existing = await clients.policy.listCustomRoles();
+      const existingSlugs = new Set(existing.map((role) => role.slug));
+      const configuredRoles = Object.entries(config.customRoles);
+      const missingRoles = configuredRoles.filter(([slug]) => !existingSlugs.has(slug));
+      for (const [slug, role] of missingRoles) {
+        await run("createCustomRole", slug, () => clients.policy.createCustomRole(slug, {
+          description: role.description,
+          grants: []
+        }));
+      }
+      for (const [slug, role] of configuredRoles) {
+        await run("updateCustomRole", slug, () => clients.policy.updateCustomRole(slug, role));
+      }
+    }
+    return { actions, warnings };
+  }
+}
+const assertDistinctExistingAuthPolicies = (policies) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const policy of policies ?? []) {
+    const key = authPolicyKey(policy);
+    if (seen.has(key)) {
+      throw new Error(
+        `Duplicate existing auth policy: ${describeAuthPolicy(policy)}. Resolve duplicate rows before applying the tenant config.`
+      );
+    }
+    seen.add(key);
+  }
+};
+const assertDistinctAuthPolicies = (policies) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const policy of policies ?? []) {
+    const key = authPolicyKey(policy);
+    if (seen.has(key)) {
+      throw `Duplicate auth policy in the config: ${describeAuthPolicy(policy)}. Policies are identified by scope, project and role set.`;
+    }
+    seen.add(key);
+  }
+};
+const nullableConfigClearPaths = /* @__PURE__ */ new Set([
+  "passwordless.url",
+  "password.pattern",
+  "login.maxTokenExpiration",
+  "captcha.provider",
+  "captcha.threshold"
+]);
+const hasEffectiveConfigValue = (value, path = []) => {
+  if (value === void 0) {
+    return false;
+  }
+  if (value === null) {
+    return nullableConfigClearPaths.has(path.join("."));
+  }
+  if (typeof value !== "object") {
+    return true;
+  }
+  return Object.entries(value).some(([key, item]) => hasEffectiveConfigValue(item, [...path, key]));
+};
+export {
+  TenantConfigApplier
+};
+//# sourceMappingURL=TenantConfigApplier.js.map

package/dist/development/src/lib/tenant/TenantConfigApplier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConfigApplier.js","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConfigApplier.ts"],"sourcesContent":["import { Output } from '@contember/cli-common'\nimport { authPolicyKey, describeAuthPolicy } from './authPolicy.js'\nimport { type RemoteAuthPolicy, TenantPolicyClient, TenantProjectClient } from './clients/index.js'\nimport { TenantConfig } from './tenantConfig.js'\n\nexport interface TenantConfigApplyOptions {\n\tdryRun?: boolean\n}\n\n/** The slice of the domain clients the applier drives — structural, so a test can pass a fake. */\nexport interface TenantConfigApplierClients {\n\treadonly project: Pick<TenantProjectClient, 'configure' | 'listIdentityProviders' | 'addIdp' | 'updateIdp' | 'enableIdp' | 'disableIdp'>\n\treadonly policy: Pick<\n\t\tTenantPolicyClient,\n\t\t'addMailTemplate' | 'listAuthPolicies' | 'createAuthPolicy' | 'updateAuthPolicy' | 'listCustomRoles' | 'createCustomRole' | 'updateCustomRole'\n\t>\n}\n\nexport type TenantConfigActionType =\n\t| 'configure'\n\t| 'addIdp'\n\t| 'updateIdp'\n\t| 'enableIdp'\n\t| 'disableIdp'\n\t| 'addMailTemplate'\n\t| 'createAuthPolicy'\n\t| 'updateAuthPolicy'\n\t| 'createCustomRole'\n\t| 'updateCustomRole'\n\n/** One step of the apply plan. In a dry run it is what would be done, otherwise what was done. */\nexport interface TenantConfigAction {\n\taction: TenantConfigActionType\n\ttarget: string | null\n}\n\nexport type TenantConfigWarningCode = 'UNMANAGED_AUTH_POLICY'\n\n/** Server-side state the config does not cover. Nothing is pruned, so it stays in effect. */\nexport interface TenantConfigWarning {\n\tcode: TenantConfigWarningCode\n\ttarget: string\n\tmessage: string\n}\n\n/**\n * The outcome of an apply. Warnings are returned rather than only printed: `output.warn` is silent\n * outside human mode, and an unmanaged policy is exactly what an agent running `--json` needs to see.\n */\nexport interface TenantConfigPlan {\n\tactions: TenantConfigAction[]\n\twarnings: TenantConfigWarning[]\n}\n\n/**\n * Applies a {@link TenantConfig} to a tenant idempotently:\n * - `configure` is a partial merge and is sent only when the schema maps at least one value to a database change.\n * - identity providers are added or updated based on the current state, then\n *   enabled/disabled to match `disabled`.\n * - mail templates are upserted server-side by `addMailTemplate`.\n * - auth policies are matched to existing rows by what they target (scope,\n *   project, role set) and created or updated accordingly; every policy the\n *   config does not cover is warned about, including when the config lists none.\n * - custom roles are created or updated by slug.\n *\n * Nothing is ever removed — entries missing from the config are left untouched.\n *\n * Returns the plan as data; the caller prints it. The applier itself only reports each action on stderr.\n */\nexport class TenantConfigApplier {\n\tconstructor(\n\t\tprivate readonly output: Output = new Output(),\n\t) {\n\t}\n\n\tpublic async apply(\n\t\tclients: TenantConfigApplierClients,\n\t\tconfig: TenantConfig,\n\t\toptions: TenantConfigApplyOptions = {},\n\t): Promise<TenantConfigPlan> {\n\t\tconst dryRun = options.dryRun === true\n\t\tconst actions: TenantConfigAction[] = []\n\t\tconst warnings: TenantConfigWarning[] = []\n\t\tconst warn = (code: TenantConfigWarningCode, target: string, message: string) => {\n\t\t\twarnings.push({ code, target, message })\n\t\t\tthis.output.warn(message)\n\t\t}\n\t\tconst run = async (action: TenantConfigActionType, target: string | null, execute: () => Promise<void>) => {\n\t\t\tactions.push({ action, target })\n\t\t\tif (dryRun) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// info, not progress: `tenant apply` mostly runs in CI, where a non-TTY progress line would leave no record of what was touched\n\t\t\tthis.output.info(target === null ? action : `${action}: ${target}`)\n\t\t\tawait execute()\n\t\t}\n\n\t\t// Up front, before anything has been written: two entries targeting the same\n\t\t// scope/project/roles are one policy to the applier but two rows server-side.\n\t\tassertDistinctAuthPolicies(config.authPolicies)\n\t\tconst existingAuthPolicies = config.authPolicies === undefined ? undefined : await clients.policy.listAuthPolicies()\n\t\tassertDistinctExistingAuthPolicies(existingAuthPolicies)\n\n\t\tif (config.config && hasEffectiveConfigValue(config.config)) {\n\t\t\tconst globalConfig = config.config\n\t\t\tawait run('configure', null, () => clients.project.configure(globalConfig))\n\t\t}\n\n\t\tif (config.identityProviders && Object.keys(config.identityProviders).length > 0) {\n\t\t\tconst existing = await clients.project.listIdentityProviders()\n\t\t\tconst existingBySlug = new Map(existing.map(it => [it.slug, it]))\n\n\t\t\tfor (const [slug, idp] of Object.entries(config.identityProviders)) {\n\t\t\t\tconst current = existingBySlug.get(slug)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('addIdp', slug, () => clients.project.addIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateIdp', slug, () => clients.project.updateIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t}\n\n\t\t\t\tconst wantDisabled = idp.disabled === true\n\t\t\t\tconst isDisabled = current ? current.disabledAt !== null : false\n\t\t\t\tif (wantDisabled && !isDisabled) {\n\t\t\t\t\tawait run('disableIdp', slug, () => clients.project.disableIdp(slug))\n\t\t\t\t} else if (!wantDisabled && isDisabled) {\n\t\t\t\t\tawait run('enableIdp', slug, () => clients.project.enableIdp(slug))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.mailTemplates && config.mailTemplates.length > 0) {\n\t\t\tfor (const template of config.mailTemplates) {\n\t\t\t\tconst target = `${template.type}${template.variant ? `/${template.variant}` : ''}`\n\t\t\t\tawait run('addMailTemplate', target, () => clients.policy.addMailTemplate(template))\n\t\t\t}\n\t\t}\n\n\t\t// `[]` is meaningful here, unlike for the other sections: it says \"I manage\n\t\t// policies and there are none\", which is exactly when the warning below matters.\n\t\tif (config.authPolicies) {\n\t\t\tconst existing = existingAuthPolicies ?? []\n\t\t\tconst existingByKey = new Map(existing.map(it => [authPolicyKey(it), it]))\n\t\t\tconst managedKeys = new Set(config.authPolicies.map(authPolicyKey))\n\n\t\t\tfor (const policy of config.authPolicies) {\n\t\t\t\tconst current = existingByKey.get(authPolicyKey(policy))\n\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('createAuthPolicy', target, async () => {\n\t\t\t\t\t\tawait clients.policy.createAuthPolicy(policy)\n\t\t\t\t\t})\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateAuthPolicy', target, () => clients.policy.updateAuthPolicy(current.id, policy))\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Policies are aggregated strictest-wins, so one left behind by a config\n\t\t\t// edit keeps enforcing. Nothing is pruned, but silence would hide it.\n\t\t\tfor (const policy of existing) {\n\t\t\t\tif (!managedKeys.has(authPolicyKey(policy))) {\n\t\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\t\twarn('UNMANAGED_AUTH_POLICY', target, `Auth policy ${target} exists but is not in the config; it stays in effect.`)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.customRoles && Object.keys(config.customRoles).length > 0) {\n\t\t\tconst existing = await clients.policy.listCustomRoles()\n\t\t\tconst existingSlugs = new Set(existing.map(role => role.slug))\n\t\t\tconst configuredRoles = Object.entries(config.customRoles)\n\t\t\tconst missingRoles = configuredRoles.filter(([slug]) => !existingSlugs.has(slug))\n\n\t\t\t// Create all slugs first so grants may reference roles declared later or cyclically.\n\t\t\tfor (const [slug, role] of missingRoles) {\n\t\t\t\tawait run('createCustomRole', slug, () =>\n\t\t\t\t\tclients.policy.createCustomRole(slug, {\n\t\t\t\t\t\tdescription: role.description,\n\t\t\t\t\t\tgrants: [],\n\t\t\t\t\t}))\n\t\t\t}\n\n\t\t\tfor (const [slug, role] of configuredRoles) {\n\t\t\t\tawait run('updateCustomRole', slug, () => clients.policy.updateCustomRole(slug, role))\n\t\t\t}\n\t\t}\n\n\t\treturn { actions, warnings }\n\t}\n}\n\nconst assertDistinctExistingAuthPolicies = (policies: readonly RemoteAuthPolicy[] | undefined): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Duplicate existing auth policy: ${describeAuthPolicy(policy)}. Resolve duplicate rows before applying the tenant config.`,\n\t\t\t)\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/**\n * A policy's identity is its target, so two config entries with the same\n * scope/project/roles are indistinguishable to the applier but produce two rows\n * server-side — the second of which would then be silently orphaned on the next\n * run. Cheaper to reject than to reconcile.\n */\nconst assertDistinctAuthPolicies = (policies: TenantConfig['authPolicies']): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow `Duplicate auth policy in the config: ${describeAuthPolicy(policy)}. Policies are identified by scope, project and role set.`\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/** Null clears only the fields that the tenant update command maps to a nullable database column. */\nconst nullableConfigClearPaths = new Set([\n\t'passwordless.url',\n\t'password.pattern',\n\t'login.maxTokenExpiration',\n\t'captcha.provider',\n\t'captcha.threshold',\n])\n\nconst hasEffectiveConfigValue = (value: unknown, path: readonly string[] = []): boolean => {\n\tif (value === undefined) {\n\t\treturn false\n\t}\n\tif (value === null) {\n\t\treturn nullableConfigClearPaths.has(path.join('.'))\n\t}\n\tif (typeof value !== 'object') {\n\t\treturn true\n\t}\n\treturn Object.entries(value).some(([key, item]) => hasEffectiveConfigValue(item, [...path, key]))\n}\n"],"names":[],"mappings":";;AAqEO,MAAM,oBAAoB;AAAA,EAChC,YACkB,SAAiB,IAAI,UACrC;AADgB,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,MACZ,SACA,QACA,UAAoC,CAAA,GACR;AAC5B,UAAM,SAAS,QAAQ,WAAW;AAClC,UAAM,UAAgC,CAAA;AACtC,UAAM,WAAkC,CAAA;AACxC,UAAM,OAAO,CAAC,MAA+B,QAAgB,YAAoB;AAChF,eAAS,KAAK,EAAE,MAAM,QAAQ,SAAS;AACvC,WAAK,OAAO,KAAK,OAAO;AAAA,IACzB;AACA,UAAM,MAAM,OAAO,QAAgC,QAAuB,YAAiC;AAC1G,cAAQ,KAAK,EAAE,QAAQ,OAAA,CAAQ;AAC/B,UAAI,QAAQ;AACX;AAAA,MACD;AAEA,WAAK,OAAO,KAAK,WAAW,OAAO,SAAS,GAAG,MAAM,KAAK,MAAM,EAAE;AAClE,YAAM,QAAA;AAAA,IACP;AAIA,+BAA2B,OAAO,YAAY;AAC9C,UAAM,uBAAuB,OAAO,iBAAiB,SAAY,SAAY,MAAM,QAAQ,OAAO,iBAAA;AAClG,uCAAmC,oBAAoB;AAEvD,QAAI,OAAO,UAAU,wBAAwB,OAAO,MAAM,GAAG;AAC5D,YAAM,eAAe,OAAO;AAC5B,YAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,YAAY,CAAC;AAAA,IAC3E;AAEA,QAAI,OAAO,qBAAqB,OAAO,KAAK,OAAO,iBAAiB,EAAE,SAAS,GAAG;AACjF,YAAM,WAAW,MAAM,QAAQ,QAAQ,sBAAA;AACvC,YAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;AAEhE,iBAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,iBAAiB,GAAG;AACnE,cAAM,UAAU,eAAe,IAAI,IAAI;AACvC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,UAAU,MAAM,MAAM,QAAQ,QAAQ,OAAO,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QACvG,OAAO;AACN,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QAC7G;AAEA,cAAM,eAAe,IAAI,aAAa;AACtC,cAAM,aAAa,UAAU,QAAQ,eAAe,OAAO;AAC3D,YAAI,gBAAgB,CAAC,YAAY;AAChC,gBAAM,IAAI,cAAc,MAAM,MAAM,QAAQ,QAAQ,WAAW,IAAI,CAAC;AAAA,QACrE,WAAW,CAAC,gBAAgB,YAAY;AACvC,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,IAAI,CAAC;AAAA,QACnE;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,iBAAiB,OAAO,cAAc,SAAS,GAAG;AAC5D,iBAAW,YAAY,OAAO,eAAe;AAC5C,cAAM,SAAS,GAAG,SAAS,IAAI,GAAG,SAAS,UAAU,IAAI,SAAS,OAAO,KAAK,EAAE;AAChF,cAAM,IAAI,mBAAmB,QAAQ,MAAM,QAAQ,OAAO,gBAAgB,QAAQ,CAAC;AAAA,MACpF;AAAA,IACD;AAIA,QAAI,OAAO,cAAc;AACxB,YAAM,WAAW,wBAAwB,CAAA;AACzC,YAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;AACzE,YAAM,cAAc,IAAI,IAAI,OAAO,aAAa,IAAI,aAAa,CAAC;AAElE,iBAAW,UAAU,OAAO,cAAc;AACzC,cAAM,UAAU,cAAc,IAAI,cAAc,MAAM,CAAC;AACvD,cAAM,SAAS,mBAAmB,MAAM;AACxC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,oBAAoB,QAAQ,YAAY;AACjD,kBAAM,QAAQ,OAAO,iBAAiB,MAAM;AAAA,UAC7C,CAAC;AAAA,QACF,OAAO;AACN,gBAAM,IAAI,oBAAoB,QAAQ,MAAM,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,MAAM,CAAC;AAAA,QAChG;AAAA,MACD;AAIA,iBAAW,UAAU,UAAU;AAC9B,YAAI,CAAC,YAAY,IAAI,cAAc,MAAM,CAAC,GAAG;AAC5C,gBAAM,SAAS,mBAAmB,MAAM;AACxC,eAAK,yBAAyB,QAAQ,eAAe,MAAM,uDAAuD;AAAA,QACnH;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,eAAe,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,GAAG;AACrE,YAAM,WAAW,MAAM,QAAQ,OAAO,gBAAA;AACtC,YAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAA,SAAQ,KAAK,IAAI,CAAC;AAC7D,YAAM,kBAAkB,OAAO,QAAQ,OAAO,WAAW;AACzD,YAAM,eAAe,gBAAgB,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;AAGhF,iBAAW,CAAC,MAAM,IAAI,KAAK,cAAc;AACxC,cAAM,IAAI,oBAAoB,MAAM,MACnC,QAAQ,OAAO,iBAAiB,MAAM;AAAA,UACrC,aAAa,KAAK;AAAA,UAClB,QAAQ,CAAA;AAAA,QAAC,CACT,CAAC;AAAA,MACJ;AAEA,iBAAW,CAAC,MAAM,IAAI,KAAK,iBAAiB;AAC3C,cAAM,IAAI,oBAAoB,MAAM,MAAM,QAAQ,OAAO,iBAAiB,MAAM,IAAI,CAAC;AAAA,MACtF;AAAA,IACD;AAEA,WAAO,EAAE,SAAS,SAAA;AAAA,EACnB;AACD;AAEA,MAAM,qCAAqC,CAAC,aAA4D;AACvG,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAM,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,IAAI;AAAA,QACT,mCAAmC,mBAAmB,MAAM,CAAC;AAAA,MAAA;AAAA,IAE/D;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAQA,MAAM,6BAA6B,CAAC,aAAiD;AACpF,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAM,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,wCAAwC,mBAAmB,MAAM,CAAC;AAAA,IACzE;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAGA,MAAM,+CAA+B,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,MAAM,0BAA0B,CAAC,OAAgB,OAA0B,OAAgB;AAC1F,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AACA,MAAI,UAAU,MAAM;AACnB,WAAO,yBAAyB,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,EACnD;AACA,MAAI,OAAO,UAAU,UAAU;AAC9B,WAAO;AAAA,EACR;AACA,SAAO,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,wBAAwB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACjG;"}

package/dist/development/src/lib/tenant/TenantConfigLoader.cjs

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const path = require("node:path");
+const resolvePath = (path$1) => path.isAbsolute(path$1) ? path$1 : path.resolve(process.cwd(), path$1);
+const extractDefault = (result) => {
+  if (typeof result !== "object" || result === null || !("default" in result)) {
+    throw `Tenant config file must have a default export (use \`export default defineTenantConfig({ ... })\`).`;
+  }
+  const config = result.default;
+  if (typeof config !== "object" || config === null) {
+    throw `Default export of the tenant config file must be an object.`;
+  }
+  return config;
+};
+class ImportTenantConfigLoader {
+  async loadConfig(path2) {
+    const result = await import(resolvePath(path2));
+    return extractDefault(result);
+  }
+}
+class TranspilingTenantConfigLoader {
+  constructor(jsCodeRunner) {
+    this.jsCodeRunner = jsCodeRunner;
+  }
+  async loadConfig(path2) {
+    const result = await this.jsCodeRunner.run(resolvePath(path2));
+    return extractDefault(result);
+  }
+}
+exports.ImportTenantConfigLoader = ImportTenantConfigLoader;
+exports.TranspilingTenantConfigLoader = TranspilingTenantConfigLoader;
+//# sourceMappingURL=TenantConfigLoader.cjs.map

package/dist/development/src/lib/tenant/TenantConfigLoader.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConfigLoader.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConfigLoader.ts"],"sourcesContent":["import { isAbsolute, resolve } from 'node:path'\nimport { JsCodeRunner } from '../js/JsCodeRunner.js'\nimport { TenantConfig } from './tenantConfig.js'\n\nconst resolvePath = (path: string): string => isAbsolute(path) ? path : resolve(process.cwd(), path)\n\nconst extractDefault = (result: unknown): TenantConfig => {\n\tif (typeof result !== 'object' || result === null || !('default' in result)) {\n\t\tthrow `Tenant config file must have a default export (use \\`export default defineTenantConfig({ ... })\\`).`\n\t}\n\tconst config = (result as { default: unknown }).default\n\tif (typeof config !== 'object' || config === null) {\n\t\tthrow `Default export of the tenant config file must be an object.`\n\t}\n\treturn config as TenantConfig\n}\n\nexport interface TenantConfigLoader {\n\tloadConfig(path: string): Promise<TenantConfig>\n}\n\n/** Loads a `tenant.config.ts` directly via dynamic import (Bun runtime). */\nexport class ImportTenantConfigLoader implements TenantConfigLoader {\n\tasync loadConfig(path: string): Promise<TenantConfig> {\n\t\tconst result = await import(resolvePath(path))\n\t\treturn extractDefault(result)\n\t}\n}\n\n/** Loads a `tenant.config.ts` by transpiling it first (Node runtime). */\nexport class TranspilingTenantConfigLoader implements TenantConfigLoader {\n\tconstructor(\n\t\tprivate readonly jsCodeRunner: JsCodeRunner,\n\t) {\n\t}\n\n\tasync loadConfig(path: string): Promise<TenantConfig> {\n\t\tconst result = await this.jsCodeRunner.run(resolvePath(path))\n\t\treturn extractDefault(result)\n\t}\n}\n"],"names":["path","isAbsolute","resolve"],"mappings":";;;AAIA,MAAM,cAAc,CAACA,WAAyBC,KAAAA,WAAWD,MAAI,IAAIA,SAAOE,KAAAA,QAAQ,QAAQ,IAAA,GAAOF,MAAI;AAEnG,MAAM,iBAAiB,CAAC,WAAkC;AACzD,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,aAAa,SAAS;AAC5E,UAAM;AAAA,EACP;AACA,QAAM,SAAU,OAAgC;AAChD,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AAClD,UAAM;AAAA,EACP;AACA,SAAO;AACR;AAOO,MAAM,yBAAuD;AAAA,EACnE,MAAM,WAAWA,OAAqC;AACrD,UAAM,SAAS,MAAM,OAAO,YAAYA,KAAI;AAC5C,WAAO,eAAe,MAAM;AAAA,EAC7B;AACD;AAGO,MAAM,8BAA4D;AAAA,EACxE,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WAAWA,OAAqC;AACrD,UAAM,SAAS,MAAM,KAAK,aAAa,IAAI,YAAYA,KAAI,CAAC;AAC5D,WAAO,eAAe,MAAM;AAAA,EAC7B;AACD;;;"}

package/dist/development/src/lib/tenant/TenantConfigLoader.js

@@ -0,0 +1,32 @@
+import { isAbsolute, resolve } from "node:path";
+const resolvePath = (path) => isAbsolute(path) ? path : resolve(process.cwd(), path);
+const extractDefault = (result) => {
+  if (typeof result !== "object" || result === null || !("default" in result)) {
+    throw `Tenant config file must have a default export (use \`export default defineTenantConfig({ ... })\`).`;
+  }
+  const config = result.default;
+  if (typeof config !== "object" || config === null) {
+    throw `Default export of the tenant config file must be an object.`;
+  }
+  return config;
+};
+class ImportTenantConfigLoader {
+  async loadConfig(path) {
+    const result = await import(resolvePath(path));
+    return extractDefault(result);
+  }
+}
+class TranspilingTenantConfigLoader {
+  constructor(jsCodeRunner) {
+    this.jsCodeRunner = jsCodeRunner;
+  }
+  async loadConfig(path) {
+    const result = await this.jsCodeRunner.run(resolvePath(path));
+    return extractDefault(result);
+  }
+}
+export {
+  ImportTenantConfigLoader,
+  TranspilingTenantConfigLoader
+};
+//# sourceMappingURL=TenantConfigLoader.js.map

package/dist/development/src/lib/tenant/TenantConfigLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConfigLoader.js","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConfigLoader.ts"],"sourcesContent":["import { isAbsolute, resolve } from 'node:path'\nimport { JsCodeRunner } from '../js/JsCodeRunner.js'\nimport { TenantConfig } from './tenantConfig.js'\n\nconst resolvePath = (path: string): string => isAbsolute(path) ? path : resolve(process.cwd(), path)\n\nconst extractDefault = (result: unknown): TenantConfig => {\n\tif (typeof result !== 'object' || result === null || !('default' in result)) {\n\t\tthrow `Tenant config file must have a default export (use \\`export default defineTenantConfig({ ... })\\`).`\n\t}\n\tconst config = (result as { default: unknown }).default\n\tif (typeof config !== 'object' || config === null) {\n\t\tthrow `Default export of the tenant config file must be an object.`\n\t}\n\treturn config as TenantConfig\n}\n\nexport interface TenantConfigLoader {\n\tloadConfig(path: string): Promise<TenantConfig>\n}\n\n/** Loads a `tenant.config.ts` directly via dynamic import (Bun runtime). */\nexport class ImportTenantConfigLoader implements TenantConfigLoader {\n\tasync loadConfig(path: string): Promise<TenantConfig> {\n\t\tconst result = await import(resolvePath(path))\n\t\treturn extractDefault(result)\n\t}\n}\n\n/** Loads a `tenant.config.ts` by transpiling it first (Node runtime). */\nexport class TranspilingTenantConfigLoader implements TenantConfigLoader {\n\tconstructor(\n\t\tprivate readonly jsCodeRunner: JsCodeRunner,\n\t) {\n\t}\n\n\tasync loadConfig(path: string): Promise<TenantConfig> {\n\t\tconst result = await this.jsCodeRunner.run(resolvePath(path))\n\t\treturn extractDefault(result)\n\t}\n}\n"],"names":[],"mappings":";AAIA,MAAM,cAAc,CAAC,SAAyB,WAAW,IAAI,IAAI,OAAO,QAAQ,QAAQ,IAAA,GAAO,IAAI;AAEnG,MAAM,iBAAiB,CAAC,WAAkC;AACzD,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,aAAa,SAAS;AAC5E,UAAM;AAAA,EACP;AACA,QAAM,SAAU,OAAgC;AAChD,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AAClD,UAAM;AAAA,EACP;AACA,SAAO;AACR;AAOO,MAAM,yBAAuD;AAAA,EACnE,MAAM,WAAW,MAAqC;AACrD,UAAM,SAAS,MAAM,OAAO,YAAY,IAAI;AAC5C,WAAO,eAAe,MAAM;AAAA,EAC7B;AACD;AAGO,MAAM,8BAA4D;AAAA,EACxE,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WAAW,MAAqC;AACrD,UAAM,SAAS,MAAM,KAAK,aAAa,IAAI,YAAY,IAAI,CAAC;AAC5D,WAAO,eAAe,MAAM;AAAA,EAC7B;AACD;"}

package/dist/development/src/lib/tenant/TenantConnectionProvider.cjs

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+class TenantConnectionProvider {
+  constructor(resolver) {
+    this.resolver = resolver;
+  }
+  get() {
+    const connection = this.resolver.resolve();
+    if (!connection) {
+      throw new cliCommon.CliError("Tenant connection not defined. Set CONTEMBER_DSN, or CONTEMBER_API_URL and CONTEMBER_API_TOKEN.", {
+        code: "TENANT_CONNECTION_NOT_DEFINED",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    return connection;
+  }
+}
+exports.TenantConnectionProvider = TenantConnectionProvider;
+//# sourceMappingURL=TenantConnectionProvider.cjs.map

package/dist/development/src/lib/tenant/TenantConnectionProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConnectionProvider.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConnectionProvider.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport type { TenantConnection, TenantConnectionSource } from './TenantConnection.js'\nimport { TenantConnectionResolver } from './TenantConnectionResolver.js'\n\nexport class TenantConnectionProvider implements TenantConnectionSource {\n\tconstructor(\n\t\tprivate readonly resolver: TenantConnectionResolver,\n\t) {\n\t}\n\n\tpublic get(): TenantConnection {\n\t\tconst connection = this.resolver.resolve()\n\t\tif (!connection) {\n\t\t\tthrow new CliError('Tenant connection not defined. Set CONTEMBER_DSN, or CONTEMBER_API_URL and CONTEMBER_API_TOKEN.', {\n\t\t\t\tcode: 'TENANT_CONNECTION_NOT_DEFINED',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\treturn connection\n\t}\n}\n"],"names":["CliError","ExitCode"],"mappings":";;;AAIO,MAAM,yBAA2D;AAAA,EACvE,YACkB,UAChB;AADgB,SAAA,WAAA;AAAA,EAElB;AAAA,EAEO,MAAwB;AAC9B,UAAM,aAAa,KAAK,SAAS,QAAA;AACjC,QAAI,CAAC,YAAY;AAChB,YAAM,IAAIA,UAAAA,SAAS,mGAAmG;AAAA,QACrH,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/lib/tenant/TenantConnectionProvider.js

@@ -0,0 +1,20 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+class TenantConnectionProvider {
+  constructor(resolver) {
+    this.resolver = resolver;
+  }
+  get() {
+    const connection = this.resolver.resolve();
+    if (!connection) {
+      throw new CliError("Tenant connection not defined. Set CONTEMBER_DSN, or CONTEMBER_API_URL and CONTEMBER_API_TOKEN.", {
+        code: "TENANT_CONNECTION_NOT_DEFINED",
+        exitCode: ExitCode.InputError
+      });
+    }
+    return connection;
+  }
+}
+export {
+  TenantConnectionProvider
+};
+//# sourceMappingURL=TenantConnectionProvider.js.map

package/dist/development/src/lib/tenant/TenantConnectionProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConnectionProvider.js","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConnectionProvider.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport type { TenantConnection, TenantConnectionSource } from './TenantConnection.js'\nimport { TenantConnectionResolver } from './TenantConnectionResolver.js'\n\nexport class TenantConnectionProvider implements TenantConnectionSource {\n\tconstructor(\n\t\tprivate readonly resolver: TenantConnectionResolver,\n\t) {\n\t}\n\n\tpublic get(): TenantConnection {\n\t\tconst connection = this.resolver.resolve()\n\t\tif (!connection) {\n\t\t\tthrow new CliError('Tenant connection not defined. Set CONTEMBER_DSN, or CONTEMBER_API_URL and CONTEMBER_API_TOKEN.', {\n\t\t\t\tcode: 'TENANT_CONNECTION_NOT_DEFINED',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\treturn connection\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,yBAA2D;AAAA,EACvE,YACkB,UAChB;AADgB,SAAA,WAAA;AAAA,EAElB;AAAA,EAEO,MAAwB;AAC9B,UAAM,aAAa,KAAK,SAAS,QAAA;AACjC,QAAI,CAAC,YAAY;AAChB,YAAM,IAAI,SAAS,mGAAmG;AAAA,QACrH,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/lib/tenant/TenantConnectionResolver.cjs

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const dsn = require("../dsn.cjs");
+class TenantConnectionResolver {
+  constructor(cliEnv) {
+    this.cliEnv = cliEnv;
+  }
+  resolve() {
+    let endpoint;
+    let token;
+    if (this.cliEnv.dsn) {
+      ({ endpoint, token } = dsn.parseDsn(this.cliEnv.dsn));
+    } else {
+      endpoint = this.cliEnv.apiUrl;
+      token = this.cliEnv.apiToken;
+    }
+    if (!endpoint || !token) {
+      return void 0;
+    }
+    if (endpoint.endsWith("/")) {
+      endpoint = endpoint.slice(0, -1);
+    }
+    if (endpoint.endsWith(".contember.cloud") && !endpoint.includes("://api-")) {
+      endpoint += "/_api";
+    }
+    return { endpoint, token };
+  }
+}
+exports.TenantConnectionResolver = TenantConnectionResolver;
+//# sourceMappingURL=TenantConnectionResolver.cjs.map

package/dist/development/src/lib/tenant/TenantConnectionResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConnectionResolver.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConnectionResolver.ts"],"sourcesContent":["import { parseDsn } from '../dsn.js'\nimport type { CliEnv } from '../env.js'\nimport type { TenantConnection } from './TenantConnection.js'\n\nexport class TenantConnectionResolver {\n\tconstructor(\n\t\tprivate readonly cliEnv: CliEnv,\n\t) {\n\t}\n\n\tpublic resolve(): TenantConnection | undefined {\n\t\tlet endpoint: string | undefined\n\t\tlet token: string | undefined\n\t\tif (this.cliEnv.dsn) {\n\t\t\t;({ endpoint, token } = parseDsn(this.cliEnv.dsn))\n\t\t} else {\n\t\t\tendpoint = this.cliEnv.apiUrl\n\t\t\ttoken = this.cliEnv.apiToken\n\t\t}\n\t\tif (!endpoint || !token) {\n\t\t\treturn undefined\n\t\t}\n\t\tif (endpoint.endsWith('/')) {\n\t\t\tendpoint = endpoint.slice(0, -1)\n\t\t}\n\t\tif (endpoint.endsWith('.contember.cloud') && !endpoint.includes('://api-')) {\n\t\t\tendpoint += '/_api'\n\t\t}\n\t\treturn { endpoint, token }\n\t}\n}\n"],"names":["parseDsn"],"mappings":";;;AAIO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QAChB;AADgB,SAAA,SAAA;AAAA,EAElB;AAAA,EAEO,UAAwC;AAC9C,QAAI;AACJ,QAAI;AACJ,QAAI,KAAK,OAAO,KAAK;AACnB,OAAC,EAAE,UAAU,MAAA,IAAUA,IAAAA,SAAS,KAAK,OAAO,GAAG;AAAA,IACjD,OAAO;AACN,iBAAW,KAAK,OAAO;AACvB,cAAQ,KAAK,OAAO;AAAA,IACrB;AACA,QAAI,CAAC,YAAY,CAAC,OAAO;AACxB,aAAO;AAAA,IACR;AACA,QAAI,SAAS,SAAS,GAAG,GAAG;AAC3B,iBAAW,SAAS,MAAM,GAAG,EAAE;AAAA,IAChC;AACA,QAAI,SAAS,SAAS,kBAAkB,KAAK,CAAC,SAAS,SAAS,SAAS,GAAG;AAC3E,kBAAY;AAAA,IACb;AACA,WAAO,EAAE,UAAU,MAAA;AAAA,EACpB;AACD;;"}

package/dist/development/src/lib/tenant/TenantConnectionResolver.js

@@ -0,0 +1,30 @@
+import { parseDsn } from "../dsn.js";
+class TenantConnectionResolver {
+  constructor(cliEnv) {
+    this.cliEnv = cliEnv;
+  }
+  resolve() {
+    let endpoint;
+    let token;
+    if (this.cliEnv.dsn) {
+      ({ endpoint, token } = parseDsn(this.cliEnv.dsn));
+    } else {
+      endpoint = this.cliEnv.apiUrl;
+      token = this.cliEnv.apiToken;
+    }
+    if (!endpoint || !token) {
+      return void 0;
+    }
+    if (endpoint.endsWith("/")) {
+      endpoint = endpoint.slice(0, -1);
+    }
+    if (endpoint.endsWith(".contember.cloud") && !endpoint.includes("://api-")) {
+      endpoint += "/_api";
+    }
+    return { endpoint, token };
+  }
+}
+export {
+  TenantConnectionResolver
+};
+//# sourceMappingURL=TenantConnectionResolver.js.map

package/dist/development/src/lib/tenant/TenantConnectionResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConnectionResolver.js","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConnectionResolver.ts"],"sourcesContent":["import { parseDsn } from '../dsn.js'\nimport type { CliEnv } from '../env.js'\nimport type { TenantConnection } from './TenantConnection.js'\n\nexport class TenantConnectionResolver {\n\tconstructor(\n\t\tprivate readonly cliEnv: CliEnv,\n\t) {\n\t}\n\n\tpublic resolve(): TenantConnection | undefined {\n\t\tlet endpoint: string | undefined\n\t\tlet token: string | undefined\n\t\tif (this.cliEnv.dsn) {\n\t\t\t;({ endpoint, token } = parseDsn(this.cliEnv.dsn))\n\t\t} else {\n\t\t\tendpoint = this.cliEnv.apiUrl\n\t\t\ttoken = this.cliEnv.apiToken\n\t\t}\n\t\tif (!endpoint || !token) {\n\t\t\treturn undefined\n\t\t}\n\t\tif (endpoint.endsWith('/')) {\n\t\t\tendpoint = endpoint.slice(0, -1)\n\t\t}\n\t\tif (endpoint.endsWith('.contember.cloud') && !endpoint.includes('://api-')) {\n\t\t\tendpoint += '/_api'\n\t\t}\n\t\treturn { endpoint, token }\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QAChB;AADgB,SAAA,SAAA;AAAA,EAElB;AAAA,EAEO,UAAwC;AAC9C,QAAI;AACJ,QAAI;AACJ,QAAI,KAAK,OAAO,KAAK;AACnB,OAAC,EAAE,UAAU,MAAA,IAAU,SAAS,KAAK,OAAO,GAAG;AAAA,IACjD,OAAO;AACN,iBAAW,KAAK,OAAO;AACvB,cAAQ,KAAK,OAAO;AAAA,IACrB;AACA,QAAI,CAAC,YAAY,CAAC,OAAO;AACxB,aAAO;AAAA,IACR;AACA,QAAI,SAAS,SAAS,GAAG,GAAG;AAC3B,iBAAW,SAAS,MAAM,GAAG,EAAE;AAAA,IAChC;AACA,QAAI,SAAS,SAAS,kBAAkB,KAAK,CAAC,SAAS,SAAS,SAAS,GAAG;AAC3E,kBAAY;AAAA,IACb;AACA,WAAO,EAAE,UAAU,MAAA;AAAA,EACpB;AACD;"}

package/dist/development/src/lib/tenant/authPolicy.cjs

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authPolicyKey = (policy) => JSON.stringify([policy.scope, policy.project ?? null, [...policy.roles].sort()]);
+const describeAuthPolicy = (policy) => {
+  const target = policy.scope === "project" ? `project:${policy.project ?? "?"}` : "global";
+  return `${target} [${[...policy.roles].sort().join(", ")}]`;
+};
+exports.authPolicyKey = authPolicyKey;
+exports.describeAuthPolicy = describeAuthPolicy;
+//# sourceMappingURL=authPolicy.cjs.map

package/dist/development/src/lib/tenant/authPolicy.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPolicy.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/authPolicy.ts"],"sourcesContent":["interface AuthPolicyIdentity {\n\tscope: string\n\tproject?: string | null\n\troles: readonly string[]\n}\n\n/**\n * Identity of a policy for reconciliation purposes. `auth_policy` has no unique\n * constraint beyond its generated id, so the config is matched against existing\n * rows by what the policy actually *targets*: a scope, an optional project and a\n * set of roles. Roles are sorted because `AuthPolicyResolver` treats them as a\n * set (it matches with `roles.some(...)`), so ordering carries no meaning.\n */\nexport const authPolicyKey = (policy: AuthPolicyIdentity): string => JSON.stringify([policy.scope, policy.project ?? null, [...policy.roles].sort()])\n\n/** Human-readable label for logs and error messages. */\nexport const describeAuthPolicy = (policy: AuthPolicyIdentity): string => {\n\tconst target = policy.scope === 'project' ? `project:${policy.project ?? '?'}` : 'global'\n\treturn `${target} [${[...policy.roles].sort().join(', ')}]`\n}\n"],"names":[],"mappings":";;AAaO,MAAM,gBAAgB,CAAC,WAAuC,KAAK,UAAU,CAAC,OAAO,OAAO,OAAO,WAAW,MAAM,CAAC,GAAG,OAAO,KAAK,EAAE,MAAM,CAAC;AAG7I,MAAM,qBAAqB,CAAC,WAAuC;AACzE,QAAM,SAAS,OAAO,UAAU,YAAY,WAAW,OAAO,WAAW,GAAG,KAAK;AACjF,SAAO,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,KAAK,EAAE,KAAA,EAAO,KAAK,IAAI,CAAC;AACzD;;;"}

package/dist/development/src/lib/tenant/authPolicy.js

@@ -0,0 +1,10 @@
+const authPolicyKey = (policy) => JSON.stringify([policy.scope, policy.project ?? null, [...policy.roles].sort()]);
+const describeAuthPolicy = (policy) => {
+  const target = policy.scope === "project" ? `project:${policy.project ?? "?"}` : "global";
+  return `${target} [${[...policy.roles].sort().join(", ")}]`;
+};
+export {
+  authPolicyKey,
+  describeAuthPolicy
+};
+//# sourceMappingURL=authPolicy.js.map

package/dist/development/src/lib/tenant/authPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPolicy.js","sources":["../../../../../../packages/cli/src/lib/tenant/authPolicy.ts"],"sourcesContent":["interface AuthPolicyIdentity {\n\tscope: string\n\tproject?: string | null\n\troles: readonly string[]\n}\n\n/**\n * Identity of a policy for reconciliation purposes. `auth_policy` has no unique\n * constraint beyond its generated id, so the config is matched against existing\n * rows by what the policy actually *targets*: a scope, an optional project and a\n * set of roles. Roles are sorted because `AuthPolicyResolver` treats them as a\n * set (it matches with `roles.some(...)`), so ordering carries no meaning.\n */\nexport const authPolicyKey = (policy: AuthPolicyIdentity): string => JSON.stringify([policy.scope, policy.project ?? null, [...policy.roles].sort()])\n\n/** Human-readable label for logs and error messages. */\nexport const describeAuthPolicy = (policy: AuthPolicyIdentity): string => {\n\tconst target = policy.scope === 'project' ? `project:${policy.project ?? '?'}` : 'global'\n\treturn `${target} [${[...policy.roles].sort().join(', ')}]`\n}\n"],"names":[],"mappings":"AAaO,MAAM,gBAAgB,CAAC,WAAuC,KAAK,UAAU,CAAC,OAAO,OAAO,OAAO,WAAW,MAAM,CAAC,GAAG,OAAO,KAAK,EAAE,MAAM,CAAC;AAG7I,MAAM,qBAAqB,CAAC,WAAuC;AACzE,QAAM,SAAS,OAAO,UAAU,YAAY,WAAW,OAAO,WAAW,GAAG,KAAK;AACjF,SAAO,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,KAAK,EAAE,KAAA,EAAO,KAAK,IAAI,CAAC;AACzD;"}

package/dist/development/src/lib/tenant/clients/TenantApiKeyClient.cjs

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const TenantApi = require("@contember/graphql-client-tenant");
+const cliCommon = require("@contember/cli-common");
+const globalApiKeysFetcher = TenantApi.query$.globalApiKeys(TenantApi.apiKey$$.identity(TenantApi.identity$.id.roles));
+const projectApiKeysFetcher = TenantApi.query$.projectBySlug(
+  TenantApi.project$.apiKeys(
+    TenantApi.apiKey$$.identity(
+      TenantApi.identity$.id.projects(
+        TenantApi.identityProjectRelation$.project(TenantApi.project$.slug).memberships(TenantApi.membership$.role.variables(TenantApi.variableEntry$$))
+      )
+    )
+  )
+);
+const createApiKeyFetcher = TenantApi.mutation$.createApiKey(
+  TenantApi.createApiKeyResponse$$.error(TenantApi.createApiKeyError$$).result(TenantApi.createApiKeyResult$.apiKey(TenantApi.apiKeyWithToken$$))
+);
+const createGlobalApiKeyFetcher = TenantApi.mutation$.createGlobalApiKey(
+  TenantApi.createApiKeyResponse$$.error(TenantApi.createApiKeyError$$).result(TenantApi.createApiKeyResult$.apiKey(TenantApi.apiKeyWithToken$$))
+);
+const disableApiKeyFetcher = TenantApi.mutation$.disableApiKey(TenantApi.disableApiKeyResponse$$.error(TenantApi.disableApiKeyError$$));
+class TenantApiKeyClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listGlobalApiKeys() {
+    const result = await this.transport.exec(globalApiKeysFetcher, {});
+    return result.globalApiKeys.map((it) => ({
+      ...toApiKey(it),
+      globalRoles: it.identity.roles ? [...it.identity.roles] : null
+    }));
+  }
+  async listProjectApiKeys(projectSlug) {
+    const result = await this.transport.exec(projectApiKeysFetcher, { slug: projectSlug });
+    const project = result.projectBySlug;
+    if (!project) {
+      throw new cliCommon.CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {
+        code: "PROJECT_NOT_FOUND",
+        exitCode: cliCommon.ExitCode.NotFound,
+        details: { projectSlug }
+      });
+    }
+    return project.apiKeys.map((it) => ({
+      ...toApiKey(it),
+      memberships: it.identity.projects.find((relation) => relation.project.slug === projectSlug)?.memberships.map((membership) => ({
+        role: membership.role,
+        variables: membership.variables.map((variable) => ({ name: variable.name, values: [...variable.values] }))
+      })) ?? []
+    }));
+  }
+  /** Project-scoped key. The token in the result is shown exactly once — the server does not store or re-expose it. */
+  async createApiKey(args) {
+    const operation = `createApiKey(${args.projectSlug})`;
+    const result = await this.transport.exec(createApiKeyFetcher, {
+      projectSlug: args.projectSlug,
+      memberships: args.memberships,
+      description: args.description,
+      tokenHash: args.tokenHash,
+      options: args.options
+    });
+    this.transport.assertOk(result.createApiKey, operation);
+    return toApiKeyWithToken(result.createApiKey?.result?.apiKey, operation);
+  }
+  /** Global key, tied to no project. The token in the result is shown exactly once. */
+  async createGlobalApiKey(args) {
+    const operation = `createGlobalApiKey(${args.description})`;
+    const result = await this.transport.exec(createGlobalApiKeyFetcher, {
+      description: args.description,
+      roles: args.roles,
+      tokenHash: args.tokenHash,
+      options: args.options
+    });
+    this.transport.assertOk(result.createGlobalApiKey, operation);
+    return toApiKeyWithToken(result.createGlobalApiKey?.result?.apiKey, operation);
+  }
+  async disableApiKey(id) {
+    const result = await this.transport.exec(disableApiKeyFetcher, { id });
+    this.transport.assertOk(result.disableApiKey, `disableApiKey(${id})`);
+  }
+}
+const toApiKey = (it) => ({
+  id: it.id,
+  identityId: it.identity.id,
+  description: it.description ?? null,
+  type: it.type ?? null,
+  enabled: it.enabled ?? null,
+  createdAt: it.createdAt ?? null,
+  lastUsedAt: it.lastUsedAt ?? null,
+  expiresAt: it.expiresAt ?? null
+});
+const toApiKeyWithToken = (apiKey, operation) => {
+  if (!apiKey) {
+    throw new cliCommon.CliError(`${operation} reported success but returned no api key`, {
+      code: "TENANT_API_INVALID_RESPONSE",
+      exitCode: cliCommon.ExitCode.InternalError
+    });
+  }
+  return { id: apiKey.id, token: apiKey.token ?? null };
+};
+exports.TenantApiKeyClient = TenantApiKeyClient;
+//# sourceMappingURL=TenantApiKeyClient.cjs.map

package/dist/development/src/lib/tenant/clients/TenantApiKeyClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiKeyClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantApiKeyClient.ts"],"sourcesContent":["import {\n\tapiKey$$,\n\tapiKeyWithToken$$,\n\tcreateApiKeyError$$,\n\ttype CreateApiKeyOptions,\n\tcreateApiKeyResponse$$,\n\tcreateApiKeyResult$,\n\tdisableApiKeyError$$,\n\tdisableApiKeyResponse$$,\n\tidentity$,\n\tidentityProjectRelation$,\n\tmembership$,\n\ttype MembershipInput,\n\tmutation$,\n\tproject$,\n\tquery$,\n\tvariableEntry$$,\n} from '@contember/graphql-client-tenant'\nimport { CliError, ExitCode } from '@contember/cli-common'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantApiKey {\n\tid: string\n\tidentityId: string\n\tdescription: string | null\n\ttype: string | null\n\tenabled: boolean | null\n\tcreatedAt: string | null\n\tlastUsedAt: string | null\n\texpiresAt: string | null\n}\n\nexport interface TenantGlobalApiKey extends TenantApiKey {\n\tglobalRoles: string[] | null\n}\n\nexport interface TenantApiKeyMembership {\n\trole: string\n\tvariables: { name: string; values: string[] }[]\n}\n\nexport interface TenantProjectApiKey extends TenantApiKey {\n\tmemberships: TenantApiKeyMembership[]\n}\n\nexport interface TenantApiKeyWithToken {\n\tid: string\n\t/** Null when the key was provisioned from a caller-supplied `tokenHash` — the server never had a plaintext to return. */\n\ttoken: string | null\n}\n\nexport interface CreateApiKeyArgs {\n\tprojectSlug: string\n\tmemberships: MembershipInput[]\n\tdescription: string\n\ttokenHash?: string\n\toptions?: CreateApiKeyOptions\n}\n\nexport interface CreateGlobalApiKeyArgs {\n\tdescription: string\n\troles?: string[]\n\ttokenHash?: string\n\toptions?: CreateApiKeyOptions\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst globalApiKeysFetcher = query$.globalApiKeys(apiKey$$.identity(identity$.id.roles))\nconst projectApiKeysFetcher = query$.projectBySlug(\n\tproject$.apiKeys(\n\t\tapiKey$$.identity(\n\t\t\tidentity$.id.projects(\n\t\t\t\tidentityProjectRelation$.project(project$.slug).memberships(membership$.role.variables(variableEntry$$)),\n\t\t\t),\n\t\t),\n\t),\n)\nconst createApiKeyFetcher = mutation$.createApiKey(\n\tcreateApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),\n)\nconst createGlobalApiKeyFetcher = mutation$.createGlobalApiKey(\n\tcreateApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),\n)\nconst disableApiKeyFetcher = mutation$.disableApiKey(disableApiKeyResponse$$.error(disableApiKeyError$$))\n\n/** API keys — global permanent keys and per-project ones. */\nexport class TenantApiKeyClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listGlobalApiKeys(): Promise<TenantGlobalApiKey[]> {\n\t\tconst result = await this.transport.exec(globalApiKeysFetcher, {})\n\t\treturn result.globalApiKeys.map(it => ({\n\t\t\t...toApiKey(it),\n\t\t\tglobalRoles: it.identity.roles ? [...it.identity.roles] : null,\n\t\t}))\n\t}\n\n\tpublic async listProjectApiKeys(projectSlug: string): Promise<TenantProjectApiKey[]> {\n\t\tconst result = await this.transport.exec(projectApiKeysFetcher, { slug: projectSlug })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\tthrow new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {\n\t\t\t\tcode: 'PROJECT_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t\tdetails: { projectSlug },\n\t\t\t})\n\t\t}\n\t\treturn project.apiKeys.map(it => ({\n\t\t\t...toApiKey(it),\n\t\t\tmemberships: it.identity.projects.find(relation => relation.project.slug === projectSlug)?.memberships.map(membership => ({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),\n\t\t\t})) ?? [],\n\t\t}))\n\t}\n\n\t/** Project-scoped key. The token in the result is shown exactly once — the server does not store or re-expose it. */\n\tpublic async createApiKey(args: CreateApiKeyArgs): Promise<TenantApiKeyWithToken> {\n\t\tconst operation = `createApiKey(${args.projectSlug})`\n\t\tconst result = await this.transport.exec(createApiKeyFetcher, {\n\t\t\tprojectSlug: args.projectSlug,\n\t\t\tmemberships: args.memberships,\n\t\t\tdescription: args.description,\n\t\t\ttokenHash: args.tokenHash,\n\t\t\toptions: args.options,\n\t\t})\n\t\tthis.transport.assertOk(result.createApiKey, operation)\n\t\treturn toApiKeyWithToken(result.createApiKey?.result?.apiKey, operation)\n\t}\n\n\t/** Global key, tied to no project. The token in the result is shown exactly once. */\n\tpublic async createGlobalApiKey(args: CreateGlobalApiKeyArgs): Promise<TenantApiKeyWithToken> {\n\t\tconst operation = `createGlobalApiKey(${args.description})`\n\t\tconst result = await this.transport.exec(createGlobalApiKeyFetcher, {\n\t\t\tdescription: args.description,\n\t\t\troles: args.roles,\n\t\t\ttokenHash: args.tokenHash,\n\t\t\toptions: args.options,\n\t\t})\n\t\tthis.transport.assertOk(result.createGlobalApiKey, operation)\n\t\treturn toApiKeyWithToken(result.createGlobalApiKey?.result?.apiKey, operation)\n\t}\n\n\tpublic async disableApiKey(id: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disableApiKeyFetcher, { id })\n\t\tthis.transport.assertOk(result.disableApiKey, `disableApiKey(${id})`)\n\t}\n}\n\nconst toApiKey = (it: {\n\treadonly id: string\n\treadonly identity: { readonly id: string }\n\treadonly description?: string\n\treadonly type?: string\n\treadonly enabled?: boolean\n\treadonly createdAt?: string\n\treadonly lastUsedAt?: string\n\treadonly expiresAt?: string\n}): TenantApiKey => ({\n\tid: it.id,\n\tidentityId: it.identity.id,\n\tdescription: it.description ?? null,\n\ttype: it.type ?? null,\n\tenabled: it.enabled ?? null,\n\tcreatedAt: it.createdAt ?? null,\n\tlastUsedAt: it.lastUsedAt ?? null,\n\texpiresAt: it.expiresAt ?? null,\n})\n\n/** `assertOk` only proves `ok`/`error` are consistent — `result` is still typed optional, so this guards the actual payload. */\nconst toApiKeyWithToken = (apiKey: { id: string; token?: string } | undefined, operation: string): TenantApiKeyWithToken => {\n\tif (!apiKey) {\n\t\tthrow new CliError(`${operation} reported success but returned no api key`, {\n\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\texitCode: ExitCode.InternalError,\n\t\t})\n\t}\n\treturn { id: apiKey.id, token: apiKey.token ?? null }\n}\n"],"names":["query$","apiKey$$","identity$","project$","identityProjectRelation$","membership$","variableEntry$$","mutation$","createApiKeyResponse$$","createApiKeyError$$","createApiKeyResult$","apiKeyWithToken$$","disableApiKeyResponse$$","disableApiKeyError$$","CliError","ExitCode"],"mappings":";;;;AAmEA,MAAM,uBAAuBA,UAAAA,OAAO,cAAcC,UAAAA,SAAS,SAASC,oBAAU,GAAG,KAAK,CAAC;AACvF,MAAM,wBAAwBF,UAAAA,OAAO;AAAA,EACpCG,UAAAA,SAAS;AAAA,IACRF,UAAAA,SAAS;AAAA,MACRC,UAAAA,UAAU,GAAG;AAAA,QACZE,mCAAyB,QAAQD,UAAAA,SAAS,IAAI,EAAE,YAAYE,sBAAY,KAAK,UAAUC,yBAAe,CAAC;AAAA,MAAA;AAAA,IACxG;AAAA,EACD;AAEF;AACA,MAAM,sBAAsBC,UAAAA,UAAU;AAAA,EACrCC,UAAAA,uBAAuB,MAAMC,6BAAmB,EAAE,OAAOC,UAAAA,oBAAoB,OAAOC,2BAAiB,CAAC;AACvG;AACA,MAAM,4BAA4BJ,UAAAA,UAAU;AAAA,EAC3CC,UAAAA,uBAAuB,MAAMC,6BAAmB,EAAE,OAAOC,UAAAA,oBAAoB,OAAOC,2BAAiB,CAAC;AACvG;AACA,MAAM,uBAAuBJ,UAAAA,UAAU,cAAcK,UAAAA,wBAAwB,MAAMC,UAAAA,oBAAoB,CAAC;AAGjG,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,oBAAmD;AAC/D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,WAAO,OAAO,cAAc,IAAI,CAAA,QAAO;AAAA,MACtC,GAAG,SAAS,EAAE;AAAA,MACd,aAAa,GAAG,SAAS,QAAQ,CAAC,GAAG,GAAG,SAAS,KAAK,IAAI;AAAA,IAAA,EACzD;AAAA,EACH;AAAA,EAEA,MAAa,mBAAmB,aAAqD;AACpF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,MAAM,aAAa;AACrF,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,YAAM,IAAIC,UAAAA,SAAS,WAAW,WAAW,mDAAmD;AAAA,QAC3F,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,QACnB,SAAS,EAAE,YAAA;AAAA,MAAY,CACvB;AAAA,IACF;AACA,WAAO,QAAQ,QAAQ,IAAI,CAAA,QAAO;AAAA,MACjC,GAAG,SAAS,EAAE;AAAA,MACd,aAAa,GAAG,SAAS,SAAS,KAAK,CAAA,aAAY,SAAS,QAAQ,SAAS,WAAW,GAAG,YAAY,IAAI,CAAA,gBAAe;AAAA,QACzH,MAAM,WAAW;AAAA,QACjB,WAAW,WAAW,UAAU,IAAI,eAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,IAAI;AAAA,MAAA,EACtG,KAAK,CAAA;AAAA,IAAC,EACP;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,aAAa,MAAwD;AACjF,UAAM,YAAY,gBAAgB,KAAK,WAAW;AAClD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,qBAAqB;AAAA,MAC7D,aAAa,KAAK;AAAA,MAClB,aAAa,KAAK;AAAA,MAClB,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,SAAS,KAAK;AAAA,IAAA,CACd;AACD,SAAK,UAAU,SAAS,OAAO,cAAc,SAAS;AACtD,WAAO,kBAAkB,OAAO,cAAc,QAAQ,QAAQ,SAAS;AAAA,EACxE;AAAA;AAAA,EAGA,MAAa,mBAAmB,MAA8D;AAC7F,UAAM,YAAY,sBAAsB,KAAK,WAAW;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B;AAAA,MACnE,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,SAAS,KAAK;AAAA,IAAA,CACd;AACD,SAAK,UAAU,SAAS,OAAO,oBAAoB,SAAS;AAC5D,WAAO,kBAAkB,OAAO,oBAAoB,QAAQ,QAAQ,SAAS;AAAA,EAC9E;AAAA,EAEA,MAAa,cAAc,IAA2B;AACrD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,IAAI;AACrE,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,EAAE,GAAG;AAAA,EACrE;AACD;AAEA,MAAM,WAAW,CAAC,QASG;AAAA,EACpB,IAAI,GAAG;AAAA,EACP,YAAY,GAAG,SAAS;AAAA,EACxB,aAAa,GAAG,eAAe;AAAA,EAC/B,MAAM,GAAG,QAAQ;AAAA,EACjB,SAAS,GAAG,WAAW;AAAA,EACvB,WAAW,GAAG,aAAa;AAAA,EAC3B,YAAY,GAAG,cAAc;AAAA,EAC7B,WAAW,GAAG,aAAa;AAC5B;AAGA,MAAM,oBAAoB,CAAC,QAAoD,cAA6C;AAC3H,MAAI,CAAC,QAAQ;AACZ,UAAM,IAAID,UAAAA,SAAS,GAAG,SAAS,6CAA6C;AAAA,MAC3E,MAAM;AAAA,MACN,UAAUC,UAAAA,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO,EAAE,IAAI,OAAO,IAAI,OAAO,OAAO,SAAS,KAAA;AAChD;;"}