@contember/cli 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/lib/tenant/confirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmation.js","sources":["../../../../../../packages/cli/src/lib/tenant/confirmation.ts"],"sourcesContent":["import { CliError, ExitCode, Output } from '@contember/cli-common'\nimport { promptConfirm } from '../prompt/index.js'\n\nexport interface ConfirmationArgs {\n\treadonly yes: boolean\n\treadonly output: Output\n\t/** What is about to happen, shown above the prompt. */\n\treadonly warning: string\n}\n\n/**\n * The one destructive-action guard of the tenant commands. `--yes` skips the prompt; without a TTY there\n * is nobody to answer it, so the run fails fast instead of hanging a CI job. Declining throws as well, so\n * a caller never has to turn a boolean into an exit code and an agent always gets a typed error.\n */\nexport const requireConfirmation = async ({ yes, output, warning }: ConfirmationArgs): Promise<void> => {\n\tif (yes) {\n\t\treturn\n\t}\n\tif (!output.canPrompt()) {\n\t\tthrow new CliError('TTY not available. Pass --yes to confirm execution.', {\n\t\t\tcode: 'TTY_UNAVAILABLE',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n\toutput.warn(warning)\n\toutput.info('(to skip this dialog, you can pass the --yes option)')\n\tconst confirmed = await promptConfirm(output, { message: 'Do you want to continue?' })\n\tif (!confirmed) {\n\t\tthrow new CliError('Aborted by the user.', { code: 'ABORTED', exitCode: ExitCode.InputError })\n\t}\n}\n"],"names":[],"mappings":";;AAeO,MAAM,sBAAsB,OAAO,EAAE,KAAK,QAAQ,cAA+C;AACvG,MAAI,KAAK;AACR;AAAA,EACD;AACA,MAAI,CAAC,OAAO,aAAa;AACxB,UAAM,IAAI,SAAS,uDAAuD;AAAA,MACzE,MAAM;AAAA,MACN,UAAU,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO,KAAK,OAAO;AACnB,SAAO,KAAK,sDAAsD;AAClE,QAAM,YAAY,MAAM,cAAc,QAAQ,EAAE,SAAS,4BAA4B;AACrF,MAAI,CAAC,WAAW;AACf,UAAM,IAAI,SAAS,wBAAwB,EAAE,MAAM,WAAW,UAAU,SAAS,YAAY;AAAA,EAC9F;AACD;"}

package/dist/development/src/lib/tenant/input/pagination.cjs

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const GRAPHQL_INT_MAX = 2147483647;
+const parsePaginationOffset = (value, flag = "--offset") => parsePaginationInteger(value, flag, "offset", 0);
+const parsePaginationLimit = (value, flag = "--limit") => parsePaginationInteger(value, flag, "limit", 1);
+const parsePaginationInteger = (value, flag, kind, minimum) => {
+  if (value === void 0) {
+    return void 0;
+  }
+  const parsed = Number(value);
+  if (!/^(?:0|[1-9]\d*)$/.test(value) || !Number.isSafeInteger(parsed) || parsed < minimum || parsed > GRAPHQL_INT_MAX) {
+    const requirement = kind === "offset" ? `a non-negative GraphQL Int (maximum ${GRAPHQL_INT_MAX})` : `a positive GraphQL Int (maximum ${GRAPHQL_INT_MAX})`;
+    throw new cliCommon.CliError(`${flag} must be ${requirement}.`, {
+      code: kind === "offset" ? "INVALID_PAGINATION_OFFSET" : "INVALID_PAGINATION_LIMIT",
+      exitCode: cliCommon.ExitCode.InputError
+    });
+  }
+  return parsed;
+};
+exports.GRAPHQL_INT_MAX = GRAPHQL_INT_MAX;
+exports.parsePaginationLimit = parsePaginationLimit;
+exports.parsePaginationOffset = parsePaginationOffset;
+//# sourceMappingURL=pagination.cjs.map

package/dist/development/src/lib/tenant/input/pagination.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/input/pagination.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\n\n/** GraphQL `Int` is a signed 32-bit integer. Pagination values are non-negative. */\nexport const GRAPHQL_INT_MAX = 2_147_483_647\n\n/** Parses an optional non-negative integer pagination offset. */\nexport const parsePaginationOffset = (value: string | undefined, flag = '--offset'): number | undefined =>\n\tparsePaginationInteger(value, flag, 'offset', 0)\n\n/** Parses an optional positive integer pagination limit. */\nexport const parsePaginationLimit = (value: string | undefined, flag = '--limit'): number | undefined =>\n\tparsePaginationInteger(value, flag, 'limit', 1)\n\nconst parsePaginationInteger = (\n\tvalue: string | undefined,\n\tflag: string,\n\tkind: 'offset' | 'limit',\n\tminimum: number,\n): number | undefined => {\n\tif (value === undefined) {\n\t\treturn undefined\n\t}\n\tconst parsed = Number(value)\n\tif (\n\t\t!/^(?:0|[1-9]\\d*)$/.test(value)\n\t\t|| !Number.isSafeInteger(parsed)\n\t\t|| parsed < minimum\n\t\t|| parsed > GRAPHQL_INT_MAX\n\t) {\n\t\tconst requirement = kind === 'offset'\n\t\t\t? `a non-negative GraphQL Int (maximum ${GRAPHQL_INT_MAX})`\n\t\t\t: `a positive GraphQL Int (maximum ${GRAPHQL_INT_MAX})`\n\t\tthrow new CliError(`${flag} must be ${requirement}.`, {\n\t\t\tcode: kind === 'offset' ? 'INVALID_PAGINATION_OFFSET' : 'INVALID_PAGINATION_LIMIT',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n\treturn parsed\n}\n"],"names":["CliError","ExitCode"],"mappings":";;;AAGO,MAAM,kBAAkB;AAGxB,MAAM,wBAAwB,CAAC,OAA2B,OAAO,eACvE,uBAAuB,OAAO,MAAM,UAAU,CAAC;AAGzC,MAAM,uBAAuB,CAAC,OAA2B,OAAO,cACtE,uBAAuB,OAAO,MAAM,SAAS,CAAC;AAE/C,MAAM,yBAAyB,CAC9B,OACA,MACA,MACA,YACwB;AACxB,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,MACC,CAAC,mBAAmB,KAAK,KAAK,KAC3B,CAAC,OAAO,cAAc,MAAM,KAC5B,SAAS,WACT,SAAS,iBACX;AACD,UAAM,cAAc,SAAS,WAC1B,uCAAuC,eAAe,MACtD,mCAAmC,eAAe;AACrD,UAAM,IAAIA,UAAAA,SAAS,GAAG,IAAI,YAAY,WAAW,KAAK;AAAA,MACrD,MAAM,SAAS,WAAW,8BAA8B;AAAA,MACxD,UAAUC,UAAAA,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO;AACR;;;;"}

package/dist/development/src/lib/tenant/input/pagination.js

@@ -0,0 +1,24 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+const GRAPHQL_INT_MAX = 2147483647;
+const parsePaginationOffset = (value, flag = "--offset") => parsePaginationInteger(value, flag, "offset", 0);
+const parsePaginationLimit = (value, flag = "--limit") => parsePaginationInteger(value, flag, "limit", 1);
+const parsePaginationInteger = (value, flag, kind, minimum) => {
+  if (value === void 0) {
+    return void 0;
+  }
+  const parsed = Number(value);
+  if (!/^(?:0|[1-9]\d*)$/.test(value) || !Number.isSafeInteger(parsed) || parsed < minimum || parsed > GRAPHQL_INT_MAX) {
+    const requirement = kind === "offset" ? `a non-negative GraphQL Int (maximum ${GRAPHQL_INT_MAX})` : `a positive GraphQL Int (maximum ${GRAPHQL_INT_MAX})`;
+    throw new CliError(`${flag} must be ${requirement}.`, {
+      code: kind === "offset" ? "INVALID_PAGINATION_OFFSET" : "INVALID_PAGINATION_LIMIT",
+      exitCode: ExitCode.InputError
+    });
+  }
+  return parsed;
+};
+export {
+  GRAPHQL_INT_MAX,
+  parsePaginationLimit,
+  parsePaginationOffset
+};
+//# sourceMappingURL=pagination.js.map

package/dist/development/src/lib/tenant/input/pagination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.js","sources":["../../../../../../../packages/cli/src/lib/tenant/input/pagination.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\n\n/** GraphQL `Int` is a signed 32-bit integer. Pagination values are non-negative. */\nexport const GRAPHQL_INT_MAX = 2_147_483_647\n\n/** Parses an optional non-negative integer pagination offset. */\nexport const parsePaginationOffset = (value: string | undefined, flag = '--offset'): number | undefined =>\n\tparsePaginationInteger(value, flag, 'offset', 0)\n\n/** Parses an optional positive integer pagination limit. */\nexport const parsePaginationLimit = (value: string | undefined, flag = '--limit'): number | undefined =>\n\tparsePaginationInteger(value, flag, 'limit', 1)\n\nconst parsePaginationInteger = (\n\tvalue: string | undefined,\n\tflag: string,\n\tkind: 'offset' | 'limit',\n\tminimum: number,\n): number | undefined => {\n\tif (value === undefined) {\n\t\treturn undefined\n\t}\n\tconst parsed = Number(value)\n\tif (\n\t\t!/^(?:0|[1-9]\\d*)$/.test(value)\n\t\t|| !Number.isSafeInteger(parsed)\n\t\t|| parsed < minimum\n\t\t|| parsed > GRAPHQL_INT_MAX\n\t) {\n\t\tconst requirement = kind === 'offset'\n\t\t\t? `a non-negative GraphQL Int (maximum ${GRAPHQL_INT_MAX})`\n\t\t\t: `a positive GraphQL Int (maximum ${GRAPHQL_INT_MAX})`\n\t\tthrow new CliError(`${flag} must be ${requirement}.`, {\n\t\t\tcode: kind === 'offset' ? 'INVALID_PAGINATION_OFFSET' : 'INVALID_PAGINATION_LIMIT',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n\treturn parsed\n}\n"],"names":[],"mappings":";AAGO,MAAM,kBAAkB;AAGxB,MAAM,wBAAwB,CAAC,OAA2B,OAAO,eACvE,uBAAuB,OAAO,MAAM,UAAU,CAAC;AAGzC,MAAM,uBAAuB,CAAC,OAA2B,OAAO,cACtE,uBAAuB,OAAO,MAAM,SAAS,CAAC;AAE/C,MAAM,yBAAyB,CAC9B,OACA,MACA,MACA,YACwB;AACxB,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,MACC,CAAC,mBAAmB,KAAK,KAAK,KAC3B,CAAC,OAAO,cAAc,MAAM,KAC5B,SAAS,WACT,SAAS,iBACX;AACD,UAAM,cAAc,SAAS,WAC1B,uCAAuC,eAAe,MACtD,mCAAmC,eAAe;AACrD,UAAM,IAAI,SAAS,GAAG,IAAI,YAAY,WAAW,KAAK;AAAA,MACrD,MAAM,SAAS,WAAW,8BAA8B;AAAA,MACxD,UAAU,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO;AACR;"}

package/dist/development/src/lib/tenant/input/value.cjs

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const stdin = require("../stdin.cjs");
+const literalInput = (name, flag, value) => ({
+  kind: "literal",
+  name,
+  flag,
+  value
+});
+const environmentInput = (name, flag, variable) => ({
+  kind: "environment",
+  name,
+  flag,
+  variable
+});
+const stdinInput = (name, flag) => ({
+  kind: "stdin",
+  name,
+  flag
+});
+const resolveRequiredTenantInput = async (sources, options, dependencies = {}) => {
+  const source = selectSource(sources, options.label, true);
+  return await resolveSelectedSource(source, options, dependencies);
+};
+const resolveOptionalTenantInput = async (sources, options, dependencies = {}) => {
+  const source = selectSource(sources, options.label, false);
+  return source === void 0 ? void 0 : await resolveSelectedSource(source, options, dependencies);
+};
+function selectSource(sources, label, required) {
+  if (sources.length > 1) {
+    throw inputError(`Select only one input source for ${label}: ${sources.map((source2) => source2.flag).join(", ")}.`, "AMBIGUOUS_INPUT_SOURCE");
+  }
+  const source = sources[0];
+  if (source === void 0 && required) {
+    throw inputError(`Select an input source for ${label}.`, "MISSING_INPUT_SOURCE");
+  }
+  return source;
+}
+const resolveSelectedSource = async (source, options, dependencies) => {
+  const value = await readSource(source, dependencies);
+  const normalized = options.trailingLineEnding === "remove-one" ? removeOneTrailingLineEnding(value) : value;
+  if (normalized === "" && options.allowEmpty !== true) {
+    throw inputError(`${source.flag} resolved to an empty value for ${options.label}.`, "EMPTY_INPUT_VALUE");
+  }
+  return { name: source.name, kind: source.kind, value: normalized };
+};
+const readSource = async (source, dependencies) => {
+  switch (source.kind) {
+    case "literal":
+      return source.value;
+    case "environment": {
+      const value = (dependencies.readEnvironment ?? readEnvironment)(source.variable);
+      if (value === void 0) {
+        throw inputError(`Environment variable ${source.variable} selected by ${source.flag} is not set.`, "INPUT_ENV_NOT_SET");
+      }
+      return value;
+    }
+    case "stdin":
+      return await (dependencies.readStdin ?? stdin.readStdinText)();
+  }
+};
+const readEnvironment = (name) => process.env[name];
+const removeOneTrailingLineEnding = (value) => value.replace(/(?:\r\n|\n)$/, "");
+const inputError = (message, code) => new cliCommon.CliError(message, { code, exitCode: cliCommon.ExitCode.InputError });
+exports.environmentInput = environmentInput;
+exports.literalInput = literalInput;
+exports.resolveOptionalTenantInput = resolveOptionalTenantInput;
+exports.resolveRequiredTenantInput = resolveRequiredTenantInput;
+exports.stdinInput = stdinInput;
+//# sourceMappingURL=value.cjs.map

package/dist/development/src/lib/tenant/input/value.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"value.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/input/value.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport { readStdinText, type StdinReader } from '../stdin.js'\n\ninterface InputSourceBase<Name extends string> {\n\t/** Identifies the semantic value, for example `password` or `password-hash`. */\n\treadonly name: Name\n\t/** Identifies the selected option without including its submitted value. */\n\treadonly flag: string\n}\n\nexport interface LiteralInputSource<Name extends string = string> extends InputSourceBase<Name> {\n\treadonly kind: 'literal'\n\treadonly value: string\n}\n\nexport interface EnvironmentInputSource<Name extends string = string> extends InputSourceBase<Name> {\n\treadonly kind: 'environment'\n\treadonly variable: string\n}\n\nexport interface StdinInputSource<Name extends string = string> extends InputSourceBase<Name> {\n\treadonly kind: 'stdin'\n}\n\n/** One explicitly selected input source. Unselected options must not be included. */\nexport type TenantInputSource<Name extends string = string> =\n\t| LiteralInputSource<Name>\n\t| EnvironmentInputSource<Name>\n\t| StdinInputSource<Name>\n\nexport type TrailingLineEnding = 'preserve' | 'remove-one'\n\nexport interface TenantInputOptions {\n\t/** A non-sensitive description used in errors, for example `project secret`. */\n\treadonly label: string\n\treadonly allowEmpty?: boolean\n\treadonly trailingLineEnding?: TrailingLineEnding\n}\n\nexport interface TenantInputDependencies {\n\treadonly readStdin?: StdinReader\n\treadonly readEnvironment?: (name: string) => string | undefined\n}\n\nexport interface ResolvedTenantInput<Name extends string = string> {\n\treadonly name: Name\n\treadonly kind: TenantInputSource<Name>['kind']\n\treadonly value: string\n}\n\nexport const literalInput = <Name extends string>(name: Name, flag: string, value: string): LiteralInputSource<Name> => ({\n\tkind: 'literal',\n\tname,\n\tflag,\n\tvalue,\n})\n\nexport const environmentInput = <Name extends string>(name: Name, flag: string, variable: string): EnvironmentInputSource<Name> => ({\n\tkind: 'environment',\n\tname,\n\tflag,\n\tvariable,\n})\n\nexport const stdinInput = <Name extends string>(name: Name, flag: string): StdinInputSource<Name> => ({\n\tkind: 'stdin',\n\tname,\n\tflag,\n})\n\n/** Resolves exactly one explicitly selected source. */\nexport const resolveRequiredTenantInput = async <Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\toptions: TenantInputOptions,\n\tdependencies: TenantInputDependencies = {},\n): Promise<ResolvedTenantInput<Name>> => {\n\tconst source = selectSource(sources, options.label, true)\n\treturn await resolveSelectedSource(source, options, dependencies)\n}\n\n/** Resolves at most one explicitly selected source without reading stdin when none was selected. */\nexport const resolveOptionalTenantInput = async <Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\toptions: TenantInputOptions,\n\tdependencies: TenantInputDependencies = {},\n): Promise<ResolvedTenantInput<Name> | undefined> => {\n\tconst source = selectSource(sources, options.label, false)\n\treturn source === undefined ? undefined : await resolveSelectedSource(source, options, dependencies)\n}\n\nfunction selectSource<Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\tlabel: string,\n\trequired: true,\n): TenantInputSource<Name>\nfunction selectSource<Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\tlabel: string,\n\trequired: false,\n): TenantInputSource<Name> | undefined\nfunction selectSource<Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\tlabel: string,\n\trequired: boolean,\n): TenantInputSource<Name> | undefined {\n\tif (sources.length > 1) {\n\t\tthrow inputError(`Select only one input source for ${label}: ${sources.map(source => source.flag).join(', ')}.`, 'AMBIGUOUS_INPUT_SOURCE')\n\t}\n\tconst source = sources[0]\n\tif (source === undefined && required) {\n\t\tthrow inputError(`Select an input source for ${label}.`, 'MISSING_INPUT_SOURCE')\n\t}\n\treturn source\n}\n\nconst resolveSelectedSource = async <Name extends string>(\n\tsource: TenantInputSource<Name>,\n\toptions: TenantInputOptions,\n\tdependencies: TenantInputDependencies,\n): Promise<ResolvedTenantInput<Name>> => {\n\tconst value = await readSource(source, dependencies)\n\tconst normalized = options.trailingLineEnding === 'remove-one' ? removeOneTrailingLineEnding(value) : value\n\tif (normalized === '' && options.allowEmpty !== true) {\n\t\tthrow inputError(`${source.flag} resolved to an empty value for ${options.label}.`, 'EMPTY_INPUT_VALUE')\n\t}\n\treturn { name: source.name, kind: source.kind, value: normalized }\n}\n\nconst readSource = async <Name extends string>(source: TenantInputSource<Name>, dependencies: TenantInputDependencies): Promise<string> => {\n\tswitch (source.kind) {\n\t\tcase 'literal':\n\t\t\treturn source.value\n\t\tcase 'environment': {\n\t\t\tconst value = (dependencies.readEnvironment ?? readEnvironment)(source.variable)\n\t\t\tif (value === undefined) {\n\t\t\t\tthrow inputError(`Environment variable ${source.variable} selected by ${source.flag} is not set.`, 'INPUT_ENV_NOT_SET')\n\t\t\t}\n\t\t\treturn value\n\t\t}\n\t\tcase 'stdin':\n\t\t\treturn await (dependencies.readStdin ?? readStdinText)()\n\t}\n}\n\nconst readEnvironment = (name: string): string | undefined => process.env[name]\n\nconst removeOneTrailingLineEnding = (value: string): string => value.replace(/(?:\\r\\n|\\n)$/, '')\n\nconst inputError = (message: string, code: string): CliError => new CliError(message, { code, exitCode: ExitCode.InputError })\n"],"names":["source","readStdinText","CliError","ExitCode"],"mappings":";;;;AAkDO,MAAM,eAAe,CAAsB,MAAY,MAAc,WAA6C;AAAA,EACxH,MAAM;AAAA,EACN;AAAA,EACA;AAAA,EACA;AACD;AAEO,MAAM,mBAAmB,CAAsB,MAAY,MAAc,cAAoD;AAAA,EACnI,MAAM;AAAA,EACN;AAAA,EACA;AAAA,EACA;AACD;AAEO,MAAM,aAAa,CAAsB,MAAY,UAA0C;AAAA,EACrG,MAAM;AAAA,EACN;AAAA,EACA;AACD;AAGO,MAAM,6BAA6B,OACzC,SACA,SACA,eAAwC,CAAA,MACA;AACxC,QAAM,SAAS,aAAa,SAAS,QAAQ,OAAO,IAAI;AACxD,SAAO,MAAM,sBAAsB,QAAQ,SAAS,YAAY;AACjE;AAGO,MAAM,6BAA6B,OACzC,SACA,SACA,eAAwC,CAAA,MACY;AACpD,QAAM,SAAS,aAAa,SAAS,QAAQ,OAAO,KAAK;AACzD,SAAO,WAAW,SAAY,SAAY,MAAM,sBAAsB,QAAQ,SAAS,YAAY;AACpG;AAYA,SAAS,aACR,SACA,OACA,UACsC;AACtC,MAAI,QAAQ,SAAS,GAAG;AACvB,UAAM,WAAW,oCAAoC,KAAK,KAAK,QAAQ,IAAI,CAAAA,YAAUA,QAAO,IAAI,EAAE,KAAK,IAAI,CAAC,KAAK,wBAAwB;AAAA,EAC1I;AACA,QAAM,SAAS,QAAQ,CAAC;AACxB,MAAI,WAAW,UAAa,UAAU;AACrC,UAAM,WAAW,8BAA8B,KAAK,KAAK,sBAAsB;AAAA,EAChF;AACA,SAAO;AACR;AAEA,MAAM,wBAAwB,OAC7B,QACA,SACA,iBACwC;AACxC,QAAM,QAAQ,MAAM,WAAW,QAAQ,YAAY;AACnD,QAAM,aAAa,QAAQ,uBAAuB,eAAe,4BAA4B,KAAK,IAAI;AACtG,MAAI,eAAe,MAAM,QAAQ,eAAe,MAAM;AACrD,UAAM,WAAW,GAAG,OAAO,IAAI,mCAAmC,QAAQ,KAAK,KAAK,mBAAmB;AAAA,EACxG;AACA,SAAO,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,WAAA;AACvD;AAEA,MAAM,aAAa,OAA4B,QAAiC,iBAA2D;AAC1I,UAAQ,OAAO,MAAA;AAAA,IACd,KAAK;AACJ,aAAO,OAAO;AAAA,IACf,KAAK,eAAe;AACnB,YAAM,SAAS,aAAa,mBAAmB,iBAAiB,OAAO,QAAQ;AAC/E,UAAI,UAAU,QAAW;AACxB,cAAM,WAAW,wBAAwB,OAAO,QAAQ,gBAAgB,OAAO,IAAI,gBAAgB,mBAAmB;AAAA,MACvH;AACA,aAAO;AAAA,IACR;AAAA,IACA,KAAK;AACJ,aAAO,OAAO,aAAa,aAAaC,qBAAA;AAAA,EAAe;AAE1D;AAEA,MAAM,kBAAkB,CAAC,SAAqC,QAAQ,IAAI,IAAI;AAE9E,MAAM,8BAA8B,CAAC,UAA0B,MAAM,QAAQ,gBAAgB,EAAE;AAE/F,MAAM,aAAa,CAAC,SAAiB,SAA2B,IAAIC,UAAAA,SAAS,SAAS,EAAE,MAAM,UAAUC,UAAAA,SAAS,WAAA,CAAY;;;;;;"}

package/dist/development/src/lib/tenant/input/value.js

@@ -0,0 +1,71 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+import { readStdinText } from "../stdin.js";
+const literalInput = (name, flag, value) => ({
+  kind: "literal",
+  name,
+  flag,
+  value
+});
+const environmentInput = (name, flag, variable) => ({
+  kind: "environment",
+  name,
+  flag,
+  variable
+});
+const stdinInput = (name, flag) => ({
+  kind: "stdin",
+  name,
+  flag
+});
+const resolveRequiredTenantInput = async (sources, options, dependencies = {}) => {
+  const source = selectSource(sources, options.label, true);
+  return await resolveSelectedSource(source, options, dependencies);
+};
+const resolveOptionalTenantInput = async (sources, options, dependencies = {}) => {
+  const source = selectSource(sources, options.label, false);
+  return source === void 0 ? void 0 : await resolveSelectedSource(source, options, dependencies);
+};
+function selectSource(sources, label, required) {
+  if (sources.length > 1) {
+    throw inputError(`Select only one input source for ${label}: ${sources.map((source2) => source2.flag).join(", ")}.`, "AMBIGUOUS_INPUT_SOURCE");
+  }
+  const source = sources[0];
+  if (source === void 0 && required) {
+    throw inputError(`Select an input source for ${label}.`, "MISSING_INPUT_SOURCE");
+  }
+  return source;
+}
+const resolveSelectedSource = async (source, options, dependencies) => {
+  const value = await readSource(source, dependencies);
+  const normalized = options.trailingLineEnding === "remove-one" ? removeOneTrailingLineEnding(value) : value;
+  if (normalized === "" && options.allowEmpty !== true) {
+    throw inputError(`${source.flag} resolved to an empty value for ${options.label}.`, "EMPTY_INPUT_VALUE");
+  }
+  return { name: source.name, kind: source.kind, value: normalized };
+};
+const readSource = async (source, dependencies) => {
+  switch (source.kind) {
+    case "literal":
+      return source.value;
+    case "environment": {
+      const value = (dependencies.readEnvironment ?? readEnvironment)(source.variable);
+      if (value === void 0) {
+        throw inputError(`Environment variable ${source.variable} selected by ${source.flag} is not set.`, "INPUT_ENV_NOT_SET");
+      }
+      return value;
+    }
+    case "stdin":
+      return await (dependencies.readStdin ?? readStdinText)();
+  }
+};
+const readEnvironment = (name) => process.env[name];
+const removeOneTrailingLineEnding = (value) => value.replace(/(?:\r\n|\n)$/, "");
+const inputError = (message, code) => new CliError(message, { code, exitCode: ExitCode.InputError });
+export {
+  environmentInput,
+  literalInput,
+  resolveOptionalTenantInput,
+  resolveRequiredTenantInput,
+  stdinInput
+};
+//# sourceMappingURL=value.js.map

package/dist/development/src/lib/tenant/input/value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"value.js","sources":["../../../../../../../packages/cli/src/lib/tenant/input/value.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport { readStdinText, type StdinReader } from '../stdin.js'\n\ninterface InputSourceBase<Name extends string> {\n\t/** Identifies the semantic value, for example `password` or `password-hash`. */\n\treadonly name: Name\n\t/** Identifies the selected option without including its submitted value. */\n\treadonly flag: string\n}\n\nexport interface LiteralInputSource<Name extends string = string> extends InputSourceBase<Name> {\n\treadonly kind: 'literal'\n\treadonly value: string\n}\n\nexport interface EnvironmentInputSource<Name extends string = string> extends InputSourceBase<Name> {\n\treadonly kind: 'environment'\n\treadonly variable: string\n}\n\nexport interface StdinInputSource<Name extends string = string> extends InputSourceBase<Name> {\n\treadonly kind: 'stdin'\n}\n\n/** One explicitly selected input source. Unselected options must not be included. */\nexport type TenantInputSource<Name extends string = string> =\n\t| LiteralInputSource<Name>\n\t| EnvironmentInputSource<Name>\n\t| StdinInputSource<Name>\n\nexport type TrailingLineEnding = 'preserve' | 'remove-one'\n\nexport interface TenantInputOptions {\n\t/** A non-sensitive description used in errors, for example `project secret`. */\n\treadonly label: string\n\treadonly allowEmpty?: boolean\n\treadonly trailingLineEnding?: TrailingLineEnding\n}\n\nexport interface TenantInputDependencies {\n\treadonly readStdin?: StdinReader\n\treadonly readEnvironment?: (name: string) => string | undefined\n}\n\nexport interface ResolvedTenantInput<Name extends string = string> {\n\treadonly name: Name\n\treadonly kind: TenantInputSource<Name>['kind']\n\treadonly value: string\n}\n\nexport const literalInput = <Name extends string>(name: Name, flag: string, value: string): LiteralInputSource<Name> => ({\n\tkind: 'literal',\n\tname,\n\tflag,\n\tvalue,\n})\n\nexport const environmentInput = <Name extends string>(name: Name, flag: string, variable: string): EnvironmentInputSource<Name> => ({\n\tkind: 'environment',\n\tname,\n\tflag,\n\tvariable,\n})\n\nexport const stdinInput = <Name extends string>(name: Name, flag: string): StdinInputSource<Name> => ({\n\tkind: 'stdin',\n\tname,\n\tflag,\n})\n\n/** Resolves exactly one explicitly selected source. */\nexport const resolveRequiredTenantInput = async <Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\toptions: TenantInputOptions,\n\tdependencies: TenantInputDependencies = {},\n): Promise<ResolvedTenantInput<Name>> => {\n\tconst source = selectSource(sources, options.label, true)\n\treturn await resolveSelectedSource(source, options, dependencies)\n}\n\n/** Resolves at most one explicitly selected source without reading stdin when none was selected. */\nexport const resolveOptionalTenantInput = async <Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\toptions: TenantInputOptions,\n\tdependencies: TenantInputDependencies = {},\n): Promise<ResolvedTenantInput<Name> | undefined> => {\n\tconst source = selectSource(sources, options.label, false)\n\treturn source === undefined ? undefined : await resolveSelectedSource(source, options, dependencies)\n}\n\nfunction selectSource<Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\tlabel: string,\n\trequired: true,\n): TenantInputSource<Name>\nfunction selectSource<Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\tlabel: string,\n\trequired: false,\n): TenantInputSource<Name> | undefined\nfunction selectSource<Name extends string>(\n\tsources: readonly TenantInputSource<Name>[],\n\tlabel: string,\n\trequired: boolean,\n): TenantInputSource<Name> | undefined {\n\tif (sources.length > 1) {\n\t\tthrow inputError(`Select only one input source for ${label}: ${sources.map(source => source.flag).join(', ')}.`, 'AMBIGUOUS_INPUT_SOURCE')\n\t}\n\tconst source = sources[0]\n\tif (source === undefined && required) {\n\t\tthrow inputError(`Select an input source for ${label}.`, 'MISSING_INPUT_SOURCE')\n\t}\n\treturn source\n}\n\nconst resolveSelectedSource = async <Name extends string>(\n\tsource: TenantInputSource<Name>,\n\toptions: TenantInputOptions,\n\tdependencies: TenantInputDependencies,\n): Promise<ResolvedTenantInput<Name>> => {\n\tconst value = await readSource(source, dependencies)\n\tconst normalized = options.trailingLineEnding === 'remove-one' ? removeOneTrailingLineEnding(value) : value\n\tif (normalized === '' && options.allowEmpty !== true) {\n\t\tthrow inputError(`${source.flag} resolved to an empty value for ${options.label}.`, 'EMPTY_INPUT_VALUE')\n\t}\n\treturn { name: source.name, kind: source.kind, value: normalized }\n}\n\nconst readSource = async <Name extends string>(source: TenantInputSource<Name>, dependencies: TenantInputDependencies): Promise<string> => {\n\tswitch (source.kind) {\n\t\tcase 'literal':\n\t\t\treturn source.value\n\t\tcase 'environment': {\n\t\t\tconst value = (dependencies.readEnvironment ?? readEnvironment)(source.variable)\n\t\t\tif (value === undefined) {\n\t\t\t\tthrow inputError(`Environment variable ${source.variable} selected by ${source.flag} is not set.`, 'INPUT_ENV_NOT_SET')\n\t\t\t}\n\t\t\treturn value\n\t\t}\n\t\tcase 'stdin':\n\t\t\treturn await (dependencies.readStdin ?? readStdinText)()\n\t}\n}\n\nconst readEnvironment = (name: string): string | undefined => process.env[name]\n\nconst removeOneTrailingLineEnding = (value: string): string => value.replace(/(?:\\r\\n|\\n)$/, '')\n\nconst inputError = (message: string, code: string): CliError => new CliError(message, { code, exitCode: ExitCode.InputError })\n"],"names":["source"],"mappings":";;AAkDO,MAAM,eAAe,CAAsB,MAAY,MAAc,WAA6C;AAAA,EACxH,MAAM;AAAA,EACN;AAAA,EACA;AAAA,EACA;AACD;AAEO,MAAM,mBAAmB,CAAsB,MAAY,MAAc,cAAoD;AAAA,EACnI,MAAM;AAAA,EACN;AAAA,EACA;AAAA,EACA;AACD;AAEO,MAAM,aAAa,CAAsB,MAAY,UAA0C;AAAA,EACrG,MAAM;AAAA,EACN;AAAA,EACA;AACD;AAGO,MAAM,6BAA6B,OACzC,SACA,SACA,eAAwC,CAAA,MACA;AACxC,QAAM,SAAS,aAAa,SAAS,QAAQ,OAAO,IAAI;AACxD,SAAO,MAAM,sBAAsB,QAAQ,SAAS,YAAY;AACjE;AAGO,MAAM,6BAA6B,OACzC,SACA,SACA,eAAwC,CAAA,MACY;AACpD,QAAM,SAAS,aAAa,SAAS,QAAQ,OAAO,KAAK;AACzD,SAAO,WAAW,SAAY,SAAY,MAAM,sBAAsB,QAAQ,SAAS,YAAY;AACpG;AAYA,SAAS,aACR,SACA,OACA,UACsC;AACtC,MAAI,QAAQ,SAAS,GAAG;AACvB,UAAM,WAAW,oCAAoC,KAAK,KAAK,QAAQ,IAAI,CAAAA,YAAUA,QAAO,IAAI,EAAE,KAAK,IAAI,CAAC,KAAK,wBAAwB;AAAA,EAC1I;AACA,QAAM,SAAS,QAAQ,CAAC;AACxB,MAAI,WAAW,UAAa,UAAU;AACrC,UAAM,WAAW,8BAA8B,KAAK,KAAK,sBAAsB;AAAA,EAChF;AACA,SAAO;AACR;AAEA,MAAM,wBAAwB,OAC7B,QACA,SACA,iBACwC;AACxC,QAAM,QAAQ,MAAM,WAAW,QAAQ,YAAY;AACnD,QAAM,aAAa,QAAQ,uBAAuB,eAAe,4BAA4B,KAAK,IAAI;AACtG,MAAI,eAAe,MAAM,QAAQ,eAAe,MAAM;AACrD,UAAM,WAAW,GAAG,OAAO,IAAI,mCAAmC,QAAQ,KAAK,KAAK,mBAAmB;AAAA,EACxG;AACA,SAAO,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,MAAM,OAAO,WAAA;AACvD;AAEA,MAAM,aAAa,OAA4B,QAAiC,iBAA2D;AAC1I,UAAQ,OAAO,MAAA;AAAA,IACd,KAAK;AACJ,aAAO,OAAO;AAAA,IACf,KAAK,eAAe;AACnB,YAAM,SAAS,aAAa,mBAAmB,iBAAiB,OAAO,QAAQ;AAC/E,UAAI,UAAU,QAAW;AACxB,cAAM,WAAW,wBAAwB,OAAO,QAAQ,gBAAgB,OAAO,IAAI,gBAAgB,mBAAmB;AAAA,MACvH;AACA,aAAO;AAAA,IACR;AAAA,IACA,KAAK;AACJ,aAAO,OAAO,aAAa,aAAa,eAAA;AAAA,EAAe;AAE1D;AAEA,MAAM,kBAAkB,CAAC,SAAqC,QAAQ,IAAI,IAAI;AAE9E,MAAM,8BAA8B,CAAC,UAA0B,MAAM,QAAQ,gBAAgB,EAAE;AAE/F,MAAM,aAAa,CAAC,SAAiB,SAA2B,IAAI,SAAS,SAAS,EAAE,MAAM,UAAU,SAAS,WAAA,CAAY;"}

package/dist/development/src/lib/tenant/stdin.cjs

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const readStdinText = async () => {
+  const stream = process.stdin;
+  const decoder = new TextDecoder();
+  let text = "";
+  for await (const chunk of stream) {
+    text += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+  }
+  return text + decoder.decode();
+};
+exports.readStdinText = readStdinText;
+//# sourceMappingURL=stdin.cjs.map

package/dist/development/src/lib/tenant/stdin.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdin.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/stdin.ts"],"sourcesContent":["/** Reads the whole stdin. Injected into the commands so a test never has to touch the real stream. */\nexport type StdinReader = () => Promise<string>\n\n/**\n * Reads stdin to the end, verbatim. Only ever reached behind an explicit `--*-stdin` flag, so a normal\n * run never blocks on it — a command that reads stdin \"just in case\" hangs every non-TTY caller.\n */\nexport const readStdinText: StdinReader = async () => {\n\tconst stream: AsyncIterable<string | Uint8Array> = process.stdin\n\tconst decoder = new TextDecoder()\n\tlet text = ''\n\tfor await (const chunk of stream) {\n\t\ttext += typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true })\n\t}\n\treturn text + decoder.decode()\n}\n"],"names":[],"mappings":";;AAOO,MAAM,gBAA6B,YAAY;AACrD,QAAM,SAA6C,QAAQ;AAC3D,QAAM,UAAU,IAAI,YAAA;AACpB,MAAI,OAAO;AACX,mBAAiB,SAAS,QAAQ;AACjC,YAAQ,OAAO,UAAU,WAAW,QAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,MAAM;AAAA,EACnF;AACA,SAAO,OAAO,QAAQ,OAAA;AACvB;;"}

package/dist/development/src/lib/tenant/stdin.js

@@ -0,0 +1,13 @@
+const readStdinText = async () => {
+  const stream = process.stdin;
+  const decoder = new TextDecoder();
+  let text = "";
+  for await (const chunk of stream) {
+    text += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+  }
+  return text + decoder.decode();
+};
+export {
+  readStdinText
+};
+//# sourceMappingURL=stdin.js.map

package/dist/development/src/lib/tenant/stdin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdin.js","sources":["../../../../../../packages/cli/src/lib/tenant/stdin.ts"],"sourcesContent":["/** Reads the whole stdin. Injected into the commands so a test never has to touch the real stream. */\nexport type StdinReader = () => Promise<string>\n\n/**\n * Reads stdin to the end, verbatim. Only ever reached behind an explicit `--*-stdin` flag, so a normal\n * run never blocks on it — a command that reads stdin \"just in case\" hangs every non-TTY caller.\n */\nexport const readStdinText: StdinReader = async () => {\n\tconst stream: AsyncIterable<string | Uint8Array> = process.stdin\n\tconst decoder = new TextDecoder()\n\tlet text = ''\n\tfor await (const chunk of stream) {\n\t\ttext += typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true })\n\t}\n\treturn text + decoder.decode()\n}\n"],"names":[],"mappings":"AAOO,MAAM,gBAA6B,YAAY;AACrD,QAAM,SAA6C,QAAQ;AAC3D,QAAM,UAAU,IAAI,YAAA;AACpB,MAAI,OAAO;AACX,mBAAiB,SAAS,QAAQ;AACjC,YAAQ,OAAO,UAAU,WAAW,QAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,MAAM;AAAA,EACnF;AACA,SAAO,OAAO,QAAQ,OAAA;AACvB;"}

package/dist/development/src/lib/tenant/tenantConfig.cjs

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const defineTenantConfig = (config) => config;
+exports.defineTenantConfig = defineTenantConfig;
+//# sourceMappingURL=tenantConfig.cjs.map

package/dist/development/src/lib/tenant/tenantConfig.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantConfig.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/tenantConfig.ts"],"sourcesContent":["import type {\n\tAuthPolicyInput,\n\tConfigCaptchaInput,\n\tConfigInput,\n\tConfigLoginInput,\n\tConfigPasswordInput,\n\tConfigPasswordlessInput,\n\tConfigRateLimitsInput,\n\tConfigRateLimitWindowInput,\n\tIDPOptions,\n\tMailTemplate,\n\tMailType,\n} from '@contember/graphql-client-tenant'\n\n// These aliases keep tenant config authoring aligned with the GraphQL schema.\n// The generator preserves nullable input fields, including explicit `null`.\nexport type { AuthPolicyScope, CaptchaProvider, ConfigPolicy, MailType } from '@contember/graphql-client-tenant'\n\n/**\n * ISO 8601 duration string, e.g. `\"P1D\"` (1 day) or `\"PT5M\"` (5 minutes).\n */\nexport type Interval = string\n\nexport type TenantPasswordConfig = ConfigPasswordInput\n\nexport type TenantLoginConfig = ConfigLoginInput\n\nexport type TenantPasswordlessConfig = ConfigPasswordlessInput\n\n/**\n * `provider: null` disables captcha verification.\n * `secret` is write-only: `null`/omitted leaves the stored value unchanged, `''` clears it.\n */\nexport type TenantCaptchaConfig = ConfigCaptchaInput\n\nexport type TenantRateLimitWindow = ConfigRateLimitWindowInput\n\nexport type TenantRateLimitsConfig = ConfigRateLimitsInput\n\n/** Maps to the tenant `configure(config: ConfigInput!)` mutation. */\nexport type TenantGlobalConfig = ConfigInput\n\nexport type TenantIdpOptions = IDPOptions\n\n/**\n * A single identity provider. The record key is used as the provider slug.\n * `type` is the handler key registered on the server (built-in: `oidc`,\n * `facebook`, `apple`).\n *\n * This is a CLI-specific composite — the `addIDP`/`updateIDP` mutations take\n * `type`/`configuration`/`options` as separate arguments, not a single input.\n */\nexport interface TenantIdpConfig {\n\ttype: string\n\tconfiguration: Record<string, unknown>\n\toptions?: TenantIdpOptions\n\t/** When `true`, the provider is disabled (kept, but not usable for sign-in). */\n\tdisabled?: boolean\n}\n\n/** Maps to the `addMailTemplate(template: MailTemplate!)` mutation. */\nexport type TenantMailTemplate = MailTemplate\n\n/**\n * A per-role MFA / session policy. `project` is a project slug, required for\n * `scope: 'project'` and rejected for `scope: 'global'` (validated server-side).\n *\n * Unlike identity providers there is no server-side slug, so entries are matched\n * against existing rows by `scope` + `project` + the `roles` **set** (order does\n * not matter). Editing `roles` therefore reads as a different policy: a new row\n * is created and the old one is left in place — see `TenantConfigApplier`.\n */\nexport type TenantAuthPolicy = AuthPolicyInput\n\nexport interface TenantCustomRoleRoleConstraint {\n\t/** Exhaustive: every role observed at the constrained position must appear here. Not a filter, and there is no `denied` counterpart. */\n\treadonly allowed: readonly string[]\n}\n\nexport interface TenantCustomRoleTarget {\n\treadonly globalRoles: TenantCustomRoleRoleConstraint\n\treadonly projectMemberships: 'none' | 'any'\n}\n\nexport interface TenantCustomRoleRoleInputConfig {\n\treadonly roles: TenantCustomRoleRoleConstraint\n}\n\nexport interface TenantCustomRoleTargetConfig {\n\treadonly target: TenantCustomRoleTarget\n}\n\nexport interface TenantCustomRoleMutationConfig extends TenantCustomRoleRoleInputConfig, TenantCustomRoleTargetConfig {\n\treadonly allowSelf: boolean\n}\n\nexport interface TenantCustomRoleGlobalApiKeyConfig extends TenantCustomRoleRoleInputConfig {\n\t/** Custom roles may not create keys trusted to forward client info. */\n\treadonly allowTrustForwardedClientInfo: false\n}\n\nexport interface TenantCustomRoleChangeProfileConfig extends TenantCustomRoleTargetConfig {\n\treadonly fields: {\n\t\treadonly allowed: readonly ('name' | 'email')[]\n\t}\n}\n\nexport interface TenantCustomRoleCreateSessionTokenConfig extends TenantCustomRoleTargetConfig {\n\treadonly session: {\n\t\treadonly maxExpirationMinutes: number\n\t\treadonly allowTrustForwardedClientInfo: boolean\n\t}\n}\n\nexport interface TenantCustomRoleMailTemplateConfig {\n\treadonly global: boolean\n\treadonly projects: readonly string[]\n\treadonly types: readonly MailType[]\n}\n\nexport type TenantCustomRoleConfigFreePermission =\n\t| 'system:configure'\n\t| 'system:viewConfig'\n\t| 'system:viewAuthLog'\n\t| 'person:view'\n\t| 'person:list'\n\t| 'entrypoint:deployEntrypoint'\n\t| 'apiKey:list'\n\t| 'idp:disable'\n\t| 'idp:enable'\n\t| 'idp:list'\n\t| 'customRole:view'\n\t| 'identity:viewPermissions'\n\nexport type TenantCustomRoleTargetPermission =\n\t| 'person:disable'\n\t| 'person:forceSignOut'\n\t| 'person:resetMfa'\n\t| 'person:viewSessions'\n\t| 'person:viewIdp'\n\t| 'person:changePassword'\n\nexport type TenantCustomRoleMutationPermission =\n\t| 'identity:addGlobalRoles'\n\t| 'identity:removeGlobalRoles'\n\nexport type TenantCustomRoleMailTemplatePermission =\n\t| 'mailTemplate:add'\n\t| 'mailTemplate:remove'\n\t| 'mailTemplate:list'\n\n/**\n * A custom-role grant discriminated by `permission`. Configured permissions\n * require their exact action-specific config; config-free permissions reject it.\n */\nexport type TenantCustomRoleGrant =\n\t| {\n\t\treadonly permission: TenantCustomRoleConfigFreePermission\n\t\treadonly config?: never\n\t}\n\t| {\n\t\treadonly permission: 'person:signUp'\n\t\treadonly config: TenantCustomRoleRoleInputConfig\n\t}\n\t| {\n\t\treadonly permission: TenantCustomRoleTargetPermission\n\t\treadonly config: TenantCustomRoleTargetConfig\n\t}\n\t| {\n\t\treadonly permission: 'person:changeProfile'\n\t\treadonly config: TenantCustomRoleChangeProfileConfig\n\t}\n\t| {\n\t\treadonly permission: 'person:createSessionToken'\n\t\treadonly config: TenantCustomRoleCreateSessionTokenConfig\n\t}\n\t| {\n\t\treadonly permission: TenantCustomRoleMutationPermission\n\t\treadonly config: TenantCustomRoleMutationConfig\n\t}\n\t| {\n\t\treadonly permission: 'apiKey:createGlobal'\n\t\treadonly config: TenantCustomRoleGlobalApiKeyConfig\n\t}\n\t| {\n\t\treadonly permission: TenantCustomRoleMailTemplatePermission\n\t\treadonly config: TenantCustomRoleMailTemplateConfig\n\t}\n\nexport interface TenantCustomRoleConfig {\n\treadonly description?: string | null\n\treadonly grants: readonly TenantCustomRoleGrant[]\n}\n\n/**\n * Declarative tenant configuration. Applied idempotently by\n * `contember tenant:apply`.\n */\nexport interface TenantConfig {\n\tconfig?: TenantGlobalConfig\n\t/** Identity providers keyed by slug. */\n\tidentityProviders?: Record<string, TenantIdpConfig>\n\tmailTemplates?: TenantMailTemplate[]\n\tauthPolicies?: TenantAuthPolicy[]\n\t/** Custom roles keyed by slug. Missing roles are created; existing roles are replaced. */\n\tcustomRoles?: Record<string, TenantCustomRoleConfig>\n}\n\n/**\n * Type-safe helper for authoring a `tenant.config.ts`. Returns the config\n * unchanged — it exists only to provide editor autocompletion and type\n * checking.\n *\n * ```ts\n * import { defineTenantConfig } from '@contember/cli'\n *\n * export default defineTenantConfig({\n *   config: { password: { minLength: 8 } },\n * })\n * ```\n */\nexport const defineTenantConfig = (config: TenantConfig): TenantConfig => config\n"],"names":[],"mappings":";;AA6NO,MAAM,qBAAqB,CAAC,WAAuC;;"}

package/dist/development/src/lib/tenant/tenantConfig.js

@@ -0,0 +1,5 @@
+const defineTenantConfig = (config) => config;
+export {
+  defineTenantConfig
+};
+//# sourceMappingURL=tenantConfig.js.map

package/dist/development/src/lib/tenant/tenantConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantConfig.js","sources":["../../../../../../packages/cli/src/lib/tenant/tenantConfig.ts"],"sourcesContent":["import type {\n\tAuthPolicyInput,\n\tConfigCaptchaInput,\n\tConfigInput,\n\tConfigLoginInput,\n\tConfigPasswordInput,\n\tConfigPasswordlessInput,\n\tConfigRateLimitsInput,\n\tConfigRateLimitWindowInput,\n\tIDPOptions,\n\tMailTemplate,\n\tMailType,\n} from '@contember/graphql-client-tenant'\n\n// These aliases keep tenant config authoring aligned with the GraphQL schema.\n// The generator preserves nullable input fields, including explicit `null`.\nexport type { AuthPolicyScope, CaptchaProvider, ConfigPolicy, MailType } from '@contember/graphql-client-tenant'\n\n/**\n * ISO 8601 duration string, e.g. `\"P1D\"` (1 day) or `\"PT5M\"` (5 minutes).\n */\nexport type Interval = string\n\nexport type TenantPasswordConfig = ConfigPasswordInput\n\nexport type TenantLoginConfig = ConfigLoginInput\n\nexport type TenantPasswordlessConfig = ConfigPasswordlessInput\n\n/**\n * `provider: null` disables captcha verification.\n * `secret` is write-only: `null`/omitted leaves the stored value unchanged, `''` clears it.\n */\nexport type TenantCaptchaConfig = ConfigCaptchaInput\n\nexport type TenantRateLimitWindow = ConfigRateLimitWindowInput\n\nexport type TenantRateLimitsConfig = ConfigRateLimitsInput\n\n/** Maps to the tenant `configure(config: ConfigInput!)` mutation. */\nexport type TenantGlobalConfig = ConfigInput\n\nexport type TenantIdpOptions = IDPOptions\n\n/**\n * A single identity provider. The record key is used as the provider slug.\n * `type` is the handler key registered on the server (built-in: `oidc`,\n * `facebook`, `apple`).\n *\n * This is a CLI-specific composite — the `addIDP`/`updateIDP` mutations take\n * `type`/`configuration`/`options` as separate arguments, not a single input.\n */\nexport interface TenantIdpConfig {\n\ttype: string\n\tconfiguration: Record<string, unknown>\n\toptions?: TenantIdpOptions\n\t/** When `true`, the provider is disabled (kept, but not usable for sign-in). */\n\tdisabled?: boolean\n}\n\n/** Maps to the `addMailTemplate(template: MailTemplate!)` mutation. */\nexport type TenantMailTemplate = MailTemplate\n\n/**\n * A per-role MFA / session policy. `project` is a project slug, required for\n * `scope: 'project'` and rejected for `scope: 'global'` (validated server-side).\n *\n * Unlike identity providers there is no server-side slug, so entries are matched\n * against existing rows by `scope` + `project` + the `roles` **set** (order does\n * not matter). Editing `roles` therefore reads as a different policy: a new row\n * is created and the old one is left in place — see `TenantConfigApplier`.\n */\nexport type TenantAuthPolicy = AuthPolicyInput\n\nexport interface TenantCustomRoleRoleConstraint {\n\t/** Exhaustive: every role observed at the constrained position must appear here. Not a filter, and there is no `denied` counterpart. */\n\treadonly allowed: readonly string[]\n}\n\nexport interface TenantCustomRoleTarget {\n\treadonly globalRoles: TenantCustomRoleRoleConstraint\n\treadonly projectMemberships: 'none' | 'any'\n}\n\nexport interface TenantCustomRoleRoleInputConfig {\n\treadonly roles: TenantCustomRoleRoleConstraint\n}\n\nexport interface TenantCustomRoleTargetConfig {\n\treadonly target: TenantCustomRoleTarget\n}\n\nexport interface TenantCustomRoleMutationConfig extends TenantCustomRoleRoleInputConfig, TenantCustomRoleTargetConfig {\n\treadonly allowSelf: boolean\n}\n\nexport interface TenantCustomRoleGlobalApiKeyConfig extends TenantCustomRoleRoleInputConfig {\n\t/** Custom roles may not create keys trusted to forward client info. */\n\treadonly allowTrustForwardedClientInfo: false\n}\n\nexport interface TenantCustomRoleChangeProfileConfig extends TenantCustomRoleTargetConfig {\n\treadonly fields: {\n\t\treadonly allowed: readonly ('name' | 'email')[]\n\t}\n}\n\nexport interface TenantCustomRoleCreateSessionTokenConfig extends TenantCustomRoleTargetConfig {\n\treadonly session: {\n\t\treadonly maxExpirationMinutes: number\n\t\treadonly allowTrustForwardedClientInfo: boolean\n\t}\n}\n\nexport interface TenantCustomRoleMailTemplateConfig {\n\treadonly global: boolean\n\treadonly projects: readonly string[]\n\treadonly types: readonly MailType[]\n}\n\nexport type TenantCustomRoleConfigFreePermission =\n\t| 'system:configure'\n\t| 'system:viewConfig'\n\t| 'system:viewAuthLog'\n\t| 'person:view'\n\t| 'person:list'\n\t| 'entrypoint:deployEntrypoint'\n\t| 'apiKey:list'\n\t| 'idp:disable'\n\t| 'idp:enable'\n\t| 'idp:list'\n\t| 'customRole:view'\n\t| 'identity:viewPermissions'\n\nexport type TenantCustomRoleTargetPermission =\n\t| 'person:disable'\n\t| 'person:forceSignOut'\n\t| 'person:resetMfa'\n\t| 'person:viewSessions'\n\t| 'person:viewIdp'\n\t| 'person:changePassword'\n\nexport type TenantCustomRoleMutationPermission =\n\t| 'identity:addGlobalRoles'\n\t| 'identity:removeGlobalRoles'\n\nexport type TenantCustomRoleMailTemplatePermission =\n\t| 'mailTemplate:add'\n\t| 'mailTemplate:remove'\n\t| 'mailTemplate:list'\n\n/**\n * A custom-role grant discriminated by `permission`. Configured permissions\n * require their exact action-specific config; config-free permissions reject it.\n */\nexport type TenantCustomRoleGrant =\n\t| {\n\t\treadonly permission: TenantCustomRoleConfigFreePermission\n\t\treadonly config?: never\n\t}\n\t| {\n\t\treadonly permission: 'person:signUp'\n\t\treadonly config: TenantCustomRoleRoleInputConfig\n\t}\n\t| {\n\t\treadonly permission: TenantCustomRoleTargetPermission\n\t\treadonly config: TenantCustomRoleTargetConfig\n\t}\n\t| {\n\t\treadonly permission: 'person:changeProfile'\n\t\treadonly config: TenantCustomRoleChangeProfileConfig\n\t}\n\t| {\n\t\treadonly permission: 'person:createSessionToken'\n\t\treadonly config: TenantCustomRoleCreateSessionTokenConfig\n\t}\n\t| {\n\t\treadonly permission: TenantCustomRoleMutationPermission\n\t\treadonly config: TenantCustomRoleMutationConfig\n\t}\n\t| {\n\t\treadonly permission: 'apiKey:createGlobal'\n\t\treadonly config: TenantCustomRoleGlobalApiKeyConfig\n\t}\n\t| {\n\t\treadonly permission: TenantCustomRoleMailTemplatePermission\n\t\treadonly config: TenantCustomRoleMailTemplateConfig\n\t}\n\nexport interface TenantCustomRoleConfig {\n\treadonly description?: string | null\n\treadonly grants: readonly TenantCustomRoleGrant[]\n}\n\n/**\n * Declarative tenant configuration. Applied idempotently by\n * `contember tenant:apply`.\n */\nexport interface TenantConfig {\n\tconfig?: TenantGlobalConfig\n\t/** Identity providers keyed by slug. */\n\tidentityProviders?: Record<string, TenantIdpConfig>\n\tmailTemplates?: TenantMailTemplate[]\n\tauthPolicies?: TenantAuthPolicy[]\n\t/** Custom roles keyed by slug. Missing roles are created; existing roles are replaced. */\n\tcustomRoles?: Record<string, TenantCustomRoleConfig>\n}\n\n/**\n * Type-safe helper for authoring a `tenant.config.ts`. Returns the config\n * unchanged — it exists only to provide editor autocompletion and type\n * checking.\n *\n * ```ts\n * import { defineTenantConfig } from '@contember/cli'\n *\n * export default defineTenantConfig({\n *   config: { password: { minLength: 8 } },\n * })\n * ```\n */\nexport const defineTenantConfig = (config: TenantConfig): TenantConfig => config\n"],"names":[],"mappings":"AA6NO,MAAM,qBAAqB,CAAC,WAAuC;"}