@contember/cli 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/lib/schema/SchemaValidationPrinter.cjs

@@ -1,14 +1,14 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const printValidationErrors = (errors, message) => {
+const cliCommon = require("@contember/cli-common");
+const printValidationErrors = (errors, message, output = new cliCommon.Output()) => {
   if (errors.length === 0) {
     return;
   }
-  console.group(message || "Schema is invalid:");
+  output.error(message || "Schema is invalid:");
   for (const err of errors) {
-    console.log(`${err.path.join(".")}: [${err.code}] ${err.message}`);
+    output.error(`  ${err.path.join(".")}: [${err.code}] ${err.message}`);
   }
-  console.groupEnd();
 };
 exports.printValidationErrors = printValidationErrors;
 //# sourceMappingURL=SchemaValidationPrinter.cjs.map

package/dist/production/src/lib/schema/SchemaValidationPrinter.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SchemaValidationPrinter.cjs","sources":["../../../../../../packages/cli/src/lib/schema/SchemaValidationPrinter.ts"],"sourcesContent":["import { ValidationError } from '@contember/schema-utils'\n\nexport const printValidationErrors = (errors: ValidationError[], message?: string) => {\n\tif (errors.length === 0) {\n\t\treturn\n\t}\n\tconsole.group(message || 'Schema is invalid:')\n\tfor (const err of errors) {\n\t\tconsole.log(`${err.path.join('.')}: [${err.code}] ${err.message}`)\n\t}\n\tconsole.groupEnd()\n}\n"],"names":[],"mappings":";;AAEO,MAAM,wBAAwB,CAAC,QAA2B,YAAqB;AACrF,MAAI,OAAO,WAAW,GAAG;AACxB;AAAA,EACD;AACA,UAAQ,MAAM,WAAW,oBAAoB;AAC7C,aAAW,OAAO,QAAQ;AACzB,YAAQ,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,IAAI,OAAO,EAAE;AAAA,EAClE;AACA,UAAQ,SAAA;AACT;;"}
+{"version":3,"file":"SchemaValidationPrinter.cjs","sources":["../../../../../../packages/cli/src/lib/schema/SchemaValidationPrinter.ts"],"sourcesContent":["import { Output } from '@contember/cli-common'\nimport { ValidationError } from '@contember/schema-utils'\n\n// diagnostic only — never the command's own data output; callers that don't yet pass `output` fall back to a fresh one\nexport const printValidationErrors = (errors: ValidationError[], message?: string, output: Output = new Output()) => {\n\tif (errors.length === 0) {\n\t\treturn\n\t}\n\toutput.error(message || 'Schema is invalid:')\n\tfor (const err of errors) {\n\t\toutput.error(`  ${err.path.join('.')}: [${err.code}] ${err.message}`)\n\t}\n}\n"],"names":["Output"],"mappings":";;;AAIO,MAAM,wBAAwB,CAAC,QAA2B,SAAkB,SAAiB,IAAIA,UAAAA,aAAa;AACpH,MAAI,OAAO,WAAW,GAAG;AACxB;AAAA,EACD;AACA,SAAO,MAAM,WAAW,oBAAoB;AAC5C,aAAW,OAAO,QAAQ;AACzB,WAAO,MAAM,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,IAAI,OAAO,EAAE;AAAA,EACrE;AACD;;"}

package/dist/production/src/lib/schema/SchemaValidationPrinter.js

@@ -1,12 +1,12 @@
-const printValidationErrors = (errors, message) => {
+import { Output } from "@contember/cli-common";
+const printValidationErrors = (errors, message, output = new Output()) => {
   if (errors.length === 0) {
     return;
   }
-  console.group(message || "Schema is invalid:");
+  output.error(message || "Schema is invalid:");
   for (const err of errors) {
-    console.log(`${err.path.join(".")}: [${err.code}] ${err.message}`);
+    output.error(`  ${err.path.join(".")}: [${err.code}] ${err.message}`);
   }
-  console.groupEnd();
 };
 export {
   printValidationErrors

package/dist/production/src/lib/schema/SchemaValidationPrinter.js.map

@@ -1 +1 @@
-{"version":3,"file":"SchemaValidationPrinter.js","sources":["../../../../../../packages/cli/src/lib/schema/SchemaValidationPrinter.ts"],"sourcesContent":["import { ValidationError } from '@contember/schema-utils'\n\nexport const printValidationErrors = (errors: ValidationError[], message?: string) => {\n\tif (errors.length === 0) {\n\t\treturn\n\t}\n\tconsole.group(message || 'Schema is invalid:')\n\tfor (const err of errors) {\n\t\tconsole.log(`${err.path.join('.')}: [${err.code}] ${err.message}`)\n\t}\n\tconsole.groupEnd()\n}\n"],"names":[],"mappings":"AAEO,MAAM,wBAAwB,CAAC,QAA2B,YAAqB;AACrF,MAAI,OAAO,WAAW,GAAG;AACxB;AAAA,EACD;AACA,UAAQ,MAAM,WAAW,oBAAoB;AAC7C,aAAW,OAAO,QAAQ;AACzB,YAAQ,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,IAAI,OAAO,EAAE;AAAA,EAClE;AACA,UAAQ,SAAA;AACT;"}
+{"version":3,"file":"SchemaValidationPrinter.js","sources":["../../../../../../packages/cli/src/lib/schema/SchemaValidationPrinter.ts"],"sourcesContent":["import { Output } from '@contember/cli-common'\nimport { ValidationError } from '@contember/schema-utils'\n\n// diagnostic only — never the command's own data output; callers that don't yet pass `output` fall back to a fresh one\nexport const printValidationErrors = (errors: ValidationError[], message?: string, output: Output = new Output()) => {\n\tif (errors.length === 0) {\n\t\treturn\n\t}\n\toutput.error(message || 'Schema is invalid:')\n\tfor (const err of errors) {\n\t\toutput.error(`  ${err.path.join('.')}: [${err.code}] ${err.message}`)\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,wBAAwB,CAAC,QAA2B,SAAkB,SAAiB,IAAI,aAAa;AACpH,MAAI,OAAO,WAAW,GAAG;AACxB;AAAA,EACD;AACA,SAAO,MAAM,WAAW,oBAAoB;AAC5C,aAAW,OAAO,QAAQ;AACzB,WAAO,MAAM,KAAK,IAAI,KAAK,KAAK,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,IAAI,OAAO,EAAE;AAAA,EACrE;AACD;"}

package/dist/production/src/lib/tenant/TenantApiTransport.cjs

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const graphqlClient = require("@contember/graphql-client");
+const graphqlTsClientApi = require("graphql-ts-client-api");
+const TransportError = require("../errors/TransportError.cjs");
+const createTenantApiUrl = (url) => {
+  if (url.endsWith("/")) {
+    url = url.substring(0, url.length - 1);
+  }
+  if (url.endsWith("/tenant")) {
+    return url;
+  }
+  return url + "/tenant";
+};
+class TenantApiTransport {
+  constructor(apiClient) {
+    this.apiClient = apiClient;
+  }
+  static create(url, apiToken) {
+    return new TenantApiTransport(new graphqlClient.GraphQlClient({ url: createTenantApiUrl(url), apiToken }));
+  }
+  get apiUrl() {
+    return this.apiClient.apiUrl;
+  }
+  /** Runs a `graphql-ts-client-api` fetcher as a query or a mutation, depending on the fetcher's root type. */
+  async exec(fetcher, variables) {
+    try {
+      return await this.apiClient.execute(buildRequestDocument(fetcher), { variables });
+    } catch (e) {
+      throw toTenantApiError(e);
+    }
+  }
+  /** Runs a hand-written operation document — only for what a fetcher cannot express, such as an explicit `null` root argument. */
+  async execDocument(document, variables) {
+    try {
+      return await this.apiClient.execute(document, { variables });
+    } catch (e) {
+      throw toTenantApiError(e);
+    }
+  }
+  /** Turns a failed tenant mutation payload into a {@link CliError} carrying the tenant error code. */
+  assertOk(result, operation) {
+    if (result?.ok === true) {
+      return;
+    }
+    throw tenantMutationError(result, operation);
+  }
+}
+const buildRequestDocument = (fetcher) => {
+  const writer = new graphqlTsClientApi.TextWriter();
+  writer.text(fetcher.fetchableType.name.toLowerCase());
+  if (fetcher.variableTypeMap.size !== 0) {
+    writer.scope({ type: "ARGUMENTS", multiLines: fetcher.variableTypeMap.size > 2, suffix: " " }, () => {
+      graphqlTsClientApi.util.iterateMap(fetcher.variableTypeMap, ([name, type]) => {
+        writer.seperator();
+        writer.text(`$${name}: ${type}`);
+      });
+    });
+  }
+  writer.text(fetcher.toString());
+  writer.text(fetcher.toFragmentString());
+  return writer.toString();
+};
+const tenantMutationError = (result, operation) => {
+  const code = result?.error?.code ?? "UNKNOWN";
+  const developerMessage = result?.error?.developerMessage ?? null;
+  const details = { operation, code, developerMessage };
+  const weakPasswordReasons2 = result?.error?.weakPasswordReasons?.filter(isWeakPasswordReason);
+  if (weakPasswordReasons2 !== void 0 && weakPasswordReasons2.length > 0) {
+    details.weakPasswordReasons = weakPasswordReasons2;
+  }
+  const recommendedAction = result?.error?.recommendedAction;
+  if (isSignUpRecommendedAction(recommendedAction)) {
+    details.recommendedAction = recommendedAction;
+  }
+  return new cliCommon.CliError(`${operation} failed: ${code}${developerMessage ? ` — ${developerMessage}` : ""}`, {
+    code,
+    exitCode: tenantErrorCodeToExitCode(code),
+    details
+  });
+};
+const weakPasswordReasons = [
+  "TOO_SHORT",
+  "MISSING_UPPERCASE",
+  "MISSING_LOWERCASE",
+  "MISSING_DIGIT",
+  "MISSING_SPECIAL",
+  "INVALID_PATTERN",
+  "BLACKLISTED",
+  "COMPROMISED"
+];
+const isWeakPasswordReason = (value) => typeof value === "string" && weakPasswordReasons.includes(value);
+const isSignUpRecommendedAction = (value) => value === "SIGN_IN" || value === "RESET_PASSWORD";
+const tenantErrorCodeExitCodes = /* @__PURE__ */ new Map([
+  // conflicts
+  ["ALREADY_EXISTS", cliCommon.ExitCode.Conflict],
+  ["ALREADY_MEMBER", cliCommon.ExitCode.Conflict],
+  ["EMAIL_ALREADY_EXISTS", cliCommon.ExitCode.Conflict],
+  ["PERSON_ALREADY_EXISTS", cliCommon.ExitCode.Conflict],
+  ["PERSON_ALREADY_DISABLED", cliCommon.ExitCode.Conflict],
+  // not found
+  ["NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["IDENTITY_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["KEY_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["PERSON_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["PROJECT_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["PROVIDER_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["ROLE_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["SESSION_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["TEMPLATE_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["TOKEN_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["VARIABLE_NOT_FOUND", cliCommon.ExitCode.NotFound],
+  ["UNKNOWN_EMAIL", cliCommon.ExitCode.NotFound],
+  ["UNKNOWN_PERSON_ID", cliCommon.ExitCode.NotFound],
+  ["NOT_MEMBER", cliCommon.ExitCode.NotFound],
+  // auth / permission
+  ["INVALID_CREDENTIALS", cliCommon.ExitCode.Forbidden],
+  ["PERSON_DISABLED", cliCommon.ExitCode.Forbidden],
+  ["EMAIL_NOT_VERIFIED", cliCommon.ExitCode.Forbidden],
+  ["MFA_REQUIRED", cliCommon.ExitCode.Forbidden],
+  ["MFA_ENROLLMENT_REQUIRED", cliCommon.ExitCode.Forbidden],
+  ["OTP_REQUIRED", cliCommon.ExitCode.Forbidden],
+  ["INVALID_OTP_TOKEN", cliCommon.ExitCode.Forbidden],
+  ["PASSWORDLESS_DISABLED", cliCommon.ExitCode.Forbidden],
+  ["NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY", cliCommon.ExitCode.Forbidden],
+  // retryable
+  ["RATE_LIMITED", cliCommon.ExitCode.Transient],
+  ["RATE_LIMIT_EXCEEDED", cliCommon.ExitCode.Transient],
+  // server-side failures the caller cannot fix by changing the input
+  ["INIT_ERROR", cliCommon.ExitCode.InternalError],
+  ["UNKNOWN", cliCommon.ExitCode.InternalError]
+]);
+const tenantErrorCodeToExitCode = (code) => {
+  const known = tenantErrorCodeExitCodes.get(code);
+  if (known !== void 0) {
+    return known;
+  }
+  if (code.endsWith("_NOT_FOUND")) {
+    return cliCommon.ExitCode.NotFound;
+  }
+  if (code.startsWith("ALREADY_") || code.includes("_ALREADY_")) {
+    return cliCommon.ExitCode.Conflict;
+  }
+  if (code.includes("RATE_LIMIT")) {
+    return cliCommon.ExitCode.Transient;
+  }
+  return cliCommon.ExitCode.InputError;
+};
+const toTenantApiError = (error) => TransportError.toTransportError(error, {
+  service: "Tenant API",
+  codePrefix: "TENANT_API"
+});
+exports.TenantApiTransport = TenantApiTransport;
+exports.buildRequestDocument = buildRequestDocument;
+exports.createTenantApiUrl = createTenantApiUrl;
+exports.tenantErrorCodeToExitCode = tenantErrorCodeToExitCode;
+exports.tenantMutationError = tenantMutationError;
+exports.toTenantApiError = toTenantApiError;
+//# sourceMappingURL=TenantApiTransport.cjs.map

package/dist/production/src/lib/tenant/TenantApiTransport.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiTransport.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantApiTransport.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport { GraphQlClient, GraphQlClientVariables } from '@contember/graphql-client'\nimport { Fetcher, TextWriter, util } from 'graphql-ts-client-api'\nimport { toTransportError } from '../errors/TransportError.js'\n\n/** Normalizes any endpoint the user may have configured into the tenant GraphQL endpoint. */\nexport const createTenantApiUrl = (url: string): string => {\n\tif (url.endsWith('/')) {\n\t\turl = url.substring(0, url.length - 1)\n\t}\n\tif (url.endsWith('/tenant')) {\n\t\treturn url\n\t}\n\treturn url + '/tenant'\n}\n\n/** The shape every tenant `*Response` mutation payload shares. */\nexport interface TenantMutationResult {\n\treadonly ok: boolean\n\treadonly error?: {\n\t\treadonly code: string\n\t\treadonly developerMessage?: string | null\n\t\treadonly weakPasswordReasons?: readonly unknown[] | null\n\t\treadonly recommendedAction?: unknown\n\t} | null\n}\n\n/**\n * The single transport every tenant domain client is built on.\n *\n * Usage — see `clients/README.md`:\n *\n * ```ts\n * const personsFetcher = query$.persons(person$$)                       // built once, fetchers are immutable\n * const result = await this.transport.exec(personsFetcher, { limit })   // variables are typed by the fetcher\n * this.transport.assertOk(result.disablePerson, 'disablePerson')        // mutation payloads only\n * ```\n *\n * Everything thrown out of here is a {@link CliError} with a stable `code` and the `ExitCode`\n * matching the taxonomy, so no command has to translate tenant errors itself.\n */\nexport class TenantApiTransport {\n\tconstructor(\n\t\tprivate readonly apiClient: GraphQlClient,\n\t) {\n\t}\n\n\tpublic static create(url: string, apiToken: string): TenantApiTransport {\n\t\treturn new TenantApiTransport(new GraphQlClient({ url: createTenantApiUrl(url), apiToken }))\n\t}\n\n\tpublic get apiUrl(): string {\n\t\treturn this.apiClient.apiUrl\n\t}\n\n\t/** Runs a `graphql-ts-client-api` fetcher as a query or a mutation, depending on the fetcher's root type. */\n\tpublic async exec<TData extends object, TVariables extends object>(\n\t\tfetcher: Fetcher<'Query' | 'Mutation', TData, TVariables>,\n\t\tvariables: TVariables,\n\t): Promise<TData> {\n\t\ttry {\n\t\t\treturn await this.apiClient.execute<TData>(buildRequestDocument(fetcher), { variables })\n\t\t} catch (e) {\n\t\t\tthrow toTenantApiError(e)\n\t\t}\n\t}\n\n\t/** Runs a hand-written operation document — only for what a fetcher cannot express, such as an explicit `null` root argument. */\n\tpublic async execDocument<TData extends object>(document: string, variables: GraphQlClientVariables): Promise<TData> {\n\t\ttry {\n\t\t\treturn await this.apiClient.execute<TData>(document, { variables })\n\t\t} catch (e) {\n\t\t\tthrow toTenantApiError(e)\n\t\t}\n\t}\n\n\t/** Turns a failed tenant mutation payload into a {@link CliError} carrying the tenant error code. */\n\tpublic assertOk(result: TenantMutationResult | null | undefined, operation: string): void {\n\t\tif (result?.ok === true) {\n\t\t\treturn\n\t\t}\n\t\tthrow tenantMutationError(result, operation)\n\t}\n}\n\n/** Builds the operation document out of a fetcher — the variable declarations are derived from its variable map. */\nexport const buildRequestDocument = (fetcher: Fetcher<'Query' | 'Mutation', object, object>): string => {\n\tconst writer = new TextWriter()\n\twriter.text(fetcher.fetchableType.name.toLowerCase())\n\tif (fetcher.variableTypeMap.size !== 0) {\n\t\twriter.scope({ type: 'ARGUMENTS', multiLines: fetcher.variableTypeMap.size > 2, suffix: ' ' }, () => {\n\t\t\tutil.iterateMap(fetcher.variableTypeMap, ([name, type]) => {\n\t\t\t\twriter.seperator()\n\t\t\t\twriter.text(`$${name}: ${type}`)\n\t\t\t})\n\t\t})\n\t}\n\twriter.text(fetcher.toString())\n\twriter.text(fetcher.toFragmentString())\n\treturn writer.toString()\n}\n\nexport const tenantMutationError = (result: TenantMutationResult | null | undefined, operation: string): CliError => {\n\tconst code = result?.error?.code ?? 'UNKNOWN'\n\tconst developerMessage = result?.error?.developerMessage ?? null\n\tconst details: Record<string, unknown> = { operation, code, developerMessage }\n\tconst weakPasswordReasons = result?.error?.weakPasswordReasons?.filter(isWeakPasswordReason)\n\tif (weakPasswordReasons !== undefined && weakPasswordReasons.length > 0) {\n\t\tdetails.weakPasswordReasons = weakPasswordReasons\n\t}\n\tconst recommendedAction = result?.error?.recommendedAction\n\tif (isSignUpRecommendedAction(recommendedAction)) {\n\t\tdetails.recommendedAction = recommendedAction\n\t}\n\treturn new CliError(`${operation} failed: ${code}${developerMessage ? ` — ${developerMessage}` : ''}`, {\n\t\tcode,\n\t\texitCode: tenantErrorCodeToExitCode(code),\n\t\tdetails,\n\t})\n}\n\nconst weakPasswordReasons = [\n\t'TOO_SHORT',\n\t'MISSING_UPPERCASE',\n\t'MISSING_LOWERCASE',\n\t'MISSING_DIGIT',\n\t'MISSING_SPECIAL',\n\t'INVALID_PATTERN',\n\t'BLACKLISTED',\n\t'COMPROMISED',\n]\n\nconst isWeakPasswordReason = (value: unknown): value is string => typeof value === 'string' && weakPasswordReasons.includes(value)\n\nconst isSignUpRecommendedAction = (value: unknown): value is string => value === 'SIGN_IN' || value === 'RESET_PASSWORD'\n\n/**\n * The tenant API returns a per-mutation error code enum (see `tenant.graphql`). Only the codes that are\n * not plain input errors are listed — everything unlisted falls back to {@link ExitCode.InputError}.\n */\nconst tenantErrorCodeExitCodes = new Map<string, ExitCode>([\n\t// conflicts\n\t['ALREADY_EXISTS', ExitCode.Conflict],\n\t['ALREADY_MEMBER', ExitCode.Conflict],\n\t['EMAIL_ALREADY_EXISTS', ExitCode.Conflict],\n\t['PERSON_ALREADY_EXISTS', ExitCode.Conflict],\n\t['PERSON_ALREADY_DISABLED', ExitCode.Conflict],\n\n\t// not found\n\t['NOT_FOUND', ExitCode.NotFound],\n\t['IDENTITY_NOT_FOUND', ExitCode.NotFound],\n\t['KEY_NOT_FOUND', ExitCode.NotFound],\n\t['PERSON_NOT_FOUND', ExitCode.NotFound],\n\t['PROJECT_NOT_FOUND', ExitCode.NotFound],\n\t['PROVIDER_NOT_FOUND', ExitCode.NotFound],\n\t['ROLE_NOT_FOUND', ExitCode.NotFound],\n\t['SESSION_NOT_FOUND', ExitCode.NotFound],\n\t['TEMPLATE_NOT_FOUND', ExitCode.NotFound],\n\t['TOKEN_NOT_FOUND', ExitCode.NotFound],\n\t['VARIABLE_NOT_FOUND', ExitCode.NotFound],\n\t['UNKNOWN_EMAIL', ExitCode.NotFound],\n\t['UNKNOWN_PERSON_ID', ExitCode.NotFound],\n\t['NOT_MEMBER', ExitCode.NotFound],\n\n\t// auth / permission\n\t['INVALID_CREDENTIALS', ExitCode.Forbidden],\n\t['PERSON_DISABLED', ExitCode.Forbidden],\n\t['EMAIL_NOT_VERIFIED', ExitCode.Forbidden],\n\t['MFA_REQUIRED', ExitCode.Forbidden],\n\t['MFA_ENROLLMENT_REQUIRED', ExitCode.Forbidden],\n\t['OTP_REQUIRED', ExitCode.Forbidden],\n\t['INVALID_OTP_TOKEN', ExitCode.Forbidden],\n\t['PASSWORDLESS_DISABLED', ExitCode.Forbidden],\n\t['NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY', ExitCode.Forbidden],\n\n\t// retryable\n\t['RATE_LIMITED', ExitCode.Transient],\n\t['RATE_LIMIT_EXCEEDED', ExitCode.Transient],\n\n\t// server-side failures the caller cannot fix by changing the input\n\t['INIT_ERROR', ExitCode.InternalError],\n\t['UNKNOWN', ExitCode.InternalError],\n])\n\n/** Maps a tenant error code onto the exit-code taxonomy. Unknown codes fall back on the naming convention. */\nexport const tenantErrorCodeToExitCode = (code: string): ExitCode => {\n\tconst known = tenantErrorCodeExitCodes.get(code)\n\tif (known !== undefined) {\n\t\treturn known\n\t}\n\t// codes added to the schema later follow the same naming, so the taxonomy holds without a CLI release\n\tif (code.endsWith('_NOT_FOUND')) {\n\t\treturn ExitCode.NotFound\n\t}\n\tif (code.startsWith('ALREADY_') || code.includes('_ALREADY_')) {\n\t\treturn ExitCode.Conflict\n\t}\n\tif (code.includes('RATE_LIMIT')) {\n\t\treturn ExitCode.Transient\n\t}\n\treturn ExitCode.InputError\n}\n\n/** Normalizes a transport-level failure without exposing the GraphQL request or response body. */\nexport const toTenantApiError = (error: unknown): CliError =>\n\ttoTransportError(error, {\n\t\tservice: 'Tenant API',\n\t\tcodePrefix: 'TENANT_API',\n\t})\n"],"names":["GraphQlClient","TextWriter","util","weakPasswordReasons","CliError","ExitCode","toTransportError"],"mappings":";;;;;;AAMO,MAAM,qBAAqB,CAAC,QAAwB;AAC1D,MAAI,IAAI,SAAS,GAAG,GAAG;AACtB,UAAM,IAAI,UAAU,GAAG,IAAI,SAAS,CAAC;AAAA,EACtC;AACA,MAAI,IAAI,SAAS,SAAS,GAAG;AAC5B,WAAO;AAAA,EACR;AACA,SAAO,MAAM;AACd;AA2BO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,OAAc,OAAO,KAAa,UAAsC;AACvE,WAAO,IAAI,mBAAmB,IAAIA,cAAAA,cAAc,EAAE,KAAK,mBAAmB,GAAG,GAAG,SAAA,CAAU,CAAC;AAAA,EAC5F;AAAA,EAEA,IAAW,SAAiB;AAC3B,WAAO,KAAK,UAAU;AAAA,EACvB;AAAA;AAAA,EAGA,MAAa,KACZ,SACA,WACiB;AACjB,QAAI;AACH,aAAO,MAAM,KAAK,UAAU,QAAe,qBAAqB,OAAO,GAAG,EAAE,WAAW;AAAA,IACxF,SAAS,GAAG;AACX,YAAM,iBAAiB,CAAC;AAAA,IACzB;AAAA,EACD;AAAA;AAAA,EAGA,MAAa,aAAmC,UAAkB,WAAmD;AACpH,QAAI;AACH,aAAO,MAAM,KAAK,UAAU,QAAe,UAAU,EAAE,WAAW;AAAA,IACnE,SAAS,GAAG;AACX,YAAM,iBAAiB,CAAC;AAAA,IACzB;AAAA,EACD;AAAA;AAAA,EAGO,SAAS,QAAiD,WAAyB;AACzF,QAAI,QAAQ,OAAO,MAAM;AACxB;AAAA,IACD;AACA,UAAM,oBAAoB,QAAQ,SAAS;AAAA,EAC5C;AACD;AAGO,MAAM,uBAAuB,CAAC,YAAmE;AACvG,QAAM,SAAS,IAAIC,8BAAA;AACnB,SAAO,KAAK,QAAQ,cAAc,KAAK,aAAa;AACpD,MAAI,QAAQ,gBAAgB,SAAS,GAAG;AACvC,WAAO,MAAM,EAAE,MAAM,aAAa,YAAY,QAAQ,gBAAgB,OAAO,GAAG,QAAQ,IAAA,GAAO,MAAM;AACpGC,yBAAAA,KAAK,WAAW,QAAQ,iBAAiB,CAAC,CAAC,MAAM,IAAI,MAAM;AAC1D,eAAO,UAAA;AACP,eAAO,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE;AAAA,MAChC,CAAC;AAAA,IACF,CAAC;AAAA,EACF;AACA,SAAO,KAAK,QAAQ,UAAU;AAC9B,SAAO,KAAK,QAAQ,kBAAkB;AACtC,SAAO,OAAO,SAAA;AACf;AAEO,MAAM,sBAAsB,CAAC,QAAiD,cAAgC;AACpH,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,mBAAmB,QAAQ,OAAO,oBAAoB;AAC5D,QAAM,UAAmC,EAAE,WAAW,MAAM,iBAAA;AAC5D,QAAMC,uBAAsB,QAAQ,OAAO,qBAAqB,OAAO,oBAAoB;AAC3F,MAAIA,yBAAwB,UAAaA,qBAAoB,SAAS,GAAG;AACxE,YAAQ,sBAAsBA;AAAAA,EAC/B;AACA,QAAM,oBAAoB,QAAQ,OAAO;AACzC,MAAI,0BAA0B,iBAAiB,GAAG;AACjD,YAAQ,oBAAoB;AAAA,EAC7B;AACA,SAAO,IAAIC,UAAAA,SAAS,GAAG,SAAS,YAAY,IAAI,GAAG,mBAAmB,MAAM,gBAAgB,KAAK,EAAE,IAAI;AAAA,IACtG;AAAA,IACA,UAAU,0BAA0B,IAAI;AAAA,IACxC;AAAA,EAAA,CACA;AACF;AAEA,MAAM,sBAAsB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEA,MAAM,uBAAuB,CAAC,UAAoC,OAAO,UAAU,YAAY,oBAAoB,SAAS,KAAK;AAEjI,MAAM,4BAA4B,CAAC,UAAoC,UAAU,aAAa,UAAU;AAMxG,MAAM,+CAA+B,IAAsB;AAAA;AAAA,EAE1D,CAAC,kBAAkBC,UAAAA,SAAS,QAAQ;AAAA,EACpC,CAAC,kBAAkBA,UAAAA,SAAS,QAAQ;AAAA,EACpC,CAAC,wBAAwBA,UAAAA,SAAS,QAAQ;AAAA,EAC1C,CAAC,yBAAyBA,UAAAA,SAAS,QAAQ;AAAA,EAC3C,CAAC,2BAA2BA,UAAAA,SAAS,QAAQ;AAAA;AAAA,EAG7C,CAAC,aAAaA,UAAAA,SAAS,QAAQ;AAAA,EAC/B,CAAC,sBAAsBA,UAAAA,SAAS,QAAQ;AAAA,EACxC,CAAC,iBAAiBA,UAAAA,SAAS,QAAQ;AAAA,EACnC,CAAC,oBAAoBA,UAAAA,SAAS,QAAQ;AAAA,EACtC,CAAC,qBAAqBA,UAAAA,SAAS,QAAQ;AAAA,EACvC,CAAC,sBAAsBA,UAAAA,SAAS,QAAQ;AAAA,EACxC,CAAC,kBAAkBA,UAAAA,SAAS,QAAQ;AAAA,EACpC,CAAC,qBAAqBA,UAAAA,SAAS,QAAQ;AAAA,EACvC,CAAC,sBAAsBA,UAAAA,SAAS,QAAQ;AAAA,EACxC,CAAC,mBAAmBA,UAAAA,SAAS,QAAQ;AAAA,EACrC,CAAC,sBAAsBA,UAAAA,SAAS,QAAQ;AAAA,EACxC,CAAC,iBAAiBA,UAAAA,SAAS,QAAQ;AAAA,EACnC,CAAC,qBAAqBA,UAAAA,SAAS,QAAQ;AAAA,EACvC,CAAC,cAAcA,UAAAA,SAAS,QAAQ;AAAA;AAAA,EAGhC,CAAC,uBAAuBA,UAAAA,SAAS,SAAS;AAAA,EAC1C,CAAC,mBAAmBA,UAAAA,SAAS,SAAS;AAAA,EACtC,CAAC,sBAAsBA,UAAAA,SAAS,SAAS;AAAA,EACzC,CAAC,gBAAgBA,UAAAA,SAAS,SAAS;AAAA,EACnC,CAAC,2BAA2BA,UAAAA,SAAS,SAAS;AAAA,EAC9C,CAAC,gBAAgBA,UAAAA,SAAS,SAAS;AAAA,EACnC,CAAC,qBAAqBA,UAAAA,SAAS,SAAS;AAAA,EACxC,CAAC,yBAAyBA,UAAAA,SAAS,SAAS;AAAA,EAC5C,CAAC,gDAAgDA,UAAAA,SAAS,SAAS;AAAA;AAAA,EAGnE,CAAC,gBAAgBA,UAAAA,SAAS,SAAS;AAAA,EACnC,CAAC,uBAAuBA,UAAAA,SAAS,SAAS;AAAA;AAAA,EAG1C,CAAC,cAAcA,UAAAA,SAAS,aAAa;AAAA,EACrC,CAAC,WAAWA,UAAAA,SAAS,aAAa;AACnC,CAAC;AAGM,MAAM,4BAA4B,CAAC,SAA2B;AACpE,QAAM,QAAQ,yBAAyB,IAAI,IAAI;AAC/C,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AAEA,MAAI,KAAK,SAAS,YAAY,GAAG;AAChC,WAAOA,UAAAA,SAAS;AAAA,EACjB;AACA,MAAI,KAAK,WAAW,UAAU,KAAK,KAAK,SAAS,WAAW,GAAG;AAC9D,WAAOA,UAAAA,SAAS;AAAA,EACjB;AACA,MAAI,KAAK,SAAS,YAAY,GAAG;AAChC,WAAOA,UAAAA,SAAS;AAAA,EACjB;AACA,SAAOA,UAAAA,SAAS;AACjB;AAGO,MAAM,mBAAmB,CAAC,UAChCC,eAAAA,iBAAiB,OAAO;AAAA,EACvB,SAAS;AAAA,EACT,YAAY;AACb,CAAC;;;;;;;"}

package/dist/production/src/lib/tenant/TenantApiTransport.js

@@ -0,0 +1,160 @@
+import { ExitCode, CliError } from "@contember/cli-common";
+import { GraphQlClient } from "@contember/graphql-client";
+import { TextWriter, util } from "graphql-ts-client-api";
+import { toTransportError } from "../errors/TransportError.js";
+const createTenantApiUrl = (url) => {
+  if (url.endsWith("/")) {
+    url = url.substring(0, url.length - 1);
+  }
+  if (url.endsWith("/tenant")) {
+    return url;
+  }
+  return url + "/tenant";
+};
+class TenantApiTransport {
+  constructor(apiClient) {
+    this.apiClient = apiClient;
+  }
+  static create(url, apiToken) {
+    return new TenantApiTransport(new GraphQlClient({ url: createTenantApiUrl(url), apiToken }));
+  }
+  get apiUrl() {
+    return this.apiClient.apiUrl;
+  }
+  /** Runs a `graphql-ts-client-api` fetcher as a query or a mutation, depending on the fetcher's root type. */
+  async exec(fetcher, variables) {
+    try {
+      return await this.apiClient.execute(buildRequestDocument(fetcher), { variables });
+    } catch (e) {
+      throw toTenantApiError(e);
+    }
+  }
+  /** Runs a hand-written operation document — only for what a fetcher cannot express, such as an explicit `null` root argument. */
+  async execDocument(document, variables) {
+    try {
+      return await this.apiClient.execute(document, { variables });
+    } catch (e) {
+      throw toTenantApiError(e);
+    }
+  }
+  /** Turns a failed tenant mutation payload into a {@link CliError} carrying the tenant error code. */
+  assertOk(result, operation) {
+    if (result?.ok === true) {
+      return;
+    }
+    throw tenantMutationError(result, operation);
+  }
+}
+const buildRequestDocument = (fetcher) => {
+  const writer = new TextWriter();
+  writer.text(fetcher.fetchableType.name.toLowerCase());
+  if (fetcher.variableTypeMap.size !== 0) {
+    writer.scope({ type: "ARGUMENTS", multiLines: fetcher.variableTypeMap.size > 2, suffix: " " }, () => {
+      util.iterateMap(fetcher.variableTypeMap, ([name, type]) => {
+        writer.seperator();
+        writer.text(`$${name}: ${type}`);
+      });
+    });
+  }
+  writer.text(fetcher.toString());
+  writer.text(fetcher.toFragmentString());
+  return writer.toString();
+};
+const tenantMutationError = (result, operation) => {
+  const code = result?.error?.code ?? "UNKNOWN";
+  const developerMessage = result?.error?.developerMessage ?? null;
+  const details = { operation, code, developerMessage };
+  const weakPasswordReasons2 = result?.error?.weakPasswordReasons?.filter(isWeakPasswordReason);
+  if (weakPasswordReasons2 !== void 0 && weakPasswordReasons2.length > 0) {
+    details.weakPasswordReasons = weakPasswordReasons2;
+  }
+  const recommendedAction = result?.error?.recommendedAction;
+  if (isSignUpRecommendedAction(recommendedAction)) {
+    details.recommendedAction = recommendedAction;
+  }
+  return new CliError(`${operation} failed: ${code}${developerMessage ? ` — ${developerMessage}` : ""}`, {
+    code,
+    exitCode: tenantErrorCodeToExitCode(code),
+    details
+  });
+};
+const weakPasswordReasons = [
+  "TOO_SHORT",
+  "MISSING_UPPERCASE",
+  "MISSING_LOWERCASE",
+  "MISSING_DIGIT",
+  "MISSING_SPECIAL",
+  "INVALID_PATTERN",
+  "BLACKLISTED",
+  "COMPROMISED"
+];
+const isWeakPasswordReason = (value) => typeof value === "string" && weakPasswordReasons.includes(value);
+const isSignUpRecommendedAction = (value) => value === "SIGN_IN" || value === "RESET_PASSWORD";
+const tenantErrorCodeExitCodes = /* @__PURE__ */ new Map([
+  // conflicts
+  ["ALREADY_EXISTS", ExitCode.Conflict],
+  ["ALREADY_MEMBER", ExitCode.Conflict],
+  ["EMAIL_ALREADY_EXISTS", ExitCode.Conflict],
+  ["PERSON_ALREADY_EXISTS", ExitCode.Conflict],
+  ["PERSON_ALREADY_DISABLED", ExitCode.Conflict],
+  // not found
+  ["NOT_FOUND", ExitCode.NotFound],
+  ["IDENTITY_NOT_FOUND", ExitCode.NotFound],
+  ["KEY_NOT_FOUND", ExitCode.NotFound],
+  ["PERSON_NOT_FOUND", ExitCode.NotFound],
+  ["PROJECT_NOT_FOUND", ExitCode.NotFound],
+  ["PROVIDER_NOT_FOUND", ExitCode.NotFound],
+  ["ROLE_NOT_FOUND", ExitCode.NotFound],
+  ["SESSION_NOT_FOUND", ExitCode.NotFound],
+  ["TEMPLATE_NOT_FOUND", ExitCode.NotFound],
+  ["TOKEN_NOT_FOUND", ExitCode.NotFound],
+  ["VARIABLE_NOT_FOUND", ExitCode.NotFound],
+  ["UNKNOWN_EMAIL", ExitCode.NotFound],
+  ["UNKNOWN_PERSON_ID", ExitCode.NotFound],
+  ["NOT_MEMBER", ExitCode.NotFound],
+  // auth / permission
+  ["INVALID_CREDENTIALS", ExitCode.Forbidden],
+  ["PERSON_DISABLED", ExitCode.Forbidden],
+  ["EMAIL_NOT_VERIFIED", ExitCode.Forbidden],
+  ["MFA_REQUIRED", ExitCode.Forbidden],
+  ["MFA_ENROLLMENT_REQUIRED", ExitCode.Forbidden],
+  ["OTP_REQUIRED", ExitCode.Forbidden],
+  ["INVALID_OTP_TOKEN", ExitCode.Forbidden],
+  ["PASSWORDLESS_DISABLED", ExitCode.Forbidden],
+  ["NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY", ExitCode.Forbidden],
+  // retryable
+  ["RATE_LIMITED", ExitCode.Transient],
+  ["RATE_LIMIT_EXCEEDED", ExitCode.Transient],
+  // server-side failures the caller cannot fix by changing the input
+  ["INIT_ERROR", ExitCode.InternalError],
+  ["UNKNOWN", ExitCode.InternalError]
+]);
+const tenantErrorCodeToExitCode = (code) => {
+  const known = tenantErrorCodeExitCodes.get(code);
+  if (known !== void 0) {
+    return known;
+  }
+  if (code.endsWith("_NOT_FOUND")) {
+    return ExitCode.NotFound;
+  }
+  if (code.startsWith("ALREADY_") || code.includes("_ALREADY_")) {
+    return ExitCode.Conflict;
+  }
+  if (code.includes("RATE_LIMIT")) {
+    return ExitCode.Transient;
+  }
+  return ExitCode.InputError;
+};
+const toTenantApiError = (error) => toTransportError(error, {
+  service: "Tenant API",
+  codePrefix: "TENANT_API"
+});
+export {
+  TenantApiTransport,
+  buildRequestDocument,
+  createTenantApiUrl,
+  tenantErrorCodeToExitCode,
+  tenantMutationError,
+  toTenantApiError
+};
+//# sourceMappingURL=TenantApiTransport.js.map

package/dist/production/src/lib/tenant/TenantApiTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiTransport.js","sources":["../../../../../../packages/cli/src/lib/tenant/TenantApiTransport.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport { GraphQlClient, GraphQlClientVariables } from '@contember/graphql-client'\nimport { Fetcher, TextWriter, util } from 'graphql-ts-client-api'\nimport { toTransportError } from '../errors/TransportError.js'\n\n/** Normalizes any endpoint the user may have configured into the tenant GraphQL endpoint. */\nexport const createTenantApiUrl = (url: string): string => {\n\tif (url.endsWith('/')) {\n\t\turl = url.substring(0, url.length - 1)\n\t}\n\tif (url.endsWith('/tenant')) {\n\t\treturn url\n\t}\n\treturn url + '/tenant'\n}\n\n/** The shape every tenant `*Response` mutation payload shares. */\nexport interface TenantMutationResult {\n\treadonly ok: boolean\n\treadonly error?: {\n\t\treadonly code: string\n\t\treadonly developerMessage?: string | null\n\t\treadonly weakPasswordReasons?: readonly unknown[] | null\n\t\treadonly recommendedAction?: unknown\n\t} | null\n}\n\n/**\n * The single transport every tenant domain client is built on.\n *\n * Usage — see `clients/README.md`:\n *\n * ```ts\n * const personsFetcher = query$.persons(person$$)                       // built once, fetchers are immutable\n * const result = await this.transport.exec(personsFetcher, { limit })   // variables are typed by the fetcher\n * this.transport.assertOk(result.disablePerson, 'disablePerson')        // mutation payloads only\n * ```\n *\n * Everything thrown out of here is a {@link CliError} with a stable `code` and the `ExitCode`\n * matching the taxonomy, so no command has to translate tenant errors itself.\n */\nexport class TenantApiTransport {\n\tconstructor(\n\t\tprivate readonly apiClient: GraphQlClient,\n\t) {\n\t}\n\n\tpublic static create(url: string, apiToken: string): TenantApiTransport {\n\t\treturn new TenantApiTransport(new GraphQlClient({ url: createTenantApiUrl(url), apiToken }))\n\t}\n\n\tpublic get apiUrl(): string {\n\t\treturn this.apiClient.apiUrl\n\t}\n\n\t/** Runs a `graphql-ts-client-api` fetcher as a query or a mutation, depending on the fetcher's root type. */\n\tpublic async exec<TData extends object, TVariables extends object>(\n\t\tfetcher: Fetcher<'Query' | 'Mutation', TData, TVariables>,\n\t\tvariables: TVariables,\n\t): Promise<TData> {\n\t\ttry {\n\t\t\treturn await this.apiClient.execute<TData>(buildRequestDocument(fetcher), { variables })\n\t\t} catch (e) {\n\t\t\tthrow toTenantApiError(e)\n\t\t}\n\t}\n\n\t/** Runs a hand-written operation document — only for what a fetcher cannot express, such as an explicit `null` root argument. */\n\tpublic async execDocument<TData extends object>(document: string, variables: GraphQlClientVariables): Promise<TData> {\n\t\ttry {\n\t\t\treturn await this.apiClient.execute<TData>(document, { variables })\n\t\t} catch (e) {\n\t\t\tthrow toTenantApiError(e)\n\t\t}\n\t}\n\n\t/** Turns a failed tenant mutation payload into a {@link CliError} carrying the tenant error code. */\n\tpublic assertOk(result: TenantMutationResult | null | undefined, operation: string): void {\n\t\tif (result?.ok === true) {\n\t\t\treturn\n\t\t}\n\t\tthrow tenantMutationError(result, operation)\n\t}\n}\n\n/** Builds the operation document out of a fetcher — the variable declarations are derived from its variable map. */\nexport const buildRequestDocument = (fetcher: Fetcher<'Query' | 'Mutation', object, object>): string => {\n\tconst writer = new TextWriter()\n\twriter.text(fetcher.fetchableType.name.toLowerCase())\n\tif (fetcher.variableTypeMap.size !== 0) {\n\t\twriter.scope({ type: 'ARGUMENTS', multiLines: fetcher.variableTypeMap.size > 2, suffix: ' ' }, () => {\n\t\t\tutil.iterateMap(fetcher.variableTypeMap, ([name, type]) => {\n\t\t\t\twriter.seperator()\n\t\t\t\twriter.text(`$${name}: ${type}`)\n\t\t\t})\n\t\t})\n\t}\n\twriter.text(fetcher.toString())\n\twriter.text(fetcher.toFragmentString())\n\treturn writer.toString()\n}\n\nexport const tenantMutationError = (result: TenantMutationResult | null | undefined, operation: string): CliError => {\n\tconst code = result?.error?.code ?? 'UNKNOWN'\n\tconst developerMessage = result?.error?.developerMessage ?? null\n\tconst details: Record<string, unknown> = { operation, code, developerMessage }\n\tconst weakPasswordReasons = result?.error?.weakPasswordReasons?.filter(isWeakPasswordReason)\n\tif (weakPasswordReasons !== undefined && weakPasswordReasons.length > 0) {\n\t\tdetails.weakPasswordReasons = weakPasswordReasons\n\t}\n\tconst recommendedAction = result?.error?.recommendedAction\n\tif (isSignUpRecommendedAction(recommendedAction)) {\n\t\tdetails.recommendedAction = recommendedAction\n\t}\n\treturn new CliError(`${operation} failed: ${code}${developerMessage ? ` — ${developerMessage}` : ''}`, {\n\t\tcode,\n\t\texitCode: tenantErrorCodeToExitCode(code),\n\t\tdetails,\n\t})\n}\n\nconst weakPasswordReasons = [\n\t'TOO_SHORT',\n\t'MISSING_UPPERCASE',\n\t'MISSING_LOWERCASE',\n\t'MISSING_DIGIT',\n\t'MISSING_SPECIAL',\n\t'INVALID_PATTERN',\n\t'BLACKLISTED',\n\t'COMPROMISED',\n]\n\nconst isWeakPasswordReason = (value: unknown): value is string => typeof value === 'string' && weakPasswordReasons.includes(value)\n\nconst isSignUpRecommendedAction = (value: unknown): value is string => value === 'SIGN_IN' || value === 'RESET_PASSWORD'\n\n/**\n * The tenant API returns a per-mutation error code enum (see `tenant.graphql`). Only the codes that are\n * not plain input errors are listed — everything unlisted falls back to {@link ExitCode.InputError}.\n */\nconst tenantErrorCodeExitCodes = new Map<string, ExitCode>([\n\t// conflicts\n\t['ALREADY_EXISTS', ExitCode.Conflict],\n\t['ALREADY_MEMBER', ExitCode.Conflict],\n\t['EMAIL_ALREADY_EXISTS', ExitCode.Conflict],\n\t['PERSON_ALREADY_EXISTS', ExitCode.Conflict],\n\t['PERSON_ALREADY_DISABLED', ExitCode.Conflict],\n\n\t// not found\n\t['NOT_FOUND', ExitCode.NotFound],\n\t['IDENTITY_NOT_FOUND', ExitCode.NotFound],\n\t['KEY_NOT_FOUND', ExitCode.NotFound],\n\t['PERSON_NOT_FOUND', ExitCode.NotFound],\n\t['PROJECT_NOT_FOUND', ExitCode.NotFound],\n\t['PROVIDER_NOT_FOUND', ExitCode.NotFound],\n\t['ROLE_NOT_FOUND', ExitCode.NotFound],\n\t['SESSION_NOT_FOUND', ExitCode.NotFound],\n\t['TEMPLATE_NOT_FOUND', ExitCode.NotFound],\n\t['TOKEN_NOT_FOUND', ExitCode.NotFound],\n\t['VARIABLE_NOT_FOUND', ExitCode.NotFound],\n\t['UNKNOWN_EMAIL', ExitCode.NotFound],\n\t['UNKNOWN_PERSON_ID', ExitCode.NotFound],\n\t['NOT_MEMBER', ExitCode.NotFound],\n\n\t// auth / permission\n\t['INVALID_CREDENTIALS', ExitCode.Forbidden],\n\t['PERSON_DISABLED', ExitCode.Forbidden],\n\t['EMAIL_NOT_VERIFIED', ExitCode.Forbidden],\n\t['MFA_REQUIRED', ExitCode.Forbidden],\n\t['MFA_ENROLLMENT_REQUIRED', ExitCode.Forbidden],\n\t['OTP_REQUIRED', ExitCode.Forbidden],\n\t['INVALID_OTP_TOKEN', ExitCode.Forbidden],\n\t['PASSWORDLESS_DISABLED', ExitCode.Forbidden],\n\t['NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY', ExitCode.Forbidden],\n\n\t// retryable\n\t['RATE_LIMITED', ExitCode.Transient],\n\t['RATE_LIMIT_EXCEEDED', ExitCode.Transient],\n\n\t// server-side failures the caller cannot fix by changing the input\n\t['INIT_ERROR', ExitCode.InternalError],\n\t['UNKNOWN', ExitCode.InternalError],\n])\n\n/** Maps a tenant error code onto the exit-code taxonomy. Unknown codes fall back on the naming convention. */\nexport const tenantErrorCodeToExitCode = (code: string): ExitCode => {\n\tconst known = tenantErrorCodeExitCodes.get(code)\n\tif (known !== undefined) {\n\t\treturn known\n\t}\n\t// codes added to the schema later follow the same naming, so the taxonomy holds without a CLI release\n\tif (code.endsWith('_NOT_FOUND')) {\n\t\treturn ExitCode.NotFound\n\t}\n\tif (code.startsWith('ALREADY_') || code.includes('_ALREADY_')) {\n\t\treturn ExitCode.Conflict\n\t}\n\tif (code.includes('RATE_LIMIT')) {\n\t\treturn ExitCode.Transient\n\t}\n\treturn ExitCode.InputError\n}\n\n/** Normalizes a transport-level failure without exposing the GraphQL request or response body. */\nexport const toTenantApiError = (error: unknown): CliError =>\n\ttoTransportError(error, {\n\t\tservice: 'Tenant API',\n\t\tcodePrefix: 'TENANT_API',\n\t})\n"],"names":["weakPasswordReasons"],"mappings":";;;;AAMO,MAAM,qBAAqB,CAAC,QAAwB;AAC1D,MAAI,IAAI,SAAS,GAAG,GAAG;AACtB,UAAM,IAAI,UAAU,GAAG,IAAI,SAAS,CAAC;AAAA,EACtC;AACA,MAAI,IAAI,SAAS,SAAS,GAAG;AAC5B,WAAO;AAAA,EACR;AACA,SAAO,MAAM;AACd;AA2BO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,OAAc,OAAO,KAAa,UAAsC;AACvE,WAAO,IAAI,mBAAmB,IAAI,cAAc,EAAE,KAAK,mBAAmB,GAAG,GAAG,SAAA,CAAU,CAAC;AAAA,EAC5F;AAAA,EAEA,IAAW,SAAiB;AAC3B,WAAO,KAAK,UAAU;AAAA,EACvB;AAAA;AAAA,EAGA,MAAa,KACZ,SACA,WACiB;AACjB,QAAI;AACH,aAAO,MAAM,KAAK,UAAU,QAAe,qBAAqB,OAAO,GAAG,EAAE,WAAW;AAAA,IACxF,SAAS,GAAG;AACX,YAAM,iBAAiB,CAAC;AAAA,IACzB;AAAA,EACD;AAAA;AAAA,EAGA,MAAa,aAAmC,UAAkB,WAAmD;AACpH,QAAI;AACH,aAAO,MAAM,KAAK,UAAU,QAAe,UAAU,EAAE,WAAW;AAAA,IACnE,SAAS,GAAG;AACX,YAAM,iBAAiB,CAAC;AAAA,IACzB;AAAA,EACD;AAAA;AAAA,EAGO,SAAS,QAAiD,WAAyB;AACzF,QAAI,QAAQ,OAAO,MAAM;AACxB;AAAA,IACD;AACA,UAAM,oBAAoB,QAAQ,SAAS;AAAA,EAC5C;AACD;AAGO,MAAM,uBAAuB,CAAC,YAAmE;AACvG,QAAM,SAAS,IAAI,WAAA;AACnB,SAAO,KAAK,QAAQ,cAAc,KAAK,aAAa;AACpD,MAAI,QAAQ,gBAAgB,SAAS,GAAG;AACvC,WAAO,MAAM,EAAE,MAAM,aAAa,YAAY,QAAQ,gBAAgB,OAAO,GAAG,QAAQ,IAAA,GAAO,MAAM;AACpG,WAAK,WAAW,QAAQ,iBAAiB,CAAC,CAAC,MAAM,IAAI,MAAM;AAC1D,eAAO,UAAA;AACP,eAAO,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE;AAAA,MAChC,CAAC;AAAA,IACF,CAAC;AAAA,EACF;AACA,SAAO,KAAK,QAAQ,UAAU;AAC9B,SAAO,KAAK,QAAQ,kBAAkB;AACtC,SAAO,OAAO,SAAA;AACf;AAEO,MAAM,sBAAsB,CAAC,QAAiD,cAAgC;AACpH,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,mBAAmB,QAAQ,OAAO,oBAAoB;AAC5D,QAAM,UAAmC,EAAE,WAAW,MAAM,iBAAA;AAC5D,QAAMA,uBAAsB,QAAQ,OAAO,qBAAqB,OAAO,oBAAoB;AAC3F,MAAIA,yBAAwB,UAAaA,qBAAoB,SAAS,GAAG;AACxE,YAAQ,sBAAsBA;AAAAA,EAC/B;AACA,QAAM,oBAAoB,QAAQ,OAAO;AACzC,MAAI,0BAA0B,iBAAiB,GAAG;AACjD,YAAQ,oBAAoB;AAAA,EAC7B;AACA,SAAO,IAAI,SAAS,GAAG,SAAS,YAAY,IAAI,GAAG,mBAAmB,MAAM,gBAAgB,KAAK,EAAE,IAAI;AAAA,IACtG;AAAA,IACA,UAAU,0BAA0B,IAAI;AAAA,IACxC;AAAA,EAAA,CACA;AACF;AAEA,MAAM,sBAAsB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEA,MAAM,uBAAuB,CAAC,UAAoC,OAAO,UAAU,YAAY,oBAAoB,SAAS,KAAK;AAEjI,MAAM,4BAA4B,CAAC,UAAoC,UAAU,aAAa,UAAU;AAMxG,MAAM,+CAA+B,IAAsB;AAAA;AAAA,EAE1D,CAAC,kBAAkB,SAAS,QAAQ;AAAA,EACpC,CAAC,kBAAkB,SAAS,QAAQ;AAAA,EACpC,CAAC,wBAAwB,SAAS,QAAQ;AAAA,EAC1C,CAAC,yBAAyB,SAAS,QAAQ;AAAA,EAC3C,CAAC,2BAA2B,SAAS,QAAQ;AAAA;AAAA,EAG7C,CAAC,aAAa,SAAS,QAAQ;AAAA,EAC/B,CAAC,sBAAsB,SAAS,QAAQ;AAAA,EACxC,CAAC,iBAAiB,SAAS,QAAQ;AAAA,EACnC,CAAC,oBAAoB,SAAS,QAAQ;AAAA,EACtC,CAAC,qBAAqB,SAAS,QAAQ;AAAA,EACvC,CAAC,sBAAsB,SAAS,QAAQ;AAAA,EACxC,CAAC,kBAAkB,SAAS,QAAQ;AAAA,EACpC,CAAC,qBAAqB,SAAS,QAAQ;AAAA,EACvC,CAAC,sBAAsB,SAAS,QAAQ;AAAA,EACxC,CAAC,mBAAmB,SAAS,QAAQ;AAAA,EACrC,CAAC,sBAAsB,SAAS,QAAQ;AAAA,EACxC,CAAC,iBAAiB,SAAS,QAAQ;AAAA,EACnC,CAAC,qBAAqB,SAAS,QAAQ;AAAA,EACvC,CAAC,cAAc,SAAS,QAAQ;AAAA;AAAA,EAGhC,CAAC,uBAAuB,SAAS,SAAS;AAAA,EAC1C,CAAC,mBAAmB,SAAS,SAAS;AAAA,EACtC,CAAC,sBAAsB,SAAS,SAAS;AAAA,EACzC,CAAC,gBAAgB,SAAS,SAAS;AAAA,EACnC,CAAC,2BAA2B,SAAS,SAAS;AAAA,EAC9C,CAAC,gBAAgB,SAAS,SAAS;AAAA,EACnC,CAAC,qBAAqB,SAAS,SAAS;AAAA,EACxC,CAAC,yBAAyB,SAAS,SAAS;AAAA,EAC5C,CAAC,gDAAgD,SAAS,SAAS;AAAA;AAAA,EAGnE,CAAC,gBAAgB,SAAS,SAAS;AAAA,EACnC,CAAC,uBAAuB,SAAS,SAAS;AAAA;AAAA,EAG1C,CAAC,cAAc,SAAS,aAAa;AAAA,EACrC,CAAC,WAAW,SAAS,aAAa;AACnC,CAAC;AAGM,MAAM,4BAA4B,CAAC,SAA2B;AACpE,QAAM,QAAQ,yBAAyB,IAAI,IAAI;AAC/C,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AAEA,MAAI,KAAK,SAAS,YAAY,GAAG;AAChC,WAAO,SAAS;AAAA,EACjB;AACA,MAAI,KAAK,WAAW,UAAU,KAAK,KAAK,SAAS,WAAW,GAAG;AAC9D,WAAO,SAAS;AAAA,EACjB;AACA,MAAI,KAAK,SAAS,YAAY,GAAG;AAChC,WAAO,SAAS;AAAA,EACjB;AACA,SAAO,SAAS;AACjB;AAGO,MAAM,mBAAmB,CAAC,UAChC,iBAAiB,OAAO;AAAA,EACvB,SAAS;AAAA,EACT,YAAY;AACb,CAAC;"}

package/dist/production/src/lib/tenant/TenantConfigApplier.cjs

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const authPolicy = require("./authPolicy.cjs");
+class TenantConfigApplier {
+  constructor(output = new cliCommon.Output()) {
+    this.output = output;
+  }
+  async apply(clients, config, options = {}) {
+    const dryRun = options.dryRun === true;
+    const actions = [];
+    const warnings = [];
+    const warn = (code, target, message) => {
+      warnings.push({ code, target, message });
+      this.output.warn(message);
+    };
+    const run = async (action, target, execute) => {
+      actions.push({ action, target });
+      if (dryRun) {
+        return;
+      }
+      this.output.info(target === null ? action : `${action}: ${target}`);
+      await execute();
+    };
+    assertDistinctAuthPolicies(config.authPolicies);
+    const existingAuthPolicies = config.authPolicies === void 0 ? void 0 : await clients.policy.listAuthPolicies();
+    assertDistinctExistingAuthPolicies(existingAuthPolicies);
+    if (config.config && hasEffectiveConfigValue(config.config)) {
+      const globalConfig = config.config;
+      await run("configure", null, () => clients.project.configure(globalConfig));
+    }
+    if (config.identityProviders && Object.keys(config.identityProviders).length > 0) {
+      const existing = await clients.project.listIdentityProviders();
+      const existingBySlug = new Map(existing.map((it) => [it.slug, it]));
+      for (const [slug, idp] of Object.entries(config.identityProviders)) {
+        const current = existingBySlug.get(slug);
+        if (!current) {
+          await run("addIdp", slug, () => clients.project.addIdp(slug, idp.type, idp.configuration, idp.options));
+        } else {
+          await run("updateIdp", slug, () => clients.project.updateIdp(slug, idp.type, idp.configuration, idp.options));
+        }
+        const wantDisabled = idp.disabled === true;
+        const isDisabled = current ? current.disabledAt !== null : false;
+        if (wantDisabled && !isDisabled) {
+          await run("disableIdp", slug, () => clients.project.disableIdp(slug));
+        } else if (!wantDisabled && isDisabled) {
+          await run("enableIdp", slug, () => clients.project.enableIdp(slug));
+        }
+      }
+    }
+    if (config.mailTemplates && config.mailTemplates.length > 0) {
+      for (const template of config.mailTemplates) {
+        const target = `${template.type}${template.variant ? `/${template.variant}` : ""}`;
+        await run("addMailTemplate", target, () => clients.policy.addMailTemplate(template));
+      }
+    }
+    if (config.authPolicies) {
+      const existing = existingAuthPolicies ?? [];
+      const existingByKey = new Map(existing.map((it) => [authPolicy.authPolicyKey(it), it]));
+      const managedKeys = new Set(config.authPolicies.map(authPolicy.authPolicyKey));
+      for (const policy of config.authPolicies) {
+        const current = existingByKey.get(authPolicy.authPolicyKey(policy));
+        const target = authPolicy.describeAuthPolicy(policy);
+        if (!current) {
+          await run("createAuthPolicy", target, async () => {
+            await clients.policy.createAuthPolicy(policy);
+          });
+        } else {
+          await run("updateAuthPolicy", target, () => clients.policy.updateAuthPolicy(current.id, policy));
+        }
+      }
+      for (const policy of existing) {
+        if (!managedKeys.has(authPolicy.authPolicyKey(policy))) {
+          const target = authPolicy.describeAuthPolicy(policy);
+          warn("UNMANAGED_AUTH_POLICY", target, `Auth policy ${target} exists but is not in the config; it stays in effect.`);
+        }
+      }
+    }
+    if (config.customRoles && Object.keys(config.customRoles).length > 0) {
+      const existing = await clients.policy.listCustomRoles();
+      const existingSlugs = new Set(existing.map((role) => role.slug));
+      const configuredRoles = Object.entries(config.customRoles);
+      const missingRoles = configuredRoles.filter(([slug]) => !existingSlugs.has(slug));
+      for (const [slug, role] of missingRoles) {
+        await run("createCustomRole", slug, () => clients.policy.createCustomRole(slug, {
+          description: role.description,
+          grants: []
+        }));
+      }
+      for (const [slug, role] of configuredRoles) {
+        await run("updateCustomRole", slug, () => clients.policy.updateCustomRole(slug, role));
+      }
+    }
+    return { actions, warnings };
+  }
+}
+const assertDistinctExistingAuthPolicies = (policies) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const policy of policies ?? []) {
+    const key = authPolicy.authPolicyKey(policy);
+    if (seen.has(key)) {
+      throw new Error(
+        `Duplicate existing auth policy: ${authPolicy.describeAuthPolicy(policy)}. Resolve duplicate rows before applying the tenant config.`
+      );
+    }
+    seen.add(key);
+  }
+};
+const assertDistinctAuthPolicies = (policies) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const policy of policies ?? []) {
+    const key = authPolicy.authPolicyKey(policy);
+    if (seen.has(key)) {
+      throw `Duplicate auth policy in the config: ${authPolicy.describeAuthPolicy(policy)}. Policies are identified by scope, project and role set.`;
+    }
+    seen.add(key);
+  }
+};
+const nullableConfigClearPaths = /* @__PURE__ */ new Set([
+  "passwordless.url",
+  "password.pattern",
+  "login.maxTokenExpiration",
+  "captcha.provider",
+  "captcha.threshold"
+]);
+const hasEffectiveConfigValue = (value, path = []) => {
+  if (value === void 0) {
+    return false;
+  }
+  if (value === null) {
+    return nullableConfigClearPaths.has(path.join("."));
+  }
+  if (typeof value !== "object") {
+    return true;
+  }
+  return Object.entries(value).some(([key, item]) => hasEffectiveConfigValue(item, [...path, key]));
+};
+exports.TenantConfigApplier = TenantConfigApplier;
+//# sourceMappingURL=TenantConfigApplier.cjs.map

package/dist/production/src/lib/tenant/TenantConfigApplier.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConfigApplier.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConfigApplier.ts"],"sourcesContent":["import { Output } from '@contember/cli-common'\nimport { authPolicyKey, describeAuthPolicy } from './authPolicy.js'\nimport { type RemoteAuthPolicy, TenantPolicyClient, TenantProjectClient } from './clients/index.js'\nimport { TenantConfig } from './tenantConfig.js'\n\nexport interface TenantConfigApplyOptions {\n\tdryRun?: boolean\n}\n\n/** The slice of the domain clients the applier drives — structural, so a test can pass a fake. */\nexport interface TenantConfigApplierClients {\n\treadonly project: Pick<TenantProjectClient, 'configure' | 'listIdentityProviders' | 'addIdp' | 'updateIdp' | 'enableIdp' | 'disableIdp'>\n\treadonly policy: Pick<\n\t\tTenantPolicyClient,\n\t\t'addMailTemplate' | 'listAuthPolicies' | 'createAuthPolicy' | 'updateAuthPolicy' | 'listCustomRoles' | 'createCustomRole' | 'updateCustomRole'\n\t>\n}\n\nexport type TenantConfigActionType =\n\t| 'configure'\n\t| 'addIdp'\n\t| 'updateIdp'\n\t| 'enableIdp'\n\t| 'disableIdp'\n\t| 'addMailTemplate'\n\t| 'createAuthPolicy'\n\t| 'updateAuthPolicy'\n\t| 'createCustomRole'\n\t| 'updateCustomRole'\n\n/** One step of the apply plan. In a dry run it is what would be done, otherwise what was done. */\nexport interface TenantConfigAction {\n\taction: TenantConfigActionType\n\ttarget: string | null\n}\n\nexport type TenantConfigWarningCode = 'UNMANAGED_AUTH_POLICY'\n\n/** Server-side state the config does not cover. Nothing is pruned, so it stays in effect. */\nexport interface TenantConfigWarning {\n\tcode: TenantConfigWarningCode\n\ttarget: string\n\tmessage: string\n}\n\n/**\n * The outcome of an apply. Warnings are returned rather than only printed: `output.warn` is silent\n * outside human mode, and an unmanaged policy is exactly what an agent running `--json` needs to see.\n */\nexport interface TenantConfigPlan {\n\tactions: TenantConfigAction[]\n\twarnings: TenantConfigWarning[]\n}\n\n/**\n * Applies a {@link TenantConfig} to a tenant idempotently:\n * - `configure` is a partial merge and is sent only when the schema maps at least one value to a database change.\n * - identity providers are added or updated based on the current state, then\n *   enabled/disabled to match `disabled`.\n * - mail templates are upserted server-side by `addMailTemplate`.\n * - auth policies are matched to existing rows by what they target (scope,\n *   project, role set) and created or updated accordingly; every policy the\n *   config does not cover is warned about, including when the config lists none.\n * - custom roles are created or updated by slug.\n *\n * Nothing is ever removed — entries missing from the config are left untouched.\n *\n * Returns the plan as data; the caller prints it. The applier itself only reports each action on stderr.\n */\nexport class TenantConfigApplier {\n\tconstructor(\n\t\tprivate readonly output: Output = new Output(),\n\t) {\n\t}\n\n\tpublic async apply(\n\t\tclients: TenantConfigApplierClients,\n\t\tconfig: TenantConfig,\n\t\toptions: TenantConfigApplyOptions = {},\n\t): Promise<TenantConfigPlan> {\n\t\tconst dryRun = options.dryRun === true\n\t\tconst actions: TenantConfigAction[] = []\n\t\tconst warnings: TenantConfigWarning[] = []\n\t\tconst warn = (code: TenantConfigWarningCode, target: string, message: string) => {\n\t\t\twarnings.push({ code, target, message })\n\t\t\tthis.output.warn(message)\n\t\t}\n\t\tconst run = async (action: TenantConfigActionType, target: string | null, execute: () => Promise<void>) => {\n\t\t\tactions.push({ action, target })\n\t\t\tif (dryRun) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// info, not progress: `tenant apply` mostly runs in CI, where a non-TTY progress line would leave no record of what was touched\n\t\t\tthis.output.info(target === null ? action : `${action}: ${target}`)\n\t\t\tawait execute()\n\t\t}\n\n\t\t// Up front, before anything has been written: two entries targeting the same\n\t\t// scope/project/roles are one policy to the applier but two rows server-side.\n\t\tassertDistinctAuthPolicies(config.authPolicies)\n\t\tconst existingAuthPolicies = config.authPolicies === undefined ? undefined : await clients.policy.listAuthPolicies()\n\t\tassertDistinctExistingAuthPolicies(existingAuthPolicies)\n\n\t\tif (config.config && hasEffectiveConfigValue(config.config)) {\n\t\t\tconst globalConfig = config.config\n\t\t\tawait run('configure', null, () => clients.project.configure(globalConfig))\n\t\t}\n\n\t\tif (config.identityProviders && Object.keys(config.identityProviders).length > 0) {\n\t\t\tconst existing = await clients.project.listIdentityProviders()\n\t\t\tconst existingBySlug = new Map(existing.map(it => [it.slug, it]))\n\n\t\t\tfor (const [slug, idp] of Object.entries(config.identityProviders)) {\n\t\t\t\tconst current = existingBySlug.get(slug)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('addIdp', slug, () => clients.project.addIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateIdp', slug, () => clients.project.updateIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t}\n\n\t\t\t\tconst wantDisabled = idp.disabled === true\n\t\t\t\tconst isDisabled = current ? current.disabledAt !== null : false\n\t\t\t\tif (wantDisabled && !isDisabled) {\n\t\t\t\t\tawait run('disableIdp', slug, () => clients.project.disableIdp(slug))\n\t\t\t\t} else if (!wantDisabled && isDisabled) {\n\t\t\t\t\tawait run('enableIdp', slug, () => clients.project.enableIdp(slug))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.mailTemplates && config.mailTemplates.length > 0) {\n\t\t\tfor (const template of config.mailTemplates) {\n\t\t\t\tconst target = `${template.type}${template.variant ? `/${template.variant}` : ''}`\n\t\t\t\tawait run('addMailTemplate', target, () => clients.policy.addMailTemplate(template))\n\t\t\t}\n\t\t}\n\n\t\t// `[]` is meaningful here, unlike for the other sections: it says \"I manage\n\t\t// policies and there are none\", which is exactly when the warning below matters.\n\t\tif (config.authPolicies) {\n\t\t\tconst existing = existingAuthPolicies ?? []\n\t\t\tconst existingByKey = new Map(existing.map(it => [authPolicyKey(it), it]))\n\t\t\tconst managedKeys = new Set(config.authPolicies.map(authPolicyKey))\n\n\t\t\tfor (const policy of config.authPolicies) {\n\t\t\t\tconst current = existingByKey.get(authPolicyKey(policy))\n\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('createAuthPolicy', target, async () => {\n\t\t\t\t\t\tawait clients.policy.createAuthPolicy(policy)\n\t\t\t\t\t})\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateAuthPolicy', target, () => clients.policy.updateAuthPolicy(current.id, policy))\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Policies are aggregated strictest-wins, so one left behind by a config\n\t\t\t// edit keeps enforcing. Nothing is pruned, but silence would hide it.\n\t\t\tfor (const policy of existing) {\n\t\t\t\tif (!managedKeys.has(authPolicyKey(policy))) {\n\t\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\t\twarn('UNMANAGED_AUTH_POLICY', target, `Auth policy ${target} exists but is not in the config; it stays in effect.`)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.customRoles && Object.keys(config.customRoles).length > 0) {\n\t\t\tconst existing = await clients.policy.listCustomRoles()\n\t\t\tconst existingSlugs = new Set(existing.map(role => role.slug))\n\t\t\tconst configuredRoles = Object.entries(config.customRoles)\n\t\t\tconst missingRoles = configuredRoles.filter(([slug]) => !existingSlugs.has(slug))\n\n\t\t\t// Create all slugs first so grants may reference roles declared later or cyclically.\n\t\t\tfor (const [slug, role] of missingRoles) {\n\t\t\t\tawait run('createCustomRole', slug, () =>\n\t\t\t\t\tclients.policy.createCustomRole(slug, {\n\t\t\t\t\t\tdescription: role.description,\n\t\t\t\t\t\tgrants: [],\n\t\t\t\t\t}))\n\t\t\t}\n\n\t\t\tfor (const [slug, role] of configuredRoles) {\n\t\t\t\tawait run('updateCustomRole', slug, () => clients.policy.updateCustomRole(slug, role))\n\t\t\t}\n\t\t}\n\n\t\treturn { actions, warnings }\n\t}\n}\n\nconst assertDistinctExistingAuthPolicies = (policies: readonly RemoteAuthPolicy[] | undefined): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Duplicate existing auth policy: ${describeAuthPolicy(policy)}. Resolve duplicate rows before applying the tenant config.`,\n\t\t\t)\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/**\n * A policy's identity is its target, so two config entries with the same\n * scope/project/roles are indistinguishable to the applier but produce two rows\n * server-side — the second of which would then be silently orphaned on the next\n * run. Cheaper to reject than to reconcile.\n */\nconst assertDistinctAuthPolicies = (policies: TenantConfig['authPolicies']): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow `Duplicate auth policy in the config: ${describeAuthPolicy(policy)}. Policies are identified by scope, project and role set.`\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/** Null clears only the fields that the tenant update command maps to a nullable database column. */\nconst nullableConfigClearPaths = new Set([\n\t'passwordless.url',\n\t'password.pattern',\n\t'login.maxTokenExpiration',\n\t'captcha.provider',\n\t'captcha.threshold',\n])\n\nconst hasEffectiveConfigValue = (value: unknown, path: readonly string[] = []): boolean => {\n\tif (value === undefined) {\n\t\treturn false\n\t}\n\tif (value === null) {\n\t\treturn nullableConfigClearPaths.has(path.join('.'))\n\t}\n\tif (typeof value !== 'object') {\n\t\treturn true\n\t}\n\treturn Object.entries(value).some(([key, item]) => hasEffectiveConfigValue(item, [...path, key]))\n}\n"],"names":["Output","authPolicyKey","describeAuthPolicy"],"mappings":";;;;AAqEO,MAAM,oBAAoB;AAAA,EAChC,YACkB,SAAiB,IAAIA,UAAAA,UACrC;AADgB,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,MACZ,SACA,QACA,UAAoC,CAAA,GACR;AAC5B,UAAM,SAAS,QAAQ,WAAW;AAClC,UAAM,UAAgC,CAAA;AACtC,UAAM,WAAkC,CAAA;AACxC,UAAM,OAAO,CAAC,MAA+B,QAAgB,YAAoB;AAChF,eAAS,KAAK,EAAE,MAAM,QAAQ,SAAS;AACvC,WAAK,OAAO,KAAK,OAAO;AAAA,IACzB;AACA,UAAM,MAAM,OAAO,QAAgC,QAAuB,YAAiC;AAC1G,cAAQ,KAAK,EAAE,QAAQ,OAAA,CAAQ;AAC/B,UAAI,QAAQ;AACX;AAAA,MACD;AAEA,WAAK,OAAO,KAAK,WAAW,OAAO,SAAS,GAAG,MAAM,KAAK,MAAM,EAAE;AAClE,YAAM,QAAA;AAAA,IACP;AAIA,+BAA2B,OAAO,YAAY;AAC9C,UAAM,uBAAuB,OAAO,iBAAiB,SAAY,SAAY,MAAM,QAAQ,OAAO,iBAAA;AAClG,uCAAmC,oBAAoB;AAEvD,QAAI,OAAO,UAAU,wBAAwB,OAAO,MAAM,GAAG;AAC5D,YAAM,eAAe,OAAO;AAC5B,YAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,YAAY,CAAC;AAAA,IAC3E;AAEA,QAAI,OAAO,qBAAqB,OAAO,KAAK,OAAO,iBAAiB,EAAE,SAAS,GAAG;AACjF,YAAM,WAAW,MAAM,QAAQ,QAAQ,sBAAA;AACvC,YAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;AAEhE,iBAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,iBAAiB,GAAG;AACnE,cAAM,UAAU,eAAe,IAAI,IAAI;AACvC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,UAAU,MAAM,MAAM,QAAQ,QAAQ,OAAO,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QACvG,OAAO;AACN,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QAC7G;AAEA,cAAM,eAAe,IAAI,aAAa;AACtC,cAAM,aAAa,UAAU,QAAQ,eAAe,OAAO;AAC3D,YAAI,gBAAgB,CAAC,YAAY;AAChC,gBAAM,IAAI,cAAc,MAAM,MAAM,QAAQ,QAAQ,WAAW,IAAI,CAAC;AAAA,QACrE,WAAW,CAAC,gBAAgB,YAAY;AACvC,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,IAAI,CAAC;AAAA,QACnE;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,iBAAiB,OAAO,cAAc,SAAS,GAAG;AAC5D,iBAAW,YAAY,OAAO,eAAe;AAC5C,cAAM,SAAS,GAAG,SAAS,IAAI,GAAG,SAAS,UAAU,IAAI,SAAS,OAAO,KAAK,EAAE;AAChF,cAAM,IAAI,mBAAmB,QAAQ,MAAM,QAAQ,OAAO,gBAAgB,QAAQ,CAAC;AAAA,MACpF;AAAA,IACD;AAIA,QAAI,OAAO,cAAc;AACxB,YAAM,WAAW,wBAAwB,CAAA;AACzC,YAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAACC,yBAAc,EAAE,GAAG,EAAE,CAAC,CAAC;AACzE,YAAM,cAAc,IAAI,IAAI,OAAO,aAAa,IAAIA,WAAAA,aAAa,CAAC;AAElE,iBAAW,UAAU,OAAO,cAAc;AACzC,cAAM,UAAU,cAAc,IAAIA,WAAAA,cAAc,MAAM,CAAC;AACvD,cAAM,SAASC,WAAAA,mBAAmB,MAAM;AACxC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,oBAAoB,QAAQ,YAAY;AACjD,kBAAM,QAAQ,OAAO,iBAAiB,MAAM;AAAA,UAC7C,CAAC;AAAA,QACF,OAAO;AACN,gBAAM,IAAI,oBAAoB,QAAQ,MAAM,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,MAAM,CAAC;AAAA,QAChG;AAAA,MACD;AAIA,iBAAW,UAAU,UAAU;AAC9B,YAAI,CAAC,YAAY,IAAID,WAAAA,cAAc,MAAM,CAAC,GAAG;AAC5C,gBAAM,SAASC,WAAAA,mBAAmB,MAAM;AACxC,eAAK,yBAAyB,QAAQ,eAAe,MAAM,uDAAuD;AAAA,QACnH;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,eAAe,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,GAAG;AACrE,YAAM,WAAW,MAAM,QAAQ,OAAO,gBAAA;AACtC,YAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAA,SAAQ,KAAK,IAAI,CAAC;AAC7D,YAAM,kBAAkB,OAAO,QAAQ,OAAO,WAAW;AACzD,YAAM,eAAe,gBAAgB,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;AAGhF,iBAAW,CAAC,MAAM,IAAI,KAAK,cAAc;AACxC,cAAM,IAAI,oBAAoB,MAAM,MACnC,QAAQ,OAAO,iBAAiB,MAAM;AAAA,UACrC,aAAa,KAAK;AAAA,UAClB,QAAQ,CAAA;AAAA,QAAC,CACT,CAAC;AAAA,MACJ;AAEA,iBAAW,CAAC,MAAM,IAAI,KAAK,iBAAiB;AAC3C,cAAM,IAAI,oBAAoB,MAAM,MAAM,QAAQ,OAAO,iBAAiB,MAAM,IAAI,CAAC;AAAA,MACtF;AAAA,IACD;AAEA,WAAO,EAAE,SAAS,SAAA;AAAA,EACnB;AACD;AAEA,MAAM,qCAAqC,CAAC,aAA4D;AACvG,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAMD,WAAAA,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,IAAI;AAAA,QACT,mCAAmCC,WAAAA,mBAAmB,MAAM,CAAC;AAAA,MAAA;AAAA,IAE/D;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAQA,MAAM,6BAA6B,CAAC,aAAiD;AACpF,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAMD,WAAAA,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,wCAAwCC,WAAAA,mBAAmB,MAAM,CAAC;AAAA,IACzE;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAGA,MAAM,+CAA+B,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,MAAM,0BAA0B,CAAC,OAAgB,OAA0B,OAAgB;AAC1F,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AACA,MAAI,UAAU,MAAM;AACnB,WAAO,yBAAyB,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,EACnD;AACA,MAAI,OAAO,UAAU,UAAU;AAC9B,WAAO;AAAA,EACR;AACA,SAAO,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,wBAAwB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACjG;;"}