@lightdash/cli 0.3387.0 → 0.3389.0

package/dist/handlers/connectSnowflake.test.js

@@ -0,0 +1,347 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@lightdash/common");
+const node_fetch_1 = require("node-fetch");
+const analytics_1 = require("../analytics/analytics");
+const connectSnowflake_1 = require("./connectSnowflake");
+vi.mock('../analytics/analytics');
+const options = {
+    code: '11111111_random-code',
+    url: 'https://lightdash.example.com/setup',
+    account: 'acme.eu-west-1',
+    user: 'lightdash_user',
+};
+const discovery = {
+    user: 'lightdash_user',
+    defaults: {
+        database: 'analytics',
+        warehouse: 'lightdash_wh',
+        role: 'lightdash_role',
+        schema: 'public',
+    },
+    inventory: {
+        databases: [
+            {
+                name: 'analytics',
+                comment: 'Analytics data',
+                kind: 'STANDARD',
+            },
+        ],
+        warehouses: [
+            {
+                name: 'lightdash_wh',
+                size: 'X-Small',
+                state: 'STARTED',
+                autoSuspendSeconds: 300,
+            },
+        ],
+        roles: [
+            { name: 'lightdash_role', isDefault: true },
+            { name: 'PUBLIC', isDefault: false },
+        ],
+        schemas: [{ databaseName: 'analytics', name: 'public' }],
+    },
+};
+const privateKey = '-----BEGIN PRIVATE KEY-----\ntest-private-key\n-----END PRIVATE KEY-----\n';
+const publicKey = 'dGVzdC1wdWJsaWMta2V5';
+const getSessionDiscovery = vi.fn();
+const getUserPublicKeySlots = vi.fn();
+const setUserPublicKey = vi.fn();
+const unsetUserPublicKey = vi.fn();
+const createProgrammaticAccessToken = vi.fn();
+const openDiagnosticConnection = vi.fn();
+const selectOneDiagnosticConnection = vi.fn();
+const closeDiagnosticConnection = vi.fn();
+const warehouseClientFactory = vi.fn(() => ({
+    closeDiagnosticConnection,
+    createProgrammaticAccessToken,
+    getSessionDiscovery,
+    getUserPublicKeySlots,
+    openDiagnosticConnection,
+    selectOneDiagnosticConnection,
+    setUserPublicKey,
+    unsetUserPublicKey,
+}));
+const fetchMock = vi.fn();
+const write = vi.fn();
+const sleep = vi.fn(async () => undefined);
+const responseForDeposit = () => new node_fetch_1.Response(JSON.stringify({ status: 'ok' }), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json' },
+});
+const getDepositRequest = () => JSON.parse(String(vi.mocked(fetchMock).mock.calls[0][1]?.body));
+const getDependencies = () => ({
+    warehouseClientFactory,
+    generateKeyPair: () => ({ privateKey, publicKey }),
+    sleep,
+    now: () => new Date('2026-07-14T12:00:00.000Z'),
+    fetch: fetchMock,
+    write,
+});
+const depositInventory = {
+    databases: [{ name: 'analytics', comment: 'Analytics data' }],
+    warehouses: [{ name: 'lightdash_wh', size: 'X-Small', state: 'STARTED' }],
+    roles: [
+        { name: 'lightdash_role', isDefault: true },
+        { name: 'PUBLIC', isDefault: false },
+    ],
+    schemas: [{ database: 'analytics', name: 'public' }],
+};
+const privateKeyCredentials = (values = {}) => ({
+    type: common_1.WarehouseTypes.SNOWFLAKE,
+    account: options.account,
+    user: discovery.user,
+    authenticationType: common_1.SnowflakeAuthenticationType.PRIVATE_KEY,
+    role: discovery.defaults.role ?? undefined,
+    database: discovery.defaults.database ?? '',
+    warehouse: discovery.defaults.warehouse ?? '',
+    schema: discovery.defaults.schema ?? '',
+    privateKey,
+    ...values,
+});
+describe('connectSnowflakeHandler', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.mocked(analytics_1.categorizeError).mockReturnValue('warehouse_connection');
+        vi.mocked(getSessionDiscovery).mockResolvedValue(discovery);
+        vi.mocked(getUserPublicKeySlots).mockResolvedValue({
+            RSA_PUBLIC_KEY: null,
+            RSA_PUBLIC_KEY_2: null,
+        });
+        vi.mocked(setUserPublicKey).mockResolvedValue(undefined);
+        vi.mocked(unsetUserPublicKey).mockResolvedValue(undefined);
+        vi.mocked(createProgrammaticAccessToken).mockResolvedValue({
+            tokenName: 'LIGHTDASH_ONBOARDING',
+            tokenSecret: 'pat-secret',
+        });
+        vi.mocked(openDiagnosticConnection).mockResolvedValue({
+            connection: {},
+        });
+        vi.mocked(selectOneDiagnosticConnection).mockResolvedValue(undefined);
+        vi.mocked(closeDiagnosticConnection).mockResolvedValue(undefined);
+        vi.mocked(fetchMock).mockResolvedValue(responseForDeposit());
+    });
+    it('deposits private-key credentials using session defaults', async () => {
+        await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).resolves.toBeUndefined();
+        expect(warehouseClientFactory).toHaveBeenNthCalledWith(1, {
+            type: common_1.WarehouseTypes.SNOWFLAKE,
+            account: options.account,
+            user: options.user,
+            authenticationType: common_1.SnowflakeAuthenticationType.OAUTH_AUTHORIZATION_CODE,
+            role: undefined,
+            database: '',
+            warehouse: '',
+            schema: '',
+        });
+        expect(getSessionDiscovery).toHaveBeenCalledWith(options.user);
+        expect(setUserPublicKey).toHaveBeenCalledWith(discovery.user, 'RSA_PUBLIC_KEY', publicKey);
+        expect(warehouseClientFactory).toHaveBeenNthCalledWith(2, privateKeyCredentials({
+            database: '',
+            warehouse: '',
+            schema: '',
+            role: undefined,
+        }));
+        const request = {
+            code: options.code,
+            credentials: privateKeyCredentials(),
+            inventory: depositInventory,
+        };
+        expect(getDepositRequest()).toEqual(request);
+        expect(write).toHaveBeenCalledWith('Secured with a key pair');
+        expect(write).toHaveBeenCalledWith('Connection values resolved: database (session default), warehouse (session default), schema (session default), role (session default)');
+        expect(write).not.toHaveBeenCalledWith(expect.stringContaining(options.code));
+        expect(write).not.toHaveBeenCalledWith(expect.stringContaining(privateKey));
+        const { LightdashAnalytics } = await Promise.resolve().then(() => __importStar(require('../analytics/analytics')));
+        expect(vi.mocked(LightdashAnalytics.track)).toHaveBeenCalledWith({
+            event: 'connect_snowflake.started',
+            properties: {},
+        });
+        expect(vi.mocked(LightdashAnalytics.track)).toHaveBeenCalledWith({
+            event: 'connect_snowflake.completed',
+            properties: { method: 'key_pair' },
+        });
+    });
+    it('prefers explicit flags over session defaults', async () => {
+        const overrideOptions = {
+            ...options,
+            database: 'flag_db',
+            warehouse: 'flag_wh',
+            role: 'flag_role',
+            schema: 'flag_schema',
+        };
+        await expect((0, connectSnowflake_1.connectSnowflakeHandler)(overrideOptions, getDependencies())).resolves.toBeUndefined();
+        const request = {
+            code: options.code,
+            credentials: privateKeyCredentials({
+                database: 'flag_db',
+                warehouse: 'flag_wh',
+                role: 'flag_role',
+                schema: 'flag_schema',
+            }),
+            inventory: depositInventory,
+        };
+        expect(getDepositRequest()).toEqual(request);
+        expect(write).toHaveBeenCalledWith('Connection values resolved: database (flag), warehouse (flag), schema (flag), role (flag)');
+    });
+    it('omits missing values and deposits capped inventory names', async () => {
+        const inventoryNames = Array.from({ length: 105 }, (_, index) => `item_${index}`);
+        vi.mocked(getSessionDiscovery).mockResolvedValue({
+            ...discovery,
+            defaults: {
+                database: null,
+                warehouse: null,
+                role: null,
+                schema: null,
+            },
+            inventory: {
+                databases: inventoryNames.map((name) => ({
+                    name,
+                    comment: null,
+                    kind: null,
+                })),
+                warehouses: inventoryNames.map((name) => ({
+                    name,
+                    size: null,
+                    state: null,
+                    autoSuspendSeconds: null,
+                })),
+                roles: inventoryNames.map((name) => ({
+                    name,
+                    isDefault: false,
+                })),
+                schemas: inventoryNames.map((name) => ({
+                    databaseName: 'analytics',
+                    name,
+                })),
+            },
+        });
+        await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).resolves.toBeUndefined();
+        const request = getDepositRequest();
+        expect(request.credentials).not.toHaveProperty('database');
+        expect(request.credentials).not.toHaveProperty('warehouse');
+        expect(request.credentials).not.toHaveProperty('schema');
+        expect(request.credentials).not.toHaveProperty('role');
+        expect(request.inventory).toEqual({
+            databases: inventoryNames
+                .slice(0, 100)
+                .map((name) => ({ name, comment: null })),
+            warehouses: inventoryNames
+                .slice(0, 100)
+                .map((name) => ({ name, size: null, state: null })),
+            roles: inventoryNames
+                .slice(0, 100)
+                .map((name) => ({ name, isDefault: false })),
+            schemas: inventoryNames
+                .slice(0, 1000)
+                .map((name) => ({ database: 'analytics', name })),
+        });
+        expect(write).toHaveBeenCalledWith('Connection values resolved: none');
+        expect(write).toHaveBeenCalledWith('Finish choosing database, warehouse, schema, role in the browser.');
+    });
+    it('selects the first free Snowflake public-key slot', async () => {
+        vi.mocked(getUserPublicKeySlots).mockResolvedValue({
+            RSA_PUBLIC_KEY: 'SHA256:existing-key',
+            RSA_PUBLIC_KEY_2: null,
+        });
+        await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).resolves.toBeUndefined();
+        expect(setUserPublicKey).toHaveBeenCalledWith(discovery.user, 'RSA_PUBLIC_KEY_2', publicKey);
+        expect(createProgrammaticAccessToken).not.toHaveBeenCalled();
+    });
+    it('uses the stable PAT name for collision replacement when both key slots are occupied', async () => {
+        vi.mocked(getUserPublicKeySlots).mockResolvedValue({
+            RSA_PUBLIC_KEY: 'SHA256:existing-key-1',
+            RSA_PUBLIC_KEY_2: 'SHA256:existing-key-2',
+        });
+        await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).resolves.toBeUndefined();
+        expect(setUserPublicKey).not.toHaveBeenCalled();
+        expect(createProgrammaticAccessToken).toHaveBeenCalledWith('LIGHTDASH_ONBOARDING', 365, 1440);
+        const request = {
+            code: options.code,
+            credentials: {
+                type: common_1.WarehouseTypes.SNOWFLAKE,
+                account: options.account,
+                user: discovery.user,
+                authenticationType: common_1.SnowflakeAuthenticationType.PASSWORD,
+                role: discovery.defaults.role ?? undefined,
+                database: discovery.defaults.database ?? '',
+                warehouse: discovery.defaults.warehouse ?? '',
+                schema: discovery.defaults.schema ?? '',
+                password: 'pat-secret',
+            },
+            inventory: depositInventory,
+        };
+        expect(getDepositRequest()).toEqual(request);
+    });
+    it('unsets an unverified key before falling back to a PAT', async () => {
+        vi.mocked(openDiagnosticConnection).mockRejectedValue(new Error('Authentication policy excludes KEYPAIR'));
+        await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).resolves.toBeUndefined();
+        expect(openDiagnosticConnection).toHaveBeenCalledTimes(3);
+        expect(sleep).toHaveBeenCalledTimes(2);
+        expect(sleep).toHaveBeenCalledWith(5_000);
+        expect(unsetUserPublicKey).toHaveBeenCalledWith(discovery.user, 'RSA_PUBLIC_KEY');
+        expect(createProgrammaticAccessToken).toHaveBeenCalledAfter(unsetUserPublicKey);
+    });
+    it('falls back to a PAT when key registration lacks privileges', async () => {
+        vi.mocked(setUserPublicKey).mockRejectedValue(new Error('Insufficient privileges to operate on user'));
+        await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).resolves.toBeUndefined();
+        expect(createProgrammaticAccessToken).toHaveBeenCalledWith('LIGHTDASH_ONBOARDING', 365, 1440);
+        expect(write).toHaveBeenCalledWith('Secured with a programmatic access token (expires 2027-07-14)');
+    });
+    it('prints administrator remediation when both durable paths fail', async () => {
+        vi.mocked(setUserPublicKey).mockRejectedValue(new Error('Insufficient privileges'));
+        vi.mocked(createProgrammaticAccessToken).mockRejectedValue(new Error('Authentication policy does not allow PROGRAMMATIC_ACCESS_TOKEN'));
+        await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).rejects.toThrow('Snowflake programmatic access token creation failed');
+        expect(write).toHaveBeenCalledWith('GRANT MODIFY PROGRAMMATIC AUTHENTICATION METHODS ON USER lightdash_user TO ROLE lightdash_role;');
+        expect(write).toHaveBeenCalledWith(expect.stringContaining('PROGRAMMATIC_ACCESS_TOKEN'));
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+    it('reports an expired connect code without exposing it', async () => {
+        vi.mocked(fetchMock).mockResolvedValue(new node_fetch_1.Response(JSON.stringify({ status: 'error' }), {
+            status: 404,
+            headers: { 'Content-Type': 'application/json' },
+        }));
+        await expect((0, connectSnowflake_1.connectSnowflakeHandler)(options, getDependencies())).rejects.toThrow(common_1.WarehouseConnectionError);
+        expect(write).not.toHaveBeenCalledWith(expect.stringContaining(options.code));
+        const { LightdashAnalytics } = await Promise.resolve().then(() => __importStar(require('../analytics/analytics')));
+        expect(vi.mocked(LightdashAnalytics.track)).toHaveBeenCalledWith({
+            event: 'connect_snowflake.error',
+            properties: {
+                error: expect.any(String),
+                errorCategory: 'warehouse_connection',
+            },
+        });
+    });
+});

package/dist/handlers/organizationContent/customRoles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"customRoles.d.ts","sourceRoot":"","sources":["../../../src/handlers/organizationContent/customRoles.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,uBAAuB,EAAE,CAAC;CACvC,CAAC;AAgBF,eAAO,MAAM,oBAAoB,GAAI,yBAAyB,MAAM,KAAG,MACjB,CAAC;AAEvD,eAAO,MAAM,6BAA6B,GACtC,SAAS,uBAAuB,KACjC,MACmH,CAAC;AAoGvH,eAAO,MAAM,mBAAmB,GAC5B,yBAAyB,MAAM,KAChC,OAAO,CAAC,OAAO,EAAE,CAUnB,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC1B,kBAAkB,MAAM,EACxB,yBAAyB,MAAM,KAChC,OAAO,CAAC,uBAAuB,CA6CjC,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC5B,kBAAkB,MAAM,EACxB,yBAAyB,MAAM,KAChC,OAAO,CAAC,MAAM,CAqDhB,CAAC"}
+{"version":3,"file":"customRoles.d.ts","sourceRoot":"","sources":["../../../src/handlers/organizationContent/customRoles.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,uBAAuB,EAAE,CAAC;CACvC,CAAC;AAgBF,eAAO,MAAM,oBAAoB,GAAI,yBAAyB,MAAM,KAAG,MACjB,CAAC;AAEvD,eAAO,MAAM,6BAA6B,GACtC,SAAS,uBAAuB,KACjC,MACmH,CAAC;AAkFvH,eAAO,MAAM,mBAAmB,GAC5B,yBAAyB,MAAM,KAChC,OAAO,CAAC,OAAO,EAAE,CAUnB,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC1B,kBAAkB,MAAM,EACxB,yBAAyB,MAAM,KAChC,OAAO,CAAC,uBAAuB,CA6CjC,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAC5B,kBAAkB,MAAM,EACxB,yBAAyB,MAAM,KAChC,OAAO,CAAC,MAAM,CAiChB,CAAC"}

package/dist/handlers/organizationContent/customRoles.js

@@ -4,13 +4,12 @@ exports.downloadCustomRoles = exports.uploadCustomRoles = exports.readCustomRole
 const tslib_1 = require("tslib");
 /* eslint-disable no-await-in-loop */
 const common_1 = require("@lightdash/common");
-const crypto_1 = require("crypto");
 const fs_1 = require("fs");
 const yaml = tslib_1.__importStar(require("js-yaml"));
 const groupBy_1 = tslib_1.__importDefault(require("lodash/groupBy"));
 const path = tslib_1.__importStar(require("path"));
 const apiClient_1 = require("../dbt/apiClient");
-const CUSTOM_ROLE_FILENAME_MAX_LENGTH = 200;
+const fileNames_1 = require("./fileNames");
 const getCustomRolesFolder = (organizationContentPath) => path.join(organizationContentPath, 'custom-roles');
 exports.getCustomRolesFolder = getCustomRolesFolder;
 const formatCustomRoleUploadSummary = (summary) => `${summary.created} created, ${summary.updated} updated, ${summary.unchanged} unchanged, ${summary.failed} failed`;
@@ -23,19 +22,6 @@ const getCustomRoleName = (role) => {
         ? role.name
         : undefined;
 };
-const getCustomRoleFilenameBase = (name) => {
-    const slug = name
-        .normalize('NFKD')
-        .replace(/[\u0300-\u036f]/g, '')
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '');
-    const nameHash = (0, crypto_1.createHash)('sha256')
-        .update(name)
-        .digest('hex')
-        .slice(0, 8);
-    return (slug || `role-${nameHash}`).slice(0, CUSTOM_ROLE_FILENAME_MAX_LENGTH);
-};
 const readCustomRoleFileResults = async (organizationContentPath) => {
     const folder = (0, exports.getCustomRolesFolder)(organizationContentPath);
     let entries;
@@ -153,22 +139,12 @@ const downloadCustomRoles = async (organizationUuid, organizationContentPath) =>
     await Promise.all(existingFiles
         .filter((entry) => entry.isFile() && entry.name.endsWith('.yml'))
         .map((entry) => fs_1.promises.unlink(path.join(folder, entry.name))));
-    const filenameBases = customRoles.map(({ name }) => getCustomRoleFilenameBase(name));
-    const baseCounts = filenameBases.reduce((counts, filenameBase) => ({
-        ...counts,
-        [filenameBase]: (counts[filenameBase] ?? 0) + 1,
-    }), {});
+    const filenames = (0, fileNames_1.getOrganizationContentFileNames)({
+        values: customRoles.map(({ name }) => name),
+        fallbackPrefix: 'role',
+    });
     await Promise.all(customRoles.map(async (role, index) => {
-        const filenameBase = filenameBases[index];
-        const collisionSuffix = `-${(0, crypto_1.createHash)('sha256')
-            .update(role.name)
-            .digest('hex')
-            .slice(0, 8)}`;
-        const uniqueFilenameBase = baseCounts[filenameBase] > 1
-            ? `${filenameBase.slice(0, CUSTOM_ROLE_FILENAME_MAX_LENGTH -
-                collisionSuffix.length)}${collisionSuffix}`
-            : filenameBase;
-        await fs_1.promises.writeFile(path.join(folder, `${uniqueFilenameBase}.yml`), yaml.dump(role, { quotingType: '"', sortKeys: true }));
+        await fs_1.promises.writeFile(path.join(folder, filenames[index]), yaml.dump(role, { quotingType: '"', sortKeys: true }));
     }));
     return customRoles.length;
 };

package/dist/handlers/organizationContent/fileNames.d.ts

@@ -0,0 +1,5 @@
+export declare const getOrganizationContentFileNames: ({ values, fallbackPrefix, }: {
+    values: string[];
+    fallbackPrefix: string;
+}) => string[];
+//# sourceMappingURL=fileNames.d.ts.map

package/dist/handlers/organizationContent/fileNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileNames.d.ts","sourceRoot":"","sources":["../../../src/handlers/organizationContent/fileNames.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,+BAA+B,GAAI,6BAG7C;IACC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CAC1B,KAAG,MAAM,EAsBT,CAAC"}

package/dist/handlers/organizationContent/fileNames.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOrganizationContentFileNames = void 0;
+const common_1 = require("@lightdash/common");
+const crypto_1 = require("crypto");
+const ORGANIZATION_CONTENT_FILENAME_MAX_LENGTH = 200;
+const FILENAME_HASH_LENGTH = 8;
+const getStableHash = (value) => (0, crypto_1.createHash)('sha256')
+    .update(value)
+    .digest('hex')
+    .slice(0, FILENAME_HASH_LENGTH);
+const getFilenameBase = (value, fallbackPrefix) => {
+    const normalizedValue = value
+        .normalize('NFKD')
+        .replace(/[\u0300-\u036f]/g, '');
+    const slug = /[a-z0-9]/i.test(normalizedValue)
+        ? (0, common_1.generateSlug)(normalizedValue)
+        : `${fallbackPrefix}-${getStableHash(value)}`;
+    return slug.slice(0, ORGANIZATION_CONTENT_FILENAME_MAX_LENGTH);
+};
+const getOrganizationContentFileNames = ({ values, fallbackPrefix, }) => {
+    const filenameBases = values.map((value) => getFilenameBase(value, fallbackPrefix));
+    const baseCounts = filenameBases.reduce((counts, filenameBase) => counts.set(filenameBase, (counts.get(filenameBase) ?? 0) + 1), new Map());
+    return filenameBases.map((filenameBase, index) => {
+        if ((baseCounts.get(filenameBase) ?? 0) === 1) {
+            return `${filenameBase}.yml`;
+        }
+        const collisionSuffix = `-${getStableHash(values[index])}`;
+        const uniqueFilenameBase = `${filenameBase.slice(0, ORGANIZATION_CONTENT_FILENAME_MAX_LENGTH - collisionSuffix.length)}${collisionSuffix}`;
+        return `${uniqueFilenameBase}.yml`;
+    });
+};
+exports.getOrganizationContentFileNames = getOrganizationContentFileNames;

package/dist/handlers/organizationContent/fileNames.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=fileNames.test.d.ts.map

package/dist/handlers/organizationContent/fileNames.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileNames.test.d.ts","sourceRoot":"","sources":["../../../src/handlers/organizationContent/fileNames.test.ts"],"names":[],"mappings":""}

package/dist/handlers/organizationContent/fileNames.test.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = require("crypto");
+const fileNames_1 = require("./fileNames");
+describe('organization content filenames', () => {
+    it('uses generateSlug with normalized accents', () => {
+        expect((0, fileNames_1.getOrganizationContentFileNames)({
+            values: ['Málaga Finance'],
+            fallbackPrefix: 'group',
+        })).toStrictEqual(['malaga-finance.yml']);
+    });
+    it('uses a deterministic hash when no slug can be generated', () => {
+        const value = '🎉';
+        const hash = (0, crypto_1.createHash)('sha256')
+            .update(value)
+            .digest('hex')
+            .slice(0, 8);
+        expect((0, fileNames_1.getOrganizationContentFileNames)({
+            values: [value],
+            fallbackPrefix: 'group',
+        })).toStrictEqual([`group-${hash}.yml`]);
+    });
+    it('adds stable hashes when different values generate the same slug', () => {
+        const values = ['Finance?', 'Finance!'];
+        expect((0, fileNames_1.getOrganizationContentFileNames)({
+            values,
+            fallbackPrefix: 'group',
+        })).toStrictEqual(values.map((value) => {
+            const hash = (0, crypto_1.createHash)('sha256')
+                .update(value)
+                .digest('hex')
+                .slice(0, 8);
+            return `finance-${hash}.yml`;
+        }));
+    });
+});

package/dist/handlers/organizationContent/groups.d.ts

@@ -0,0 +1,18 @@
+export type GroupUploadFailure = {
+    message: string;
+};
+export type GroupUploadSummary = {
+    created: number;
+    updated: number;
+    unchanged: number;
+    failed: number;
+    dependencySkipped: number;
+    failures: GroupUploadFailure[];
+};
+export declare const getGroupsFolder: (organizationContentPath: string) => string;
+export declare const formatGroupUploadSummary: (summary: GroupUploadSummary) => string;
+export declare const readGroupFiles: (organizationContentPath: string) => Promise<unknown[]>;
+export declare const countDependencySkippedGroups: (organizationContentPath: string) => Promise<number>;
+export declare const uploadGroups: (organizationUuid: string, organizationContentPath: string) => Promise<GroupUploadSummary>;
+export declare const downloadGroups: (organizationUuid: string, organizationContentPath: string) => Promise<number>;
+//# sourceMappingURL=groups.d.ts.map

package/dist/handlers/organizationContent/groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../../src/handlers/organizationContent/groups.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,kBAAkB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAClC,CAAC;AAgBF,eAAO,MAAM,eAAe,GAAI,yBAAyB,MAAM,KAAG,MAClB,CAAC;AAEjD,eAAO,MAAM,wBAAwB,GAAI,SAAS,kBAAkB,KAAG,MACgG,CAAC;AAiFxK,eAAO,MAAM,cAAc,GACvB,yBAAyB,MAAM,KAChC,OAAO,CAAC,OAAO,EAAE,CAUnB,CAAC;AAEF,eAAO,MAAM,4BAA4B,GACrC,yBAAyB,MAAM,KAChC,OAAO,CAAC,MAAM,CAahB,CAAC;AAEF,eAAO,MAAM,YAAY,GACrB,kBAAkB,MAAM,EACxB,yBAAyB,MAAM,KAChC,OAAO,CAAC,kBAAkB,CA8C5B,CAAC;AAEF,eAAO,MAAM,cAAc,GACvB,kBAAkB,MAAM,EACxB,yBAAyB,MAAM,KAChC,OAAO,CAAC,MAAM,CAuChB,CAAC"}