@pylonsync/sdk 0.3.385 → 0.4.1

package/dist/index.d.ts

@@ -769,6 +769,12 @@ export declare function policiesToManifest(policies: PolicyDefinition[]): Manife
  * })
  */
 export type AuthConfig = {
+    /**
+     * Additional organization role slugs. Built-ins (`owner`, `admin`,
+     * `member`) remain available. Custom roles are exact-match labels and do
+     * not inherit member/admin permissions.
+     */
+    orgRoles?: string[];
     user?: {
         /** Manifest entity name pylon treats as the User table. Default `"User"`. */
         entity?: string;
@@ -953,6 +959,7 @@ export type ManifestAuthConfig = {
         invite_entity: string;
         disabled: boolean;
     };
+    org_roles: string[];
     trusted_origins: string[];
 };
 /**
@@ -971,7 +978,7 @@ export declare function buildManifest(options: {
     queries?: QueryDefinition[];
     actions?: ActionDefinition[];
     policies?: PolicyDefinition[];
-    auth?: ManifestAuthConfig;
+    auth?: ManifestAuthConfig | AuthConfig;
     llm?: ManifestLlmConfig;
     connections?: ManifestConnection[];
     crons?: ManifestCron[];

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.385",
+  "version": "0.4.1",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./dist/index.d.ts",

package/src/index.ts

@@ -1408,6 +1408,12 @@ export function policiesToManifest(
  * })
  */
 export type AuthConfig = {
+  /**
+   * Additional organization role slugs. Built-ins (`owner`, `admin`,
+   * `member`) remain available. Custom roles are exact-match labels and do
+   * not inherit member/admin permissions.
+   */
+  orgRoles?: string[];
   user?: {
     /** Manifest entity name pylon treats as the User table. Default `"User"`. */
     entity?: string;
@@ -1621,9 +1627,34 @@ export type ManifestAuthConfig = {
     invite_entity: string;
     disabled: boolean;
   };
+  org_roles: string[];
   trusted_origins: string[];
 };
 
+const BUILTIN_ORG_ROLES = new Set(["owner", "admin", "member"]);
+const ORG_ROLE_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+
+function validateOrgRoles(roles: string[]): string[] {
+  const seen = new Set<string>();
+  return roles.map((role) => {
+    if (!ORG_ROLE_PATTERN.test(role)) {
+      throw new Error(
+        `Invalid organization role "${role}". Roles must match ${ORG_ROLE_PATTERN}`,
+      );
+    }
+    if (BUILTIN_ORG_ROLES.has(role)) {
+      throw new Error(
+        `Organization role "${role}" is built in and must not be redeclared`,
+      );
+    }
+    if (seen.has(role)) {
+      throw new Error(`Duplicate organization role "${role}"`);
+    }
+    seen.add(role);
+    return role;
+  });
+}
+
 /**
  * Build the manifest's `auth` block from the user-facing camelCase
  * config. Translates to the snake_case shape the Rust runtime expects.
@@ -1653,10 +1684,17 @@ export function auth(cfg: AuthConfig = {}): ManifestAuthConfig {
       invite_entity: cfg.org?.inviteEntity ?? "OrgInvite",
       disabled: cfg.org?.disabled ?? false,
     },
+    org_roles: validateOrgRoles(cfg.orgRoles ?? []),
     trusted_origins: cfg.trustedOrigins ?? [],
   };
 }
 
+function isManifestAuthConfig(
+  cfg: ManifestAuthConfig | AuthConfig,
+): cfg is ManifestAuthConfig {
+  return "trusted_origins" in cfg;
+}
+
 export function buildManifest(options: {
   name: string;
   version: string;
@@ -1665,7 +1703,7 @@ export function buildManifest(options: {
   queries?: QueryDefinition[];
   actions?: ActionDefinition[];
   policies?: PolicyDefinition[];
-  auth?: ManifestAuthConfig;
+  auth?: ManifestAuthConfig | AuthConfig;
   llm?: ManifestLlmConfig;
   connections?: ManifestConnection[];
   crons?: ManifestCron[];
@@ -1707,7 +1745,11 @@ export function buildManifest(options: {
     queries: queriesToManifest(options.queries ?? []),
     actions: actionsToManifest(options.actions ?? []),
     policies: policiesToManifest(allPolicies),
-    auth: options.auth ?? auth(),
+    auth: options.auth
+      ? isManifestAuthConfig(options.auth)
+        ? options.auth
+        : auth(options.auth)
+      : auth(),
     ...(options.llm && Object.keys(options.llm).length > 0
       ? { llm: options.llm }
       : {}),

package/src/sdk.types.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { buildManifest, entity, field } from "./index";
+import { auth, buildManifest, entity, field } from "./index";
 
 /**
  * The shape callers actually hit.
@@ -67,3 +67,38 @@ describe("entity() sync option", () => {
       .toBe(false);
   });
 });
+
+describe("custom organization roles", () => {
+  const base = {
+    name: "roles",
+    version: "1",
+    entities: [],
+    policies: [],
+    routes: [],
+  };
+
+  test("buildManifest accepts the concise auth.orgRoles form", () => {
+    const manifest = buildManifest({
+      ...base,
+      auth: { orgRoles: ["reviewer", "speaker_manager"] },
+    });
+    expect(manifest.auth?.org_roles).toEqual([
+      "reviewer",
+      "speaker_manager",
+    ]);
+  });
+
+  test("the auth() helper emits the same role allowlist", () => {
+    expect(auth({ orgRoles: ["billing"] }).org_roles).toEqual(["billing"]);
+  });
+
+  test("invalid, duplicate, and redeclared built-in roles fail clearly", () => {
+    expect(() => auth({ orgRoles: ["Reviewer"] })).toThrow(
+      "Invalid organization role",
+    );
+    expect(() => auth({ orgRoles: ["reviewer", "reviewer"] })).toThrow(
+      "Duplicate organization role",
+    );
+    expect(() => auth({ orgRoles: ["member"] })).toThrow("is built in");
+  });
+});