@viberaven/cli 1.6.12 → 1.7.1

package/schemas/permissions-matrix.schema.json

@@ -1,90 +1,90 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://viberaven.dev/schemas/permissions-matrix.v1.json",
-  "title": "VibeRaven permissions matrix (viberaven.permissions.json)",
-  "description": "Who may read, add, change and delete rows in each table, written by a person. `viberaven rls-test` checks the migrations against it. Never generate it from the app's own policies. Every cell is about rows owned by `owner`: owner acts on their own row, other_user is a different signed-in user acting on the owner's row, anon is a request with only the public anon key. For insert, the new row names the owner as its owner.",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["version", "tables"],
-  "properties": {
-    "$schema": { "type": "string" },
-    "version": { "const": 1 },
-    "description": { "type": "string" },
-    "defaultGrants": {
-      "description": "Table grants the test database gives new public tables. supabase-legacy: anon and authenticated get all privileges on new public tables, as on existing Supabase projects (the more exposed assumption). none: no default grants, only what the migrations grant.",
-      "enum": ["supabase-legacy", "none"],
-      "default": "supabase-legacy"
-    },
-    "tables": {
-      "type": "object",
-      "minProperties": 1,
-      "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*(\\.[A-Za-z_][A-Za-z0-9_$]*)?$" },
-      "additionalProperties": { "$ref": "#/$defs/table" }
-    }
-  },
-  "$defs": {
-    "table": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["owner", "expect"],
-      "properties": {
-        "description": { "type": "string" },
-        "owner": {
-          "description": "How a row's owner is defined. Only `column = auth.uid()` is supported.",
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["column", "is"],
-          "properties": {
-            "column": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
-            "is": { "const": "auth.uid()" }
-          }
-        },
-        "expect": { "$ref": "#/$defs/expectation" },
-        "seed": {
-          "description": "Values for columns the test cannot fill by itself (for example a NOT NULL foreign key). Used for every seeded and inserted row. Leave the owner column out.",
-          "type": "object",
-          "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
-          "additionalProperties": { "type": ["string", "number", "boolean", "null"] }
-        },
-        "updateColumn": {
-          "description": "Column the update probe changes. Default: the first plain column that is not the owner column or part of the primary key.",
-          "type": "string",
-          "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$"
-        }
-      }
-    },
-    "expectation": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["owner", "other_user", "anon"],
-      "properties": {
-        "owner": { "$ref": "#/$defs/actorCells" },
-        "other_user": { "$ref": "#/$defs/actorCells" },
-        "anon": { "$ref": "#/$defs/actorCells" },
-        "service_role": {
-          "description": "The service role bypasses RLS, so it is never tested.",
-          "const": "excluded"
-        }
-      }
-    },
-    "actorCells": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["select", "insert", "update", "delete"],
-      "properties": {
-        "select": { "$ref": "#/$defs/cell" },
-        "insert": { "$ref": "#/$defs/cell" },
-        "update": { "$ref": "#/$defs/cell" },
-        "delete": { "$ref": "#/$defs/cell" },
-        "reassign": {
-          "description": "Optional. Setting the owner column of the owner's row to another user: the owner giving the row away, or another user taking it. Not tested when absent.",
-          "$ref": "#/$defs/cell"
-        }
-      }
-    },
-    "cell": {
-      "description": "allow: the action must work on the owner's row. deny: it must return nothing, change nothing, or be refused with a permission error. skip: not tested (N/A).",
-      "enum": ["allow", "deny", "skip"]
-    }
-  }
-}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://viberaven.dev/schemas/permissions-matrix.v1.json",
+  "title": "VibeRaven permissions matrix (viberaven.permissions.json)",
+  "description": "Who may read, add, change and delete rows in each table, written by a person. `viberaven rls-test` checks the migrations against it. Never generate it from the app's own policies. Every cell is about rows owned by `owner`: owner acts on their own row, other_user is a different signed-in user acting on the owner's row, anon is a request with only the public anon key. For insert, the new row names the owner as its owner.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "tables"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "version": { "const": 1 },
+    "description": { "type": "string" },
+    "defaultGrants": {
+      "description": "Table grants the test database gives new public tables. supabase-legacy: anon and authenticated get all privileges on new public tables, as on existing Supabase projects (the more exposed assumption). none: no default grants, only what the migrations grant.",
+      "enum": ["supabase-legacy", "none"],
+      "default": "supabase-legacy"
+    },
+    "tables": {
+      "type": "object",
+      "minProperties": 1,
+      "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*(\\.[A-Za-z_][A-Za-z0-9_$]*)?$" },
+      "additionalProperties": { "$ref": "#/$defs/table" }
+    }
+  },
+  "$defs": {
+    "table": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["owner", "expect"],
+      "properties": {
+        "description": { "type": "string" },
+        "owner": {
+          "description": "How a row's owner is defined. Only `column = auth.uid()` is supported.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["column", "is"],
+          "properties": {
+            "column": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
+            "is": { "const": "auth.uid()" }
+          }
+        },
+        "expect": { "$ref": "#/$defs/expectation" },
+        "seed": {
+          "description": "Values for columns the test cannot fill by itself (for example a NOT NULL foreign key). Used for every seeded and inserted row. Leave the owner column out.",
+          "type": "object",
+          "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
+          "additionalProperties": { "type": ["string", "number", "boolean", "null"] }
+        },
+        "updateColumn": {
+          "description": "Column the update probe changes. Default: the first plain column that is not the owner column or part of the primary key.",
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$"
+        }
+      }
+    },
+    "expectation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["owner", "other_user", "anon"],
+      "properties": {
+        "owner": { "$ref": "#/$defs/actorCells" },
+        "other_user": { "$ref": "#/$defs/actorCells" },
+        "anon": { "$ref": "#/$defs/actorCells" },
+        "service_role": {
+          "description": "The service role bypasses RLS, so it is never tested.",
+          "const": "excluded"
+        }
+      }
+    },
+    "actorCells": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["select", "insert", "update", "delete"],
+      "properties": {
+        "select": { "$ref": "#/$defs/cell" },
+        "insert": { "$ref": "#/$defs/cell" },
+        "update": { "$ref": "#/$defs/cell" },
+        "delete": { "$ref": "#/$defs/cell" },
+        "reassign": {
+          "description": "Optional. Setting the owner column of the owner's row to another user: the owner giving the row away, or another user taking it. Not tested when absent.",
+          "$ref": "#/$defs/cell"
+        }
+      }
+    },
+    "cell": {
+      "description": "allow: the action must work on the owner's row. deny: it must return nothing, change nothing, or be refused with a permission error. skip: not tested (N/A).",
+      "enum": ["allow", "deny", "skip"]
+    }
+  }
+}

package/schemas/verification-plan.schema.json

@@ -0,0 +1,350 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "VibeRaven local verification plan v1",
+  "type": "object",
+  "properties": {
+    "schemaVersion": {
+      "const": 1
+    },
+    "checks": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 32,
+      "items": {
+        "oneOf": [
+          {
+            "type": "object",
+            "properties": {
+              "id": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_-]{0,39}$"
+              },
+              "conditionId": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_-]{0,39}$"
+              },
+              "adapter": {
+                "const": "module"
+              },
+              "module": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 200,
+                "pattern": "^(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\\\:*?\"<>|\\u0000-\\u001f])(?!/)(?!.*//)(?!.*[. ](?:/|$))[^/]+(?:/[^/]+)*$"
+              },
+              "export": {
+                "type": "string",
+                "pattern": "^[A-Za-z_$][A-Za-z0-9_$]{0,79}$"
+              },
+              "cases": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 32,
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "args": {
+                      "type": "array",
+                      "maxItems": 16
+                    },
+                    "expected": {}
+                  },
+                  "required": [
+                    "args",
+                    "expected"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            },
+            "required": [
+              "id",
+              "conditionId",
+              "adapter",
+              "module",
+              "export",
+              "cases"
+            ],
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "properties": {
+              "id": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_-]{0,39}$"
+              },
+              "conditionId": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_-]{0,39}$"
+              },
+              "adapter": {
+                "const": "node-test"
+              },
+              "entry": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 200,
+                "pattern": "^(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\\\:*?\"<>|\\u0000-\\u001f])(?!/)(?!.*//)(?!.*[. ](?:/|$))[^/]+(?:/[^/]+)*$"
+              },
+              "frozenPaths": {
+                "type": "array",
+                "minItems": 0,
+                "maxItems": 16,
+                "uniqueItems": true,
+                "items": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 200,
+                  "pattern": "^(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\\\:*?\"<>|\\u0000-\\u001f])(?!/)(?!.*//)(?!.*[. ](?:/|$))[^/]+(?:/[^/]+)*$"
+                }
+              }
+            },
+            "required": [
+              "id",
+              "conditionId",
+              "adapter",
+              "entry",
+              "frozenPaths"
+            ],
+            "additionalProperties": false
+          },
+          {
+            "type": "object",
+            "properties": {
+              "id": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_-]{0,39}$"
+              },
+              "conditionId": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_-]{0,39}$"
+              },
+              "adapter": {
+                "const": "http"
+              },
+              "module": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 200,
+                "pattern": "^(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\\\:*?\"<>|\\u0000-\\u001f])(?!/)(?!.*//)(?!.*[. ](?:/|$))[^/]+(?:/[^/]+)*$"
+              },
+              "export": {
+                "type": "string",
+                "pattern": "^[A-Za-z_$][A-Za-z0-9_$]{0,79}$"
+              },
+              "cases": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 32,
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "request": {
+                      "type": "object",
+                      "properties": {
+                        "method": {
+                          "enum": [
+                            "GET",
+                            "HEAD",
+                            "POST",
+                            "PUT",
+                            "PATCH",
+                            "DELETE",
+                            "OPTIONS"
+                          ]
+                        },
+                        "path": {
+                          "type": "string",
+                          "minLength": 1,
+                          "maxLength": 2048,
+                          "allOf": [
+                            {
+                              "pattern": "^/(?!/)(?!.*%(?:0[0-9a-fA-F]|1[0-9a-fA-F]|20|7[fF]|5[cC]))[!-~]*$(?![\\s\\S])"
+                            },
+                            {
+                              "not": {
+                                "pattern": "[\\\\#]"
+                              }
+                            }
+                          ]
+                        },
+                        "headers": {
+                          "type": "object",
+                          "maxProperties": 8,
+                          "propertyNames": {
+                            "pattern": "^(?:accept|content-type|stripe-signature|x-(?:fixture|test)-[a-z0-9-]{1,40})$(?![\\s\\S])"
+                          },
+                          "additionalProperties": {
+                            "type": "string",
+                            "maxLength": 512,
+                            "pattern": "^[ -~]*$(?![\\s\\S])"
+                          }
+                        },
+                        "body": {
+                          "type": "string",
+                          "maxLength": 8192
+                        }
+                      },
+                      "required": [
+                        "method",
+                        "path"
+                      ],
+                      "additionalProperties": false,
+                      "allOf": [
+                        {
+                          "if": {
+                            "properties": {
+                              "method": {
+                                "enum": [
+                                  "GET",
+                                  "HEAD"
+                                ]
+                              }
+                            }
+                          },
+                          "then": {
+                            "not": {
+                              "required": [
+                                "body"
+                              ]
+                            }
+                          }
+                        }
+                      ]
+                    },
+                    "expected": {
+                      "type": "object",
+                      "properties": {
+                        "status": {
+                          "type": "integer",
+                          "minimum": 200,
+                          "maximum": 599
+                        },
+                        "json": {},
+                        "text": {
+                          "type": "string",
+                          "maxLength": 8192
+                        }
+                      },
+                      "required": [
+                        "status"
+                      ],
+                      "additionalProperties": false,
+                      "oneOf": [
+                        {
+                          "required": [
+                            "json"
+                          ],
+                          "not": {
+                            "required": [
+                              "text"
+                            ]
+                          }
+                        },
+                        {
+                          "required": [
+                            "text"
+                          ],
+                          "not": {
+                            "required": [
+                              "json"
+                            ]
+                          }
+                        }
+                      ],
+                      "allOf": [
+                        {
+                          "if": {
+                            "properties": {
+                              "status": {
+                                "enum": [
+                                  204,
+                                  205,
+                                  304
+                                ]
+                              }
+                            }
+                          },
+                          "then": {
+                            "required": [
+                              "text"
+                            ],
+                            "properties": {
+                              "text": {
+                                "const": ""
+                              }
+                            },
+                            "not": {
+                              "required": [
+                                "json"
+                              ]
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "request",
+                    "expected"
+                  ],
+                  "additionalProperties": false,
+                  "allOf": [
+                    {
+                      "if": {
+                        "properties": {
+                          "request": {
+                            "properties": {
+                              "method": {
+                                "const": "HEAD"
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "then": {
+                        "properties": {
+                          "expected": {
+                            "required": [
+                              "text"
+                            ],
+                            "properties": {
+                              "text": {
+                                "const": ""
+                              }
+                            },
+                            "not": {
+                              "required": [
+                                "json"
+                              ]
+                            }
+                          }
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            "required": [
+              "id",
+              "conditionId",
+              "adapter",
+              "module",
+              "export",
+              "cases"
+            ],
+            "additionalProperties": false
+          }
+        ]
+      }
+    }
+  },
+  "required": [
+    "schemaVersion",
+    "checks"
+  ],
+  "additionalProperties": false,
+  "description": "Reviewed local observations, not commands or imported proof. Runtime also bounds JSON depth/UTF-8 bytes, including HTTP request/expected bodies to 8192 bytes, rejects unknown condition IDs, and restricts node-test to preservation conditions and frozen test-owned paths. HTTP factories return unlistened Node servers; sequential requests observe volatile state only. Runtime package/config files remain candidate inputs. Expected values remain in the host comparator. Coverage completeness is a human judgment."
+}