@zveltio/cli 3.0.0-beta.78 → 3.0.0-beta.80

package/dist/index.js

@@ -4028,7 +4028,7 @@ var CORE_FIELD_TS_TYPES = {
   smallint: "number",
   real: "number",
   decimal: "number",
-  money: "number",
+  money: "string",
   varchar: "string",
   char: "string",
   time: "string",
@@ -4042,12 +4042,12 @@ var CORE_FIELD_TS_TYPES = {
   xml: "string",
   bit: "string",
   varbit: "string",
-  int4range: "{ lower: number; upper: number }",
-  int8range: "{ lower: number; upper: number }",
-  numrange: "{ lower: number; upper: number }",
-  daterange: "{ lower: string; upper: string }",
-  tsrange: "{ lower: string; upper: string }",
-  tstzrange: "{ lower: string; upper: string }"
+  int4range: "string",
+  int8range: "string",
+  numrange: "string",
+  daterange: "string",
+  tsrange: "string",
+  tstzrange: "string"
 };
 function emitCollectionTypes(collection, tsTypeOf = (t) => CORE_FIELD_TS_TYPES[t]) {
   const typeName = collection.name.charAt(0).toUpperCase() + collection.name.slice(1);
@@ -4146,7 +4146,7 @@ import { join as join10 } from "path";
 
 // ../sdk/dist/validate/migration-parse.js
 function parseMigrationSql(raw) {
-  const downIdx = raw.search(/^--\s*DOWN\b/im);
+  const downIdx = raw.search(/^--\s*DOWN\s*$/im);
   if (downIdx < 0) {
     return { up: raw.trim(), down: null };
   }
@@ -4374,6 +4374,7 @@ var SHARED_MESSAGE_KEYS = new Set([
 ]);
 
 // ../sdk/dist/validate/index.js
+var CREDENTIAL_HEADERS = ["authorization", "cookie", "proxy-authorization", "x-api-key"];
 var SEMVER_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/;
 var KNOWN_CATEGORIES = new Set([
   "auth",
@@ -4464,13 +4465,38 @@ function validateManifest(input) {
     }
   }
   if (obj.apiKeyRoutes !== undefined) {
-    const routes = Array.isArray(obj.apiKeyRoutes) ? obj.apiKeyRoutes : [obj.apiKeyRoutes];
+    const routes = Array.isArray(obj.apiKeyRoutes) ? obj.apiKeyRoutes : [];
+    if (!Array.isArray(obj.apiKeyRoutes)) {
+      out.push(err("MANIFEST_BAD_API_KEY_ROUTE", '"apiKeyRoutes" must be an array'));
+    }
     for (const r of routes) {
       if (typeof r !== "string" || !/^(GET|POST|PUT|PATCH|DELETE) \S+$/.test(r)) {
         out.push(err("MANIFEST_BAD_API_KEY_ROUTE", `apiKeyRoutes entry ${JSON.stringify(r)} must be "<GET|POST|PUT|PATCH|DELETE> <pattern>"`));
       }
     }
   }
+  if (obj.forwardCredentials !== undefined) {
+    const fwd = obj.forwardCredentials;
+    const publicRoutes = Array.isArray(obj.publicRoutes) ? obj.publicRoutes : [];
+    if (!fwd || typeof fwd !== "object" || Array.isArray(fwd)) {
+      out.push(err("MANIFEST_BAD_FORWARD_CREDENTIALS", '"forwardCredentials" must map a route to headers'));
+    } else {
+      for (const [route, names] of Object.entries(fwd)) {
+        if (!publicRoutes.includes(route)) {
+          out.push(err("MANIFEST_BAD_FORWARD_CREDENTIALS", `forwardCredentials names "${route}", which is not a publicRoutes entry`));
+        }
+        if (!Array.isArray(names)) {
+          out.push(err("MANIFEST_BAD_FORWARD_CREDENTIALS", `forwardCredentials "${route}" must be an array of header names`));
+          continue;
+        }
+        for (const n of names) {
+          if (typeof n !== "string" || !CREDENTIAL_HEADERS.includes(n)) {
+            out.push(err("MANIFEST_BAD_FORWARD_CREDENTIALS", `forwardCredentials "${route}": ${JSON.stringify(n)} is not one of ${CREDENTIAL_HEADERS.join(", ")}`));
+          }
+        }
+      }
+    }
+  }
   if (typeof obj.category === "string" && !KNOWN_CATEGORIES.has(obj.category)) {
     out.push(warn("MANIFEST_UNKNOWN_CATEGORY", `category "${obj.category}" isn't in the known set \u2014 typo? Known: ${[...KNOWN_CATEGORIES].sort().join(", ")}`));
   }
@@ -6041,7 +6067,7 @@ function typesFromFiles(collection, dir, outputPath) {
 
 // src/commands/schema.ts
 import { existsSync as existsSync16, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join15 } from "path";
+import { dirname as dirname5, join as join15, resolve as resolve4, sep } from "path";
 import { createInterface as createInterface2 } from "readline";
 async function schemaPullCommand(opts) {
   const dir = opts.dir || "./schema";
@@ -6057,8 +6083,17 @@ async function schemaPullCommand(opts) {
     process.exit(1);
   }
   const { files } = await res.json();
-  for (const [path, content] of Object.entries(files)) {
-    const target = join15(dir, path);
+  const root = resolve4(dir);
+  const inside = root.endsWith(sep) ? root : root + sep;
+  const writes = Object.entries(files).map(([path, content]) => {
+    const target = resolve4(root, path);
+    if (!target.startsWith(inside)) {
+      console.error(`Schema export named a path outside ${dir}: ${path}`);
+      process.exit(1);
+    }
+    return [target, content];
+  });
+  for (const [target, content] of writes) {
     mkdirSync6(dirname5(target), { recursive: true });
     writeFileSync6(target, content);
   }
@@ -6090,18 +6125,24 @@ function readSchemaDir(dir) {
   }
   return files;
 }
-async function postSchema(engineUrl, route, files, allowDestructive = false) {
+async function postSchema(engineUrl, route, files, allowDestructive = false, adoptRules = false) {
   const res = await fetch(`${engineUrl}/api/admin/schema/${route}`, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${process.env.ZVELTIO_API_KEY || ""}`,
       "Content-Type": "application/json"
     },
-    body: JSON.stringify({ files, allowDestructive })
+    body: JSON.stringify({ files, allowDestructive, ...adoptRules ? { adopt_rules: true } : {} })
   });
   if (!res.ok) {
     const body = await res.json().catch(() => null);
     console.error(`Schema ${route} failed: ${res.status} ${body?.detail ?? res.statusText}`);
+    if (body?.code === "existing_rules") {
+      for (const r of body.errors ?? []) {
+        console.error(`  ${r.object}: ${r.subject} ${r.action} in ${r.domain}`);
+      }
+      console.error("  Delete these rules, or rerun with --adopt-rules to keep them on the new collection.");
+    }
     if (res.status === 401 || res.status === 403) {
       console.error("  Set ZVELTIO_API_KEY to a key of an instance admin.");
     }
@@ -6146,15 +6187,15 @@ The plan has destructive steps; nothing was changed. Rerun with --allow-destruct
   }
   if (!opts.yes) {
     const rl2 = createInterface2({ input: process.stdin, output: process.stdout });
-    const answer = await new Promise((resolve4) => rl2.question(`
-Apply these changes? Type "yes" to continue: `, resolve4));
+    const answer = await new Promise((resolve5) => rl2.question(`
+Apply these changes? Type "yes" to continue: `, resolve5));
     rl2.close();
     if (answer.trim().toLowerCase() !== "yes") {
       console.log("Cancelled; nothing was changed.");
       return;
     }
   }
-  const applied = await postSchema(engineUrl, "apply", files, opts.allowDestructive);
+  const applied = await postSchema(engineUrl, "apply", files, opts.allowDestructive, opts.adoptRules);
   console.log(`Applied ${applied.length} change(s).`);
 }
 
@@ -6171,7 +6212,7 @@ async function installCommand(name, opts) {
     await installFromPath(name, opts.path, engineUrl, opts.force ?? false);
     return;
   }
-  await installFromCatalog(name, engineUrl);
+  await installFromCatalog(name, engineUrl, opts.approveForwardCredentials ?? false);
 }
 async function installFromPath(name, sourcePath, engineUrl, force) {
   if (!existsSync17(join16(sourcePath, "manifest.json"))) {
@@ -6233,7 +6274,7 @@ async function installFromPath(name, sourcePath, engineUrl, force) {
   console.log(`  ZVELTIO_EXTENSIONS=...,${category}/${extName}
 `);
 }
-async function installFromCatalog(name, engineUrl) {
+async function installFromCatalog(name, engineUrl, approveForward) {
   console.log(`  Checking engine catalog at ${engineUrl}...`);
   let catalogRes;
   try {
@@ -6284,11 +6325,30 @@ Available extensions:`);
 \u2705 Extension "${entry.displayName || entry.name}" is already active.`);
     return;
   }
+  const forward = entry.forwarded_credentials ?? {};
+  const forwardPairs = Object.entries(forward).flatMap(([route, headers]) => headers.map((h) => `${route}: ${h}`));
+  const approval = approveForward ? { forward_credentials: forward } : undefined;
   if (entry.is_installed) {
     console.log(`  Already installed. Enabling...`);
+    if (approval && forwardPairs.length > 0) {
+      const res = await fetch(`${engineUrl}/api/marketplace/${entry.name}/approve-forward-credentials`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(approval)
+      }).catch(() => null);
+      if (!res?.ok) {
+        console.error(`\u274C Credential forwarding approval failed: HTTP ${res?.status ?? "unreachable"}`);
+        process.exit(1);
+      }
+      console.log(`  \u2713 Credential forwarding approved (${forwardPairs.join(", ")})`);
+    }
   } else {
     const installRes = await fetch(`${engineUrl}/api/marketplace/${entry.name}/install`, {
-      method: "POST"
+      method: "POST",
+      ...approval && {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(approval)
+      }
     }).catch(() => null);
     if (!installRes?.ok) {
       const err2 = await installRes?.json().catch(() => ({}));
@@ -6302,6 +6362,11 @@ Available extensions:`);
       console.log(`  \u2713 Marked as installed`);
     }
   }
+  if (forwardPairs.length > 0 && !approval) {
+    console.log(`  \u26A0\uFE0F  Asks for the caller's credentials on: ${forwardPairs.join(", ")}`);
+    console.log(`     Not forwarded until approved: re-run with --approve-forward-credentials,`);
+    console.log(`     or approve it in Studio \u2192 Marketplace.`);
+  }
   const enableRes = await fetch(`${engineUrl}/api/marketplace/${entry.name}/enable`, {
     method: "POST"
   }).catch(() => null);
@@ -6345,12 +6410,12 @@ async function activateViaApi(name, category, engineUrl) {
 // src/commands/create-god.ts
 import { createInterface as createInterface3 } from "readline";
 async function prompt(rl2, question) {
-  return new Promise((resolve4) => {
-    rl2.question(question, resolve4);
+  return new Promise((resolve5) => {
+    rl2.question(question, resolve5);
   });
 }
 async function promptHidden(question) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     process.stdout.write(question);
     const stdin = process.stdin;
     const wasPaused = stdin.isPaused();
@@ -6369,7 +6434,7 @@ async function promptHidden(question) {
         stdin.off("data", handler);
         process.stdout.write(`
 `);
-        resolve4(value);
+        resolve5(value);
       } else if (char === "\x7F") {
         if (value.length > 0)
           value = value.slice(0, -1);
@@ -6622,9 +6687,9 @@ var rollbackCommand = new Command("rollback").description("Rollback database mig
       input: process.stdin,
       output: process.stdout
     });
-    const answer = await new Promise((resolve4) => {
+    const answer = await new Promise((resolve5) => {
       rl2.question(`
-\u26A0\uFE0F  This will rollback schema changes. Type "yes" to continue: `, resolve4);
+\u26A0\uFE0F  This will rollback schema changes. Type "yes" to continue: `, resolve5);
     });
     rl2.close();
     if (answer.trim().toLowerCase() !== "yes") {
@@ -6941,8 +7006,8 @@ function compareVersions(a, b) {
   return 0;
 }
 async function readLine() {
-  return new Promise((resolve4) => {
-    process.stdin.once("data", (data) => resolve4(data.toString().trim()));
+  return new Promise((resolve5) => {
+    process.stdin.once("data", (data) => resolve5(data.toString().trim()));
   });
 }
 
@@ -7074,7 +7139,7 @@ async function getLocalVersion() {
 // package.json
 var package_default = {
   name: "@zveltio/cli",
-  version: "3.0.0-beta.78",
+  version: "3.0.0-beta.80",
   type: "module",
   bin: {
     zveltio: "./dist/index.js"
@@ -7089,7 +7154,7 @@ var package_default = {
     dev: "bun run --watch src/index.ts"
   },
   dependencies: {
-    "@zveltio/sdk": "3.0.0-beta.78",
+    "@zveltio/sdk": "3.0.0-beta.80",
     commander: "^12.1.0"
   },
   devDependencies: {
@@ -7121,11 +7186,11 @@ program2.command("generate-types [collection]").description("Generate TypeScript
 var schema = program2.command("schema").description("Schema as code: the live schema as reviewable JSON files");
 schema.command("pull").description("Write the live schema to ./schema (collections, roles)").option("--dir <path>", "Schema directory", "./schema").option("--url <url>", "Engine URL (env: ZVELTIO_URL)").action(schemaPullCommand);
 schema.command("diff").description("Print what apply would change to match ./schema; exits 1 on drift").option("--dir <path>", "Schema directory", "./schema").option("--url <url>", "Engine URL (env: ZVELTIO_URL)").action(schemaDiffCommand);
-schema.command("apply").description("Make the instance match ./schema; shows the plan and asks first").option("--dir <path>", "Schema directory", "./schema").option("--url <url>", "Engine URL (env: ZVELTIO_URL)").option("--yes", "Apply without asking").option("--allow-destructive", "Run drops and type changes that a migration in migrations/ names").action(schemaApplyCommand);
-program2.command("install <name>").description("Install a Zveltio extension from marketplace or local path").option("--path <path>", "Install from local directory (offline)").option("--url <url>", "Engine URL for marketplace install", "http://localhost:3000").option("--force", "Overwrite existing extension (local install only)").action((name, opts) => installCommand(name, opts));
+schema.command("apply").description("Make the instance match ./schema; shows the plan and asks first").option("--dir <path>", "Schema directory", "./schema").option("--url <url>", "Engine URL (env: ZVELTIO_URL)").option("--yes", "Apply without asking").option("--allow-destructive", "Run drops and type changes that a migration in migrations/ names").option("--adopt-rules", "Create collections even when access rules already name them").action(schemaApplyCommand);
+program2.command("install <name>").description("Install a Zveltio extension from marketplace or local path").option("--path <path>", "Install from local directory (offline)").option("--url <url>", "Engine URL for marketplace install", "http://localhost:3000").option("--force", "Overwrite existing extension (local install only)").option("--approve-forward-credentials", "Approve the caller-credential forwarding the extension's manifest declares").action((name, opts) => installCommand(name, opts));
 var extensions = program2.command("extensions").description("Manage Zveltio extensions");
 extensions.command("list").description("List all available and installed extensions").option("--url <url>", "Engine URL", "http://localhost:3000").option("--category <category>", "Filter by category").option("--json", "Output as JSON").action((opts) => extensionsListCommand(opts));
-extensions.command("install <name>").description("Install an extension from the marketplace or local path").option("--path <path>", "Install from local directory (offline)").option("--url <url>", "Engine URL", "http://localhost:3000").option("--force", "Overwrite existing extension (local install only)").action((name, opts) => installCommand(name, opts));
+extensions.command("install <name>").description("Install an extension from the marketplace or local path").option("--path <path>", "Install from local directory (offline)").option("--url <url>", "Engine URL", "http://localhost:3000").option("--force", "Overwrite existing extension (local install only)").option("--approve-forward-credentials", "Approve the caller-credential forwarding the extension's manifest declares").action((name, opts) => installCommand(name, opts));
 extensions.command("enable <name>").description("Enable an installed extension").option("--url <url>", "Engine URL", "http://localhost:3000").action(async (name, opts) => {
   const url = opts.url || "http://localhost:3000";
   const res = await fetch(`${url}/api/marketplace/${name}/enable`, { method: "POST" }).catch(() => null);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zveltio/cli",
-  "version": "3.0.0-beta.78",
+  "version": "3.0.0-beta.80",
   "type": "module",
   "bin": {
     "zveltio": "./dist/index.js"
@@ -15,7 +15,7 @@
     "dev": "bun run --watch src/index.ts"
   },
   "dependencies": {
-    "@zveltio/sdk": "3.0.0-beta.78",
+    "@zveltio/sdk": "3.0.0-beta.80",
     "commander": "^12.1.0"
   },
   "devDependencies": {