permdock 0.6.0 → 0.8.0

package/dist/{saas-BCXRuXca.js → saas-iWnUdwCt.js}

@@ -1,12 +1,12 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { r as principal } from "./refs-K6eWUJ0H.js";
-import { a as deny, n as role, r as allow } from "./role-builder-uWQZ4v84.js";
-import { E as memoryCustomRoleSource, _ as limits, g as memoryRelationSource, v as memoryLimitStore } from "./src-Cu2m75uo.js";
-import { h as secondsAt } from "./time-DkWjdL98.js";
-import { l as relation, n as anyone } from "./grantee-hxrUsbpM.js";
-import { n as definePolicy } from "./policy-DbM5YYtV.js";
-import { s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-BPxlwVhN.js";
+import { i as principal } from "./refs-C8BKxc_e.js";
+import { a as deny, n as role, r as allow } from "./role-builder-BK2-T6oD.js";
+import { A as memoryCustomRoleSource, S as memoryLimitStore, b as memoryRelationSource, x as limits } from "./src-DZ0l9UAg.js";
+import { h as secondsAt } from "./time-nR1JesoH.js";
+import { l as relation, n as anyone } from "./grantee-Dke-9rd1.js";
+import { r as definePolicy } from "./policy-CLQ8__GF.js";
+import { s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-mDcTWoBs.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;
@@ -107,6 +107,7 @@ const saasPolicy = definePolicy({
 const SAAS_EXPIRED_AT = 1e9;
 /**
 * Users, one hazard each:
+*
 * - alice: admin in acme, viewer in globex (different role per org)
 * - bob: member in acme (owns p1, p3, p4)
 * - carol: owner in acme
@@ -116,9 +117,11 @@ const SAAS_EXPIRED_AT = 1e9;
 * - mallory: no memberships at all
 * - gina: `lead` of team-a in acme
 * - hank: viewer in acme, `collaborator` on project p3 only
-* - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one instant
+* - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one
+*   instant
 * - tina: member of `tenant-1`; `Date.parse('org-1') === Date.parse('tenant-1')`
-* - ivan: viewer in acme who holds the team role `lead` on the tenant membership (the wrong scope)
+* - ivan: viewer in acme who holds the team role `lead` on the tenant membership
+*   (the wrong scope)
 *
 * Acme's folders: `root` ─ `eng` ─ `platform` ─ `infra`, and `root` ─ `hr`
 * (restricted) ─ `payroll`. bob views `root`, hank views `hr`, gina edits
@@ -391,7 +394,10 @@ const saasSeed = Object.freeze({
 		}
 	]
 });
-/** The seed's folder tree and shares as a `RelationSource`, for `createPermDock({ relations })`. */
+/**
+* The seed's folder tree and shares as a `RelationSource`, for
+* `createPermDock({ relations })`.
+*/
 function saasRelations(seed = saasSeed) {
 	const edges = (relation) => seed.shares.filter((share) => share.relation === relation).map((share) => share.expiresAt === void 0 ? {
 		id: share.folder,
@@ -432,9 +438,9 @@ function saasMemberships(user, members = saasSeed.members) {
 /** Custom roles of every org, as `createPermDock({ customRoles })` expects. */
 const saasCustomRoles = saasSeed.orgs.flatMap((org) => org.customRoles);
 /**
-* The principal for `user`, with the plans of the requested `tenant`'s org.
-* The tenant itself is passed to `createPermDock({ tenant })`, never trusted
-* from here.
+* The principal for `user`, with the plans of the requested `tenant`'s org. The
+* tenant itself is passed to `createPermDock({ tenant })`, never trusted from
+* here.
 */
 function saasPrincipal(user, tenant) {
 	const org = tenant === void 0 ? void 0 : saasOrg(tenant);
@@ -447,10 +453,10 @@ function saasPrincipal(user, tenant) {
 //#endregion
 //#region src/testing/saas/sql.ts
 /**
-* Postgres tables for the SaaS domain. Column names match the resource
-* fields (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile
-* against them without a column map. RLS is enabled and forced on the row
-* tables; policies come from `permdock rls generate`.
+* Postgres tables for the SaaS domain. Column names match the resource fields
+* (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile against
+* them without a column map. RLS is enabled and forced on the row tables;
+* policies come from `permdock rls generate`.
 */
 const saasSchemaSql = `
 create table org (
@@ -507,7 +513,7 @@ create table folder_editor (
 function literal(value) {
 	if (value === null || value === void 0) return "null";
 	if (typeof value === "number") {
-		if (!Number.isFinite(value)) throw new Error("PermDock: non-finite number in fixture seed");
+		if (!Number.isFinite(value)) throw new TypeError("PermDock: non-finite number in fixture seed");
 		return String(value);
 	}
 	if (typeof value === "boolean") return value ? "true" : "false";
@@ -592,7 +598,7 @@ const SAAS_TOKEN_TTL_SECONDS = 3600;
 function base64url(bytes) {
 	let binary = "";
 	for (const byte of bytes) binary += String.fromCodePoint(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
 }
 function encodeJson(value) {
 	return base64url(new TextEncoder().encode(JSON.stringify(value)));
@@ -640,9 +646,9 @@ function parseSegment(segment) {
 	}
 }
 /**
-* Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`)
-* and returns its `sub`, or `null`; never throws. Identity only: memberships
-* and plans come from the seed, never from the token.
+* Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`) and
+* returns its `sub`, or `null`; never throws. Identity only: memberships and
+* plans come from the seed, never from the token.
 */
 async function verifySaasToken(token, now) {
 	return (await verifySaasSession(token, now))?.sub ?? null;
@@ -677,7 +683,10 @@ async function verifySaasSession(token, at) {
 }
 //#endregion
 //#region src/testing/saas/scenarios.ts
-/** What the policy's `subject` receives: the principal, or a `Subject` carrying the actor. */
+/**
+* What the policy's `subject` receives: the principal, or a `Subject` carrying
+* the actor.
+*/
 function saasUser(scenario) {
 	const principal = saasPrincipal(scenario.user, scenario.tenant);
 	if (scenario.actor === void 0 && scenario.delegation === void 0) return principal;
@@ -713,7 +722,10 @@ function saasLimitStore(used = 0) {
 		}
 	};
 }
-/** The `createPermDock` options a scenario runs with: tenant, custom roles, quota and folder tree. */
+/**
+* The `createPermDock` options a scenario runs with: tenant, custom roles,
+* quota and folder tree.
+*/
 function saasScenarioOptions(scenario) {
 	return {
 		...scenario.tenant === void 0 ? {} : { tenant: scenario.tenant },
@@ -738,8 +750,9 @@ function saasFolder(id) {
 	return row;
 }
 /**
-* The folder tree, decided with `createPermDock({ relations: saasRelations() })`.
-* A snapshot carries no graph, so every graph grant is server-only on a client.
+* The folder tree, decided with `createPermDock({ relations: saasRelations()
+* })`. A snapshot carries no graph, so every graph grant is server-only on a
+* client.
 */
 const saasFolderScenarios = Object.freeze([
 	{
@@ -803,8 +816,8 @@ const saasFolderScenarios = Object.freeze([
 	}
 ]);
 /**
-* Hand-written expectations. Never derive `expected` from the engine: the
-* list is the oracle every adapter, ORM and client suite runs against.
+* Hand-written expectations. Never derive `expected` from the engine: the list
+* is the oracle every adapter, ORM and client suite runs against.
 */
 const saasScenarios = Object.freeze([
 	{

package/dist/{scan-qvOe0hS3.js → scan-DCj1KQfn.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-DCYe60Pi.js");
+		const { runAdoptionScan } = await import("./adoption-scan-BLs67P1l.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-B4v0Qrac.js → schema-BOJjqlWL.js}

@@ -1,5 +1,5 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as RFC3339_PATTERN } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as RFC3339_PATTERN } from "./time-nR1JesoH.js";
 //#region src/catalog/schema.ts
 const name = {
 	type: "string",
@@ -234,6 +234,7 @@ const catalogSchema = freezeDeep({
 					},
 					renamedFrom: strings,
 					levels: strings,
+					orderedLevels: { const: true },
 					hostable: { const: true },
 					rowConditions: { type: "boolean" },
 					approvals: {

package/dist/{schema-yLuBWWsh.js → schema-Dst9I9Gs.js}

@@ -1,7 +1,8 @@
-import { t as require__2020 } from "./2020-C9VN-x8c.js";
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
-import { t as DRAFT_PINS } from "./pins-8ILTftC9.js";
+import { l as packageRoot } from "./version-DMQ0dnN5.js";
+import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 //#region src/cli/openapi/schema.ts
@@ -97,9 +98,12 @@ function validatorFor(file) {
 	return compiled;
 }
 function describeErrors(errors) {
-	return (errors ?? []).slice(0, 5).map((error) => `  ${error.instancePath || "/"} ${error.message ?? ""}`).join("\n");
+	return (errors ?? []).slice(0, 5).map((error) => `  ${nonEmptyOr(error.instancePath, "/")} ${error.message ?? ""}`).join("\n");
 }
-/** Validates an OpenAPI 3.1 or 3.2 document against the official JSON Schema, and 3.3 against the pinned patch of 3.2. */
+/**
+* Validates an OpenAPI 3.1 or 3.2 document against the official JSON Schema,
+* and 3.3 against the pinned patch of 3.2.
+*/
 function validateOpenapi(document) {
 	const version = isRecord(document) ? document["openapi"] : void 0;
 	const match = typeof version === "string" ? /^3\.([123])\.\d+$/u.exec(version) : null;

package/dist/scim/index.d.ts

@@ -1,2 +1,3 @@
-import { A as ScimPage, C as GROUP_SCHEMA, D as SCIM_CONTENT_TYPE, E as ROLES_EXTENSION, F as isDirectoryNotFoundError, I as isDirectoryUniquenessError, M as ScimPatchOp, N as ScimTokenOptions, O as ScimFilter, P as USER_SCHEMA, S as ERROR_SCHEMA, T as PATCH_SCHEMA, _ as DirectoryMembershipSourceOptions, a as scimHandler, b as DirectoryUniquenessError, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryGroup, h as DirectoryChange, i as tenantFromPath, j as ScimPageResult, k as ScimHandlerOptions, l as resourceTypes, m as APP_DATA_EXTENSION, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryNotFoundError, w as LIST_SCHEMA, x as DirectoryUser, y as DirectoryStore } from "../index-Ch8LpNDp.js";
-export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };
+import { t as SqlQuery } from "../sql-B80DFdpG.js";
+import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-BT5-1VsX.js";
+export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, type PostgresDirectoryStoreOptions, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, type SqlQuery, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim/index.js

@@ -1 +1,3 @@
-export { f as APP_DATA_EXTENSION, p as DirectoryNotFoundError, m as DirectoryUniquenessError, h as ERROR_SCHEMA, g as GROUP_SCHEMA, _ as LIST_SCHEMA, v as PATCH_SCHEMA, y as ROLES_EXTENSION, b as SCIM_CONTENT_TYPE, x as USER_SCHEMA, w as authenticateScim, n as directoryMembershipSource, o as filterSupported, S as isDirectoryNotFoundError, C as isDirectoryUniquenessError, s as matchFilter, t as memoryDirectoryStore, a as normalizePatchOps, c as parseScimFilter, l as resourceTypes, u as schemas, r as scimHandler, d as serviceProviderConfig, T as sha256Hex, i as tenantFromPath } from "../scim-ClHtpyV3.js";
+import { a as resourceTypes, c as authenticateScim, i as normalizePatchOps, l as sha256Hex, n as scimHandler, o as schemas, r as tenantFromPath, s as serviceProviderConfig, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
+import { _ as SCIM_CONTENT_TYPE, a as memoryDirectoryStore, b as isDirectoryUniquenessError, c as parseScimFilter, d as DirectoryUniquenessError, f as ERROR_SCHEMA, g as ROLES_EXTENSION, h as PATCH_SCHEMA, i as postgresDirectoryStore, l as APP_DATA_EXTENSION, m as LIST_SCHEMA, o as filterSupported, p as GROUP_SCHEMA, s as matchFilter, u as DirectoryNotFoundError, v as USER_SCHEMA, y as isDirectoryNotFoundError } from "../postgres-store-DcyrPS-r.js";
+export { APP_DATA_EXTENSION, DirectoryNotFoundError, DirectoryUniquenessError, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim-D8YupzX1.js

@@ -0,0 +1,44 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, i as dryRunFlag, t as checkFlag } from "./flags-DXjoTVbS.js";
+//#region src/cli/commands/scim.ts
+const generate = defineLeaf({
+	flags: {
+		out: {
+			type: "string",
+			description: "File to write, - for stdout (default supabase/schemas/<schema>/scim.sql, else permdock_scim.sql)",
+			valueHint: "file"
+		},
+		dialect: {
+			type: "enum",
+			options: [
+				"supabase",
+				"neon",
+				"guc"
+			],
+			description: "Which client roles lose access to the tables (default rls.dialect, else supabase)"
+		},
+		schema: {
+			type: "string",
+			description: "Schema for the directory tables (default rls.schema, else permdock)",
+			valueHint: "name"
+		},
+		...checkFlag,
+		...dryRunFlag
+	},
+	async run(ctx, { flags }) {
+		const out = given(flags.out);
+		const schema = given(flags.schema);
+		const { runScimGenerate } = await import("./generate-CRVV5V7l.js");
+		return runScimGenerate({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			check: flags.check,
+			dryRun: flags["dry-run"],
+			...out === void 0 ? {} : { out },
+			...schema === void 0 ? {} : { schema },
+			...flags.dialect === void 0 ? {} : { dialect: flags.dialect }
+		});
+	}
+});
+//#endregion
+export { generate };