src-auth-perms-sync 0.7.0__tar.gz → 0.8.1__tar.gz

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/.github/workflows/release.yml

@@ -83,7 +83,7 @@ jobs:
 
     steps:
       - name: Check out release ref
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -95,7 +95,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Cache uv
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cache/uv
           key: uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock') }}

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/.github/workflows/validate.yml

@@ -98,7 +98,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
@@ -131,13 +131,13 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Cache npm
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.npm
           key: npm-${{ runner.os }}-markdownlint-cli2-${{ env.MARKDOWNLINT_CLI2_VERSION }}-relative-links-${{ env.MARKDOWNLINT_RELATIVE_LINKS_VERSION }}
@@ -160,7 +160,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -172,7 +172,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Cache uv
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cache/uv
           key: uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock') }}
@@ -185,6 +185,9 @@ jobs:
       - name: Validate lockfile
         run: uv lock --check
 
+      - name: Scan for Unicode characters
+        run: uv run --frozen python tests/unicode_scan.py
+
       - name: Lint Python
         run: uv run --frozen ruff check .
 
@@ -212,7 +215,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -224,7 +227,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Cache uv
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cache/uv
           key: uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-${{ hashFiles('uv.lock') }}

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/AGENTS.md

@@ -14,9 +14,8 @@ actionlint
 ### Markdown files
 npx --yes -p markdownlint-cli2@0.22.1 -p markdownlint-rule-relative-links@5.1.0 markdownlint-cli2
 
-### Confusable Unicode characters in non-Python files
-# (ruff RUF001-RUF003 covers Python strings/comments/docstrings)
-uv run python tests/confusables.py
+### Non-ASCII characters in tracked text files
+uv run python tests/unicode_scan.py
 
 ### Python files
 
@@ -41,7 +40,7 @@ own checks.
 
 ```bash
 # Fast, no network (also what the pre-commit hook runs):
-# lint, format, pyright, confusable-character scan, unit + fixture
+# lint, format, pyright, non-ASCII character scan, unit + fixture
 # tests, CLI rejection matrix,
 # randomized permission invariants
 uv run tests/run.py
@@ -64,7 +63,7 @@ uv run tests/run.py --performance --baseline-command "uvx src-auth-perms-sync@la
 uv run tests/run.py --update-golden
 ```
 
-- Fixture cases live in `tests/e2e/fixtures/<case>/` — see the README there
+- Fixture cases live in `tests/e2e/fixtures/<case>/` - see the README there
   for the format. Add cases there to cover new mapping behaviors.
 - For manual verification against a real instance, dry-run first (no
   `--apply`), read the planned changes, then `--apply` on a scratch instance
@@ -165,7 +164,7 @@ gh run watch "${RUN_ID}" --repo "${GH_REPO}" --exit-status
 gh release view "v${VERSION}" --repo "${GH_REPO}"
 ```
 
-## Hard invariants — do not break
+## Hard invariants - do not break
 
 Violating these can silently grant the wrong users access to the wrong
 repos.
@@ -206,31 +205,31 @@ organization sync maps SAML groups to Sourcegraph org membership. Read
 CLI lives in `src/src_auth_perms_sync/`; invoke with `uv run src-auth-perms-sync`.
 Strict pyright covers the package. Root modules are entrypoints only:
 
-- `cli.py` — `main()`, arg parsing, owns the CLI description. Module
+- `cli.py` - `main()`, arg parsing, owns the CLI description. Module
   wrappers (`Get`/`Set`/`Restore`/`SyncSamlOrgs`) return result dataclasses
   and never install logging handlers; only `main()` runs CLI-mode logging.
-- `shared/` — cross-workflow helpers: Sourcegraph auth-provider/user list
+- `shared/` - cross-workflow helpers: Sourcegraph auth-provider/user list
   helpers, shared GraphQL operations and TypedDicts, site-config validation,
   and SAML group parsing. `shared/backups.py` defines `RunPaths`: every
   filesystem path for one run, resolved once at the edge
-  (`resolve_run_paths`) and threaded explicitly — never recompute paths
+  (`resolve_run_paths`) and threaded explicitly - never recompute paths
   from cwd or globals below the edge, and honor `run_paths.write_files`
   (False under `--no-files`) before any disk write.
 
 Business workflows live in packages:
 
-- `permissions/` — repo permission sync (`command.py`, `maps.py`,
+- `permissions/` - repo permission sync (`command.py`, `maps.py`,
   `mapping.py`, `sourcegraph.py`, `snapshot.py`, `apply.py`, `queries.py`,
   `types.py`). Add new mapping filters in `permissions/types.py` and
   `permissions/mapping.py`.
-- `orgs/` — SAML group → Sourcegraph organization sync (`command.py`,
+- `orgs/` - SAML group -> Sourcegraph organization sync (`command.py`,
   `queries.py`, `types.py`).
 
 ## Toolchain
 
 - Python 3.11 + [uv](https://docs.astral.sh/uv/). Never invoke `python`
   directly; always `uv run ...`.
-- `uv run pyright` must be clean. No `# type: ignore` to silence —
+- `uv run pyright` must be clean. No `# type: ignore` to silence -
   fix the underlying type.
 - Local tests use stdlib `unittest`: `uv run python -m unittest discover -s tests`.
 - For Sourcegraph mutation-path changes, also verify by dry-running `--get` /
@@ -268,7 +267,7 @@ Short names that ARE acceptable (don't rewrite these on sight):
   `key`, `value`, `name`, `kind`.
 - **Stdlib idioms**: `ctx` for `contextvars.copy_context()`.
 - **Loop / comprehension variables when the type is obvious from one
-  line of context** is still discouraged — prefer `user`, `repo`,
+  line of context** is still discouraged - prefer `user`, `repo`,
   `provider`, `service`, `permission`, `node`, `entry`, `match`,
   `account`, `future`, `executor`, `exception`, `event`, `connection`,
   `response`, `timestamp`, `current`, `outcome`, `index`, `field_name`.

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: src-auth-perms-sync
-Version: 0.7.0
+Version: 0.8.1
 Summary: Set Sourcegraph permissions from authentication provider data
 Project-URL: Homepage, https://github.com/sourcegraph/src-auth-perms-sync
 Project-URL: Issues, https://github.com/sourcegraph/src-auth-perms-sync/issues
@@ -16,13 +16,13 @@ Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
-Requires-Dist: json5>=0.14.0
+Requires-Dist: json5>=0.15.0
 Requires-Dist: pyyaml>=6.0.3
-Requires-Dist: src-py-lib[otel]==0.3.0
+Requires-Dist: src-py-lib[otel]==0.3.2
 Description-Content-Type: text/markdown
 
 # src-auth-perms-sync
-<!-- HUMAN-MAINTAINED SECTION START — DO NOT EDIT THIS SECTION -->
+<!-- HUMAN-MAINTAINED SECTION START - DO NOT EDIT THIS SECTION -->
 
 src-auth-perms-sync automates Sourcegraph's Explicit Permissions GraphQL API,
 setting user-to-repo permissions based on mapping rules, for example:
@@ -167,10 +167,10 @@ result = src.Set(config)  # truthy on success; result.paths has run artifacts
 get_result = src.Get(config)
 for provider in get_result.auth_providers:
     ...
-for code_host in get_result.code_hosts:
+for code_host_connection in get_result.code_host_connections:
     ...
 
-# Mapping rules can be passed in memory instead of a maps YAML file —
+# Mapping rules can be passed in memory instead of a maps YAML file -
 # same structure and validation as maps.yaml entries:
 rules: list[src.MappingRule] = [
     {
@@ -190,11 +190,11 @@ result = src.Set(config, mapping_rules=rules)
 ```
 
 The import API does not read environment variables or `.env` files on its
-own — those apply to the CLI only. Pass every value explicitly to
+own - those apply to the CLI only. Pass every value explicitly to
 `src.Config(...)` (read `os.environ` yourself if you want env-driven
 configuration, as the example above does).
 
-Module mode never touches your `logging` handlers or the root logger — your
+Module mode never touches your `logging` handlers or the root logger - your
 application's logging config stays in charge. To see progress messages:
 
 ```python
@@ -248,7 +248,7 @@ snapshots that make `--apply` reversible.
     ```
 
     - Queries the Sourcegraph instance for auth providers and code host connections
-    - Writes generated reference files `auth-providers.yaml` and `code-hosts.yaml` under
+    - Writes generated reference files `auth-providers.yaml` and `code-host-connections.yaml` under
       `src-auth-perms-sync-runs/<src_endpoint>/`
     - Creates an empty `maps.yaml` if it doesn't exist
 
@@ -316,11 +316,11 @@ snapshots that make `--apply` reversible.
 
     ```bash
     src-auth-perms-sync sync-saml-orgs --users alice,bob
-    src-auth-perms-sync sync-saml-orgs --created-after 2026-06-01
+    src-auth-perms-sync sync-saml-orgs --users-created-after 2026-06-01
     src-auth-perms-sync sync-saml-orgs --users-without-explicit-perms
     ```
 
-    - Same user filters as `get` and `set`; a mode flag is required — there
+    - Same user filters as `get` and `set`; a mode flag is required - there
       is no bare `sync-saml-orgs`
 
 ### Org sync behavior
@@ -328,14 +328,14 @@ snapshots that make `--apply` reversible.
 - Org names are `synced-<configID>-<group name>` (non-alphanumeric characters
   become `-`). The `synced-` prefix marks tool ownership: the sync only ever
   modifies orgs whose name carries it, so manually created orgs are never touched.
-- The org sync mode is always explicit — no surprises:
+- The org sync mode is always explicit - no surprises:
   - **Full** (`sync-saml-orgs --full`, or `set --full` / `--repos*`
     `--sync-saml-orgs`): converges every synced org against all users. A synced
     org whose SAML group disappeared has all members removed, but the org itself
     is kept (its settings survive in case the group comes back).
   - **Scoped** (user filters on `sync-saml-orgs`, or `set --users` /
-    `--users-without-explicit-perms` / `--created-after` with
-    `--sync-saml-orgs`): syncs org membership for exactly the selected users —
+    `--users-without-explicit-perms` / `--users-created-after` with
+    `--sync-saml-orgs`): syncs org membership for exactly the selected users -
     per-user additions AND removals, computed from each user's own SAML
     assertion and org list. Other users' memberships never change, and no full
     user scan or org member listing is needed, so API traffic stays
@@ -349,22 +349,22 @@ Run `src-auth-perms-sync --help` for options
 
 ```text
 src-auth-perms-sync-runs/<src_endpoint>/
-├── auth-providers.yaml
-├── code-hosts.yaml
-├── maps.yaml
-└── runs
-    └── timestamp-command
-        ├── before.json
-        ├── after.json
-        ├── diff.json
-        ├── log.json
-        └── maps.yaml
+|-- auth-providers.yaml
+|-- code-host-connections.yaml
+|-- maps.yaml
+`-- runs
+    `-- timestamp-command
+        |-- before.json
+        |-- after.json
+        |-- diff.json
+        |-- log.json
+        `-- maps.yaml
 ```
 
 - The `src-auth-perms-sync-runs` dir is created under your current working directory
 - The `<src_endpoint>` dir is created with the hostname from `SRC_ENDPOINT`
 - If `maps.yaml` doesn't exist already, it'll be created for you
-- `auth-providers.yaml` and `code-hosts.yaml` are created / replaced by the `get` command,
+- `auth-providers.yaml` and `code-host-connections.yaml` are created / replaced by the `get` command,
   for you to copy values from, to use in your `maps.yaml`
 - Only one `maps.yaml` file can be used at a time per Sourcegraph instance, as each `set --apply`
   command resets the state on the Sourcegraph instance to the `maps.yaml` file which was used
@@ -376,4 +376,4 @@ src-auth-perms-sync-runs/<src_endpoint>/
   - An `after.json` file, capturing the new state
   - A `diff.json` file, a shorter, reviewable file containing the diffs between before and after
 
-<!-- HUMAN-MAINTAINED SECTION END — DO NOT EDIT ABOVE -->
+<!-- HUMAN-MAINTAINED SECTION END - DO NOT EDIT ABOVE -->

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/README.md

@@ -1,5 +1,5 @@
 # src-auth-perms-sync
-<!-- HUMAN-MAINTAINED SECTION START — DO NOT EDIT THIS SECTION -->
+<!-- HUMAN-MAINTAINED SECTION START - DO NOT EDIT THIS SECTION -->
 
 src-auth-perms-sync automates Sourcegraph's Explicit Permissions GraphQL API,
 setting user-to-repo permissions based on mapping rules, for example:
@@ -144,10 +144,10 @@ result = src.Set(config)  # truthy on success; result.paths has run artifacts
 get_result = src.Get(config)
 for provider in get_result.auth_providers:
     ...
-for code_host in get_result.code_hosts:
+for code_host_connection in get_result.code_host_connections:
     ...
 
-# Mapping rules can be passed in memory instead of a maps YAML file —
+# Mapping rules can be passed in memory instead of a maps YAML file -
 # same structure and validation as maps.yaml entries:
 rules: list[src.MappingRule] = [
     {
@@ -167,11 +167,11 @@ result = src.Set(config, mapping_rules=rules)
 ```
 
 The import API does not read environment variables or `.env` files on its
-own — those apply to the CLI only. Pass every value explicitly to
+own - those apply to the CLI only. Pass every value explicitly to
 `src.Config(...)` (read `os.environ` yourself if you want env-driven
 configuration, as the example above does).
 
-Module mode never touches your `logging` handlers or the root logger — your
+Module mode never touches your `logging` handlers or the root logger - your
 application's logging config stays in charge. To see progress messages:
 
 ```python
@@ -225,7 +225,7 @@ snapshots that make `--apply` reversible.
     ```
 
     - Queries the Sourcegraph instance for auth providers and code host connections
-    - Writes generated reference files `auth-providers.yaml` and `code-hosts.yaml` under
+    - Writes generated reference files `auth-providers.yaml` and `code-host-connections.yaml` under
       `src-auth-perms-sync-runs/<src_endpoint>/`
     - Creates an empty `maps.yaml` if it doesn't exist
 
@@ -293,11 +293,11 @@ snapshots that make `--apply` reversible.
 
     ```bash
     src-auth-perms-sync sync-saml-orgs --users alice,bob
-    src-auth-perms-sync sync-saml-orgs --created-after 2026-06-01
+    src-auth-perms-sync sync-saml-orgs --users-created-after 2026-06-01
     src-auth-perms-sync sync-saml-orgs --users-without-explicit-perms
     ```
 
-    - Same user filters as `get` and `set`; a mode flag is required — there
+    - Same user filters as `get` and `set`; a mode flag is required - there
       is no bare `sync-saml-orgs`
 
 ### Org sync behavior
@@ -305,14 +305,14 @@ snapshots that make `--apply` reversible.
 - Org names are `synced-<configID>-<group name>` (non-alphanumeric characters
   become `-`). The `synced-` prefix marks tool ownership: the sync only ever
   modifies orgs whose name carries it, so manually created orgs are never touched.
-- The org sync mode is always explicit — no surprises:
+- The org sync mode is always explicit - no surprises:
   - **Full** (`sync-saml-orgs --full`, or `set --full` / `--repos*`
     `--sync-saml-orgs`): converges every synced org against all users. A synced
     org whose SAML group disappeared has all members removed, but the org itself
     is kept (its settings survive in case the group comes back).
   - **Scoped** (user filters on `sync-saml-orgs`, or `set --users` /
-    `--users-without-explicit-perms` / `--created-after` with
-    `--sync-saml-orgs`): syncs org membership for exactly the selected users —
+    `--users-without-explicit-perms` / `--users-created-after` with
+    `--sync-saml-orgs`): syncs org membership for exactly the selected users -
     per-user additions AND removals, computed from each user's own SAML
     assertion and org list. Other users' memberships never change, and no full
     user scan or org member listing is needed, so API traffic stays
@@ -326,22 +326,22 @@ Run `src-auth-perms-sync --help` for options
 
 ```text
 src-auth-perms-sync-runs/<src_endpoint>/
-├── auth-providers.yaml
-├── code-hosts.yaml
-├── maps.yaml
-└── runs
-    └── timestamp-command
-        ├── before.json
-        ├── after.json
-        ├── diff.json
-        ├── log.json
-        └── maps.yaml
+|-- auth-providers.yaml
+|-- code-host-connections.yaml
+|-- maps.yaml
+`-- runs
+    `-- timestamp-command
+        |-- before.json
+        |-- after.json
+        |-- diff.json
+        |-- log.json
+        `-- maps.yaml
 ```
 
 - The `src-auth-perms-sync-runs` dir is created under your current working directory
 - The `<src_endpoint>` dir is created with the hostname from `SRC_ENDPOINT`
 - If `maps.yaml` doesn't exist already, it'll be created for you
-- `auth-providers.yaml` and `code-hosts.yaml` are created / replaced by the `get` command,
+- `auth-providers.yaml` and `code-host-connections.yaml` are created / replaced by the `get` command,
   for you to copy values from, to use in your `maps.yaml`
 - Only one `maps.yaml` file can be used at a time per Sourcegraph instance, as each `set --apply`
   command resets the state on the Sourcegraph instance to the `maps.yaml` file which was used
@@ -353,4 +353,4 @@ src-auth-perms-sync-runs/<src_endpoint>/
   - An `after.json` file, capturing the new state
   - A `diff.json` file, a shorter, reviewable file containing the diffs between before and after
 
-<!-- HUMAN-MAINTAINED SECTION END — DO NOT EDIT ABOVE -->
+<!-- HUMAN-MAINTAINED SECTION END - DO NOT EDIT ABOVE -->

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/dev/TODO.md

@@ -32,7 +32,7 @@
 - `get --repos <name>` still scans every user's explicit grants to find one
   repo's holders (~400 s at 10k users). A repo-centric read
   (`repository.permissionsInfo.users` + site-admin disambiguation, as the
-  test harness already does) would make it seconds — see the repo-centric
+  test harness already does) would make it seconds - see the repo-centric
   section below.
 
 ## Low priority: Repo-centric path, when users > repos, or for cross-checking
@@ -50,10 +50,10 @@ Reasons we might want to bring it back later:
 - **Targeted snapshots.** A "planned-scope" capture (only the repos
   the mapping rules touch) is faster than a full instance scan when
   the user-centric path is the long pole AND the planned set is small.
-  Would need either a server-side `source` filter on the repo→users
+  Would need either a server-side `source` filter on the repo->users
   connection, or a follow-up user-centric `source: API` query per
   ambiguous (site-admin) user to disambiguate.
-- **Adaptive capture path after SG adds `source` to repo→users.** Once
+- **Adaptive capture path after SG adds `source` to repo->users.** Once
   `RepositoryPermissionsInfo.users(source: PermissionSource)` exists,
   compute the expected request count both ways before snapshotting:
   sum `userCount` across all auth providers and sum `repoCount` across
@@ -70,7 +70,7 @@ If/when we revisit:
    ambiguous-user follow-up to be correct).
 2. Restore `QUERY_REPO_EXPLICIT_USERS` from git history; implement
    `list_repo_explicit_users` returning `(definitely, ambiguous)` and
-   actually consume both buckets — the previous code did neither.
+   actually consume both buckets - the previous code did neither.
 3. Add a CLI flag (e.g. `--cross-check-capture`) gated behind a clear
    "this doubles capture cost" warning.
 
@@ -89,7 +89,7 @@ SAML actually persists the group list. Recovery options for each:
 - OIDC has no `allowGroups` field on `OpenIDConnectAuthProvider`.
   `UserClaims` stores only name/email fields; the `groups` claim is never
   parsed. Recovery needs an upstream change to persist the claim.
-- GitHub OAuth has `allowOrgs`, `allowOrgsMap` (org→teams), and
+- GitHub OAuth has `allowOrgs`, `allowOrgsMap` (org->teams), and
   `requiredSsoOrgs`. Org/team checks happen live in `verifyUserOrgs` /
   `verifyUserTeams` and are discarded. Recovery needs an upstream change to
   persist the claim.

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/dev/engineering-requests.md

@@ -88,15 +88,15 @@ Observed during the concurrent captures:
 - `pgsql-0` CPU (`kubectl top`): 7,636-7,683 millicores of 8,000 (saturated).
 - `frontend` / `gitserver` CPU: 124-138m / 2-3m (idle bystanders).
 - `pg_stat_activity`: 29 active statements, all
-  `permsStore.ListUserPermissions`, **zero wait events** — pure CPU, no lock
+  `permsStore.ListUserPermissions`, **zero wait events** - pure CPU, no lock
   contention.
 - `pg_stat_statements`: `permsStore.ListUserPermissions` at 24,026 calls,
   27,635.6s total, 1,150ms mean.
-- Per-client capture throughput: 23 users/sec solo → 2-4 users/sec at 4-way
+- Per-client capture throughput: 23 users/sec solo -> 2-4 users/sec at 4-way
   concurrency.
-- Aggregate throughput: 8-16 users/sec at 4-way — **below the 23 users/sec a
+- Aggregate throughput: 8-16 users/sec at 4-way - **below the 23 users/sec a
   single client achieves alone** (negative scaling).
-- ALB (CloudWatch): no 5xx, no rejected connections — the edge and frontend
+- ALB (CloudWatch): no 5xx, no rejected connections - the edge and frontend
   are not the bottleneck.
 - Collateral failure: the fifth client's queries exceeded the 60s read timeout
   under this load; 5 retry attempts exhausted; its run failed with exit 1.
@@ -144,7 +144,7 @@ from `github.com/sourcegraph/sourcegraph`:
 Measured on the 10k-user / 50k-repo test instance, the presence probe
 `User.permissionsInfo.repositories(source: API, first: 1)` costs 225-350ms of
 server work per user, and alias batching barely helps (21,004 single-user
-probes averaged 351.6ms; 25-user batches averaged 5,616ms ≈ 224.7ms/user). A
+probes averaged 351.6ms; 25-user batches averaged 5,616ms ~ 224.7ms/user). A
 single `set --users-without-explicit-perms` run probing all 10,002 users at
 batch size 1 spent 4,269s of its 5,210s total in these probes.
 
@@ -158,9 +158,9 @@ Reading the resolver code in `github.com/sourcegraph/sourcegraph` explains why
   `updatedAt` fields. The rows are discarded afterward.
 - `userPermissionsInfoResolver.Repositories` (permissions_info.go) builds a
   CTE (`reposPermissionsInfoQueryFmt` in perms_store.go) that **materializes
-  every repo accessible to the user** — a full `repo` ⋈
-  `external_service_repos` ⋈ `external_services` join with the correlated
-  authz `EXISTS` predicate and an `ORDER BY` — before the outer query applies
+  every repo accessible to the user** - a full `repo` join
+  `external_service_repos` join `external_services` join with the correlated
+  authz `EXISTS` predicate and an `ORDER BY` - before the outer query applies
   `urp.source = 'API'` and the LIMIT. `first: 1` becomes `LIMIT 2` on the
   outer query only; the CTE is not short-circuited.
 - Requesting `totalCount` adds a second independent execution of the same CTE
@@ -180,7 +180,7 @@ Client-side mitigation shipped in `src-auth-perms-sync` (2026-06-12):
 locally BEFORE probing, so probes scale with the rule-matched user count
 instead of the instance's user count, and user hydration runs as aliased
 25-user batches instead of one `UserByID` request per user. The remaining
-inherent cost — ~225ms x probed user — is exactly what the
+inherent cost - ~225ms x probed user - is exactly what the
 presence/filter API requested below would remove, and
 `get --users-without-explicit-perms` still has to probe every active user
 because its semantics are instance-wide.
@@ -505,7 +505,7 @@ joined to `users` and `repo` for names.
 
 ### `GetPermissionSyncDiscovery`
 
-The `get` command writes `code-hosts.yaml` and `auth-providers.yaml`, then uses
+The `get` command writes `code-host-connections.yaml` and `auth-providers.yaml`, then uses
 the same discovery data for mapping. A single discovery endpoint would simplify
 this and avoid multiple round trips.
 

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/dev/memory-analysis/memory-efficiency-analyze.py

@@ -470,7 +470,7 @@ def write_text_report(
         )
     r_squared = "n/a" if model.r_squared is None else f"{model.r_squared:.4f}"
     print("\nFit quality:")
-    print(f"  R²: {r_squared}")
+    print(f"  R^2: {r_squared}")
     print(f"  mean absolute error: {model.mean_absolute_error_megabytes:.2f} MiB")
     print(f"  p95 absolute error: {model.p95_absolute_error_megabytes:.2f} MiB")
     print(f"  max absolute error: {model.max_absolute_error_megabytes:.2f} MiB")

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/examples/import.py

@@ -27,9 +27,9 @@ config = src.Config(
 # Discover the instance's auth providers and code hosts
 discovery = src.Get(config)
 for auth_provider in discovery.auth_providers:
-    print("auth provider:", auth_provider.get("displayName"))
-for code_host in discovery.code_hosts:
-    print("code host:", code_host.get("displayName"))
+    print("auth provider:", auth_provider["authProvider"].get("displayName"))
+for code_host_connection in discovery.code_host_connections:
+    print("code host:", code_host_connection["codeHostConnection"].get("displayName"))
 
 # Configure your mapping rules
 mapping_rules: list[src.MappingRule] = [

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/examples/maps.yaml

@@ -1,6 +1,6 @@
-# User → Repo permission mapping rules
+# User -> Repo permission mapping rules
 
-# Maintain your maps.yaml file, using the values from auth-providers.yaml and code-hosts.yaml,
+# Maintain your maps.yaml file, using the values from auth-providers.yaml and code-host-connections.yaml,
 # which are created by the --get command, under `src-auth-perms-sync-runs/<endpoint>/`
 
 # Schema details:

{src_auth_perms_sync-0.7.0 → src_auth_perms_sync-0.8.1}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "hatchling.build"
 
 [dependency-groups]
 dev = [
-    "pyright>=1.1.410",
-    "ruff>=0.15.17",
+    "pyright>=1.1.411",
+    "ruff>=0.15.20",
     "types-pyyaml>=6.0.12.20260518",
 ]
 
@@ -30,9 +30,9 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "json5>=0.14.0",
+    "json5>=0.15.0",
     "pyyaml>=6.0.3",
-    "src-py-lib[otel]==0.3.0",
+    "src-py-lib[otel]==0.3.2",
 ]
 keywords = [
     "Sourcegraph"
@@ -63,9 +63,7 @@ line-length = 100
 extend-exclude = ["src-auth-perms-sync-runs"]
 
 [tool.ruff.lint]
-# RUF001-RUF003 ban confusable Unicode (en dash, multiplication sign,
-# lookalike letters) in Python strings, comments, and docstrings;
-# tests/confusables.py applies the same policy to non-Python files.
+# tests/unicode_scan.py bans non-ASCII characters in tracked text files.
 select = ["E", "F", "I", "B", "UP", "SIM", "RUF001", "RUF002", "RUF003"]
 
 [tool.uv]