Fix TypeScript errors in SCIM and RLS helper functions

content/docs/references/auth/meta.json

@@ -5,6 +5,7 @@
     "identity",
     "organization",
     "policy",
-    "role"
+    "role",
+    "scim"
   ]
 }

content/docs/references/auth/scim/SCIMAddress.mdx

@@ -0,0 +1,17 @@
+---
+title: SCIMAddress
+description: SCIMAddress Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **formatted** | `string` | optional | Formatted address |
+| **streetAddress** | `string` | optional | Street address |
+| **locality** | `string` | optional | City/Locality |
+| **region** | `string` | optional | State/Region |
+| **postalCode** | `string` | optional | Postal code |
+| **country** | `string` | optional | Country |
+| **type** | `Enum<'work' \| 'home' \| 'other'>` | optional | Address type |
+| **primary** | `boolean` | optional | Primary address indicator |

content/docs/references/auth/scim/SCIMEmail.mdx

@@ -0,0 +1,13 @@
+---
+title: SCIMEmail
+description: SCIMEmail Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **value** | `string` | ✅ | Email address |
+| **type** | `Enum<'work' \| 'home' \| 'other'>` | optional | Email type |
+| **display** | `string` | optional | Display label |
+| **primary** | `boolean` | optional | Primary email indicator |

content/docs/references/auth/scim/SCIMEnterpriseUser.mdx

@@ -0,0 +1,15 @@
+---
+title: SCIMEnterpriseUser
+description: SCIMEnterpriseUser Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **employeeNumber** | `string` | optional | Employee number |
+| **costCenter** | `string` | optional | Cost center |
+| **organization** | `string` | optional | Organization |
+| **division** | `string` | optional | Division |
+| **department** | `string` | optional | Department |
+| **manager** | `object` | optional | Manager reference |

content/docs/references/auth/scim/SCIMError.mdx

@@ -0,0 +1,13 @@
+---
+title: SCIMError
+description: SCIMError Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **schemas** | `string[]` | optional | SCIM schema URIs |
+| **status** | `integer` | ✅ | HTTP status code |
+| **scimType** | `Enum<'invalidFilter' \| 'tooMany' \| 'uniqueness' \| 'mutability' \| 'invalidSyntax' \| 'invalidPath' \| 'noTarget' \| 'invalidValue' \| 'invalidVers' \| 'sensitive'>` | optional | SCIM error type |
+| **detail** | `string` | optional | Error detail message |

content/docs/references/auth/scim/SCIMGroup.mdx

@@ -0,0 +1,15 @@
+---
+title: SCIMGroup
+description: SCIMGroup Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **schemas** | `string[]` | optional | SCIM schema URIs (must include Group schema) |
+| **id** | `string` | optional | Unique resource identifier |
+| **externalId** | `string` | optional | External identifier from client system |
+| **displayName** | `string` | ✅ | Group display name (REQUIRED) |
+| **members** | `object[]` | optional | Group members |
+| **meta** | `object` | optional | Resource metadata |

content/docs/references/auth/scim/SCIMGroupReference.mdx

@@ -0,0 +1,13 @@
+---
+title: SCIMGroupReference
+description: SCIMGroupReference Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **value** | `string` | ✅ | Group ID |
+| **$ref** | `string` | optional | URI reference to the group |
+| **display** | `string` | optional | Group display name |
+| **type** | `Enum<'direct' \| 'indirect'>` | optional | Membership type |

content/docs/references/auth/scim/SCIMListResponse.mdx

@@ -0,0 +1,14 @@
+---
+title: SCIMListResponse
+description: SCIMListResponse Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **schemas** | `string[]` | optional | SCIM schema URIs |
+| **totalResults** | `integer` | ✅ | Total results count |
+| **Resources** | `object \| object \| Record<string, any>[]` | ✅ | Resources array (Users, Groups, or custom resources) |
+| **startIndex** | `integer` | optional | Start index (1-based) |
+| **itemsPerPage** | `integer` | optional | Items per page |

content/docs/references/auth/scim/SCIMMemberReference.mdx

@@ -0,0 +1,13 @@
+---
+title: SCIMMemberReference
+description: SCIMMemberReference Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **value** | `string` | ✅ | Member ID |
+| **$ref** | `string` | optional | URI reference to the member |
+| **type** | `Enum<'User' \| 'Group'>` | optional | Member type |
+| **display** | `string` | optional | Member display name |

content/docs/references/auth/scim/SCIMMeta.mdx

@@ -0,0 +1,14 @@
+---
+title: SCIMMeta
+description: SCIMMeta Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **resourceType** | `string` | optional | Resource type |
+| **created** | `string` | optional | Creation timestamp |
+| **lastModified** | `string` | optional | Last modification timestamp |
+| **location** | `string` | optional | Resource location URI |
+| **version** | `string` | optional | Entity tag (ETag) for concurrency control |

content/docs/references/auth/scim/SCIMName.mdx

@@ -0,0 +1,15 @@
+---
+title: SCIMName
+description: SCIMName Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **formatted** | `string` | optional | Formatted full name |
+| **familyName** | `string` | optional | Family name (last name) |
+| **givenName** | `string` | optional | Given name (first name) |
+| **middleName** | `string` | optional | Middle name |
+| **honorificPrefix** | `string` | optional | Honorific prefix (Mr., Ms., Dr.) |
+| **honorificSuffix** | `string` | optional | Honorific suffix (Jr., Sr.) |

content/docs/references/auth/scim/SCIMPatchOperation.mdx

@@ -0,0 +1,12 @@
+---
+title: SCIMPatchOperation
+description: SCIMPatchOperation Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **op** | `Enum<'add' \| 'remove' \| 'replace'>` | ✅ | Operation type |
+| **path** | `string` | optional | Attribute path (optional for add) |
+| **value** | `any` | optional | Value to set |

content/docs/references/auth/scim/SCIMPatchRequest.mdx

@@ -0,0 +1,11 @@
+---
+title: SCIMPatchRequest
+description: SCIMPatchRequest Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **schemas** | `string[]` | optional | SCIM schema URIs |
+| **Operations** | `object[]` | ✅ | Patch operations |

content/docs/references/auth/scim/SCIMPhoneNumber.mdx

@@ -0,0 +1,13 @@
+---
+title: SCIMPhoneNumber
+description: SCIMPhoneNumber Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **value** | `string` | ✅ | Phone number |
+| **type** | `Enum<'work' \| 'home' \| 'mobile' \| 'fax' \| 'pager' \| 'other'>` | optional | Phone number type |
+| **display** | `string` | optional | Display label |
+| **primary** | `boolean` | optional | Primary phone indicator |

content/docs/references/auth/scim/SCIMUser.mdx

@@ -0,0 +1,35 @@
+---
+title: SCIMUser
+description: SCIMUser Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **schemas** | `string[]` | optional | SCIM schema URIs (must include User schema) |
+| **id** | `string` | optional | Unique resource identifier |
+| **externalId** | `string` | optional | External identifier from client system |
+| **userName** | `string` | ✅ | Unique username (REQUIRED) |
+| **name** | `object` | optional | Structured name components |
+| **displayName** | `string` | optional | Display name for UI |
+| **nickName** | `string` | optional | Nickname |
+| **profileUrl** | `string` | optional | Profile page URL |
+| **title** | `string` | optional | Job title |
+| **userType** | `string` | optional | User type (employee, contractor) |
+| **preferredLanguage** | `string` | optional | Preferred language (ISO 639-1) |
+| **locale** | `string` | optional | Locale (e.g., en-US) |
+| **timezone** | `string` | optional | Timezone |
+| **active** | `boolean` | optional | Account active status |
+| **password** | `string` | optional | Password (write-only) |
+| **emails** | `object[]` | optional | Email addresses |
+| **phoneNumbers** | `object[]` | optional | Phone numbers |
+| **ims** | `object[]` | optional | IM addresses |
+| **photos** | `object[]` | optional | Photo URLs |
+| **addresses** | `object[]` | optional | Physical addresses |
+| **groups** | `object[]` | optional | Group memberships |
+| **entitlements** | `object[]` | optional | Entitlements |
+| **roles** | `object[]` | optional | Roles |
+| **x509Certificates** | `object[]` | optional | X509 certificates |
+| **meta** | `object` | optional | Resource metadata |
+| **urn:ietf:params:scim:schemas:extension:enterprise:2.0:User** | `object` | optional | Enterprise user attributes |

content/docs/references/auth/scim/meta.json

@@ -0,0 +1,3 @@
+{
+  "title": "Scim"
+}

content/docs/references/permission/meta.json

@@ -2,6 +2,7 @@
   "title": "Permission Protocol",
   "pages": [
     "permission",
+    "rls",
     "sharing",
     "territory"
   ]

content/docs/references/permission/rls/RLSConfig.mdx

@@ -0,0 +1,17 @@
+---
+title: RLSConfig
+description: RLSConfig Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **enabled** | `boolean` | optional | Enable RLS enforcement globally |
+| **defaultPolicy** | `Enum<'deny' \| 'allow'>` | optional | Default action when no policies match |
+| **allowSuperuserBypass** | `boolean` | optional | Allow superusers to bypass RLS |
+| **bypassRoles** | `string[]` | optional | Roles that bypass RLS (see all data) |
+| **logEvaluations** | `boolean` | optional | Log RLS policy evaluations for debugging |
+| **cacheResults** | `boolean` | optional | Cache RLS evaluation results |
+| **cacheTtlSeconds** | `integer` | optional | Cache TTL in seconds |
+| **prefetchUserContext** | `boolean` | optional | Pre-fetch user context for performance |

content/docs/references/permission/rls/RLSEvaluationResult.mdx

@@ -0,0 +1,15 @@
+---
+title: RLSEvaluationResult
+description: RLSEvaluationResult Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **policyName** | `string` | ✅ | Policy name |
+| **granted** | `boolean` | ✅ | Whether access was granted |
+| **durationMs** | `number` | optional | Evaluation duration in milliseconds |
+| **error** | `string` | optional | Error message if evaluation failed |
+| **usingResult** | `boolean` | optional | USING clause evaluation result |
+| **checkResult** | `boolean` | optional | CHECK clause evaluation result |

content/docs/references/permission/rls/RLSOperation.mdx

@@ -0,0 +1,12 @@
+---
+title: RLSOperation
+description: RLSOperation Schema Reference
+---
+
+## Allowed Values
+
+* `select`
+* `insert`
+* `update`
+* `delete`
+* `all`

content/docs/references/permission/rls/RLSUserContext.mdx

@@ -0,0 +1,15 @@
+---
+title: RLSUserContext
+description: RLSUserContext Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **id** | `string` | ✅ | User ID |
+| **email** | `string` | optional | User email |
+| **tenantId** | `string` | optional | Tenant/Organization ID |
+| **role** | `string \| string[]` | optional | User role(s) |
+| **department** | `string` | optional | User department |
+| **attributes** | `Record<string, any>` | optional | Additional custom user attributes |

content/docs/references/permission/rls/RowLevelSecurityPolicy.mdx

@@ -0,0 +1,20 @@
+---
+title: RowLevelSecurityPolicy
+description: RowLevelSecurityPolicy Schema Reference
+---
+
+## Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **name** | `string` | ✅ | Policy unique identifier (snake_case) |
+| **label** | `string` | optional | Human-readable policy label |
+| **description** | `string` | optional | Policy description and business justification |
+| **object** | `string` | ✅ | Target object name |
+| **operation** | `Enum<'select' \| 'insert' \| 'update' \| 'delete' \| 'all'>` | ✅ | Database operation this policy applies to |
+| **using** | `string` | optional | Filter condition for SELECT/UPDATE/DELETE (PostgreSQL SQL WHERE clause syntax with parameterized context variables). Optional for INSERT-only policies. |
+| **check** | `string` | optional | Validation condition for INSERT/UPDATE (defaults to USING clause if not specified - enforced at application level) |
+| **roles** | `string[]` | optional | Roles this policy applies to (omit for all roles) |
+| **enabled** | `boolean` | optional | Whether this policy is active |
+| **priority** | `integer` | optional | Policy evaluation priority (higher = evaluated first) |
+| **tags** | `string[]` | optional | Policy categorization tags |

content/docs/references/permission/rls/meta.json

@@ -0,0 +1,3 @@
+{
+  "title": "Rls"
+}

packages/spec/json-schema/auth/SCIMAddress.json

@@ -0,0 +1,50 @@
+{
+  "$ref": "#/definitions/SCIMAddress",
+  "definitions": {
+    "SCIMAddress": {
+      "type": "object",
+      "properties": {
+        "formatted": {
+          "type": "string",
+          "description": "Formatted address"
+        },
+        "streetAddress": {
+          "type": "string",
+          "description": "Street address"
+        },
+        "locality": {
+          "type": "string",
+          "description": "City/Locality"
+        },
+        "region": {
+          "type": "string",
+          "description": "State/Region"
+        },
+        "postalCode": {
+          "type": "string",
+          "description": "Postal code"
+        },
+        "country": {
+          "type": "string",
+          "description": "Country"
+        },
+        "type": {
+          "type": "string",
+          "enum": [
+            "work",
+            "home",
+            "other"
+          ],
+          "description": "Address type"
+        },
+        "primary": {
+          "type": "boolean",
+          "default": false,
+          "description": "Primary address indicator"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}