@bevel-software/platform-core-backend 0.10.0 → 0.11.0

package/dist/modules/access/groups-admin.service.js

@@ -0,0 +1,442 @@
+/**
+ * Admin Groups service — CRUD on the default-branch `groups.yaml` (manual
+ * mode), the mode probe, and the connect-time retirement of manual groups.
+ *
+ * Shares `RolesAdminService`'s write pipeline via the SHARED
+ * `AdminLockedCommits` helper (one lock/commit implementation — the twin
+ * copies diverged once into a real bug) with the policy differences the
+ * roles/groups split defines:
+ *
+ *   - MODE GATE: every mutation refuses in IdP mode (`synced-groups.yaml`
+ *     exists on the default branch). Groups are managed in the identity
+ *     provider then; a second write surface would fragment org management —
+ *     which is the thing the mode model exists to prevent.
+ *   - COLLISION GATE: create/rename refuse a name whose canonical form is a
+ *     roles.yaml role. Bare-name precedence would let the group win, but a
+ *     deliberately-created shadow of a capability role is far more likely a
+ *     mistake than an intent — the IdP can still produce collisions, which
+ *     precedence then resolves (group first, `role/<name>` for the role).
+ *   - DEGRADE LOUDLY: a broken groups source never fails access resolution
+ *     closed — groups contribute nothing and the model carries a
+ *     `groupsHealth` marker, which the roster exposes so the Groups page can
+ *     banner it. A broken MANUAL groups.yaml additionally makes the roster
+ *     answer 422 with the parse message (the operator must see what to fix —
+ *     never a dead Groups page, never a silent empty roster they might
+ *     "repair" by re-creating groups over live bytes).
+ */
+import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { WorkflowDomainError } from '../workflow/workflow.errors.js';
+import { GROUP_REF_PREFIX, canonicalRoleName, hasAccessFrontmatterExtension, loadActiveGroups, } from './access-control.service.js';
+import { GROUPS_YAML, SYNCED_GROUPS_YAML, validateGroupsFile } from './group-files.js';
+import { parseRolesModel, removeGroupRefsEverywhere, renameGroupRefs, isGroupRefMember } from './roles-edit.js';
+import { makeRolesYamlWriteValidator } from './roles-yaml-guard.js';
+import { GroupsEditError, parseGroupsModel, createGroup as editCreateGroup, deleteGroup as editDeleteGroup, addGroupMember as editAddMember, removeGroupMember as editRemoveMember, renameGroupDisplay as editRenameDisplay, } from './groups-edit.js';
+import { AdminLockedCommits } from './admin-locked-commit.js';
+import { KbReferenceScanner } from './reference-scan.js';
+/** Where role→group assignments live (`group:<canonical>` member entries). */
+const ROLES_YAML = 'roles.yaml';
+/** A group mutation that cannot proceed. `payload.kind` distinguishes the
+ *  mode refusal (`'idp-mode'`) for the UI. */
+export class GroupsAdminError extends WorkflowDomainError {
+    constructor(message, status = 422, payload) {
+        super(message, status, payload);
+        this.name = 'GroupsAdminError';
+    }
+}
+export class GroupsAdminService {
+    workspaceService;
+    workflowService;
+    accessControl;
+    kbDirName;
+    defaultBranchOf;
+    eventBus;
+    /** Shared lock/commit plumbing — see module doc. */
+    locked;
+    /** Shared cached reference scanner. */
+    references;
+    constructor(workspaceService, workflowService, accessControl, kbDirName, 
+    /** Live-binding thunk — see RolesAdminService's identical note. */
+    defaultBranchOf, eventBus) {
+        this.workspaceService = workspaceService;
+        this.workflowService = workflowService;
+        this.accessControl = accessControl;
+        this.kbDirName = kbDirName;
+        this.defaultBranchOf = defaultBranchOf;
+        this.eventBus = eventBus;
+        this.locked = new AdminLockedCommits({
+            workspaceService,
+            workflowService,
+            kbDirName,
+            defaultBranchOf,
+            makeError: (message, status, payload) => new GroupsAdminError(message, status, payload),
+            logTag: 'groups-admin',
+            contendedSubject: 'Groups',
+            // The rename/delete batch may rewrite roles.yaml (group:<ref> members)
+            // — same pre-disk no-lockout gate the roles admin attaches.
+            validateWrite: makeRolesYamlWriteValidator(kbDirName),
+        });
+        // The event bus keeps the roster's `referencedBy` fresh: a share-dialog
+        // grant/revoke on any access.md happens outside this service, and the
+        // scanner invalidates its cache on those writes' events (TTL as backstop).
+        this.references = new KbReferenceScanner(workspaceService, kbDirName, eventBus);
+    }
+    get defaultBranch() {
+        return this.defaultBranchOf();
+    }
+    get workspaceId() {
+        return workspaceIdForBranch(this.defaultBranch);
+    }
+    async ensureWorkspace() {
+        await this.workspaceService.getOrCreateForBranch(this.defaultBranch);
+        return this.workspaceId;
+    }
+    /**
+     * IdP mode iff `synced-groups.yaml` exists — same rule the resolver applies.
+     *
+     * KNOWN GAP, deliberate: this cannot see the connect WINDOW — a directory
+     * connection that is configured but whose first provisioning push has not
+     * landed the synced file yet. Core's `SyncedGroupsSource` seam exposes only
+     * `listGroups()` (the overlay owns the connection), so "connected but not
+     * yet materialized" is not cheaply knowable server-side; the UI keeps its
+     * own suppression for that window.
+     */
+    async getMode() {
+        const workspaceId = await this.ensureWorkspace();
+        return (await this.locked.readKbFile(workspaceId, SYNCED_GROUPS_YAML)) !== null ? 'idp' : 'manual';
+    }
+    // ---- Read ---------------------------------------------------------------
+    /**
+     * Mode + roster + source health. Reads the ACTIVE source through the same
+     * `loadActiveGroups` rule the resolver applies, so mode, health, and the
+     * group set can never disagree with resolution:
+     *
+     *   - IdP mode (synced file present, even broken): the roster IS the synced
+     *     file — read-only in the UI; the manual file is retired and showing it
+     *     would misreport who has access. A broken synced file yields an EMPTY
+     *     roster with the `groupsHealth` marker (mode stays 'idp' — no
+     *     fallback to manual, which would resurrect retired groups).
+     *   - Manual mode, broken groups.yaml: 422 with the parse message — the
+     *     repair path must show the operator what to fix, never a dead page.
+     */
+    async getRoster() {
+        const workspaceId = await this.ensureWorkspace();
+        const active = await loadActiveGroups((f) => this.locked.readKbFile(workspaceId, f));
+        if (active.sourceFile === GROUPS_YAML && !active.health.ok) {
+            throw new GroupsAdminError(`groups.yaml cannot be read: ${active.health.reason}`, 422, {
+                kind: 'broken-groups',
+                file: active.health.file,
+                reason: active.health.reason,
+            });
+        }
+        const [referencesByToken, assignedByGroup] = await Promise.all([
+            this.references.scan(workspaceId),
+            this.rolesReferencingGroups(workspaceId),
+        ]);
+        const mode = active.sourceFile === SYNCED_GROUPS_YAML ? 'idp' : 'manual';
+        const groups = [];
+        for (const [canonical, def] of active.groups) {
+            groups.push({
+                canonical,
+                displayName: def.displayName,
+                // IdP members render sorted (machine-generated file, no author order
+                // to honour); manual members keep file order (the editor's view).
+                members: mode === 'idp' ? [...def.emails].sort() : [...def.emails],
+                // A group's references are its BARE-token hits, unconditionally: this
+                // group exists in the active source, so under group-first precedence
+                // it owns the bare key — even when a role shares the name (the roles
+                // roster is the mirror image: it then skips the bare hits and counts
+                // only `role/<name>`). Explicit `role/<name>` hits are never a group
+                // reference.
+                referencedBy: referencesByToken.get(canonical) ?? [],
+                assignedToRoles: assignedByGroup.get(canonical) ?? [],
+            });
+        }
+        return { mode, groups, groupsHealth: active.health };
+    }
+    /**
+     * Display names from the ACTIVE group source (synced in IdP mode, manual
+     * otherwise). Malformed files degrade to an empty list, matching the
+     * resolver's degrade rule.
+     */
+    async listActiveGroupNames() {
+        const workspaceId = await this.ensureWorkspace();
+        const active = await loadActiveGroups((f) => this.locked.readKbFile(workspaceId, f));
+        return [...active.groups.values()].map((g) => g.displayName);
+    }
+    /** Manual group display names — what the connect-time warning dialog lists. */
+    async listManualGroupNames() {
+        const workspaceId = await this.ensureWorkspace();
+        const text = (await this.locked.readKbFile(workspaceId, GROUPS_YAML)) ?? '';
+        return parseGroupsModel(text).map((g) => g.displayName);
+    }
+    // ---- Mutations ----------------------------------------------------------
+    async createGroup(actor, displayName) {
+        // Mode gate FIRST: in IdP mode every mutation must answer the typed 409
+        // (the UI's cue to point at the identity provider) — a name-collision 422
+        // for a name like "Admin" would mislead about what is actually refused.
+        await this.assertManualMode(await this.ensureWorkspace());
+        await this.assertRoleNameFree(displayName);
+        await this.runEdit(actor, (text) => editCreateGroup(text, displayName));
+        return this.getRoster();
+    }
+    /**
+     * Delete a group AND unassign it from every role — the `group:<canonical>`
+     * members in roles.yaml — in the SAME atomic locked commit (mirror of the
+     * rename's ref rewrite): a delete that left the refs would silently shrink
+     * each assigned role's membership behind a mere log warning. Grant
+     * references in access.md are NOT touched — a dangling grant resolves to
+     * nothing by design (and the roster's `referencedBy` fed the confirm
+     * dialog's warning).
+     */
+    async deleteGroup(actor, canonical) {
+        const workspaceId = await this.ensureWorkspace();
+        await this.assertManualMode(workspaceId);
+        await this.locked.withFileLocks(workspaceId, actor, [GROUPS_YAML, ROLES_YAML], async () => {
+            const groupsOriginal = await this.locked.readKbFile(workspaceId, GROUPS_YAML);
+            const groupsEdit = this.guardEdit(() => editDeleteGroup(groupsOriginal ?? '', canonical));
+            this.assertLoadable(groupsEdit.text);
+            const files = [
+                { repoRel: GROUPS_YAML, content: groupsEdit.text, original: groupsOriginal },
+            ];
+            const rolesText = await this.locked.readKbFile(workspaceId, ROLES_YAML);
+            if (rolesText !== null) {
+                let rolesEdit;
+                try {
+                    rolesEdit = removeGroupRefsEverywhere(rolesText, canonical);
+                }
+                catch (err) {
+                    // Fail closed on a malformed roles.yaml: deleting the group without
+                    // unassigning it would strand dangling refs the delete exists to clean.
+                    throw new GroupsAdminError(`Cannot rewrite role assignments in ${ROLES_YAML}; delete aborted with no changes`, 422, { cause: err?.message });
+                }
+                if (rolesEdit.changed) {
+                    // Same pre-disk no-lockout gate LockingFilesystem would have run.
+                    makeRolesYamlWriteValidator(this.kbDirName)(`${this.kbDirName}/${ROLES_YAML}`, rolesEdit.text);
+                    files.push({ repoRel: ROLES_YAML, content: rolesEdit.text, original: rolesText });
+                }
+            }
+            await this.locked.writeAndCommitLocked(workspaceId, actor, files, `Delete group ${canonical}`);
+            this.afterWrite(workspaceId, actor, files.map((f) => f.repoRel));
+        });
+        return this.getRoster();
+    }
+    async addMember(actor, canonical, email) {
+        await this.runEdit(actor, (text) => editAddMember(text, canonical, email));
+        return this.getRoster();
+    }
+    async removeMember(actor, canonical, email) {
+        await this.runEdit(actor, (text) => editRemoveMember(text, canonical, email));
+        return this.getRoster();
+    }
+    /**
+     * Rename — canonical-changing renames rewrite every grant reference in ONE
+     * atomic commit (same machinery, same reasoning as ref unassignment on
+     * delete: a partial rewrite is a silent access drop).
+     */
+    async renameGroup(actor, canonical, newDisplayName) {
+        const workspaceId = await this.ensureWorkspace();
+        await this.assertManualMode(workspaceId);
+        const newCanonical = canonicalRoleName(newDisplayName);
+        if (newCanonical !== canonical)
+            await this.assertRoleNameFree(newDisplayName);
+        // Both roster files are read AND rewritten from snapshots — hold their
+        // locks across the whole build so a concurrent roster edit can't land in
+        // between and be overwritten by the batch.
+        await this.locked.withFileLocks(workspaceId, actor, [GROUPS_YAML, ROLES_YAML], () => this.renameGroupLocked(workspaceId, actor, canonical, newCanonical, newDisplayName));
+        return this.getRoster();
+    }
+    async renameGroupLocked(workspaceId, actor, canonical, newCanonical, newDisplayName) {
+        const text = (await this.locked.readKbFile(workspaceId, GROUPS_YAML)) ?? '';
+        const groupsEdit = this.guardEdit(() => editRenameDisplay(text, canonical, newDisplayName));
+        const files = [];
+        if (groupsEdit.changed) {
+            this.assertLoadable(groupsEdit.text);
+            files.push({ repoRel: GROUPS_YAML, content: groupsEdit.text, original: text });
+        }
+        if (newCanonical !== canonical) {
+            // Grant references (bare tokens in access.md + node frontmatter). The
+            // rewrite returns each file's ORIGINAL text alongside the new content,
+            // so the rollback snapshots reuse the read it already did — no second
+            // full-KB pass. Explicit `role/<name>` tokens are untouched by design:
+            // they reference the ROLE, not this group.
+            const refWrites = await this.references.rewriteReferences(workspaceId, canonical, newDisplayName.trim(), (message, cause) => new GroupsAdminError(message, 422, { cause }));
+            for (const w of refWrites) {
+                files.push({ repoRel: w.repoRelativePath, content: w.content, original: w.original });
+            }
+            // Role→group assignments live in roles.yaml as `group:<canonical>` —
+            // stored canonical, so they go stale on a canonical-changing rename and
+            // the role would silently stop expanding to the group's members. Rewrite
+            // them in the SAME atomic commit. Fail closed on a malformed roles.yaml:
+            // committing the rename without it would strand any refs it holds.
+            const rolesText = await this.locked.readKbFile(workspaceId, ROLES_YAML);
+            if (rolesText !== null) {
+                let rolesEdit;
+                try {
+                    rolesEdit = renameGroupRefs(rolesText, canonical, newCanonical);
+                }
+                catch (err) {
+                    throw new GroupsAdminError(`Cannot rewrite role assignments in ${ROLES_YAML}; rename aborted with no changes`, 422, { cause: err?.message });
+                }
+                if (rolesEdit.changed) {
+                    // Same pre-disk no-lockout gate LockingFilesystem would have run —
+                    // the plain-write path must not lose it (a roles.yaml that fails
+                    // the resolver's parser is an app-wide admin lockout).
+                    makeRolesYamlWriteValidator(this.kbDirName)(`${this.kbDirName}/${ROLES_YAML}`, rolesEdit.text);
+                    files.push({ repoRel: ROLES_YAML, content: rolesEdit.text, original: rolesText });
+                }
+            }
+        }
+        if (files.length === 0)
+            return;
+        // Roster locks are already ours (withFileLocks; strict same-user acquire
+        // forbids LockingFilesystem here). Grant-reference candidates are written
+        // unlocked — same exposure every reference rewrite has always had.
+        await this.locked.writeAndCommitLocked(workspaceId, actor, files, `Rename group ${canonical} → ${newDisplayName.trim()}`);
+        this.afterWrite(workspaceId, actor, files.map((f) => f.repoRel));
+    }
+    /**
+     * Connect-time retirement: delete `groups.yaml` in one commit. Called by the
+     * SCIM connect flow AFTER the admin confirmed the warning dialog ("groups
+     * you don't recreate in the IdP will be lost"). Recovery is a git revert —
+     * the file's history keeps every retired group. No-op when the file is
+     * already absent.
+     */
+    async retireManualGroups(actor) {
+        const workspaceId = await this.ensureWorkspace();
+        let retired = false;
+        // Existence check AND delete under the SAME lock: checked outside it, a
+        // concurrent create could land groups.yaml right after a "not there"
+        // answer (leaving retired manual groups behind to resurrect if the synced
+        // file ever goes away), or a concurrent retire could delete it right
+        // after a "there" answer and fail this one on ENOENT.
+        await this.locked.withFileLocks(workspaceId, actor, [GROUPS_YAML], async () => {
+            const original = await this.locked.readKbFile(workspaceId, GROUPS_YAML);
+            if (original === null)
+                return; // already absent — a no-op retire
+            await this.locked.writeAndCommitLocked(workspaceId, actor, [{ repoRel: GROUPS_YAML, content: null, original }], 'Retire manual groups — directory sync connected');
+            retired = true;
+        });
+        if (retired)
+            this.afterWrite(workspaceId, actor, [GROUPS_YAML]);
+        return retired;
+    }
+    // ---- Internals ----------------------------------------------------------
+    guardEdit(fn) {
+        try {
+            return fn();
+        }
+        catch (err) {
+            if (err instanceof GroupsEditError)
+                throw new GroupsAdminError(err.message, err.status);
+            throw err;
+        }
+    }
+    assertLoadable(candidate) {
+        const v = validateGroupsFile(candidate, GROUPS_YAML);
+        if (!v.ok) {
+            throw new GroupsAdminError(`groups.yaml would be invalid: ${v.errors.join('; ')}`, 422);
+        }
+    }
+    async assertManualMode(workspaceId) {
+        if ((await this.locked.readKbFile(workspaceId, SYNCED_GROUPS_YAML)) !== null) {
+            throw new GroupsAdminError('Groups are synced from your identity provider — manage membership there.', 409, { kind: 'idp-mode' });
+        }
+    }
+    /**
+     * Refuse a group name that IS a role. Bare-name precedence (group-first)
+     * would make the group win resolution, so this is deliberate FRICTION, not
+     * a correctness need: an admin naming a group after a capability role is
+     * far more likely shadowing by accident than by intent. IdP-sourced
+     * collisions still happen (the sync writer doesn't consult roles.yaml) and
+     * precedence resolves them.
+     */
+    async assertRoleNameFree(displayName) {
+        const workspaceId = await this.ensureWorkspace();
+        const canonical = canonicalRoleName(displayName);
+        const rolesText = (await this.locked.readKbFile(workspaceId, 'roles.yaml')) ?? '';
+        let roles;
+        try {
+            roles = parseRolesModel(rolesText);
+        }
+        catch {
+            // A broken roles.yaml cannot vouch for the name being free — refuse
+            // rather than let a group land that may shadow a role once repaired.
+            throw new GroupsAdminError('roles.yaml is not readable — fix it before creating groups.', 409);
+        }
+        if (roles.some((r) => canonicalRoleName(r.displayName) === canonical)) {
+            throw new GroupsAdminError(`'${displayName.trim()}' is a role name — name the group something else (a role can be referenced explicitly as 'role/${canonical}').`, 422);
+        }
+    }
+    /**
+     * Which roles carry a `group:<canonical>` assignment, per group canonical.
+     * Advisory (feeds the roster's `assignedToRoles` warning field): a broken
+     * roles.yaml yields an empty map rather than failing the roster.
+     */
+    async rolesReferencingGroups(workspaceId) {
+        const rolesText = (await this.locked.readKbFile(workspaceId, ROLES_YAML)) ?? '';
+        const byGroup = new Map();
+        let roles;
+        try {
+            roles = parseRolesModel(rolesText);
+        }
+        catch {
+            return byGroup;
+        }
+        for (const role of roles) {
+            const roleCanonical = canonicalRoleName(role.displayName);
+            for (const member of role.members) {
+                if (!isGroupRefMember(member))
+                    continue;
+                const groupCanonical = canonicalRoleName(member.slice(GROUP_REF_PREFIX.length));
+                const list = byGroup.get(groupCanonical);
+                if (list) {
+                    if (!list.includes(roleCanonical))
+                        list.push(roleCanonical);
+                }
+                else {
+                    byGroup.set(groupCanonical, [roleCanonical]);
+                }
+            }
+        }
+        return byGroup;
+    }
+    async runEdit(actor, pre) {
+        const workspaceId = await this.ensureWorkspace();
+        await this.assertManualMode(workspaceId);
+        return this.locked.withFileLocks(workspaceId, actor, [GROUPS_YAML], () => this.runEditLocked(workspaceId, actor, pre));
+    }
+    async runEditLocked(workspaceId, actor, pre) {
+        // Keep absent (null) distinct from existing-but-empty ('') — rollback
+        // must DELETE a file it created, not truncate one that was already there.
+        const original = await this.locked.readKbFile(workspaceId, GROUPS_YAML);
+        const result = this.guardEdit(() => pre(original ?? ''));
+        if (!result.changed)
+            return;
+        this.assertLoadable(result.text);
+        await this.locked.writeAndCommitLocked(workspaceId, actor, [{ repoRel: GROUPS_YAML, content: result.text, original }], `Update ${GROUPS_YAML}`);
+        this.afterWrite(workspaceId, actor, [GROUPS_YAML]);
+    }
+    afterWrite(workspaceId, actor, repoRelPaths) {
+        this.accessControl.invalidate(workspaceId);
+        // Any write in this batch may have moved grant references (scanned-file
+        // rewrites on rename — `.md` AND `.tool`); drop the cached scan so the
+        // next roster is fresh.
+        if (repoRelPaths.some(hasAccessFrontmatterExtension))
+            this.references.invalidate(workspaceId);
+        if (!this.eventBus)
+            return;
+        for (const repoRel of repoRelPaths) {
+            this.eventBus.emit({
+                kind: 'file-changed',
+                workspaceId,
+                branch: this.defaultBranch,
+                path: `${this.kbDirName}/${repoRel}`,
+                newSha: null,
+                byUserId: actor.id,
+                byUserName: actor.name,
+            });
+        }
+        this.eventBus.emit({ kind: 'fs-tree-changed', workspaceId, branch: this.defaultBranch });
+    }
+}
+//# sourceMappingURL=groups-admin.service.js.map

package/dist/modules/access/groups-admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups-admin.service.js","sourceRoot":"","sources":["../../../src/modules/access/groups-admin.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,6BAA6B,EAC7B,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,WAAW,IAAI,eAAe,EAC9B,WAAW,IAAI,eAAe,EAC9B,cAAc,IAAI,aAAa,EAC/B,iBAAiB,IAAI,gBAAgB,EACrC,kBAAkB,IAAI,iBAAiB,GAExC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAoB,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,8EAA8E;AAC9E,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC;8CAC8C;AAC9C,MAAM,OAAO,gBAAiB,SAAQ,mBAAmB;IACvD,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG,EAAE,OAAiC;QAC1E,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AA8BD,MAAM,OAAO,kBAAkB;IAOV;IACA;IACA;IACA;IAEA;IACA;IAZnB,oDAAoD;IACnC,MAAM,CAAqB;IAC5C,uCAAuC;IACtB,UAAU,CAAqB;IAEhD,YACmB,gBAAmC,EACnC,eAAiC,EACjC,aAA6B,EAC7B,SAAiB;IAClC,mEAAmE;IAClD,eAA6B,EAC7B,QAA2B;QAN3B,qBAAgB,GAAhB,gBAAgB,CAAmB;QACnC,oBAAe,GAAf,eAAe,CAAkB;QACjC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;QAEjB,oBAAe,GAAf,eAAe,CAAc;QAC7B,aAAQ,GAAR,QAAQ,CAAmB;QAE5C,IAAI,CAAC,MAAM,GAAG,IAAI,kBAAkB,CAAC;YACnC,gBAAgB;YAChB,eAAe;YACf,SAAS;YACT,eAAe;YACf,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;YACvF,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,QAAQ;YAC1B,uEAAuE;YACvE,4DAA4D;YAC5D,aAAa,EAAE,2BAA2B,CAAC,SAAS,CAAC;SACtD,CAAC,CAAC;QACH,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,IAAI,CAAC,UAAU,GAAG,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrG,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE;gBACrF,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;gBACxB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,iBAAiB,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACjC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,IAAI,GAAe,MAAM,CAAC,UAAU,KAAK,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrF,MAAM,MAAM,GAAuB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS;gBACT,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,qEAAqE;gBACrE,kEAAkE;gBAClE,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;gBAClE,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,aAAa;gBACb,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;gBACpD,eAAe,EAAE,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB;QACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,oBAAoB;QACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,WAAW,CAAC,KAAe,EAAE,WAAmB;QACpD,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAe,EAAE,SAAiB;QAClD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,KAAK,IAAI,EAAE;YACxF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,cAAc,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,KAAK,GAAkB;gBAC3B,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE;aAC7E,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACxE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,IAAI,SAA6C,CAAC;gBAClD,IAAI,CAAC;oBACH,SAAS,GAAG,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC9D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,oEAAoE;oBACpE,wEAAwE;oBACxE,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,UAAU,kCAAkC,EAClF,GAAG,EACH,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,EAAE,CACnC,CAAC;gBACJ,CAAC;gBACD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,kEAAkE;oBAClE,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;oBAC/F,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACpC,WAAW,EACX,KAAK,EACL,KAAK,EACL,gBAAgB,SAAS,EAAE,CAC5B,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAe,EAAE,SAAiB,EAAE,KAAa;QAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAe,EAAE,SAAiB,EAAE,KAAa;QAClE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAe,EAAE,SAAiB,EAAE,cAAsB;QAC1E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,YAAY,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAE9E,uEAAuE;QACvE,yEAAyE;QACzE,2CAA2C;QAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,CAClF,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,CAAC,CACpF,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,WAAmB,EACnB,KAAe,EACf,SAAiB,EACjB,YAAoB,EACpB,cAAsB;QAEtB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,2CAA2C;YAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CACvD,WAAW,EACX,SAAS,EACT,cAAc,CAAC,IAAI,EAAE,EACrB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAClE,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,qEAAqE;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACxE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,IAAI,SAA6C,CAAC;gBAClD,IAAI,CAAC;oBACH,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,UAAU,kCAAkC,EAClF,GAAG,EACH,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,EAAE,CACnC,CAAC;gBACJ,CAAC;gBACD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,mEAAmE;oBACnE,iEAAiE;oBACjE,uDAAuD;oBACvD,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;oBAC/F,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,yEAAyE;QACzE,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACpC,WAAW,EACX,KAAK,EACL,KAAK,EACL,gBAAgB,SAAS,MAAM,cAAc,CAAC,IAAI,EAAE,EAAE,CACvD,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAe;QACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACxE,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,CAAC,kCAAkC;YACjE,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACpC,WAAW,EACX,KAAK,EACL,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EACnD,iDAAiD,CAClD,CAAC;YACF,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4EAA4E;IAEpE,SAAS,CAAC,EAA0B;QAC1C,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACxF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,SAAiB;QACtC,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QAChD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7E,MAAM,IAAI,gBAAgB,CACxB,0EAA0E,EAC1E,GAAG,EACH,EAAE,IAAI,EAAE,UAAU,EAAE,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,kBAAkB,CAAC,WAAmB;QAClD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,IAAI,gBAAgB,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,gBAAgB,CACxB,IAAI,WAAW,CAAC,IAAI,EAAE,kGAAkG,SAAS,KAAK,EACtI,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,sBAAsB,CAAC,WAAmB;QACtD,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACxC,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACzC,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;wBAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC9D,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAe,EAAE,GAAuC;QAC5E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CACvE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,CAC5C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,WAAmB,EACnB,KAAe,EACf,GAAuC;QAEvC,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACpC,WAAW,EACX,KAAK,EACL,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC1D,UAAU,WAAW,EAAE,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACrD,CAAC;IAEO,UAAU,CAAC,WAAmB,EAAE,KAAe,EAAE,YAAsB;QAC7E,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC3C,wEAAwE;QACxE,uEAAuE;QACvE,wBAAwB;QACxB,IAAI,YAAY,CAAC,IAAI,CAAC,6BAA6B,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC9F,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,cAAc;gBACpB,WAAW;gBACX,MAAM,EAAE,IAAI,CAAC,aAAa;gBAC1B,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE;gBACpC,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,UAAU,EAAE,KAAK,CAAC,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3F,CAAC;CACF"}

package/dist/modules/access/groups-edit.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Pure parse → edit → re-emit editor for `groups.yaml` — the manual-mode
+ * group file. Mirrors `roles-edit.ts` (same re-emit rationale: no body, no
+ * comments to preserve, deterministic canonical output), with two deliberate
+ * differences:
+ *
+ *   - No Admin invariants — groups carry no capabilities, so there is no
+ *     lockout class of mistake here.
+ *   - Members are EMAILS ONLY. `group:` references are a roles.yaml grammar
+ *     (a role assigned to a group); a group containing a group is nesting,
+ *     which is a deliberate non-goal.
+ *
+ * Policy that needs more than this file's text — IdP-mode gating, collision
+ * with role names — lives in `groups-admin.service.ts`.
+ */
+/** Bad-input failure when editing groups.yaml. */
+export declare class GroupsEditError extends Error {
+    readonly status: number;
+    constructor(message: string, status?: number);
+}
+export interface GroupModel {
+    displayName: string;
+    /** canonicalised, de-duplicated, in first-seen order */
+    members: string[];
+}
+export type GroupsModel = GroupModel[];
+export interface GroupsEditResult {
+    text: string;
+    changed: boolean;
+}
+/** Thin assert wrapper over the SHARED name-safety predicate (`group-files.ts`
+ *  `unsafeNameReason`) — one namespace, one set of rules, including the
+ *  reserved `role/` prefix. */
+export declare function assertSafeGroupDisplayName(displayName: string): void;
+/**
+ * Parse groups.yaml into the ordered model; `[]` for an empty/missing file.
+ *
+ * DERIVED from the resolver's own `parseGroupsFile` — one parser for the
+ * grammar, so the editor's skip rules (empty/reserved/duplicate names,
+ * malformed member emails) can never drift from the resolver's: the admin
+ * roster and the edit surface must never show an entry the resolver ignores,
+ * or an admin "manages" a group that grants nothing. Consequence, deliberate:
+ * the next edit's re-emit garbage-collects those dead entries from the file.
+ * Structural failures throw GroupsEditError (422) — the caller reads under
+ * the lock, so a broken on-disk file is an operator problem surfaced loudly,
+ * not a silent reset.
+ */
+export declare function parseGroupsModel(text: string): GroupsModel;
+/** Deterministic canonical emit; empty groups as `Name: []`. */
+export declare function emitGroupsModel(model: GroupsModel): string;
+export declare function createGroup(text: string, displayName: string): GroupsEditResult;
+export declare function deleteGroup(text: string, canonical: string): GroupsEditResult;
+export declare function addGroupMember(text: string, canonical: string, rawEmail: string): GroupsEditResult;
+export declare function removeGroupMember(text: string, canonical: string, rawEmail: string): GroupsEditResult;
+/** Rename a group's display name (canonical may change — service layer owns
+ *  the reference rewrite when it does). */
+export declare function renameGroupDisplay(text: string, canonical: string, newDisplayName: string): GroupsEditResult;
+//# sourceMappingURL=groups-edit.d.ts.map

package/dist/modules/access/groups-edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups-edit.d.ts","sourceRoot":"","sources":["../../../src/modules/access/groups-edit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAWH,kDAAkD;AAClD,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,MAAM,SAAM;CAK1C;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;AAEvC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;+BAE+B;AAC/B,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAKpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAQ1D;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAW1D;AAiBD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAY/E;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAM7E;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAqBlG;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CASrG;AAED;2CAC2C;AAC3C,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,gBAAgB,CAclB"}