@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/access-model/change-gate.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The contract of the READ-BEFORE-WRITE gate: nothing is created, changed or
+ * removed at a place its author cannot read. The service that answers
+ * (filesystem stats, access checks) is `modules/access/change-read-gate.ts`;
+ * this file carries only the types, so the workflow, kb-fs and tool modules
+ * depend on the contract and never on the access module.
+ *
+ * Why `read`, when every write already needs `write`: on a draft branch no
+ * write grant is needed at all — anyone may propose anything, and the change
+ * request is where the real boundary lives. Without this gate a proposal
+ * could land in a folder its author cannot see, where it would vanish from
+ * them the moment it was added. And a write grant only IMPLIES read; a
+ * nearer `deny read` can take the read away while the write stands. The gate
+ * makes the one rule hold everywhere: you can only change what you can see.
+ *
+ * The one exception is a NEW FOLDER directly under one of the three roots
+ * (knowledge, skills, plugins — `creatableRootDirNames`). Those roots grant
+ * read to nobody by default, and a person's own space or a new plugin or
+ * skill has to start somewhere. The new folder carries its creator's own
+ * grant in its `access.md` (see `ICreatorAccess`), so what they create there
+ * is visible to them from the first byte. A loose FILE directly at a root
+ * cannot carry such a grant, so it is not excepted.
+ */
+/**
+ * Where a change is asked about. `'file'` is what every lock acquire is (the
+ * path being written, moved, or deleted — a `.gitkeep` included); `'dir'` is
+ * for a caller asking about a folder itself before it fills it, such as the
+ * destination of an archive extraction.
+ */
+export type ChangeTargetKind = 'file' | 'dir';
+export type ChangeReadVerdict = {
+    allowed: true;
+    via: 
+    /** The caller reads the path (or, for a new path, where it lands). */
+    'readable'
+    /** A new folder directly under one of the three roots — the exception. */
+     | 'new-top-level-folder'
+    /** Outside the knowledge-base repository: no read rules apply. */
+     | 'outside-kb'
+    /** A machine-owned file whose writer the write rule already names. */
+     | 'machine-owned'
+    /** An admin on a file directly in the repository root — the rescue path. */
+     | 'admin-rescue'
+    /**
+     * No `roles.yaml` on this tree at all — a repository before its first
+     * one: nothing to decide against. A `roles.yaml` that is THERE but
+     * unusable is not this: a broken rule set is an error, never an open
+     * door.
+     */
+     | 'no-rules';
+} | {
+    allowed: false;
+    /**
+     * The repo-relative path the caller cannot read: the target itself when
+     * it exists, otherwise the folder it would land in (`''` = the root).
+     */
+    unreadable: string;
+};
+export interface IChangeReadGate {
+    /** The verdict for `wsPath` (workspace-relative), with why it holds. */
+    judge(workspaceId: string, userEmail: string, wsPath: string, kind: ChangeTargetKind): Promise<ChangeReadVerdict>;
+    /** `judge`, throwing `AccessDeniedError` (with `unreadable` set) on a refusal. */
+    assertMayChange(workspaceId: string, userEmail: string, wsPath: string, kind: ChangeTargetKind): Promise<void>;
+}
+//# sourceMappingURL=change-gate.d.ts.map

package/dist/modules/access-model/change-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-gate.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/change-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,KAAK,CAAC;AAE9C,MAAM,MAAM,iBAAiB,GACzB;IACE,OAAO,EAAE,IAAI,CAAC;IACd,GAAG;IACD,sEAAsE;IACpE,UAAU;IACZ,0EAA0E;OACxE,sBAAsB;IACxB,kEAAkE;OAChE,YAAY;IACd,sEAAsE;OACpE,eAAe;IACjB,4EAA4E;OAC1E,cAAc;IAChB;;;;;OAKG;OACD,UAAU,CAAC;CAChB,GACD;IACE,OAAO,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE9B,kFAAkF;IAClF,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/modules/access-model/change-gate.js

@@ -0,0 +1,25 @@
+/**
+ * The contract of the READ-BEFORE-WRITE gate: nothing is created, changed or
+ * removed at a place its author cannot read. The service that answers
+ * (filesystem stats, access checks) is `modules/access/change-read-gate.ts`;
+ * this file carries only the types, so the workflow, kb-fs and tool modules
+ * depend on the contract and never on the access module.
+ *
+ * Why `read`, when every write already needs `write`: on a draft branch no
+ * write grant is needed at all — anyone may propose anything, and the change
+ * request is where the real boundary lives. Without this gate a proposal
+ * could land in a folder its author cannot see, where it would vanish from
+ * them the moment it was added. And a write grant only IMPLIES read; a
+ * nearer `deny read` can take the read away while the write stands. The gate
+ * makes the one rule hold everywhere: you can only change what you can see.
+ *
+ * The one exception is a NEW FOLDER directly under one of the three roots
+ * (knowledge, skills, plugins — `creatableRootDirNames`). Those roots grant
+ * read to nobody by default, and a person's own space or a new plugin or
+ * skill has to start somewhere. The new folder carries its creator's own
+ * grant in its `access.md` (see `ICreatorAccess`), so what they create there
+ * is visible to them from the first byte. A loose FILE directly at a root
+ * cannot carry such a grant, so it is not excepted.
+ */
+export {};
+//# sourceMappingURL=change-gate.js.map

package/dist/modules/access-model/change-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-gate.js","sourceRoot":"","sources":["../../../src/modules/access-model/change-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}

package/dist/modules/access-model/creator.d.ts

@@ -8,26 +8,24 @@
  */
 import type { Principal } from './access-splice.js';
 /**
- * How a pending creation gets its creator read grant.
- *   - `seed-access-md`: merge the grant into `wsRelPath` (a new directory's
- *     own `access.md`, workspace-relative) — BEFORE or alongside the creation,
- *     via the caller's own lock+commit machinery. The caller MUST re-read the
- *     file's CURRENT text under its lock and write `apply(current)` ('' when
- *     absent), never a precomputed fresh file: two concurrent creators can
- *     both plan a seed for the same new directory, and a blind overwrite
- *     would silently revoke whichever grant landed first. Skip the write when
- *     `apply` returns the input unchanged, and call `noteAccessFileWritten`
- *     after a write so the resolver cache drops.
- *   - `frontmatter`: run the new file's content through `apply` before
- *     writing it, so the grant lands atomically inside the created file.
+ * How a pending creation gets its creator read grant — there is one way:
+ * `seed-access-md` merges the grant into `wsRelPath` (the new top-level
+ * folder's own `access.md`, workspace-relative) BEFORE or alongside the
+ * creation, via the caller's own lock+commit machinery. The caller MUST
+ * re-read the file's CURRENT text under its lock and write `apply(current)`
+ * ('' when absent), never a precomputed fresh file: two concurrent creators
+ * can both plan a seed for the same new directory, and a blind overwrite
+ * would silently revoke whichever grant landed first. Skip the write when
+ * `apply` returns the input unchanged, and call `noteAccessFileWritten`
+ * after a write so the resolver cache drops.
+ *
+ * Kept a union of one so a second plan kind can return without touching the
+ * consumers' `plan?.kind === 'seed-access-md'` reads.
  */
 export type CreationGrantPlan = {
     kind: 'seed-access-md';
     wsRelPath: string;
     apply: (current: string) => string;
-} | {
-    kind: 'frontmatter';
-    apply: (content: string) => string;
 };
 /** The creator identity a grant is written for. */
 export interface Creator {
@@ -41,7 +39,6 @@ export interface Creator {
  */
 export interface ICreatorAccess {
     planForCreate(workspaceId: string, creator: Creator, wsRelPath: string, kind: 'file' | 'dir'): Promise<CreationGrantPlan | null>;
-    grantInExtractedFile(workspaceId: string, creator: Creator, wsRelPath: string): Promise<string | null>;
     noteAccessFileWritten(workspaceId: string): void;
 }
 /**

package/dist/modules/access-model/creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"creator.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/creator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,CAAC;AAEhE,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GAAG,KAAK,GACnB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAErC,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE1B,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAE5D"}
+{"version":3,"file":"creator.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/creator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;CACpC,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GAAG,KAAK,GACnB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAErC,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAE5D"}

package/dist/modules/access-model/creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"creator.js","sourceRoot":"","sources":["../../../src/modules/access-model/creator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAkDH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE;IAC1B,oGAAoG;IACpG,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;AACtF,CAAC"}
+{"version":3,"file":"creator.js","sourceRoot":"","sources":["../../../src/modules/access-model/creator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA+CH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE;IAC1B,oGAAoG;IACpG,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;AACtF,CAAC"}

package/dist/modules/access-model/frontmatter-lines.d.ts

@@ -0,0 +1,27 @@
+/** An opening fence with no closing one — the caller decides what that means. */
+export interface UnterminatedFrontmatter {
+    kind: 'unterminated';
+}
+/** No opening fence: the whole text is body. */
+export interface NoFrontmatter {
+    kind: 'none';
+    /** Every line of the text, so a splice can put it back untouched. */
+    lines: string[];
+    eol: string;
+}
+/** A closed `---` block. */
+export interface ScannedFrontmatter {
+    kind: 'frontmatter';
+    /** The opening fence line, on its own — a splice writes it back verbatim. */
+    open: string[];
+    /** The lines BETWEEN the fences. */
+    fm: string[];
+    /** The closing fence line and everything after it. */
+    post: string[];
+    /** The text's own line ending, so a rewrite does not dirty every line. */
+    eol: string;
+}
+export type FrontmatterScan = ScannedFrontmatter | NoFrontmatter | UnterminatedFrontmatter;
+/** Scan `text` for a leading `---` block. Decides nothing beyond the fences. */
+export declare function scanFrontmatter(text: string): FrontmatterScan;
+//# sourceMappingURL=frontmatter-lines.d.ts.map

package/dist/modules/access-model/frontmatter-lines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-lines.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/frontmatter-lines.ts"],"names":[],"mappings":"AAuBA,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,oCAAoC;IACpC,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,sDAAsD;IACtD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG,aAAa,GAAG,uBAAuB,CAAC;AAqC3F,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAU7D"}

package/dist/modules/access-model/frontmatter-lines.js

@@ -0,0 +1,74 @@
+/**
+ * THE line-based scan of a `---` frontmatter block, for the access model.
+ *
+ * The access model deliberately does NOT use the two-string splitter in
+ * `@bevel-software/platform-shared`: a splice has to put bytes back exactly
+ * as it found them — comments, blank lines, the file's own line endings —
+ * and that needs the LINES, not two captured strings. Two readers here
+ * scanned for the fences separately (the grammar's `extractFrontmatter` and
+ * `bodyAfterFrontmatter`, and the splice's `splitFrontmatter`), each with its
+ * own copy of the same loop. This is that loop, once.
+ *
+ * What it decides, and what it leaves to the caller:
+ *
+ *   - THE FENCE RULE is NOT decided here: it is `isFrontmatterFence` from the
+ *     shared package, the same function the splitter asks, so the access
+ *     model and the catalog can never again disagree about whether a file
+ *     has frontmatter (`frontmatter-fences.test.ts` asserts they agree).
+ *   - WHAT AN UNTERMINATED BLOCK MEANS is the caller's: the grammar reads it
+ *     as a parse error, the body reader as no body, the splice as a refusal.
+ *     One scan, three answers, none of them re-deriving the fences.
+ */
+import { isFrontmatterFence } from '@bevel-software/platform-shared';
+/** Whether a line IS a fence — the platform's one rule, shared with the catalog's splitter. */
+const isFence = isFrontmatterFence;
+/**
+ * The line ending a rewrite of `text` should use: the one MOST of its lines
+ * already use.
+ *
+ * A splice re-joins the whole file with a single separator — the frontmatter
+ * array is edited by index, so there is no surviving per-line ending to put
+ * back — which makes "which ending?" purely a question of whose lines get
+ * rewritten. The majority answers it with the fewest: a consistent file (all
+ * LF, or all CRLF, which is every file git checks out) comes back byte for
+ * byte, and a MIXED file is normalised towards whatever it mostly already is.
+ *
+ * The rule this replaces was "CRLF if the text contains one anywhere", which
+ * let a single stray CRLF — in the body, in a comment — rewrite every line of
+ * a knowledge base's access rules as churn in somebody's change request. Ties
+ * (and a file with no line breaks at all) go to the file's FIRST ending, so
+ * the answer is always the file's own.
+ */
+function dominantEol(text) {
+    let crlf = 0;
+    let lf = 0;
+    let firstIsCrlf = false;
+    for (let i = text.indexOf('\n'); i !== -1; i = text.indexOf('\n', i + 1)) {
+        const isCrlf = i > 0 && text[i - 1] === '\r';
+        if (crlf + lf === 0)
+            firstIsCrlf = isCrlf;
+        if (isCrlf)
+            crlf++;
+        else
+            lf++;
+    }
+    if (crlf > lf)
+        return '\r\n';
+    if (lf > crlf)
+        return '\n';
+    return firstIsCrlf ? '\r\n' : '\n';
+}
+/** Scan `text` for a leading `---` block. Decides nothing beyond the fences. */
+export function scanFrontmatter(text) {
+    const eol = dominantEol(text);
+    const lines = text.split(/\r?\n/);
+    if (!isFence(lines[0]))
+        return { kind: 'none', lines, eol };
+    for (let i = 1; i < lines.length; i++) {
+        if (isFence(lines[i])) {
+            return { kind: 'frontmatter', open: lines.slice(0, 1), fm: lines.slice(1, i), post: lines.slice(i), eol };
+        }
+    }
+    return { kind: 'unterminated' };
+}
+//# sourceMappingURL=frontmatter-lines.js.map

package/dist/modules/access-model/frontmatter-lines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-lines.js","sourceRoot":"","sources":["../../../src/modules/access-model/frontmatter-lines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AA8BrE,+FAA+F;AAC/F,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;QAC7C,IAAI,IAAI,GAAG,EAAE,KAAK,CAAC;YAAE,WAAW,GAAG,MAAM,CAAC;QAC1C,IAAI,MAAM;YAAE,IAAI,EAAE,CAAC;;YACd,EAAE,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC7B,IAAI,EAAE,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5G,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAClC,CAAC"}

package/dist/modules/access-model/group-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"group-files.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/group-files.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWnE;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,WAAW,CAAC;IACpB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,gBAAgB,GAAG,eAAe,CAyFpC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAWhD"}
+{"version":3,"file":"group-files.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/group-files.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcnE;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,WAAW,CAAC;IACpB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,gBAAgB,GAAG,eAAe,CAyFpC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAWhD"}

package/dist/modules/access-model/group-files.js

@@ -1,4 +1,4 @@
-import { EMAIL_REGEX, GROUP_REF_PREFIX, RESERVED_ROLE_NAMES, ROLE_TOKEN_PREFIX, canonicalEmail, canonicalRoleName, parseYamlSubset, } from './access-grammar.js';
+import { EMAIL_REGEX, GROUP_REF_PREFIX, RESERVED_ROLE_NAMES, PLUGIN_TOKEN_PREFIX, ROLE_TOKEN_PREFIX, canonicalEmail, canonicalRoleName, parseYamlSubset, } from './access-grammar.js';
 /**
  * Group files — the "who you are" half of the roles/groups split.
  *
@@ -61,6 +61,9 @@ export function unsafeNameReason(displayName) {
     if (canonicalRoleName(trimmed).startsWith(ROLE_TOKEN_PREFIX)) {
         return `starts with the reserved '${ROLE_TOKEN_PREFIX}' prefix (the explicit role token in access entries)`;
     }
+    if (canonicalRoleName(trimmed).startsWith(PLUGIN_TOKEN_PREFIX)) {
+        return `starts with the reserved '${PLUGIN_TOKEN_PREFIX}' prefix (the plugin-principal token in access entries)`;
+    }
     return null;
 }
 /**

package/dist/modules/access-model/group-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"group-files.js","sourceRoot":"","sources":["../../../src/modules/access-model/group-files.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,gCAAgC,CAAC;IACpE,4CAA4C;IAC5C,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,6BAA6B,CAAC;IACtE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACtD,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7D,OAAO,6BAA6B,iBAAiB,sDAAsD,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAAgB;IAEhB,oEAAoE;IACpE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;IAE/E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,+BAA+B,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAI,IAAgC,CAAC,MAAM,CAAC;IAC5D,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7E,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,8BAA8B,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAgB,IAAI,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAqC,CAAC,EAAE,CAAC;QACzF,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,8BAA8B,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,+BAA+B;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,MAAM,YAAY,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,yBAAyB,SAAS,aAAa,CAClF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,uBAAuB,SAAS,2BAA2B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,WAAW,aAAa,CAC7I,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,YAAY,WAAW,sCAAsC,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,YAAY,WAAW,0CAA0C,CAAC,CAAC;gBAC5F,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAClC,0DAA0D;YAC1D,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,4DAA4D;YAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,YAAY,gBAAgB,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,+DAA+D,CACrK,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,0BAA0B,GAAG,mBAAmB,CACnF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,QAAgB;IAEhB,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"group-files.js","sourceRoot":"","sources":["../../../src/modules/access-model/group-files.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,gCAAgC,CAAC;IACpE,4CAA4C;IAC5C,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,6BAA6B,CAAC;IACtE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACtD,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7D,OAAO,6BAA6B,iBAAiB,sDAAsD,CAAC;IAC9G,CAAC;IACD,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,OAAO,6BAA6B,mBAAmB,yDAAyD,CAAC;IACnH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAAgB;IAEhB,oEAAoE;IACpE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;IAE/E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,+BAA+B,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAI,IAAgC,CAAC,MAAM,CAAC;IAC5D,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7E,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,8BAA8B,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAgB,IAAI,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAqC,CAAC,EAAE,CAAC;QACzF,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,8BAA8B,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,+BAA+B;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,MAAM,YAAY,CACxE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,yBAAyB,SAAS,aAAa,CAClF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,uBAAuB,SAAS,2BAA2B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,WAAW,aAAa,CAC7I,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,YAAY,WAAW,sCAAsC,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,YAAY,WAAW,0CAA0C,CAAC,CAAC;gBAC5F,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAClC,0DAA0D;YAC1D,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,4DAA4D;YAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,YAAY,gBAAgB,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,+DAA+D,CACrK,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,YAAY,WAAW,0BAA0B,GAAG,mBAAmB,CACnF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,QAAgB;IAEhB,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/modules/access-model/plugin-principals.d.ts

@@ -0,0 +1,51 @@
+import { type AccessFile, type RolesIndex } from './access-grammar.js';
+/**
+ * Plugin principals — `plugin/<Name>/<verb>` — synthesised into the principal
+ * index from each plugin folder's own `access.md`, so a grant naming one
+ * resolves exactly like a group grant: the resolver sees a named principal
+ * with member emails and needs no plugin awareness at all.
+ *
+ * WHAT A PLUGIN'S ROSTER IS: the folder-governing rules of
+ * `Plugins/<Name>/access.md` — the file provisioning seeds and the join flow
+ * edits. Three principals per plugin, folded by the resolver's own
+ * `sourceVerbsFor` table — the ONE place the nesting is written down, so a
+ * roster can never drift from what resolution itself grants (`write` and
+ * `download` each imply `read`; `owner` implies all three):
+ *
+ *   plugin/<slug>/read    everyone under read, write, download or owner
+ *   plugin/<slug>/write   everyone under write or owner
+ *   plugin/<slug>/owner   everyone under owner
+ *
+ * The `<slug>` is the manifest slug of the folder (`pluginManifestName`), the
+ * identity `parseAccessEntry` canonicalises a hand-written token to.
+ *
+ * Deliberately NOT membership:
+ *   - the file's frontmatter (`read: everyone` there is DISCOVERABILITY of
+ *     the access.md itself, not membership) — `AccessFile.entries` already
+ *     holds only the folder block;
+ *   - rules inherited from above the plugin folder (the repo root's
+ *     `write: Admin`) — admins reach the skill through those same rules
+ *     anyway, and the roster should be what the plugin's page shows;
+ *   - `deny` entries — a denial subtracts nothing here; a plugin that wants
+ *     someone out removes the grant;
+ *   - other plugin tokens inside a plugin's rules — skipped, so synthesis is
+ *     one pass with no recursion and no cycle to detect.
+ *
+ * `everyone` in a plugin's own rules makes the corresponding principal
+ * PUBLIC: no email list can enumerate it, so its key is recorded in
+ * `index.publicKeys` and the resolver unions those into every caller's set.
+ *
+ * Runs AFTER groups are merged (so role and group entries expand through the
+ * finished index) and BEFORE unknown-role validation (so plugin tokens in
+ * access files count as known).
+ */
+export declare function synthesizePluginPrincipals(index: RolesIndex, accessFiles: ReadonlyMap<string, AccessFile>, 
+/**
+ * The repo-relative folders that ARE plugins — the ones carrying a
+ * `plugin.json` — each with its IDENTITY (the manifest's name, or the
+ * folder folded into one), as the model loader read them. A plugin is a
+ * folder with a manifest, at any depth; its access.md is its roster.
+ * Nothing else's is.
+ */
+pluginDirs: ReadonlyMap<string, string>): void;
+//# sourceMappingURL=plugin-principals.d.ts.map

package/dist/modules/access-model/plugin-principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-principals.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/plugin-principals.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,UAAU,EAEf,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC;AAC5C;;;;;;GAMG;AACH,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,IAAI,CAqCN"}

package/dist/modules/access-model/plugin-principals.js

@@ -0,0 +1,119 @@
+import { comparePathComponents } from '../../shared/path-order.js';
+import { EVERYONE_CANONICAL, PLUGIN_TOKEN_PREFIX, PLUGIN_TOKEN_VERBS, pluginPrincipalKey, sourceVerbsFor, } from './access-grammar.js';
+/**
+ * Plugin principals — `plugin/<Name>/<verb>` — synthesised into the principal
+ * index from each plugin folder's own `access.md`, so a grant naming one
+ * resolves exactly like a group grant: the resolver sees a named principal
+ * with member emails and needs no plugin awareness at all.
+ *
+ * WHAT A PLUGIN'S ROSTER IS: the folder-governing rules of
+ * `Plugins/<Name>/access.md` — the file provisioning seeds and the join flow
+ * edits. Three principals per plugin, folded by the resolver's own
+ * `sourceVerbsFor` table — the ONE place the nesting is written down, so a
+ * roster can never drift from what resolution itself grants (`write` and
+ * `download` each imply `read`; `owner` implies all three):
+ *
+ *   plugin/<slug>/read    everyone under read, write, download or owner
+ *   plugin/<slug>/write   everyone under write or owner
+ *   plugin/<slug>/owner   everyone under owner
+ *
+ * The `<slug>` is the manifest slug of the folder (`pluginManifestName`), the
+ * identity `parseAccessEntry` canonicalises a hand-written token to.
+ *
+ * Deliberately NOT membership:
+ *   - the file's frontmatter (`read: everyone` there is DISCOVERABILITY of
+ *     the access.md itself, not membership) — `AccessFile.entries` already
+ *     holds only the folder block;
+ *   - rules inherited from above the plugin folder (the repo root's
+ *     `write: Admin`) — admins reach the skill through those same rules
+ *     anyway, and the roster should be what the plugin's page shows;
+ *   - `deny` entries — a denial subtracts nothing here; a plugin that wants
+ *     someone out removes the grant;
+ *   - other plugin tokens inside a plugin's rules — skipped, so synthesis is
+ *     one pass with no recursion and no cycle to detect.
+ *
+ * `everyone` in a plugin's own rules makes the corresponding principal
+ * PUBLIC: no email list can enumerate it, so its key is recorded in
+ * `index.publicKeys` and the resolver unions those into every caller's set.
+ *
+ * Runs AFTER groups are merged (so role and group entries expand through the
+ * finished index) and BEFORE unknown-role validation (so plugin tokens in
+ * access files count as known).
+ */
+export function synthesizePluginPrincipals(index, accessFiles, 
+/**
+ * The repo-relative folders that ARE plugins — the ones carrying a
+ * `plugin.json` — each with its IDENTITY (the manifest's name, or the
+ * folder folded into one), as the model loader read them. A plugin is a
+ * folder with a manifest, at any depth; its access.md is its roster.
+ * Nothing else's is.
+ */
+pluginDirs) {
+    const claimed = new Set();
+    // The same path order discovery walks in, so "first by path" is the same
+    // plugin in both places — see `comparePathComponents`.
+    for (const [dir, slug] of [...pluginDirs].sort(([a], [b]) => comparePathComponents(a, b))) {
+        // Two plugins with one name: discovery keeps the first by path, so do we —
+        // and the claim is made BEFORE looking for a roster, or a first plugin
+        // without rules would leave its slug to a later twin's roster.
+        if (claimed.has(slug))
+            continue;
+        claimed.add(slug);
+        const file = accessFiles.get(dir);
+        if (!file)
+            continue; // a plugin without rules has no roster
+        for (const verb of PLUGIN_TOKEN_VERBS) {
+            const { emails, everyone, sourceKeys } = holdersOf(index, file, verb);
+            const key = pluginPrincipalKey(slug, verb);
+            index.byCanonical.set(key, {
+                displayName: key,
+                emails,
+                kind: 'plugin',
+                pluginName: slug,
+                pluginDir: dir,
+                sourceKeys,
+            });
+            for (const email of emails) {
+                let set = index.byEmail.get(email);
+                if (!set) {
+                    set = new Set();
+                    index.byEmail.set(email, set);
+                }
+                set.add(key);
+            }
+            if (everyone) {
+                index.publicKeys ??= new Set();
+                index.publicKeys.add(key);
+            }
+        }
+    }
+}
+function holdersOf(index, file, verb) {
+    const emails = new Set();
+    const sourceKeys = new Set();
+    let everyone = false;
+    for (const source of sourceVerbsFor(verb)) {
+        for (const entry of file.entries[source]) {
+            if (entry.deny)
+                continue;
+            if (entry.kind === 'user') {
+                emails.add(entry.email);
+                continue;
+            }
+            if (entry.role === EVERYONE_CANONICAL) {
+                everyone = true;
+                continue;
+            }
+            if (entry.role.startsWith(PLUGIN_TOKEN_PREFIX))
+                continue; // no recursion
+            const record = index.byCanonical.get(entry.role);
+            if (!record)
+                continue; // an unknown role contributes nothing (loadModel warns separately)
+            sourceKeys.add(entry.role);
+            for (const email of record.emails)
+                emails.add(email);
+        }
+    }
+    return { emails, everyone, sourceKeys };
+}
+//# sourceMappingURL=plugin-principals.js.map

package/dist/modules/access-model/plugin-principals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-principals.js","sourceRoot":"","sources":["../../../src/modules/access-model/plugin-principals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GAIf,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAiB,EACjB,WAA4C;AAC5C;;;;;;GAMG;AACH,UAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,yEAAyE;IACzE,uDAAuD;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,2EAA2E;QAC3E,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,uCAAuC;QAC5D,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE;gBACzB,WAAW,EAAE,GAAG;gBAChB,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,GAAG;gBACd,UAAU;aACX,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;oBAChB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAChC,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,UAAU,KAAK,IAAI,GAAG,EAAE,CAAC;gBAC/B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,KAAiB,EACjB,IAAgB,EAChB,IAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,IAAI;gBAAE,SAAS;YACzB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACtC,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAAE,SAAS,CAAC,eAAe;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM;gBAAE,SAAS,CAAC,mEAAmE;YAC1F,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC"}

package/dist/modules/access-model/roles-yaml-guard.d.ts

@@ -5,7 +5,7 @@
  * app. The runtime resolver's `loadModel` HARD-THROWS `AccessConfigError` on a
  * parse failure, and `isAdmin` swallows that into `false` for EVERYONE — so a
  * single malformed `roles.yaml` is an app-wide, in-app-unrecoverable admin
- * lockout. The dedicated Roles & Members service already validates every
+ * lockout. The dedicated App roles service already validates every
  * candidate before writing (`assertLoadable`), but the two RAW write paths do
  * not:
  *   - the human editor save  (`PUT /workspace/:id/file`)
@@ -21,7 +21,9 @@
  * a direct git push, a pre-guard commit) lives in `roles-admin.service.ts`.
  */
 import type { FileContent } from '@mastra/core/workspace';
+import type { GroupsIndex } from './group-files.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import type { WriteValidator } from '../kb-fs/locking-filesystem.js';
 /** Repo-relative basename of the roles file (it lives at the KB repo root). */
 export declare const ROLES_YAML_BASENAME = "roles.yaml";
 /**
@@ -52,5 +54,74 @@ export declare function assertRolesYamlParsable(content: string): void;
  * code path that writes `roles.yaml` writes it as text; a binary write to that
  * path is nonsensical and left alone.
  */
-export declare function makeRolesYamlWriteValidator(kbDirName: string): (path: string, content: FileContent) => void;
+export declare function makeRolesYamlWriteValidator(kbDirName: string): WriteValidator & ((path: string, content: FileContent) => void);
+/** What an agent is told to do instead of creating a role. */
+export declare const NEW_ROLE_GUIDANCE = "App roles are pre-set \u2014 add people to existing roles, and use a GROUP for a task- or team-scoped set of people.";
+/**
+ * An AGENT write whose candidate `roles.yaml` declares a role the current file
+ * does not. Same 422 shape as {@link RolesYamlInvalidError}; the message is
+ * self-contained because a tool error reaches the agent as its message alone,
+ * and the agent relays it to its user.
+ */
+export declare class RolesYamlNewRoleError extends WorkflowDomainError {
+    readonly roleNames: string[];
+    constructor(roleNames: string[]);
+}
+/**
+ * Throw {@link RolesYamlNewRoleError} if `candidate` declares a role name
+ * (compared canonically, so a respelling is not new) absent from `current`.
+ * A rename is a delete plus a create, so it is refused for the created name.
+ */
+export declare function assertNoNewRoles(current: string | null, candidate: string): void;
+/**
+ * The active group source an agent write is checked against: its groups and
+ * the file they came from (`groups.yaml`, or `synced-groups.yaml` in IdP mode).
+ * `null` when the source exists but could not be read — group entries are then
+ * left unchecked rather than every one refused.
+ */
+export type ActiveGroupsForValidation = {
+    groups: GroupsIndex;
+    sourceFile: string;
+} | null;
+/**
+ * An AGENT write whose candidate `roles.yaml` adds a `- group:<Name>` entry
+ * naming no group in the active group source. The resolver ignores such an
+ * entry with only a log warning — the role silently reaches nobody — so it is
+ * refused up front, naming each entry, in the same 422 shape as the others.
+ */
+export declare class RolesYamlUnknownGroupError extends WorkflowDomainError {
+    readonly entries: {
+        role: string;
+        entry: string;
+    }[];
+    constructor(entries: {
+        role: string;
+        entry: string;
+    }[], sourceFile: string);
+}
+/**
+ * Throw {@link RolesYamlUnknownGroupError} if `candidate` adds a group entry
+ * whose name (compared canonically) the active group source does not declare.
+ * Only ADDED entries are checked: an entry already in `current` whose group
+ * has since been retired is left alone, so it cannot block an unrelated
+ * membership edit.
+ */
+export declare function assertKnownGroups(current: string | null, candidate: string, active: ActiveGroupsForValidation): void;
+/**
+ * The agent's `roles.yaml` gate: everything {@link makeRolesYamlWriteValidator}
+ * refuses, plus any role the current file does not declare and — when
+ * `loadGroups` is given — any added `- group:<Name>` entry naming a group the
+ * active group source does not declare. Agents manage
+ * membership only; the human editor and the App roles service keep the plain
+ * validator. `readCurrent` returns the file's current text, null when absent.
+ * Content of any type is checked — decoded as UTF-8 — so bytes cannot slip past.
+ *
+ * `readCurrent` is read afresh on every call, never cached: `LockingFilesystem`
+ * calls this validator before taking the lock (a cheap early refusal) and again
+ * once the `roles.yaml` lock is held, on the bytes that land. That second call
+ * is the decisive one — it compares against the file as the other roles.yaml
+ * writers, which coordinate on the same lock, left it — so a role deleted while
+ * the write waited cannot be reinstated, and one added meanwhile is not refused.
+ */
+export declare function makeAgentRolesYamlWriteValidator(kbDirName: string, readCurrent: () => Promise<string | null>, loadGroups?: () => Promise<ActiveGroupsForValidation>): WriteValidator;
 //# sourceMappingURL=roles-yaml-guard.d.ts.map

package/dist/modules/access-model/roles-yaml-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles-yaml-guard.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/roles-yaml-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACd,MAAM,EAAE,MAAM,EAAE;CAS7B;AAOD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGpF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAChB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,IAAI,CAM9C"}
+{"version":3,"file":"roles-yaml-guard.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/roles-yaml-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACd,MAAM,EAAE,MAAM,EAAE;CAS7B;AAOD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGpF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAChB,cAAc,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC,CAQjE;AAED,8DAA8D;AAC9D,eAAO,MAAM,iBAAiB,yHACqF,CAAC;AAEpH;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;gBACjB,SAAS,EAAE,MAAM,EAAE;CAWhC;AAqBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAMhF;AAED;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC;AAU3F;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;gBACxC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,EAAE,UAAU,EAAE,MAAM;CAY3E;AA2BD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,yBAAyB,GAChC,IAAI,CAQN;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EACzC,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,yBAAyB,CAAC,GACpD,cAAc,CAWhB"}