@bevel-software/platform-core-backend 0.19.0 → 0.20.0

package/dist/modules/access/access-splice.js

@@ -1,389 +0,0 @@
-/**
- * Surgical text-splice editor for `access.md` frontmatter and node-frontmatter
- * access verbs.
- *
- * WHY a splice and not parse→model→emit: the resolver's parser
- * (`parseYamlSubset` / `extractFrontmatter` / `stripComment`) deliberately
- * throws away comments, blank lines, key order, AND the markdown body below the
- * closing `---`. Re-serialising from the parsed model would silently DELETE the
- * prose bodies the real `access.md` files carry (the repo-root one is a whole
- * README) — and a `parse(emit(x))` round-trip test would PASS anyway because
- * parse ignores the body. So every mutation here edits the RAW text: we locate
- * the verb's block, splice exactly one list line in or out, and leave every
- * other byte — comments, ordering, blank lines, the body — untouched.
- *
- *   ---
- *   write:                 (verb key line, indent 0)
- *     - Admin              (list item, indent 2)  <- splice point
- *     - Felix <f@x.eu>     (list item)
- *   # a comment            (preserved verbatim)
- *   owner: []              (inline-empty list)
- *   ---
- *   # Body prose           (preserved verbatim)
- *
- * The same engine serves node-frontmatter, which additionally accepts a scalar
- * form (`owner: Felix <f@x.eu>`). Adding a second principal to a scalar verb
- * normalises it to the block-list form.
- */
-import { parseAccessEntry, canonicalEmail, canonicalRoleName, accessMdDeclaresBodyRules, } from './access-control.service.js';
-/** Thrown when the input can't be spliced safely (malformed frontmatter, etc.). */
-export class AccessSpliceError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'AccessSpliceError';
-    }
-}
-/** Control chars (NUL..US) — newlines, tabs, etc. Never allowed in a principal. */
-// eslint-disable-next-line no-control-regex -- intentional control-char injection guard
-const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
-/**
- * Render a principal as the canonical access-entry line value the parser reads
- * back (`Name <email>` or a bare role display name). The caller is responsible
- * for having validated the principal first (see `validatePrincipal`).
- *
- * `deny` prefixes the entry with `deny ` so the resolver reads it as a denial
- * (the `deny-here` per-item override) — same line shape, opposite verdict.
- */
-export function renderEntry(p, deny = false) {
-    const body = p.kind === 'user' ? `${p.displayName} <${p.email}>` : p.role;
-    return deny ? `deny ${body}` : body;
-}
-/**
- * Validate a principal before it is spliced into a file. Rejects anything that
- * could break frontmatter or smuggle in extra YAML — newlines, control chars,
- * and emails / names that don't match the resolver's own regexes. This is the
- * injection guard: a principal that survives this is safe to render verbatim
- * into a `  - ` list line.
- *
- * Returns the canonical principal (lowercased email / canonical role) on
- * success, or throws `AccessSpliceError`.
- */
-export function validatePrincipal(p) {
-    if (p.kind === 'user') {
-        const displayName = p.displayName.trim();
-        const email = canonicalEmail(p.email);
-        if (!displayName)
-            throw new AccessSpliceError('person grant needs a display name');
-        // `#` is rejected because `uncomment()` truncates a whitespace-preceded `#`
-        // on read-back, so a name containing it would not round-trip through blockEntries.
-        if (CONTROL_CHARS.test(displayName) ||
-            displayName.includes('<') ||
-            displayName.includes('>') ||
-            displayName.includes('#')) {
-            throw new AccessSpliceError(`invalid display name: ${JSON.stringify(p.displayName)}`);
-        }
-        // Reuse the resolver's own email shape so a granted entry always parses back.
-        if (!/^[^<>\s@]+@[^<>\s@]+\.[^<>\s@]+$/.test(email)) {
-            throw new AccessSpliceError(`invalid email: ${JSON.stringify(p.email)}`);
-        }
-        // The rendered `Name <email>` line must round-trip through parseAccessEntry.
-        const round = parseAccessEntry(`${displayName} <${email}>`);
-        if (!round.ok || round.entry.kind !== 'user' || round.entry.deny) {
-            throw new AccessSpliceError(`person grant does not round-trip: ${JSON.stringify(p)}`);
-        }
-        return { kind: 'user', email, displayName };
-    }
-    const role = p.role.trim();
-    const canonical = canonicalRoleName(role);
-    if (!canonical)
-        throw new AccessSpliceError('role grant needs a name');
-    if (CONTROL_CHARS.test(role) ||
-        role.includes('<') ||
-        role.includes('>') ||
-        role.includes(':') ||
-        role.includes('#')) {
-        throw new AccessSpliceError(`invalid role name: ${JSON.stringify(p.role)}`);
-    }
-    // `deny` is never a grantee — it's the denial prefix. `everyone` IS grantable
-    // (the built-in public role); the access route restricts it to the read verb.
-    if (canonical === 'deny') {
-        throw new AccessSpliceError(`'${role}' is a reserved name and cannot be granted as a role`);
-    }
-    const round = parseAccessEntry(role);
-    if (!round.ok || round.entry.kind !== 'role' || round.entry.deny) {
-        throw new AccessSpliceError(`role grant does not round-trip: ${JSON.stringify(p)}`);
-    }
-    return { kind: 'role', role };
-}
-/**
- * True when a parsed entry names the given principal (ignoring deny prefix).
- * `tokenMatch` (role-shaped principals only) selects exact-spelling vs
- * name-level matching — see {@link TokenMatch}.
- */
-function entryMatches(entry, p, tokenMatch) {
-    if (p.kind === 'user')
-        return entry.kind === 'user' && entry.email === canonicalEmail(p.email);
-    if (entry.kind !== 'role')
-        return false;
-    const canonicalPrincipal = canonicalRoleName(p.role);
-    if (tokenMatch === 'exact')
-        return entry.role === canonicalPrincipal;
-    const strip = (token) => token.startsWith('role/') ? canonicalRoleName(token.slice('role/'.length)) : token;
-    return strip(entry.role) === strip(canonicalPrincipal);
-}
-/**
- * Split a file into [pre, frontmatter-lines, post] without losing a byte.
- * `hasFrontmatter` is false when the file has no `---` fence yet — callers that
- * grant into a fresh file synthesise one.
- */
-function splitFrontmatter(text) {
-    const eol = text.includes('\r\n') ? '\r\n' : '\n';
-    const lines = text.split(/\r?\n/);
-    // Opening fence must be the very first line.
-    if (lines[0]?.trim() !== '---') {
-        return { pre: [], fm: [], post: lines, eol, hasFrontmatter: false };
-    }
-    for (let i = 1; i < lines.length; i++) {
-        if (lines[i].trim() === '---') {
-            return {
-                pre: lines.slice(0, 1), // the opening ---
-                fm: lines.slice(1, i),
-                post: lines.slice(i), // closing --- onward (body preserved)
-                eol,
-                hasFrontmatter: true,
-            };
-        }
-    }
-    throw new AccessSpliceError('unterminated frontmatter — no closing `---`');
-}
-function joinFrontmatter(f) {
-    return [...f.pre, ...f.fm, ...f.post].join(f.eol);
-}
-/**
- * The line region a mutation edits, per {@link SpliceTarget}. `lines` aliases
- * the region's array (edited in place, like `f.fm` always was); `join()`
- * reassembles the whole file around it.
- */
-function pickRegion(text, f, target) {
-    if (target === 'folder' && f.hasFrontmatter && accessMdDeclaresBodyRules(text)) {
-        // New format: post = [closing '---', ...body]. Edit the body lines.
-        const closing = f.post[0];
-        const body = f.post.slice(1);
-        return {
-            lines: body,
-            join: () => [...f.pre, ...f.fm, closing, ...body].join(f.eol),
-        };
-    }
-    return { lines: f.fm, join: () => joinFrontmatter(f) };
-}
-/** Leading-space count of a line. */
-function indentOf(line) {
-    const m = line.match(/^( *)/);
-    return m ? m[1].length : 0;
-}
-/** Strip a trailing `# comment` the way the resolver's tokeniser does. */
-function uncomment(line) {
-    let inWs = true;
-    for (let i = 0; i < line.length; i++) {
-        const ch = line[i];
-        if (ch === '#' && (inWs || (i > 0 && /\s/.test(line[i - 1]))))
-            return line.slice(0, i);
-        if (!/\s/.test(ch))
-            inWs = false;
-    }
-    return line;
-}
-/**
- * Locate a verb's block within the frontmatter lines. Walks the raw lines (not
- * the parsed model) so we can address them for splicing. Recognises the three
- * shapes the resolver accepts: a block list, an inline `verb: []`, and (node
- * frontmatter only) an inline scalar `verb: value`.
- */
-function findVerbBlock(fm, verb) {
-    const block = {
-        keyLine: -1,
-        keyIndent: 0,
-        itemLines: [],
-        itemIndent: -1,
-        inlineEmpty: false,
-        inlineScalarValue: null,
-    };
-    for (let i = 0; i < fm.length; i++) {
-        const content = uncomment(fm[i]);
-        if (!content.trim())
-            continue;
-        const indent = indentOf(content);
-        const body = content.slice(indent);
-        // A list item belonging to the current verb block.
-        if ((body.startsWith('- ') || body === '-') &&
-            block.keyLine !== -1 &&
-            indent > block.keyIndent) {
-            block.itemLines.push(i);
-            if (block.itemIndent === -1)
-                block.itemIndent = indent;
-            continue;
-        }
-        const colon = body.indexOf(':');
-        if (colon < 0)
-            continue; // not a key line; ignore (the parser would too)
-        const key = body.slice(0, colon).trim();
-        const value = body.slice(colon + 1).trim();
-        if (block.keyLine !== -1) {
-            // We already found our verb; a new key at <= our indent ends the block.
-            if (indent <= block.keyIndent)
-                break;
-            continue;
-        }
-        if (key === verb && indent === 0) {
-            block.keyLine = i;
-            block.keyIndent = indent;
-            if (value === '[]')
-                block.inlineEmpty = true;
-            else if (value !== '')
-                block.inlineScalarValue = value;
-        }
-    }
-    if (block.itemIndent === -1)
-        block.itemIndent = block.keyIndent + 2;
-    return block;
-}
-/**
- * Parse the items currently under a verb block into ParsedEntry form, for
- * matching. Handles list items and the inline-scalar form.
- */
-function blockEntries(fm, block) {
-    const out = [];
-    if (block.inlineScalarValue !== null) {
-        const r = parseAccessEntry(block.inlineScalarValue);
-        if (r.ok)
-            out.push({ entry: r.entry, line: block.keyLine });
-        return out;
-    }
-    for (const li of block.itemLines) {
-        const content = uncomment(fm[li]).trim();
-        const value = content === '-' ? '' : content.slice(2).trim();
-        if (!value)
-            continue;
-        const r = parseAccessEntry(value);
-        if (r.ok)
-            out.push({ entry: r.entry, line: li });
-    }
-    return out;
-}
-// ---------------------------------------------------------------------------
-// Public splice operations
-// ---------------------------------------------------------------------------
-/**
- * Add `principal` under `verb`. Idempotent: if an entry with the EXACT same
- * token spelling already exists with the SAME deny-ness (a grant when
- * granting, a deny when denying), returns `changed: false`. Idempotency is
- * deliberately exact-token, never name-level: a bare token and a `role/`
- * token are different principals (group-first precedence gives the bare key
- * to a same-named group), so a bare-`X` GROUP grant must go through even when
- * `role/X` is present, and vice versa. Creates the verb key (and the
- * frontmatter fence, for a fresh file) as needed. Preserves everything else
- * byte-for-byte.
- *
- * `allowScalar` controls whether a fresh single-entry verb may be written in
- * the node-frontmatter scalar form (`owner: Name <email>`). access.md always
- * uses the block-list form; node frontmatter prefers scalar for a lone entry.
- *
- * `deny` writes the entry as a `deny <principal>` denial instead of a grant
- * (the `deny-here` per-item override). The block/scalar/empty-list handling is
- * identical — only the rendered line and the idempotency check differ — so the
- * deny path reuses this engine rather than a parallel `spliceDeny`. NOTE: the
- * resolver lets a same-scope grant override a same-scope deny of the same
- * principal, so a caller adding a deny where a grant already exists must strip
- * that grant first (see `AccessMutationService`); this function only writes the
- * one entry it's asked to.
- */
-export function spliceGrant(text, verb, rawPrincipal, opts = {}) {
-    const principal = validatePrincipal(rawPrincipal);
-    const deny = opts.deny ?? false;
-    const f = splitFrontmatter(text);
-    if (!f.hasFrontmatter) {
-        // Fresh file — synthesise a minimal frontmatter block, keep any body lines
-        // the caller passed (usually none for a new access.md).
-        const itemLine = opts.allowScalar
-            ? `${verb}: ${renderEntry(principal, deny)}`
-            : `${verb}:${f.eol}  - ${renderEntry(principal, deny)}`;
-        const fenced = ['---', itemLine, '---'].join(f.eol);
-        const bodyText = f.post.length ? f.post.join(f.eol) : '';
-        const text2 = bodyText ? `${fenced}${f.eol}${bodyText}` : `${fenced}${f.eol}`;
-        return { text: text2, changed: true };
-    }
-    const region = pickRegion(text, f, opts.target ?? 'node');
-    const block = findVerbBlock(region.lines, verb);
-    const existing = blockEntries(region.lines, block);
-    // Idempotency: an entry for this EXACT token with the same deny-ness is
-    // already present (a grant when granting, a deny when denying). Exact-token
-    // on purpose — see the doc above.
-    if (existing.some((e) => entryMatches(e.entry, principal, 'exact') && e.entry.deny === deny)) {
-        return { text, changed: false };
-    }
-    const itemValue = renderEntry(principal, deny);
-    if (block.keyLine === -1) {
-        // Verb key absent — append a new block at the end of the region.
-        const lines = opts.allowScalar ? [`${verb}: ${itemValue}`] : [`${verb}:`, `  - ${itemValue}`];
-        region.lines.push(...lines);
-        return { text: region.join(), changed: true };
-    }
-    if (block.inlineScalarValue !== null) {
-        // Scalar form — promote to a block list with both the old and new entry.
-        const old = block.inlineScalarValue;
-        region.lines.splice(block.keyLine, 1, `${verb}:`, `  - ${old}`, `  - ${itemValue}`);
-        return { text: region.join(), changed: true };
-    }
-    // Block-list (possibly inline `[]`). Insert after the last existing item, or
-    // right after the key line when the list is currently empty.
-    const indent = ' '.repeat(block.itemIndent);
-    const newLine = `${indent}- ${itemValue}`;
-    if (block.inlineEmpty) {
-        // `verb: []` -> `verb:` + one item.
-        region.lines[block.keyLine] = `${' '.repeat(block.keyIndent)}${verb}:`;
-        region.lines.splice(block.keyLine + 1, 0, newLine);
-        return { text: region.join(), changed: true };
-    }
-    const insertAt = block.itemLines.length > 0 ? block.itemLines[block.itemLines.length - 1] + 1 : block.keyLine + 1;
-    region.lines.splice(insertAt, 0, newLine);
-    return { text: region.join(), changed: true };
-}
-/**
- * Remove every entry naming `principal` under `verb` (grant or deny). Idempotent:
- * returns `changed: false` when the principal isn't present. If removing the
- * last item empties the verb, the `verb:` key is collapsed to `verb: []` so the
- * file still parses cleanly (the resolver reads `[]` as an empty list).
- * Preserves everything else.
- *
- * Token matching for role-shaped principals is `tokenMatch` (default `'name'`:
- * BOTH spellings — revoking the role removes legacy bare spellings too).
- * Callers pass `'exact'` when a GROUP shadows the principal's bare name: the
- * bare token then belongs to the group and the `role/` token to the role, so a
- * revoke of one must never strip the other (see AccessMutationService, which
- * derives the flag from the merged principal index).
- */
-export function spliceRevoke(text, verb, rawPrincipal, opts = {}) {
-    const principal = validatePrincipal(rawPrincipal);
-    const tokenMatch = opts.tokenMatch ?? 'name';
-    const f = splitFrontmatter(text);
-    if (!f.hasFrontmatter)
-        return { text, changed: false };
-    const region = pickRegion(text, f, opts.target ?? 'node');
-    const block = findVerbBlock(region.lines, verb);
-    if (block.keyLine === -1)
-        return { text, changed: false };
-    if (block.inlineScalarValue !== null) {
-        const r = parseAccessEntry(block.inlineScalarValue);
-        if (r.ok && entryMatches(r.entry, principal, tokenMatch)) {
-            // Lone scalar entry removed -> collapse to empty list.
-            region.lines[block.keyLine] = `${' '.repeat(block.keyIndent)}${verb}: []`;
-            return { text: region.join(), changed: true };
-        }
-        return { text, changed: false };
-    }
-    const entries = blockEntries(region.lines, block);
-    const victims = entries.filter((e) => entryMatches(e.entry, principal, tokenMatch)).map((e) => e.line);
-    if (victims.length === 0)
-        return { text, changed: false };
-    // Delete from the bottom up so earlier indices stay valid.
-    const remaining = block.itemLines.filter((l) => !victims.includes(l));
-    for (const line of [...victims].sort((a, b) => b - a))
-        region.lines.splice(line, 1);
-    if (remaining.length === 0) {
-        // Verb block is now empty — collapse `verb:` to `verb: []`. The key line
-        // index is unchanged because we only removed lines that came after it.
-        region.lines[block.keyLine] = `${' '.repeat(block.keyIndent)}${verb}: []`;
-    }
-    return { text: region.join(), changed: true };
-}
-//# sourceMappingURL=access-splice.js.map

package/dist/modules/access/access-splice.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-splice.js","sourceRoot":"","sources":["../../../src/modules/access/access-splice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAGL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AA0BrC,mFAAmF;AACnF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mFAAmF;AACnF,wFAAwF;AACxF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,IAAI,GAAG,KAAK;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAY;IAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,CAAC,CAAC;QACnF,4EAA4E;QAC5E,mFAAmF;QACnF,IACE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6EAA6E;QAC7E,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,WAAW,KAAK,KAAK,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;IACvE,IACE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,sDAAsD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAiBD;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAkB,EAAE,CAAY,EAAE,UAAsB;IAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CACtC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAiBD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,6CAA6C;IAC7C,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB;gBAC1C,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sCAAsC;gBAC5D,GAAG;gBACH,cAAc,EAAE,IAAI;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,IAAY,EACZ,CAA4C,EAC5C,MAAoB;IAEpB,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,qCAAqC;AACrC,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAiBD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAY,EAAE,IAAU;IAC7C,MAAM,KAAK,GAAc;QACvB,OAAO,EAAE,CAAC,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,mDAAmD;QACnD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;YACvC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,KAAK,CAAC,SAAS,EACxB,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;gBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC;YACvD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,gDAAgD;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACzB,wEAAwE;YACxE,IAAI,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,MAAM;YACrC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;YACzB,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;iBACxC,IAAI,KAAK,KAAK,EAAE;gBAAE,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,EAAY,EAAE,KAAgB;IAClD,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,IAAU,EACV,YAAuB,EACvB,OAAyE,EAAE;IAE3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACtB,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW;YAC/B,CAAC,CAAC,GAAG,IAAI,KAAK,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE;YAC5C,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,OAAO,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEnD,wEAAwE;IACxE,4EAA4E;IAC5E,kCAAkC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,iEAAiE;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,yEAAyE;QACzE,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,MAAM,KAAK,SAAS,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,oCAAoC;QACpC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,IAAU,EACV,YAAuB,EACvB,OAA2D,EAAE;IAE7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,CAAC,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YACzD,uDAAuD;YACvD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC"}

package/dist/modules/access/group-files.d.ts

@@ -1,83 +0,0 @@
-/**
- * Group files — the "who you are" half of the roles/groups split.
- *
- * Groups are people-sets referenced by access grants ("GTM Team can read the
- * battlecards"). A deployment has exactly ONE group source at a time — a mode
- * derived from which file exists, so it holds at any git ref:
- *
- *   - `synced-groups.yaml` EXISTS  → IdP mode. The file is MACHINE-OWNED,
- *     regenerated wholesale from the SCIM directory mirror; membership is
- *     managed in the IdP. `groups.yaml` is ignored entirely.
- *   - otherwise                    → manual mode. `groups.yaml` (UI-edited)
- *     is the source.
- *
- * Both files share one format, the group twin of roles.yaml:
- *
- *   groups:
- *     Engineering:
- *       - ada@x.io
- *       - bo@x.io
- *     Empty Group: []
- *
- * Parsing is FORGIVING at the entry level by design — a malformed email or a
- * reserved/duplicate name skips that entry with a warning, it never takes the
- * whole file down. Only structural failures (unparsable YAML, `groups:` not a
- * mapping) reject the file, and even then the RESOLVER degrades to "this file
- * contributes nothing" rather than throwing: unlike roles.yaml there is no
- * admin-lockout risk here, so groups must never be able to brick access
- * resolution. Strict acceptance for WRITES is the job of the write-side
- * validator (`validateGroupsFile` below), which treats warnings as refusals.
- */
-export declare const GROUPS_YAML = "groups.yaml";
-export declare const SYNCED_GROUPS_YAML = "synced-groups.yaml";
-/**
- * THE name-safety predicate for principal display names — the single source
- * of truth every surface derives from (group creation/rename, IdP sync
- * materialization; thin assert wrappers sit on top). Returns a human-readable
- * reason the name is unsafe, or null when it is fine.
- *
- * The character rules keep the emitted YAML parseable and the entry grammar
- * unambiguous:
- *   `:`        mis-tokenises as a nested mapping key
- *   `#`        truncated as a comment by the subset parser's stripComment
- *   `<` / `>`  collide with the `Name <email>` user-reference shape
- *   leading -  tokenises as a list item
- *   \x00-\x1f  control chars / newlines break line structure outright
- *   `role/…`   reserved: that spelling is the EXPLICIT role token in access
- *              entries — a group carrying it could never be referenced.
- */
-export declare function unsafeNameReason(displayName: string): string | null;
-/** One parsed group: display name + canonicalised member emails. */
-export interface GroupDefinition {
-    displayName: string;
-    emails: Set<string>;
-}
-/** Canonical group name → definition, in file order. */
-export type GroupsIndex = Map<string, GroupDefinition>;
-export interface ParsedGroupsFile {
-    ok: true;
-    groups: GroupsIndex;
-    /** Entry-level problems that were skipped over (bad email, dup name, …). */
-    warnings: string[];
-}
-export interface GroupsFileError {
-    ok: false;
-    errors: string[];
-}
-/**
- * Parse a group file (either of the two — same grammar). See the module note
- * for the forgiving-vs-structural split.
- */
-export declare function parseGroupsFile(text: string, filename: string): ParsedGroupsFile | GroupsFileError;
-/**
- * Write-gate twin of {@link parseGroupsFile}: strict — structural errors AND
- * entry-level warnings both refuse the candidate, so a UI write can never land
- * a group the resolver would silently skip.
- */
-export declare function validateGroupsFile(text: string, filename: string): {
-    ok: true;
-} | {
-    ok: false;
-    errors: string[];
-};
-//# sourceMappingURL=group-files.d.ts.map

package/dist/modules/access/group-files.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"group-files.d.ts","sourceRoot":"","sources":["../../../src/modules/access/group-files.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWnE;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,WAAW,CAAC;IACpB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,gBAAgB,GAAG,eAAe,CAyFpC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAWhD"}

package/dist/modules/access/group-files.js

@@ -1,167 +0,0 @@
-import { EMAIL_REGEX, GROUP_REF_PREFIX, RESERVED_ROLE_NAMES, ROLE_TOKEN_PREFIX, canonicalEmail, canonicalRoleName, parseYamlSubset, } from './access-control.service.js';
-/**
- * Group files — the "who you are" half of the roles/groups split.
- *
- * Groups are people-sets referenced by access grants ("GTM Team can read the
- * battlecards"). A deployment has exactly ONE group source at a time — a mode
- * derived from which file exists, so it holds at any git ref:
- *
- *   - `synced-groups.yaml` EXISTS  → IdP mode. The file is MACHINE-OWNED,
- *     regenerated wholesale from the SCIM directory mirror; membership is
- *     managed in the IdP. `groups.yaml` is ignored entirely.
- *   - otherwise                    → manual mode. `groups.yaml` (UI-edited)
- *     is the source.
- *
- * Both files share one format, the group twin of roles.yaml:
- *
- *   groups:
- *     Engineering:
- *       - ada@x.io
- *       - bo@x.io
- *     Empty Group: []
- *
- * Parsing is FORGIVING at the entry level by design — a malformed email or a
- * reserved/duplicate name skips that entry with a warning, it never takes the
- * whole file down. Only structural failures (unparsable YAML, `groups:` not a
- * mapping) reject the file, and even then the RESOLVER degrades to "this file
- * contributes nothing" rather than throwing: unlike roles.yaml there is no
- * admin-lockout risk here, so groups must never be able to brick access
- * resolution. Strict acceptance for WRITES is the job of the write-side
- * validator (`validateGroupsFile` below), which treats warnings as refusals.
- */
-export const GROUPS_YAML = 'groups.yaml';
-export const SYNCED_GROUPS_YAML = 'synced-groups.yaml';
-/**
- * THE name-safety predicate for principal display names — the single source
- * of truth every surface derives from (group creation/rename, IdP sync
- * materialization; thin assert wrappers sit on top). Returns a human-readable
- * reason the name is unsafe, or null when it is fine.
- *
- * The character rules keep the emitted YAML parseable and the entry grammar
- * unambiguous:
- *   `:`        mis-tokenises as a nested mapping key
- *   `#`        truncated as a comment by the subset parser's stripComment
- *   `<` / `>`  collide with the `Name <email>` user-reference shape
- *   leading -  tokenises as a list item
- *   \x00-\x1f  control chars / newlines break line structure outright
- *   `role/…`   reserved: that spelling is the EXPLICIT role token in access
- *              entries — a group carrying it could never be referenced.
- */
-export function unsafeNameReason(displayName) {
-    const trimmed = displayName.trim();
-    if (!trimmed)
-        return 'empty name';
-    if (/[:#<>]/.test(trimmed))
-        return "contains ':', '#', '<', or '>'";
-    // eslint-disable-next-line no-control-regex
-    if (/[\x00-\x1f]/.test(trimmed))
-        return 'contains control characters';
-    if (trimmed.startsWith('-'))
-        return "starts with '-'";
-    if (canonicalRoleName(trimmed).startsWith(ROLE_TOKEN_PREFIX)) {
-        return `starts with the reserved '${ROLE_TOKEN_PREFIX}' prefix (the explicit role token in access entries)`;
-    }
-    return null;
-}
-/**
- * Parse a group file (either of the two — same grammar). See the module note
- * for the forgiving-vs-structural split.
- */
-export function parseGroupsFile(text, filename) {
-    // Tolerate empty keys at parse: this file's contract is ENTRY-level
-    // forgiveness (a blank group name is skipped with a warning below), and a
-    // hard tokenizer error here would retire every OTHER group fail-closed.
-    const parsed = parseYamlSubset(text, { tolerateEmptyKeys: true });
-    if (!parsed.ok)
-        return { ok: false, errors: [`${filename}: ${parsed.error}`] };
-    const root = parsed.value;
-    if (root == null || typeof root !== 'object' || Array.isArray(root)) {
-        return { ok: false, errors: [`${filename}: must be a top-level mapping`] };
-    }
-    const groupsNode = root.groups;
-    // An empty file (or one with no `groups:` key yet) is a valid empty set —
-    // a fresh deployment's groups.yaml starts this way.
-    if (groupsNode == null)
-        return { ok: true, groups: new Map(), warnings: [] };
-    if (typeof groupsNode !== 'object' || Array.isArray(groupsNode)) {
-        return { ok: false, errors: [`${filename}: 'groups' must be a mapping`] };
-    }
-    const groups = new Map();
-    const warnings = [];
-    for (const [displayName, value] of Object.entries(groupsNode)) {
-        const canonical = canonicalRoleName(displayName);
-        if (!canonical) {
-            warnings.push(`${filename}: empty group name — skipped`);
-            continue;
-        }
-        // THE shared name-safety predicate (see `unsafeNameReason` above) — the
-        // same rules every write surface asserts. The parser must apply it too:
-        // a name the writers refuse (control chars, `<`/`>`, a leading `-`, the
-        // reserved `role/` prefix) can still reach a group file by hand edit or
-        // through a skewed writer, and accepting it here would let the resolver
-        // honor — and `validateGroupsFile` pass — a name no editor can ever
-        // produce or reference safely.
-        const unsafe = unsafeNameReason(displayName);
-        if (unsafe) {
-            warnings.push(`${filename}: group ${JSON.stringify(displayName)} ${unsafe} — skipped`);
-            continue;
-        }
-        if (RESERVED_ROLE_NAMES.has(canonical)) {
-            warnings.push(`${filename}: group '${displayName}' uses reserved name '${canonical}' — skipped`);
-            continue;
-        }
-        if (groups.has(canonical)) {
-            warnings.push(`${filename}: group '${displayName}' canonicalises to '${canonical}', already declared as '${groups.get(canonical).displayName}' — skipped`);
-            continue;
-        }
-        if (value !== null && !Array.isArray(value)) {
-            warnings.push(`${filename}: group '${displayName}' must be a list of emails — skipped`);
-            continue;
-        }
-        const emails = new Set();
-        for (const raw of value ?? []) {
-            if (typeof raw !== 'string') {
-                warnings.push(`${filename}: group '${displayName}' has a non-string entry — entry skipped`);
-                continue;
-            }
-            const email = canonicalEmail(raw);
-            // The reserved `group:` prefix would PASS the email regex
-            // (`group:lee@x.io` shapes like an email) but it is the roles.yaml
-            // group-reference token, not an address — groups contain emails, never
-            // other groups. Skip it with its own warning so the write gate refuses
-            // it and the resolver never grants a colon-bearing "email".
-            if (email.startsWith(GROUP_REF_PREFIX)) {
-                warnings.push(`${filename}: group '${displayName}' has a '${GROUP_REF_PREFIX}'-prefixed entry ${JSON.stringify(raw)} — groups contain emails, not group references; entry skipped`);
-                continue;
-            }
-            if (!EMAIL_REGEX.test(email)) {
-                warnings.push(`${filename}: group '${displayName}' has malformed email '${raw}' — entry skipped`);
-                continue;
-            }
-            emails.add(email);
-        }
-        groups.set(canonical, { displayName: displayName.trim(), emails });
-    }
-    return { ok: true, groups, warnings };
-}
-/**
- * Write-gate twin of {@link parseGroupsFile}: strict — structural errors AND
- * entry-level warnings both refuse the candidate, so a UI write can never land
- * a group the resolver would silently skip.
- */
-export function validateGroupsFile(text, filename) {
-    // Strict PARSE first (no empty-key tolerance): the read side forgives a
-    // blank key entry-level so other groups keep resolving, but a WRITE that
-    // contains one — anywhere, including outside the `groups:` mapping — must
-    // refuse rather than land bytes the tolerant reader silently drops.
-    const strict = parseYamlSubset(text.trim() ? text : 'groups:');
-    if (!strict.ok)
-        return { ok: false, errors: [`${filename}: ${strict.error}`] };
-    const parsed = parseGroupsFile(text, filename);
-    if (!parsed.ok)
-        return { ok: false, errors: parsed.errors };
-    if (parsed.warnings.length > 0)
-        return { ok: false, errors: parsed.warnings };
-    return { ok: true };
-}
-//# sourceMappingURL=group-files.js.map