@bevel-software/platform-core-backend 0.19.0 → 0.21.0

package/dist/modules/access/access-splice.d.ts

@@ -1,140 +0,0 @@
-/**
- * Surgical text-splice editor for `access.md` frontmatter and node-frontmatter
- * access verbs.
- *
- * WHY a splice and not parse→model→emit: the resolver's parser
- * (`parseYamlSubset` / `extractFrontmatter` / `stripComment`) deliberately
- * throws away comments, blank lines, key order, AND the markdown body below the
- * closing `---`. Re-serialising from the parsed model would silently DELETE the
- * prose bodies the real `access.md` files carry (the repo-root one is a whole
- * README) — and a `parse(emit(x))` round-trip test would PASS anyway because
- * parse ignores the body. So every mutation here edits the RAW text: we locate
- * the verb's block, splice exactly one list line in or out, and leave every
- * other byte — comments, ordering, blank lines, the body — untouched.
- *
- *   ---
- *   write:                 (verb key line, indent 0)
- *     - Admin              (list item, indent 2)  <- splice point
- *     - Felix <f@x.eu>     (list item)
- *   # a comment            (preserved verbatim)
- *   owner: []              (inline-empty list)
- *   ---
- *   # Body prose           (preserved verbatim)
- *
- * The same engine serves node-frontmatter, which additionally accepts a scalar
- * form (`owner: Felix <f@x.eu>`). Adding a second principal to a scalar verb
- * normalises it to the block-list form.
- */
-import { type Verb } from './access-control.service.js';
-/**
- * Which rule block a mutation edits.
- *
- *  - `'node'` (default): the file's YAML frontmatter — node files, and every
- *    call that predates the two-format `access.md` story.
- *  - `'folder'`: the block that governs the CONTAINING FOLDER of an
- *    `access.md` — the body when the file is in the new (body-governed)
- *    format, the frontmatter otherwise. Callers mutating folder rules pass
- *    this so a grant can never land in a new-format file's frontmatter
- *    (which governs the FILE itself, not the folder).
- */
-export type SpliceTarget = 'node' | 'folder';
-/** A principal to grant/revoke, in the resolver's canonical terms. */
-export type Principal = {
-    kind: 'user';
-    email: string;
-    displayName: string;
-} | {
-    kind: 'role';
-    role: string;
-};
-/** Result of a splice — the new full file text and whether anything changed. */
-export interface SpliceResult {
-    text: string;
-    changed: boolean;
-}
-/** Thrown when the input can't be spliced safely (malformed frontmatter, etc.). */
-export declare class AccessSpliceError extends Error {
-    constructor(message: string);
-}
-/**
- * Render a principal as the canonical access-entry line value the parser reads
- * back (`Name <email>` or a bare role display name). The caller is responsible
- * for having validated the principal first (see `validatePrincipal`).
- *
- * `deny` prefixes the entry with `deny ` so the resolver reads it as a denial
- * (the `deny-here` per-item override) — same line shape, opposite verdict.
- */
-export declare function renderEntry(p: Principal, deny?: boolean): string;
-/**
- * Validate a principal before it is spliced into a file. Rejects anything that
- * could break frontmatter or smuggle in extra YAML — newlines, control chars,
- * and emails / names that don't match the resolver's own regexes. This is the
- * injection guard: a principal that survives this is safe to render verbatim
- * into a `  - ` list line.
- *
- * Returns the canonical principal (lowercased email / canonical role) on
- * success, or throws `AccessSpliceError`.
- */
-export declare function validatePrincipal(p: Principal): Principal;
-/**
- * How a role-shaped principal's TOKEN is compared against a file entry:
- *
- *  - `'exact'`: the entry must carry the SAME spelling — a bare token and a
- *    `role/<name>` token are DIFFERENT principals (bare = whoever owns the
- *    bare key under group-first precedence, `role/` = the role). Grants
- *    always use this: granting the group `X` while `role/X` is present (or
- *    vice versa) must NOT be treated as already-granted, or the other
- *    principal silently never receives the grant.
- *  - `'name'`: both spellings of the name match. Revokes use this ONLY when
- *    no group shadows the bare name — then both spellings resolve to the
- *    role, and revoking the role must also remove legacy bare spellings.
- */
-export type TokenMatch = 'exact' | 'name';
-/**
- * Add `principal` under `verb`. Idempotent: if an entry with the EXACT same
- * token spelling already exists with the SAME deny-ness (a grant when
- * granting, a deny when denying), returns `changed: false`. Idempotency is
- * deliberately exact-token, never name-level: a bare token and a `role/`
- * token are different principals (group-first precedence gives the bare key
- * to a same-named group), so a bare-`X` GROUP grant must go through even when
- * `role/X` is present, and vice versa. Creates the verb key (and the
- * frontmatter fence, for a fresh file) as needed. Preserves everything else
- * byte-for-byte.
- *
- * `allowScalar` controls whether a fresh single-entry verb may be written in
- * the node-frontmatter scalar form (`owner: Name <email>`). access.md always
- * uses the block-list form; node frontmatter prefers scalar for a lone entry.
- *
- * `deny` writes the entry as a `deny <principal>` denial instead of a grant
- * (the `deny-here` per-item override). The block/scalar/empty-list handling is
- * identical — only the rendered line and the idempotency check differ — so the
- * deny path reuses this engine rather than a parallel `spliceDeny`. NOTE: the
- * resolver lets a same-scope grant override a same-scope deny of the same
- * principal, so a caller adding a deny where a grant already exists must strip
- * that grant first (see `AccessMutationService`); this function only writes the
- * one entry it's asked to.
- */
-export declare function spliceGrant(text: string, verb: Verb, rawPrincipal: Principal, opts?: {
-    allowScalar?: boolean;
-    deny?: boolean;
-    target?: SpliceTarget;
-}): SpliceResult;
-/**
- * Remove every entry naming `principal` under `verb` (grant or deny). Idempotent:
- * returns `changed: false` when the principal isn't present. If removing the
- * last item empties the verb, the `verb:` key is collapsed to `verb: []` so the
- * file still parses cleanly (the resolver reads `[]` as an empty list).
- * Preserves everything else.
- *
- * Token matching for role-shaped principals is `tokenMatch` (default `'name'`:
- * BOTH spellings — revoking the role removes legacy bare spellings too).
- * Callers pass `'exact'` when a GROUP shadows the principal's bare name: the
- * bare token then belongs to the group and the `role/` token to the role, so a
- * revoke of one must never strip the other (see AccessMutationService, which
- * derives the flag from the merged principal index).
- */
-export declare function spliceRevoke(text: string, verb: Verb, rawPrincipal: Principal, opts?: {
-    target?: SpliceTarget;
-    tokenMatch?: TokenMatch;
-}): SpliceResult;
-//# sourceMappingURL=access-splice.d.ts.map

package/dist/modules/access/access-splice.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-splice.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-splice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,KAAK,IAAI,EAMV,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7C,sEAAsE;AACtE,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,mFAAmF;AACnF,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAMD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,UAAQ,GAAG,MAAM,CAG9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,CAgDzD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AA+L1C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,SAAS,EACvB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAA;CAAO,GAC1E,YAAY,CA0Dd;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,SAAS,EACvB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,YAAY,CAAC;IAAC,UAAU,CAAC,EAAE,UAAU,CAAA;CAAO,GAC5D,YAAY,CAkCd"}

package/dist/modules/access/access-splice.js

@@ -1,389 +0,0 @@
-/**
- * Surgical text-splice editor for `access.md` frontmatter and node-frontmatter
- * access verbs.
- *
- * WHY a splice and not parse→model→emit: the resolver's parser
- * (`parseYamlSubset` / `extractFrontmatter` / `stripComment`) deliberately
- * throws away comments, blank lines, key order, AND the markdown body below the
- * closing `---`. Re-serialising from the parsed model would silently DELETE the
- * prose bodies the real `access.md` files carry (the repo-root one is a whole
- * README) — and a `parse(emit(x))` round-trip test would PASS anyway because
- * parse ignores the body. So every mutation here edits the RAW text: we locate
- * the verb's block, splice exactly one list line in or out, and leave every
- * other byte — comments, ordering, blank lines, the body — untouched.
- *
- *   ---
- *   write:                 (verb key line, indent 0)
- *     - Admin              (list item, indent 2)  <- splice point
- *     - Felix <f@x.eu>     (list item)
- *   # a comment            (preserved verbatim)
- *   owner: []              (inline-empty list)
- *   ---
- *   # Body prose           (preserved verbatim)
- *
- * The same engine serves node-frontmatter, which additionally accepts a scalar
- * form (`owner: Felix <f@x.eu>`). Adding a second principal to a scalar verb
- * normalises it to the block-list form.
- */
-import { parseAccessEntry, canonicalEmail, canonicalRoleName, accessMdDeclaresBodyRules, } from './access-control.service.js';
-/** Thrown when the input can't be spliced safely (malformed frontmatter, etc.). */
-export class AccessSpliceError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'AccessSpliceError';
-    }
-}
-/** Control chars (NUL..US) — newlines, tabs, etc. Never allowed in a principal. */
-// eslint-disable-next-line no-control-regex -- intentional control-char injection guard
-const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
-/**
- * Render a principal as the canonical access-entry line value the parser reads
- * back (`Name <email>` or a bare role display name). The caller is responsible
- * for having validated the principal first (see `validatePrincipal`).
- *
- * `deny` prefixes the entry with `deny ` so the resolver reads it as a denial
- * (the `deny-here` per-item override) — same line shape, opposite verdict.
- */
-export function renderEntry(p, deny = false) {
-    const body = p.kind === 'user' ? `${p.displayName} <${p.email}>` : p.role;
-    return deny ? `deny ${body}` : body;
-}
-/**
- * Validate a principal before it is spliced into a file. Rejects anything that
- * could break frontmatter or smuggle in extra YAML — newlines, control chars,
- * and emails / names that don't match the resolver's own regexes. This is the
- * injection guard: a principal that survives this is safe to render verbatim
- * into a `  - ` list line.
- *
- * Returns the canonical principal (lowercased email / canonical role) on
- * success, or throws `AccessSpliceError`.
- */
-export function validatePrincipal(p) {
-    if (p.kind === 'user') {
-        const displayName = p.displayName.trim();
-        const email = canonicalEmail(p.email);
-        if (!displayName)
-            throw new AccessSpliceError('person grant needs a display name');
-        // `#` is rejected because `uncomment()` truncates a whitespace-preceded `#`
-        // on read-back, so a name containing it would not round-trip through blockEntries.
-        if (CONTROL_CHARS.test(displayName) ||
-            displayName.includes('<') ||
-            displayName.includes('>') ||
-            displayName.includes('#')) {
-            throw new AccessSpliceError(`invalid display name: ${JSON.stringify(p.displayName)}`);
-        }
-        // Reuse the resolver's own email shape so a granted entry always parses back.
-        if (!/^[^<>\s@]+@[^<>\s@]+\.[^<>\s@]+$/.test(email)) {
-            throw new AccessSpliceError(`invalid email: ${JSON.stringify(p.email)}`);
-        }
-        // The rendered `Name <email>` line must round-trip through parseAccessEntry.
-        const round = parseAccessEntry(`${displayName} <${email}>`);
-        if (!round.ok || round.entry.kind !== 'user' || round.entry.deny) {
-            throw new AccessSpliceError(`person grant does not round-trip: ${JSON.stringify(p)}`);
-        }
-        return { kind: 'user', email, displayName };
-    }
-    const role = p.role.trim();
-    const canonical = canonicalRoleName(role);
-    if (!canonical)
-        throw new AccessSpliceError('role grant needs a name');
-    if (CONTROL_CHARS.test(role) ||
-        role.includes('<') ||
-        role.includes('>') ||
-        role.includes(':') ||
-        role.includes('#')) {
-        throw new AccessSpliceError(`invalid role name: ${JSON.stringify(p.role)}`);
-    }
-    // `deny` is never a grantee — it's the denial prefix. `everyone` IS grantable
-    // (the built-in public role); the access route restricts it to the read verb.
-    if (canonical === 'deny') {
-        throw new AccessSpliceError(`'${role}' is a reserved name and cannot be granted as a role`);
-    }
-    const round = parseAccessEntry(role);
-    if (!round.ok || round.entry.kind !== 'role' || round.entry.deny) {
-        throw new AccessSpliceError(`role grant does not round-trip: ${JSON.stringify(p)}`);
-    }
-    return { kind: 'role', role };
-}
-/**
- * True when a parsed entry names the given principal (ignoring deny prefix).
- * `tokenMatch` (role-shaped principals only) selects exact-spelling vs
- * name-level matching — see {@link TokenMatch}.
- */
-function entryMatches(entry, p, tokenMatch) {
-    if (p.kind === 'user')
-        return entry.kind === 'user' && entry.email === canonicalEmail(p.email);
-    if (entry.kind !== 'role')
-        return false;
-    const canonicalPrincipal = canonicalRoleName(p.role);
-    if (tokenMatch === 'exact')
-        return entry.role === canonicalPrincipal;
-    const strip = (token) => token.startsWith('role/') ? canonicalRoleName(token.slice('role/'.length)) : token;
-    return strip(entry.role) === strip(canonicalPrincipal);
-}
-/**
- * Split a file into [pre, frontmatter-lines, post] without losing a byte.
- * `hasFrontmatter` is false when the file has no `---` fence yet — callers that
- * grant into a fresh file synthesise one.
- */
-function splitFrontmatter(text) {
-    const eol = text.includes('\r\n') ? '\r\n' : '\n';
-    const lines = text.split(/\r?\n/);
-    // Opening fence must be the very first line.
-    if (lines[0]?.trim() !== '---') {
-        return { pre: [], fm: [], post: lines, eol, hasFrontmatter: false };
-    }
-    for (let i = 1; i < lines.length; i++) {
-        if (lines[i].trim() === '---') {
-            return {
-                pre: lines.slice(0, 1), // the opening ---
-                fm: lines.slice(1, i),
-                post: lines.slice(i), // closing --- onward (body preserved)
-                eol,
-                hasFrontmatter: true,
-            };
-        }
-    }
-    throw new AccessSpliceError('unterminated frontmatter — no closing `---`');
-}
-function joinFrontmatter(f) {
-    return [...f.pre, ...f.fm, ...f.post].join(f.eol);
-}
-/**
- * The line region a mutation edits, per {@link SpliceTarget}. `lines` aliases
- * the region's array (edited in place, like `f.fm` always was); `join()`
- * reassembles the whole file around it.
- */
-function pickRegion(text, f, target) {
-    if (target === 'folder' && f.hasFrontmatter && accessMdDeclaresBodyRules(text)) {
-        // New format: post = [closing '---', ...body]. Edit the body lines.
-        const closing = f.post[0];
-        const body = f.post.slice(1);
-        return {
-            lines: body,
-            join: () => [...f.pre, ...f.fm, closing, ...body].join(f.eol),
-        };
-    }
-    return { lines: f.fm, join: () => joinFrontmatter(f) };
-}
-/** Leading-space count of a line. */
-function indentOf(line) {
-    const m = line.match(/^( *)/);
-    return m ? m[1].length : 0;
-}
-/** Strip a trailing `# comment` the way the resolver's tokeniser does. */
-function uncomment(line) {
-    let inWs = true;
-    for (let i = 0; i < line.length; i++) {
-        const ch = line[i];
-        if (ch === '#' && (inWs || (i > 0 && /\s/.test(line[i - 1]))))
-            return line.slice(0, i);
-        if (!/\s/.test(ch))
-            inWs = false;
-    }
-    return line;
-}
-/**
- * Locate a verb's block within the frontmatter lines. Walks the raw lines (not
- * the parsed model) so we can address them for splicing. Recognises the three
- * shapes the resolver accepts: a block list, an inline `verb: []`, and (node
- * frontmatter only) an inline scalar `verb: value`.
- */
-function findVerbBlock(fm, verb) {
-    const block = {
-        keyLine: -1,
-        keyIndent: 0,
-        itemLines: [],
-        itemIndent: -1,
-        inlineEmpty: false,
-        inlineScalarValue: null,
-    };
-    for (let i = 0; i < fm.length; i++) {
-        const content = uncomment(fm[i]);
-        if (!content.trim())
-            continue;
-        const indent = indentOf(content);
-        const body = content.slice(indent);
-        // A list item belonging to the current verb block.
-        if ((body.startsWith('- ') || body === '-') &&
-            block.keyLine !== -1 &&
-            indent > block.keyIndent) {
-            block.itemLines.push(i);
-            if (block.itemIndent === -1)
-                block.itemIndent = indent;
-            continue;
-        }
-        const colon = body.indexOf(':');
-        if (colon < 0)
-            continue; // not a key line; ignore (the parser would too)
-        const key = body.slice(0, colon).trim();
-        const value = body.slice(colon + 1).trim();
-        if (block.keyLine !== -1) {
-            // We already found our verb; a new key at <= our indent ends the block.
-            if (indent <= block.keyIndent)
-                break;
-            continue;
-        }
-        if (key === verb && indent === 0) {
-            block.keyLine = i;
-            block.keyIndent = indent;
-            if (value === '[]')
-                block.inlineEmpty = true;
-            else if (value !== '')
-                block.inlineScalarValue = value;
-        }
-    }
-    if (block.itemIndent === -1)
-        block.itemIndent = block.keyIndent + 2;
-    return block;
-}
-/**
- * Parse the items currently under a verb block into ParsedEntry form, for
- * matching. Handles list items and the inline-scalar form.
- */
-function blockEntries(fm, block) {
-    const out = [];
-    if (block.inlineScalarValue !== null) {
-        const r = parseAccessEntry(block.inlineScalarValue);
-        if (r.ok)
-            out.push({ entry: r.entry, line: block.keyLine });
-        return out;
-    }
-    for (const li of block.itemLines) {
-        const content = uncomment(fm[li]).trim();
-        const value = content === '-' ? '' : content.slice(2).trim();
-        if (!value)
-            continue;
-        const r = parseAccessEntry(value);
-        if (r.ok)
-            out.push({ entry: r.entry, line: li });
-    }
-    return out;
-}
-// ---------------------------------------------------------------------------
-// Public splice operations
-// ---------------------------------------------------------------------------
-/**
- * Add `principal` under `verb`. Idempotent: if an entry with the EXACT same
- * token spelling already exists with the SAME deny-ness (a grant when
- * granting, a deny when denying), returns `changed: false`. Idempotency is
- * deliberately exact-token, never name-level: a bare token and a `role/`
- * token are different principals (group-first precedence gives the bare key
- * to a same-named group), so a bare-`X` GROUP grant must go through even when
- * `role/X` is present, and vice versa. Creates the verb key (and the
- * frontmatter fence, for a fresh file) as needed. Preserves everything else
- * byte-for-byte.
- *
- * `allowScalar` controls whether a fresh single-entry verb may be written in
- * the node-frontmatter scalar form (`owner: Name <email>`). access.md always
- * uses the block-list form; node frontmatter prefers scalar for a lone entry.
- *
- * `deny` writes the entry as a `deny <principal>` denial instead of a grant
- * (the `deny-here` per-item override). The block/scalar/empty-list handling is
- * identical — only the rendered line and the idempotency check differ — so the
- * deny path reuses this engine rather than a parallel `spliceDeny`. NOTE: the
- * resolver lets a same-scope grant override a same-scope deny of the same
- * principal, so a caller adding a deny where a grant already exists must strip
- * that grant first (see `AccessMutationService`); this function only writes the
- * one entry it's asked to.
- */
-export function spliceGrant(text, verb, rawPrincipal, opts = {}) {
-    const principal = validatePrincipal(rawPrincipal);
-    const deny = opts.deny ?? false;
-    const f = splitFrontmatter(text);
-    if (!f.hasFrontmatter) {
-        // Fresh file — synthesise a minimal frontmatter block, keep any body lines
-        // the caller passed (usually none for a new access.md).
-        const itemLine = opts.allowScalar
-            ? `${verb}: ${renderEntry(principal, deny)}`
-            : `${verb}:${f.eol}  - ${renderEntry(principal, deny)}`;
-        const fenced = ['---', itemLine, '---'].join(f.eol);
-        const bodyText = f.post.length ? f.post.join(f.eol) : '';
-        const text2 = bodyText ? `${fenced}${f.eol}${bodyText}` : `${fenced}${f.eol}`;
-        return { text: text2, changed: true };
-    }
-    const region = pickRegion(text, f, opts.target ?? 'node');
-    const block = findVerbBlock(region.lines, verb);
-    const existing = blockEntries(region.lines, block);
-    // Idempotency: an entry for this EXACT token with the same deny-ness is
-    // already present (a grant when granting, a deny when denying). Exact-token
-    // on purpose — see the doc above.
-    if (existing.some((e) => entryMatches(e.entry, principal, 'exact') && e.entry.deny === deny)) {
-        return { text, changed: false };
-    }
-    const itemValue = renderEntry(principal, deny);
-    if (block.keyLine === -1) {
-        // Verb key absent — append a new block at the end of the region.
-        const lines = opts.allowScalar ? [`${verb}: ${itemValue}`] : [`${verb}:`, `  - ${itemValue}`];
-        region.lines.push(...lines);
-        return { text: region.join(), changed: true };
-    }
-    if (block.inlineScalarValue !== null) {
-        // Scalar form — promote to a block list with both the old and new entry.
-        const old = block.inlineScalarValue;
-        region.lines.splice(block.keyLine, 1, `${verb}:`, `  - ${old}`, `  - ${itemValue}`);
-        return { text: region.join(), changed: true };
-    }
-    // Block-list (possibly inline `[]`). Insert after the last existing item, or
-    // right after the key line when the list is currently empty.
-    const indent = ' '.repeat(block.itemIndent);
-    const newLine = `${indent}- ${itemValue}`;
-    if (block.inlineEmpty) {
-        // `verb: []` -> `verb:` + one item.
-        region.lines[block.keyLine] = `${' '.repeat(block.keyIndent)}${verb}:`;
-        region.lines.splice(block.keyLine + 1, 0, newLine);
-        return { text: region.join(), changed: true };
-    }
-    const insertAt = block.itemLines.length > 0 ? block.itemLines[block.itemLines.length - 1] + 1 : block.keyLine + 1;
-    region.lines.splice(insertAt, 0, newLine);
-    return { text: region.join(), changed: true };
-}
-/**
- * Remove every entry naming `principal` under `verb` (grant or deny). Idempotent:
- * returns `changed: false` when the principal isn't present. If removing the
- * last item empties the verb, the `verb:` key is collapsed to `verb: []` so the
- * file still parses cleanly (the resolver reads `[]` as an empty list).
- * Preserves everything else.
- *
- * Token matching for role-shaped principals is `tokenMatch` (default `'name'`:
- * BOTH spellings — revoking the role removes legacy bare spellings too).
- * Callers pass `'exact'` when a GROUP shadows the principal's bare name: the
- * bare token then belongs to the group and the `role/` token to the role, so a
- * revoke of one must never strip the other (see AccessMutationService, which
- * derives the flag from the merged principal index).
- */
-export function spliceRevoke(text, verb, rawPrincipal, opts = {}) {
-    const principal = validatePrincipal(rawPrincipal);
-    const tokenMatch = opts.tokenMatch ?? 'name';
-    const f = splitFrontmatter(text);
-    if (!f.hasFrontmatter)
-        return { text, changed: false };
-    const region = pickRegion(text, f, opts.target ?? 'node');
-    const block = findVerbBlock(region.lines, verb);
-    if (block.keyLine === -1)
-        return { text, changed: false };
-    if (block.inlineScalarValue !== null) {
-        const r = parseAccessEntry(block.inlineScalarValue);
-        if (r.ok && entryMatches(r.entry, principal, tokenMatch)) {
-            // Lone scalar entry removed -> collapse to empty list.
-            region.lines[block.keyLine] = `${' '.repeat(block.keyIndent)}${verb}: []`;
-            return { text: region.join(), changed: true };
-        }
-        return { text, changed: false };
-    }
-    const entries = blockEntries(region.lines, block);
-    const victims = entries.filter((e) => entryMatches(e.entry, principal, tokenMatch)).map((e) => e.line);
-    if (victims.length === 0)
-        return { text, changed: false };
-    // Delete from the bottom up so earlier indices stay valid.
-    const remaining = block.itemLines.filter((l) => !victims.includes(l));
-    for (const line of [...victims].sort((a, b) => b - a))
-        region.lines.splice(line, 1);
-    if (remaining.length === 0) {
-        // Verb block is now empty — collapse `verb:` to `verb: []`. The key line
-        // index is unchanged because we only removed lines that came after it.
-        region.lines[block.keyLine] = `${' '.repeat(block.keyIndent)}${verb}: []`;
-    }
-    return { text: region.join(), changed: true };
-}
-//# sourceMappingURL=access-splice.js.map

package/dist/modules/access/access-splice.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-splice.js","sourceRoot":"","sources":["../../../src/modules/access/access-splice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAGL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AA0BrC,mFAAmF;AACnF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mFAAmF;AACnF,wFAAwF;AACxF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,IAAI,GAAG,KAAK;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAY;IAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,CAAC,CAAC;QACnF,4EAA4E;QAC5E,mFAAmF;QACnF,IACE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6EAA6E;QAC7E,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,WAAW,KAAK,KAAK,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;IACvE,IACE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,sDAAsD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAiBD;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAkB,EAAE,CAAY,EAAE,UAAsB;IAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CACtC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAiBD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,6CAA6C;IAC7C,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB;gBAC1C,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sCAAsC;gBAC5D,GAAG;gBACH,cAAc,EAAE,IAAI;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,IAAY,EACZ,CAA4C,EAC5C,MAAoB;IAEpB,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,qCAAqC;AACrC,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAiBD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAY,EAAE,IAAU;IAC7C,MAAM,KAAK,GAAc;QACvB,OAAO,EAAE,CAAC,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,mDAAmD;QACnD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;YACvC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,KAAK,CAAC,SAAS,EACxB,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;gBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC;YACvD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,gDAAgD;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACzB,wEAAwE;YACxE,IAAI,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,MAAM;YACrC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;YACzB,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;iBACxC,IAAI,KAAK,KAAK,EAAE;gBAAE,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,EAAY,EAAE,KAAgB;IAClD,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,IAAU,EACV,YAAuB,EACvB,OAAyE,EAAE;IAE3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACtB,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW;YAC/B,CAAC,CAAC,GAAG,IAAI,KAAK,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE;YAC5C,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,OAAO,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEnD,wEAAwE;IACxE,4EAA4E;IAC5E,kCAAkC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,iEAAiE;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,yEAAyE;QACzE,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,MAAM,KAAK,SAAS,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,oCAAoC;QACpC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,IAAU,EACV,YAAuB,EACvB,OAA2D,EAAE;IAE7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,CAAC,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YACzD,uDAAuD;YACvD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC"}

package/dist/modules/access/group-files.d.ts

@@ -1,83 +0,0 @@
-/**
- * Group files — the "who you are" half of the roles/groups split.
- *
- * Groups are people-sets referenced by access grants ("GTM Team can read the
- * battlecards"). A deployment has exactly ONE group source at a time — a mode
- * derived from which file exists, so it holds at any git ref:
- *
- *   - `synced-groups.yaml` EXISTS  → IdP mode. The file is MACHINE-OWNED,
- *     regenerated wholesale from the SCIM directory mirror; membership is
- *     managed in the IdP. `groups.yaml` is ignored entirely.
- *   - otherwise                    → manual mode. `groups.yaml` (UI-edited)
- *     is the source.
- *
- * Both files share one format, the group twin of roles.yaml:
- *
- *   groups:
- *     Engineering:
- *       - ada@x.io
- *       - bo@x.io
- *     Empty Group: []
- *
- * Parsing is FORGIVING at the entry level by design — a malformed email or a
- * reserved/duplicate name skips that entry with a warning, it never takes the
- * whole file down. Only structural failures (unparsable YAML, `groups:` not a
- * mapping) reject the file, and even then the RESOLVER degrades to "this file
- * contributes nothing" rather than throwing: unlike roles.yaml there is no
- * admin-lockout risk here, so groups must never be able to brick access
- * resolution. Strict acceptance for WRITES is the job of the write-side
- * validator (`validateGroupsFile` below), which treats warnings as refusals.
- */
-export declare const GROUPS_YAML = "groups.yaml";
-export declare const SYNCED_GROUPS_YAML = "synced-groups.yaml";
-/**
- * THE name-safety predicate for principal display names — the single source
- * of truth every surface derives from (group creation/rename, IdP sync
- * materialization; thin assert wrappers sit on top). Returns a human-readable
- * reason the name is unsafe, or null when it is fine.
- *
- * The character rules keep the emitted YAML parseable and the entry grammar
- * unambiguous:
- *   `:`        mis-tokenises as a nested mapping key
- *   `#`        truncated as a comment by the subset parser's stripComment
- *   `<` / `>`  collide with the `Name <email>` user-reference shape
- *   leading -  tokenises as a list item
- *   \x00-\x1f  control chars / newlines break line structure outright
- *   `role/…`   reserved: that spelling is the EXPLICIT role token in access
- *              entries — a group carrying it could never be referenced.
- */
-export declare function unsafeNameReason(displayName: string): string | null;
-/** One parsed group: display name + canonicalised member emails. */
-export interface GroupDefinition {
-    displayName: string;
-    emails: Set<string>;
-}
-/** Canonical group name → definition, in file order. */
-export type GroupsIndex = Map<string, GroupDefinition>;
-export interface ParsedGroupsFile {
-    ok: true;
-    groups: GroupsIndex;
-    /** Entry-level problems that were skipped over (bad email, dup name, …). */
-    warnings: string[];
-}
-export interface GroupsFileError {
-    ok: false;
-    errors: string[];
-}
-/**
- * Parse a group file (either of the two — same grammar). See the module note
- * for the forgiving-vs-structural split.
- */
-export declare function parseGroupsFile(text: string, filename: string): ParsedGroupsFile | GroupsFileError;
-/**
- * Write-gate twin of {@link parseGroupsFile}: strict — structural errors AND
- * entry-level warnings both refuse the candidate, so a UI write can never land
- * a group the resolver would silently skip.
- */
-export declare function validateGroupsFile(text: string, filename: string): {
-    ok: true;
-} | {
-    ok: false;
-    errors: string[];
-};
-//# sourceMappingURL=group-files.d.ts.map

package/dist/modules/access/group-files.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"group-files.d.ts","sourceRoot":"","sources":["../../../src/modules/access/group-files.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWnE;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,WAAW,CAAC;IACpB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,gBAAgB,GAAG,eAAe,CAyFpC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAWhD"}