@numa-tech/numa 1.19.0 → 1.20.1

package/dist/authorization/group-client.d.ts

@@ -1,169 +0,0 @@
-import { z } from "zod";
-import type { AuthConfig } from "../config.js";
-import { type KeycloakTokenProvider } from "../oauth.js";
-export declare const EnrollmentSchema: z.ZodObject<{
-    membershipStatus: z.ZodEnum<{
-        ACTIVE: "ACTIVE";
-        NOT_ENROLLED: "NOT_ENROLLED";
-        REVOKED: "REVOKED";
-        SUSPENDED: "SUSPENDED";
-    }>;
-    syncStatus: z.ZodEnum<{
-        APPLIED: "APPLIED";
-        DISABLED: "DISABLED";
-        FAILED: "FAILED";
-        PENDING: "PENDING";
-        UNKNOWN: "UNKNOWN";
-    }>;
-    tokenRefreshRequired: z.ZodBoolean;
-    policyRevision: z.ZodNumber;
-    blocked: z.ZodOptional<z.ZodBoolean>;
-    policyEnabled: z.ZodOptional<z.ZodBoolean>;
-    clientId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    groupId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    blockReason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    expectedClientRoles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
-}, z.core.$strip>;
-export type Enrollment = z.infer<typeof EnrollmentSchema>;
-/** @deprecated Historical suggestions only; never an enrollment or authorization allowlist. */
-export declare const BASELINE_ROLES: readonly ["mci-devops-platform-notion-user", "mci-devops-platform-ai-registry-reader", "mci-devops-platform-oss-user"];
-export declare const GroupPlanInputSchema: z.ZodObject<{
-    operation: z.ZodEnum<{
-        ADD_MEMBER: "ADD_MEMBER";
-        CREATE_GROUP: "CREATE_GROUP";
-        DEACTIVATE_GROUP: "DEACTIVATE_GROUP";
-        FILL_MISSING: "FILL_MISSING";
-        LINK_GROUP: "LINK_GROUP";
-        MIGRATE_POLICY: "MIGRATE_POLICY";
-        REMOVE_MEMBER: "REMOVE_MEMBER";
-        RESTORE_MEMBER: "RESTORE_MEMBER";
-        SET_GROUP_ROLES: "SET_GROUP_ROLES";
-        SET_MEMBER_STATE: "SET_MEMBER_STATE";
-        SET_POLICY: "SET_POLICY";
-    }>;
-    name: z.ZodOptional<z.ZodString>;
-    groupId: z.ZodOptional<z.ZodString>;
-    keycloakGroupId: z.ZodOptional<z.ZodString>;
-    subject: z.ZodOptional<z.ZodString>;
-    state: z.ZodOptional<z.ZodEnum<{
-        ACTIVE: "ACTIVE";
-        REVOKED: "REVOKED";
-        SUSPENDED: "SUSPENDED";
-    }>>;
-    enabled: z.ZodOptional<z.ZodBoolean>;
-    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-export type GroupPlanInput = z.infer<typeof GroupPlanInputSchema>;
-declare const GroupPlanSchema: z.ZodObject<{
-    planId: z.ZodString;
-    digest: z.ZodString;
-    status: z.ZodString;
-    operation: z.ZodString;
-    policyRevision: z.ZodNumber;
-    items: z.ZodArray<z.ZodObject<{
-        action: z.ZodString;
-        status: z.ZodString;
-    }, z.core.$loose>>;
-    summary: z.ZodUnknown;
-    input: z.ZodUnknown;
-    totalItems: z.ZodNumber;
-    businessImpact: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, z.core.$strip>;
-export type GroupPlan = z.infer<typeof GroupPlanSchema>;
-declare const GroupListSchema: z.ZodObject<{
-    groups: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-    policy: z.ZodObject<{
-        revision: z.ZodNumber;
-        enabled: z.ZodBoolean;
-        groupId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    }, z.core.$loose>;
-    baselineRoles: z.ZodArray<z.ZodString>;
-    readiness: z.ZodOptional<z.ZodObject<{
-        status: z.ZodString;
-        writesVerified: z.ZodBoolean;
-        message: z.ZodString;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-declare const MemberListSchema: z.ZodObject<{
-    members: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$strip>;
-export type GroupList = z.infer<typeof GroupListSchema>;
-export type MemberList = z.infer<typeof MemberListSchema>;
-declare const PlanItemListSchema: z.ZodObject<{
-    items: z.ZodArray<z.ZodObject<{
-        action: z.ZodString;
-        status: z.ZodString;
-    }, z.core.$loose>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$strip>;
-declare const DirectoryUsersSchema: z.ZodObject<{
-    users: z.ZodArray<z.ZodObject<{
-        subject: z.ZodString;
-        username: z.ZodString;
-        email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    }, z.core.$strip>>;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$loose>;
-declare const DirectoryGroupsSchema: z.ZodObject<{
-    groups: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$strip>;
-export type PlanItemList = z.infer<typeof PlanItemListSchema>;
-export type DirectoryUsers = z.infer<typeof DirectoryUsersSchema>;
-export type DirectoryGroups = z.infer<typeof DirectoryGroupsSchema>;
-export declare const ImpactKindSchema: z.ZodEnum<{
-    notionRoleGrants: "notionRoleGrants";
-    ossExistingGrants: "ossExistingGrants";
-    readerNamespaces: "readerNamespaces";
-}>;
-export type ImpactKind = z.infer<typeof ImpactKindSchema>;
-declare const ImpactListSchema: z.ZodObject<{
-    items: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$strip>;
-export type ImpactList = z.infer<typeof ImpactListSchema>;
-export interface GroupApi {
-    enrollment(initialize?: boolean): Promise<Enrollment>;
-    list(page?: number, limit?: number): Promise<GroupList>;
-    members(query?: string, page?: number, limit?: number, groupId?: string): Promise<MemberList>;
-    users(query: string, page?: number, limit?: number): Promise<DirectoryUsers>;
-    directoryGroups(query?: string, page?: number, limit?: number): Promise<DirectoryGroups>;
-    plan(input: GroupPlanInput): Promise<GroupPlan>;
-    getPlan(id: string): Promise<GroupPlan>;
-    planItems(id: string, page?: number, limit?: number): Promise<PlanItemList>;
-    impact(id: string, kind: ImpactKind, page?: number, limit?: number): Promise<ImpactList>;
-    apply(id: string, expectedDigest: string, idempotencyKey: string): Promise<GroupPlan>;
-}
-export declare class GroupClient implements GroupApi {
-    private readonly config;
-    private readonly dependencies;
-    constructor(config: AuthConfig, dependencies?: {
-        fetch?: typeof fetch;
-        tokenProvider?: KeycloakTokenProvider;
-    });
-    enrollment(initialize?: boolean): Promise<Enrollment>;
-    list(page?: number, limit?: number): Promise<GroupList>;
-    members(query?: string, page?: number, limit?: number, groupId?: string): Promise<MemberList>;
-    users(query: string, page?: number, limit?: number): Promise<DirectoryUsers>;
-    directoryGroups(query?: string, page?: number, limit?: number): Promise<DirectoryGroups>;
-    plan(input: GroupPlanInput): Promise<GroupPlan>;
-    getPlan(id: string): Promise<GroupPlan>;
-    planItems(id: string, page?: number, limit?: number): Promise<PlanItemList>;
-    impact(id: string, kind: ImpactKind, page?: number, limit?: number): Promise<ImpactList>;
-    apply(id: string, expectedDigest: string, idempotencyKey: string): Promise<GroupPlan>;
-    private json;
-}
-export {};

package/dist/authorization/group-client.js

@@ -1,129 +0,0 @@
-import { z } from "zod";
-import { resolveBackendUrl } from "../backend.js";
-import { ensureAccessToken, fetchWithKeycloakIdentity } from "../oauth.js";
-import { AuthorizationError, authorizationHttpErrorCode } from "./errors.js";
-const ROOT = "/api/v1/admin/authorization/groups";
-export const EnrollmentSchema = z.object({
-    membershipStatus: z.enum(["NOT_ENROLLED", "ACTIVE", "SUSPENDED", "REVOKED"]),
-    syncStatus: z.enum(["DISABLED", "PENDING", "APPLIED", "FAILED", "UNKNOWN"]),
-    tokenRefreshRequired: z.boolean(), policyRevision: z.number().int().nonnegative(),
-    blocked: z.boolean().optional(), policyEnabled: z.boolean().optional(), clientId: z.string().nullable().optional(),
-    groupId: z.string().nullable().optional(), blockReason: z.string().nullable().optional(),
-    expectedClientRoles: z.record(z.string(), z.array(z.string())).optional()
-});
-/** @deprecated Historical suggestions only; never an enrollment or authorization allowlist. */
-export const BASELINE_ROLES = [
-    "mci-devops-platform-notion-user",
-    "mci-devops-platform-ai-registry-reader",
-    "mci-devops-platform-oss-user"
-];
-export const GroupPlanInputSchema = z.object({
-    operation: z.enum(["CREATE_GROUP", "LINK_GROUP", "SET_GROUP_ROLES", "SET_POLICY", "ADD_MEMBER", "REMOVE_MEMBER", "RESTORE_MEMBER", "DEACTIVATE_GROUP", "SET_MEMBER_STATE", "FILL_MISSING", "MIGRATE_POLICY"]),
-    name: z.string().trim().min(1).max(160).optional(),
-    groupId: z.string().uuid().optional(),
-    keycloakGroupId: z.string().uuid().optional(),
-    subject: z.string().min(1).max(200).optional(),
-    state: z.enum(["ACTIVE", "SUSPENDED", "REVOKED"]).optional(),
-    enabled: z.boolean().optional(),
-    roles: z.array(z.string().min(1).max(416).refine(value => {
-        const parts = value.split("/");
-        const client = parts.length === 1 ? "mci-devops-platform" : parts[0];
-        const role = parts.at(-1);
-        return parts.length <= 2 && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,159}$/u.test(client)
-            && !["realm-management", "account", "account-console", "security-admin-console", "admin-cli", "broker", "web-client", "mcp-client"].includes(client)
-            && !client.endsWith("-realm") && Boolean(role.trim()) && role.length <= 255 && !/[\u0000-\u001f\u007f]/u.test(role);
-    })).max(200).optional()
-}).strict();
-const GroupPlanSchema = z.object({
-    planId: z.string().uuid(),
-    digest: z.string().min(1), status: z.string().min(1), operation: z.string(),
-    policyRevision: z.number().int().nonnegative(),
-    items: z.array(z.object({ action: z.string(), status: z.string() }).passthrough()),
-    summary: z.unknown(), input: z.unknown(), totalItems: z.number().int().nonnegative(),
-    businessImpact: z.record(z.string(), z.unknown()).optional()
-});
-const GroupListSchema = z.object({
-    groups: z.array(z.record(z.string(), z.unknown())), total: z.number().int().nonnegative(),
-    page: z.number().int(), limit: z.number().int(),
-    policy: z.object({ revision: z.number().int(), enabled: z.boolean(), groupId: z.string().uuid().nullable().optional() }).passthrough(),
-    baselineRoles: z.array(z.string()),
-    readiness: z.object({ status: z.string(), writesVerified: z.boolean(), message: z.string() }).optional()
-});
-const MemberListSchema = z.object({
-    members: z.array(z.record(z.string(), z.unknown())), total: z.number().int().nonnegative(),
-    page: z.number().int(), limit: z.number().int()
-});
-const PlanItemListSchema = z.object({ items: z.array(z.object({ action: z.string(), status: z.string() }).passthrough()), total: z.number().int(), page: z.number().int(), limit: z.number().int() });
-const DirectoryUsersSchema = z.object({ users: z.array(z.object({ subject: z.string(), username: z.string(), email: z.string().nullable().optional() })), page: z.number().int(), limit: z.number().int() }).passthrough();
-const DirectoryGroupsSchema = z.object({ groups: z.array(z.record(z.string(), z.unknown())), total: z.number().int(), page: z.number().int(), limit: z.number().int() });
-export const ImpactKindSchema = z.enum(["notionRoleGrants", "readerNamespaces", "ossExistingGrants"]);
-const ImpactListSchema = z.object({ items: z.array(z.record(z.string(), z.unknown())), total: z.number().int(), page: z.number().int(), limit: z.number().int() });
-export class GroupClient {
-    config;
-    dependencies;
-    constructor(config, dependencies = {}) {
-        this.config = config;
-        this.dependencies = dependencies;
-    }
-    enrollment(initialize = false) {
-        if (this.config.authenticationMode === "client_credentials") {
-            throw new AuthorizationError("Application enrollment is for human user sessions, not machine identities.", "authorization_input_invalid");
-        }
-        return this.json("/api/v1/me/enrollment", EnrollmentSchema, initialize ? {} : undefined);
-    }
-    list(page = 1, limit = 20) {
-        return this.json(`${ROOT}?${new URLSearchParams({ page: String(page), limit: String(limit) })}`, GroupListSchema);
-    }
-    members(query = "", page = 1, limit = 20, groupId) {
-        return this.json(`${ROOT}/members?${new URLSearchParams({ query, page: String(page), limit: String(limit), ...(groupId ? { groupId } : {}) })}`, MemberListSchema);
-    }
-    users(query, page = 1, limit = 20) {
-        return this.json(`${ROOT}/directory/users?${new URLSearchParams({ query, page: String(page), limit: String(limit) })}`, DirectoryUsersSchema);
-    }
-    directoryGroups(query = "", page = 1, limit = 20) {
-        return this.json(`${ROOT}/directory/groups?${new URLSearchParams({ query, page: String(page), limit: String(limit) })}`, DirectoryGroupsSchema);
-    }
-    plan(input) {
-        const parsed = GroupPlanInputSchema.safeParse(input);
-        if (!parsed.success)
-            throw new AuthorizationError("Group plan input is invalid; use registered application Client Role references.", "authorization_input_invalid");
-        return this.json(`${ROOT}/plans`, GroupPlanSchema, parsed.data);
-    }
-    getPlan(id) {
-        return this.json(`${ROOT}/plans/${segment(id)}`, GroupPlanSchema);
-    }
-    planItems(id, page = 1, limit = 20) {
-        return this.json(`${ROOT}/plans/${segment(id)}/items?${new URLSearchParams({ page: String(page), limit: String(limit) })}`, PlanItemListSchema);
-    }
-    impact(id, kind, page = 1, limit = 20) {
-        if (!ImpactKindSchema.safeParse(kind).success)
-            throw new AuthorizationError("Unsupported business impact kind.", "authorization_input_invalid");
-        return this.json(`${ROOT}/plans/${segment(id)}/impact?${new URLSearchParams({ kind, page: String(page), limit: String(limit) })}`, ImpactListSchema);
-    }
-    apply(id, expectedDigest, idempotencyKey) {
-        return this.json(`${ROOT}/plans/${segment(id)}/apply`, GroupPlanSchema, { expectedDigest, idempotencyKey });
-    }
-    async json(path, schema, body) {
-        const method = body === undefined ? "GET" : "POST";
-        const response = await fetchWithKeycloakIdentity(this.config, resolveBackendUrl(this.config, { path, method }), () => ({
-            method, redirect: "error", signal: AbortSignal.timeout(20_000),
-            headers: { Accept: "application/json", ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
-            ...(body === undefined ? {} : { body: JSON.stringify(body) })
-        }), { fetch: this.dependencies.fetch ?? fetch, tokenProvider: this.dependencies.tokenProvider ?? ensureAccessToken, retryUnauthorized: method === "GET" });
-        if (!response.ok) {
-            // Never echo credential-bearing upstream errors or HTML. After write timeouts,
-            // operators must inspect the same plan instead of submitting a new operation.
-            throw new AuthorizationError(`Application group API returned HTTP ${response.status}. Inspect the same plan before retrying a write.`, authorizationHttpErrorCode(response.status), response.status);
-        }
-        const parsed = schema.safeParse(await response.json().catch(() => undefined));
-        if (!parsed.success)
-            throw new AuthorizationError("Application group API response does not match the CLI contract.", "authorization_invalid_response");
-        return parsed.data;
-    }
-}
-function segment(value) {
-    if (!/^[A-Za-z0-9_-]{1,200}$/u.test(value))
-        throw new AuthorizationError("Invalid group plan ID.", "authorization_input_invalid");
-    return encodeURIComponent(value);
-}
-//# sourceMappingURL=group-client.js.map

package/dist/authorization/group-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"group-client.js","sourceRoot":"","sources":["../../src/authorization/group-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAA8B,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAE7E,MAAM,IAAI,GAAG,oCAAoC,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5E,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3E,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxF,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,iCAAiC;IACjC,wCAAwC;IACxC,8BAA8B;CACtB,CAAC;AACX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC7M,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QACtE,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC;eACzE,CAAC,CAAC,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;eACjJ,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpF,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;IACtI,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzG,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CAChD,CAAC,CAAC;AAGH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACtM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3N,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAIzK,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEtG,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAenK,MAAM,OAAO,WAAW;IACO,MAAM;IAA+B,YAAY;IAA9E,YAA6B,MAAkB,EAAmB,YAAY,GAE1E,EAAE;sBAFuB,MAAM;4BAA+B,YAAY;IAErE,CAAC;IAEV,UAAU,CAAC,UAAU,GAAG,KAAK;QAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,KAAK,oBAAoB,EAAE,CAAC;YAC5D,MAAM,IAAI,kBAAkB,CAAC,4EAA4E,EAAE,6BAA6B,CAAC,CAAC;QAC5I,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,OAAgB;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,YAAY,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACrK,CAAC;IACD,KAAK,CAAC,KAAa,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAChJ,CAAC;IACD,eAAe,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,qBAAqB,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,CAAC,KAAqB;QACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,iFAAiF,EAAE,6BAA6B,CAAC,CAAC;QACpK,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACpE,CAAC;IACD,SAAS,CAAC,EAAU,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,EAAE,CAAC,UAAU,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,CAAC,EAAU,EAAE,IAAgB,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QACvD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,EAAE,6BAA6B,CAAC,CAAC;QAChJ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,EAAE,CAAC,WAAW,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACvJ,CAAC;IACD,KAAK,CAAC,EAAU,EAAE,cAAsB,EAAE,cAAsB;QAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9G,CAAC;IACO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAoB,EAAE,IAAc;QACtE,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACrH,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;YAC9G,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,aAAa,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;QAC3J,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,+EAA+E;YAC/E,8EAA8E;YAC9E,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,QAAQ,CAAC,MAAM,kDAAkD,EAAE,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvM,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,iEAAiE,EAAE,gCAAgC,CAAC,CAAC;QACvJ,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,CAAC;IAClI,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/authorization/group-commands.d.ts

@@ -1,25 +0,0 @@
-import type { Command } from "commander";
-import { type GroupApi, type GroupPlanInput } from "./group-client.js";
-interface Dependencies {
-    clientFactory?: () => GroupApi;
-}
-type PageOptions = {
-    page: string;
-    limit: string;
-};
-type ApplyOptions = {
-    expectedDigest: string;
-    idempotencyKey: string;
-    yes?: boolean;
-};
-export declare function registerGroupCommands(authorization: Command, dependencies?: Dependencies): void;
-export declare function parseGroupPlanInput(value: unknown): GroupPlanInput;
-export declare function parseGroupApplyInput(options: ApplyOptions): {
-    expectedDigest: string;
-    idempotencyKey: string;
-};
-export declare function parseGroupPagination(options: PageOptions): {
-    page: number;
-    limit: number;
-};
-export {};

package/dist/authorization/group-commands.js

@@ -1,155 +0,0 @@
-import process from "node:process";
-import { readFile } from "node:fs/promises";
-import { loadConfig } from "../config.js";
-import { GroupClient, GroupPlanInputSchema, ImpactKindSchema } from "./group-client.js";
-import { initializeApplicationMembership } from "./enrollment.js";
-import { AuthorizationError, sanitizeAuthorizationOutput } from "./errors.js";
-export function registerGroupCommands(authorization, dependencies = {}) {
-    const client = dependencies.clientFactory ?? (() => new GroupClient(loadConfig()));
-    const enrollment = authorization.command("enrollment").description("本人应用成员资格与默认组同步（不操作 realm 默认组）");
-    enrollment.command("status").description("只读查询本人入组状态，不触发授权")
-        .action(async (_options, command) => output(command, { ok: true, enrollment: await client().enrollment() }));
-    enrollment.command("initialize").description("显式初始化本人默认组；机器、暂停和已撤销成员不可自动入组")
-        .action(async (_options, command) => {
-        const result = await initializeApplicationMembership(loadConfig(), { client: client() });
-        await output(command, { ok: result.status === "READY", ...result });
-        if (result.status !== "READY")
-            process.exitCode = 1;
-    });
-    const group = authorization.command("group").description("应用受管组、默认策略及成员重分配；不直接连接 Keycloak")
-        .addHelpText("after", `
-所有变更先生成不可变计划，再显式 apply；超时先 status 同一个计划，UNKNOWN 需重新预览。
-组角色使用已登记应用的 Client Role；格式 clientId/roleName，平台角色兼容裸名称。
-成员来源、状态、漂移与最终权限全部由平台服务端校验。
-`);
-    paginated(group.command("list").description("分页查询受管组、默认策略和允许的基础角色"))
-        .action(async (options, command) => {
-        const { page, limit } = parseGroupPagination(options);
-        await output(command, { ok: true, ...await client().list(page, limit) });
-    });
-    paginated(group.command("members").description("分页查询应用成员；不是 realm 用户全量清单").option("--query <text>", "按用户名称或邮箱搜索").option("--group-id <uuid>", "受管组 ID 筛选"))
-        .action(async (options, command) => {
-        const { page, limit } = parseGroupPagination(options);
-        await output(command, { ok: true, ...await client().members(options.query, page, limit, options.groupId) });
-    });
-    paginated(group.command("users").description("从 Keycloak 人员目录搜索候选，返回稳定 subject；不创建成员").requiredOption("--query <text>", "输入名称或邮箱搜索"))
-        .action(async (options, command) => {
-        const { page, limit } = parseGroupPagination(options);
-        await output(command, { ok: true, ...await client().users(options.query, page, limit) });
-    });
-    paginated(group.command("directory").description("只读发现可关联的远端普通组；发现不等于允许接管").option("--query <text>", "按组名搜索"))
-        .action(async (options, command) => {
-        const { page, limit } = parseGroupPagination(options);
-        await output(command, { ok: true, ...await client().directoryGroups(options.query, page, limit) });
-    });
-    group.command("plan").description("从严格 JSON 输入预览创建/关联组、角色绑定、策略、成员或重分配变更；不写 Keycloak")
-        .requiredOption("--file <path>", "GroupPlanInput JSON 文件，不含 secret 或 token")
-        .action(async (options, command) => {
-        const source = await readFile(options.file, "utf8");
-        if (Buffer.byteLength(source) > 64 * 1024)
-            throw invalid("Group plan file exceeds 64 KiB.");
-        let body;
-        try {
-            body = JSON.parse(source);
-        }
-        catch {
-            throw invalid("Group plan file must contain valid JSON.");
-        }
-        await output(command, { ok: true, plan: await client().plan(parseGroupPlanInput(body)) });
-    }).addHelpText("after", `
-JSON 示例:
-  {"operation":"CREATE_GROUP","name":"mci-devops-platform-users"}
-  {"operation":"SET_POLICY","groupId":"<managed-group-uuid>","enabled":true}
-  {"operation":"FILL_MISSING"}
-
-numa authorization group plan --file group-plan.json --json
-`);
-    group.command("status <plan-id>").description("只读检查同一计划的结果；UNKNOWN 需核对后重新预览")
-        .action(async (id, _options, command) => output(command, { ok: true, plan: await client().getPlan(planId(id)) }));
-    paginated(group.command("items <plan-id>").description("分页检查计划全部候选；status 仅含前 20 条摘要"))
-        .action(async (id, options, command) => {
-        const { page, limit } = parseGroupPagination(options);
-        await output(command, { ok: true, ...await client().planItems(planId(id), page, limit) });
-    });
-    paginated(group.command("impact <plan-id>").description("分页读取摘要绑定的真实业务范围；counts 不等于完整明细")
-        .requiredOption("--kind <kind>", "notionRoleGrants、readerNamespaces 或 ossExistingGrants"))
-        .action(async (id, options, command) => {
-        const { page, limit } = parseGroupPagination(options);
-        const kind = ImpactKindSchema.safeParse(options.kind);
-        if (!kind.success)
-            throw invalid("kind must be notionRoleGrants, readerNamespaces, or ossExistingGrants.");
-        await output(command, { ok: true, kind: kind.data, ...await client().impact(planId(id), kind.data, page, limit) });
-    });
-    group.command("apply <plan-id>").description("确认执行或恢复同一批准快照；不重新生成成员范围")
-        .requiredOption("--expected-digest <sha256>", "预览返回的精确 digest")
-        .requiredOption("--idempotency-key <key>", "8-200 字符；重试复用同一个值")
-        .option("--yes", "已核对当前环境、计划明细、权限变化与人员范围")
-        .action(async (id, options, command) => {
-        const input = parseGroupApplyInput(options);
-        const plan = await client().getPlan(planId(id));
-        if (plan.digest !== input.expectedDigest)
-            throw invalid("Plan digest changed. Read a new preview before applying.");
-        if (!["PREVIEW", "APPLIED"].includes(plan.status))
-            throw invalid("This plan cannot be replayed. Inspect all items and create a new preview after UNKNOWN, failure, or drift.");
-        const result = await client().apply(planId(id), input.expectedDigest, input.idempotencyKey);
-        await output(command, { ok: result.status === "APPLIED", plan: result });
-        if (result.status !== "APPLIED")
-            process.exitCode = 1;
-    });
-}
-export function parseGroupPlanInput(value) {
-    const result = GroupPlanInputSchema.safeParse(value);
-    if (!result.success)
-        throw invalid("Invalid group plan fields or role. Use registered application Client Role references.");
-    const input = result.data;
-    const requiresGroup = ["SET_GROUP_ROLES", "SET_POLICY", "ADD_MEMBER", "REMOVE_MEMBER", "RESTORE_MEMBER", "DEACTIVATE_GROUP"];
-    if (requiresGroup.includes(input.operation) && input.groupId == null)
-        throw invalid("This operation requires groupId.");
-    if (input.operation === "CREATE_GROUP" && (!input.name || !/^[A-Za-z0-9][A-Za-z0-9_.-]{2,119}$/u.test(input.name)))
-        throw invalid("CREATE_GROUP requires a flat 3-120 character name (letters, numbers, dot, dash, underscore).");
-    if (input.operation === "LINK_GROUP" && !input.keycloakGroupId)
-        throw invalid("LINK_GROUP requires keycloakGroupId.");
-    if (["ADD_MEMBER", "REMOVE_MEMBER", "RESTORE_MEMBER", "SET_MEMBER_STATE"].includes(input.operation) && !input.subject)
-        throw invalid("This operation requires subject from the member directory.");
-    if (input.operation === "SET_MEMBER_STATE" && !input.state)
-        throw invalid("SET_MEMBER_STATE requires state.");
-    if (input.operation === "SET_GROUP_ROLES" && input.roles == null)
-        throw invalid("SET_GROUP_ROLES requires an explicit roles list.");
-    if (input.operation === "SET_POLICY" && input.enabled == null)
-        throw invalid("SET_POLICY requires explicit enabled.");
-    for (const value of [input.name, input.subject, input.keycloakGroupId]) {
-        if (value && /[\u0000-\u001f\u007f]/u.test(value))
-            throw invalid("Group plan values must not contain control characters.");
-    }
-    return input;
-}
-export function parseGroupApplyInput(options) {
-    if (!options.yes)
-        throw invalid("Group authorization changes require --yes after reviewing the plan.");
-    if (!/^[a-f0-9]{64}$/iu.test(options.expectedDigest))
-        throw invalid("expected-digest must be the preview SHA-256 digest.");
-    if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{7,199}$/u.test(options.idempotencyKey))
-        throw invalid("idempotency-key must be 8-200 safe characters.");
-    return { expectedDigest: options.expectedDigest, idempotencyKey: options.idempotencyKey };
-}
-export function parseGroupPagination(options) {
-    const page = Number(options.page), limit = Number(options.limit);
-    if (!Number.isSafeInteger(page) || page < 1 || !Number.isSafeInteger(limit) || limit < 1 || limit > 100)
-        throw invalid("page must start at 1; limit must be 1-100.");
-    return { page, limit };
-}
-function paginated(command) {
-    return command.option("--page <number>", "从 1 开始的页码", "1").option("--limit <count>", "每页 1-100 条", "20");
-}
-function planId(value) {
-    if (!/^[A-Za-z0-9_-]{1,200}$/u.test(value))
-        throw invalid("Invalid plan ID.");
-    return value;
-}
-function invalid(message) { return new AuthorizationError(message, "authorization_input_invalid"); }
-async function output(_command, value) {
-    // Keep server field names stable for plan-file automation; redaction precedes all output.
-    const safe = sanitizeAuthorizationOutput(value);
-    process.stdout.write(`${JSON.stringify(safe, null, 2)}\n`);
-}
-//# sourceMappingURL=group-commands.js.map

package/dist/authorization/group-commands.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"group-commands.js","sourceRoot":"","sources":["../../src/authorization/group-commands.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,gBAAgB,EAAsC,MAAM,mBAAmB,CAAC;AAC5H,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAM9E,MAAM,UAAU,qBAAqB,CAAC,aAAsB,EAAE,YAAY,GAAiB,EAAE;IAC3F,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACpG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC;SACzD,MAAM,CAAC,KAAK,EAAE,QAAiB,EAAE,OAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IACjI,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,8BAA8B,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,QAAiB,EAAE,OAAgB,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACzF,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,iCAAiC,CAAC;SACxF,WAAW,CAAC,OAAO,EAAE;;;;CAIzB,CAAC,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,OAAoB,EAAE,OAAgB,EAAE,EAAE;QACvD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACL,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;SACxJ,MAAM,CAAC,KAAK,EAAE,OAA2D,EAAE,OAAgB,EAAE,EAAE;QAC9F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC,CAAC,CAAC;IACL,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC,cAAc,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;SAClI,MAAM,CAAC,KAAK,EAAE,OAAwC,EAAE,OAAgB,EAAE,EAAE;QAC3E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IACL,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;SAC3G,MAAM,CAAC,KAAK,EAAE,OAAyC,EAAE,OAAgB,EAAE,EAAE;QAC5E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IACL,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,kDAAkD,CAAC;SAClF,cAAc,CAAC,eAAe,EAAE,0CAA0C,CAAC;SAC3E,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,OAAgB,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,OAAO,CAAC,iCAAiC,CAAC,CAAC;QAC5F,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,OAAO,CAAC,0CAA0C,CAAC,CAAC;QAAC,CAAC;QAClH,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE;;;;;;;CAO3B,CAAC,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,WAAW,CAAC,8BAA8B,CAAC;SAC1E,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,QAAiB,EAAE,OAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9I,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAAC;SACpF,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,OAAoB,EAAE,OAAgB,EAAE,EAAE;QACnE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IACL,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,WAAW,CAAC,gCAAgC,CAAC;SACtF,cAAc,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;SACzF,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,OAAuC,EAAE,OAAgB,EAAE,EAAE;QACtF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,wEAAwE,CAAC,CAAC;QAC3G,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC,CAAC,CAAC;IACL,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC;SACpE,cAAc,CAAC,4BAA4B,EAAE,gBAAgB,CAAC;SAC9D,cAAc,CAAC,yBAAyB,EAAE,mBAAmB,CAAC;SAC9D,MAAM,CAAC,OAAO,EAAE,wBAAwB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,OAAqB,EAAE,OAAgB,EAAE,EAAE;QACpE,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc;YAAE,MAAM,OAAO,CAAC,0DAA0D,CAAC,CAAC;QACpH,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,OAAO,CAAC,4GAA4G,CAAC,CAAC;QAC/K,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC5F,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC,uFAAuF,CAAC,CAAC;IAC5H,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,MAAM,aAAa,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC7H,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI;QAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACxH,IAAI,KAAK,CAAC,SAAS,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,OAAO,CAAC,8FAA8F,CAAC,CAAC;IAClO,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,MAAM,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACtH,IAAI,CAAC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC,4DAA4D,CAAC,CAAC;IACnM,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC9G,IAAI,KAAK,CAAC,SAAS,KAAK,iBAAiB,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI;QAAE,MAAM,OAAO,CAAC,kDAAkD,CAAC,CAAC;IACpI,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI;QAAE,MAAM,OAAO,CAAC,uCAAuC,CAAC,CAAC;IACtH,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,wDAAwD,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,OAAqB;IACxD,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,MAAM,OAAO,CAAC,qEAAqE,CAAC,CAAC;IACvG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,MAAM,OAAO,CAAC,qDAAqD,CAAC,CAAC;IAC3H,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,MAAM,OAAO,CAAC,gDAAgD,CAAC,CAAC;IAC1I,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;AAC5F,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,OAAoB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;QAAE,MAAM,OAAO,CAAC,4CAA4C,CAAC,CAAC;IACrK,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AACD,SAAS,SAAS,CAAC,OAAgB;IACjC,OAAO,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;AAC3G,CAAC;AACD,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,OAAO,CAAC,OAAe,IAAwB,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;AAChI,KAAK,UAAU,MAAM,CAAC,QAAiB,EAAE,KAAc;IACrD,0FAA0F;IAC1F,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}