@numa-tech/numa 1.20.0 → 1.20.2

package/examples/oss/roundtrip.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Exercise Grant/STS APIs and OSS list/write/read using an unpublished local Numa build."""
+import argparse
+import hashlib
+import json
+import pathlib
+import subprocess
+import tempfile
+import uuid
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--cli', type=pathlib.Path, default=pathlib.Path(__file__).resolve().parents[2] / 'dist/cli.js', help='Local dist/cli.js; never downloads or installs a CLI')
+    parser.add_argument('--issuer', help='Business issuer code from the selected Profile; omit to use its default')
+    parser.add_argument('--grant-id', required=True, type=int, help='An exact grant ID from numa oss grants')
+    parser.add_argument('--prefix', help='Optional test prefix inside the grant scope')
+    args = parser.parse_args()
+    if not args.cli.is_file():
+        parser.error('Build the local CLI first (npm run build), or pass --cli /absolute/path/dist/cli.js')
+    command = ['node', str(args.cli.resolve())]
+    if args.issuer:
+        command += ['--issuer', args.issuer]
+
+    def cli(*arguments):
+        result = subprocess.run(command + list(arguments) + ['--json'], capture_output=True, text=True)
+        try:
+            value = json.loads(result.stdout)
+        except ValueError:
+            raise RuntimeError('CLI did not return JSON; check the local build and Profile configuration') from None
+        if result.returncode or not value.get('ok'):
+            # Do not echo arbitrary stdout, stderr, API responses or credentials.
+            error = value.get('error', {})
+            code = error.get('code', 'command_failed') if isinstance(error, dict) else 'command_failed'
+            raise RuntimeError(f'CLI command {arguments[0]} {arguments[1]} failed: {code}')
+        return value
+
+    grants = cli('oss', 'grants')['grants']
+    grant = next((g for g in grants if g['grantId'] == args.grant_id), None)
+    if not grant:
+        parser.error(f'Grant {args.grant_id} 未出现在当前身份的授权列表中；请使用相同 --issuer 执行 oss grants 查看授权 ID')
+    blockers = []
+    if grant['status'] != 'ACTIVE':
+        blockers.append('授权未启用（status=' + json.dumps(grant['status'], ensure_ascii=False) + '）')
+    if not grant['cloudPolicySynced']:
+        blockers.append('云端策略未同步/验证（cloudPolicySynced=false）')
+    required_actions = {'oss:ListObjects', 'oss:GetObject', 'oss:PutObject'}
+    actions = grant.get('actions')
+    permitted = grant.get('effect') == 'Allow' and isinstance(actions, list) and (required_actions.issubset(set(actions)) or 'oss:*' in actions)
+    if not permitted:
+        blockers.append('读写示例需要 Allow 且同时包含 ListObjects、GetObject、PutObject，当前 actions=' + json.dumps(actions, ensure_ascii=False))
+    if blockers:
+        parser.error(f'Grant {args.grant_id} 无法运行读写示例：' + '；'.join(blockers) + '。尚未申请 STS 或执行 OSS 对象操作。请选择已同步/验证且具有读写权限的授权。')
+    scope = grant['scopeType']
+    allowed = grant.get('objectPrefix') or ''
+    if scope not in ('BUCKET', 'PREFIX') or scope == 'PREFIX' and not allowed:
+        parser.error('Grant scope is incomplete')
+    prefix = args.prefix if args.prefix is not None else allowed
+    if scope == 'PREFIX' and not prefix.startswith(allowed):
+        parser.error('--prefix must be inside the granted objectPrefix')
+    if prefix and not prefix.endswith('/'):
+        prefix += '/'
+    key = prefix + 'numa-cli-example-' + uuid.uuid4().hex + '.txt'
+    grant_id = str(args.grant_id)
+    print(json.dumps({'bucket': grant['bucketName'], 'object_key': key, 'issuer': args.issuer or 'profile-default'}, ensure_ascii=False))
+    cli('oss', 'ls', grant_id, prefix, '--limit', '10')
+    with tempfile.TemporaryDirectory(prefix='numa-oss-example-') as directory:
+        source = pathlib.Path(directory) / 'source.txt'
+        downloaded = pathlib.Path(directory) / 'downloaded.txt'
+        source.write_text('Numa OSS CLI roundtrip\n' + str(uuid.uuid4()) + '\n', encoding='utf-8')
+        cli('oss', 'put', grant_id, key, str(source))  # No --overwrite.
+        cli('oss', 'stat', grant_id, key)
+        cli('oss', 'get', grant_id, key, '--output', str(downloaded))
+        if source.read_bytes() != downloaded.read_bytes():
+            raise RuntimeError('Downloaded contents do not match the uploaded file')
+        print(json.dumps({'ok': True, 'verified': ['list', 'write', 'read'], 'sha256': hashlib.sha256(downloaded.read_bytes()).hexdigest(), 'retained_object_key': key}))
+    # Deliberately retain the unique remote object. There is no implicit delete.
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except (RuntimeError, OSError) as error:
+        raise SystemExit(str(error)) from None

package/examples/oss/test_roundtrip.py

@@ -0,0 +1,66 @@
+"""Contract tests for the runnable example; all CLI/cloud responses are simulated."""
+import contextlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+spec=importlib.util.spec_from_file_location('roundtrip',Path(__file__).with_name('roundtrip.py'))
+module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)
+
+class RoundtripTest(unittest.TestCase):
+    def exercise(self,permission='READ_WRITE',prefix=None,corrupt=False,synced=True,status='ACTIVE',missing=False,blocked_message=None):
+        calls=[];storage={}
+        with tempfile.TemporaryDirectory() as directory:
+            entry=Path(directory)/'cli.js';entry.touch()
+            argv=['roundtrip','--cli',str(entry),'--grant-id','7','--issuer','cluster-b']
+            if prefix is not None:argv += ['--prefix',prefix]
+            def run(command,**kwargs):
+                self.assertEqual(command[2:4],['--issuer','cluster-b'])
+                args=command[4:-1];calls.append(args)
+                self.assertEqual(args[0],'oss');self.assertNotIn('--overwrite',args)
+                if args[1]=='grants': payload={'grants':[] if missing else [{'grantId':7,'status':status,'cloudPolicySynced':synced,'permissionLevel':permission,'effect':'Allow','actions':['oss:ListObjects','oss:GetObject']+([] if permission=='READ_ONLY' else ['oss:PutObject']),'scopeType':'PREFIX','objectPrefix':'tenant/kb/','bucketName':'example-bucket'}]}
+                elif args[1]=='put': storage[args[3]]=Path(args[4]).read_bytes();payload={}
+                elif args[1]=='get': Path(args[5]).write_bytes(b'wrong' if corrupt else storage[args[3]]);payload={}
+                elif args[1] in ('ls','stat'): payload={}
+                else:raise AssertionError('Unexpected object mutation: '+args[1])
+                return subprocess.CompletedProcess(command,0,json.dumps({'ok':True,**payload}),'')
+            output=io.StringIO();errors=io.StringIO()
+            with patch.object(sys,'argv',argv),patch.object(module.subprocess,'run',run),contextlib.redirect_stdout(output),contextlib.redirect_stderr(errors):
+                if blocked_message is None:
+                    module.main()
+                else:
+                    with self.assertRaises(SystemExit) as error:module.main()
+                    self.assertEqual(error.exception.code,2)
+                    self.assertRegex(errors.getvalue(),blocked_message)
+                    self.assertEqual([c[1] for c in calls],['grants'])
+                    self.assertEqual(storage,{})
+            return calls,storage,output.getvalue()
+
+    def test_roundtrip_selects_one_issuer_and_keeps_unique_object(self):
+        calls,storage,output=self.exercise()
+        self.assertEqual([c[1] for c in calls],['grants','ls','put','stat','get'])
+        key=next(iter(storage));self.assertTrue(key.startswith('tenant/kb/numa-cli-example-'))
+        self.assertEqual(json.loads(output.splitlines()[-1])['retained_object_key'],key)
+
+    def test_refuses_readonly_and_out_of_scope_before_write(self):
+        with self.assertRaises(SystemExit):self.exercise(permission='READ_ONLY')
+        with self.assertRaises(SystemExit):self.exercise(prefix='another-tenant/')
+
+    def test_detects_corrupted_download(self):
+        with self.assertRaisesRegex(RuntimeError,'do not match'):self.exercise(corrupt=True)
+
+    def test_reports_all_fixture_blockers_without_requesting_sts_or_objects(self):
+        self.exercise(permission='READ_ONLY',synced=False,blocked_message=r'Grant 7.*cloudPolicySynced=false.*actions=.*oss:GetObject.*尚未申请 STS')
+
+    def test_distinguishes_missing_inactive_and_synced_readonly_grants(self):
+        self.exercise(missing=True,blocked_message=r'Grant 7 未出现在当前身份')
+        self.exercise(status='DISABLED',blocked_message=r'授权未启用.*DISABLED')
+        self.exercise(permission='READ_ONLY',blocked_message=r'需要 Allow.*ListObjects.*GetObject.*PutObject.*actions=')
+
+if __name__=='__main__':unittest.main()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@numa-tech/numa",
-  "version": "1.20.0",
+  "version": "1.20.2",
   "description": "Cross-platform CLI for the Numa internal developer platform with Keycloak authentication and MCP support.",
   "author": "numa-tech",
   "keywords": [
@@ -22,6 +22,7 @@
     "dist",
     "README.md",
     "docs/wecom-messaging.md",
+    "docs/application-default-groups.md",
     "docs/module-maintenance-and-skills-updates.md",
     "examples",
     "skills",
@@ -37,7 +38,7 @@
     "dev:oss-web": "tsx src/cli.ts oss web",
     "test:oss-web": "node --import tsx --test src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts",
     "test:oss-auth-code": "node scripts/test-oss-auth-code.mjs",
-    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/group-client.test.ts src/authorization/group-commands.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts",
+    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/bootstrap-client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/application-commands.test.ts src/authorization/application-client.test.ts src/authorization/application-schemas.test.ts src/authorization/enrollment-client.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts src/business-issuer.test.ts src/login-configuration.test.ts src/login-recovery.test.ts src/ai-registry/mcp-management.test.ts src/ai-registry/mcp-runtime.test.ts src/ai-registry/mcp-stdio.test.ts",
     "pack:check": "turbo run pack:check root:pack:check",
     "root:pack:check": "node scripts/check-root-package.mjs",
     "boundaries": "node scripts/check-workspace-boundaries.mjs",
@@ -60,8 +61,8 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@numa-tech/cli-auth": "1.20.0",
-    "@tokensrc/codex": "1.20.0",
+    "@numa-tech/cli-auth": "1.20.2",
+    "@tokensrc/codex": "1.20.2",
     "ali-oss": "^6.23.0",
     "commander": "^14.0.3",
     "ink": "^6.8.0",

package/dist/authorization/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/authorization/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAA8B,MAAM,aAAa,CAAC;AACvG,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EAMvB,MAAM,cAAc,CAAC;AAEtB,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,SAAS,GAAG,GAAG,kBAAkB,QAAQ,CAAC;AAChD,MAAM,QAAQ,GAAG,GAAG,kBAAkB,yBAAyB,CAAC;AAChE,MAAM,cAAc,GAAG,GAAG,kBAAkB,YAAY,CAAC;AACzD,MAAM,0BAA0B,GAAG,GAAG,kBAAkB,wBAAwB,CAAC;AAqDjF,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,IAAI,GAAG;WACnB,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,IAAa;IACtD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,IAAa;IACnD,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAoC;QAChD,GAAG,EAAE,mDAAmD;QACxD,GAAG,EAAE,uDAAuD;QAC5D,GAAG,EAAE,8DAA8D;QACnE,GAAG,EAAE,kEAAkE;QACvE,GAAG,EAAE,2DAA2D;QAChE,GAAG,EAAE,qEAAqE;QAC1E,GAAG,EAAE,sEAAsE;KAC5E,CAAC;IACF,OAAO,IAAI,kBAAkB,CAC3B,0BAA0B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,iBAAiB,EAAE,EAC9F,IAAI,EACJ,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mBAAmB;IAID,MAAM;IAHlB,SAAS,CAAe;IACxB,aAAa,CAAwB;IAEtD,YAA6B,MAAkB,EAAE,YAAY,GAAoC,EAAE;sBAAtE,MAAM;QACjC,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,iBAAiB,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,IAAY,EAAE,IAAI,GAAgB,EAAE;QACnE,iFAAiF;QACjF,yEAAyE;QACzE,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvE,OAAO,yBAAyB,CAC9B,IAAI,CAAC,MAAM,EACX,GAAG,EACH,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAC5B,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAC7D,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,MAAiB,EACjB,IAAI,GAAgB,EAAE,EACtB,gBAAgB,GAAa,CAAC,GAAG,CAAC;QAElC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,kBAAkB,CAC1B,mCAAmC,QAAQ,CAAC,MAAM,cAAc,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAChG,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,kBAAkB,CAC1B,kFAAkF,EAClF,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IAED,UAAU,CAAC,KAAmC;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,MAAM,uBAAuB,EAAE,0BAA0B,CAAC,CAAC;IAC9F,CAAC;IAED,SAAS,CAAC,MAAc,EAAE,KAA8B;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,MAAM,eAAe,EAAE,sBAAsB,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,EAAE,sBAAsB,CAAC,CAAC;IACnE,CAAC;IAED,sBAAsB,CAAC,KAAkC;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,WAAW,EAAE,4BAA4B,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB,CAAC,KAAa;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,SAAS,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAClF,CAAC;IAED,wBAAwB,CAAC,KAAoC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,4BAA4B,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,KAAa;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,0BAA0B,IAAI,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACzF,CAAC;CACF"}

package/dist/authorization/group-client.d.ts

@@ -1,169 +0,0 @@
-import { z } from "zod";
-import type { AuthConfig } from "../config.js";
-import { type KeycloakTokenProvider } from "../oauth.js";
-export declare const EnrollmentSchema: z.ZodObject<{
-    membershipStatus: z.ZodEnum<{
-        ACTIVE: "ACTIVE";
-        NOT_ENROLLED: "NOT_ENROLLED";
-        REVOKED: "REVOKED";
-        SUSPENDED: "SUSPENDED";
-    }>;
-    syncStatus: z.ZodEnum<{
-        APPLIED: "APPLIED";
-        DISABLED: "DISABLED";
-        FAILED: "FAILED";
-        PENDING: "PENDING";
-        UNKNOWN: "UNKNOWN";
-    }>;
-    tokenRefreshRequired: z.ZodBoolean;
-    policyRevision: z.ZodNumber;
-    blocked: z.ZodOptional<z.ZodBoolean>;
-    policyEnabled: z.ZodOptional<z.ZodBoolean>;
-    clientId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    groupId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    blockReason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    expectedClientRoles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
-}, z.core.$strip>;
-export type Enrollment = z.infer<typeof EnrollmentSchema>;
-/** @deprecated Historical suggestions only; never an enrollment or authorization allowlist. */
-export declare const BASELINE_ROLES: readonly ["mci-devops-platform-notion-user", "mci-devops-platform-ai-registry-reader", "mci-devops-platform-oss-user"];
-export declare const GroupPlanInputSchema: z.ZodObject<{
-    operation: z.ZodEnum<{
-        ADD_MEMBER: "ADD_MEMBER";
-        CREATE_GROUP: "CREATE_GROUP";
-        DEACTIVATE_GROUP: "DEACTIVATE_GROUP";
-        FILL_MISSING: "FILL_MISSING";
-        LINK_GROUP: "LINK_GROUP";
-        MIGRATE_POLICY: "MIGRATE_POLICY";
-        REMOVE_MEMBER: "REMOVE_MEMBER";
-        RESTORE_MEMBER: "RESTORE_MEMBER";
-        SET_GROUP_ROLES: "SET_GROUP_ROLES";
-        SET_MEMBER_STATE: "SET_MEMBER_STATE";
-        SET_POLICY: "SET_POLICY";
-    }>;
-    name: z.ZodOptional<z.ZodString>;
-    groupId: z.ZodOptional<z.ZodString>;
-    keycloakGroupId: z.ZodOptional<z.ZodString>;
-    subject: z.ZodOptional<z.ZodString>;
-    state: z.ZodOptional<z.ZodEnum<{
-        ACTIVE: "ACTIVE";
-        REVOKED: "REVOKED";
-        SUSPENDED: "SUSPENDED";
-    }>>;
-    enabled: z.ZodOptional<z.ZodBoolean>;
-    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-export type GroupPlanInput = z.infer<typeof GroupPlanInputSchema>;
-declare const GroupPlanSchema: z.ZodObject<{
-    planId: z.ZodString;
-    digest: z.ZodString;
-    status: z.ZodString;
-    operation: z.ZodString;
-    policyRevision: z.ZodNumber;
-    items: z.ZodArray<z.ZodObject<{
-        action: z.ZodString;
-        status: z.ZodString;
-    }, z.core.$loose>>;
-    summary: z.ZodUnknown;
-    input: z.ZodUnknown;
-    totalItems: z.ZodNumber;
-    businessImpact: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, z.core.$strip>;
-export type GroupPlan = z.infer<typeof GroupPlanSchema>;
-declare const GroupListSchema: z.ZodObject<{
-    groups: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-    policy: z.ZodObject<{
-        revision: z.ZodNumber;
-        enabled: z.ZodBoolean;
-        groupId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    }, z.core.$loose>;
-    baselineRoles: z.ZodArray<z.ZodString>;
-    readiness: z.ZodOptional<z.ZodObject<{
-        status: z.ZodString;
-        writesVerified: z.ZodBoolean;
-        message: z.ZodString;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-declare const MemberListSchema: z.ZodObject<{
-    members: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$strip>;
-export type GroupList = z.infer<typeof GroupListSchema>;
-export type MemberList = z.infer<typeof MemberListSchema>;
-declare const PlanItemListSchema: z.ZodObject<{
-    items: z.ZodArray<z.ZodObject<{
-        action: z.ZodString;
-        status: z.ZodString;
-    }, z.core.$loose>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$strip>;
-declare const DirectoryUsersSchema: z.ZodObject<{
-    users: z.ZodArray<z.ZodObject<{
-        subject: z.ZodString;
-        username: z.ZodString;
-        email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    }, z.core.$strip>>;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$loose>;
-declare const DirectoryGroupsSchema: z.ZodObject<{
-    groups: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$strip>;
-export type PlanItemList = z.infer<typeof PlanItemListSchema>;
-export type DirectoryUsers = z.infer<typeof DirectoryUsersSchema>;
-export type DirectoryGroups = z.infer<typeof DirectoryGroupsSchema>;
-export declare const ImpactKindSchema: z.ZodEnum<{
-    notionRoleGrants: "notionRoleGrants";
-    ossExistingGrants: "ossExistingGrants";
-    readerNamespaces: "readerNamespaces";
-}>;
-export type ImpactKind = z.infer<typeof ImpactKindSchema>;
-declare const ImpactListSchema: z.ZodObject<{
-    items: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    total: z.ZodNumber;
-    page: z.ZodNumber;
-    limit: z.ZodNumber;
-}, z.core.$strip>;
-export type ImpactList = z.infer<typeof ImpactListSchema>;
-export interface GroupApi {
-    enrollment(initialize?: boolean): Promise<Enrollment>;
-    list(page?: number, limit?: number): Promise<GroupList>;
-    members(query?: string, page?: number, limit?: number, groupId?: string): Promise<MemberList>;
-    users(query: string, page?: number, limit?: number): Promise<DirectoryUsers>;
-    directoryGroups(query?: string, page?: number, limit?: number): Promise<DirectoryGroups>;
-    plan(input: GroupPlanInput): Promise<GroupPlan>;
-    getPlan(id: string): Promise<GroupPlan>;
-    planItems(id: string, page?: number, limit?: number): Promise<PlanItemList>;
-    impact(id: string, kind: ImpactKind, page?: number, limit?: number): Promise<ImpactList>;
-    apply(id: string, expectedDigest: string, idempotencyKey: string): Promise<GroupPlan>;
-}
-export declare class GroupClient implements GroupApi {
-    private readonly config;
-    private readonly dependencies;
-    constructor(config: AuthConfig, dependencies?: {
-        fetch?: typeof fetch;
-        tokenProvider?: KeycloakTokenProvider;
-    });
-    enrollment(initialize?: boolean): Promise<Enrollment>;
-    list(page?: number, limit?: number): Promise<GroupList>;
-    members(query?: string, page?: number, limit?: number, groupId?: string): Promise<MemberList>;
-    users(query: string, page?: number, limit?: number): Promise<DirectoryUsers>;
-    directoryGroups(query?: string, page?: number, limit?: number): Promise<DirectoryGroups>;
-    plan(input: GroupPlanInput): Promise<GroupPlan>;
-    getPlan(id: string): Promise<GroupPlan>;
-    planItems(id: string, page?: number, limit?: number): Promise<PlanItemList>;
-    impact(id: string, kind: ImpactKind, page?: number, limit?: number): Promise<ImpactList>;
-    apply(id: string, expectedDigest: string, idempotencyKey: string): Promise<GroupPlan>;
-    private json;
-}
-export {};

package/dist/authorization/group-client.js

@@ -1,129 +0,0 @@
-import { z } from "zod";
-import { resolveBackendUrl } from "../backend.js";
-import { ensureAccessToken, fetchWithKeycloakIdentity } from "../oauth.js";
-import { AuthorizationError, authorizationHttpErrorCode } from "./errors.js";
-const ROOT = "/api/v1/admin/authorization/groups";
-export const EnrollmentSchema = z.object({
-    membershipStatus: z.enum(["NOT_ENROLLED", "ACTIVE", "SUSPENDED", "REVOKED"]),
-    syncStatus: z.enum(["DISABLED", "PENDING", "APPLIED", "FAILED", "UNKNOWN"]),
-    tokenRefreshRequired: z.boolean(), policyRevision: z.number().int().nonnegative(),
-    blocked: z.boolean().optional(), policyEnabled: z.boolean().optional(), clientId: z.string().nullable().optional(),
-    groupId: z.string().nullable().optional(), blockReason: z.string().nullable().optional(),
-    expectedClientRoles: z.record(z.string(), z.array(z.string())).optional()
-});
-/** @deprecated Historical suggestions only; never an enrollment or authorization allowlist. */
-export const BASELINE_ROLES = [
-    "mci-devops-platform-notion-user",
-    "mci-devops-platform-ai-registry-reader",
-    "mci-devops-platform-oss-user"
-];
-export const GroupPlanInputSchema = z.object({
-    operation: z.enum(["CREATE_GROUP", "LINK_GROUP", "SET_GROUP_ROLES", "SET_POLICY", "ADD_MEMBER", "REMOVE_MEMBER", "RESTORE_MEMBER", "DEACTIVATE_GROUP", "SET_MEMBER_STATE", "FILL_MISSING", "MIGRATE_POLICY"]),
-    name: z.string().trim().min(1).max(160).optional(),
-    groupId: z.string().uuid().optional(),
-    keycloakGroupId: z.string().uuid().optional(),
-    subject: z.string().min(1).max(200).optional(),
-    state: z.enum(["ACTIVE", "SUSPENDED", "REVOKED"]).optional(),
-    enabled: z.boolean().optional(),
-    roles: z.array(z.string().min(1).max(416).refine(value => {
-        const parts = value.split("/");
-        const client = parts.length === 1 ? "mci-devops-platform" : parts[0];
-        const role = parts.at(-1);
-        return parts.length <= 2 && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,159}$/u.test(client)
-            && !["realm-management", "account", "account-console", "security-admin-console", "admin-cli", "broker", "web-client", "mcp-client"].includes(client)
-            && !client.endsWith("-realm") && Boolean(role.trim()) && role.length <= 255 && !/[\u0000-\u001f\u007f]/u.test(role);
-    })).max(200).optional()
-}).strict();
-const GroupPlanSchema = z.object({
-    planId: z.string().uuid(),
-    digest: z.string().min(1), status: z.string().min(1), operation: z.string(),
-    policyRevision: z.number().int().nonnegative(),
-    items: z.array(z.object({ action: z.string(), status: z.string() }).passthrough()),
-    summary: z.unknown(), input: z.unknown(), totalItems: z.number().int().nonnegative(),
-    businessImpact: z.record(z.string(), z.unknown()).optional()
-});
-const GroupListSchema = z.object({
-    groups: z.array(z.record(z.string(), z.unknown())), total: z.number().int().nonnegative(),
-    page: z.number().int(), limit: z.number().int(),
-    policy: z.object({ revision: z.number().int(), enabled: z.boolean(), groupId: z.string().uuid().nullable().optional() }).passthrough(),
-    baselineRoles: z.array(z.string()),
-    readiness: z.object({ status: z.string(), writesVerified: z.boolean(), message: z.string() }).optional()
-});
-const MemberListSchema = z.object({
-    members: z.array(z.record(z.string(), z.unknown())), total: z.number().int().nonnegative(),
-    page: z.number().int(), limit: z.number().int()
-});
-const PlanItemListSchema = z.object({ items: z.array(z.object({ action: z.string(), status: z.string() }).passthrough()), total: z.number().int(), page: z.number().int(), limit: z.number().int() });
-const DirectoryUsersSchema = z.object({ users: z.array(z.object({ subject: z.string(), username: z.string(), email: z.string().nullable().optional() })), page: z.number().int(), limit: z.number().int() }).passthrough();
-const DirectoryGroupsSchema = z.object({ groups: z.array(z.record(z.string(), z.unknown())), total: z.number().int(), page: z.number().int(), limit: z.number().int() });
-export const ImpactKindSchema = z.enum(["notionRoleGrants", "readerNamespaces", "ossExistingGrants"]);
-const ImpactListSchema = z.object({ items: z.array(z.record(z.string(), z.unknown())), total: z.number().int(), page: z.number().int(), limit: z.number().int() });
-export class GroupClient {
-    config;
-    dependencies;
-    constructor(config, dependencies = {}) {
-        this.config = config;
-        this.dependencies = dependencies;
-    }
-    enrollment(initialize = false) {
-        if (this.config.authenticationMode === "client_credentials") {
-            throw new AuthorizationError("Application enrollment is for human user sessions, not machine identities.", "authorization_input_invalid");
-        }
-        return this.json("/api/v1/me/enrollment", EnrollmentSchema, initialize ? {} : undefined);
-    }
-    list(page = 1, limit = 20) {
-        return this.json(`${ROOT}?${new URLSearchParams({ page: String(page), limit: String(limit) })}`, GroupListSchema);
-    }
-    members(query = "", page = 1, limit = 20, groupId) {
-        return this.json(`${ROOT}/members?${new URLSearchParams({ query, page: String(page), limit: String(limit), ...(groupId ? { groupId } : {}) })}`, MemberListSchema);
-    }
-    users(query, page = 1, limit = 20) {
-        return this.json(`${ROOT}/directory/users?${new URLSearchParams({ query, page: String(page), limit: String(limit) })}`, DirectoryUsersSchema);
-    }
-    directoryGroups(query = "", page = 1, limit = 20) {
-        return this.json(`${ROOT}/directory/groups?${new URLSearchParams({ query, page: String(page), limit: String(limit) })}`, DirectoryGroupsSchema);
-    }
-    plan(input) {
-        const parsed = GroupPlanInputSchema.safeParse(input);
-        if (!parsed.success)
-            throw new AuthorizationError("Group plan input is invalid; use registered application Client Role references.", "authorization_input_invalid");
-        return this.json(`${ROOT}/plans`, GroupPlanSchema, parsed.data);
-    }
-    getPlan(id) {
-        return this.json(`${ROOT}/plans/${segment(id)}`, GroupPlanSchema);
-    }
-    planItems(id, page = 1, limit = 20) {
-        return this.json(`${ROOT}/plans/${segment(id)}/items?${new URLSearchParams({ page: String(page), limit: String(limit) })}`, PlanItemListSchema);
-    }
-    impact(id, kind, page = 1, limit = 20) {
-        if (!ImpactKindSchema.safeParse(kind).success)
-            throw new AuthorizationError("Unsupported business impact kind.", "authorization_input_invalid");
-        return this.json(`${ROOT}/plans/${segment(id)}/impact?${new URLSearchParams({ kind, page: String(page), limit: String(limit) })}`, ImpactListSchema);
-    }
-    apply(id, expectedDigest, idempotencyKey) {
-        return this.json(`${ROOT}/plans/${segment(id)}/apply`, GroupPlanSchema, { expectedDigest, idempotencyKey });
-    }
-    async json(path, schema, body) {
-        const method = body === undefined ? "GET" : "POST";
-        const response = await fetchWithKeycloakIdentity(this.config, resolveBackendUrl(this.config, { path, method }), () => ({
-            method, redirect: "error", signal: AbortSignal.timeout(20_000),
-            headers: { Accept: "application/json", ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
-            ...(body === undefined ? {} : { body: JSON.stringify(body) })
-        }), { fetch: this.dependencies.fetch ?? fetch, tokenProvider: this.dependencies.tokenProvider ?? ensureAccessToken, retryUnauthorized: method === "GET" });
-        if (!response.ok) {
-            // Never echo credential-bearing upstream errors or HTML. After write timeouts,
-            // operators must inspect the same plan instead of submitting a new operation.
-            throw new AuthorizationError(`Application group API returned HTTP ${response.status}. Inspect the same plan before retrying a write.`, authorizationHttpErrorCode(response.status), response.status);
-        }
-        const parsed = schema.safeParse(await response.json().catch(() => undefined));
-        if (!parsed.success)
-            throw new AuthorizationError("Application group API response does not match the CLI contract.", "authorization_invalid_response");
-        return parsed.data;
-    }
-}
-function segment(value) {
-    if (!/^[A-Za-z0-9_-]{1,200}$/u.test(value))
-        throw new AuthorizationError("Invalid group plan ID.", "authorization_input_invalid");
-    return encodeURIComponent(value);
-}
-//# sourceMappingURL=group-client.js.map

package/dist/authorization/group-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"group-client.js","sourceRoot":"","sources":["../../src/authorization/group-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAA8B,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAE7E,MAAM,IAAI,GAAG,oCAAoC,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5E,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3E,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxF,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,iCAAiC;IACjC,wCAAwC;IACxC,8BAA8B;CACtB,CAAC;AACX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC7M,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QACtE,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC;eACzE,CAAC,CAAC,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;eACjJ,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpF,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;IACtI,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzG,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CAChD,CAAC,CAAC;AAGH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACtM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3N,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAIzK,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEtG,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAenK,MAAM,OAAO,WAAW;IACO,MAAM;IAA+B,YAAY;IAA9E,YAA6B,MAAkB,EAAmB,YAAY,GAE1E,EAAE;sBAFuB,MAAM;4BAA+B,YAAY;IAErE,CAAC;IAEV,UAAU,CAAC,UAAU,GAAG,KAAK;QAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,KAAK,oBAAoB,EAAE,CAAC;YAC5D,MAAM,IAAI,kBAAkB,CAAC,4EAA4E,EAAE,6BAA6B,CAAC,CAAC;QAC5I,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,OAAgB;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,YAAY,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACrK,CAAC;IACD,KAAK,CAAC,KAAa,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAChJ,CAAC;IACD,eAAe,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,qBAAqB,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,CAAC,KAAqB;QACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,iFAAiF,EAAE,6BAA6B,CAAC,CAAC;QACpK,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACpE,CAAC;IACD,SAAS,CAAC,EAAU,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,EAAE,CAAC,UAAU,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,CAAC,EAAU,EAAE,IAAgB,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE;QACvD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,EAAE,6BAA6B,CAAC,CAAC;QAChJ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,EAAE,CAAC,WAAW,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACvJ,CAAC;IACD,KAAK,CAAC,EAAU,EAAE,cAAsB,EAAE,cAAsB;QAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9G,CAAC;IACO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAoB,EAAE,IAAc;QACtE,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACrH,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;YAC9G,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,aAAa,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;QAC3J,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,+EAA+E;YAC/E,8EAA8E;YAC9E,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,QAAQ,CAAC,MAAM,kDAAkD,EAAE,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvM,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,iEAAiE,EAAE,gCAAgC,CAAC,CAAC;QACvJ,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,CAAC;IAClI,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/authorization/group-commands.d.ts

@@ -1,25 +0,0 @@
-import type { Command } from "commander";
-import { type GroupApi, type GroupPlanInput } from "./group-client.js";
-interface Dependencies {
-    clientFactory?: () => GroupApi;
-}
-type PageOptions = {
-    page: string;
-    limit: string;
-};
-type ApplyOptions = {
-    expectedDigest: string;
-    idempotencyKey: string;
-    yes?: boolean;
-};
-export declare function registerGroupCommands(authorization: Command, dependencies?: Dependencies): void;
-export declare function parseGroupPlanInput(value: unknown): GroupPlanInput;
-export declare function parseGroupApplyInput(options: ApplyOptions): {
-    expectedDigest: string;
-    idempotencyKey: string;
-};
-export declare function parseGroupPagination(options: PageOptions): {
-    page: number;
-    limit: number;
-};
-export {};