canopycms 0.0.0

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":""}

package/dist/authorization/branch.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Branch-level authorization
+ *
+ * Handles checking if a user can access a branch based on ACLs.
+ */
+import type { BranchContext } from '../types';
+import type { DefaultBranchAccess } from '../config';
+import type { CanopyUser } from '../user';
+import type { BranchAccessResult } from './types';
+/**
+ * Check if user has access to a branch with explicit default behavior.
+ */
+export declare function checkBranchAccessWithDefault(context: BranchContext, user: CanopyUser, defaultAccess?: DefaultBranchAccess): BranchAccessResult;
+/**
+ * Create a branch access checker with bound default access.
+ */
+export declare function createCheckBranchAccess(defaultAccess?: DefaultBranchAccess): (context: BranchContext, user: CanopyUser) => BranchAccessResult;
+/**
+ * Check if user can perform workflow actions (submit/withdraw) on a branch.
+ * Allowed if: user is creator OR user has ACL access OR (system branch AND user has general access).
+ *
+ * This implements a hybrid permission model:
+ * - Branch creators can always submit/withdraw their branches
+ * - Users explicitly listed in branch ACLs can also submit/withdraw
+ * - For system branches (createdBy: 'canopycms-system'), anyone with general access can submit/withdraw
+ * - Admins and Reviewers always have access (via checkBranchAccess)
+ */
+export declare function canPerformWorkflowAction(context: BranchContext, user: CanopyUser, defaultAccess?: DefaultBranchAccess): boolean;
+//# sourceMappingURL=branch.d.ts.map

package/dist/authorization/branch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch.d.ts","sourceRoot":"","sources":["../../src/authorization/branch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAEjD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,UAAU,EAChB,aAAa,GAAE,mBAA4B,GAC1C,kBAAkB,CAyBpB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,GAAE,mBAA4B,IACzE,SAAS,aAAa,EAAE,MAAM,UAAU,KAAG,kBAAkB,CAEtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,UAAU,EAChB,aAAa,GAAE,mBAA4B,GAC1C,OAAO,CAyBT"}

package/dist/authorization/branch.js

@@ -0,0 +1,67 @@
+/**
+ * Branch-level authorization
+ *
+ * Handles checking if a user can access a branch based on ACLs.
+ */
+import { isAdmin, isReviewer } from './helpers';
+/**
+ * Check if user has access to a branch with explicit default behavior.
+ */
+export function checkBranchAccessWithDefault(context, user, defaultAccess = 'deny') {
+    // Admins and Reviewers have full branch access
+    if (isAdmin(user.groups) || isReviewer(user.groups)) {
+        return { allowed: true, reason: 'privileged' };
+    }
+    const access = context.branch.access;
+    const hasUserConstraint = !!access.allowedUsers?.length;
+    const hasGroupConstraint = !!access.allowedGroups?.length;
+    const managerOrAdminAllowed = access.managerOrAdminAllowed ?? false;
+    if (!hasUserConstraint && !hasGroupConstraint) {
+        if (managerOrAdminAllowed) {
+            return { allowed: false, reason: 'denied_by_acl' };
+        }
+        const allowed = defaultAccess === 'allow';
+        return { allowed, reason: 'no_acl' };
+    }
+    const userAllowed = hasUserConstraint && access.allowedUsers?.includes(user.userId);
+    const groupAllowed = hasGroupConstraint && user.groups?.some((g) => access.allowedGroups?.includes(g));
+    const allowed = Boolean(userAllowed || groupAllowed);
+    return { allowed, reason: allowed ? 'allowed_by_acl' : 'denied_by_acl' };
+}
+/**
+ * Create a branch access checker with bound default access.
+ */
+export function createCheckBranchAccess(defaultAccess = 'deny') {
+    return (context, user) => checkBranchAccessWithDefault(context, user, defaultAccess);
+}
+/**
+ * Check if user can perform workflow actions (submit/withdraw) on a branch.
+ * Allowed if: user is creator OR user has ACL access OR (system branch AND user has general access).
+ *
+ * This implements a hybrid permission model:
+ * - Branch creators can always submit/withdraw their branches
+ * - Users explicitly listed in branch ACLs can also submit/withdraw
+ * - For system branches (createdBy: 'canopycms-system'), anyone with general access can submit/withdraw
+ * - Admins and Reviewers always have access (via checkBranchAccess)
+ */
+export function canPerformWorkflowAction(context, user, defaultAccess = 'deny') {
+    // Check if user has general branch access (handles admins, reviewers, ACLs)
+    const accessResult = checkBranchAccessWithDefault(context, user, defaultAccess);
+    // If user doesn't have basic branch access, deny immediately
+    if (!accessResult.allowed) {
+        return false;
+    }
+    // Check if user is the branch creator
+    const userIsCreator = context.branch.createdBy === user.userId;
+    // Check if this is a system-created branch
+    const isSystemBranch = context.branch.createdBy === 'canopycms-system';
+    // Allow if:
+    // 1. User is the creator, OR
+    // 2. User has ACL access (reason: 'privileged' or 'allowed_by_acl'), OR
+    // 3. System branch with general access
+    return (userIsCreator ||
+        accessResult.reason === 'privileged' ||
+        accessResult.reason === 'allowed_by_acl' ||
+        (isSystemBranch && accessResult.allowed));
+}
+//# sourceMappingURL=branch.js.map

package/dist/authorization/branch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch.js","sourceRoot":"","sources":["../../src/authorization/branch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAI/C;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM;IAE3C,+CAA+C;IAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAA;IACpC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IACzD,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,KAAK,CAAA;IAEnE,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,KAAK,OAAO,CAAA;QACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACtC,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAEnF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;IACpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,EAAE,CAAA;AAC1E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,gBAAqC,MAAM;IACjF,OAAO,CAAC,OAAsB,EAAE,IAAgB,EAAsB,EAAE,CACtE,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM;IAE3C,4EAA4E;IAC5E,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;IAE/E,6DAA6D;IAC7D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAA;IAE9D,2CAA2C;IAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,kBAAkB,CAAA;IAEtE,YAAY;IACZ,6BAA6B;IAC7B,wEAAwE;IACxE,uCAAuC;IACvC,OAAO,CACL,aAAa;QACb,YAAY,CAAC,MAAM,KAAK,YAAY;QACpC,YAAY,CAAC,MAAM,KAAK,gBAAgB;QACxC,CAAC,cAAc,IAAI,YAAY,CAAC,OAAO,CAAC,CACzC,CAAA;AACH,CAAC"}

package/dist/authorization/content.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Content access authorization
+ *
+ * This is the main entry point for authorization checks. It combines
+ * branch-level and path-level access checks into a single API.
+ *
+ * Usage:
+ * ```ts
+ * import { checkContentAccess } from './authorization'
+ *
+ * const result = await checkContentAccess(deps, context, branchRoot, 'content/posts/my-post.mdx', user, 'edit')
+ * if (result.allowed) {
+ *   // User can edit the file
+ * }
+ * ```
+ */
+import type { BranchContext } from '../types';
+import type { PermissionLevel } from '../config';
+import type { CanopyUser } from '../user';
+import type { ContentAccessResult, ContentAccessDeps } from './types';
+import type { PhysicalPath } from '../paths/types';
+/**
+ * Check content access by evaluating both branch and path permissions.
+ * Path permissions are loaded dynamically from the branch root.
+ *
+ * @param deps - Dependencies including branch access checker and path permissions loader
+ * @param context - Branch context containing branch metadata
+ * @param branchRoot - Root directory of the branch
+ * @param relativePath - Physical path relative to branch root (with embedded IDs)
+ * @param user - User to check access for
+ * @param level - Permission level to check ('read', 'edit', or 'review')
+ */
+export declare function checkContentAccess(deps: ContentAccessDeps, context: BranchContext, branchRoot: string, relativePath: PhysicalPath, user: CanopyUser, level: PermissionLevel): Promise<ContentAccessResult>;
+/**
+ * Create a content access checker with bound dependencies.
+ */
+export declare function createCheckContentAccess(deps: ContentAccessDeps): (context: BranchContext, branchRoot: string, relativePath: PhysicalPath, user: CanopyUser, level: PermissionLevel) => Promise<ContentAccessResult>;
+//# sourceMappingURL=content.d.ts.map

package/dist/authorization/content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/authorization/content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAGzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,mBAAmB,CAAC,CAmC9B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,IAE5D,SAAS,aAAa,EACtB,YAAY,MAAM,EAClB,cAAc,YAAY,EAC1B,MAAM,UAAU,EAChB,OAAO,eAAe,KACrB,OAAO,CAAC,mBAAmB,CAAC,CAEhC"}

package/dist/authorization/content.js

@@ -0,0 +1,65 @@
+/**
+ * Content access authorization
+ *
+ * This is the main entry point for authorization checks. It combines
+ * branch-level and path-level access checks into a single API.
+ *
+ * Usage:
+ * ```ts
+ * import { checkContentAccess } from './authorization'
+ *
+ * const result = await checkContentAccess(deps, context, branchRoot, 'content/posts/my-post.mdx', user, 'edit')
+ * if (result.allowed) {
+ *   // User can edit the file
+ * }
+ * ```
+ */
+import { operatingStrategy } from '../operating-mode';
+import { createCheckPathAccess } from './path';
+/**
+ * Check content access by evaluating both branch and path permissions.
+ * Path permissions are loaded dynamically from the branch root.
+ *
+ * @param deps - Dependencies including branch access checker and path permissions loader
+ * @param context - Branch context containing branch metadata
+ * @param branchRoot - Root directory of the branch
+ * @param relativePath - Physical path relative to branch root (with embedded IDs)
+ * @param user - User to check access for
+ * @param level - Permission level to check ('read', 'edit', or 'review')
+ */
+export async function checkContentAccess(deps, context, branchRoot, relativePath, user, level) {
+    const branch = deps.checkBranchAccess(context, user);
+    // Load permissions from appropriate location based on operating mode
+    // Modes with separate settings branch: load from settings branch
+    // Other modes: load from the current branch
+    let permissionsRoot = branchRoot;
+    const mode = deps.mode;
+    const strategy = operatingStrategy(mode);
+    if (strategy.usesSeparateSettingsBranch()) {
+        if (!deps.getSettingsBranchRoot) {
+            throw new Error('getSettingsBranchRoot is required for modes that use separate settings branch');
+        }
+        // getSettingsBranchRoot must throw if it cannot load the settings branch
+        // This ensures we never fall back to reading permissions from the current branch
+        permissionsRoot = await deps.getSettingsBranchRoot();
+    }
+    const rules = await deps.loadPathPermissions(permissionsRoot, deps.mode);
+    const pathChecker = createCheckPathAccess(rules, deps.defaultPathAccess);
+    const path = pathChecker({
+        relativePath,
+        user,
+        level,
+    });
+    return {
+        allowed: branch.allowed && path.allowed,
+        branch,
+        path,
+    };
+}
+/**
+ * Create a content access checker with bound dependencies.
+ */
+export function createCheckContentAccess(deps) {
+    return (context, branchRoot, relativePath, user, level) => checkContentAccess(deps, context, branchRoot, relativePath, user, level);
+}
+//# sourceMappingURL=content.js.map

package/dist/authorization/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/authorization/content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAI9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,OAAsB,EACtB,UAAkB,EAClB,YAA0B,EAC1B,IAAgB,EAChB,KAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAEpD,qEAAqE;IACrE,iEAAiE;IACjE,4CAA4C;IAC5C,IAAI,eAAe,GAAG,UAAU,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACtB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAExC,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,iFAAiF;QACjF,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAA;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACxE,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAExE,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,YAAY;QACZ,IAAI;QACJ,KAAK;KACN,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;QACvC,MAAM;QACN,IAAI;KACL,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,OAAO,CACL,OAAsB,EACtB,UAAkB,EAClB,YAA0B,EAC1B,IAAgB,EAChB,KAAsB,EACQ,EAAE,CAChC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/authorization/groups/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Groups module exports
+ */
+export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, } from './schema';
+export { loadGroupsFile, loadInternalGroups, saveInternalGroups } from './loader';
+//# sourceMappingURL=index.d.ts.map

package/dist/authorization/groups/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/groups/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA"}

package/dist/authorization/groups/index.js

@@ -0,0 +1,6 @@
+/**
+ * Groups module exports
+ */
+export { GroupsFileSchema, createDefaultGroupsFile, } from './schema';
+export { loadGroupsFile, loadInternalGroups, saveInternalGroups } from './loader';
+//# sourceMappingURL=index.js.map

package/dist/authorization/groups/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/groups/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA"}

package/dist/authorization/groups/loader.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Groups file loader
+ *
+ * Handles loading and saving internal groups from the filesystem.
+ */
+import type { CanopyUserId } from '../../types';
+import { type InternalGroup, type GroupsFile } from './schema';
+import type { OperatingMode } from '../../operating-mode';
+/**
+ * Load full groups file (for version checking)
+ * Returns null if file doesn't exist.
+ */
+export declare function loadGroupsFile(branchRoot: string, mode: OperatingMode): Promise<GroupsFile | null>;
+/**
+ * Load internal groups from .canopycms/groups.json (or .local.json in dev mode)
+ * Ensures Admins and Reviewers groups always exist, adding them dynamically if not present.
+ * If Admins group exists in file, merges with bootstrap admin IDs.
+ */
+export declare function loadInternalGroups(branchRoot: string, mode: OperatingMode, bootstrapAdminIds?: Set<string>): Promise<InternalGroup[]>;
+/**
+ * Save internal groups to .canopycms/groups.json (or .local.json in dev mode)
+ */
+export declare function saveInternalGroups(branchRoot: string, groups: InternalGroup[], updatedBy: CanopyUserId, mode: OperatingMode, contentVersion?: number): Promise<void>;
+//# sourceMappingURL=loader.d.ts.map

package/dist/authorization/groups/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/authorization/groups/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAoB,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAWzD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAe5B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,EACnB,iBAAiB,GAAE,GAAG,CAAC,MAAM,CAAa,GACzC,OAAO,CAAC,aAAa,EAAE,CAAC,CA0C1B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,aAAa,EAAE,EACvB,SAAS,EAAE,YAAY,EACvB,IAAI,EAAE,aAAa,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/authorization/groups/loader.js

@@ -0,0 +1,98 @@
+/**
+ * Groups file loader
+ *
+ * Handles loading and saving internal groups from the filesystem.
+ */
+import { promises as fs } from 'node:fs';
+import { join } from 'node:path';
+import { GroupsFileSchema } from './schema';
+import { operatingStrategy } from '../../operating-mode';
+import { RESERVED_GROUPS } from '../helpers';
+/**
+ * Get the appropriate groups file path based on mode
+ */
+function getGroupsFilePath(branchRoot, mode) {
+    return operatingStrategy(mode).getGroupsFilePath(branchRoot);
+}
+/**
+ * Load full groups file (for version checking)
+ * Returns null if file doesn't exist.
+ */
+export async function loadGroupsFile(branchRoot, mode) {
+    const groupsPath = getGroupsFilePath(branchRoot, mode);
+    try {
+        const content = await fs.readFile(groupsPath, 'utf-8');
+        const parsed = JSON.parse(content);
+        const validated = GroupsFileSchema.parse(parsed);
+        return validated;
+    }
+    catch (error) {
+        // File doesn't exist
+        if (error.code === 'ENOENT') {
+            return null;
+        }
+        throw error;
+    }
+}
+/**
+ * Load internal groups from .canopycms/groups.json (or .local.json in dev mode)
+ * Ensures Admins and Reviewers groups always exist, adding them dynamically if not present.
+ * If Admins group exists in file, merges with bootstrap admin IDs.
+ */
+export async function loadInternalGroups(branchRoot, mode, bootstrapAdminIds = new Set()) {
+    const file = await loadGroupsFile(branchRoot, mode);
+    const fileGroups = file?.groups ?? [];
+    // Find existing Admins and Reviewers groups
+    let adminsGroup = fileGroups.find((g) => g.id === RESERVED_GROUPS.ADMINS);
+    let reviewersGroup = fileGroups.find((g) => g.id === RESERVED_GROUPS.REVIEWERS);
+    // Ensure Admins group exists and includes bootstrap admins
+    if (adminsGroup) {
+        // Merge bootstrap admin IDs with existing members
+        const allAdmins = new Set([...adminsGroup.members, ...bootstrapAdminIds]);
+        adminsGroup = {
+            ...adminsGroup,
+            members: Array.from(allAdmins),
+        };
+    }
+    else {
+        // Create Admins group with bootstrap admins
+        adminsGroup = {
+            id: RESERVED_GROUPS.ADMINS,
+            name: RESERVED_GROUPS.ADMINS,
+            description: 'Full access to all CMS operations',
+            members: Array.from(bootstrapAdminIds),
+        };
+    }
+    // Ensure Reviewers group exists
+    if (!reviewersGroup) {
+        reviewersGroup = {
+            id: RESERVED_GROUPS.REVIEWERS,
+            name: RESERVED_GROUPS.REVIEWERS,
+            description: 'Can review branches, request changes, approve PRs',
+            members: [],
+        };
+    }
+    // Return all groups: reserved groups first, then other groups
+    const otherGroups = fileGroups.filter((g) => g.id !== RESERVED_GROUPS.ADMINS && g.id !== RESERVED_GROUPS.REVIEWERS);
+    return [adminsGroup, reviewersGroup, ...otherGroups];
+}
+/**
+ * Save internal groups to .canopycms/groups.json (or .local.json in dev mode)
+ */
+export async function saveInternalGroups(branchRoot, groups, updatedBy, mode, contentVersion) {
+    const groupsPath = getGroupsFilePath(branchRoot, mode);
+    const groupsDir = join(groupsPath, '..');
+    // Ensure parent directory exists (e.g., .canopy-meta or .canopycms)
+    await fs.mkdir(groupsDir, { recursive: true });
+    const groupsFile = {
+        version: 1,
+        contentVersion: contentVersion ?? 1,
+        updatedAt: new Date().toISOString(),
+        updatedBy,
+        groups,
+    };
+    // Validate before writing
+    GroupsFileSchema.parse(groupsFile);
+    await fs.writeFile(groupsPath, JSON.stringify(groupsFile, null, 2), 'utf-8');
+}
+//# sourceMappingURL=loader.js.map

package/dist/authorization/groups/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/authorization/groups/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,gBAAgB,EAAuC,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C;;GAEG;AACH,SAAS,iBAAiB,CAAC,UAAkB,EAAE,IAAmB;IAChE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,IAAmB;IAEnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB;QACrB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,IAAmB,EACnB,oBAAiC,IAAI,GAAG,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,IAAI,EAAE,MAAM,IAAI,EAAE,CAAA;IAErC,4CAA4C;IAC5C,IAAI,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,CAAC,CAAA;IACzE,IAAI,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,SAAS,CAAC,CAAA;IAE/E,2DAA2D;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAA;QACzE,WAAW,GAAG;YACZ,GAAG,WAAW;YACd,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;SAC/B,CAAA;IACH,CAAC;SAAM,CAAC;QACN,4CAA4C;QAC5C,WAAW,GAAG;YACZ,EAAE,EAAE,eAAe,CAAC,MAAM;YAC1B,IAAI,EAAE,eAAe,CAAC,MAAM;YAC5B,WAAW,EAAE,mCAAmC;YAChD,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;SACvC,CAAA;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG;YACf,EAAE,EAAE,eAAe,CAAC,SAAS;YAC7B,IAAI,EAAE,eAAe,CAAC,SAAS;YAC/B,WAAW,EAAE,mDAAmD;YAChE,OAAO,EAAE,EAAE;SACZ,CAAA;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,SAAS,CAC7E,CAAA;IAED,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,MAAuB,EACvB,SAAuB,EACvB,IAAmB,EACnB,cAAuB;IAEvB,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAExC,oEAAoE;IACpE,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE9C,MAAM,UAAU,GAAe;QAC7B,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,cAAc,IAAI,CAAC;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,MAAM;KACP,CAAA;IAED,0BAA0B;IAC1B,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAElC,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;AAC9E,CAAC"}

package/dist/authorization/groups/schema.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Schema for groups.json file
+ */
+import { z } from 'zod';
+import type { CanopyUserId, CanopyGroupId } from '../../types';
+/**
+ * Schema for .canopycms/groups.json
+ */
+export declare const GroupsFileSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    contentVersion: z.ZodOptional<z.ZodNumber>;
+    updatedAt: z.ZodString;
+    updatedBy: z.ZodType<CanopyUserId>;
+    groups: z.ZodArray<z.ZodObject<{
+        id: z.ZodType<CanopyGroupId>;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        members: z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        members: string[];
+        id: string;
+        description?: string | undefined;
+    }, {
+        name: string;
+        members: string[];
+        id: string;
+        description?: string | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    updatedAt: string;
+    version: 1;
+    groups: {
+        name: string;
+        members: string[];
+        id: string;
+        description?: string | undefined;
+    }[];
+    updatedBy: string;
+    contentVersion?: number | undefined;
+}, {
+    updatedAt: string;
+    version: 1;
+    groups: {
+        name: string;
+        members: string[];
+        id: string;
+        description?: string | undefined;
+    }[];
+    updatedBy: string;
+    contentVersion?: number | undefined;
+}>;
+export type GroupsFile = z.infer<typeof GroupsFileSchema>;
+/**
+ * Internal group representation
+ */
+export interface InternalGroup {
+    id: CanopyGroupId;
+    name: string;
+    description?: string;
+    members: CanopyUserId[];
+}
+/**
+ * Default groups file
+ */
+export declare function createDefaultGroupsFile(userId: CanopyUserId): GroupsFile;
+//# sourceMappingURL=schema.d.ts.map

package/dist/authorization/groups/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/authorization/groups/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE9D;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;eAIF,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;;YAG1B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM9C,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,aAAa,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAOxE"}

package/dist/authorization/groups/schema.js

@@ -0,0 +1,31 @@
+/**
+ * Schema for groups.json file
+ */
+import { z } from 'zod';
+/**
+ * Schema for .canopycms/groups.json
+ */
+export const GroupsFileSchema = z.object({
+    version: z.literal(1),
+    contentVersion: z.number().optional(), // For optimistic locking
+    updatedAt: z.string().datetime(),
+    updatedBy: z.string(),
+    groups: z.array(z.object({
+        id: z.string(),
+        name: z.string().min(1),
+        description: z.string().optional(),
+        members: z.array(z.string()),
+    })),
+});
+/**
+ * Default groups file
+ */
+export function createDefaultGroupsFile(userId) {
+    return {
+        version: 1,
+        updatedAt: new Date().toISOString(),
+        updatedBy: userId,
+        groups: [],
+    };
+}
+//# sourceMappingURL=schema.js.map

package/dist/authorization/groups/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/authorization/groups/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAA6B;IAChD,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAA8B;QAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA6B,CAAC;KACxD,CAAC,CACH;CACF,CAAC,CAAA;AAcF;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC"}

package/dist/authorization/helpers.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Authorization helper functions
+ *
+ * Simple utilities for checking user roles and permissions.
+ */
+/**
+ * Reserved groups for CanopyCMS permission system.
+ *
+ * These groups have special meaning and cannot be deleted or renamed.
+ * - Admins: Full access to all CMS operations
+ * - Reviewers: Can review branches, request changes, approve PRs
+ */
+export declare const RESERVED_GROUPS: {
+    readonly ADMINS: "Admins";
+    readonly REVIEWERS: "Reviewers";
+};
+export type ReservedGroupId = (typeof RESERVED_GROUPS)[keyof typeof RESERVED_GROUPS];
+/**
+ * Check if a group ID is a reserved group
+ */
+export declare function isReservedGroup(groupId: string): groupId is ReservedGroupId;
+/**
+ * Check if user is in the Admins group
+ */
+export declare function isAdmin(groups: readonly string[] | undefined): boolean;
+/**
+ * Check if user is in the Reviewers group (or is an Admin, since Admins can do everything)
+ */
+export declare function isReviewer(groups: readonly string[] | undefined): boolean;
+/**
+ * Check if user has privileged access (Admin or Reviewer)
+ * Used for operations that require elevated permissions but not full admin
+ */
+export declare function isPrivileged(groups: readonly string[] | undefined): boolean;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/authorization/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/authorization/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;;;CAGlB,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA;AAEpF;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,IAAI,eAAe,CAE3E;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAEtE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAEzE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAE3E"}

package/dist/authorization/helpers.js

@@ -0,0 +1,42 @@
+/**
+ * Authorization helper functions
+ *
+ * Simple utilities for checking user roles and permissions.
+ */
+/**
+ * Reserved groups for CanopyCMS permission system.
+ *
+ * These groups have special meaning and cannot be deleted or renamed.
+ * - Admins: Full access to all CMS operations
+ * - Reviewers: Can review branches, request changes, approve PRs
+ */
+export const RESERVED_GROUPS = {
+    ADMINS: 'Admins',
+    REVIEWERS: 'Reviewers',
+};
+/**
+ * Check if a group ID is a reserved group
+ */
+export function isReservedGroup(groupId) {
+    return Object.values(RESERVED_GROUPS).includes(groupId);
+}
+/**
+ * Check if user is in the Admins group
+ */
+export function isAdmin(groups) {
+    return groups?.includes(RESERVED_GROUPS.ADMINS) ?? false;
+}
+/**
+ * Check if user is in the Reviewers group (or is an Admin, since Admins can do everything)
+ */
+export function isReviewer(groups) {
+    return isAdmin(groups) || (groups?.includes(RESERVED_GROUPS.REVIEWERS) ?? false);
+}
+/**
+ * Check if user has privileged access (Admin or Reviewer)
+ * Used for operations that require elevated permissions but not full admin
+ */
+export function isPrivileged(groups) {
+    return isReviewer(groups);
+}
+//# sourceMappingURL=helpers.js.map

package/dist/authorization/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../src/authorization/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;CACd,CAAA;AAIV;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,OAA0B,CAAC,CAAA;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,MAAqC;IAC3D,OAAO,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,MAAqC;IAC9D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAA;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAqC;IAChE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;AAC3B,CAAC"}

package/dist/authorization/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Authorization module for CanopyCMS
+ *
+ * This module provides a unified API for checking user access to branches and content.
+ *
+ * ## Quick Start
+ *
+ * For most use cases, use `checkContentAccess` which handles both branch and path permissions:
+ *
+ * ```ts
+ * import { checkContentAccess } from './authorization'
+ *
+ * const result = await checkContentAccess(deps, context, branchRoot, 'content/posts/post.mdx', user, 'edit')
+ * if (result.allowed) {
+ *   // User can edit the file
+ * }
+ * ```
+ *
+ * ## Module Structure
+ *
+ * - `content.ts` - Combined branch + path access (main entry point)
+ * - `branch.ts` - Branch-level access control
+ * - `path.ts` - Path-level permissions
+ * - `helpers.ts` - Utility functions (isAdmin, isReviewer, etc.)
+ * - `permissions/` - Permissions file schema and loader
+ * - `groups/` - Groups file schema and loader
+ */
+export type { BranchAccessResult, PathPermissionResult, ContentAccessResult, ContentAccessDeps, PermissionPath, } from './types';
+export { parsePermissionPath } from './validation';
+export { checkContentAccess, createCheckContentAccess } from './content';
+export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch';
+export { checkPathAccess, createCheckPathAccess } from './path';
+export { RESERVED_GROUPS, type ReservedGroupId, isReservedGroup, isAdmin, isReviewer, isPrivileged, } from './helpers';
+export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile, loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './permissions';
+export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, loadGroupsFile, loadInternalGroups, saveInternalGroups, } from './groups';
+//# sourceMappingURL=index.d.ts.map

package/dist/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAGxE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAG/D,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,eAAe,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}