@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/dist/modules/access-model/access-splice.js

@@ -26,6 +26,8 @@
  * normalises it to the block-list form.
  */
 import { parseAccessEntry, canonicalEmail, canonicalRoleName, accessMdDeclaresBodyRules, } from './access-grammar.js';
+import { freshAccessMd } from './access-template.js';
+import { scanFrontmatter } from './frontmatter-lines.js';
 /** Thrown when the input can't be spliced safely (malformed frontmatter, etc.). */
 export class AccessSpliceError extends Error {
     constructor(message) {
@@ -127,24 +129,14 @@ function entryMatches(entry, p, tokenMatch) {
  * grant into a fresh file synthesise one.
  */
 function splitFrontmatter(text) {
-    const eol = text.includes('\r\n') ? '\r\n' : '\n';
-    const lines = text.split(/\r?\n/);
-    // Opening fence must be the very first line.
-    if (lines[0]?.trim() !== '---') {
-        return { pre: [], fm: [], post: lines, eol, hasFrontmatter: false };
+    const scan = scanFrontmatter(text);
+    if (scan.kind === 'unterminated') {
+        throw new AccessSpliceError('unterminated frontmatter — no closing `---`');
     }
-    for (let i = 1; i < lines.length; i++) {
-        if (lines[i].trim() === '---') {
-            return {
-                pre: lines.slice(0, 1), // the opening ---
-                fm: lines.slice(1, i),
-                post: lines.slice(i), // closing --- onward (body preserved)
-                eol,
-                hasFrontmatter: true,
-            };
-        }
+    if (scan.kind === 'none') {
+        return { pre: [], fm: [], post: scan.lines, eol: scan.eol, hasFrontmatter: false };
     }
-    throw new AccessSpliceError('unterminated frontmatter — no closing `---`');
+    return { pre: scan.open, fm: scan.fm, post: scan.post, eol: scan.eol, hasFrontmatter: true };
 }
 function joinFrontmatter(f) {
     return [...f.pre, ...f.fm, ...f.post].join(f.eol);
@@ -292,8 +284,16 @@ export function spliceGrant(text, verb, rawPrincipal, opts = {}) {
     const deny = opts.deny ?? false;
     const f = splitFrontmatter(text);
     if (!f.hasFrontmatter) {
-        // Fresh file — synthesise a minimal frontmatter block, keep any body lines
-        // the caller passed (usually none for a new access.md).
+        // A fresh FOLDER access.md gets the platform's two-block shape, the grant
+        // in the body and the explanation of both blocks in place — the same
+        // file a person would find beside a plugin, so every generated
+        // access.md teaches the same rules. (Only for an EMPTY file: text
+        // without a frontmatter is the legacy single-block format, kept as it is.)
+        if (opts.target === 'folder' && text.trim() === '') {
+            return { text: freshAccessMd(`${verb}:${f.eol}  - ${renderEntry(principal, deny)}`, f.eol), changed: true };
+        }
+        // Fresh node frontmatter — synthesise a minimal block, keep any body
+        // lines the caller passed.
         const itemLine = opts.allowScalar
             ? `${verb}: ${renderEntry(principal, deny)}`
             : `${verb}:${f.eol}  - ${renderEntry(principal, deny)}`;

package/dist/modules/access-model/access-splice.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-splice.js","sourceRoot":"","sources":["../../../src/modules/access-model/access-splice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAGL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AA0B7B,mFAAmF;AACnF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mFAAmF;AACnF,wFAAwF;AACxF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,IAAI,GAAG,KAAK;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAY;IAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,CAAC,CAAC;QACnF,4EAA4E;QAC5E,mFAAmF;QACnF,IACE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6EAA6E;QAC7E,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,WAAW,KAAK,KAAK,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;IACvE,IACE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,sDAAsD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAiBD;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAkB,EAAE,CAAY,EAAE,UAAsB;IAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CACtC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAiBD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,6CAA6C;IAC7C,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB;gBAC1C,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sCAAsC;gBAC5D,GAAG;gBACH,cAAc,EAAE,IAAI;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,IAAY,EACZ,CAA4C,EAC5C,MAAoB;IAEpB,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,qCAAqC;AACrC,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAiBD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAY,EAAE,IAAU;IAC7C,MAAM,KAAK,GAAc;QACvB,OAAO,EAAE,CAAC,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,mDAAmD;QACnD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;YACvC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,KAAK,CAAC,SAAS,EACxB,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;gBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC;YACvD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,gDAAgD;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACzB,wEAAwE;YACxE,IAAI,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,MAAM;YACrC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;YACzB,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;iBACxC,IAAI,KAAK,KAAK,EAAE;gBAAE,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,EAAY,EAAE,KAAgB;IAClD,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,IAAU,EACV,YAAuB,EACvB,OAAyE,EAAE;IAE3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACtB,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW;YAC/B,CAAC,CAAC,GAAG,IAAI,KAAK,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE;YAC5C,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,OAAO,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEnD,wEAAwE;IACxE,4EAA4E;IAC5E,kCAAkC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,iEAAiE;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,yEAAyE;QACzE,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,MAAM,KAAK,SAAS,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,oCAAoC;QACpC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,IAAU,EACV,YAAuB,EACvB,OAA2D,EAAE;IAE7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,CAAC,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YACzD,uDAAuD;YACvD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"access-splice.js","sourceRoot":"","sources":["../../../src/modules/access-model/access-splice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAGL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AA0BzD,mFAAmF;AACnF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mFAAmF;AACnF,wFAAwF;AACxF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,IAAI,GAAG,KAAK;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAY;IAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,CAAC,CAAC;QACnF,4EAA4E;QAC5E,mFAAmF;QACnF,IACE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6EAA6E;QAC7E,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,WAAW,KAAK,KAAK,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;IACvE,IACE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,sDAAsD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAiBD;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAkB,EAAE,CAAY,EAAE,UAAsB;IAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/F,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CACtC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAiBD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,IAAY,EACZ,CAA4C,EAC5C,MAAoB;IAEpB,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,qCAAqC;AACrC,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAiBD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAY,EAAE,IAAU;IAC7C,MAAM,KAAK,GAAc;QACvB,OAAO,EAAE,CAAC,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,mDAAmD;QACnD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;YACvC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,KAAK,CAAC,SAAS,EACxB,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;gBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC;YACvD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,gDAAgD;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACzB,wEAAwE;YACxE,IAAI,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,MAAM;YACrC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;YACzB,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;iBACxC,IAAI,KAAK,KAAK,EAAE;gBAAE,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,EAAY,EAAE,KAAgB;IAClD,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,IAAU,EACV,YAAuB,EACvB,OAAyE,EAAE;IAE3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACtB,0EAA0E;QAC1E,qEAAqE;QACrE,+DAA+D;QAC/D,kEAAkE;QAClE,2EAA2E;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACnD,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,OAAO,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9G,CAAC;QACD,qEAAqE;QACrE,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW;YAC/B,CAAC,CAAC,GAAG,IAAI,KAAK,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE;YAC5C,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,OAAO,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEnD,wEAAwE;IACxE,4EAA4E;IAC5E,kCAAkC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,iEAAiE;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,yEAAyE;QACzE,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,MAAM,KAAK,SAAS,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,oCAAoC;QACpC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,IAAU,EACV,YAAuB,EACvB,OAA2D,EAAE;IAE7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,CAAC,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YACzD,uDAAuD;YACvD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC"}

package/dist/modules/access-model/access-template.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The shape of an `access.md` the platform writes on its own — THE one
+ * explanation of how the file works, carried inside every file it generates
+ * so a person (or an agent) reading it in place learns the rules from the
+ * file itself, rather than from a document they have not opened.
+ *
+ * Two blocks, two scopes: the frontmatter governs the FILE, the body governs
+ * the FOLDER. The wording here is what a fresh folder `access.md` carries
+ * (`spliceGrant` on an empty file with `target: 'folder'`); the plugin and
+ * personal-space templates in the provisioning service say the same thing in
+ * their own words, tailored to what those folders are.
+ */
+/** The frontmatter block of a fresh access.md — comments only, no verbs. */
+export declare const ACCESS_MD_FRONTMATTER_NOTE: readonly string[];
+/** The comment block that opens a fresh access.md body, before its verbs. */
+export declare const ACCESS_MD_BODY_NOTE: readonly string[];
+/**
+ * A fresh access.md around `bodyYaml` (the folder's verbs, already rendered)
+ * — the two blocks, each opened by its note.
+ */
+export declare function freshAccessMd(bodyYaml: string, eol?: string): string;
+//# sourceMappingURL=access-template.d.ts.map

package/dist/modules/access-model/access-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-template.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/access-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAGvD,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAShD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAO,GAAG,MAAM,CAQlE"}

package/dist/modules/access-model/access-template.js

@@ -0,0 +1,42 @@
+/**
+ * The shape of an `access.md` the platform writes on its own — THE one
+ * explanation of how the file works, carried inside every file it generates
+ * so a person (or an agent) reading it in place learns the rules from the
+ * file itself, rather than from a document they have not opened.
+ *
+ * Two blocks, two scopes: the frontmatter governs the FILE, the body governs
+ * the FOLDER. The wording here is what a fresh folder `access.md` carries
+ * (`spliceGrant` on an empty file with `target: 'folder'`); the plugin and
+ * personal-space templates in the provisioning service say the same thing in
+ * their own words, tailored to what those folders are.
+ */
+/** The frontmatter block of a fresh access.md — comments only, no verbs. */
+export const ACCESS_MD_FRONTMATTER_NOTE = [
+    '# THIS BLOCK (the frontmatter) governs this access.md FILE only: who may see',
+    '# and change these rules. Left empty, the file follows the folder rules below.',
+];
+/** The comment block that opens a fresh access.md body, before its verbs. */
+export const ACCESS_MD_BODY_NOTE = [
+    '# THIS BLOCK (the body) governs the FOLDER this file sits in, and everything',
+    '# beneath it until a nearer access.md says otherwise. Verbs: read, write,',
+    '# download, owner (owner implies the rest; write and download each imply read).',
+    '# An entry is a role from roles.yaml, a group from groups.yaml, a person as',
+    '# `Name <email>`, or `everyone` — every signed-in person, the whole organisation.',
+    '# `deny X` takes away that verb ALONE: grants imply the lower verbs, denials',
+    '# never do — `deny download` says nothing about read, and leaves a separate',
+    '# read grant standing. Keep this block pure YAML; explanations go in `#` lines.',
+];
+/**
+ * A fresh access.md around `bodyYaml` (the folder's verbs, already rendered)
+ * — the two blocks, each opened by its note.
+ */
+export function freshAccessMd(bodyYaml, eol = '\n') {
+    return [
+        '---',
+        ...ACCESS_MD_FRONTMATTER_NOTE,
+        '---',
+        ...ACCESS_MD_BODY_NOTE,
+        bodyYaml,
+    ].join(eol) + eol;
+}
+//# sourceMappingURL=access-template.js.map

package/dist/modules/access-model/access-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-template.js","sourceRoot":"","sources":["../../../src/modules/access-model/access-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,8EAA8E;IAC9E,gFAAgF;CACjF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,8EAA8E;IAC9E,2EAA2E;IAC3E,iFAAiF;IACjF,6EAA6E;IAC7E,mFAAmF;IACnF,8EAA8E;IAC9E,6EAA6E;IAC7E,iFAAiF;CAClF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,GAAG,GAAG,IAAI;IACxD,OAAO;QACL,KAAK;QACL,GAAG,0BAA0B;QAC7B,KAAK;QACL,GAAG,mBAAmB;QACtB,QAAQ;KACT,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACpB,CAAC"}

package/dist/modules/access-model/change-gate.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The contract of the READ-BEFORE-WRITE gate: nothing is created, changed or
+ * removed at a place its author cannot read. The service that answers
+ * (filesystem stats, access checks) is `modules/access/change-read-gate.ts`;
+ * this file carries only the types, so the workflow, kb-fs and tool modules
+ * depend on the contract and never on the access module.
+ *
+ * Why `read`, when every write already needs `write`: on a draft branch no
+ * write grant is needed at all — anyone may propose anything, and the change
+ * request is where the real boundary lives. Without this gate a proposal
+ * could land in a folder its author cannot see, where it would vanish from
+ * them the moment it was added. And a write grant only IMPLIES read; a
+ * nearer `deny read` can take the read away while the write stands. The gate
+ * makes the one rule hold everywhere: you can only change what you can see.
+ *
+ * The one exception is a NEW FOLDER directly under one of the three roots
+ * (knowledge, skills, plugins — `creatableRootDirNames`). Those roots grant
+ * read to nobody by default, and a person's own space or a new plugin or
+ * skill has to start somewhere. The new folder carries its creator's own
+ * grant in its `access.md` (see `ICreatorAccess`), so what they create there
+ * is visible to them from the first byte. A loose FILE directly at a root
+ * cannot carry such a grant, so it is not excepted.
+ */
+/**
+ * Where a change is asked about. `'file'` is what every lock acquire is (the
+ * path being written, moved, or deleted — a `.gitkeep` included); `'dir'` is
+ * for a caller asking about a folder itself before it fills it, such as the
+ * destination of an archive extraction.
+ */
+export type ChangeTargetKind = 'file' | 'dir';
+export type ChangeReadVerdict = {
+    allowed: true;
+    via: 
+    /** The caller reads the path (or, for a new path, where it lands). */
+    'readable'
+    /** A new folder directly under one of the three roots — the exception. */
+     | 'new-top-level-folder'
+    /** Outside the knowledge-base repository: no read rules apply. */
+     | 'outside-kb'
+    /** A machine-owned file whose writer the write rule already names. */
+     | 'machine-owned'
+    /** An admin on a file directly in the repository root — the rescue path. */
+     | 'admin-rescue'
+    /**
+     * No `roles.yaml` on this tree at all — a repository before its first
+     * one: nothing to decide against. A `roles.yaml` that is THERE but
+     * unusable is not this: a broken rule set is an error, never an open
+     * door.
+     */
+     | 'no-rules';
+} | {
+    allowed: false;
+    /**
+     * The repo-relative path the caller cannot read: the target itself when
+     * it exists, otherwise the folder it would land in (`''` = the root).
+     */
+    unreadable: string;
+};
+export interface IChangeReadGate {
+    /** The verdict for `wsPath` (workspace-relative), with why it holds. */
+    judge(workspaceId: string, userEmail: string, wsPath: string, kind: ChangeTargetKind): Promise<ChangeReadVerdict>;
+    /** `judge`, throwing `AccessDeniedError` (with `unreadable` set) on a refusal. */
+    assertMayChange(workspaceId: string, userEmail: string, wsPath: string, kind: ChangeTargetKind): Promise<void>;
+}
+//# sourceMappingURL=change-gate.d.ts.map

package/dist/modules/access-model/change-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-gate.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/change-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,KAAK,CAAC;AAE9C,MAAM,MAAM,iBAAiB,GACzB;IACE,OAAO,EAAE,IAAI,CAAC;IACd,GAAG;IACD,sEAAsE;IACpE,UAAU;IACZ,0EAA0E;OACxE,sBAAsB;IACxB,kEAAkE;OAChE,YAAY;IACd,sEAAsE;OACpE,eAAe;IACjB,4EAA4E;OAC1E,cAAc;IAChB;;;;;OAKG;OACD,UAAU,CAAC;CAChB,GACD;IACE,OAAO,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE9B,kFAAkF;IAClF,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/modules/access-model/change-gate.js

@@ -0,0 +1,25 @@
+/**
+ * The contract of the READ-BEFORE-WRITE gate: nothing is created, changed or
+ * removed at a place its author cannot read. The service that answers
+ * (filesystem stats, access checks) is `modules/access/change-read-gate.ts`;
+ * this file carries only the types, so the workflow, kb-fs and tool modules
+ * depend on the contract and never on the access module.
+ *
+ * Why `read`, when every write already needs `write`: on a draft branch no
+ * write grant is needed at all — anyone may propose anything, and the change
+ * request is where the real boundary lives. Without this gate a proposal
+ * could land in a folder its author cannot see, where it would vanish from
+ * them the moment it was added. And a write grant only IMPLIES read; a
+ * nearer `deny read` can take the read away while the write stands. The gate
+ * makes the one rule hold everywhere: you can only change what you can see.
+ *
+ * The one exception is a NEW FOLDER directly under one of the three roots
+ * (knowledge, skills, plugins — `creatableRootDirNames`). Those roots grant
+ * read to nobody by default, and a person's own space or a new plugin or
+ * skill has to start somewhere. The new folder carries its creator's own
+ * grant in its `access.md` (see `ICreatorAccess`), so what they create there
+ * is visible to them from the first byte. A loose FILE directly at a root
+ * cannot carry such a grant, so it is not excepted.
+ */
+export {};
+//# sourceMappingURL=change-gate.js.map

package/dist/modules/access-model/change-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-gate.js","sourceRoot":"","sources":["../../../src/modules/access-model/change-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}

package/dist/modules/access-model/creator.d.ts

@@ -8,26 +8,24 @@
  */
 import type { Principal } from './access-splice.js';
 /**
- * How a pending creation gets its creator read grant.
- *   - `seed-access-md`: merge the grant into `wsRelPath` (a new directory's
- *     own `access.md`, workspace-relative) — BEFORE or alongside the creation,
- *     via the caller's own lock+commit machinery. The caller MUST re-read the
- *     file's CURRENT text under its lock and write `apply(current)` ('' when
- *     absent), never a precomputed fresh file: two concurrent creators can
- *     both plan a seed for the same new directory, and a blind overwrite
- *     would silently revoke whichever grant landed first. Skip the write when
- *     `apply` returns the input unchanged, and call `noteAccessFileWritten`
- *     after a write so the resolver cache drops.
- *   - `frontmatter`: run the new file's content through `apply` before
- *     writing it, so the grant lands atomically inside the created file.
+ * How a pending creation gets its creator read grant — there is one way:
+ * `seed-access-md` merges the grant into `wsRelPath` (the new top-level
+ * folder's own `access.md`, workspace-relative) BEFORE or alongside the
+ * creation, via the caller's own lock+commit machinery. The caller MUST
+ * re-read the file's CURRENT text under its lock and write `apply(current)`
+ * ('' when absent), never a precomputed fresh file: two concurrent creators
+ * can both plan a seed for the same new directory, and a blind overwrite
+ * would silently revoke whichever grant landed first. Skip the write when
+ * `apply` returns the input unchanged, and call `noteAccessFileWritten`
+ * after a write so the resolver cache drops.
+ *
+ * Kept a union of one so a second plan kind can return without touching the
+ * consumers' `plan?.kind === 'seed-access-md'` reads.
  */
 export type CreationGrantPlan = {
     kind: 'seed-access-md';
     wsRelPath: string;
     apply: (current: string) => string;
-} | {
-    kind: 'frontmatter';
-    apply: (content: string) => string;
 };
 /** The creator identity a grant is written for. */
 export interface Creator {
@@ -41,7 +39,6 @@ export interface Creator {
  */
 export interface ICreatorAccess {
     planForCreate(workspaceId: string, creator: Creator, wsRelPath: string, kind: 'file' | 'dir'): Promise<CreationGrantPlan | null>;
-    grantInExtractedFile(workspaceId: string, creator: Creator, wsRelPath: string): Promise<string | null>;
     noteAccessFileWritten(workspaceId: string): void;
 }
 /**

package/dist/modules/access-model/creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"creator.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/creator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,CAAC;AAEhE,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GAAG,KAAK,GACnB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAErC,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE1B,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAE5D"}
+{"version":3,"file":"creator.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/creator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;CACpC,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GAAG,KAAK,GACnB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAErC,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAE5D"}

package/dist/modules/access-model/creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"creator.js","sourceRoot":"","sources":["../../../src/modules/access-model/creator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAkDH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE;IAC1B,oGAAoG;IACpG,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;AACtF,CAAC"}
+{"version":3,"file":"creator.js","sourceRoot":"","sources":["../../../src/modules/access-model/creator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA+CH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE;IAC1B,oGAAoG;IACpG,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;AACtF,CAAC"}

package/dist/modules/access-model/frontmatter-lines.d.ts

@@ -0,0 +1,27 @@
+/** An opening fence with no closing one — the caller decides what that means. */
+export interface UnterminatedFrontmatter {
+    kind: 'unterminated';
+}
+/** No opening fence: the whole text is body. */
+export interface NoFrontmatter {
+    kind: 'none';
+    /** Every line of the text, so a splice can put it back untouched. */
+    lines: string[];
+    eol: string;
+}
+/** A closed `---` block. */
+export interface ScannedFrontmatter {
+    kind: 'frontmatter';
+    /** The opening fence line, on its own — a splice writes it back verbatim. */
+    open: string[];
+    /** The lines BETWEEN the fences. */
+    fm: string[];
+    /** The closing fence line and everything after it. */
+    post: string[];
+    /** The text's own line ending, so a rewrite does not dirty every line. */
+    eol: string;
+}
+export type FrontmatterScan = ScannedFrontmatter | NoFrontmatter | UnterminatedFrontmatter;
+/** Scan `text` for a leading `---` block. Decides nothing beyond the fences. */
+export declare function scanFrontmatter(text: string): FrontmatterScan;
+//# sourceMappingURL=frontmatter-lines.d.ts.map

package/dist/modules/access-model/frontmatter-lines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-lines.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/frontmatter-lines.ts"],"names":[],"mappings":"AAuBA,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,oCAAoC;IACpC,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,sDAAsD;IACtD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG,aAAa,GAAG,uBAAuB,CAAC;AAqC3F,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAU7D"}

package/dist/modules/access-model/frontmatter-lines.js

@@ -0,0 +1,74 @@
+/**
+ * THE line-based scan of a `---` frontmatter block, for the access model.
+ *
+ * The access model deliberately does NOT use the two-string splitter in
+ * `@bevel-software/platform-shared`: a splice has to put bytes back exactly
+ * as it found them — comments, blank lines, the file's own line endings —
+ * and that needs the LINES, not two captured strings. Two readers here
+ * scanned for the fences separately (the grammar's `extractFrontmatter` and
+ * `bodyAfterFrontmatter`, and the splice's `splitFrontmatter`), each with its
+ * own copy of the same loop. This is that loop, once.
+ *
+ * What it decides, and what it leaves to the caller:
+ *
+ *   - THE FENCE RULE is NOT decided here: it is `isFrontmatterFence` from the
+ *     shared package, the same function the splitter asks, so the access
+ *     model and the catalog can never again disagree about whether a file
+ *     has frontmatter (`frontmatter-fences.test.ts` asserts they agree).
+ *   - WHAT AN UNTERMINATED BLOCK MEANS is the caller's: the grammar reads it
+ *     as a parse error, the body reader as no body, the splice as a refusal.
+ *     One scan, three answers, none of them re-deriving the fences.
+ */
+import { isFrontmatterFence } from '@bevel-software/platform-shared';
+/** Whether a line IS a fence — the platform's one rule, shared with the catalog's splitter. */
+const isFence = isFrontmatterFence;
+/**
+ * The line ending a rewrite of `text` should use: the one MOST of its lines
+ * already use.
+ *
+ * A splice re-joins the whole file with a single separator — the frontmatter
+ * array is edited by index, so there is no surviving per-line ending to put
+ * back — which makes "which ending?" purely a question of whose lines get
+ * rewritten. The majority answers it with the fewest: a consistent file (all
+ * LF, or all CRLF, which is every file git checks out) comes back byte for
+ * byte, and a MIXED file is normalised towards whatever it mostly already is.
+ *
+ * The rule this replaces was "CRLF if the text contains one anywhere", which
+ * let a single stray CRLF — in the body, in a comment — rewrite every line of
+ * a knowledge base's access rules as churn in somebody's change request. Ties
+ * (and a file with no line breaks at all) go to the file's FIRST ending, so
+ * the answer is always the file's own.
+ */
+function dominantEol(text) {
+    let crlf = 0;
+    let lf = 0;
+    let firstIsCrlf = false;
+    for (let i = text.indexOf('\n'); i !== -1; i = text.indexOf('\n', i + 1)) {
+        const isCrlf = i > 0 && text[i - 1] === '\r';
+        if (crlf + lf === 0)
+            firstIsCrlf = isCrlf;
+        if (isCrlf)
+            crlf++;
+        else
+            lf++;
+    }
+    if (crlf > lf)
+        return '\r\n';
+    if (lf > crlf)
+        return '\n';
+    return firstIsCrlf ? '\r\n' : '\n';
+}
+/** Scan `text` for a leading `---` block. Decides nothing beyond the fences. */
+export function scanFrontmatter(text) {
+    const eol = dominantEol(text);
+    const lines = text.split(/\r?\n/);
+    if (!isFence(lines[0]))
+        return { kind: 'none', lines, eol };
+    for (let i = 1; i < lines.length; i++) {
+        if (isFence(lines[i])) {
+            return { kind: 'frontmatter', open: lines.slice(0, 1), fm: lines.slice(1, i), post: lines.slice(i), eol };
+        }
+    }
+    return { kind: 'unterminated' };
+}
+//# sourceMappingURL=frontmatter-lines.js.map

package/dist/modules/access-model/frontmatter-lines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-lines.js","sourceRoot":"","sources":["../../../src/modules/access-model/frontmatter-lines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AA8BrE,+FAA+F;AAC/F,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;QAC7C,IAAI,IAAI,GAAG,EAAE,KAAK,CAAC;YAAE,WAAW,GAAG,MAAM,CAAC;QAC1C,IAAI,MAAM;YAAE,IAAI,EAAE,CAAC;;YACd,EAAE,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC7B,IAAI,EAAE,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5G,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAClC,CAAC"}

package/dist/modules/access-model/plugin-principals.d.ts

@@ -7,10 +7,12 @@ import { type AccessFile, type RolesIndex } from './access-grammar.js';
  *
  * WHAT A PLUGIN'S ROSTER IS: the folder-governing rules of
  * `Plugins/<Name>/access.md` — the file provisioning seeds and the join flow
- * edits. Three principals per plugin, following the resolver's own superset
- * convention (write implies read, owner implies both):
+ * edits. Three principals per plugin, folded by the resolver's own
+ * `sourceVerbsFor` table — the ONE place the nesting is written down, so a
+ * roster can never drift from what resolution itself grants (`write` and
+ * `download` each imply `read`; `owner` implies all three):
  *
- *   plugin/<slug>/read    everyone under read, write or owner
+ *   plugin/<slug>/read    everyone under read, write, download or owner
  *   plugin/<slug>/write   everyone under write or owner
  *   plugin/<slug>/owner   everyone under owner
  *

package/dist/modules/access-model/plugin-principals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-principals.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/plugin-principals.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,UAAU,EAEf,KAAK,UAAU,EAEhB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC;AAC5C;;;;;;GAMG;AACH,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,IAAI,CAoCN"}
+{"version":3,"file":"plugin-principals.d.ts","sourceRoot":"","sources":["../../../src/modules/access-model/plugin-principals.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,UAAU,EAEf,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC;AAC5C;;;;;;GAMG;AACH,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,IAAI,CAqCN"}

package/dist/modules/access-model/plugin-principals.js

@@ -1,5 +1,5 @@
 import { comparePathComponents } from '../../shared/path-order.js';
-import { EVERYONE_CANONICAL, PLUGIN_TOKEN_PREFIX, PLUGIN_TOKEN_VERBS, pluginPrincipalKey, } from './access-grammar.js';
+import { EVERYONE_CANONICAL, PLUGIN_TOKEN_PREFIX, PLUGIN_TOKEN_VERBS, pluginPrincipalKey, sourceVerbsFor, } from './access-grammar.js';
 /**
  * Plugin principals — `plugin/<Name>/<verb>` — synthesised into the principal
  * index from each plugin folder's own `access.md`, so a grant naming one
@@ -8,10 +8,12 @@ import { EVERYONE_CANONICAL, PLUGIN_TOKEN_PREFIX, PLUGIN_TOKEN_VERBS, pluginPrin
  *
  * WHAT A PLUGIN'S ROSTER IS: the folder-governing rules of
  * `Plugins/<Name>/access.md` — the file provisioning seeds and the join flow
- * edits. Three principals per plugin, following the resolver's own superset
- * convention (write implies read, owner implies both):
+ * edits. Three principals per plugin, folded by the resolver's own
+ * `sourceVerbsFor` table — the ONE place the nesting is written down, so a
+ * roster can never drift from what resolution itself grants (`write` and
+ * `download` each imply `read`; `owner` implies all three):
  *
- *   plugin/<slug>/read    everyone under read, write or owner
+ *   plugin/<slug>/read    everyone under read, write, download or owner
  *   plugin/<slug>/write   everyone under write or owner
  *   plugin/<slug>/owner   everyone under owner
  *
@@ -61,7 +63,7 @@ pluginDirs) {
         if (!file)
             continue; // a plugin without rules has no roster
         for (const verb of PLUGIN_TOKEN_VERBS) {
-            const { emails, everyone } = holdersOf(index, file, verb);
+            const { emails, everyone, sourceKeys } = holdersOf(index, file, verb);
             const key = pluginPrincipalKey(slug, verb);
             index.byCanonical.set(key, {
                 displayName: key,
@@ -69,6 +71,7 @@ pluginDirs) {
                 kind: 'plugin',
                 pluginName: slug,
                 pluginDir: dir,
+                sourceKeys,
             });
             for (const email of emails) {
                 let set = index.byEmail.get(email);
@@ -85,19 +88,9 @@ pluginDirs) {
         }
     }
 }
-/** The verbs whose grants confer `verb` on the plugin (the superset fold). */
-function sourceVerbsFor(verb) {
-    switch (verb) {
-        case 'read':
-            return ['read', 'write', 'owner'];
-        case 'write':
-            return ['write', 'owner'];
-        case 'owner':
-            return ['owner'];
-    }
-}
 function holdersOf(index, file, verb) {
     const emails = new Set();
+    const sourceKeys = new Set();
     let everyone = false;
     for (const source of sourceVerbsFor(verb)) {
         for (const entry of file.entries[source]) {
@@ -116,10 +109,11 @@ function holdersOf(index, file, verb) {
             const record = index.byCanonical.get(entry.role);
             if (!record)
                 continue; // an unknown role contributes nothing (loadModel warns separately)
+            sourceKeys.add(entry.role);
             for (const email of record.emails)
                 emails.add(email);
         }
     }
-    return { emails, everyone };
+    return { emails, everyone, sourceKeys };
 }
 //# sourceMappingURL=plugin-principals.js.map

package/dist/modules/access-model/plugin-principals.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-principals.js","sourceRoot":"","sources":["../../../src/modules/access-model/plugin-principals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GAKnB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAiB,EACjB,WAA4C;AAC5C;;;;;;GAMG;AACH,UAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,yEAAyE;IACzE,uDAAuD;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,2EAA2E;QAC3E,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,uCAAuC;QAC5D,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE;gBACzB,WAAW,EAAE,GAAG;gBAChB,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;oBAChB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAChC,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,UAAU,KAAK,IAAI,GAAG,EAAE,CAAC;gBAC/B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CAAC,IAAqB;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,KAAK,OAAO;YACV,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,KAAK,OAAO;YACV,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,KAAiB,EACjB,IAAgB,EAChB,IAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,IAAI;gBAAE,SAAS;YACzB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACtC,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAAE,SAAS,CAAC,eAAe;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM;gBAAE,SAAS,CAAC,mEAAmE;YAC1F,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"plugin-principals.js","sourceRoot":"","sources":["../../../src/modules/access-model/plugin-principals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GAIf,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAiB,EACjB,WAA4C;AAC5C;;;;;;GAMG;AACH,UAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,yEAAyE;IACzE,uDAAuD;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,2EAA2E;QAC3E,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,uCAAuC;QAC5D,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACtC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE;gBACzB,WAAW,EAAE,GAAG;gBAChB,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,GAAG;gBACd,UAAU;aACX,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;oBAChB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAChC,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,UAAU,KAAK,IAAI,GAAG,EAAE,CAAC;gBAC/B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,KAAiB,EACjB,IAAgB,EAChB,IAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,IAAI;gBAAE,SAAS;YACzB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACtC,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBAAE,SAAS,CAAC,eAAe;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM;gBAAE,SAAS,CAAC,mEAAmE;YAC1F,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC"}