@bevel-software/platform-core-backend 0.20.0 → 0.21.0

package/dist/modules/plugins/plugin-links.js

@@ -1,11 +1,17 @@
 import path from 'node:path';
 import { logger } from '../../shared/logging.js';
 const log = logger('plugins');
-import { DEFAULT_BRANCH, pluginManifestName, skillUnderRoot } from '@bevel-software/platform-shared';
-import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import { pluginManifestName, skillUnderRoot } from '@bevel-software/platform-shared';
 import { TtlCache } from '../../shared/ttl-cache.js';
 import { canonicalRoleName, pluginPrincipalKey } from '../access-model/access-grammar.js';
 const CACHE_TTL_MS = 60_000;
+/**
+ * The two verbs a link grants — the pair `PluginLinksService.grantTokens`
+ * writes and this index looks for. `owner` is deliberately not one of them: a
+ * link shares a skill and lets the plugin's managers edit it; it never hands
+ * over who validates it.
+ */
+export const LINK_GRANT_VERBS = ['read', 'write'];
 /**
  * The link index: which shared skills each plugin links, and — the other way
  * round — which plugins each skill belongs to, whether by sitting inside the
@@ -18,10 +24,15 @@ const CACHE_TTL_MS = 60_000;
  * and the global-name dedup, and a second walk here would be a second
  * opinion about what a skill is.
  *
- * `granted` is the consistency check the amber dot renders: a linked skill
- * whose own access rules DO grant the plugin's `plugin/<Name>/read`
- * principal (directly or from a scope above it). The link service writes
- * that grant with the link; only a hand edit takes it away.
+ * `granted` is the consistency check the amber dot renders, and it is a
+ * question about the FILE, not about who happens to be able to read the skill
+ * today: a link is granted when the declared ROOT's own access file carries
+ * both `plugin/<Name>/read` and `plugin/<Name>/write`, and neither is denied
+ * at that root or between it and the skill. A root that is readable by
+ * everyone, or that inherits a plugin grant from a folder above, is NOT
+ * granted — the grant is the link's contract, and a public root merely hides
+ * its absence until the day someone restricts the tree. The link service
+ * writes those two lines with the link; only a hand edit takes them away.
  *
  * Cached briefly, dropped by `invalidate()` from the same file-change
  * subscriber that drops the plugin index, so a link committed on the default
@@ -31,19 +42,22 @@ export class PluginLinkIndex {
     workspaceService;
     skillService;
     accessControl;
-    kbDirName;
+    kb;
     source;
     cache;
-    constructor(workspaceService, skillService, accessControl, kbDirName, 
+    constructor(workspaceService, skillService, accessControl, kb, 
     /** Where plugins come from — the one discovery every catalog shares. */
     source, now = Date.now) {
         this.workspaceService = workspaceService;
         this.skillService = skillService;
         this.accessControl = accessControl;
-        this.kbDirName = kbDirName;
+        this.kb = kb;
         this.source = source;
         this.cache = new TtlCache(CACHE_TTL_MS, now);
     }
+    get kbDirName() {
+        return this.kb.kbDirName;
+    }
     invalidate() {
         this.cache.invalidate();
     }
@@ -73,7 +87,7 @@ export class PluginLinkIndex {
         let wsId;
         let kbRoot;
         try {
-            wsId = (await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH)).id;
+            wsId = (await this.workspaceService.getOrCreateForBranch(this.kb.defaultBranch)).id;
             kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
         }
         catch {
@@ -110,13 +124,64 @@ export class PluginLinkIndex {
             const roots = plugin.linkedRoots;
             const linkedSkills = [];
             const unresolvedRoots = [];
+            /** Which declared roots each linked skill arrives through. */
+            const rootsOfSkill = new Map();
             for (const root of roots) {
                 const hits = skills.filter((s) => skillUnderRoot(s.path, root)).map((s) => s.path);
                 if (hits.length === 0)
                     unresolvedRoots.push(root);
-                for (const hit of hits)
+                for (const hit of hits) {
                     if (!linkedSkills.includes(hit))
                         linkedSkills.push(hit);
+                    rootsOfSkill.set(hit, [...(rootsOfSkill.get(hit) ?? []), root]);
+                }
+            }
+            // A skill — or a root — that sits INSIDE this plugin's folder is inline:
+            // its membership already stands, and no grant is written for it.
+            const inline = (p) => p === plugin.folder || p.startsWith(`${plugin.folder}/`);
+            const slug = pluginManifestName(plugin.name);
+            // Root by root FIRST, skill by skill second: the grant lives on the
+            // root's access file, so a root holding twenty skills is one question to
+            // the resolver, not twenty. An unmanaged (dialect) link is a plain
+            // reference — nothing to grant, nothing to repair — so it asks none.
+            const carriesGrants = new Map();
+            if (plugin.linksAreManaged) {
+                for (const root of roots) {
+                    if (inline(root))
+                        continue;
+                    carriesGrants.set(root, await this.rootCarriesGrants(wsId, root, slug));
+                }
+            }
+            const grantedSkills = new Map();
+            for (const skillPath of linkedSkills) {
+                if (inline(skillPath))
+                    continue;
+                if (!plugin.linksAreManaged) {
+                    grantedSkills.set(skillPath, true);
+                    continue;
+                }
+                let granted = false;
+                for (const root of rootsOfSkill.get(skillPath) ?? []) {
+                    if (!carriesGrants.get(root))
+                        continue;
+                    if (await this.deniedBetween(wsId, root, skillPath, slug))
+                        continue;
+                    granted = true;
+                    break;
+                }
+                grantedSkills.set(skillPath, granted);
+            }
+            // What the automatic repair has to write: a root missing its lines, with
+            // the skills that are actually going without because of it. A root whose
+            // skills all reach the plugin through ANOTHER declared root is nothing to
+            // repair — there is no broken link to fix, and a write would be noise.
+            const ungrantedRoots = [];
+            for (const root of roots) {
+                if (inline(root) || carriesGrants.get(root) !== false)
+                    continue;
+                const without = linkedSkills.filter((s) => !inline(s) && (rootsOfSkill.get(s) ?? []).includes(root) && grantedSkills.get(s) === false);
+                if (without.length > 0)
+                    ungrantedRoots.push({ root, skills: without });
             }
             byPlugin.set(plugin.name, {
                 name: plugin.name,
@@ -124,40 +189,80 @@ export class PluginLinkIndex {
                 roots,
                 linkedSkills,
                 unresolvedRoots,
+                ungrantedRoots,
                 linksAreManaged: plugin.linksAreManaged,
             });
-            if (linkedSkills.length === 0)
-                continue;
-            const token = pluginPrincipalKey(pluginManifestName(plugin.name), 'read');
             for (const skillPath of linkedSkills) {
-                // A skill that also sits INSIDE this plugin folder is inline, and its
-                // inline membership already stands.
-                if (skillPath.startsWith(`${plugin.folder}/`))
+                if (inline(skillPath))
                     continue;
-                // An unmanaged (dialect) link is a plain reference: nothing to grant,
-                // nothing to repair — the skill's own scope decides who reads it.
-                const granted = plugin.linksAreManaged ? await this.isGranted(wsId, skillPath, token) : true;
-                add(skillPath, { name: plugin.name, linked: true, granted });
+                add(skillPath, { name: plugin.name, linked: true, granted: grantedSkills.get(skillPath) === true });
             }
         }
         return { bySkill, byPlugin };
     }
-    /** Whether the skill folder's effective readers include the plugin's read principal. */
-    async isGranted(wsId, skillPath, token) {
+    /**
+     * Whether the ROOT's own access file carries both of the link's grant lines.
+     *
+     * "Its own" is the whole rule: `grantSources` reports every scope that
+     * grants the principal, closest-first, so `[0].kind === 'direct'` is
+     * "granted by the file this root's link writes" — a grant inherited from a
+     * folder above is an `ancestor` source and does not count, and a root that
+     * is simply public names the principal nowhere and yields no source at all.
+     * `tokenMatch: 'exact'` pins the comparison to the canonical token the
+     * grant is written as, the same spelling `grantTokens` splices.
+     *
+     * A `deny` of either token in that same file is not granted either, whatever
+     * the resolver makes of a grant beside it: the deny is the operator's, the
+     * repair never removes it, and reporting the link as healthy would hide the
+     * one thing the banner exists to say. `locallyDeniedPrincipals` is what sees
+     * it — the per-verb denial walk cannot, since a grant in the same scope wins
+     * there and ends the walk.
+     */
+    async rootCarriesGrants(wsId, root, slug) {
         try {
-            const readers = await this.accessControl.eligibleReaders(wsId, skillPath);
-            if (!readers.restricted)
-                return true; // readable by everyone — the plugin's members included
+            for (const verb of LINK_GRANT_VERBS) {
+                const principal = { kind: 'role', role: pluginPrincipalKey(slug, verb) };
+                const sources = await this.accessControl.grantSources(wsId, 'folder', root, principal, {
+                    tokenMatch: 'exact',
+                });
+                if (sources[verb]?.[0]?.kind !== 'direct')
+                    return false;
+            }
+            const denied = await this.accessControl.locallyDeniedPrincipals?.(wsId, 'folder', root);
+            const tokens = LINK_GRANT_VERBS.map((verb) => pluginPrincipalKey(slug, verb));
             // The resolver reports display names; compare through the one canonicaliser.
-            return (readers.principals ?? []).some((p) => p.kind === 'plugin' && canonicalRoleName(p.name) === token);
+            return !(denied?.principals ?? []).some((p) => tokens.includes(canonicalRoleName(p.name)));
         }
         catch {
             return false; // fail closed: an unreadable tree reports the link as needing repair
         }
     }
-}
-/** The default-branch workspace id every link resolution runs against. */
-export function linksWorkspaceId() {
-    return workspaceIdForBranch(DEFAULT_BRANCH);
+    /**
+     * Whether either grant is DENIED below the root — at the skill's own folder
+     * or at anything between it and the root.
+     *
+     * The denial walk stops at a closer grant, and the root's grant is what
+     * brought us here, so what this reports is exactly the scopes under the
+     * root: a `deny` above the root is dead under closeness-first and is not
+     * this link's problem.
+     */
+    async deniedBetween(wsId, root, skillPath, slug) {
+        if (skillPath === root)
+            return false; // the root's own file is `rootCarriesGrants`' business
+        try {
+            for (const verb of LINK_GRANT_VERBS) {
+                const principal = { kind: 'role', role: pluginPrincipalKey(slug, verb) };
+                const denials = await this.accessControl.denialSources?.(wsId, 'folder', skillPath, principal, {
+                    tokenMatch: 'exact',
+                });
+                if ((denials?.[verb] ?? []).length > 0)
+                    return true;
+            }
+            return false;
+        }
+        catch {
+            return true; // fail closed, as above
+        }
+    }
 }
 //# sourceMappingURL=plugin-links.js.map

package/dist/modules/plugins/plugin-links.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-links.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-links.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAErG,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAI1F,MAAM,YAAY,GAAG,MAAM,CAAC;AAyB5B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,eAAe;IAIP;IACA;IACA;IACA;IAEA;IARF,KAAK,CAA2B;IAEjD,YACmB,gBAAkC,EAClC,YAA2B,EAC3B,aAA6B,EAC7B,SAAiB;IAClC,wEAAwE;IACvD,MAAoB,EACrC,MAAoB,IAAI,CAAC,GAAG;QANX,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,iBAAY,GAAZ,YAAY,CAAe;QAC3B,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;QAEjB,WAAM,GAAN,MAAM,CAAc;QAGrC,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,wEAAwE;QACxE,yEAAyE;QACzE,mBAAmB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC/B,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IAED,8EAA8E;IAEtE,KAAK,CAAC,KAAK;QACjB,IAAI,IAAY,CAAC;QACjB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAE,CAAmB,EAAE,EAAE;YACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjD,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE,CACpC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxC,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,SAAS;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;YACjC,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,MAAM,eAAe,GAAa,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClD,KAAK,MAAM,GAAG,IAAI,IAAI;oBAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClF,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK;gBACL,YAAY;gBACZ,eAAe;gBACf,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1E,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;gBACrC,sEAAsE;gBACtE,oCAAoC;gBACpC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBACxD,sEAAsE;gBACtE,kEAAkE;gBAClE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7F,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED,wFAAwF;IAChF,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAa;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC,CAAC,uDAAuD;YAC7F,6EAA6E;YAC7E,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;QAC5G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,qEAAqE;QACrF,CAAC;IACH,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,oBAAoB,CAAC,cAAc,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"plugin-links.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-links.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAKrF,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAI1F,MAAM,YAAY,GAAG,MAAM,CAAC;AAmC5B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAS3D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,eAAe;IAIP;IACA;IACA;IACA;IAEA;IARF,KAAK,CAA2B;IAEjD,YACmB,gBAAkC,EAClC,YAA2B,EAC3B,aAA6B,EAC7B,EAAa;IAC9B,wEAAwE;IACvD,MAAoB,EACrC,MAAoB,IAAI,CAAC,GAAG;QANX,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,iBAAY,GAAZ,YAAY,CAAe;QAC3B,kBAAa,GAAb,aAAa,CAAgB;QAC7B,OAAE,GAAF,EAAE,CAAW;QAEb,WAAM,GAAN,MAAM,CAAc;QAGrC,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC;IAC3B,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,wEAAwE;QACxE,yEAAyE;QACzE,mBAAmB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC/B,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IAED,8EAA8E;IAEtE,KAAK,CAAC,KAAK;QACjB,IAAI,IAAY,CAAC;QACjB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAE,CAAmB,EAAE,EAAE;YACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjD,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE,CACpC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxC,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,SAAS;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;YACjC,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,MAAM,eAAe,GAAa,EAAE,CAAC;YACrC,8DAA8D;YAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACxD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YACD,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACvF,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,oEAAoE;YACpE,yEAAyE;YACzE,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAmB,CAAC;YACjD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,MAAM,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC3B,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAmB,CAAC;YACjD,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;gBACrC,IAAI,MAAM,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAChC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;oBAC5B,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBACnC,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;oBACrD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,SAAS;oBACvC,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;wBAAE,SAAS;oBACpE,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACR,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,cAAc,GAAoB,EAAE,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK;oBAAE,SAAS;gBAChE,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,CAClG,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK;gBACL,YAAY;gBACZ,eAAe;gBACf,cAAc;gBACd,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;gBACrC,IAAI,MAAM,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAChC,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;QACtE,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;oBACrF,UAAU,EAAE,OAAO;iBACpB,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;YAC1D,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,uBAAuB,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACxF,MAAM,MAAM,GAAa,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACxF,6EAA6E;YAC7E,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,qEAAqE;QACrF,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,SAAiB,EAAE,IAAY;QACrF,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,uDAAuD;QAC7F,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE;oBAC7F,UAAU,EAAE,OAAO;iBACpB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;YACtD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,wBAAwB;QACvC,CAAC;IACH,CAAC;CACF"}

package/dist/modules/plugins/plugin-links.service.d.ts

@@ -3,7 +3,44 @@ import type { WorkspaceService } from '../workspace/workspace.service.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import type { ISkillService } from '../skills/skills.contract.js';
 import type { ProvisionCommitDriver } from './plugin-provision.service.js';
-import { type PluginLinkIndex } from './plugin-links.js';
+import type { PluginLinkIndex } from './plugin-links.js';
+import type { KbContext } from '../../shared/kb-context.js';
+/** Who may edit one skill root's access file, in the terms the banner names them. */
+export interface LinkEditors {
+    roles: string[];
+    users: {
+        name: string;
+        email: string;
+    }[];
+}
+/** One link the automatic repair left alone, and why — see `repairAll`. */
+export interface UnrepairedLink {
+    /** Repo-relative root, as the manifest declares it. */
+    root: string;
+    /**
+     * `needs-skill-write` — the viewer may not write the root's access file, so
+     * nothing was attempted; `failed` — the write was attempted and did not
+     * land; `denied` — both lines are already in the file and the link is still
+     * not granted, which is a `deny` of the plugin at that root: nothing to
+     * write, and only an editor removing the deny would change it. All three
+     * leave the link broken and all three keep the banner.
+     */
+    reason: 'needs-skill-write' | 'failed' | 'denied';
+    /** The skills the plugin's members still cannot read through the root. */
+    skills: {
+        path: string;
+        name: string;
+    }[];
+    /** Who can repair it from the skill page. */
+    editors: LinkEditors;
+}
+/** What one page-open repair did and what it could not do. */
+export interface LinkRepairReport {
+    /** Roots whose two grant lines are now in place (silent: nothing to show). */
+    repaired: string[];
+    /** What is still broken, and who can fix it. */
+    skipped: UnrepairedLink[];
+}
 /** A refusal the route passes through: message + HTTP status + a machine-readable kind. */
 export declare class PluginLinkError extends Error {
     readonly status: number;
@@ -35,7 +72,9 @@ export declare class PluginLinkError extends Error {
  * skill page says so, for a skill editor to remove.
  *
  * Repair re-grants the tokens for a link that exists but whose grant was
- * hand-removed: the amber dot's one action.
+ * hand-removed — the amber dot's one action, run one link at a time from the
+ * skill page, or over a whole plugin's links by `repairAll` the moment
+ * somebody who may write that plugin opens its page.
  *
  * Every operation is serialised on BOTH sides it writes — the plugin's
  * manifest slug (the same key provisioning locks on) and the skill root whose
@@ -49,18 +88,19 @@ export declare class PluginLinksService {
     private readonly accessControl;
     private readonly skillService;
     private readonly links;
-    private readonly kbDirName;
+    private readonly kb;
     private readonly events?;
     private readonly onChanged?;
     private readonly locks;
     private readonly mutation;
-    constructor(workspaceService: WorkspaceService, commits: ProvisionCommitDriver, accessControl: IAccessControl, skillService: ISkillService, links: PluginLinkIndex, kbDirName: string, events?: {
+    constructor(workspaceService: WorkspaceService, commits: ProvisionCommitDriver, accessControl: IAccessControl, skillService: ISkillService, links: PluginLinkIndex, kb: KbContext, events?: {
         emit(event: {
             kind: "fs-tree-changed";
             workspaceId: string;
             branch: string;
         }): void;
     } | undefined, onChanged?: (() => void) | undefined);
+    private get kbDirName();
     link(user: AuthUser, plugin: string, rawRoot: string): Promise<{
         root: string;
         skills: string[];
@@ -69,9 +109,64 @@ export declare class PluginLinksService {
         root: string;
         revoked: boolean;
     }>;
-    repair(user: AuthUser, plugin: string, rawRoot: string): Promise<{
+    /**
+     * Re-grant one link's two tokens. The skill EDITOR's verb (the plugin side
+     * is not consulted): the amber dot's one manual action, and the single
+     * write the automatic repair runs too — see {@link repairAll}.
+     *
+     * `summary` is the commit subject when the caller has a better one than the
+     * path-derived default; the automatic repair passes one that says it was
+     * automatic, because the commit is the only trace it leaves.
+     *
+     * `written` says whether the file changed. A root that already carried
+     * both lines is left alone and reports false — which, for a root the index
+     * called ungranted, means the lines are not what is missing (a `deny`
+     * beside them is): the automatic repair reads it as "still broken", not as
+     * repaired.
+     */
+    repair(user: AuthUser, plugin: string, rawRoot: string, opts?: {
+        summary?: string;
+    }): Promise<{
         root: string;
+        written: boolean;
     }>;
+    /**
+     * Repair EVERY link of `plugin` that is missing its grants — what opening
+     * the plugin's page runs for someone who may write the plugin.
+     *
+     * Two gates, in this order: the caller must be able to write the PLUGIN
+     * (this is the plugin's page repairing its own links, not a way to write
+     * other people's access files), and then, per root, to write that root's
+     * access file. A root they cannot write is left exactly as it is and comes
+     * back in `skipped` with the people who CAN write it, which is the sentence
+     * the banner then says. Nothing comes back for a root that was repaired:
+     * the commit is the trace, the page simply renders with the link healthy.
+     *
+     * Root by root through {@link repair} — the same write, the same manifest
+     * check, the same pair of locks — so the automatic path and the button on
+     * the skill page can never write different things. Each root's failure is
+     * caught into `skipped`: one unwritable file must not cost the others their
+     * repair, nor the page its render.
+     *
+     * A root the repair did not have to write is NOT repaired. The work list
+     * holds only roots the index called ungranted, so a root whose two lines
+     * were already there is broken by something the lines cannot fix — a `deny`
+     * of the plugin in that same file — and reporting it repaired would hide
+     * the one link the writer opening this page could not see anywhere else.
+     */
+    repairAll(user: AuthUser, plugin: string): Promise<LinkRepairReport>;
+    /**
+     * Who may edit a root's access file — the principals the banner names as
+     * the people who can repair a link this viewer cannot.
+     *
+     * Plugin principals are dropped: `plugin/gtm/write` is a real holder of the
+     * verb, and naming it in a sentence addressed to a person says nothing they
+     * could act on. The eligible lists carry emails and no display names, so an
+     * email stands in — every name here has to be something a reader can go and
+     * ask. A lookup that fails names nobody rather than failing the whole
+     * repair — the banner has a sentence for that.
+     */
+    private editorsOf;
     /**
      * ONE reservation for both sides of a link: the plugin's manifest AND the
      * skill root's access.md. Two plugins linking the same root write the same
@@ -87,6 +182,13 @@ export declare class PluginLinksService {
      * whatever the folder is called.
      */
     private tokens;
+    /**
+     * The two lines, and a commit only if they were not already there — the
+     * `changed` check is what makes re-linking, Repair and the page-open repair
+     * idempotent rather than a stream of empty commits. Returns whether the
+     * file changed, so a caller can tell a repair that wrote from one that had
+     * nothing to write.
+     */
     private grantTokens;
     private rootOrThrow;
     /**

package/dist/modules/plugins/plugin-links.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-links.service.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-links.service.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,QAAQ,EACd,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAK5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE3E,2FAA2F;AAC3F,qBAAa,eAAgB,SAAQ,KAAK;IAGtC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFzC,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAKjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,kBAAkB;IAK3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAGxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAb7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;gBAG9B,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,cAAc,EAC7B,YAAY,EAAE,aAAa,EAC3B,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE;QACxB,IAAI,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,iBAAiB,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KACrF,YAAA,EACgB,SAAS,CAAC,GAAE,MAAM,IAAI,aAAA;IAKnC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA+ClG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAgDpG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BxF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;YAQA,WAAW;IASzB,OAAO,CAAC,WAAW;IAQnB;;;;OAIG;YACW,cAAc;IAK5B;;;;;OAKG;YACW,YAAY;IAqB1B,8DAA8D;YAChD,QAAQ;YAMR,kBAAkB;YAOlB,YAAY;IAyC1B,OAAO,CAAC,OAAO;CAMhB"}
+{"version":3,"file":"plugin-links.service.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-links.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,QAAQ,EACd,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAK5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAI5D,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,MAAM,EAAE,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAClD,0EAA0E;IAC1E,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACzC,6CAA6C;IAC7C,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAcD,2FAA2F;AAC3F,qBAAa,eAAgB,SAAQ,KAAK;IAGtC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFzC,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAKjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,kBAAkB;IAK3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAGxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAb7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;gBAG9B,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,cAAc,EAC7B,YAAY,EAAE,aAAa,EAC3B,KAAK,EAAE,eAAe,EACtB,EAAE,EAAE,SAAS,EACb,MAAM,CAAC,EAAE;QACxB,IAAI,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,iBAAiB,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KACrF,YAAA,EACgB,SAAS,CAAC,GAAE,MAAM,IAAI,aAAA;IAKzC,OAAO,KAAK,SAAS,GAEpB;IAEK,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA+ClG,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAgD1G;;;;;;;;;;;;;;OAcG;IACG,MAAM,CACV,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAwB9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAoC1E;;;;;;;;;;OAUG;YACW,SAAS;IAevB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAQd;;;;;;OAMG;YACW,WAAW;IAiBzB,OAAO,CAAC,WAAW;IAQnB;;;;OAIG;YACW,cAAc;IAK5B;;;;;OAKG;YACW,YAAY;IAqB1B,8DAA8D;YAChD,QAAQ;YAMR,kBAAkB;YAOlB,YAAY;IAyC1B,OAAO,CAAC,OAAO;CAMhB"}