@bevel-software/platform-core-backend 0.21.0 → 0.22.0

package/dist/modules/kb-fs/remote-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-url.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-fs/remote-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAWlE;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/modules/kb-fs/remote-url.js

@@ -0,0 +1,35 @@
+/**
+ * Whether two repository addresses name the same repository.
+ *
+ * The answer decides whether a working copy on disk is KEPT or DELETED, so it
+ * errs towards "same": only differences that cannot change which repository
+ * is meant are ignored, and they are ignored on both sides.
+ *
+ *  - a trailing slash, and a `.git` suffix — hosts serve both spellings;
+ *  - the letter case of the scheme and the host — DNS does not distinguish;
+ *  - userinfo (`user:token@`) — who asks does not change what is asked for,
+ *    and a credential must never decide, or appear in, a comparison.
+ *
+ * The PATH keeps its case: hosts that fold it and hosts that do not both
+ * exist, and treating `Org/Repo` and `org/repo` as one would keep a clone of
+ * the wrong repository on a host that tells them apart — but deleting a clone
+ * of the right one is the worse error, and an operator who only changed the
+ * case gets a re-clone, not a loss: the work on that clone was pushed to the
+ * same place.
+ */
+export function normalizeRepositoryAddress(address) {
+    let a = address.trim();
+    const url = /^([a-z][a-z0-9+.-]*):\/\/([^/]*)(\/.*)?$/i.exec(a);
+    if (url) {
+        const host = url[2].replace(/^[^@]*@/, '').toLowerCase();
+        a = `${url[1].toLowerCase()}://${host}${url[3] ?? ''}`;
+    }
+    return a
+        .replace(/[\\/]+$/, '')
+        .replace(/\.git$/i, '')
+        .replace(/[\\/]+$/, '');
+}
+export function sameRepository(a, b) {
+    return normalizeRepositoryAddress(a) === normalizeRepositoryAddress(b);
+}
+//# sourceMappingURL=remote-url.js.map

package/dist/modules/kb-fs/remote-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-url.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/remote-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC;SACL,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAS,EAAE,CAAS;IACjD,OAAO,0BAA0B,CAAC,CAAC,CAAC,KAAK,0BAA0B,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/dist/modules/plugins/join-proposals.d.ts

@@ -1,4 +1,5 @@
 import { type Verb } from '../access-model/access-grammar.js';
+import type { TargetKind } from '../access/access-mutation.service.js';
 /**
  * What a join branch is PROPOSING, relative to the default branch.
  *
@@ -43,11 +44,22 @@ export interface JoinProposal {
     label: string;
 }
 /**
- * The grants `branchText` adds over `defaultText` — the proposals a manager
- * can accept. Empty ⇒ the branch's rules are a subset of the default's.
+ * The grants `branchText` adds over `defaultText` — the proposals an editor
+ * can accept. Empty ⇒ the branch's rules are a subset of the default's, which
+ * is the settled state.
  *
- * `path` is only used to label parse errors; both texts are the same file at
- * two refs.
+ * NULL when the branch's own copy is absent or unreadable, which is a
+ * different fact entirely and the one this surface keeps getting wrong: an
+ * empty answer closes somebody's request, so it has to mean "the branch asks
+ * for nothing more", never "the branch would not tell us".
+ *
+ * An unreadable DEFAULT copy stays what it was — every branch grant looks
+ * incoming. That is the safe direction on that side: an editor is shown
+ * proposals to consider rather than having them swallowed by a baseline
+ * nobody could read.
+ *
+ * `path` labels parse errors; both texts are the same file at two refs, and
+ * `kind` says which grammar that file is written in.
  */
-export declare function pendingProposals(branchText: string | null, defaultText: string | null, path: string): JoinProposal[];
+export declare function pendingProposals(branchText: string | null, defaultText: string | null, path: string, kind: TargetKind): JoinProposal[] | null;
 //# sourceMappingURL=join-proposals.d.ts.map

package/dist/modules/plugins/join-proposals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"join-proposals.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/join-proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,IAAI,EACV,MAAM,mCAAmC,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EACL;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GACpD;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;CACf;AAgCD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,IAAI,EAAE,MAAM,GACX,YAAY,EAAE,CA0BhB"}
+{"version":3,"file":"join-proposals.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/join-proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,IAAI,EACV,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EACL;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GACpD;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;CACf;AAoFD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,GACf,YAAY,EAAE,GAAG,IAAI,CA2BvB"}

package/dist/modules/plugins/join-proposals.js

@@ -1,29 +1,70 @@
-import { KNOWN_VERBS, parseAccessFile, } from '../access-model/access-grammar.js';
+import { KNOWN_VERBS, ownAccessReadable, parseAccessFile, parseOwnAccessEntries, } from '../access-model/access-grammar.js';
 /** Canonical identity of an entry, for set comparison across the two files. */
 function identityOf(entry) {
     return entry.kind === 'user' ? `user:${entry.email}` : `role:${entry.role}`;
 }
 /**
- * Folder rules from one copy of an `access.md`, per verb, grants only.
+ * The per-verb entries one copy of an item's rules declares, or null when the
+ * text could not be read as rules at all.
  *
- * A file that fails to parse yields NO grants. On the branch side that means
- * a malformed proposal offers nothing to accept (fail-closed). On the default
- * side it means every branch grant looks incoming — which is the safe
- * direction too: the manager is shown proposals to consider rather than
- * having them silently swallowed by an unreadable baseline.
+ * THE GRAMMAR FOLLOWS THE ITEM, because there are two of them and the
+ * resolver picks by item as well:
+ *
+ *   folder   a `access.md`, whose folder rules are a BODY of `verb:` block
+ *            lists — `parseAccessFile`, which fails the whole file if a verb
+ *            is not a list.
+ *   file     the node's OWN frontmatter — `parseOwnAccessEntries`, which also
+ *            accepts the single-value scalar form (`write: Rita <r@x.io>`),
+ *            ignores non-access keys like `nodeType:`, and drops a bad entry
+ *            rather than failing the file.
+ *
+ * Reading a file's frontmatter with the FOLDER grammar is what broke every
+ * request whose target was a file: `spliceGrant` writes one grant into a
+ * node's frontmatter as exactly that scalar — the same bytes the dialog's own
+ * grant writes, which the resolver honours — and the folder grammar rejects it
+ * with "'write:' must be a list", failing the parse, yielding no grants, which
+ * reads as a branch with nothing left to propose. The request was then closed
+ * on the editors' first listing, before anyone had seen it.
+ *
+ * Null is reserved for "could not be read": a folder `access.md` that does
+ * not parse, or a file whose frontmatter is broken (never closed, or not a
+ * mapping). A file with no frontmatter, or with frontmatter naming no verb,
+ * is perfectly readable and simply grants nothing. The file grammar's own
+ * null does not tell those apart, so the question is asked separately: a
+ * broken block read as "grants nothing" would close the request on a
+ * reading that failed, the same mistake by another door.
  */
-function grantsByVerb(text, path) {
-    const out = new Map();
+function entriesOf(text, path, kind) {
+    if (kind === 'file') {
+        return parseOwnAccessEntries(text) ?? (ownAccessReadable(text) ? emptyGrants() : null);
+    }
+    const parsed = parseAccessFile(text, path);
+    return parsed.ok ? parsed.file.entries : null;
+}
+function emptyGrants() {
+    const out = {};
     for (const verb of KNOWN_VERBS)
-        out.set(verb, new Map());
+        out[verb] = [];
+    return out;
+}
+/** An index that grants nothing — the baseline a copy nobody could read stands in as. */
+function emptyIndex() {
+    return new Map(KNOWN_VERBS.map((verb) => [verb, new Map()]));
+}
+/**
+ * Grants only, indexed by canonical identity, from one copy of the rules.
+ * Null in, null out — an unreadable copy is not an empty one.
+ */
+function grantsByVerb(text, path, kind) {
     if (text === null)
-        return out;
-    const parsed = parseAccessFile(text, path);
-    if (!parsed.ok)
-        return out;
+        return null;
+    const entries = entriesOf(text, path, kind);
+    if (entries === null)
+        return null;
+    const out = emptyIndex();
     for (const verb of KNOWN_VERBS) {
         const byId = out.get(verb);
-        for (const entry of parsed.file.entries[verb]) {
+        for (const entry of entries[verb]) {
             if (entry.deny)
                 continue;
             byId.set(identityOf(entry), entry);
@@ -32,15 +73,28 @@ function grantsByVerb(text, path) {
     return out;
 }
 /**
- * The grants `branchText` adds over `defaultText` — the proposals a manager
- * can accept. Empty ⇒ the branch's rules are a subset of the default's.
+ * The grants `branchText` adds over `defaultText` — the proposals an editor
+ * can accept. Empty ⇒ the branch's rules are a subset of the default's, which
+ * is the settled state.
+ *
+ * NULL when the branch's own copy is absent or unreadable, which is a
+ * different fact entirely and the one this surface keeps getting wrong: an
+ * empty answer closes somebody's request, so it has to mean "the branch asks
+ * for nothing more", never "the branch would not tell us".
+ *
+ * An unreadable DEFAULT copy stays what it was — every branch grant looks
+ * incoming. That is the safe direction on that side: an editor is shown
+ * proposals to consider rather than having them swallowed by a baseline
+ * nobody could read.
  *
- * `path` is only used to label parse errors; both texts are the same file at
- * two refs.
+ * `path` labels parse errors; both texts are the same file at two refs, and
+ * `kind` says which grammar that file is written in.
  */
-export function pendingProposals(branchText, defaultText, path) {
-    const branch = grantsByVerb(branchText, path);
-    const base = grantsByVerb(defaultText, path);
+export function pendingProposals(branchText, defaultText, path, kind) {
+    const branch = grantsByVerb(branchText, path, kind);
+    if (branch === null)
+        return null;
+    const base = grantsByVerb(defaultText, path, kind) ?? emptyIndex();
     const out = [];
     for (const verb of KNOWN_VERBS) {
         const baseIds = base.get(verb);

package/dist/modules/plugins/join-proposals.js.map

@@ -1 +1 @@
-{"version":3,"file":"join-proposals.js","sourceRoot":"","sources":["../../../src/modules/plugins/join-proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,eAAe,GAGhB,MAAM,mCAAmC,CAAC;AAyC3C,+EAA+E;AAC/E,SAAS,UAAU,CAAC,KAAkB;IACpC,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAmB,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,WAAW;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,IAAI;gBAAE,SAAS;YACzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAyB,EACzB,WAA0B,EAC1B,IAAY;IAEZ,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAChC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC9B,GAAG,CAAC,IAAI,CACN,KAAK,CAAC,IAAI,KAAK,MAAM;gBACnB,CAAC,CAAC;oBACE,IAAI;oBACJ,EAAE;oBACF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC/E,KAAK,EAAE,KAAK,CAAC,WAAW;iBACzB;gBACH,CAAC,CAAC;oBACE,IAAI;oBACJ,EAAE;oBACF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE;oBACpD,KAAK,EAAE,KAAK,CAAC,WAAW;iBACzB,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"join-proposals.js","sourceRoot":"","sources":["../../../src/modules/plugins/join-proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GAGtB,MAAM,mCAAmC,CAAC;AA0C3C,+EAA+E;AAC/E,SAAS,UAAU,CAAC,KAAkB;IACpC,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAS,SAAS,CAChB,IAAY,EACZ,IAAY,EACZ,IAAgB;IAEhB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,EAAiC,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,SAAS,UAAU;IACjB,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,EAAuB,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,IAAmB,EACnB,IAAY,EACZ,IAAgB;IAEhB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,SAAS;YACzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAyB,EACzB,WAA0B,EAC1B,IAAY,EACZ,IAAgB;IAEhB,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;IACnE,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAChC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC9B,GAAG,CAAC,IAAI,CACN,KAAK,CAAC,IAAI,KAAK,MAAM;gBACnB,CAAC,CAAC;oBACE,IAAI;oBACJ,EAAE;oBACF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC/E,KAAK,EAAE,KAAK,CAAC,WAAW;iBACzB;gBACH,CAAC,CAAC;oBACE,IAAI;oBACJ,EAAE;oBACF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE;oBACpD,KAAK,EAAE,KAAK,CAAC,WAAW;iBACzB,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/modules/plugins/join-requests.service.d.ts

@@ -1,6 +1,8 @@
 import { type AuthUser, type ChangeRequest, type IWorkflowService } from '@bevel-software/platform-shared';
 import { type WorkspaceService } from '../workspace/workspace.service.js';
 import type { KbContext } from '../../shared/kb-context.js';
+import type { IAccessControl } from '../access/access-control.interface.js';
+import { type AccessRequestTarget, type IAccessRequestLifecycle } from '../access/access-requests.contract.js';
 import { type JoinProposal } from './join-proposals.js';
 /** One open join change request, with what it still proposes. */
 export interface JoinRequest {
@@ -12,45 +14,133 @@ export interface JoinRequest {
     proposals: JoinProposal[];
 }
 /**
- * Join requests as PROPOSALS, and the reconciliation that retires them.
+ * Access requests as PROPOSALS, and the reconciliation that retires them.
  *
  * The lifecycle has no state of its own — it is derived, every time, from two
- * copies of one file:
+ * copies of one file (a folder's `access.md`, or a file's own frontmatter):
  *
- *   open        the branch's `access.md` grants something the default's does not
+ *   open        the branch proposes something the person does not already hold
  *   settled     it does not
  *
- * so "approve" is not an operation on the request at all. A manager grants a
+ * so "approve" is not an operation on the request at all. An editor grants a
  * principal through the ordinary access path (the same lock + commit every
  * other access edit uses, gated the same way), the default branch gains that
- * entry, and the proposal stops being pending because the diff no longer
- * contains it. When the last one goes, the change request has nothing left to
- * say and is rejected, its branch deleted.
+ * entry, and the proposal stops being pending.
  *
- * That reconciliation runs LAZILY on every listing as well as on demand, so a
- * grant made anywhere — this banner, the Manage-access dialog, a hand edit —
- * settles the request that asked for it. Nothing has to remember to.
+ * "Does not already hold" is stronger than "is not in the file", and
+ * deliberately so: Owner covers Can edit, a parent folder's grant covers this
+ * one, and a role or group carries access without naming anybody. Each of
+ * those would leave a proposal nobody can usefully accept — accepting writes
+ * a grant that changes nothing — and the request would sit open forever. See
+ * {@link JoinRequestsService.unmetProposals}.
+ *
+ * That reconciliation runs LAZILY on every listing as well as on demand, so
+ * access gained anywhere — this banner, the Manage access dialog, a hand
+ * edit, a role someone joined — settles the request that asked for it.
+ * Nothing has to remember to.
  */
-export declare class JoinRequestsService {
+export declare class JoinRequestsService implements IAccessRequestLifecycle {
     private readonly workspaceService;
     private readonly workflow;
     private readonly kb;
-    constructor(workspaceService: WorkspaceService, workflow: IWorkflowService, kb: Pick<KbContext, 'defaultBranch' | 'defaultWorkspaceId'>);
     /**
-     * Open join requests for `plugin`, each carrying only its still-pending
-     * proposals. Requests with none left are reconciled away (rejected, branch
-     * deleted) and omitted.
+     * Read-only, and asked one question only: does this person already hold
+     * this verb on the item, on the DEFAULT branch? See {@link unmetProposals}.
+     */
+    private readonly accessControl;
+    constructor(workspaceService: WorkspaceService, workflow: IWorkflowService, kb: Pick<KbContext, 'defaultBranch' | 'defaultWorkspaceId'>, 
+    /**
+     * Read-only, and asked one question only: does this person already hold
+     * this verb on the item, on the DEFAULT branch? See {@link unmetProposals}.
+     */
+    accessControl: Pick<IAccessControl, 'canRead' | 'canWrite' | 'canOwner' | 'canDownload'>);
+    /**
+     * What `branch` still proposes for `target`, minus everything the person it
+     * names already holds — or NULL when the branch's own copy could not be read
+     * at all.
+     *
+     * That distinction is the whole point of the return type. "The branch says
+     * nothing" is NOT "the branch proposes nothing", and the two arrive as the
+     * same empty diff: `pendingProposals` reads an unreadable file as carrying
+     * no grants (fail-closed, which is right for deciding what to SHOW). Used as
+     * the settle test it is fail-open in the one direction that cannot be taken
+     * back — it closes a request nobody answered.
+     *
+     * And unreadable is the normal case for a few seconds. These reads go
+     * through `origin/<branch>` in the DEFAULT branch's clone, whose fetch is
+     * throttled; a request opened moments ago names a ref that clone has not
+     * heard of. So a miss is retried behind a FORCED fetch before it is believed,
+     * and if it still misses the caller is told nothing rather than something
+     * false.
+     */
+    proposalsOn(branch: string, target: AccessRequestTarget, opts?: {
+        fresh?: boolean;
+    }): Promise<JoinProposal[] | null>;
+    /**
+     * Drop every proposal the live workspace has already ANSWERED, however it
+     * was answered.
+     *
+     * The file diff alone cannot see this. A request asking for `write` is
+     * satisfied by an `owner:` line, by a grant on a parent folder, or by a role
+     * or group the person has since joined — none of which put their email into
+     * this file, so the diff keeps reporting a proposal nobody can usefully
+     * accept (accepting writes a grant that changes nothing, and the request
+     * never retires). Asking the resolver the question the dialog's own grant
+     * would have to satisfy closes those requests instead of stranding them.
+     *
+     * A proposal naming a ROLE keeps the literal rule: "does this role hold the
+     * verb here" is not a question the per-person resolver answers, and a role
+     * proposal is answered by the live rules carrying it.
+     */
+    private unmetProposals;
+    /**
+     * Does `email` hold `verb` on the ITEM, on the default branch? The verb
+     * folds are the resolver's own (owner covers write, write covers read), so
+     * this asks exactly what an accepted grant would have to achieve.
+     *
+     * Best-effort in ONE direction: a resolver that fails answers "no", which
+     * leaves the request open. A failure must never close somebody's request for
+     * them.
+     */
+    private holds;
+    /**
+     * Open requests for one item, each carrying only what it still proposes.
+     * Requests with nothing left are reconciled away (rejected, branch deleted)
+     * and omitted.
+     *
+     * `key` is what named the branch (`joinBranchFor`) — a plugin's name for a
+     * Subscribe request, the item's own path for everything the Manage access
+     * dialog opens. `target` is the item whose rules those proposals edit; the
+     * two differ only for plugins, whose folder is not their name.
      *
-     * `actor` is who the reconciliation acts as — a manager of the plugin, since
+     * `actor` is who the reconciliation acts as — an editor of the item, since
      * rejecting a change request requires write on everything it touches.
      */
-    list(plugin: string, folder: string, crs: ChangeRequest[], actor: AuthUser): Promise<JoinRequest[]>;
+    list(key: string, target: AccessRequestTarget, crs: ChangeRequest[], actor: AuthUser): Promise<JoinRequest[]>;
     /**
      * Re-check ONE request and settle it if nothing is pending. Returns whether
      * it was settled. Called right after a grant so the banner updates in the
      * same round-trip instead of waiting for the next listing.
      */
-    reconcile(plugin: string, folder: string, cr: ChangeRequest, actor: AuthUser): Promise<boolean>;
+    reconcile(key: string, target: AccessRequestTarget, cr: ChangeRequest, actor: AuthUser): Promise<boolean>;
+    /**
+     * What the branch proposes, with an EMPTY answer confirmed against freshly
+     * fetched refs before anyone acts on it. Null keeps its meaning: nothing
+     * could be read, so nothing can be said.
+     *
+     * The confirmation is there because an empty answer is the terminal one.
+     * These reads go through `origin/<branch>` in the default branch's clone,
+     * and that clone's fetch is throttled — so a branch whose remote-tracking
+     * ref is a few seconds old answers with the commit BEFORE the proposal was
+     * pushed. That is a file identical to live, which is an empty diff, which
+     * reads as "every grant has landed". A request nobody answered is then
+     * closed, its branch deleted, and the person told it was not accepted.
+     *
+     * One extra fetch, on the one path that cannot be undone — and when that
+     * fetch turns up a proposal after all, it is the answer, not a discarded
+     * second opinion.
+     */
+    private confirmedProposals;
     /**
      * Close a request whose proposals have all landed, and delete its branch.
      *
@@ -77,6 +167,9 @@ export declare class JoinRequestsService {
      * Refresh remote-tracking refs before reading them. Throttled inside, and
      * best-effort: a request pushed seconds ago is worth one fetch, but a fetch
      * failure must degrade to "read what we have" rather than empty the list.
+     *
+     * `force` skips the throttle — for the one caller that has already missed
+     * and must not mistake a stale ref list for an answer.
      */
     private refresh;
 }

package/dist/modules/plugins/join-requests.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"join-requests.service.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/join-requests.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1E,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAFF,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,gBAAgB,EAC1B,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAG9E;;;;;;;OAOG;IACG,IAAI,CACR,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAAE,EACpB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,WAAW,EAAE,CAAC;IA2BzB;;;;OAIG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;OAWG;YACW,MAAM;IAgCpB;;;;;;;OAOG;YACW,MAAM;IAYpB;;;;OAIG;YACW,OAAO;CAKtB"}
+{"version":3,"file":"join-requests.service.d.ts","sourceRoot":"","sources":["../../../src/modules/plugins/join-requests.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1E,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,mBAAoB,YAAW,uBAAuB;IAE/D,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAPb,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,gBAAgB,EAC1B,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC5E;;;OAGG;IACc,aAAa,EAAE,IAAI,CAClC,cAAc,EACd,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,CACpD;IAGH;;;;;;;;;;;;;;;;;;OAkBG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAC7B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC;IAwBjC;;;;;;;;;;;;;;;OAeG;YACW,cAAc;IAgB5B;;;;;;;;OAQG;YACW,KAAK;IAuBnB;;;;;;;;;;;;OAYG;IACG,IAAI,CACR,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,aAAa,EAAE,EACpB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,WAAW,EAAE,CAAC;IAyBzB;;;;OAIG;IACG,SAAS,CACb,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,mBAAmB,EAC3B,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,OAAO,CAAC;IAUnB;;;;;;;;;;;;;;;;OAgBG;YACW,kBAAkB;IAShC;;;;;;;;;;;OAWG;YACW,MAAM;IAgCpB;;;;;;;OAOG;YACW,MAAM;IAYpB;;;;;;;OAOG;YACW,OAAO;CAKtB"}