@bevel-software/platform-shared 0.14.0 → 0.19.0

package/dist/workspace/entry-exists.d.ts

@@ -0,0 +1,27 @@
+/**
+ * THE sentence a rename, a move or a copy answers with when something is
+ * already at the destination.
+ *
+ * A rename is not a way to replace content: renaming a `.docx` onto an
+ * existing `.md` used to hand the markdown file the Word bytes and break the
+ * page. Every surface — the sidebar rename box, a drag onto a folder, the
+ * agent's `move_file` and `copy_file` — refuses with this one sentence, so a
+ * user who meets it in the sidebar and an agent that meets it in a tool
+ * result are told the same thing.
+ *
+ * Kept here, beside `filename.ts`, for the same reason that file is: the
+ * backend throws it and the frontend renders it, and neither should spell it
+ * its own way.
+ */
+/** What is already sitting at the destination. */
+export type ExistingEntryKind = 'file' | 'folder';
+/**
+ * `A file named <name> already exists in <folder>.` — `name` and `folder` are
+ * read off `destinationPath`, which may be workspace-relative or
+ * repo-relative; only its last two segments are used, so the reader sees the
+ * name they typed and the folder they were aiming at rather than a full path.
+ * A destination directly at the top of the tree has no folder segment to
+ * name, and says `the top level` instead.
+ */
+export declare function entryExistsMessage(kind: ExistingEntryKind, destinationPath: string): string;
+//# sourceMappingURL=entry-exists.d.ts.map

package/dist/workspace/entry-exists.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-exists.d.ts","sourceRoot":"","sources":["../../src/workspace/entry-exists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,kDAAkD;AAClD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAElD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAQ3F"}

package/dist/workspace/entry-exists.js

@@ -0,0 +1,33 @@
+/**
+ * THE sentence a rename, a move or a copy answers with when something is
+ * already at the destination.
+ *
+ * A rename is not a way to replace content: renaming a `.docx` onto an
+ * existing `.md` used to hand the markdown file the Word bytes and break the
+ * page. Every surface — the sidebar rename box, a drag onto a folder, the
+ * agent's `move_file` and `copy_file` — refuses with this one sentence, so a
+ * user who meets it in the sidebar and an agent that meets it in a tool
+ * result are told the same thing.
+ *
+ * Kept here, beside `filename.ts`, for the same reason that file is: the
+ * backend throws it and the frontend renders it, and neither should spell it
+ * its own way.
+ */
+/**
+ * `A file named <name> already exists in <folder>.` — `name` and `folder` are
+ * read off `destinationPath`, which may be workspace-relative or
+ * repo-relative; only its last two segments are used, so the reader sees the
+ * name they typed and the folder they were aiming at rather than a full path.
+ * A destination directly at the top of the tree has no folder segment to
+ * name, and says `the top level` instead.
+ */
+export function entryExistsMessage(kind, destinationPath) {
+    const segments = destinationPath
+        .replace(/\\/g, '/')
+        .split('/')
+        .filter((segment) => segment.length > 0 && segment !== '.');
+    const name = segments[segments.length - 1] ?? destinationPath;
+    const folder = segments.length > 1 ? segments[segments.length - 2] : 'the top level';
+    return `A ${kind} named ${name} already exists in ${folder}.`;
+}
+//# sourceMappingURL=entry-exists.js.map

package/dist/workspace/entry-exists.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-exists.js","sourceRoot":"","sources":["../../src/workspace/entry-exists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAuB,EAAE,eAAuB;IACjF,MAAM,QAAQ,GAAG,eAAe;SAC7B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IACrF,OAAO,KAAK,IAAI,UAAU,IAAI,sBAAsB,MAAM,GAAG,CAAC;AAChE,CAAC"}

package/dist/workspace/filename.d.ts

@@ -25,6 +25,21 @@ export declare function validateFilename(name: string): string | null;
  * `\` would round-trip differently on Windows vs the Linux container.
  */
 export declare function validateRelativePath(relativePath: string): string | null;
+/**
+ * ONE identity per file, so everything that coordinates on a path agrees about
+ * what it is coordinating on: an in-process queue, a database lock row, and
+ * the bytes on disk. {@link validateRelativePath} accepts a leading `./` and
+ * repeated slashes as spellings of the same path, and two callers spelling one
+ * file differently would otherwise take two different locks and write over
+ * each other. `.` and `..` segments are refused outright by the validator, so
+ * there is nothing to resolve here beyond the separators.
+ *
+ * Case is deliberately left alone. The deployment target is Linux, where
+ * `Foo.md` and `foo.md` are two different files; folding case to suit a
+ * case-insensitive development machine would merge two real files in
+ * production, which is a worse failure than the race it would close.
+ */
+export declare function canonicalRelativePath(relativePath: string): string;
 /**
  * Throwing wrapper for the backend service layer — keeps call sites a single
  * line and produces a clear `Error` the route handler can surface as a 400.

package/dist/workspace/filename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filename.d.ts","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsBH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2B5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAGlE"}
+{"version":3,"file":"filename.d.ts","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0BH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2B5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAelE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAGlE"}

package/dist/workspace/filename.js

@@ -21,9 +21,13 @@ const WINDOWS_RESERVED_NAMES = new Set([
 ]);
 /** Characters Windows forbids in any filename component. `/` is the path
  *  separator on Unix, included for the same reason. `\` is also a path
- *  separator on Windows. Control chars (0x00–0x1F) are rejected separately. */
+ *  separator on Windows. Control characters are rejected with them: NUL and
+ *  0x01–0x1F because Windows refuses them, and DEL (0x7F) — which every
+ *  filesystem would write — as a matter of hygiene: a name carrying a
+ *  character nobody can see or type is not a name people can share, and the
+ *  knowledge-base root names are validated by this same rule. */
 // eslint-disable-next-line no-control-regex
-const FORBIDDEN_CHARS = /[<>:"/\\|?*\x00-\x1F]/;
+const FORBIDDEN_CHARS = /[<>:"/\\|?*\x00-\x1F\x7F]/;
 /** Per-component byte limit: NTFS = 255 UTF-16 units, ext4 = 255 bytes,
  *  APFS = 255 UTF-8 bytes. Use UTF-8 bytes — the strictest of the three. */
 const MAX_NAME_BYTES = 255;
@@ -43,7 +47,7 @@ export function validateFilename(name) {
     if (name === '.' || name === '..')
         return 'Name cannot be "." or ".."';
     if (FORBIDDEN_CHARS.test(name)) {
-        return 'Name cannot contain any of these characters: < > : " / \\ | ? *';
+        return 'Name cannot contain control characters or any of: < > : " / \\ | ? *';
     }
     // Windows trims trailing dots and spaces silently — a name ending in either
     // becomes a different filename on disk, breaking sync between OSes.
@@ -86,6 +90,36 @@ export function validateRelativePath(relativePath) {
     }
     return null;
 }
+/**
+ * ONE identity per file, so everything that coordinates on a path agrees about
+ * what it is coordinating on: an in-process queue, a database lock row, and
+ * the bytes on disk. {@link validateRelativePath} accepts a leading `./` and
+ * repeated slashes as spellings of the same path, and two callers spelling one
+ * file differently would otherwise take two different locks and write over
+ * each other. `.` and `..` segments are refused outright by the validator, so
+ * there is nothing to resolve here beyond the separators.
+ *
+ * Case is deliberately left alone. The deployment target is Linux, where
+ * `Foo.md` and `foo.md` are two different files; folding case to suit a
+ * case-insensitive development machine would merge two real files in
+ * production, which is a worse failure than the race it would close.
+ */
+export function canonicalRelativePath(relativePath) {
+    // Never LAUNDER a path. Dropping empty segments would turn the absolute
+    // `/etc/passwd` into the perfectly ordinary `etc/passwd`, and an absolute
+    // path is exactly what `path.resolve` lets win over the workspace directory
+    // — which is why the workspace-boundary check refuses it today. A path this
+    // cannot canonicalise is returned UNCHANGED, so every gate downstream sees
+    // what the caller actually sent and goes on refusing it.
+    if (relativePath.startsWith('/') || validateRelativePath(relativePath) !== null) {
+        return relativePath;
+    }
+    return relativePath
+        .replace(/^\.\//, '')
+        .split('/')
+        .filter((segment) => segment.length > 0)
+        .join('/');
+}
 /**
  * Throwing wrapper for the backend service layer — keeps call sites a single
  * line and produces a clear `Error` the route handler can surface as a 400.

package/dist/workspace/filename.js.map

@@ -1 +1 @@
-{"version":3,"file":"filename.js","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;+EAC+E;AAC/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC/E,CAAC,CAAC;AAEH;;+EAE+E;AAC/E,4CAA4C;AAC5C,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD;4EAC4E;AAC5E,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,0CAA0C,CAAC;IAC5E,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,4BAA4B,CAAC;IAEvE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,iEAAiE,CAAC;IAC3E,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,uCAAuC,CAAC;IACjD,CAAC;IAED,iFAAiF;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,wCAAwC,CAAC;IAC1D,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAC9C,OAAO,yBAAyB,cAAc,SAAS,CAAC;IAC1D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,yBAAyB,OAAO,MAAM,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"filename.js","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;+EAC+E;AAC/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC/E,CAAC,CAAC;AAEH;;;;;;iEAMiE;AACjE,4CAA4C;AAC5C,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAEpD;4EAC4E;AAC5E,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,0CAA0C,CAAC;IAC5E,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,4BAA4B,CAAC;IAEvE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,sEAAsE,CAAC;IAChF,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,uCAAuC,CAAC;IACjD,CAAC;IAED,iFAAiF;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,wCAAwC,CAAC;IAC1D,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAC9C,OAAO,yBAAyB,cAAc,SAAS,CAAC;IAC1D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,yBAAyB,OAAO,MAAM,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;QAChF,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,YAAY;SAChB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;SACvC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC"}

package/dist/workspace/frontmatter-carriers.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Which files can carry their OWN frontmatter — and therefore their own
+ * per-file access rules.
+ *
+ * A file-level grant, revoke or restriction splices a `---` YAML block into
+ * the file itself. That is right for a Markdown note and destructive for
+ * anything else: spliced into a PDF, a presentation or an image it corrupts
+ * the bytes (the preview goes blank), and the grant never even resolves.
+ * Such a file takes its folder's rules instead.
+ *
+ * THE ONE predicate for that question: the access routes refuse a file-level
+ * mutation on a file it rejects, and the Manage access dialog shows the folder
+ * pointer for the same files.
+ *
+ * The carriers are exactly the files the access resolver reads its own
+ * frontmatter from — the backend's core access-frontmatter extension set:
+ * Markdown notes (`.md`) and `.tool` definitions (whole-document YAML whose
+ * access verbs sit beside the definition). Both are served by the file-reader
+ * registry's text-editable text reader. The registry test pins both facts, so
+ * this list cannot drift from the resolver or the registry silently. (Neither
+ * can live here: the registry's document readers carry backend-only extraction
+ * dependencies, and overlays register further extensions at boot — the backend
+ * passes its full registered set as `extensions`.)
+ *
+ * Matching is case-SENSITIVE, as the resolver's is: `Note.MD` carries no
+ * enforced rule, so a grant written there would never resolve. An extensionless
+ * file is NOT a carrier either: its content may be anything, and a path alone
+ * cannot tell a note from a binary.
+ */
+export declare const FRONTMATTER_CARRIER_EXTENSIONS: readonly string[];
+/**
+ * True when the file at `path` can carry its own frontmatter (and so its own
+ * access rules). `extensions` defaults to the core set; the backend passes the
+ * resolver's registered set so an overlay's kinds count too.
+ */
+export declare function canCarryFrontmatter(path: string, extensions?: readonly string[]): boolean;
+/** The `kind` a refused file-level access mutation answers with. */
+export declare const FOLDER_GOVERNS_ACCESS_KIND = "folder-governs-access";
+/**
+ * The one sentence both the 422 and the dialog say, naming the folder whose
+ * rules govern the file.
+ */
+export declare function folderGovernsAccessMessage(folder: string): string;
+//# sourceMappingURL=frontmatter-carriers.d.ts.map

package/dist/workspace/frontmatter-carriers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-carriers.d.ts","sourceRoot":"","sources":["../../src/workspace/frontmatter-carriers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAqB,CAAC;AAElF;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,SAAS,MAAM,EAAmC,GAC7D,OAAO,CAMT;AAED,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAElE;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjE"}

package/dist/workspace/frontmatter-carriers.js

@@ -0,0 +1,52 @@
+/**
+ * Which files can carry their OWN frontmatter — and therefore their own
+ * per-file access rules.
+ *
+ * A file-level grant, revoke or restriction splices a `---` YAML block into
+ * the file itself. That is right for a Markdown note and destructive for
+ * anything else: spliced into a PDF, a presentation or an image it corrupts
+ * the bytes (the preview goes blank), and the grant never even resolves.
+ * Such a file takes its folder's rules instead.
+ *
+ * THE ONE predicate for that question: the access routes refuse a file-level
+ * mutation on a file it rejects, and the Manage access dialog shows the folder
+ * pointer for the same files.
+ *
+ * The carriers are exactly the files the access resolver reads its own
+ * frontmatter from — the backend's core access-frontmatter extension set:
+ * Markdown notes (`.md`) and `.tool` definitions (whole-document YAML whose
+ * access verbs sit beside the definition). Both are served by the file-reader
+ * registry's text-editable text reader. The registry test pins both facts, so
+ * this list cannot drift from the resolver or the registry silently. (Neither
+ * can live here: the registry's document readers carry backend-only extraction
+ * dependencies, and overlays register further extensions at boot — the backend
+ * passes its full registered set as `extensions`.)
+ *
+ * Matching is case-SENSITIVE, as the resolver's is: `Note.MD` carries no
+ * enforced rule, so a grant written there would never resolve. An extensionless
+ * file is NOT a carrier either: its content may be anything, and a path alone
+ * cannot tell a note from a binary.
+ */
+export const FRONTMATTER_CARRIER_EXTENSIONS = ['.md', '.tool'];
+/**
+ * True when the file at `path` can carry its own frontmatter (and so its own
+ * access rules). `extensions` defaults to the core set; the backend passes the
+ * resolver's registered set so an overlay's kinds count too.
+ */
+export function canCarryFrontmatter(path, extensions = FRONTMATTER_CARRIER_EXTENSIONS) {
+    const name = path.slice(path.lastIndexOf('/') + 1);
+    // The resolver's own rule is a plain suffix match, so a file named exactly
+    // `.md` is read for its frontmatter there — and must be a carrier here too,
+    // or a rule the resolver honours could not be managed.
+    return extensions.some((ext) => name.endsWith(ext));
+}
+/** The `kind` a refused file-level access mutation answers with. */
+export const FOLDER_GOVERNS_ACCESS_KIND = 'folder-governs-access';
+/**
+ * The one sentence both the 422 and the dialog say, naming the folder whose
+ * rules govern the file.
+ */
+export function folderGovernsAccessMessage(folder) {
+    return `This file's access comes from its folder. Manage access on ${folder} instead.`;
+}
+//# sourceMappingURL=frontmatter-carriers.js.map

package/dist/workspace/frontmatter-carriers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-carriers.js","sourceRoot":"","sources":["../../src/workspace/frontmatter-carriers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAElF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,aAAgC,8BAA8B;IAE9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAElE;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,OAAO,8DAA8D,MAAM,WAAW,CAAC;AACzF,CAAC"}

package/dist/workspace/frontmatter.d.ts

@@ -1,9 +1,28 @@
+/**
+ * THE fence rule: a line is a frontmatter fence when, whitespace aside, it is
+ * exactly `---`. Forgiving on purpose — an opening fence with a trailing space
+ * or an indented fence is still a fence.
+ *
+ * Every reader in the platform asks this one function. The access model's
+ * line scan always judged fences this way while the splitter below demanded
+ * `---` at column 0, so a file written with a near-miss fence had access
+ * rules that applied while the catalog, the tool manuals and the frontmatter
+ * panel saw no frontmatter at all. One rule, asked everywhere, is what keeps
+ * a file from meaning two things.
+ */
+export declare function isFrontmatterFence(line: string | undefined): boolean;
 /**
  * The ONE `---` frontmatter splitter, shared by backend and frontend so no file
- * type grows its own regex. Splits a leading `---`-fenced YAML block from the
- * body; null when the text doesn't open with a fence. Parsing the YAML inside is
- * the caller's concern (the access-control resolver deliberately keeps its own
- * hardened line-based reader — see `modules/access/access-splice.ts`).
+ * type grows its own reader. Splits a leading fenced YAML block from the body;
+ * null when the first line is not a fence or no later line closes it. Fences
+ * are judged by {@link isFrontmatterFence}. Parsing the YAML inside is the
+ * caller's concern (the access model keeps its own line scan, on the same
+ * fence rule, because a splice must put bytes back exactly as it found them).
+ *
+ * `frontmatter` is the raw text between the fence lines and `body` the raw
+ * text after the closing fence's line break, both byte for byte — line
+ * endings included — so a caller that rebuilds the file changes nothing it
+ * did not mean to.
  */
 export declare function extractFrontmatter(text: string): {
     frontmatter: string;

package/dist/workspace/frontmatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/workspace/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAI7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAqBpF"}
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/workspace/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4B7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAwBpF"}

package/dist/workspace/frontmatter.js

@@ -1,15 +1,62 @@
+/**
+ * THE fence rule: a line is a frontmatter fence when, whitespace aside, it is
+ * exactly `---`. Forgiving on purpose — an opening fence with a trailing space
+ * or an indented fence is still a fence.
+ *
+ * Every reader in the platform asks this one function. The access model's
+ * line scan always judged fences this way while the splitter below demanded
+ * `---` at column 0, so a file written with a near-miss fence had access
+ * rules that applied while the catalog, the tool manuals and the frontmatter
+ * panel saw no frontmatter at all. One rule, asked everywhere, is what keeps
+ * a file from meaning two things.
+ */
+export function isFrontmatterFence(line) {
+    return line?.trim() === '---';
+}
 /**
  * The ONE `---` frontmatter splitter, shared by backend and frontend so no file
- * type grows its own regex. Splits a leading `---`-fenced YAML block from the
- * body; null when the text doesn't open with a fence. Parsing the YAML inside is
- * the caller's concern (the access-control resolver deliberately keeps its own
- * hardened line-based reader — see `modules/access/access-splice.ts`).
+ * type grows its own reader. Splits a leading fenced YAML block from the body;
+ * null when the first line is not a fence or no later line closes it. Fences
+ * are judged by {@link isFrontmatterFence}. Parsing the YAML inside is the
+ * caller's concern (the access model keeps its own line scan, on the same
+ * fence rule, because a splice must put bytes back exactly as it found them).
+ *
+ * `frontmatter` is the raw text between the fence lines and `body` the raw
+ * text after the closing fence's line break, both byte for byte — line
+ * endings included — so a caller that rebuilds the file changes nothing it
+ * did not mean to.
  */
 export function extractFrontmatter(text) {
-    const m = text.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
-    if (!m)
-        return null;
-    return { frontmatter: m[1], body: m[2] };
+    // Walk the lines by offset rather than splitting, so both halves can be
+    // sliced out of the original text with their own line endings intact.
+    let start = 0;
+    let lineIndex = 0;
+    let openEnd = -1; // offset just past the opening fence's line break
+    while (start <= text.length) {
+        const nl = text.indexOf('\n', start);
+        const end = nl === -1 ? text.length : nl;
+        const line = text.slice(start, end).replace(/\r$/, '');
+        const next = nl === -1 ? text.length + 1 : nl + 1;
+        if (lineIndex === 0) {
+            // A lone `---` with nothing after it opens nothing.
+            if (!isFrontmatterFence(line) || nl === -1)
+                return null;
+            openEnd = next;
+        }
+        else if (isFrontmatterFence(line)) {
+            // The frontmatter ends before the line break that precedes this fence.
+            const fmEnd = start - (start >= 2 && text[start - 2] === '\r' ? 2 : 1);
+            return {
+                frontmatter: fmEnd > openEnd ? text.slice(openEnd, fmEnd) : '',
+                body: next > text.length ? '' : text.slice(next),
+            };
+        }
+        if (nl === -1)
+            return null; // never closed
+        start = next;
+        lineIndex += 1;
+    }
+    return null;
 }
 /**
  * Set a top-level scalar key in a file's `---` frontmatter, LINE-based: replace an
@@ -37,7 +84,10 @@ export function setFrontmatterField(text, key, value) {
         // No frontmatter — prepend a fresh block, keeping the original body intact.
         return `---${eol}${line}${eol}---${eol}${text}`;
     }
-    const fmLines = fm.frontmatter.split(/\r?\n/);
+    // An empty block has no lines, not one empty line: splitting '' would give
+    // [''], and the inserted key would be followed by a blank line before the
+    // closing fence.
+    const fmLines = fm.frontmatter === '' ? [] : fm.frontmatter.split(/\r?\n/);
     const idx = fmLines.findIndex((l) => keyRe.test(l));
     if (idx >= 0)
         fmLines[idx] = line;

package/dist/workspace/frontmatter.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../src/workspace/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa;IAC1E,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC;IAChC,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACrF,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,4EAA4E;QAC5E,OAAO,MAAM,GAAG,GAAG,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;QAC7B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../src/workspace/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,OAAO,IAAI,EAAE,IAAI,EAAE,KAAK,KAAK,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,kDAAkD;IACpE,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,oDAAoD;YACpD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,uEAAuE;YACvE,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,OAAO;gBACL,WAAW,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC9D,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;aACjD,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,eAAe;QAC3C,KAAK,GAAG,IAAI,CAAC;QACb,SAAS,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa;IAC1E,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC;IAChC,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACrF,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,4EAA4E;QAC5E,OAAO,MAAM,GAAG,GAAG,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,iBAAiB;IACjB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;QAC7B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC"}