@bevel-software/platform-shared 0.15.1 → 0.20.0

package/dist/workflow/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/workflow/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAI5B,qDAAqD;AACrD,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAItD;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAI9C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAC/B,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAIxC;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAC/C,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACpD,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAClD,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAC7C,MAAM,MAAM,wBAAwB,GAAG,aAAa,CAAC;AACrD,MAAM,MAAM,yBAAyB,GAAG,cAAc,CAAC;AACvD,MAAM,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACnD,MAAM,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,2BAA2B,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/workflow/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAI5B,qDAAqD;AACrD,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAItD;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAI9C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAC/B,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAIxC;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAC/C,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACpD,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAClD,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAC7C,MAAM,MAAM,wBAAwB,GAAG,aAAa,CAAC;AACrD,MAAM,MAAM,yBAAyB,GAAG,cAAc,CAAC;AACvD,MAAM,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACnD,MAAM,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8BAA8B;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjE,gEAAgE;AAChE,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,2BAA2B,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErE;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,2BAA2B,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/workspace/access-verbs.d.ts

@@ -0,0 +1,83 @@
+/**
+ * The access verbs and the ONE dependency graph between them.
+ *
+ * Shared so that everything that folds verbs — the resolver in core-backend,
+ * the eligible lists it serves, and the share dialog in core-frontend that
+ * renders and edits them — reads the same table. A second fold written out by
+ * hand somewhere else is how the sheet comes to show "Owner" for someone the
+ * resolver refuses, or writes a `read:` line under an `owner:` it just granted.
+ *
+ * `read` controls who may VIEW a path. It is default-deny: a path with no
+ * effective grant of any verb is not readable. `write` is editing (and, with
+ * it, approval rights), `download` is saving a copy, `owner` is the contact
+ * point for the node and the right to manage its access.
+ */
+/**
+ * Verbs an `access.md` frontmatter can grant, each a list of principals
+ * optionally prefixed with `deny `. `AccessFile.entries` in the backend is
+ * statically keyed on this union; keep `Verb` and `KNOWN_VERBS` in lockstep.
+ */
+export declare const KNOWN_VERBS: readonly ["read", "write", "download", "owner"];
+export type Verb = (typeof KNOWN_VERBS)[number];
+/**
+ * THE DEPENDENCY GRAPH — what holding each verb presupposes, declared once.
+ * `owner` presupposes `write` and `download`; `write` and `download` each
+ * presuppose `read`; `read` presupposes nothing. Everything about how verbs
+ * fold into one another is DERIVED from this table, in both directions:
+ *
+ *   - a GRANT confers, downwards, every verb the granted one presupposes
+ *     (`sourceVerbsFor`, `effectiveVerbs`): an owner may edit, save and open;
+ *     an editor may open; someone trusted with a copy may open it;
+ *   - a DENIAL strips, upwards, every verb that presupposes the denied one
+ *     (`requiredVerbsFor`): nobody owns what they may not edit, and nobody
+ *     edits or saves what they may not open.
+ *
+ * Neither converse is implied: a `deny write` says nothing about `read`, and a
+ * `read` grant confers no `write`. `write` and `download` are independent of
+ * each other. Add a verb, or change what one presupposes, HERE and nowhere
+ * else; every list and fold below follows.
+ */
+export declare const VERB_REQUIRES: Readonly<Record<Verb, readonly Verb[]>>;
+/**
+ * Verbs whose GRANT confers `verb`, target verb first: `verb` itself, then
+ * every verb that presupposes it, in `KNOWN_VERBS` order.
+ */
+export declare function sourceVerbsFor(verb: Verb): Verb[];
+/**
+ * Verbs whose DENIAL strips `verb`, target verb first: `verb` itself, then
+ * every verb it presupposes, in `KNOWN_VERBS` order.
+ */
+export declare function requiredVerbsFor(verb: Verb): Verb[];
+/**
+ * The verbs in the order a change to a principal's set has to be APPLIED:
+ * broadest first, so every verb comes before the verbs it presupposes (ties in
+ * `KNOWN_VERBS` order). Lowering must start at the top — denying `write` while
+ * an `owner:` grant still stands in the same file is refused as ineffective,
+ * since owner confers write; stripping owner first removes what was conferring
+ * it. Raising reads the same order for the opposite reason: granting `owner`
+ * first satisfies the rest in one line.
+ */
+export declare const VERBS_BROADEST_FIRST: readonly Verb[];
+/** One flag per verb: what a principal holds, or what a form has ticked. */
+export type VerbSet = Record<Verb, boolean>;
+/** A partial set — flags left out read as not held. */
+export type VerbFlags = Partial<Record<Verb, boolean>>;
+/**
+ * The grant fold, as a whole set: what a principal EFFECTIVELY holds given the
+ * verbs they are granted. Each verb is held when it, or any verb that
+ * presupposes it, is in `held`. Idempotent on an already-folded set.
+ */
+export declare function effectiveVerbs(held: VerbFlags): VerbSet;
+/**
+ * True when some OTHER verb in `held` confers `verb` — it is implied, not
+ * chosen, which is what a form renders as checked-and-disabled.
+ */
+export declare function conferredByOthers(held: VerbFlags, verb: Verb): boolean;
+/**
+ * The fewest grant lines that produce `held`: every held verb that no other
+ * held verb confers, broadest first. `{ owner }` is one line; `{ write, read,
+ * download }` is `write` and `download` (read rides on either); `{ read,
+ * download }` is `download` alone. A flag left out is not granted.
+ */
+export declare function minimalGrantVerbs(held: VerbFlags): Verb[];
+//# sourceMappingURL=access-verbs.d.ts.map

package/dist/workspace/access-verbs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-verbs.d.ts","sourceRoot":"","sources":["../../src/workspace/access-verbs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW,iDAAkD,CAAC;AAC3E,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAKjE,CAAC;AAcF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,CAEjD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,CAGnD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,IAAI,EAG/C,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5C,uDAAuD;AACvD,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAIvD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAEtE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,EAAE,CAEzD"}

package/dist/workspace/access-verbs.js

@@ -0,0 +1,110 @@
+/**
+ * The access verbs and the ONE dependency graph between them.
+ *
+ * Shared so that everything that folds verbs — the resolver in core-backend,
+ * the eligible lists it serves, and the share dialog in core-frontend that
+ * renders and edits them — reads the same table. A second fold written out by
+ * hand somewhere else is how the sheet comes to show "Owner" for someone the
+ * resolver refuses, or writes a `read:` line under an `owner:` it just granted.
+ *
+ * `read` controls who may VIEW a path. It is default-deny: a path with no
+ * effective grant of any verb is not readable. `write` is editing (and, with
+ * it, approval rights), `download` is saving a copy, `owner` is the contact
+ * point for the node and the right to manage its access.
+ */
+/**
+ * Verbs an `access.md` frontmatter can grant, each a list of principals
+ * optionally prefixed with `deny `. `AccessFile.entries` in the backend is
+ * statically keyed on this union; keep `Verb` and `KNOWN_VERBS` in lockstep.
+ */
+export const KNOWN_VERBS = ['read', 'write', 'download', 'owner'];
+/**
+ * THE DEPENDENCY GRAPH — what holding each verb presupposes, declared once.
+ * `owner` presupposes `write` and `download`; `write` and `download` each
+ * presuppose `read`; `read` presupposes nothing. Everything about how verbs
+ * fold into one another is DERIVED from this table, in both directions:
+ *
+ *   - a GRANT confers, downwards, every verb the granted one presupposes
+ *     (`sourceVerbsFor`, `effectiveVerbs`): an owner may edit, save and open;
+ *     an editor may open; someone trusted with a copy may open it;
+ *   - a DENIAL strips, upwards, every verb that presupposes the denied one
+ *     (`requiredVerbsFor`): nobody owns what they may not edit, and nobody
+ *     edits or saves what they may not open.
+ *
+ * Neither converse is implied: a `deny write` says nothing about `read`, and a
+ * `read` grant confers no `write`. `write` and `download` are independent of
+ * each other. Add a verb, or change what one presupposes, HERE and nowhere
+ * else; every list and fold below follows.
+ */
+export const VERB_REQUIRES = {
+    read: [],
+    write: ['read'],
+    download: ['read'],
+    owner: ['write', 'download'],
+};
+/** `verb` and everything it presupposes, transitively. */
+function presupposedBy(verb) {
+    const out = new Set();
+    const visit = (v) => {
+        if (out.has(v))
+            return;
+        out.add(v);
+        for (const dep of VERB_REQUIRES[v])
+            visit(dep);
+    };
+    visit(verb);
+    return out;
+}
+/**
+ * Verbs whose GRANT confers `verb`, target verb first: `verb` itself, then
+ * every verb that presupposes it, in `KNOWN_VERBS` order.
+ */
+export function sourceVerbsFor(verb) {
+    return [verb, ...KNOWN_VERBS.filter((v) => v !== verb && presupposedBy(v).has(verb))];
+}
+/**
+ * Verbs whose DENIAL strips `verb`, target verb first: `verb` itself, then
+ * every verb it presupposes, in `KNOWN_VERBS` order.
+ */
+export function requiredVerbsFor(verb) {
+    const needs = presupposedBy(verb);
+    return [verb, ...KNOWN_VERBS.filter((v) => v !== verb && needs.has(v))];
+}
+/**
+ * The verbs in the order a change to a principal's set has to be APPLIED:
+ * broadest first, so every verb comes before the verbs it presupposes (ties in
+ * `KNOWN_VERBS` order). Lowering must start at the top — denying `write` while
+ * an `owner:` grant still stands in the same file is refused as ineffective,
+ * since owner confers write; stripping owner first removes what was conferring
+ * it. Raising reads the same order for the opposite reason: granting `owner`
+ * first satisfies the rest in one line.
+ */
+export const VERBS_BROADEST_FIRST = [...KNOWN_VERBS].sort((a, b) => presupposedBy(b).size - presupposedBy(a).size || KNOWN_VERBS.indexOf(a) - KNOWN_VERBS.indexOf(b));
+/**
+ * The grant fold, as a whole set: what a principal EFFECTIVELY holds given the
+ * verbs they are granted. Each verb is held when it, or any verb that
+ * presupposes it, is in `held`. Idempotent on an already-folded set.
+ */
+export function effectiveVerbs(held) {
+    const out = {};
+    for (const verb of KNOWN_VERBS)
+        out[verb] = sourceVerbsFor(verb).some((w) => held[w] === true);
+    return out;
+}
+/**
+ * True when some OTHER verb in `held` confers `verb` — it is implied, not
+ * chosen, which is what a form renders as checked-and-disabled.
+ */
+export function conferredByOthers(held, verb) {
+    return sourceVerbsFor(verb).some((w) => w !== verb && held[w] === true);
+}
+/**
+ * The fewest grant lines that produce `held`: every held verb that no other
+ * held verb confers, broadest first. `{ owner }` is one line; `{ write, read,
+ * download }` is `write` and `download` (read rides on either); `{ read,
+ * download }` is `download` alone. A flag left out is not granted.
+ */
+export function minimalGrantVerbs(held) {
+    return VERBS_BROADEST_FIRST.filter((verb) => held[verb] === true && !conferredByOthers(held, verb));
+}
+//# sourceMappingURL=access-verbs.js.map

package/dist/workspace/access-verbs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-verbs.js","sourceRoot":"","sources":["../../src/workspace/access-verbs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAG3E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,aAAa,GAA4C;IACpE,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,CAAC,MAAM,CAAC;IACf,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF,0DAA0D;AAC1D,SAAS,aAAa,CAAC,IAAU;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAO,EAAE,EAAE;QACxB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACX,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAU;IACvC,OAAO,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAU;IACzC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAoB,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CACxE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CACnG,CAAC;AAOF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAe;IAC5C,MAAM,GAAG,GAAG,EAAa,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/F,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAe,EAAE,IAAU;IAC3D,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAe;IAC/C,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACtG,CAAC"}

package/dist/workspace/agent-preamble.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The rules about the deployment preamble's TEXT that both sides need to
+ * agree on: the file it lives in, the caps it is cut at, and what counts as a
+ * private comment inside it.
+ *
+ * These lived in the backend composer and were mirrored by hand in the
+ * frontend editor, whose own comment said so. The two are not free to differ:
+ * the editor decides what an admin is shown and what it writes back, the
+ * composer decides what agents receive, and a drift between them shows the
+ * admin one description while agents get another.
+ *
+ * Pure: no IO, no clock, no platform assumptions.
+ */
+/** The repository-root file an admin edits. */
+export declare const PREAMBLE_FILE = "mcp-description.md";
+/** UTF-16 units of preamble sent on the handshake before the marker replaces the rest. */
+export declare const PREAMBLE_CAP = 6000;
+/** UTF-16 units of the whole tool prefix (fixed line included). */
+export declare const TOOL_PREFIX_CAP = 300;
+/**
+ * Remove every `<!-- … -->` block.
+ *
+ * A `<!--` that is never closed takes the rest of the text with it and is
+ * reported, so a caller can warn: that is the fail-closed half of the rule,
+ * and it is why an admin's private note cannot leak through the likeliest
+ * editing slip. The editor strips the same blocks to decide what to show, and
+ * closes an unterminated one when it writes back.
+ */
+export declare function stripHtmlComments(text: string): {
+    text: string;
+    unterminated: boolean;
+};
+//# sourceMappingURL=agent-preamble.d.ts.map

package/dist/workspace/agent-preamble.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-preamble.d.ts","sourceRoot":"","sources":["../../src/workspace/agent-preamble.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAElD,0FAA0F;AAC1F,eAAO,MAAM,YAAY,OAAQ,CAAC;AAElC,mEAAmE;AACnE,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,CAcvF"}

package/dist/workspace/agent-preamble.js

@@ -0,0 +1,45 @@
+/**
+ * The rules about the deployment preamble's TEXT that both sides need to
+ * agree on: the file it lives in, the caps it is cut at, and what counts as a
+ * private comment inside it.
+ *
+ * These lived in the backend composer and were mirrored by hand in the
+ * frontend editor, whose own comment said so. The two are not free to differ:
+ * the editor decides what an admin is shown and what it writes back, the
+ * composer decides what agents receive, and a drift between them shows the
+ * admin one description while agents get another.
+ *
+ * Pure: no IO, no clock, no platform assumptions.
+ */
+/** The repository-root file an admin edits. */
+export const PREAMBLE_FILE = 'mcp-description.md';
+/** UTF-16 units of preamble sent on the handshake before the marker replaces the rest. */
+export const PREAMBLE_CAP = 6_000;
+/** UTF-16 units of the whole tool prefix (fixed line included). */
+export const TOOL_PREFIX_CAP = 300;
+/**
+ * Remove every `<!-- … -->` block.
+ *
+ * A `<!--` that is never closed takes the rest of the text with it and is
+ * reported, so a caller can warn: that is the fail-closed half of the rule,
+ * and it is why an admin's private note cannot leak through the likeliest
+ * editing slip. The editor strips the same blocks to decide what to show, and
+ * closes an unterminated one when it writes back.
+ */
+export function stripHtmlComments(text) {
+    let out = '';
+    let from = 0;
+    for (;;) {
+        const open = text.indexOf('<!--', from);
+        if (open === -1) {
+            out += text.slice(from);
+            return { text: out, unterminated: false };
+        }
+        out += text.slice(from, open);
+        const close = text.indexOf('-->', open + 4);
+        if (close === -1)
+            return { text: out, unterminated: true };
+        from = close + 3;
+    }
+}
+//# sourceMappingURL=agent-preamble.js.map

package/dist/workspace/agent-preamble.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-preamble.js","sourceRoot":"","sources":["../../src/workspace/agent-preamble.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAElD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAElC,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YAChB,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC3D,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/workspace/entry-exists.d.ts

@@ -0,0 +1,27 @@
+/**
+ * THE sentence a rename, a move or a copy answers with when something is
+ * already at the destination.
+ *
+ * A rename is not a way to replace content: renaming a `.docx` onto an
+ * existing `.md` used to hand the markdown file the Word bytes and break the
+ * page. Every surface — the sidebar rename box, a drag onto a folder, the
+ * agent's `move_file` and `copy_file` — refuses with this one sentence, so a
+ * user who meets it in the sidebar and an agent that meets it in a tool
+ * result are told the same thing.
+ *
+ * Kept here, beside `filename.ts`, for the same reason that file is: the
+ * backend throws it and the frontend renders it, and neither should spell it
+ * its own way.
+ */
+/** What is already sitting at the destination. */
+export type ExistingEntryKind = 'file' | 'folder';
+/**
+ * `A file named <name> already exists in <folder>.` — `name` and `folder` are
+ * read off `destinationPath`, which may be workspace-relative or
+ * repo-relative; only its last two segments are used, so the reader sees the
+ * name they typed and the folder they were aiming at rather than a full path.
+ * A destination directly at the top of the tree has no folder segment to
+ * name, and says `the top level` instead.
+ */
+export declare function entryExistsMessage(kind: ExistingEntryKind, destinationPath: string): string;
+//# sourceMappingURL=entry-exists.d.ts.map

package/dist/workspace/entry-exists.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-exists.d.ts","sourceRoot":"","sources":["../../src/workspace/entry-exists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,kDAAkD;AAClD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAElD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAQ3F"}

package/dist/workspace/entry-exists.js

@@ -0,0 +1,33 @@
+/**
+ * THE sentence a rename, a move or a copy answers with when something is
+ * already at the destination.
+ *
+ * A rename is not a way to replace content: renaming a `.docx` onto an
+ * existing `.md` used to hand the markdown file the Word bytes and break the
+ * page. Every surface — the sidebar rename box, a drag onto a folder, the
+ * agent's `move_file` and `copy_file` — refuses with this one sentence, so a
+ * user who meets it in the sidebar and an agent that meets it in a tool
+ * result are told the same thing.
+ *
+ * Kept here, beside `filename.ts`, for the same reason that file is: the
+ * backend throws it and the frontend renders it, and neither should spell it
+ * its own way.
+ */
+/**
+ * `A file named <name> already exists in <folder>.` — `name` and `folder` are
+ * read off `destinationPath`, which may be workspace-relative or
+ * repo-relative; only its last two segments are used, so the reader sees the
+ * name they typed and the folder they were aiming at rather than a full path.
+ * A destination directly at the top of the tree has no folder segment to
+ * name, and says `the top level` instead.
+ */
+export function entryExistsMessage(kind, destinationPath) {
+    const segments = destinationPath
+        .replace(/\\/g, '/')
+        .split('/')
+        .filter((segment) => segment.length > 0 && segment !== '.');
+    const name = segments[segments.length - 1] ?? destinationPath;
+    const folder = segments.length > 1 ? segments[segments.length - 2] : 'the top level';
+    return `A ${kind} named ${name} already exists in ${folder}.`;
+}
+//# sourceMappingURL=entry-exists.js.map

package/dist/workspace/entry-exists.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-exists.js","sourceRoot":"","sources":["../../src/workspace/entry-exists.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAuB,EAAE,eAAuB;IACjF,MAAM,QAAQ,GAAG,eAAe;SAC7B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IACrF,OAAO,KAAK,IAAI,UAAU,IAAI,sBAAsB,MAAM,GAAG,CAAC;AAChE,CAAC"}

package/dist/workspace/filename.d.ts

@@ -25,6 +25,21 @@ export declare function validateFilename(name: string): string | null;
  * `\` would round-trip differently on Windows vs the Linux container.
  */
 export declare function validateRelativePath(relativePath: string): string | null;
+/**
+ * ONE identity per file, so everything that coordinates on a path agrees about
+ * what it is coordinating on: an in-process queue, a database lock row, and
+ * the bytes on disk. {@link validateRelativePath} accepts a leading `./` and
+ * repeated slashes as spellings of the same path, and two callers spelling one
+ * file differently would otherwise take two different locks and write over
+ * each other. `.` and `..` segments are refused outright by the validator, so
+ * there is nothing to resolve here beyond the separators.
+ *
+ * Case is deliberately left alone. The deployment target is Linux, where
+ * `Foo.md` and `foo.md` are two different files; folding case to suit a
+ * case-insensitive development machine would merge two real files in
+ * production, which is a worse failure than the race it would close.
+ */
+export declare function canonicalRelativePath(relativePath: string): string;
 /**
  * Throwing wrapper for the backend service layer — keeps call sites a single
  * line and produces a clear `Error` the route handler can surface as a 400.

package/dist/workspace/filename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filename.d.ts","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0BH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2B5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAGlE"}
+{"version":3,"file":"filename.d.ts","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0BH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2B5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAelE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAGlE"}

package/dist/workspace/filename.js

@@ -90,6 +90,36 @@ export function validateRelativePath(relativePath) {
     }
     return null;
 }
+/**
+ * ONE identity per file, so everything that coordinates on a path agrees about
+ * what it is coordinating on: an in-process queue, a database lock row, and
+ * the bytes on disk. {@link validateRelativePath} accepts a leading `./` and
+ * repeated slashes as spellings of the same path, and two callers spelling one
+ * file differently would otherwise take two different locks and write over
+ * each other. `.` and `..` segments are refused outright by the validator, so
+ * there is nothing to resolve here beyond the separators.
+ *
+ * Case is deliberately left alone. The deployment target is Linux, where
+ * `Foo.md` and `foo.md` are two different files; folding case to suit a
+ * case-insensitive development machine would merge two real files in
+ * production, which is a worse failure than the race it would close.
+ */
+export function canonicalRelativePath(relativePath) {
+    // Never LAUNDER a path. Dropping empty segments would turn the absolute
+    // `/etc/passwd` into the perfectly ordinary `etc/passwd`, and an absolute
+    // path is exactly what `path.resolve` lets win over the workspace directory
+    // — which is why the workspace-boundary check refuses it today. A path this
+    // cannot canonicalise is returned UNCHANGED, so every gate downstream sees
+    // what the caller actually sent and goes on refusing it.
+    if (relativePath.startsWith('/') || validateRelativePath(relativePath) !== null) {
+        return relativePath;
+    }
+    return relativePath
+        .replace(/^\.\//, '')
+        .split('/')
+        .filter((segment) => segment.length > 0)
+        .join('/');
+}
 /**
  * Throwing wrapper for the backend service layer — keeps call sites a single
  * line and produces a clear `Error` the route handler can surface as a 400.

package/dist/workspace/filename.js.map

@@ -1 +1 @@
-{"version":3,"file":"filename.js","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;+EAC+E;AAC/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC/E,CAAC,CAAC;AAEH;;;;;;iEAMiE;AACjE,4CAA4C;AAC5C,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAEpD;4EAC4E;AAC5E,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,0CAA0C,CAAC;IAC5E,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,4BAA4B,CAAC;IAEvE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,sEAAsE,CAAC;IAChF,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,uCAAuC,CAAC;IACjD,CAAC;IAED,iFAAiF;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,wCAAwC,CAAC;IAC1D,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAC9C,OAAO,yBAAyB,cAAc,SAAS,CAAC;IAC1D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,yBAAyB,OAAO,MAAM,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"filename.js","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;+EAC+E;AAC/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC/E,CAAC,CAAC;AAEH;;;;;;iEAMiE;AACjE,4CAA4C;AAC5C,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAEpD;4EAC4E;AAC5E,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,0CAA0C,CAAC;IAC5E,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,4BAA4B,CAAC;IAEvE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,sEAAsE,CAAC;IAChF,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,uCAAuC,CAAC;IACjD,CAAC;IAED,iFAAiF;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,wCAAwC,CAAC;IAC1D,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAC9C,OAAO,yBAAyB,cAAc,SAAS,CAAC;IAC1D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,yBAAyB,OAAO,MAAM,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;QAChF,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,YAAY;SAChB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;SACvC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC"}

package/dist/workspace/frontmatter-carriers.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Which files can carry their OWN frontmatter — and therefore their own
+ * per-file access rules.
+ *
+ * A file-level grant, revoke or restriction splices a `---` YAML block into
+ * the file itself. That is right for a Markdown note and destructive for
+ * anything else: spliced into a PDF, a presentation or an image it corrupts
+ * the bytes (the preview goes blank), and the grant never even resolves.
+ * Such a file takes its folder's rules instead.
+ *
+ * THE ONE predicate for that question: the access routes refuse a file-level
+ * mutation on a file it rejects, and the Manage access dialog shows the folder
+ * pointer for the same files.
+ *
+ * The carriers are exactly the files the access resolver reads its own
+ * frontmatter from — the backend's core access-frontmatter extension set:
+ * Markdown notes (`.md`) and `.tool` definitions (whole-document YAML whose
+ * access verbs sit beside the definition). Both are served by the file-reader
+ * registry's text-editable text reader. The registry test pins both facts, so
+ * this list cannot drift from the resolver or the registry silently. (Neither
+ * can live here: the registry's document readers carry backend-only extraction
+ * dependencies, and overlays register further extensions at boot — the backend
+ * passes its full registered set as `extensions`.)
+ *
+ * Matching is case-SENSITIVE, as the resolver's is: `Note.MD` carries no
+ * enforced rule, so a grant written there would never resolve. An extensionless
+ * file is NOT a carrier either: its content may be anything, and a path alone
+ * cannot tell a note from a binary.
+ */
+export declare const FRONTMATTER_CARRIER_EXTENSIONS: readonly string[];
+/**
+ * True when the file at `path` can carry its own frontmatter (and so its own
+ * access rules). `extensions` defaults to the core set; the backend passes the
+ * resolver's registered set so an overlay's kinds count too.
+ */
+export declare function canCarryFrontmatter(path: string, extensions?: readonly string[]): boolean;
+/** The `kind` a refused file-level access mutation answers with. */
+export declare const FOLDER_GOVERNS_ACCESS_KIND = "folder-governs-access";
+/**
+ * The one sentence both the 422 and the dialog say, naming the folder whose
+ * rules govern the file.
+ */
+export declare function folderGovernsAccessMessage(folder: string): string;
+//# sourceMappingURL=frontmatter-carriers.d.ts.map

package/dist/workspace/frontmatter-carriers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-carriers.d.ts","sourceRoot":"","sources":["../../src/workspace/frontmatter-carriers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAqB,CAAC;AAElF;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,SAAS,MAAM,EAAmC,GAC7D,OAAO,CAMT;AAED,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAElE;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjE"}

package/dist/workspace/frontmatter-carriers.js

@@ -0,0 +1,52 @@
+/**
+ * Which files can carry their OWN frontmatter — and therefore their own
+ * per-file access rules.
+ *
+ * A file-level grant, revoke or restriction splices a `---` YAML block into
+ * the file itself. That is right for a Markdown note and destructive for
+ * anything else: spliced into a PDF, a presentation or an image it corrupts
+ * the bytes (the preview goes blank), and the grant never even resolves.
+ * Such a file takes its folder's rules instead.
+ *
+ * THE ONE predicate for that question: the access routes refuse a file-level
+ * mutation on a file it rejects, and the Manage access dialog shows the folder
+ * pointer for the same files.
+ *
+ * The carriers are exactly the files the access resolver reads its own
+ * frontmatter from — the backend's core access-frontmatter extension set:
+ * Markdown notes (`.md`) and `.tool` definitions (whole-document YAML whose
+ * access verbs sit beside the definition). Both are served by the file-reader
+ * registry's text-editable text reader. The registry test pins both facts, so
+ * this list cannot drift from the resolver or the registry silently. (Neither
+ * can live here: the registry's document readers carry backend-only extraction
+ * dependencies, and overlays register further extensions at boot — the backend
+ * passes its full registered set as `extensions`.)
+ *
+ * Matching is case-SENSITIVE, as the resolver's is: `Note.MD` carries no
+ * enforced rule, so a grant written there would never resolve. An extensionless
+ * file is NOT a carrier either: its content may be anything, and a path alone
+ * cannot tell a note from a binary.
+ */
+export const FRONTMATTER_CARRIER_EXTENSIONS = ['.md', '.tool'];
+/**
+ * True when the file at `path` can carry its own frontmatter (and so its own
+ * access rules). `extensions` defaults to the core set; the backend passes the
+ * resolver's registered set so an overlay's kinds count too.
+ */
+export function canCarryFrontmatter(path, extensions = FRONTMATTER_CARRIER_EXTENSIONS) {
+    const name = path.slice(path.lastIndexOf('/') + 1);
+    // The resolver's own rule is a plain suffix match, so a file named exactly
+    // `.md` is read for its frontmatter there — and must be a carrier here too,
+    // or a rule the resolver honours could not be managed.
+    return extensions.some((ext) => name.endsWith(ext));
+}
+/** The `kind` a refused file-level access mutation answers with. */
+export const FOLDER_GOVERNS_ACCESS_KIND = 'folder-governs-access';
+/**
+ * The one sentence both the 422 and the dialog say, naming the folder whose
+ * rules govern the file.
+ */
+export function folderGovernsAccessMessage(folder) {
+    return `This file's access comes from its folder. Manage access on ${folder} instead.`;
+}
+//# sourceMappingURL=frontmatter-carriers.js.map

package/dist/workspace/frontmatter-carriers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter-carriers.js","sourceRoot":"","sources":["../../src/workspace/frontmatter-carriers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAElF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,aAAgC,8BAA8B;IAE9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAElE;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,OAAO,8DAA8D,MAAM,WAAW,CAAC;AACzF,CAAC"}

package/dist/workspace/frontmatter.d.ts

@@ -1,9 +1,28 @@
+/**
+ * THE fence rule: a line is a frontmatter fence when, whitespace aside, it is
+ * exactly `---`. Forgiving on purpose — an opening fence with a trailing space
+ * or an indented fence is still a fence.
+ *
+ * Every reader in the platform asks this one function. The access model's
+ * line scan always judged fences this way while the splitter below demanded
+ * `---` at column 0, so a file written with a near-miss fence had access
+ * rules that applied while the catalog, the tool manuals and the frontmatter
+ * panel saw no frontmatter at all. One rule, asked everywhere, is what keeps
+ * a file from meaning two things.
+ */
+export declare function isFrontmatterFence(line: string | undefined): boolean;
 /**
  * The ONE `---` frontmatter splitter, shared by backend and frontend so no file
- * type grows its own regex. Splits a leading `---`-fenced YAML block from the
- * body; null when the text doesn't open with a fence. Parsing the YAML inside is
- * the caller's concern (the access-control resolver deliberately keeps its own
- * hardened line-based reader — see `modules/access/access-splice.ts`).
+ * type grows its own reader. Splits a leading fenced YAML block from the body;
+ * null when the first line is not a fence or no later line closes it. Fences
+ * are judged by {@link isFrontmatterFence}. Parsing the YAML inside is the
+ * caller's concern (the access model keeps its own line scan, on the same
+ * fence rule, because a splice must put bytes back exactly as it found them).
+ *
+ * `frontmatter` is the raw text between the fence lines and `body` the raw
+ * text after the closing fence's line break, both byte for byte — line
+ * endings included — so a caller that rebuilds the file changes nothing it
+ * did not mean to.
  */
 export declare function extractFrontmatter(text: string): {
     frontmatter: string;

package/dist/workspace/frontmatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/workspace/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAI7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAqBpF"}
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/workspace/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4B7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAwBpF"}