@dsh-electron/dsh-plugin-multi-root-workspace 0.1.5 → 0.1.7

package/lib/providers.js

@@ -0,0 +1,87 @@
+import { Service } from "@deepseek-ai/cordis";
+//#region src/providers.ts
+/**
+* `MultiRootProviders`: the fail-loud guard that proves the services mounted as
+* `ctx.fs` and `ctx.sandbox` are THIS bundle's providers — the only ones whose
+* widening the registry, the instruction row, LSP routing and workspace-files
+* are allowed to attach to.
+*
+* Why a brand and not `instanceof`: the plugin may be installed twice (a
+* duplicated install forks the class identity), and cordis private fields are
+* not a public contract. A well-known symbol survives both. The brand is
+* non-enumerable so it never leaks into spreads, JSON, or surface payloads.
+*
+* Deterministic outcome under a provider conflict: cordis refuses a second
+* `ctx.provide` of an already-registered key, so whoever mounts the colliding
+* provider second loses loudly — but a conflicting plugin can also DISABLE this
+* bundle's rows (the same mechanism this bundle uses on upstream), leaving a
+* foreign `ctx.fs`/`ctx.sandbox` in place. In that case this service's
+* `[Service.init]` logs which service is foreign and throws: the row never
+* activates, so every row injecting `multiRootProviders` — the registry above
+* all — never starts, the scope stays empty, and nothing is ever granted,
+* regardless of patch order. Cordis re-evaluates an injecting fiber when an
+* injected service is unprovided and re-provided, so a LATE replacement re-runs
+* the same check.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/providers
+*/
+/**
+* The well-known brand key both providers carry. `Symbol.for` makes it
+* identical across duplicated installs of this package.
+*/
+const MULTI_ROOT_PROVIDER_BRAND = Symbol.for("@dsh-electron/dsh-plugin-multi-root-workspace/provider");
+/**
+* Stamp the multi-root provider brand on a service value. Non-enumerable:
+* the mark must not travel into structural copies.
+* @param value - the service instance being mounted.
+* @param kind - which provider key it claims.
+* @returns the same value, branded.
+*/
+function brandMultiRootProvider(value, kind) {
+	Object.defineProperty(value, MULTI_ROOT_PROVIDER_BRAND, {
+		value: kind,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return value;
+}
+/**
+* Whether `value` is this bundle's provider of `kind`. Structural on purpose:
+* no `instanceof`, so a duplicated install still recognizes the brand.
+* @param value - the service mounted under the key.
+* @param kind - the provider key being checked.
+*/
+function isMultiRootProvider(value, kind) {
+	return value !== null && (typeof value === "object" || typeof value === "function") && value[MULTI_ROOT_PROVIDER_BRAND] === kind;
+}
+/**
+* The conflict gate: `ctx.multiRootProviders` exists only while `ctx.fs` and
+* `ctx.sandbox` are this bundle's branded providers. Every row that widens an
+* authority surface injects it, so a foreign provider composition loses the
+* whole gated set instead of silently widening an unverified one.
+*/
+var MultiRootProviders = class extends Service {
+	static provide = "multiRootProviders";
+	static inject = [
+		"multiRootCompat",
+		"fs",
+		"sandbox"
+	];
+	/**
+	* Verify the provider identities once per activation. A foreign service is
+	* named in the log and the throw leaves this row — and every dependent —
+	* unstarted: fail loud, never a widened grant.
+	*/
+	[Service.init]() {
+		const foreign = [];
+		if (!isMultiRootProvider(this.ctx.fs, "fs")) foreign.push("fs");
+		if (!isMultiRootProvider(this.ctx.sandbox, "sandbox")) foreign.push("sandbox");
+		if (foreign.length === 0) return;
+		const names = foreign.map((name) => `ctx.${name}`).join(" and ");
+		this.ctx.logger.error(`multi-root-workspace: ${names} is provided by another plugin, not this bundle's multi-root provider; refusing to start the multi-root rows so no widened grant can attach to an unverified provider. Resolve the conflict by disabling the other plugin's provider rows.`);
+		throw new Error(`multi-root-workspace: ${names} is a foreign provider; multi-root rows are disabled`);
+	}
+};
+//#endregion
+export { MULTI_ROOT_PROVIDER_BRAND, MultiRootProviders, MultiRootProviders as default, brandMultiRootProvider, isMultiRootProvider };

package/lib/{registry-DySMbjgW.js → registry-DCxC5Lay.js}

@@ -1,11 +1,58 @@
-import { a as classifyStoredRoots, d as resolveRootIndex, i as canonicalRoot, n as additionalRootId, p as validateRootCandidate, r as availableRoots, t as RootValidationError, u as removeStatusAt } from "./roots-DasWEBJk.js";
+import { i as isWindowsNetworkOrDevicePath } from "./windows-runner-contract-CEfmZzu0.js";
+import { a as classifyStoredRoots, d as reservedRootBoundary, f as resolveRootIndex, i as canonicalRoot, m as validateRootCandidate, n as additionalRootId, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-B-0l8mNG.js";
+import { createRequire } from "node:module";
 import { Service } from "@deepseek-ai/cordis";
-import { randomUUID } from "node:crypto";
-import { dirname, isAbsolute } from "node:path";
 import { closeSync, fstatSync, mkdirSync, openSync, statSync } from "node:fs";
+import { dirname, isAbsolute } from "node:path";
+import { randomUUID } from "node:crypto";
 import { defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
-import { z } from "zod";
 import { tryLockExclusive } from "@deepseek-ai/node-addon-system/flock";
+//#region src/compat/storage-zod.ts
+/**
+* Build the domain record schemas with the zod module the installed
+* `@deepseek-ai/dsh-storage-domain` resolves.
+*
+* ```text
+* through 0.2.1-alpha.2   storage-domain declares zod ^4.4.3
+* from   0.2.1-alpha.3    storage-domain declares zod 4.4.3 exactly
+* ```
+*
+* `domainTable` types its `schema` parameter as `ZodType`, resolved from
+* whichever zod copy storage-domain itself depends on — never from the copy
+* this package installs for its own validation work (`src/contract.ts`
+* parses the panel wire shapes with it). While upstream declared `^4.4.3`,
+* both sides resolved to one install; the exact `4.4.3` pin since
+* `0.2.1-alpha.3` splits the tree into two resolutions of the same v4 line,
+* and zod v4 brands every type with the minor it was compiled by, so a
+* schema produced by `4.6.x` is not assignable to a `ZodType` declared by
+* `4.4.3`. Pinning this package to `4.4.3` would only move the split to the
+* other side: on the supported releases before the pin changed, upstream's
+* `^4.4.3` resolves to `4.6.x` and the pinned copy is the foreign one.
+*
+* The fix resolves the BUILDER the same way the boundary resolves the TYPE:
+* `require('zod')` from inside the storage-domain package. A schema built by
+* that namespace is by construction an instance of the `ZodType` the
+* installed `domainTable` accepts, on every supported release — whichever
+* zod version a release pins, both sides keep coming from one module.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/storage-zod
+*/
+/**
+* The `z` namespace as the installed `@deepseek-ai/dsh-storage-domain`
+* resolves it.
+*
+* A resolution failure propagates rather than falling back to this package's
+* zod: a storage-domain that no longer depends on zod changes what
+* `domainTable` accepts, and that is an adapter decision, not a silent
+* degradation. The failure surfaces where a missing peer already would — at
+* module load, before any row runs.
+* @returns the zod module, typed as the used surface only.
+*/
+function domainZod() {
+	const require = createRequire(import.meta.url);
+	return createRequire(require.resolve("@deepseek-ai/dsh-storage-domain/package.json"))("zod");
+}
+//#endregion
 //#region src/registry-lease.ts
 /**
 * Store-wide kernel lease for the multi-root registry.
@@ -76,7 +123,7 @@ var RegistryAuthorityLease = class RegistryAuthorityLease {
 			mode: 448
 		});
 		if (process.platform === "win32") {
-			const { acquireLockHandleWin32 } = await import("./registry-lease-win32-dy8TQMD9.js");
+			const { acquireLockHandleWin32 } = await import("./registry-lease-win32-DTO6QpT9.js");
 			let handle;
 			try {
 				handle = await acquireLockHandleWin32(leasePath);
@@ -128,7 +175,7 @@ var RegistryAuthorityLease = class RegistryAuthorityLease {
 		if (this.released) return;
 		this.released = true;
 		if (this.held.kind === "win32") {
-			const { releaseLockHandleWin32 } = await import("./registry-lease-win32-dy8TQMD9.js");
+			const { releaseLockHandleWin32 } = await import("./registry-lease-win32-DTO6QpT9.js");
 			await releaseLockHandleWin32(this.held.handle);
 			return;
 		}
@@ -176,7 +223,9 @@ var RegistryAuthorityLease = class RegistryAuthorityLease {
 *   memory-authoritative after open, so two DSH processes sharing a storage
 *   root cannot each keep a live domain snapshot. A store-wide kernel lease
 *   (ADR-0007) elects one authority; a contended process publishes an empty
-*   scope, rejects mutations, and retries the lease from {@link MultiRootRegistry.refresh}.
+*   scope marked `authority: 'unavailable'` — under which Full-access is
+*   limited to primary-root-only writes — rejects mutations, and retries the lease
+*   from {@link MultiRootRegistry.refresh}.
 *
 * @module @dsh-electron/dsh-plugin-multi-root-workspace/registry
 */
@@ -191,19 +240,36 @@ const MAX_ALIAS_LENGTH = 120;
 * locale; the panel also shows this string verbatim via `RootsView.unavailable`.
 */
 const REGISTRY_CONTENDED_MESSAGE = "the root registry is owned by another DSH process; additional roots are not granted here. Close the other process, then retry.";
-/** One persisted root record. `zod` validates it at the durable boundary. */
+/**
+* Default cap on stored additional-root records per primary root. The bench
+* evidence for this default lives in `docs/reference/bench-root-scale-*.json`
+* (`pnpm bench:roots`): classification and argv widening stay flat far beyond
+* it, so the cap exists to bound the operator-facing list and the widened
+* profile size, not to protect the classifier.
+*/
+const DEFAULT_MAX_ADDITIONAL_ROOTS = 16;
+/** Hard ceiling for `maxAdditionalRoots`: values above it are config-invalid. */
+const MAX_ADDITIONAL_ROOTS_CEILING = 64;
+/**
+* The durable-boundary validators. The builder is the zod module the
+* INSTALLED storage-domain resolves, not this package's own `zod` copy:
+* `domainTable` types `schema` as the `ZodType` of ITS resolved zod, and
+* since `0.2.1-alpha.3` upstream pins that copy at `4.4.3` exactly while
+* this package floats on `^4.6.2` for its wire validation. The two copies
+* brand incompatible types on either side of that upstream change, so the
+* schema is built where the boundary type comes from — see
+* `src/compat/storage-zod.ts`.
+*/
+const z = domainZod();
 const persistedRoot = z.object({
 	id: z.string().min(1),
 	path: z.string().min(1),
 	recordedPath: z.string().min(1).optional(),
+	readOnlyRecordedPath: z.string().min(1).optional(),
+	readWriteRecordedPath: z.string().min(1).optional(),
 	alias: z.string().optional(),
 	addedAt: z.string().min(1)
 });
-/**
-* One primary root's whole registration list. The domain's `single` layout
-* stores the entire unit as one document, so keys stay opaque strings — which
-* is exactly what lets the canonical primary root itself be the key.
-*/
 const persistedPrimaryRoot = z.object({ roots: z.array(persistedRoot) });
 /**
 * The domain declaration: version 1, `single` layout, one `roots` table keyed
@@ -221,6 +287,7 @@ const multiRootDomainSpec = defineDomain({
 var MultiRootRegistry = class extends Service {
 	static inject = [
 		"multiRootCompat",
+		"multiRootProviders",
 		"storageDomain",
 		"multiRootScope"
 	];
@@ -248,13 +315,27 @@ var MultiRootRegistry = class extends Service {
 	loggedContended = false;
 	/** True once the fiber disposer has run: no further acquisition may happen. */
 	disposed = false;
+	/** The validated per-primary-root cap (the default when the row omits it). */
+	maxRoots;
+	/** Keys already warned about a historical over-limit store (one warning each). */
+	warnedOverLimit = /* @__PURE__ */ new Set();
 	/**
 	* @param ctx - the host context; `storageDomain` and `multiRootScope` are injected.
-	* @param config - the patch row's `leasePath`.
+	* @param config - the patch row's `leasePath` and `maxAdditionalRoots`.
 	*/
 	constructor(ctx, config = {}) {
 		super(ctx, "multiRootRegistry");
 		this.leasePath = config.leasePath;
+		this.ctx.multiRootScope.setRegistryAuthority(false);
+		const configured = config.maxAdditionalRoots === void 0 ? 16 : config.maxAdditionalRoots;
+		if (Number.isInteger(configured) && configured >= 1 && configured <= 64) this.maxRoots = configured;
+		else {
+			this.maxRoots = 16;
+			this.authorityState = {
+				kind: "config-invalid",
+				reason: `${DOMAIN_NAME}: maxAdditionalRoots must be an integer between 1 and 64, got ${JSON.stringify(configured)}`
+			};
+		}
 	}
 	/**
 	* Become the Registry Authority if possible: acquire the store-wide lease,
@@ -268,6 +349,10 @@ var MultiRootRegistry = class extends Service {
 	*/
 	async [Service.init]() {
 		this.ctx.effect(() => () => this.releaseAuthority(), "multi-root-registry: authority release");
+		if (this.authorityState.kind === "config-invalid") {
+			this.ctx.logger.error(`multi-root-workspace: ${this.authorityState.reason}; no additional root is granted`);
+			return;
+		}
 		await this.ensureAuthority();
 	}
 	/**
@@ -281,7 +366,8 @@ var MultiRootRegistry = class extends Service {
 		switch (this.authorityState.kind) {
 			case "active": return;
 			case "contended": return REGISTRY_CONTENDED_MESSAGE;
-			case "storage-failed": return this.authorityState.reason;
+			case "storage-failed":
+			case "config-invalid": return this.authorityState.reason;
 		}
 	}
 	/**
@@ -292,6 +378,21 @@ var MultiRootRegistry = class extends Service {
 		return this.authorityState;
 	}
 	/**
+	* The configured cap on stored additional-root records per primary root.
+	* Surfaces show it next to the count so "N of LIMIT" is always explainable.
+	*/
+	get limit() {
+		return this.maxRoots;
+	}
+	/**
+	* Whether one primary root's stored record count exceeds {@link limit} — a
+	* historical over-limit store, which stays fully classified and granted.
+	* @param primaryRoot - the session workspace root (any spelling).
+	*/
+	overLimit(primaryRoot) {
+		return this.statusesOf(canonicalRoot(primaryRoot)).length > this.maxRoots;
+	}
+	/**
 	* Every registration of one primary root, in registry order, as last
 	* classified. A READ of the in-memory state: it never touches the filesystem
 	* and never writes. Surfaces that must re-check the directories first call
@@ -342,24 +443,41 @@ var MultiRootRegistry = class extends Service {
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, async () => {
-			const statuses = this.statusesOf(key);
+			const earlier = this.cache.get(key);
+			const statuses = this.reclassify(key);
+			const alias = normalizeAlias(input.alias);
+			const expanded = expandRootInput(input.path);
+			if (process.platform === "win32" && isWindowsNetworkOrDevicePath(expanded)) throw new RootValidationError("unsupported-path", `Windows ACL confinement cannot cover network or device paths: ${expanded}`);
+			const preliminary = isAbsolute(expanded) ? canonicalRoot(expanded) : void 0;
+			const revived = preliminary === void 0 ? -1 : statuses.findIndex((status) => {
+				if (process.platform === "win32" && isWindowsNetworkOrDevicePath(status.path)) return false;
+				if (status.path !== preliminary && canonicalRoot(status.path) !== preliminary) return false;
+				const before = earlier?.find((candidate) => candidate.id === status.id);
+				return status.state !== "available" || before !== void 0 && before.state !== "available";
+			});
+			if (revived === -1 && statuses.length >= this.maxRoots) throw new RootValidationError("root-limit-reached", `this workspace already has ${statuses.length} additional roots; the configured limit is ${this.maxRoots}. Remove one first, or raise maxAdditionalRoots.`, { reference: String(this.maxRoots) });
 			const canonical = validateRootCandidate(input.path, {
 				primaryRoot: key,
-				existing: availableRoots(statuses)
+				existing: statuses.flatMap((status, index) => {
+					if (index === revived) return [];
+					const boundary = reservedRootBoundary(status);
+					return boundary === void 0 ? [] : [boundary];
+				})
 			});
-			const alias = normalizeAlias(input.alias);
-			const revived = statuses.findIndex((status) => status.path === canonical || canonicalRoot(status.path) === canonical);
+			const access = input.access ?? "inherit";
 			const next = revived === -1 ? [...statuses, {
 				id: additionalRootId(randomUUID()),
 				path: canonical,
-				recordedPath: canonical,
+				access,
+				...grantFields(access, canonical),
 				state: "available",
 				...alias === void 0 ? {} : { alias },
 				addedAt: (/* @__PURE__ */ new Date()).toISOString()
 			}] : statuses.map((status, index) => index === revived ? {
-				...status,
+				...dropGrantFields(status),
 				path: canonical,
-				recordedPath: canonical,
+				access: input.access ?? status.access,
+				...grantFields(input.access ?? status.access, canonical),
 				addedAt: (/* @__PURE__ */ new Date()).toISOString(),
 				...alias === void 0 ? {} : { alias }
 			} : status);
@@ -367,6 +485,47 @@ var MultiRootRegistry = class extends Service {
 		});
 	}
 	/**
+	* Change one registration's write authority WITHOUT re-recording its path.
+	*
+	* Re-resolving is not re-authorizing: the grant keeps the canonical
+	* directory it was recorded for; only which persisted field carries it
+	* changes. The three levels are not a total order — `inherit` is weaker
+	* than `read-write` under a read-only session but stronger under
+	* Full-access — so "upgrade" cannot be a single direction. The gate is
+	* therefore: pinning to `read-only` is always allowed (a withheld root may
+	* be restricted while it is withheld), while ANY other target requires the
+	* root to be `available` under the FRESH classification — every
+	* non-read-only level can widen authority under some session mode, and a
+	* root that is not currently granted must not be granted anything by a
+	* metadata change.
+	* @param primaryRoot - the session workspace root the root belongs to.
+	* @param ref - which registered root to change.
+	* @param access - the new write authority.
+	* @returns the updated status list.
+	* @throws {RootValidationError} `not-found` when the reference matches
+	*   nothing, `root-unavailable` when the target is not `available` and the
+	*   new level is not `read-only`.
+	*/
+	async setAccess(primaryRoot, ref, access) {
+		await this.ensureAuthority();
+		this.requireActive();
+		const key = canonicalRoot(primaryRoot);
+		return await this.serialize(key, async () => {
+			const statuses = this.reclassify(key);
+			const targetIndex = resolveRootIndex(statuses, ref);
+			const target = statuses[targetIndex];
+			if (target.access === access) return statuses;
+			if (access !== "read-only" && target.state !== "available") throw new RootValidationError("root-unavailable", `"${target.path}" is ${target.state} and cannot change to "${access}"; restore the directory first — only "read-only" may be set while a root is not granted`, { reference: target.id });
+			const recorded = target.recordedPath ?? target.readOnlyRecordedPath ?? target.readWriteRecordedPath;
+			const next = statuses.map((status, index) => index === targetIndex ? {
+				...dropGrantFields(status),
+				access,
+				...recorded === void 0 ? {} : grantFields(access, recorded)
+			} : status);
+			return await this.persist(key, next);
+		});
+	}
+	/**
 	* Remove one registration.
 	* @param primaryRoot - the session workspace root the root belongs to.
 	* @param ref - which registered root to remove.
@@ -391,7 +550,7 @@ var MultiRootRegistry = class extends Service {
 		await this.ensureAuthority();
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
-		return await this.serialize(key, async () => await this.persist(key, removeStatusAt(this.statusesOf(key), ref)));
+		return await this.serialize(key, async () => await this.persist(key, removeStatusAt(this.reclassify(key), ref)));
 	}
 	/**
 	* Set or clear one registration's display alias.
@@ -406,7 +565,7 @@ var MultiRootRegistry = class extends Service {
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, async () => {
-			const statuses = this.statusesOf(key);
+			const statuses = this.reclassify(key);
 			const targetIndex = resolveRootIndex(statuses, ref);
 			const normalized = normalizeAlias(alias);
 			const next = statuses.map((status, index) => {
@@ -433,7 +592,7 @@ var MultiRootRegistry = class extends Service {
 		this.requireActive();
 		const key = canonicalRoot(primaryRoot);
 		return await this.serialize(key, async () => {
-			const statuses = this.statusesOf(key);
+			const statuses = this.reclassify(key);
 			const targetIndex = resolveRootIndex(statuses, ref);
 			const anchorIndex = beforeRef === void 0 ? void 0 : resolveRootIndex(statuses, beforeRef);
 			if (anchorIndex === targetIndex) return statuses;
@@ -494,6 +653,10 @@ var MultiRootRegistry = class extends Service {
 		const key = canonicalRoot(primaryRoot);
 		const statuses = classifyStoredRoots(key, record.roots.map(toRegisteredRoot));
 		this.cache.set(key, statuses);
+		if (statuses.length > this.maxRoots && !this.warnedOverLimit.has(key)) {
+			this.warnedOverLimit.add(key);
+			this.ctx.logger.warn(`multi-root-workspace: ${statuses.length} roots are stored for ${key}, above the configured limit of ${this.maxRoots}; all of them stay granted, only new adds are refused`);
+		}
 		this.publish(key, statuses);
 		return statuses;
 	}
@@ -571,25 +734,36 @@ var MultiRootRegistry = class extends Service {
 	/**
 	* Push one status list into the scope and notify listeners.
 	*
-	* What is published is the effective GRANT — only `available` roots, so a
-	* withheld registration can never reach a provider. When the grant and the
-	* withheld set are unchanged (the common case for a read-path refresh on a
+	* What is published is the effective GRANT — membership requires
+	* `available`, so a withheld registration can never reach a provider as a
+	* grant. Withheld entries still publish for their DENY boundary alone;
+	* that includes `membership-conflict` records, whose recorded grant is
+	* intact and trustworthy even though their membership cannot stand. When
+	* the grant and the withheld set are unchanged (the common case for a
+	* read-path refresh on a
 	* healthy workspace) the scope is left alone and no listener fires: a refresh
 	* exists to keep the two in sync, not to churn on every listing — and, since
 	* the scope rebuilds its root table on each call, skipping the no-op write is
 	* also what keeps the read path cheap.
+	*
+	* Available roots keep registry order: instruction discovery consumes them
+	* under a shared byte budget, so a move must update the live scope immediately.
+	* Aliases and no-op moves still leave the signature unchanged.
 	*/
 	publish(key, statuses) {
 		const withheld = statuses.filter((status) => status.state !== "available");
-		const signature = [...statuses.filter((status) => status.state === "available").map((status) => `available:${status.recordedPath}`), ...withheld.map((status) => `${status.state}:${status.path}`)].join("\n");
-		if (this.published.get(key) === signature) return;
+		const signature = [...statuses.filter((status) => status.state === "available").map((status) => `available:${status.access}:${recordedGrantOf(status)}`), ...withheld.map((status) => `${status.state}:${status.invalidReason ?? ""}:${status.access}:${status.path}:${recordedGrantOf(status) ?? ""}`)].join("\n");
+		if ((this.published.get(key) ?? "") === signature) return;
 		this.published.set(key, signature);
 		const effective = statuses.flatMap((status) => {
-			if (status.state !== "available" || status.recordedPath === void 0) return [];
+			const recorded = recordedGrantOf(status);
+			if (status.state === "invalid" && status.invalidReason !== "membership-conflict" || recorded === void 0) return [];
 			return [{
 				id: status.id,
 				path: status.path,
-				recordedPath: status.recordedPath,
+				recordedPath: recorded,
+				access: status.access,
+				...status.state === "available" ? {} : { withheld: true },
 				...status.alias === void 0 ? {} : { alias: status.alias }
 			}];
 		});
@@ -606,6 +780,7 @@ var MultiRootRegistry = class extends Service {
 	*/
 	requireTable() {
 		if (this.authorityState.kind === "contended") throw new RootValidationError("registry-contended", REGISTRY_CONTENDED_MESSAGE);
+		if (this.authorityState.kind === "config-invalid") throw new RootValidationError("config-invalid", `the root registry configuration is invalid (${this.authorityState.reason}); no additional root is granted`);
 		if (this.authorityState.kind === "storage-failed") throw new RootValidationError("storage-unavailable", `the root registry store is unavailable (${this.authorityState.reason}); remove or repair \$DSH_HOME/storages/multi_root_workspace.json and restart dsh`);
 		if (this.table === void 0) throw new Error("multi-root registry is not started yet");
 		return this.table;
@@ -628,6 +803,7 @@ var MultiRootRegistry = class extends Service {
 		await this.serializeAuthority(async () => {
 			if (this.disposed) return;
 			if (this.authorityState.kind === "active") return;
+			if (this.authorityState.kind === "config-invalid") return;
 			if (this.lease !== void 0) {
 				await this.openDomain();
 				return;
@@ -676,10 +852,12 @@ var MultiRootRegistry = class extends Service {
 		this.cache.clear();
 		this.published.clear();
 		for (const [primaryRoot, record] of this.table.entries()) this.accept(primaryRoot, record);
+		this.ctx.multiRootScope.setRegistryAuthority(true);
 	}
 	/** Fail closed: empty scope, no table, contended state. */
 	enterContended() {
 		this.withdrawPublished();
+		this.ctx.multiRootScope.setRegistryAuthority(false);
 		this.table = void 0;
 		this.authorityState = { kind: "contended" };
 		if (!this.loggedContended) {
@@ -690,6 +868,7 @@ var MultiRootRegistry = class extends Service {
 	/** Fail closed: empty scope, no table, storage-failed state. The lease, if held, stays. */
 	enterStorageFailed(reason) {
 		this.withdrawPublished();
+		this.ctx.multiRootScope.setRegistryAuthority(false);
 		this.table = void 0;
 		this.authorityState = {
 			kind: "storage-failed",
@@ -720,6 +899,7 @@ var MultiRootRegistry = class extends Service {
 		await this.serializeAuthority(async () => {
 			this.table = void 0;
 			this.authorityState = { kind: "contended" };
+			this.ctx.multiRootScope.setRegistryAuthority(false);
 			await this.drainMutations();
 			this.withdrawPublished();
 			const domain = this.domain;
@@ -755,22 +935,63 @@ var MultiRootRegistry = class extends Service {
 		return await run;
 	}
 };
+/** The recorded canonical directory a record was granted for, whichever grant field holds it. */
+function recordedGrantOf(record) {
+	return record.recordedPath ?? record.readOnlyRecordedPath ?? record.readWriteRecordedPath;
+}
+/** The grant fields one access level persists: exactly one key, always. */
+function grantFields(access, recorded) {
+	if (access === "read-only") return { readOnlyRecordedPath: recorded };
+	if (access === "read-write") return { readWriteRecordedPath: recorded };
+	return { recordedPath: recorded };
+}
+/** Strip every grant field so a re-write can set exactly the right one back. */
+function dropGrantFields(status) {
+	const { recordedPath: _inherit, readOnlyRecordedPath: _read, readWriteRecordedPath: _write, ...rest } = status;
+	return rest;
+}
 /** Project one status back to the durable record shape. */
 function toPersistedRoot(status) {
+	const grant = [
+		status.recordedPath,
+		status.readOnlyRecordedPath,
+		status.readWriteRecordedPath
+	].filter((grant) => grant !== void 0 && grant !== "").length > 1 ? {
+		...status.recordedPath === void 0 ? {} : { recordedPath: status.recordedPath },
+		...status.readOnlyRecordedPath === void 0 ? {} : { readOnlyRecordedPath: status.readOnlyRecordedPath },
+		...status.readWriteRecordedPath === void 0 ? {} : { readWriteRecordedPath: status.readWriteRecordedPath }
+	} : status.access === "read-only" ? status.readOnlyRecordedPath === void 0 || status.readOnlyRecordedPath === "" ? {} : { readOnlyRecordedPath: status.readOnlyRecordedPath } : status.access === "read-write" ? status.readWriteRecordedPath === void 0 || status.readWriteRecordedPath === "" ? {} : { readWriteRecordedPath: status.readWriteRecordedPath } : status.recordedPath === void 0 || status.recordedPath === "" ? {} : { recordedPath: status.recordedPath };
 	return {
 		id: status.id,
 		path: status.path,
-		...status.recordedPath === void 0 || status.recordedPath === "" ? {} : { recordedPath: status.recordedPath },
+		...grant,
 		...status.alias === void 0 ? {} : { alias: status.alias },
 		addedAt: status.addedAt
 	};
 }
-/** Recover the registered-root view of a stored record entry. */
+/**
+* Recover the registered-root view of a stored record entry.
+*
+* Access is derived from WHICH grant field is present, never read from a
+* stored `access` key: the persisted layout carries no such key on purpose.
+* That is the downgrade safety in action — an older plugin version parses the
+* same document with a schema that strips unknown keys, so a read-only record
+* (no `recordedPath`) reaches the old classifier as "no grant recorded" and is
+* reported `invalid`: downgrading can never escalate a read-only registration
+* into a writable grant.
+*/
 function toRegisteredRoot(entry) {
+	const hasInheritGrant = entry.recordedPath !== void 0 && entry.recordedPath !== "";
+	const hasReadGrant = entry.readOnlyRecordedPath !== void 0 && entry.readOnlyRecordedPath !== "";
+	const hasWriteGrant = entry.readWriteRecordedPath !== void 0 && entry.readWriteRecordedPath !== "";
+	const access = hasWriteGrant && !hasInheritGrant && !hasReadGrant ? "read-write" : hasReadGrant && !hasInheritGrant && !hasWriteGrant ? "read-only" : "inherit";
 	return {
 		id: additionalRootId(entry.id),
 		path: entry.path,
+		access,
 		...entry.recordedPath === void 0 ? {} : { recordedPath: entry.recordedPath },
+		...entry.readOnlyRecordedPath === void 0 ? {} : { readOnlyRecordedPath: entry.readOnlyRecordedPath },
+		...entry.readWriteRecordedPath === void 0 ? {} : { readWriteRecordedPath: entry.readWriteRecordedPath },
 		...entry.alias === void 0 ? {} : { alias: entry.alias },
 		addedAt: entry.addedAt
 	};
@@ -790,4 +1011,4 @@ function normalizeAlias(alias) {
 	return trimmed;
 }
 //#endregion
-export { TABLE_NAME as a, RegistryLeaseContendedError as c, REGISTRY_CONTENDED_MESSAGE as i, MAX_ALIAS_LENGTH as n, multiRootDomainSpec as o, MultiRootRegistry as r, RegistryAuthorityLease as s, DOMAIN_NAME as t };
+export { MultiRootRegistry as a, multiRootDomainSpec as c, MAX_ALIAS_LENGTH as i, RegistryAuthorityLease as l, DOMAIN_NAME as n, REGISTRY_CONTENDED_MESSAGE as o, MAX_ADDITIONAL_ROOTS_CEILING as r, TABLE_NAME as s, DEFAULT_MAX_ADDITIONAL_ROOTS as t, RegistryLeaseContendedError as u };

package/lib/registry.js

@@ -1,2 +1,2 @@
-import { a as TABLE_NAME, i as REGISTRY_CONTENDED_MESSAGE, n as MAX_ALIAS_LENGTH, o as multiRootDomainSpec, r as MultiRootRegistry, t as DOMAIN_NAME } from "./registry-DySMbjgW.js";
-export { DOMAIN_NAME, MAX_ALIAS_LENGTH, MultiRootRegistry, MultiRootRegistry as default, REGISTRY_CONTENDED_MESSAGE, TABLE_NAME, multiRootDomainSpec };
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, s as TABLE_NAME, t as DEFAULT_MAX_ADDITIONAL_ROOTS } from "./registry-DCxC5Lay.js";
+export { DEFAULT_MAX_ADDITIONAL_ROOTS, DOMAIN_NAME, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MultiRootRegistry, MultiRootRegistry as default, REGISTRY_CONTENDED_MESSAGE, TABLE_NAME, multiRootDomainSpec };