@sparkelf/dsh-knowledge-base 0.1.2 → 0.1.3

package/lib/types/client/KnowledgeHome.d.ts

@@ -37,6 +37,17 @@ export interface KnowledgeHomeProps {
     departmentCode?: string;
     /** The caller's own department name; the code stands in when this is absent. */
     departmentName?: string;
+    /**
+     * Whether the Host verified this caller may manage grants.
+     *
+     * This is the ONLY per-caller permission answer the client receives. There is no
+     * per-path "may I write this" route: `grants` is admin-scoped and the list route
+     * reports visibility, not writability. So the "Owned by me" tab uses this as its
+     * whole answer for the shared buckets -- an administrator sees the shared documents
+     * there, a plain reader does not -- and marks the rows whose answer it could not
+     * narrow rather than pretending either way.
+     */
+    canManageGrants?: boolean;
     /**
      * The tab whose card should take focus on mount.
      *

package/lib/types/client/KnowledgePermissionOverview.d.ts

@@ -19,7 +19,6 @@
  * @module @sparkelf/dsh-knowledge-base/client/KnowledgePermissionOverview
  */
 import type { GrantView, KnowledgeGrantSubjectType } from '../api.ts';
-import { type RoleSummary } from './roleSummary.ts';
 /** Which reading of the grant table the tabs are showing. */
 export type OverviewTab = 'person' | 'role' | 'resource';
 /** Copy for the overview, supplied by the caller's locale record. */
@@ -55,7 +54,6 @@ export interface OverviewCopy {
     pathsHeld: (count: number) => string;
     rolesHeld: string;
     actionsHeld: string;
-    builtInRoles: string;
     noActions: string;
     /** Accessible name for the tab strip, for readers who arrive at it by keyboard. */
     tabsLabel: string;
@@ -118,8 +116,6 @@ export interface KnowledgePermissionOverviewProps {
         kind: 'unavailable';
         reason: string;
     };
-    /** Built-in role summaries, so the person view can explain what a role means. */
-    roles?: readonly RoleSummary[];
     /** Locale copy. */
     copy: OverviewCopy;
     /**

package/lib/types/client/locales.d.ts

@@ -342,6 +342,7 @@ export declare const en: {
     readonly 'step.sshfs-mount': "Mount the share over SSHFS";
     readonly 'step.sshfs-verify': "Verify the SSHFS mount";
     readonly deployLocalOnly: "Deployment steps run on a remote host. This workspace stores documents locally, so there is nothing to deploy.";
+    readonly shareEmpty: "Nothing has been shared yet.";
     readonly shareGroupReceived: "Inbound";
     readonly shareGroupGiven: "Outbound";
     readonly shareColRelation: "Sharing";

package/lib/types/client/mineScope.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Which documents belong under "Owned by me".
+ *
+ * Two rules, and the second is the one users asked for explicitly: a document in the
+ * caller's own personal folder is theirs, and a document the caller can WRITE is also
+ * theirs to manage -- an administrator who maintains `global/` should not have to open
+ * the tree to find those files, because the Home tab is where they look first.
+ *
+ * Write access is not derivable from the tree, so the caller passes in what it knows.
+ * The important part is the three-valued answer: "yes", "no" and "not known" are all
+ * different, and an unknown permission must not be silently treated as either.
+ *
+ * @module @sparkelf/dsh-knowledge-base/client
+ */
+/** What the caller knows about one path's manageability. */
+export type Manageability = 
+/** The caller may write or manage it. */
+'writable'
+/** The caller may read it but not write it. */
+ | 'read-only'
+/** No answer was available: not configured, refused, or not looked up. */
+ | 'unknown';
+/** What a row's membership answer is. */
+export type MineVerdict = 
+/** Belongs under "Owned by me". */
+'mine'
+/** Does not belong. */
+ | 'not-mine'
+/** Cannot be decided; the caller must mark the row rather than drop or claim it. */
+ | 'undetermined';
+/**
+ * The bucket a path sits in, by its first segment.
+ * @param relPath - path relative to the knowledge root.
+ * @returns The bucket name, or an empty string when the path is empty.
+ */
+export declare function bucketOfPath(relPath: string): string;
+/**
+ * Whether a path sits inside the caller's own personal folder.
+ *
+ * `personal/<callerId>/...` and nothing else: a sibling's folder is not the caller's,
+ * and the caller's bare `personal/` level is a container rather than their documents.
+ * @param relPath - path relative to the knowledge root.
+ * @param callerId - the caller's own id, when known.
+ * @returns True when the path is under the caller's own folder.
+ */
+export declare function isInOwnPersonalFolder(relPath: string, callerId: string | undefined): boolean;
+/**
+ * Decide whether one path belongs under "Owned by me".
+ *
+ * The caller's own personal folder is unconditional: it is theirs by construction, and
+ * no permission lookup can make it not theirs. Every other path depends on write access,
+ * which is why an unknown answer is NOT treated as permission -- showing a document as
+ * "mine" when the caller cannot write it would be a claim the deployment cannot back.
+ *
+ * An undetermined row is neither dropped nor claimed: the caller renders it with a mark,
+ * which is the existing degradation for a permission answer that could not be read.
+ * @param relPath - path relative to the knowledge root.
+ * @param callerId - the caller's own id, when known.
+ * @param manageability - what is known about write access for this path.
+ * @returns Whether the row is mine, not mine, or undecidable.
+ */
+export declare function mineVerdict(relPath: string, callerId: string | undefined, manageability: Manageability): MineVerdict;
+/**
+ * The rows under "Owned by me", given what is known about each.
+ *
+ * Undetermined rows are included and reported separately, because dropping them is the
+ * silent-loss failure the user reported: their files existed and simply did not appear.
+ * The caller shows them with a mark rather than hiding them.
+ * @param rows - every candidate row, in display order.
+ * @param callerId - the caller's own id, when known.
+ * @param manageabilityOf - per-path write knowledge.
+ * @returns The rows to show and the paths whose answer was undetermined.
+ */
+export declare function selectOwnedRows<T extends {
+    relPath: string;
+}>(rows: readonly T[], callerId: string | undefined, manageabilityOf: (relPath: string) => Manageability): {
+    rows: T[];
+    undetermined: string[];
+};

package/lib/types/client/roleSummary.d.ts

@@ -24,14 +24,21 @@ export interface RoleSummary {
     builtIn: boolean;
 }
 /**
- * Collapse raw action strings into the shortest describing list.
+ * Collapse raw action strings the way the rest of the page does.
  *
- * The client needs this independently of the server: the overview renders grants
- * the server already wrote, so it summarizes what is there rather than what a
- * request asked for.
+ * This used to carry its own word list, inherited from the create/edit form
+ * (`read`/`create`/`update`/`delete`). DataOps stores `read`/`write`/`manage`, so
+ * `write` and `manage` matched nothing and were dropped: the role BADGES above the
+ * table showed 「只读」 while the table below them — already fixed — showed
+ * 读/写/管理. One page, two conclusions, and the reader has no way to tell which is
+ * true.
+ *
+ * It now delegates to {@link resolveActions}, which is the single vocabulary and the
+ * single union rule for this package. Do not reintroduce a local list here: a second
+ * copy of "what the words mean" is exactly the defect this line removes.
  *
  * @param actions - raw action strings.
- * @returns `['all']` when all four concrete actions are held, else the subset.
+ * @returns The unioned actions in product order.
  */
 export declare function summarizeRoleActions(actions: readonly string[]): string[];
 /**

package/lib/types/client/shareRelations.d.ts

@@ -30,7 +30,9 @@ export interface ShareGrant {
 export type PrincipalNameOf = (kind: ShareGrant['principalType'], id: string) => string | undefined;
 /** Which group one grant belongs to. */
 export type ShareDirection = 'received' | 'given';
-/** One row of either group. */
+/** Which direction a row states. */
+export type ShareRowDirection = 'received' | 'given';
+/** One row of the share table. */
 export interface ShareRow {
     /** Stable row id, taken from the grant. */
     id: string;
@@ -46,6 +48,14 @@ export interface ShareRow {
     audience: string;
     /** The permission the grant confers. */
     action: string;
+    /**
+     * Which way this share points.
+     *
+     * Carried on the ROW rather than inferred from which table drew it: the whole point
+     * of merging the two blocks into one table is that the direction has to be readable
+     * per row, from the relation column.
+     */
+    direction: ShareRowDirection;
 }
 /**
  * Whether a grant names the caller directly.
@@ -79,3 +89,31 @@ export declare function splitShareRelations(grants: readonly ShareGrant[], calle
     received: ShareRow[];
     given: ShareRow[];
 };
+/**
+ * Every share row in the order one merged table shows them.
+ *
+ * Inbound first: "what has been shared with me" is the question this tab answers most
+ * often, and within each direction the order the grants arrived in is preserved so the
+ * table does not reshuffle between reads.
+ *
+ * A single list rather than two is what lets the tab be one table with one pager; the
+ * direction travels on each row so the relation column can state it per row.
+ * @param split - the two groups produced by {@link splitShareRelations}.
+ * @returns One list, inbound rows before outbound ones.
+ */
+export declare function mergeShareRows(split: {
+    received: readonly ShareRow[];
+    given: readonly ShareRow[];
+}): ShareRow[];
+/**
+ * The text one row's relation column shows.
+ *
+ * `receivedTemplate` is a fixed phrase: the grant data has no grantor, so naming one
+ * would be a fabrication. `givenTemplate` interpolates the audience, which IS in the
+ * data (it is the grant's principal).
+ * @param row - the row to describe.
+ * @param receivedTemplate - the fixed phrase for an inbound share.
+ * @param givenTemplate - the outbound template containing `{audience}`.
+ * @returns The relation text.
+ */
+export declare function shareRelationText(row: ShareRow, receivedTemplate: string, givenTemplate: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sparkelf/dsh-knowledge-base",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "DataOps-backed knowledge base for DeepSeek Harness: a left-sidebar destination, Settings configuration, and index tooling over a mounted NAS view.",
   "type": "module",
   "main": "./lib/index.js",