@wairon/cli 5.1.1-dev.92 → 5.1.1-dev.93

package/dist/index.js

@@ -3621,6 +3621,7 @@ __export(src_exports, {
   getRequestParentReach: () => getRequestParentReach,
   getRequestProjectRoot: () => getRequestProjectRoot,
   getStatusReport: () => getStatusReport,
+  getWriteReach: () => getWriteReach,
   globalGuideFilePath: () => globalGuideFilePath,
   globalPacksDir: () => globalPacksDir,
   globalPacksEnabled: () => globalPacksEnabled,
@@ -3792,6 +3793,8 @@ __export(src_exports, {
   writeFileIfChanged: () => writeFileIfChanged,
   writeJsonFile: () => writeJsonFile,
   writeLockRecord: () => writeLockRecord,
+  writeReachDenials: () => writeReachDenials,
+  writeReachPermits: () => writeReachPermits,
   writeRootGuideDelegator: () => writeRootGuideDelegator,
   writeYamlFile: () => writeYamlFile
 });
@@ -3861,6 +3864,18 @@ function listFilesRecursive(dirPath, ext) {
   return files;
 }
 var projectRootOverride = null;
+var sameRoot = (a, b) => path.resolve(a) === path.resolve(b);
+function writeReachPermits(reach2, root, subsystemId) {
+  const own = subsystemId === null ? void 0 : reach2.subsystems.find((s) => s.subsystemId === subsystemId && sameRoot(s.root, root));
+  if (own) return own.writable;
+  return !reach2.unwritableRoots.some((r) => sameRoot(r, root));
+}
+function writeReachDenials(reach2, root) {
+  return reach2.subsystems.filter((s) => !s.writable && sameRoot(s.root, root));
+}
+function getWriteReach() {
+  return requestRootStore.getStore()?.writeReach ?? null;
+}
 var requestRootStore = new import_node_async_hooks.AsyncLocalStorage();
 function currentRootBinding() {
   return requestRootStore.getStore();
@@ -3876,7 +3891,8 @@ function runWithProjectBinding(dir, reach2, fn) {
       parentReach: reach2.parentReach,
       ...reach2.narrowed ? { narrowed: true } : {},
       ...reach2.unwritableRoots ? { unwritableRoots: reach2.unwritableRoots.map((r) => path.resolve(r)) } : {},
-      ...reach2.hostedLookup ? { hostedLookup: reach2.hostedLookup } : {}
+      ...reach2.hostedLookup ? { hostedLookup: reach2.hostedLookup } : {},
+      ...reach2.writeReach ? { writeReach: reach2.writeReach } : {}
     },
     fn
   );
@@ -15081,7 +15097,7 @@ function defaultTargetConfig(type) {
     enabled: true
   };
 }
-var WAIRON_VERSION = "5.1.1-dev.92";
+var WAIRON_VERSION = "5.1.1-dev.93";
 var GITHUB_REPO = "SYW-Apps/Waffle-AIron";
 var ARCHITECT_AGENT_ID = "agent-architect";
 var ARCHITECT_TEMPLATE_ID = "architect";
@@ -26846,6 +26862,34 @@ var PartReadOnly = class extends WaironError {
     this.name = "PartReadOnly";
   }
 };
+var SubsystemWriteDenied = class extends WaironError {
+  constructor(message) {
+    super(message);
+    this.name = "SubsystemWriteDenied";
+  }
+};
+function deniedOwners(reach2, owners) {
+  const seen = /* @__PURE__ */ new Set();
+  const denied = [];
+  for (const o of owners) {
+    const key = `${path21.resolve(o.root)}|${o.subsystemId ?? ""}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (writeReachPermits(reach2, o.root, o.subsystemId)) continue;
+    const rule = o.subsystemId === null ? void 0 : reach2.subsystems.find((s) => s.subsystemId === o.subsystemId && path21.resolve(s.root) === path21.resolve(o.root));
+    denied.push(o.subsystemId === null ? `project "${o.project}" itself (a spec of no subsystem, decided at the project rung)` : `subsystem "${o.subsystemId}" of project "${o.project}" (decided by ${rule?.decidedBy ?? "the project rung"})`);
+  }
+  return denied;
+}
+function assertSpecWritesPermitted(owners, what) {
+  const reach2 = getWriteReach();
+  if (!reach2) return;
+  const denied = deniedOwners(reach2, owners);
+  if (denied.length === 0) return;
+  throw new SubsystemWriteDenied(
+    `SubsystemWriteDenied: ${what} would change ${denied.length === 1 ? "a spec" : "specs"} this request may not change \u2014 ${denied.join("; ")}. Nothing was written.`
+  );
+}
 function unknownKeysIn(raw, parsed, at, out) {
   if (Array.isArray(raw)) {
     if (!Array.isArray(parsed) || parsed.length !== raw.length) return;
@@ -28856,6 +28900,92 @@ var SpecWorkspace = class {
       `The spec file ${file} belongs to the part "${held.part.alias}", fetched from git (${held.source?.git ?? "its repository"} at ${held.part.commit ?? "its pinned commit"}): a git part is read-only here. Edit it in its own repository, commit it there, and take it in with \`wairon member update ${held.part.alias}\`. Nothing was written.`
     );
   }
+  /**
+   * spec_registry.save step 5 / delete step 2: inside a hosted request, may the
+   * request change this spec? Judged against the request's write reach with the
+   * home's project root and the spec's owning subsystem — the document written
+   * and, when a stored document is replaced or removed, the one stored (a
+   * component moved out of a subsystem changes that subsystem too). Outside a
+   * hosted request nothing is judged.
+   */
+  assertHomeInReach(file, kind, document) {
+    if (!getWriteReach()) return;
+    const raw = this.homeRootOf(file);
+    const owners = [];
+    if (document !== null) owners.push(this.documentOwner(raw, kind, document));
+    if (pathExists(file)) {
+      try {
+        owners.push(this.documentOwner(raw, kind, readSpecFile(file)));
+      } catch {
+      }
+    }
+    assertSpecWritesPermitted(owners, `writing ${kind} spec ${path21.basename(path21.dirname(file))}/${path21.basename(file)}`);
+  }
+  /** The project root a spec file is homed under: the root whose specs folder, or one of whose parts' folders, holds it (deepest wins). */
+  homeRootOf(file) {
+    this.scanAll();
+    let best;
+    let depth = -1;
+    for (const raw of this.cachedRawRoots) {
+      const homes = [aiPathsAt(raw.dir).specsDir(), ...raw.record.parts.map((p) => p.directory).filter((d) => d !== void 0)];
+      for (const home of homes) {
+        if (isWithin(home, file) && path21.resolve(home).length > depth) {
+          best = raw;
+          depth = path21.resolve(home).length;
+        }
+      }
+    }
+    if (!best) return { dir: this.rootDir, namespace: "", project: path21.basename(this.rootDir) };
+    return { dir: best.dir, namespace: best.record.namespace, project: idOf(best) ?? (best.record.namespace || path21.basename(best.dir)) };
+  }
+  /**
+   * The owner of one spec DOCUMENT as stored in its root (its references local
+   * to that root): a subsystem is its own, a component or type names its
+   * subsystem, an interface or implementation follows its component; the L0, a
+   * system-level type and a type group belong to no subsystem.
+   */
+  documentOwner(root, kind, document) {
+    const doc = document ?? {};
+    const local = (v) => typeof v === "string" && v ? splitNamespace(v).localId : null;
+    const key = (v) => typeof v === "string" && v ? keyIn(root.namespace, splitNamespace(v).localId) : null;
+    let subsystemId = null;
+    if (kind === "subsystem") subsystemId = local(doc.id);
+    else if (kind === "component" || kind === "type") subsystemId = local(doc.subsystem);
+    else if (kind === "interface") subsystemId = this.componentSubsystem(key(doc.component));
+    else if (kind === "implementation") {
+      const contract = key(doc.contract);
+      subsystemId = this.componentSubsystem(contract ? this.loadInterfaceSpec(contract)?.component ?? null : null);
+    }
+    return { root: root.dir, project: root.project, subsystemId };
+  }
+  /** The local id of a component's subsystem, by the component's key; null when no such component is stored. */
+  componentSubsystem(componentKey) {
+    if (!componentKey) return null;
+    const subsystem = this.loadComponentSpec(componentKey)?.subsystem;
+    return subsystem ? splitNamespace(subsystem).localId : null;
+  }
+  /**
+   * The owner of one IN-MEMORY spec (its references keys, as the loader binds
+   * them) — what a multi-spec write (a rename, a method move) judges before its
+   * first write. `staged` answers a spec the write itself creates.
+   */
+  specOwner(kind, spec, staged) {
+    this.scanAll();
+    const id = kind === "system" ? "" : String(spec?.id ?? "");
+    const namespace = (kind === "system" ? "" : this.ownerKeyOf(id)) ?? "";
+    const raw = this.cachedRawRoots.find((r) => r.record.namespace === namespace);
+    const root = raw ? { dir: raw.dir, project: idOf(raw) ?? (namespace || path21.basename(raw.dir)) } : { dir: this.rootDir, project: path21.basename(this.rootDir) };
+    const localOfKey = (v) => v ? splitNamespace(v).localId : null;
+    let subsystemId = null;
+    if (kind === "subsystem") subsystemId = localOfKey(id);
+    else if (kind === "component" || kind === "type") subsystemId = localOfKey(spec?.subsystem);
+    else if (kind === "interface") subsystemId = this.componentSubsystem(spec?.component ?? null);
+    else if (kind === "implementation" && spec?.contract) {
+      const component = this.loadInterfaceSpec(spec.contract)?.component ?? staged?.("interface", spec.contract)?.component ?? null;
+      subsystemId = this.componentSubsystem(component);
+    }
+    return { root: root.dir, project: root.project, subsystemId };
+  }
   /**
    * The key one spec file is approved under (stage 8): its path from the bound
    * root, POSIX — or, for a part's file, `members/<alias>/<path inside the
@@ -28866,13 +28996,15 @@ var SpecWorkspace = class {
     return approvalKeyIn(file, this.rootDir, this.cachedRoots[0]?.parts ?? []);
   }
   /** The file store's write, at a home the writer resolved — a part's folder included, a git part's refused. */
-  writeHome(file, document) {
+  writeHome(file, document, kind) {
     this.assertHomeWritable(file);
+    this.assertHomeInReach(file, kind, document);
     writeSpecFile(file, document);
   }
   /** The file store's delete, pruning up to the specs folder the file lives in (its part's, for a part's file). */
-  removeHome(file) {
+  removeHome(file, kind) {
     this.assertHomeWritable(file);
+    this.assertHomeInReach(file, kind, null);
     const part = this.partHolding(file)?.part;
     return removeSpecFile(file, part?.directory ? aiPathsAt(part.directory).specsDir() : this.paths.specsDir());
   }
@@ -29223,6 +29355,7 @@ var SpecWorkspace = class {
   }
   saveSystemSpec(spec) {
     const p = this.paths.specsSystem();
+    this.assertHomeInReach(p, "system", spec);
     ensureDir(path21.dirname(p));
     writeSpecFile(p, parseOrThrow(SystemSpecSchema, spec, "system", spec.name));
     invalidateSpecCache();
@@ -29373,12 +29506,12 @@ var SpecWorkspace = class {
       }
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(SubsystemSpecSchema, specToWrite, "subsystem", spec.id));
+    this.writeHome(p, parseOrThrow(SubsystemSpecSchema, specToWrite, "subsystem", spec.id), "subsystem");
     invalidateSpecCache();
   }
   deleteSubsystemSpec(id) {
     const p = this.getSubsystemPath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "subsystem")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29433,14 +29566,14 @@ var SpecWorkspace = class {
       );
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(ComponentSpecSchema, specToWrite, "component", spec.id));
+    this.writeHome(p, parseOrThrow(ComponentSpecSchema, specToWrite, "component", spec.id), "component");
     invalidateSpecCache();
     this.normalizeComponentLayout();
     return notices;
   }
   deleteComponentSpec(id) {
     const p = this.getComponentPath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "component")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29562,13 +29695,13 @@ var SpecWorkspace = class {
       }
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(InterfaceSpecSchema, specToWrite, "interface", spec.id));
+    this.writeHome(p, parseOrThrow(InterfaceSpecSchema, specToWrite, "interface", spec.id), "interface");
     invalidateSpecCache();
     return notices;
   }
   deleteInterfaceSpec(id) {
     const p = this.getInterfacePath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "interface")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29618,13 +29751,13 @@ var SpecWorkspace = class {
       }
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(ImplementationSpecSchema, specToWrite, "implementation", spec.id));
+    this.writeHome(p, parseOrThrow(ImplementationSpecSchema, specToWrite, "implementation", spec.id), "implementation");
     invalidateSpecCache();
     return notices;
   }
   deleteImplementationSpec(id) {
     const p = this.getImplementationPath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "implementation")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29670,14 +29803,14 @@ var SpecWorkspace = class {
       }
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(TypeSpecSchema, specToWrite, "type", spec.id));
+    this.writeHome(p, parseOrThrow(TypeSpecSchema, specToWrite, "type", spec.id), "type");
     invalidateSpecCache();
     return notices;
   }
   deleteTypeSpec(id) {
     const spec = this.loadTypeSpec(id);
     const p = this.getTypePath(id, spec?.subsystem, spec?.group);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "type")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29700,12 +29833,12 @@ var SpecWorkspace = class {
       specToWrite.createdAt = existing.createdAt;
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(GroupSpecSchema, specToWrite, "group", spec.id));
+    this.writeHome(p, parseOrThrow(GroupSpecSchema, specToWrite, "group", spec.id), "group");
     invalidateSpecCache();
   }
   deleteGroupSpec(id) {
     const p = this.getGroupPath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "group")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29903,7 +30036,7 @@ var SpecWorkspace = class {
       );
     }
     if (JSON.stringify(document) === JSON.stringify(stored)) return false;
-    this.writeHome(file, document);
+    this.writeHome(file, document, kind);
     invalidateSpecCache();
     return true;
   }
@@ -30817,6 +30950,7 @@ var SpecWorkspace = class {
       }
     }
     const carried = projectConfigRepository.rekeyCarried(rename, true);
+    this.assertMoveInReach(from, to, plan6, carried.length > 0);
     if (dryRun) {
       const edits2 = moveChangeReports([...plan6.edits.values()], true);
       return {
@@ -30856,6 +30990,14 @@ var SpecWorkspace = class {
       carried
     };
   }
+  /** Refuse a method move, naming every subsystem it may not change, before anything is written. */
+  assertMoveInReach(from, to, plan6, rekeysRegister) {
+    if (!getWriteReach()) return;
+    const staged = (kind, id) => plan6.edits.get(`${kind}:${id}`)?.after;
+    const owners = [...plan6.edits.values()].flatMap((e) => [e.before, e.after].filter((s) => s !== null && s !== void 0).map((s) => this.specOwner(e.kind, s, staged)));
+    if (rekeysRegister) owners.push(this.specOwner("system", null));
+    assertSpecWritesPermitted(owners, `moving methods from "${from}" to "${to}"`);
+  }
   /**
    * Rekey every lint allow keyed on a moved method, staging each spec it
    * changes like any other reference the move follows. An allow anchored at a
@@ -31586,6 +31728,14 @@ function normalizeReferences(kind, id) {
 function rewriteReferences(kind, id, edits) {
   return current().respellReferences(kind, id, edits);
 }
+function assertSpecsInReach(targets, what, projectRung = false) {
+  if (!getWriteReach()) return;
+  const ws = current();
+  const writable = ["system", "subsystem", "component", "interface", "implementation", "type"];
+  const owners = targets.map((t) => ws.specOwner(t.kind, t.kind === "system" ? null : (writable.includes(t.kind) ? ws.load(t.kind, t.id) : null) ?? { id: t.id }));
+  if (projectRung) owners.push(ws.specOwner("system", null));
+  assertSpecWritesPermitted(owners, what);
+}
 function moveMethods(from, to, methods, hooks, dryRun) {
   return current().moveMethods(from, to, methods, hooks, dryRun);
 }
@@ -33151,7 +33301,7 @@ function restateReExports(from, to) {
     publicInterfaces: entries.map((e) => e.from === from ? { ...e, from: to } : e)
   });
 }
-function rewriteRefFields(specsDir, remap, excludeDir) {
+function rewriteRefFields(specsDir, remap, excludeDir, dryRun = false) {
   const rewritten = [];
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     if (excludeDir && isWithinDir2(excludeDir, file)) continue;
@@ -33164,12 +33314,12 @@ function rewriteRefFields(specsDir, remap, excludeDir) {
     if (!raw || typeof raw !== "object") continue;
     const kind = specKind(raw);
     if (!rewriteSpecRefs(raw, remap) || !kind) continue;
-    writeYamlFile(file, raw);
+    if (!dryRun) writeYamlFile(file, raw);
     rewritten.push({ kind, id: kind === "system" ? "system" : String(raw.id) });
   }
   return rewritten;
 }
-function rekeyLintAllows(specsDir, rename) {
+function rekeyLintAllows(specsDir, rename, dryRun = false) {
   const rewritten = [];
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     let raw;
@@ -33200,7 +33350,7 @@ function rekeyLintAllows(specsDir, rename) {
       }
     }
     if (!changed) continue;
-    writeYamlFile(file, raw);
+    if (!dryRun) writeYamlFile(file, raw);
     rewritten.push({ kind, id: specId });
   }
   return rewritten;
@@ -33278,15 +33428,22 @@ function renameComponent(componentId, newId) {
     specs: renamed.map(({ from, to }) => ({ from, to })),
     components: [{ from: componentId, to: newId }]
   };
-  projectConfigRepository.rekeyCarried(rename, true);
-  const rewrittenRefs = rewriteRefFields(aiPathsAt(getProjectRoot()).specsDir(), (ref, position) => {
+  const registerEdits = projectConfigRepository.rekeyCarried(rename, true);
+  const remap = (ref, position) => {
     if (position === "component" || position === "entity-class" || position === "auth-source") {
       return ref === componentId ? newId : ref;
     }
     if (position === "interface" && ref === movingInterface?.id) return interfaceId;
     return ref;
-  });
-  const allowsRekeyed = rekeyLintAllows(aiPathsAt(getProjectRoot()).specsDir(), rename);
+  };
+  const specsDir = aiPathsAt(getProjectRoot()).specsDir();
+  assertSpecsInReach(
+    [...renamed.map(({ kind, from }) => ({ kind, id: from })), ...rewriteRefFields(specsDir, remap, void 0, true), ...rekeyLintAllows(specsDir, rename, true)],
+    `renaming component "${componentId}"`,
+    Array.isArray(registerEdits) && registerEdits.length > 0
+  );
+  const rewrittenRefs = rewriteRefFields(specsDir, remap);
+  const allowsRekeyed = rekeyLintAllows(specsDir, rename);
   const rewritten = [...new Set([...rewrittenRefs, ...allowsRekeyed].filter((spec) => !renamed.some((moved) => moved.kind === spec.kind && moved.from === spec.id)).map((spec) => spec.id))];
   invalidateSpecCache();
   moveRenamedSpecs(componentId, newId, component, movingInterface, movingImplementation);
@@ -33376,7 +33533,18 @@ function renameMethod(componentId, methodName, newName, pinSymbol) {
       ]
     }]
   };
-  projectConfigRepository.rekeyCarried(rename, true);
+  const registerEdits = projectConfigRepository.rekeyCarried(rename, true);
+  const methodRemap = (ref, position, owner) => position === "method" && owner === componentId && ref === methodName ? newName : ref;
+  const reachDir = aiPathsAt(getProjectRoot()).specsDir();
+  assertSpecsInReach(
+    [
+      ...(rename.methods?.[0]?.specs ?? []).map((id) => ({ kind: moving.some((i) => i.id === id) ? "interface" : "implementation", id })),
+      ...rewriteRefFields(reachDir, methodRemap, void 0, true),
+      ...rekeyLintAllows(reachDir, rename, true)
+    ],
+    `renaming method "${componentId}.${methodName}"`,
+    Array.isArray(registerEdits) && registerEdits.length > 0
+  );
   for (const contract of moving) {
     saveInterfaceSpec({
       ...contract,
@@ -33399,7 +33567,7 @@ function renameMethod(componentId, methodName, newName, pinSymbol) {
   }
   invalidateSpecCache();
   const specsDir = aiPathsAt(getProjectRoot()).specsDir();
-  const retargeted = rewriteRefFields(specsDir, (ref, position, owner) => position === "method" && owner === componentId && ref === methodName ? newName : ref);
+  const retargeted = rewriteRefFields(specsDir, methodRemap);
   const allowsRekeyed = rekeyLintAllows(specsDir, rename);
   const rewritten = [...new Set([...retargeted, ...allowsRekeyed].map((spec) => spec.id))];
   const mentions = collectMentions(specsDir, methodName, moving);
@@ -39438,10 +39606,13 @@ function rehearse2(plan6) {
     return { ...plan6, refusals: [...plan6.refusals, { code: `${plan6.request.verb}-refused`, project: "", detail }] };
   }
   const changes = diff(rehearsal);
-  const outside = unwritableOwners(changes);
-  if (outside.length > 0) {
+  const refused2 = [
+    ...unwritableOwners(changes).map((o) => ({ code: "family-partial", project: o, detail: `the plan must write ${o}, which this request may not write` })),
+    ...deniedSubsystems(changes)
+  ];
+  if (refused2.length > 0) {
     discard(rehearsal);
-    return { ...plan6, refusals: [...plan6.refusals, ...outside.map((o) => ({ code: "family-partial", project: o, detail: `the plan must write ${o}, which this request may not write` }))] };
+    return { ...plan6, refusals: [...plan6.refusals, ...refused2] };
   }
   return { ...plan6, rehearsal, changes, relock: relockOf(plan6, changes) };
 }
@@ -39485,6 +39656,16 @@ function unwritableOwners(changes) {
   const owners = [...new Set(changes.map((c) => path47.resolve(c.project)))];
   return owners.filter((o) => denied.includes(o));
 }
+function deniedSubsystems(changes) {
+  const reach2 = getWriteReach();
+  if (!reach2) return [];
+  const owners = [...new Set(changes.map((c) => path47.resolve(c.project)))];
+  return owners.flatMap((o) => writeReachDenials(reach2, o).map((s) => ({
+    code: "subsystem-denied",
+    project: o,
+    detail: `the plan must change ${o}, which holds subsystem "${s.subsystemId}" this request may not change (decided by ${s.decidedBy}); a family migration reshapes its projects whole, so it needs write on every subsystem of every project it changes`
+  })));
+}
 function pathProducers(plan6, family) {
   const inside = (dir) => {
     const rel2 = path47.relative(plan6.familyRoot, dir);
@@ -41845,6 +42026,7 @@ function loadProjectConfig3() {
   getRequestParentReach,
   getRequestProjectRoot,
   getStatusReport,
+  getWriteReach,
   globalGuideFilePath,
   globalPacksDir,
   globalPacksEnabled,
@@ -42016,6 +42198,8 @@ function loadProjectConfig3() {
   writeFileIfChanged,
   writeJsonFile,
   writeLockRecord,
+  writeReachDenials,
+  writeReachPermits,
   writeRootGuideDelegator,
   writeYamlFile
 });