canopycms 0.0.59 → 0.0.60

package/dist/authorization/groups/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/authorization/groups/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAA6B;IAChD,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAA8B;QAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA6B,CAAC;KACxD,CAAC,CACH;CACF,CAAC,CAAA;AAcF;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/authorization/groups/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAA6B;IAChD,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAA8B;QAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA6B,CAAC;KACxD,CAAC,CACH;CACF,CAAC,CAAA;AAcF;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC"}

package/dist/authorization/index.d.ts

@@ -29,8 +29,9 @@ export type { BranchAccessResult, PathPermissionResult, ContentAccessResult, Con
 export { parsePermissionPath } from './validation';
 export { checkContentAccess, createCheckContentAccess, createContentAccessChecker, type ContentAccessChecker, } from './content';
 export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch';
-export { checkPathAccess, createCheckPathAccess } from './path';
+export { checkPathAccess, createCheckPathAccess, resolveDefaultPathAccess } from './path';
 export { RESERVED_GROUPS, type ReservedGroupId, isReservedGroup, stripReservedGroups, isAdmin, isReviewer, isPrivileged, } from './helpers';
-export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile, loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './permissions';
-export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, loadGroupsFile, loadInternalGroups, saveInternalGroups, } from './groups';
+export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile, loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './permissions';
+export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './groups';
+export { mutateSettingsJsonFile, SettingsFileConflictError, SettingsVersionConflictError, type MutateSettingsFileOptions, } from './settings-file-store';
 //# sourceMappingURL=index.d.ts.map

package/dist/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAG/D,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,eAAe,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,QAAQ,CAAA;AAGzF,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,eAAe,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,UAAU,CAAA;AAIjB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,yBAAyB,GAC/B,MAAM,uBAAuB,CAAA"}

package/dist/authorization/index.js

@@ -32,11 +32,14 @@ export { checkContentAccess, createCheckContentAccess, createContentAccessChecke
 // Branch-level access
 export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch.js';
 // Path-level access
-export { checkPathAccess, createCheckPathAccess } from './path.js';
+export { checkPathAccess, createCheckPathAccess, resolveDefaultPathAccess } from './path.js';
 // Helper functions
 export { RESERVED_GROUPS, isReservedGroup, stripReservedGroups, isAdmin, isReviewer, isPrivileged, } from './helpers.js';
 // Permissions file handling
-export { PermissionsFileSchema, createDefaultPermissionsFile, loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './permissions/index.js';
+export { PermissionsFileSchema, createDefaultPermissionsFile, loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './permissions/index.js';
 // Groups file handling
-export { GroupsFileSchema, createDefaultGroupsFile, loadGroupsFile, loadInternalGroups, saveInternalGroups, } from './groups/index.js';
+export { GroupsFileSchema, createDefaultGroupsFile, loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './groups/index.js';
+// Settings file store — cross-host layered locking shared by
+// permissions.json and groups.json (see authorization/settings-file-store.ts)
+export { mutateSettingsJsonFile, SettingsFileConflictError, SettingsVersionConflictError, } from './settings-file-store.js';
 //# sourceMappingURL=index.js.map

package/dist/authorization/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,mDAAmD;AACnD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,GAE3B,MAAM,WAAW,CAAA;AAElB,sBAAsB;AACtB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAEjB,oBAAoB;AACpB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAE/D,mBAAmB;AACnB,OAAO,EACL,eAAe,EAEf,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAElB,4BAA4B;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAE5B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EAGvB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,mDAAmD;AACnD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,GAE3B,MAAM,WAAW,CAAA;AAElB,sBAAsB;AACtB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAEjB,oBAAoB;AACpB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,QAAQ,CAAA;AAEzF,mBAAmB;AACnB,OAAO,EACL,eAAe,EAEf,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAElB,4BAA4B;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAE5B,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EAGvB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,UAAU,CAAA;AAEjB,6DAA6D;AAC7D,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,4BAA4B,GAE7B,MAAM,uBAAuB,CAAA"}

package/dist/authorization/path.d.ts

@@ -7,6 +7,14 @@ import type { PathPermission, DefaultPathAccess, PermissionLevel } from '../conf
 import type { CanopyUser } from '../user';
 import type { PathPermissionResult } from './types';
 import type { PhysicalPath } from '../paths/types';
+/**
+ * Resolve a `defaultPathAccess` config value to an 'allow'/'deny' verdict for one
+ * permission level. String form applies the same value to every level (unchanged
+ * behavior). Object form looks up the level; an absent level resolves to 'deny'
+ * (fail-closed), so scoping e.g. `{ read: 'allow' }` doesn't accidentally open
+ * edit/review.
+ */
+export declare function resolveDefaultPathAccess(defaultAccess: DefaultPathAccess, level: PermissionLevel): 'allow' | 'deny';
 /**
  * Evaluate access for a relative path against config-defined rules.
  * Uses defaultAccess when no rule matches. First matching rule wins.

package/dist/authorization/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EAEhB,MAAM,WAAW,CAAA;AAElB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAoClD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GACN,EAAE;IACD,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,iBAAiB,CAAA;IAChC,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,oBAAoB,CA6BvB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,aAAa,EAAE,iBAAiB,IACrF,OAAO;IACb,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,eAAe,CAAA;CACvB,KAAG,oBAAoB,CACzB"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EAEhB,MAAM,WAAW,CAAA;AAElB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAoClD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,iBAAiB,EAChC,KAAK,EAAE,eAAe,GACrB,OAAO,GAAG,MAAM,CAGlB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GACN,EAAE;IACD,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,iBAAiB,CAAA;IAChC,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,oBAAoB,CAgCvB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,aAAa,EAAE,iBAAiB,IACrF,OAAO;IACb,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,eAAe,CAAA;CACvB,KAAG,oBAAoB,CACzB"}

package/dist/authorization/path.js

@@ -33,6 +33,18 @@ function isAllowedByTarget(target, user) {
     const matchesGroup = hasGroupConstraint && user.groups?.some((gid) => target.allowedGroups?.includes(gid));
     return Boolean(matchesUser || matchesGroup);
 }
+/**
+ * Resolve a `defaultPathAccess` config value to an 'allow'/'deny' verdict for one
+ * permission level. String form applies the same value to every level (unchanged
+ * behavior). Object form looks up the level; an absent level resolves to 'deny'
+ * (fail-closed), so scoping e.g. `{ read: 'allow' }` doesn't accidentally open
+ * edit/review.
+ */
+export function resolveDefaultPathAccess(defaultAccess, level) {
+    if (typeof defaultAccess === 'string')
+        return defaultAccess;
+    return defaultAccess[level] ?? 'deny';
+}
 /**
  * Evaluate access for a relative path against config-defined rules.
  * Uses defaultAccess when no rule matches. First matching rule wins.
@@ -60,7 +72,10 @@ export function checkPathAccess({ rules, relativePath, user, defaultAccess, leve
             reason: allowed ? 'allowed_by_rule' : 'denied_by_rule',
         };
     }
-    return { allowed: defaultAccess === 'allow', reason: 'no_rule_match' };
+    return {
+        allowed: resolveDefaultPathAccess(defaultAccess, level) === 'allow',
+        reason: 'no_rule_match',
+    };
 }
 /**
  * Factory to bind rules and defaultAccess once.

package/dist/authorization/path.js.map

@@ -1 +1 @@
-{"version":3,"file":"path.js","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAQrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAKnC;;GAEG;AACH,SAAS,SAAS,CAAC,CAAe;IAChC,MAAM,UAAU,GAAI,CAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAiB,CAAA;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAAoB,EAAE,YAA0B;IACnE,OAAO,SAAS,CAAC,YAAsB,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAwB,EAAE,IAAgB;IACnE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IAEzD,0DAA0D;IAC1D,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvF,OAAO,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GAON;IACC,MAAM,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;IAE9C,0CAA0C;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACvC,SAAQ;QACV,CAAC;QAED,2CAA2C;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4EAA4E;YAC5E,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/C,OAAO;YACL,OAAO;YACP,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;SACvD,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAuB,EAAE,aAAgC;IAC7F,OAAO,CAAC,KAIP,EAAwB,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;AACjF,CAAC"}
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAQrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAKnC;;GAEG;AACH,SAAS,SAAS,CAAC,CAAe;IAChC,MAAM,UAAU,GAAI,CAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAiB,CAAA;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAAoB,EAAE,YAA0B;IACnE,OAAO,SAAS,CAAC,YAAsB,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAwB,EAAE,IAAgB;IACnE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IAEzD,0DAA0D;IAC1D,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvF,OAAO,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAgC,EAChC,KAAsB;IAEtB,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAA;IAC3D,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GAON;IACC,MAAM,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;IAE9C,0CAA0C;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACvC,SAAQ;QACV,CAAC;QAED,2CAA2C;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4EAA4E;YAC5E,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/C,OAAO;YACL,OAAO;YACP,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;SACvD,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,wBAAwB,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,OAAO;QACnE,MAAM,EAAE,eAAe;KACxB,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAuB,EAAE,aAAgC;IAC7F,OAAO,CAAC,KAIP,EAAwB,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;AACjF,CAAC"}

package/dist/authorization/permissions/index.d.ts

@@ -2,5 +2,5 @@
  * Permissions module exports
  */
 export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile } from './schema';
-export { loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './loader';
+export { loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './loader';
 //# sourceMappingURL=index.d.ts.map

package/dist/authorization/permissions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}

package/dist/authorization/permissions/index.js

@@ -2,5 +2,5 @@
  * Permissions module exports
  */
 export { PermissionsFileSchema, createDefaultPermissionsFile } from './schema.js';
-export { loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './loader.js';
+export { loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './loader.js';
 //# sourceMappingURL=index.js.map

package/dist/authorization/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAwB,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAwB,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}

package/dist/authorization/permissions/loader.d.ts

@@ -1,11 +1,14 @@
 /**
  * Permissions file loader
  *
- * Handles loading and saving path permissions from the filesystem.
+ * Handles loading path permissions from the filesystem and mutating
+ * permissions.json under the cross-host layered lock in
+ * authorization/settings-file-store.ts.
  */
 import type { PathPermission } from '../../config';
 import type { PermissionsFile } from './schema';
 import type { OperatingMode } from '../../operating-mode';
+import type { OccWriteResult } from '../../utils/occ-json-write';
 /**
  * Load full permissions file (for version checking)
  * Returns null if file doesn't exist.
@@ -23,11 +26,22 @@ export declare function loadPermissionsFile(repoRoot: string, mode: OperatingMod
  */
 export declare function loadPathPermissions(repoRoot: string, mode: OperatingMode): Promise<PathPermission[]>;
 /**
- * Save path permissions to .canopycms/permissions.json (or .local.json in dev mode)
+ * Mutate permissions.json (or .local.json in dev mode) under the full
+ * cross-host lock + OCC-retry stack (see
+ * authorization/settings-file-store.ts). `mutate` is called with the
+ * current parsed file (`null` if it doesn't exist yet) and the version to
+ * write under; it returns the next raw payload, or `null` for a deliberate
+ * no-op. The returned payload is validated against
+ * {@link PermissionsFileSchema} before being written, preserving the
+ * previous validate-before-write behavior of the old `savePathPermissions`.
  */
-export declare function savePathPermissions(repoRoot: string, permissions: PathPermission[], updatedBy: string, mode: OperatingMode, contentVersion?: number): Promise<void>;
+export declare function mutatePermissionsFile(repoRoot: string, mode: OperatingMode, mutate: (current: PermissionsFile | null, version: number) => Record<string, unknown> | null, options?: {
+    settleMs?: number;
+    maxAttempts?: number;
+}): Promise<OccWriteResult | null>;
 /**
- * Initialize permissions file if it doesn't exist
+ * Initialize permissions file if it doesn't exist. A no-op when the file is
+ * already present (the mutator returns `null`, so no write happens).
  */
 export declare function ensurePermissionsFile(repoRoot: string, userId: string, mode: OperatingMode): Promise<void>;
 //# sourceMappingURL=loader.d.ts.map

package/dist/authorization/permissions/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAWzD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoBjC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,cAAc,EAAE,EAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAUf"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAShE;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoBjC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAC5F,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAahC;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/authorization/permissions/loader.js

@@ -1,12 +1,14 @@
 /**
  * Permissions file loader
  *
- * Handles loading and saving path permissions from the filesystem.
+ * Handles loading path permissions from the filesystem and mutating
+ * permissions.json under the cross-host layered lock in
+ * authorization/settings-file-store.ts.
  */
 import fs from 'node:fs/promises';
 import { PermissionsFileSchema } from './schema.js';
 import { operatingStrategy } from '../../operating-mode/index.js';
-import { atomicWriteFile } from '../../utils/atomic-write.js';
+import { mutateSettingsJsonFile } from '../settings-file-store.js';
 /**
  * Get the appropriate permissions file path based on mode
  */
@@ -50,33 +52,42 @@ export async function loadPathPermissions(repoRoot, mode) {
     return file?.pathPermissions ?? [];
 }
 /**
- * Save path permissions to .canopycms/permissions.json (or .local.json in dev mode)
+ * Mutate permissions.json (or .local.json in dev mode) under the full
+ * cross-host lock + OCC-retry stack (see
+ * authorization/settings-file-store.ts). `mutate` is called with the
+ * current parsed file (`null` if it doesn't exist yet) and the version to
+ * write under; it returns the next raw payload, or `null` for a deliberate
+ * no-op. The returned payload is validated against
+ * {@link PermissionsFileSchema} before being written, preserving the
+ * previous validate-before-write behavior of the old `savePathPermissions`.
  */
-export async function savePathPermissions(repoRoot, permissions, updatedBy, mode, contentVersion) {
+export async function mutatePermissionsFile(repoRoot, mode, mutate, options) {
     const permissionsPath = getPermissionsFilePath(repoRoot, mode);
-    const permissionsFile = {
-        version: 1,
-        contentVersion: contentVersion ?? 1,
-        updatedAt: new Date().toISOString(),
-        updatedBy,
-        pathPermissions: permissions,
-    };
-    // Validate before writing
-    PermissionsFileSchema.parse(permissionsFile);
-    await atomicWriteFile(permissionsPath, JSON.stringify(permissionsFile, null, 2));
+    return mutateSettingsJsonFile({
+        filePath: permissionsPath,
+        parse: (raw) => PermissionsFileSchema.parse(JSON.parse(raw)),
+        mutate: (current, version) => {
+            const payload = mutate(current, version);
+            return payload === null ? null : PermissionsFileSchema.parse(payload);
+        },
+        settleMs: options?.settleMs,
+        maxAttempts: options?.maxAttempts,
+    });
 }
 /**
- * Initialize permissions file if it doesn't exist
+ * Initialize permissions file if it doesn't exist. A no-op when the file is
+ * already present (the mutator returns `null`, so no write happens).
  */
 export async function ensurePermissionsFile(repoRoot, userId, mode) {
-    const permissionsPath = getPermissionsFilePath(repoRoot, mode);
-    try {
-        await fs.access(permissionsPath);
-        // File exists, nothing to do
-    }
-    catch {
-        // File doesn't exist, create default
-        await savePathPermissions(repoRoot, [], userId, mode);
-    }
+    await mutatePermissionsFile(repoRoot, mode, (current) => {
+        if (current) {
+            return null;
+        }
+        return {
+            updatedAt: new Date().toISOString(),
+            updatedBy: userId,
+            pathPermissions: [],
+        };
+    });
 }
 //# sourceMappingURL=loader.js.map

package/dist/authorization/permissions/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE1D;;GAEG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,IAAmB;IACnE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB;QACrB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,gDAAgD;QAChD,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;QACnE,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACxF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACtD,OAAO,IAAI,EAAE,eAAe,IAAI,EAAE,CAAA;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,WAA6B,EAC7B,SAAiB,EACjB,IAAmB,EACnB,cAAuB;IAEvB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,MAAM,eAAe,GAAoB;QACvC,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,cAAc,IAAI,CAAC;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,eAAe,EAAE,WAAW;KAC7B,CAAA;IAED,0BAA0B;IAC1B,qBAAqB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;IAE5C,MAAM,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,MAAc,EACd,IAAmB;IAEnB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QAChC,6BAA6B;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACvD,CAAC;AACH,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAG/D;;GAEG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,IAAmB;IACnE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB;QACrB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,gDAAgD;QAChD,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;QACnE,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACxF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACtD,OAAO,IAAI,EAAE,eAAe,IAAI,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,IAAmB,EACnB,MAA4F,EAC5F,OAAqD;IAErD,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,OAAO,sBAAsB,CAAkB;QAC7C,QAAQ,EAAE,eAAe;QACzB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACxC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACvE,CAAC;QACD,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAC3B,WAAW,EAAE,OAAO,EAAE,WAAW;KAClC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,MAAc,EACd,IAAmB;IAEnB,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,MAAM;YACjB,eAAe,EAAE,EAAE;SACpB,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/authorization/permissions/schema.d.ts

@@ -11,8 +11,8 @@ import type { PermissionPath } from '../types';
  * Any path containing '..' or other traversal sequences will be rejected.
  */
 export declare const PermissionsFileSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    contentVersion: z.ZodOptional<z.ZodNumber>;
+    version: z.ZodOptional<z.ZodNumber>;
+    writeId: z.ZodOptional<z.ZodString>;
     updatedAt: z.ZodString;
     updatedBy: z.ZodType<CanopyUserId>;
     pathPermissions: z.ZodArray<z.ZodObject<{
@@ -81,7 +81,6 @@ export declare const PermissionsFileSchema: z.ZodObject<{
         } | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    version: 1;
     updatedAt: string;
     updatedBy: string;
     pathPermissions: {
@@ -101,9 +100,9 @@ export declare const PermissionsFileSchema: z.ZodObject<{
             allowedGroups?: string[] | undefined;
         } | undefined;
     }[];
-    contentVersion?: number | undefined;
+    version?: number | undefined;
+    writeId?: string | undefined;
 }, {
-    version: 1;
     updatedAt: string;
     updatedBy: string;
     pathPermissions: {
@@ -123,11 +122,13 @@ export declare const PermissionsFileSchema: z.ZodObject<{
             allowedGroups?: string[] | undefined;
         } | undefined;
     }[];
-    contentVersion?: number | undefined;
+    version?: number | undefined;
+    writeId?: string | undefined;
 }>;
 export type PermissionsFile = z.infer<typeof PermissionsFileSchema>;
 /**
- * Default permissions file
+ * Default permissions file. Omits `version`/`writeId` — the writer
+ * (mutateSettingsJsonFile via writeOccJsonFile) manages those.
  */
 export declare function createDefaultPermissionsFile(userId: CanopyUserId): PermissionsFile;
 //# sourceMappingURL=schema.d.ts.map

package/dist/authorization/permissions/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAA;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAyB9C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;eAIP,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAShD,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,CAOlF"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAA;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAyB9C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;eAQP,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAShD,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,CAMlF"}

package/dist/authorization/permissions/schema.js

@@ -31,8 +31,12 @@ const permissionPathSchema = z
  * Any path containing '..' or other traversal sequences will be rejected.
  */
 export const PermissionsFileSchema = z.object({
-    version: z.literal(1),
-    contentVersion: z.number().optional(), // For optimistic locking
+    // Managed by writeOccJsonFile (see authorization/settings-file-store.ts) —
+    // the single OCC counter for this file. Optional so a hand-written file
+    // with no version field parses as version 0. A legacy `contentVersion`
+    // field (if present) is silently stripped by this non-strict zod parse.
+    version: z.number().int().nonnegative().optional(),
+    writeId: z.string().optional(),
     updatedAt: z.string().datetime(),
     updatedBy: z.string(),
     pathPermissions: z.array(z.object({
@@ -43,11 +47,11 @@ export const PermissionsFileSchema = z.object({
     })),
 });
 /**
- * Default permissions file
+ * Default permissions file. Omits `version`/`writeId` — the writer
+ * (mutateSettingsJsonFile via writeOccJsonFile) manages those.
  */
 export function createDefaultPermissionsFile(userId) {
     return {
-        version: 1,
         updatedAt: new Date().toISOString(),
         updatedBy: userId,
         pathPermissions: [],

package/dist/authorization/permissions/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/authorization/permissions/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAGnD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA6B,CAAC,CAAC,QAAQ,EAAE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA8B,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,MAAM,CAAC,KAAK;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC,CAAyC,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAA6B;IAChD,eAAe,EAAE,CAAC,CAAC,KAAK,CACtB,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,sBAAsB,CAAC,QAAQ,EAAE;QACvC,IAAI,EAAE,sBAAsB,CAAC,QAAQ,EAAE;QACvC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;KAC1C,CAAC,CACH;CACF,CAAC,CAAA;AAIF;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,EAAE;KACpB,CAAA;AACH,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/authorization/permissions/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAGnD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA6B,CAAC,CAAC,QAAQ,EAAE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA8B,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,MAAM,CAAC,KAAK;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IAChB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC,CAAyC,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAA6B;IAChD,eAAe,EAAE,CAAC,CAAC,KAAK,CACtB,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,sBAAsB,CAAC,QAAQ,EAAE;QACvC,IAAI,EAAE,sBAAsB,CAAC,QAAQ,EAAE;QACvC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;KAC1C,CAAC,CACH;CACF,CAAC,CAAA;AAIF;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,EAAE;KACpB,CAAA;AACH,CAAC"}

package/dist/authorization/settings-file-store.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Cross-host layered locking for settings JSON files (permissions.json,
+ * groups.json) in the settings workspace — a single global orphan-git-branch
+ * checkout at `{settingsRoot}` shared by every branch (see
+ * `api/settings-helpers.ts`'s `getSettingsBranchContext`).
+ *
+ * Without this helper, the write path is a classic unprotected TOCTOU: load
+ * -> compare -> mutate -> write with no lock spanning the cycle, so two warm
+ * Lambda containers (separate NFS clients on EFS) can each read the same
+ * pre-mutation file and have the second write silently clobber the first.
+ * `mutateSettingsJsonFile` closes that with the standard 3-layer recipe from
+ * docs/concurrency.md, structured identically to {@link CommentStore}'s
+ * `withMutation` (see comment-store.ts) and `BranchMetadataFileManager.save()`
+ * (see branch-metadata.ts):
+ *
+ * 1. {@link withLock} - an in-process FIFO mutex keyed by the resolved file
+ *    path. Deterministic same-process serialization.
+ * 2. {@link withOccFileLock} - a server-enforced, cross-process/cross-host
+ *    lock (proper-lockfile, mkdir-based), immune to NFS client dentry/
+ *    attribute caching. This is the actual fix for a lost permission/group
+ *    edit across two warm Lambda containers on EFS.
+ * 3. {@link withOccRetry} around {@link writeOccJsonFile} - version/writeId
+ *    based optimistic concurrency control, reloading the file fresh on
+ *    EVERY retry attempt. With layers 1-2 in place this is defense-in-depth
+ *    (e.g. a stale process from a rolling deploy writing without the lock),
+ *    not the primary safety mechanism.
+ *
+ * `writeOccJsonFile`'s managed `version`/`writeId` pair is now THE single
+ * counter for these files: the old hand-rolled `version: 1` format literal
+ * and the separate `contentVersion` field are gone. A pre-existing file on
+ * disk that still says `"version": 1` simply reads as OCC version 1 and
+ * continues incrementing from there; a leftover `contentVersion` key is
+ * silently stripped by the (non-strict, extra-keys-stripped) zod parse.
+ *
+ * Three caveats specific to these files, on top of the generic guarantee
+ * documented on `utils/occ-json-write.ts`:
+ *
+ * (a) UNLIKE comments.json/branch.json (which never leave the branch
+ *     workspace), permissions.json/groups.json are git-committed on the
+ *     settings orphan branch. `commitSettings()` (api/settings-helpers.ts)
+ *     calls `commitToSettingsBranch`, whose `pullCurrentBranch()` merge runs
+ *     AFTER this helper has released its lock, and that merge can rewrite
+ *     the file's `version` from upstream. So, unlike branch.json, `version`
+ *     here is NOT guaranteed monotonic — it remains a correctness aid (it
+ *     still catches the common same-host and short-window cross-host races)
+ *     but is advisory/defense-in-depth, not a hard guarantee. The LOCKFILE
+ *     (layer 2) is the actual cross-host correctness mechanism.
+ * (b) The git commit+push deliberately happens OUTSIDE this lock (mirrors
+ *     branch-metadata.ts keeping registry invalidation outside the lock it
+ *     protects): committing/pushing is comparatively slow network/process
+ *     I/O, and holding a mkdir-based lock across it would serialize
+ *     unrelated requests behind that I/O for no correctness gain — only the
+ *     write to the working tree needs the lock.
+ * (c) Because commit+push is outside the lock, two writers' save-then-commit
+ *     sequences can interleave (A saves+commits+pushes, B's save lands and
+ *     commits before A's push is visible, or similar), and the second
+ *     `git commit` can run against an already-clean tree. Verified benign
+ *     with simple-git 3.36: its task-error detection depends on stderr
+ *     output, and a clean-tree `git commit` exits 1 with "nothing to
+ *     commit" on STDOUT only, so `git.commit()` resolves rather than
+ *     throwing. Re-verify this on any simple-git upgrade.
+ */
+import { type OccWriteResult } from '../utils/occ-json-write';
+/**
+ * Thrown when the lock/OCC-retry stack in {@link mutateSettingsJsonFile}
+ * exhausts every attempt without landing a write — the file is busy with
+ * another writer. Callers translate this into a 409 ("try again").
+ */
+export declare class SettingsFileConflictError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Thrown by a caller's `mutate` callback when an app-level
+ * `expectedContentVersion` sent by a client doesn't match the file's current
+ * `version`. A different concern from {@link SettingsFileConflictError}:
+ * this is a real edit conflict the user must resolve by reloading, not
+ * transient lock contention a retry can fix — and indeed it never IS
+ * retried, since {@link withOccRetry} only recognizes
+ * {@link OccWriteConflictError} as retryable, so this propagates on the
+ * very first attempt.
+ */
+export declare class SettingsVersionConflictError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Structural shape `mutateSettingsJsonFile` needs from a parsed settings
+ * file: just enough to read the OCC version off it without resorting to
+ * `any`. Concrete file types (e.g. `PermissionsFile`, `GroupsFile`) satisfy
+ * this automatically since `version` is optional on both.
+ */
+interface VersionedSettingsFile {
+    version?: number;
+}
+export interface MutateSettingsFileOptions<TFile extends VersionedSettingsFile> {
+    /** Path to the settings JSON file (resolved internally; need not be absolute). */
+    filePath: string;
+    /** JSON.parse + zod-parse the raw file contents. Throws propagate untouched (never retried). */
+    parse: (raw: string) => TFile;
+    /**
+     * Compute the next payload from the current parsed file (`null` on
+     * ENOENT) and the version to write it under. Return `null` for a
+     * deliberate no-op — the write is skipped entirely. Called once per
+     * retry attempt against freshly reloaded state, so it must be safe to
+     * call more than once; anything it throws (besides the retried
+     * `OccWriteConflictError`, which it should never throw itself) propagates
+     * out of `mutateSettingsJsonFile` untouched.
+     */
+    mutate: (current: TFile | null, version: number) => Record<string, unknown> | null | Promise<Record<string, unknown> | null>;
+    /** Forwarded to writeOccJsonFile. Pass 0 in tests. */
+    settleMs?: number;
+    /** Forwarded to withOccRetry. */
+    maxAttempts?: number;
+}
+/**
+ * Run a load -> mutate -> write cycle for a settings JSON file under the
+ * full lock + OCC-retry stack described in the module doc comment above. A
+ * conflict that survives every retry surfaces as
+ * {@link SettingsFileConflictError}; everything else — including
+ * {@link SettingsVersionConflictError} thrown by `mutate`, and any
+ * parse/validation error — propagates untouched.
+ *
+ * Returns the `writeOccJsonFile` result, or `null` if `mutate` chose a
+ * no-op (no write happened).
+ */
+export declare function mutateSettingsJsonFile<TFile extends VersionedSettingsFile>(opts: MutateSettingsFileOptions<TFile>): Promise<OccWriteResult | null>;
+export {};
+//# sourceMappingURL=settings-file-store.d.ts.map

package/dist/authorization/settings-file-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-file-store.d.ts","sourceRoot":"","sources":["../../src/authorization/settings-file-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAMH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAA;AAGhC;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,SAAwC;CAI5D;AAED;;;;;;;;;GASG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,SAAyE;CAI7F;AAED;;;;;GAKG;AACH,UAAU,qBAAqB;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,yBAAyB,CAAC,KAAK,SAAS,qBAAqB;IAC5E,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAA;IAChB,gGAAgG;IAChG,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,KAAK,CAAA;IAC7B;;;;;;;;OAQG;IACH,MAAM,EAAE,CACN,OAAO,EAAE,KAAK,GAAG,IAAI,EACrB,OAAO,EAAE,MAAM,KACZ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;IAC7E,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAgCD;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,SAAS,qBAAqB,EAC9E,IAAI,EAAE,yBAAyB,CAAC,KAAK,CAAC,GACrC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA6BhC"}