canopycms 0.0.59 → 0.0.61-int.74

package/dist/authorization/branch.js.map

@@ -1 +1 @@
-{"version":3,"file":"branch.js","sourceRoot":"","sources":["../../src/authorization/branch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAI/C;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM;IAE3C,+CAA+C;IAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAA;IACpC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IACzD,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,KAAK,CAAA;IAEnE,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,KAAK,OAAO,CAAA;QACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACtC,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAEnF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;IACpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,EAAE,CAAA;AAC1E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,gBAAqC,MAAM;IACjF,OAAO,CAAC,OAAsB,EAAE,IAAgB,EAAsB,EAAE,CACtE,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM;IAE3C,4EAA4E;IAC5E,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;IAE/E,6DAA6D;IAC7D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAA;IAE9D,2CAA2C;IAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,kBAAkB,CAAA;IAEtE,YAAY;IACZ,6BAA6B;IAC7B,wEAAwE;IACxE,uCAAuC;IACvC,OAAO,CACL,aAAa;QACb,YAAY,CAAC,MAAM,KAAK,YAAY;QACpC,YAAY,CAAC,MAAM,KAAK,gBAAgB;QACxC,CAAC,cAAc,IAAI,YAAY,CAAC,OAAO,CAAC,CACzC,CAAA;AACH,CAAC"}
+{"version":3,"file":"branch.js","sourceRoot":"","sources":["../../src/authorization/branch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAI/C;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM;IAE3C,+CAA+C;IAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAA;IACpC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IACzD,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,KAAK,CAAA;IAEnE,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,KAAK,OAAO,CAAA;QACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACtC,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAEnF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;IACpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,EAAE,CAAA;AAC1E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,gBAAqC,MAAM;IACjF,OAAO,CAAC,OAAsB,EAAE,IAAgB,EAAsB,EAAE,CACtE,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;AAC9D,CAAC;AAcD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM,EAC3C,OAA+B;IAE/B,4EAA4E;IAC5E,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;IAE/E,6DAA6D;IAC7D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAA;IAE9D,kFAAkF;IAClF,MAAM,cAAc,GAClB,CAAC,OAAO,EAAE,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,kBAAkB,CAAA;IAEhF,YAAY;IACZ,6BAA6B;IAC7B,wEAAwE;IACxE,uCAAuC;IACvC,OAAO,CACL,aAAa;QACb,YAAY,CAAC,MAAM,KAAK,YAAY;QACpC,YAAY,CAAC,MAAM,KAAK,gBAAgB;QACxC,CAAC,cAAc,IAAI,YAAY,CAAC,OAAO,CAAC,CACzC,CAAA;AACH,CAAC"}

package/dist/authorization/groups/index.d.ts

@@ -2,5 +2,5 @@
  * Groups module exports
  */
 export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, } from './schema';
-export { loadGroupsFile, loadInternalGroups, saveInternalGroups } from './loader';
+export { loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './loader';
 //# sourceMappingURL=index.d.ts.map

package/dist/authorization/groups/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/groups/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/groups/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,UAAU,CAAA"}

package/dist/authorization/groups/index.js

@@ -2,5 +2,5 @@
  * Groups module exports
  */
 export { GroupsFileSchema, createDefaultGroupsFile, } from './schema.js';
-export { loadGroupsFile, loadInternalGroups, saveInternalGroups } from './loader.js';
+export { loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './loader.js';
 //# sourceMappingURL=index.js.map

package/dist/authorization/groups/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/groups/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/groups/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,UAAU,CAAA"}

package/dist/authorization/groups/loader.d.ts

@@ -1,16 +1,27 @@
 /**
  * Groups file loader
  *
- * Handles loading and saving internal groups from the filesystem.
+ * Handles loading internal groups from the filesystem and mutating
+ * groups.json under the cross-host layered lock in
+ * authorization/settings-file-store.ts.
  */
-import type { CanopyUserId } from '../../types';
 import { type InternalGroup, type GroupsFile } from './schema';
 import type { OperatingMode } from '../../operating-mode';
+import type { OccWriteResult } from '../../utils/occ-json-write';
 /**
  * Load full groups file (for version checking)
  * Returns null if file doesn't exist.
  */
 export declare function loadGroupsFile(branchRoot: string, mode: OperatingMode): Promise<GroupsFile | null>;
+/**
+ * Derive the effective internal groups list from the raw groups array
+ * stored on disk: ensures the reserved Admins/Reviewers groups always exist
+ * (synthesizing defaults when absent) and merges bootstrap admin IDs into
+ * Admins. Pure — no disk I/O — so a caller that already holds a freshly
+ * loaded file (e.g. a settings-file mutator, which reloads on every retry
+ * attempt) can reconcile against it without a second read.
+ */
+export declare function deriveInternalGroups(fileGroups: InternalGroup[], bootstrapAdminIds?: Set<string>): InternalGroup[];
 /**
  * Load internal groups from .canopycms/groups.json (or .local.json in dev mode)
  * Ensures Admins and Reviewers groups always exist, adding them dynamically if not present.
@@ -18,7 +29,17 @@ export declare function loadGroupsFile(branchRoot: string, mode: OperatingMode):
  */
 export declare function loadInternalGroups(branchRoot: string, mode: OperatingMode, bootstrapAdminIds?: Set<string>): Promise<InternalGroup[]>;
 /**
- * Save internal groups to .canopycms/groups.json (or .local.json in dev mode)
+ * Mutate groups.json (or .local.json in dev mode) under the full cross-host
+ * lock + OCC-retry stack (see authorization/settings-file-store.ts).
+ * `mutate` is called with the current parsed file (`null` if it doesn't
+ * exist yet) and the version to write under; it returns the next raw
+ * payload, or `null` for a deliberate no-op. The returned payload is
+ * validated against {@link GroupsFileSchema} before being written,
+ * preserving the previous validate-before-write behavior of the old
+ * `saveInternalGroups`.
  */
-export declare function saveInternalGroups(branchRoot: string, groups: InternalGroup[], updatedBy: CanopyUserId, mode: OperatingMode, contentVersion?: number): Promise<void>;
+export declare function mutateGroupsFile(branchRoot: string, mode: OperatingMode, mutate: (current: GroupsFile | null, version: number) => Record<string, unknown> | null, options?: {
+    settleMs?: number;
+    maxAttempts?: number;
+}): Promise<OccWriteResult | null>;
 //# sourceMappingURL=loader.d.ts.map

package/dist/authorization/groups/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/authorization/groups/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAoB,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAYzD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAe5B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,EACnB,iBAAiB,GAAE,GAAG,CAAC,MAAM,CAAa,GACzC,OAAO,CAAC,aAAa,EAAE,CAAC,CA0C1B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,aAAa,EAAE,EACvB,SAAS,EAAE,YAAY,EACvB,IAAI,EAAE,aAAa,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAef"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/authorization/groups/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAoB,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAIzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAShE;;;GAGG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAe5B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,EAAE,EAC3B,iBAAiB,GAAE,GAAG,CAAC,MAAM,CAAa,GACzC,aAAa,EAAE,CAuCjB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,EACnB,iBAAiB,GAAE,GAAG,CAAC,MAAM,CAAa,GACzC,OAAO,CAAC,aAAa,EAAE,CAAC,CAG1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvF,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAahC"}

package/dist/authorization/groups/loader.js

@@ -1,13 +1,15 @@
 /**
  * Groups file loader
  *
- * Handles loading and saving internal groups from the filesystem.
+ * Handles loading internal groups from the filesystem and mutating
+ * groups.json under the cross-host layered lock in
+ * authorization/settings-file-store.ts.
  */
 import { promises as fs } from 'node:fs';
 import { GroupsFileSchema } from './schema.js';
 import { operatingStrategy } from '../../operating-mode/index.js';
 import { RESERVED_GROUPS } from '../helpers.js';
-import { atomicWriteFile } from '../../utils/atomic-write.js';
+import { mutateSettingsJsonFile } from '../settings-file-store.js';
 /**
  * Get the appropriate groups file path based on mode
  */
@@ -35,13 +37,14 @@ export async function loadGroupsFile(branchRoot, mode) {
     }
 }
 /**
- * Load internal groups from .canopycms/groups.json (or .local.json in dev mode)
- * Ensures Admins and Reviewers groups always exist, adding them dynamically if not present.
- * If Admins group exists in file, merges with bootstrap admin IDs.
+ * Derive the effective internal groups list from the raw groups array
+ * stored on disk: ensures the reserved Admins/Reviewers groups always exist
+ * (synthesizing defaults when absent) and merges bootstrap admin IDs into
+ * Admins. Pure — no disk I/O — so a caller that already holds a freshly
+ * loaded file (e.g. a settings-file mutator, which reloads on every retry
+ * attempt) can reconcile against it without a second read.
  */
-export async function loadInternalGroups(branchRoot, mode, bootstrapAdminIds = new Set()) {
-    const file = await loadGroupsFile(branchRoot, mode);
-    const fileGroups = file?.groups ?? [];
+export function deriveInternalGroups(fileGroups, bootstrapAdminIds = new Set()) {
     // Find existing Admins and Reviewers groups
     let adminsGroup = fileGroups.find((g) => g.id === RESERVED_GROUPS.ADMINS);
     let reviewersGroup = fileGroups.find((g) => g.id === RESERVED_GROUPS.REVIEWERS);
@@ -77,19 +80,35 @@ export async function loadInternalGroups(branchRoot, mode, bootstrapAdminIds = n
     return [adminsGroup, reviewersGroup, ...otherGroups];
 }
 /**
- * Save internal groups to .canopycms/groups.json (or .local.json in dev mode)
+ * Load internal groups from .canopycms/groups.json (or .local.json in dev mode)
+ * Ensures Admins and Reviewers groups always exist, adding them dynamically if not present.
+ * If Admins group exists in file, merges with bootstrap admin IDs.
+ */
+export async function loadInternalGroups(branchRoot, mode, bootstrapAdminIds = new Set()) {
+    const file = await loadGroupsFile(branchRoot, mode);
+    return deriveInternalGroups(file?.groups ?? [], bootstrapAdminIds);
+}
+/**
+ * Mutate groups.json (or .local.json in dev mode) under the full cross-host
+ * lock + OCC-retry stack (see authorization/settings-file-store.ts).
+ * `mutate` is called with the current parsed file (`null` if it doesn't
+ * exist yet) and the version to write under; it returns the next raw
+ * payload, or `null` for a deliberate no-op. The returned payload is
+ * validated against {@link GroupsFileSchema} before being written,
+ * preserving the previous validate-before-write behavior of the old
+ * `saveInternalGroups`.
  */
-export async function saveInternalGroups(branchRoot, groups, updatedBy, mode, contentVersion) {
+export async function mutateGroupsFile(branchRoot, mode, mutate, options) {
     const groupsPath = getGroupsFilePath(branchRoot, mode);
-    const groupsFile = {
-        version: 1,
-        contentVersion: contentVersion ?? 1,
-        updatedAt: new Date().toISOString(),
-        updatedBy,
-        groups,
-    };
-    // Validate before writing
-    GroupsFileSchema.parse(groupsFile);
-    await atomicWriteFile(groupsPath, JSON.stringify(groupsFile, null, 2));
+    return mutateSettingsJsonFile({
+        filePath: groupsPath,
+        parse: (raw) => GroupsFileSchema.parse(JSON.parse(raw)),
+        mutate: (current, version) => {
+            const payload = mutate(current, version);
+            return payload === null ? null : GroupsFileSchema.parse(payload);
+        },
+        settleMs: options?.settleMs,
+        maxAttempts: options?.maxAttempts,
+    });
 }
 //# sourceMappingURL=loader.js.map

package/dist/authorization/groups/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/authorization/groups/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAA;AAExC,OAAO,EAAE,gBAAgB,EAAuC,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE1D;;GAEG;AACH,SAAS,iBAAiB,CAAC,UAAkB,EAAE,IAAmB;IAChE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,IAAmB;IAEnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB;QACrB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,IAAmB,EACnB,oBAAiC,IAAI,GAAG,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,IAAI,EAAE,MAAM,IAAI,EAAE,CAAA;IAErC,4CAA4C;IAC5C,IAAI,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,CAAC,CAAA;IACzE,IAAI,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,SAAS,CAAC,CAAA;IAE/E,2DAA2D;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAA;QACzE,WAAW,GAAG;YACZ,GAAG,WAAW;YACd,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;SAC/B,CAAA;IACH,CAAC;SAAM,CAAC;QACN,4CAA4C;QAC5C,WAAW,GAAG;YACZ,EAAE,EAAE,eAAe,CAAC,MAAM;YAC1B,IAAI,EAAE,eAAe,CAAC,MAAM;YAC5B,WAAW,EAAE,mCAAmC;YAChD,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;SACvC,CAAA;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG;YACf,EAAE,EAAE,eAAe,CAAC,SAAS;YAC7B,IAAI,EAAE,eAAe,CAAC,SAAS;YAC/B,WAAW,EAAE,mDAAmD;YAChE,OAAO,EAAE,EAAE;SACZ,CAAA;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,SAAS,CAC7E,CAAA;IAED,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,MAAuB,EACvB,SAAuB,EACvB,IAAmB,EACnB,cAAuB;IAEvB,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAEtD,MAAM,UAAU,GAAe;QAC7B,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,cAAc,IAAI,CAAC;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,MAAM;KACP,CAAA;IAED,0BAA0B;IAC1B,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAElC,MAAM,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AACxE,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/authorization/groups/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAuC,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAG/D;;GAEG;AACH,SAAS,iBAAiB,CAAC,UAAkB,EAAE,IAAmB;IAChE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,IAAmB;IAEnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB;QACrB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA2B,EAC3B,oBAAiC,IAAI,GAAG,EAAE;IAE1C,4CAA4C;IAC5C,IAAI,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,CAAC,CAAA;IACzE,IAAI,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,SAAS,CAAC,CAAA;IAE/E,2DAA2D;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAA;QACzE,WAAW,GAAG;YACZ,GAAG,WAAW;YACd,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;SAC/B,CAAA;IACH,CAAC;SAAM,CAAC;QACN,4CAA4C;QAC5C,WAAW,GAAG;YACZ,EAAE,EAAE,eAAe,CAAC,MAAM;YAC1B,IAAI,EAAE,eAAe,CAAC,MAAM;YAC5B,WAAW,EAAE,mCAAmC;YAChD,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;SACvC,CAAA;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG;YACf,EAAE,EAAE,eAAe,CAAC,SAAS;YAC7B,IAAI,EAAE,eAAe,CAAC,SAAS;YAC/B,WAAW,EAAE,mDAAmD;YAChE,OAAO,EAAE,EAAE;SACZ,CAAA;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,SAAS,CAC7E,CAAA;IAED,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,IAAmB,EACnB,oBAAiC,IAAI,GAAG,EAAE;IAE1C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACnD,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,IAAmB,EACnB,MAAuF,EACvF,OAAqD;IAErD,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAEtD,OAAO,sBAAsB,CAAa;QACxC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACxC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClE,CAAC;QACD,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAC3B,WAAW,EAAE,OAAO,EAAE,WAAW;KAClC,CAAC,CAAA;AACJ,CAAC"}

package/dist/authorization/groups/schema.d.ts

@@ -7,8 +7,8 @@ import type { CanopyUserId, CanopyGroupId } from '../../types';
  * Schema for .canopycms/groups.json
  */
 export declare const GroupsFileSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    contentVersion: z.ZodOptional<z.ZodNumber>;
+    version: z.ZodOptional<z.ZodNumber>;
+    writeId: z.ZodOptional<z.ZodString>;
     updatedAt: z.ZodString;
     updatedBy: z.ZodType<CanopyUserId>;
     groups: z.ZodArray<z.ZodObject<{
@@ -28,7 +28,6 @@ export declare const GroupsFileSchema: z.ZodObject<{
         description?: string | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    version: 1;
     updatedAt: string;
     groups: {
         name: string;
@@ -37,9 +36,9 @@ export declare const GroupsFileSchema: z.ZodObject<{
         description?: string | undefined;
     }[];
     updatedBy: string;
-    contentVersion?: number | undefined;
+    version?: number | undefined;
+    writeId?: string | undefined;
 }, {
-    version: 1;
     updatedAt: string;
     groups: {
         name: string;
@@ -48,7 +47,8 @@ export declare const GroupsFileSchema: z.ZodObject<{
         description?: string | undefined;
     }[];
     updatedBy: string;
-    contentVersion?: number | undefined;
+    version?: number | undefined;
+    writeId?: string | undefined;
 }>;
 export type GroupsFile = z.infer<typeof GroupsFileSchema>;
 /**
@@ -61,7 +61,8 @@ export interface InternalGroup {
     members: CanopyUserId[];
 }
 /**
- * Default groups file
+ * Default groups file. Omits `version`/`writeId` — the writer
+ * (mutateSettingsJsonFile via writeOccJsonFile) manages those.
  */
 export declare function createDefaultGroupsFile(userId: CanopyUserId): GroupsFile;
 //# sourceMappingURL=schema.d.ts.map

package/dist/authorization/groups/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/authorization/groups/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE9D;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;eAIF,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;;YAG1B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM9C,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,aAAa,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAOxE"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/authorization/groups/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE9D;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;eAQF,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;;YAG1B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM9C,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,aAAa,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAMxE"}

package/dist/authorization/groups/schema.js

@@ -6,8 +6,12 @@ import { z } from 'zod';
  * Schema for .canopycms/groups.json
  */
 export const GroupsFileSchema = z.object({
-    version: z.literal(1),
-    contentVersion: z.number().optional(), // For optimistic locking
+    // Managed by writeOccJsonFile (see authorization/settings-file-store.ts) —
+    // the single OCC counter for this file. Optional so a hand-written file
+    // with no version field parses as version 0. A legacy `contentVersion`
+    // field (if present) is silently stripped by this non-strict zod parse.
+    version: z.number().int().nonnegative().optional(),
+    writeId: z.string().optional(),
     updatedAt: z.string().datetime(),
     updatedBy: z.string(),
     groups: z.array(z.object({
@@ -18,11 +22,11 @@ export const GroupsFileSchema = z.object({
     })),
 });
 /**
- * Default groups file
+ * Default groups file. Omits `version`/`writeId` — the writer
+ * (mutateSettingsJsonFile via writeOccJsonFile) manages those.
  */
 export function createDefaultGroupsFile(userId) {
     return {
-        version: 1,
         updatedAt: new Date().toISOString(),
         updatedBy: userId,
         groups: [],

package/dist/authorization/groups/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/authorization/groups/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAA6B;IAChD,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAA8B;QAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA6B,CAAC;KACxD,CAAC,CACH;CACF,CAAC,CAAA;AAcF;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/authorization/groups/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAA6B;IAChD,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAA8B;QAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAA6B,CAAC;KACxD,CAAC,CACH;CACF,CAAC,CAAA;AAcF;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE;KACX,CAAA;AACH,CAAC"}

package/dist/authorization/index.d.ts

@@ -29,8 +29,10 @@ export type { BranchAccessResult, PathPermissionResult, ContentAccessResult, Con
 export { parsePermissionPath } from './validation';
 export { checkContentAccess, createCheckContentAccess, createContentAccessChecker, type ContentAccessChecker, } from './content';
 export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch';
-export { checkPathAccess, createCheckPathAccess } from './path';
+export { getBranchProtection, type BranchProtection } from './protected-branch';
+export { checkPathAccess, createCheckPathAccess, resolveDefaultPathAccess } from './path';
 export { RESERVED_GROUPS, type ReservedGroupId, isReservedGroup, stripReservedGroups, isAdmin, isReviewer, isPrivileged, } from './helpers';
-export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile, loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './permissions';
-export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, loadGroupsFile, loadInternalGroups, saveInternalGroups, } from './groups';
+export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile, loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './permissions';
+export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './groups';
+export { mutateSettingsJsonFile, SettingsFileConflictError, SettingsVersionConflictError, type MutateSettingsFileOptions, } from './settings-file-store';
 //# sourceMappingURL=index.d.ts.map

package/dist/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAG/D,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,eAAe,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAG/E,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,QAAQ,CAAA;AAGzF,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,eAAe,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,UAAU,CAAA;AAIjB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,yBAAyB,GAC/B,MAAM,uBAAuB,CAAA"}

package/dist/authorization/index.js

@@ -31,12 +31,17 @@ export { parsePermissionPath } from './validation.js';
 export { checkContentAccess, createCheckContentAccess, createContentAccessChecker, } from './content.js';
 // Branch-level access
 export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch.js';
+// Protected base branch (submit-block + read-only predicate)
+export { getBranchProtection } from './protected-branch.js';
 // Path-level access
-export { checkPathAccess, createCheckPathAccess } from './path.js';
+export { checkPathAccess, createCheckPathAccess, resolveDefaultPathAccess } from './path.js';
 // Helper functions
 export { RESERVED_GROUPS, isReservedGroup, stripReservedGroups, isAdmin, isReviewer, isPrivileged, } from './helpers.js';
 // Permissions file handling
-export { PermissionsFileSchema, createDefaultPermissionsFile, loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './permissions/index.js';
+export { PermissionsFileSchema, createDefaultPermissionsFile, loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './permissions/index.js';
 // Groups file handling
-export { GroupsFileSchema, createDefaultGroupsFile, loadGroupsFile, loadInternalGroups, saveInternalGroups, } from './groups/index.js';
+export { GroupsFileSchema, createDefaultGroupsFile, loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './groups/index.js';
+// Settings file store — cross-host layered locking shared by
+// permissions.json and groups.json (see authorization/settings-file-store.ts)
+export { mutateSettingsJsonFile, SettingsFileConflictError, SettingsVersionConflictError, } from './settings-file-store.js';
 //# sourceMappingURL=index.js.map

package/dist/authorization/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,mDAAmD;AACnD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,GAE3B,MAAM,WAAW,CAAA;AAElB,sBAAsB;AACtB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAEjB,oBAAoB;AACpB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAE/D,mBAAmB;AACnB,OAAO,EACL,eAAe,EAEf,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAElB,4BAA4B;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAE5B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EAGvB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,mDAAmD;AACnD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,GAE3B,MAAM,WAAW,CAAA;AAElB,sBAAsB;AACtB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAEjB,6DAA6D;AAC7D,OAAO,EAAE,mBAAmB,EAAyB,MAAM,oBAAoB,CAAA;AAE/E,oBAAoB;AACpB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,QAAQ,CAAA;AAEzF,mBAAmB;AACnB,OAAO,EACL,eAAe,EAEf,eAAe,EACf,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAElB,4BAA4B;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAE5B,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EAGvB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,UAAU,CAAA;AAEjB,6DAA6D;AAC7D,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,4BAA4B,GAE7B,MAAM,uBAAuB,CAAA"}

package/dist/authorization/path.d.ts

@@ -7,6 +7,14 @@ import type { PathPermission, DefaultPathAccess, PermissionLevel } from '../conf
 import type { CanopyUser } from '../user';
 import type { PathPermissionResult } from './types';
 import type { PhysicalPath } from '../paths/types';
+/**
+ * Resolve a `defaultPathAccess` config value to an 'allow'/'deny' verdict for one
+ * permission level. String form applies the same value to every level (unchanged
+ * behavior). Object form looks up the level; an absent level resolves to 'deny'
+ * (fail-closed), so scoping e.g. `{ read: 'allow' }` doesn't accidentally open
+ * edit/review.
+ */
+export declare function resolveDefaultPathAccess(defaultAccess: DefaultPathAccess, level: PermissionLevel): 'allow' | 'deny';
 /**
  * Evaluate access for a relative path against config-defined rules.
  * Uses defaultAccess when no rule matches. First matching rule wins.

package/dist/authorization/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EAEhB,MAAM,WAAW,CAAA;AAElB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAoClD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GACN,EAAE;IACD,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,iBAAiB,CAAA;IAChC,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,oBAAoB,CA6BvB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,aAAa,EAAE,iBAAiB,IACrF,OAAO;IACb,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,eAAe,CAAA;CACvB,KAAG,oBAAoB,CACzB"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EAEhB,MAAM,WAAW,CAAA;AAElB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAoClD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,iBAAiB,EAChC,KAAK,EAAE,eAAe,GACrB,OAAO,GAAG,MAAM,CAGlB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GACN,EAAE;IACD,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,iBAAiB,CAAA;IAChC,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,oBAAoB,CAgCvB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,aAAa,EAAE,iBAAiB,IACrF,OAAO;IACb,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,eAAe,CAAA;CACvB,KAAG,oBAAoB,CACzB"}

package/dist/authorization/path.js

@@ -33,6 +33,18 @@ function isAllowedByTarget(target, user) {
     const matchesGroup = hasGroupConstraint && user.groups?.some((gid) => target.allowedGroups?.includes(gid));
     return Boolean(matchesUser || matchesGroup);
 }
+/**
+ * Resolve a `defaultPathAccess` config value to an 'allow'/'deny' verdict for one
+ * permission level. String form applies the same value to every level (unchanged
+ * behavior). Object form looks up the level; an absent level resolves to 'deny'
+ * (fail-closed), so scoping e.g. `{ read: 'allow' }` doesn't accidentally open
+ * edit/review.
+ */
+export function resolveDefaultPathAccess(defaultAccess, level) {
+    if (typeof defaultAccess === 'string')
+        return defaultAccess;
+    return defaultAccess[level] ?? 'deny';
+}
 /**
  * Evaluate access for a relative path against config-defined rules.
  * Uses defaultAccess when no rule matches. First matching rule wins.
@@ -60,7 +72,10 @@ export function checkPathAccess({ rules, relativePath, user, defaultAccess, leve
             reason: allowed ? 'allowed_by_rule' : 'denied_by_rule',
         };
     }
-    return { allowed: defaultAccess === 'allow', reason: 'no_rule_match' };
+    return {
+        allowed: resolveDefaultPathAccess(defaultAccess, level) === 'allow',
+        reason: 'no_rule_match',
+    };
 }
 /**
  * Factory to bind rules and defaultAccess once.

package/dist/authorization/path.js.map

@@ -1 +1 @@
-{"version":3,"file":"path.js","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAQrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAKnC;;GAEG;AACH,SAAS,SAAS,CAAC,CAAe;IAChC,MAAM,UAAU,GAAI,CAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAiB,CAAA;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAAoB,EAAE,YAA0B;IACnE,OAAO,SAAS,CAAC,YAAsB,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAwB,EAAE,IAAgB;IACnE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IAEzD,0DAA0D;IAC1D,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvF,OAAO,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GAON;IACC,MAAM,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;IAE9C,0CAA0C;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACvC,SAAQ;QACV,CAAC;QAED,2CAA2C;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4EAA4E;YAC5E,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/C,OAAO;YACL,OAAO;YACP,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;SACvD,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAuB,EAAE,aAAgC;IAC7F,OAAO,CAAC,KAIP,EAAwB,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;AACjF,CAAC"}
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../src/authorization/path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAQrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAKnC;;GAEG;AACH,SAAS,SAAS,CAAC,CAAe;IAChC,MAAM,UAAU,GAAI,CAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAiB,CAAA;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAAoB,EAAE,YAA0B;IACnE,OAAO,SAAS,CAAC,YAAsB,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAwB,EAAE,IAAgB;IACnE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IAEzD,0DAA0D;IAC1D,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAEvF,OAAO,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAgC,EAChC,KAAsB;IAEtB,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAA;IAC3D,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,KAAK,EACL,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,KAAK,GAON;IACC,MAAM,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;IAE9C,0CAA0C;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC3C,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACvC,SAAQ;QACV,CAAC;QAED,2CAA2C;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4EAA4E;YAC5E,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/C,OAAO;YACL,OAAO;YACP,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;SACvD,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,wBAAwB,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,OAAO;QACnE,MAAM,EAAE,eAAe;KACxB,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAuB,EAAE,aAAgC;IAC7F,OAAO,CAAC,KAIP,EAAwB,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;AACjF,CAAC"}

package/dist/authorization/permissions/index.d.ts

@@ -2,5 +2,5 @@
  * Permissions module exports
  */
 export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile } from './schema';
-export { loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './loader';
+export { loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './loader';
 //# sourceMappingURL=index.d.ts.map

package/dist/authorization/permissions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}

package/dist/authorization/permissions/index.js

@@ -2,5 +2,5 @@
  * Permissions module exports
  */
 export { PermissionsFileSchema, createDefaultPermissionsFile } from './schema.js';
-export { loadPermissionsFile, loadPathPermissions, savePathPermissions, ensurePermissionsFile, } from './loader.js';
+export { loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './loader.js';
 //# sourceMappingURL=index.js.map

package/dist/authorization/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAwB,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAwB,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,UAAU,CAAA"}

package/dist/authorization/permissions/loader.d.ts

@@ -1,11 +1,14 @@
 /**
  * Permissions file loader
  *
- * Handles loading and saving path permissions from the filesystem.
+ * Handles loading path permissions from the filesystem and mutating
+ * permissions.json under the cross-host layered lock in
+ * authorization/settings-file-store.ts.
  */
 import type { PathPermission } from '../../config';
 import type { PermissionsFile } from './schema';
 import type { OperatingMode } from '../../operating-mode';
+import type { OccWriteResult } from '../../utils/occ-json-write';
 /**
  * Load full permissions file (for version checking)
  * Returns null if file doesn't exist.
@@ -23,11 +26,22 @@ export declare function loadPermissionsFile(repoRoot: string, mode: OperatingMod
  */
 export declare function loadPathPermissions(repoRoot: string, mode: OperatingMode): Promise<PathPermission[]>;
 /**
- * Save path permissions to .canopycms/permissions.json (or .local.json in dev mode)
+ * Mutate permissions.json (or .local.json in dev mode) under the full
+ * cross-host lock + OCC-retry stack (see
+ * authorization/settings-file-store.ts). `mutate` is called with the
+ * current parsed file (`null` if it doesn't exist yet) and the version to
+ * write under; it returns the next raw payload, or `null` for a deliberate
+ * no-op. The returned payload is validated against
+ * {@link PermissionsFileSchema} before being written, preserving the
+ * previous validate-before-write behavior of the old `savePathPermissions`.
  */
-export declare function savePathPermissions(repoRoot: string, permissions: PathPermission[], updatedBy: string, mode: OperatingMode, contentVersion?: number): Promise<void>;
+export declare function mutatePermissionsFile(repoRoot: string, mode: OperatingMode, mutate: (current: PermissionsFile | null, version: number) => Record<string, unknown> | null, options?: {
+    settleMs?: number;
+    maxAttempts?: number;
+}): Promise<OccWriteResult | null>;
 /**
- * Initialize permissions file if it doesn't exist
+ * Initialize permissions file if it doesn't exist. A no-op when the file is
+ * already present (the mutator returns `null`, so no write happens).
  */
 export declare function ensurePermissionsFile(repoRoot: string, userId: string, mode: OperatingMode): Promise<void>;
 //# sourceMappingURL=loader.d.ts.map

package/dist/authorization/permissions/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAWzD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoBjC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,cAAc,EAAE,EAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAUf"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAShE;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoBjC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAC5F,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAahC;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/authorization/permissions/loader.js

@@ -1,12 +1,14 @@
 /**
  * Permissions file loader
  *
- * Handles loading and saving path permissions from the filesystem.
+ * Handles loading path permissions from the filesystem and mutating
+ * permissions.json under the cross-host layered lock in
+ * authorization/settings-file-store.ts.
  */
 import fs from 'node:fs/promises';
 import { PermissionsFileSchema } from './schema.js';
 import { operatingStrategy } from '../../operating-mode/index.js';
-import { atomicWriteFile } from '../../utils/atomic-write.js';
+import { mutateSettingsJsonFile } from '../settings-file-store.js';
 /**
  * Get the appropriate permissions file path based on mode
  */
@@ -50,33 +52,42 @@ export async function loadPathPermissions(repoRoot, mode) {
     return file?.pathPermissions ?? [];
 }
 /**
- * Save path permissions to .canopycms/permissions.json (or .local.json in dev mode)
+ * Mutate permissions.json (or .local.json in dev mode) under the full
+ * cross-host lock + OCC-retry stack (see
+ * authorization/settings-file-store.ts). `mutate` is called with the
+ * current parsed file (`null` if it doesn't exist yet) and the version to
+ * write under; it returns the next raw payload, or `null` for a deliberate
+ * no-op. The returned payload is validated against
+ * {@link PermissionsFileSchema} before being written, preserving the
+ * previous validate-before-write behavior of the old `savePathPermissions`.
  */
-export async function savePathPermissions(repoRoot, permissions, updatedBy, mode, contentVersion) {
+export async function mutatePermissionsFile(repoRoot, mode, mutate, options) {
     const permissionsPath = getPermissionsFilePath(repoRoot, mode);
-    const permissionsFile = {
-        version: 1,
-        contentVersion: contentVersion ?? 1,
-        updatedAt: new Date().toISOString(),
-        updatedBy,
-        pathPermissions: permissions,
-    };
-    // Validate before writing
-    PermissionsFileSchema.parse(permissionsFile);
-    await atomicWriteFile(permissionsPath, JSON.stringify(permissionsFile, null, 2));
+    return mutateSettingsJsonFile({
+        filePath: permissionsPath,
+        parse: (raw) => PermissionsFileSchema.parse(JSON.parse(raw)),
+        mutate: (current, version) => {
+            const payload = mutate(current, version);
+            return payload === null ? null : PermissionsFileSchema.parse(payload);
+        },
+        settleMs: options?.settleMs,
+        maxAttempts: options?.maxAttempts,
+    });
 }
 /**
- * Initialize permissions file if it doesn't exist
+ * Initialize permissions file if it doesn't exist. A no-op when the file is
+ * already present (the mutator returns `null`, so no write happens).
  */
 export async function ensurePermissionsFile(repoRoot, userId, mode) {
-    const permissionsPath = getPermissionsFilePath(repoRoot, mode);
-    try {
-        await fs.access(permissionsPath);
-        // File exists, nothing to do
-    }
-    catch {
-        // File doesn't exist, create default
-        await savePathPermissions(repoRoot, [], userId, mode);
-    }
+    await mutatePermissionsFile(repoRoot, mode, (current) => {
+        if (current) {
+            return null;
+        }
+        return {
+            updatedAt: new Date().toISOString(),
+            updatedBy: userId,
+            pathPermissions: [],
+        };
+    });
 }
 //# sourceMappingURL=loader.js.map

package/dist/authorization/permissions/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE1D;;GAEG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,IAAmB;IACnE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB;QACrB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,gDAAgD;QAChD,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;QACnE,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACxF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACtD,OAAO,IAAI,EAAE,eAAe,IAAI,EAAE,CAAA;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,WAA6B,EAC7B,SAAiB,EACjB,IAAmB,EACnB,cAAuB;IAEvB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,MAAM,eAAe,GAAoB;QACvC,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,cAAc,IAAI,CAAC;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,eAAe,EAAE,WAAW;KAC7B,CAAA;IAED,0BAA0B;IAC1B,qBAAqB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;IAE5C,MAAM,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,MAAc,EACd,IAAmB;IAEnB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QAChC,6BAA6B;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACvD,CAAC;AACH,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/authorization/permissions/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAGjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAG/D;;GAEG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,IAAmB;IACnE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qBAAqB;QACrB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,gDAAgD;QAChD,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;QACnE,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACxF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACtD,OAAO,IAAI,EAAE,eAAe,IAAI,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,IAAmB,EACnB,MAA4F,EAC5F,OAAqD;IAErD,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAE9D,OAAO,sBAAsB,CAAkB;QAC7C,QAAQ,EAAE,eAAe;QACzB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACxC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACvE,CAAC;QACD,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAC3B,WAAW,EAAE,OAAO,EAAE,WAAW;KAClC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,MAAc,EACd,IAAmB;IAEnB,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,MAAM;YACjB,eAAe,EAAE,EAAE;SACpB,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}