AGENTS.md@packages/client/src/lib/access-grants git:20260921.826475cA

Immutable. This exact content is served forever at /api/v1/blob/8ba81447308d49fe.

# DOX — packages/client/src/lib/access-grants

Files in this directory. One row per source file.

| File | Purpose |
|------|---------|
| `access-grants-api.ts` | Transport for the Settings → Access tab. `fetchAccessSnapshot()` (ONE aggregate `GET /api/access/grants` — the only request the tab issues; render performs zero store writes, task 7.7) + `revokeAccessEntry(entry)` routing per store to ITS OWN write path (task 7.5): path grants → `DELETE /api/access/grants`, worktree trust → `DELETE /api/access/worktree-trust`, KB trust → `DELETE /api/kb/source-trust`, project trust → `DELETE /api/access/project-trust` (the `persistTrustDecision` wrapper — DELETE, never a standing refusal, design D13), trustedNetworks → `DELETE /api/access/trusted-network`, corsOrigins → `DELETE /api/access/cors-origin`, bypassHosts → `DELETE /api/access/bypass-hosts`, pinned dirs → `DELETE /api/access/pinned-directory`. EVERY store is per-entry, so no client snapshot is passed: array-valued config stores are read-modify-written server-side, which is what makes concurrent revokes safe (task 4.5 #5 — previously a whole-array `PUT /api/config` computed from a rendered snapshot, so two revokes could resurrect each other). NEVER creates a grant (design D12). `GET /api/access/grants` is owned by the server side of the change; this module is the client contract. See change: add-access-grants-and-review. |
| `access-grants-types.ts` | Types for the Access review surface. `ACCESS_STORES` — EXACTLY the eight in-scope stores (design D6): `pathGrants`, `worktreeTrust`, `kbTrust`, `projectTrust`, `trustedNetworks`, `bypassHosts`, `corsOrigins`, `pinnedDirectories`. Deliberately excluded (rationale in design D6, pinned by test): `paired-devices.json` (own management surface), `auth.bypassUrls` (route access → auth config surface). `AccessGrantSnapshot` (per-store raw shapes; kb entries carry optional additive `subject` beside `hash`), `AccessEntry` (labelled row; `legacyHashOnly` flag), `emptyAccessGrantSnapshot()`. Session-scoped grants carry the same four fields as persisted ones (subject/scope/grantedAt/origin — design D17). See change: add-access-grants-and-review. |
| `aggregate-access-entries.ts` | PURE aggregation: `aggregateAccessEntries(snapshot)` maps the eight-store snapshot to `AccessEntry[]` (every entry labelled with its origin store; bypassHosts never merged with trustedNetworks; legacy hash-only kb entries display the opaque hash and never error; stable `ACCESS_STORES`-order sort) + `groupAccessEntriesByStore(entries)` (non-empty groups in display order). Pure so fixture tests run without a live server. Tests: `__tests__/aggregate-access-entries.test.ts` (7.2/7.3/7.6/7.13), `__tests__/access-grants-api.test.ts` (7.5/7.8/7.12). See change: add-access-grants-and-review. |