feat(esign): choose which roles and permissions may use each drive

docs/design.md

@@ -447,5 +447,9 @@ Rules that the templates above don't imply.
   With several documents waiting, "Sign N together" opens a strip of the documents in the page bar's toolbar row: each
   is checked by opening it (a check replaces its number), can be left out, and the primary action stays "Next
   document" until all are checked, then becomes "Sign N documents" (one agent window, one PIN).
+  Signatures › Drives (`esign:drives:manage`) has a card per drive with two rules, "Request signatures" and "Be asked
+  to sign": chips for roles (people icon) and permissions (key icon), an inline picker listing both, a "Default: …"
+  line while empty, and Save/Discard per drive. Unknown keys show as warning chips. On a new request, signers who may
+  not sign the documents of the chosen drives are left out of the list, with a line saying why.
 - **Account**: permissions are grouped by area (Dashboard, Telegram, WhatsApp, group labels, Microsoft 365, Web) with
   the service icon.

docs/esign/TRACKER.md

@@ -123,6 +123,9 @@ Legend: ☐ todo · ◐ in progress · ☑ done
   mark, covered by it); the person appears once in the dashboard (backend#75, admin PR, sign-agent#6).
 - ☑ Sign several documents with one PIN: "Sign N together" in To sign opens a document strip to check each, then one
   agent window signs them all (agent protocol 2; older agents are asked to update).
+- ☑ Drive access by role or permission (Signatures › Drives): who may request with each drive and who may be asked to
+  sign its documents; default unchanged (auth#62 roles + catalog in the snapshot, auth-kit#2, backend, admin).
+- ☐ Create the IdP permission `esign:drives:manage` and grant it to whoever sets drive access (master admins get it).
 - ☐ Real-card check that one PIN can make several signatures in a session (`cie-mw`, `opencie`, built-in `cie`).
 - ☐ Docs: user guide (install agent, pair CIE), ops (Graph permissions, IdP permissions, env).
 

docs/esign/contracts.md

@@ -82,6 +82,12 @@ browse OneDrive). Requests are visible to their signers and creator.
   update); each signer has 1–20 places, at least one a signature, and appears once in the request.
 - `esign.requests.list({scope: "inbox"|"mine"|"all", status?})`, `esign.requests.get({id})`.
 - `esign.requests.cancel({id})`, `esign.requests.decline({id, reason})`, `esign.requests.retryDelivery({id})`.
+- `esign.drive.access()` (`esign:drives:manage`) → `{drives: [{id, label, request: {roles, permissions}, sign: {roles,
+permissions}, updatedBySub, updatedAt}], catalog: {roles: [{key, name}], permissions: [{key, name}]}}`;
+  `esign.drive.setAccess({driveId, request, sign})`. A rule names roles and permissions, any of which grants it; an
+  empty rule keeps the default (request: `esign:requests:manage`; sign: everyone who signs). `request` covers browsing
+  the drive, using it in a request and seeing its requests; `sign` covers being chosen as signer and signing. Requests
+  record `drives` (source and output); `esign.config().drives` and `esign.signers.list()[].drives` are filtered.
 - `esign.jobs.create({items: [{requestId, places?}]})` (1–10, all or none) → `[{requestId, jobId, ticket, expiresAt}]`,
   opened together in one agent window; `places` moves the caller's boxes (one position per place) before signing.
   `esign.jobs.statuses({jobIds})`, `esign.jobs.cancel({jobIds})`.

package.json

@@ -16,7 +16,7 @@
   "dependencies": {
     "@base-ui/react": "^1.6.0",
     "@dnd-kit/react": "^0.4.0",
-    "@polinetwork/backend": "^1.9.0",
+    "@polinetwork/backend": "^1.10.0",
     "@t3-oss/env-core": "^0.13.10",
     "@tanstack/charts": "1.1.0",
     "@tanstack/react-charts": "1.1.0",

src/components/shell/nav.ts

@@ -9,6 +9,7 @@ import {
   FolderKanban,
   FolderTree,
   Globe,
+  HardDrive,
   Inbox,
   LayoutDashboard,
   type LucideIcon,
@@ -86,6 +87,7 @@ export type PageMatch =
   | { kind: "esign-request"; id: string }
   | { kind: "esign-new" }
   | { kind: "esign-sign" }
+  | { kind: "esign-drives" }
   | { kind: "esign-setup" }
   | { kind: "reports-open" }
   | { kind: "reports-closed" }
@@ -261,6 +263,13 @@ const esign: Service = {
       permission: "esign:sign",
       searchPlaceholder: "Search by title or signer…",
     },
+    {
+      id: "drives",
+      title: "Drives",
+      icon: HardDrive,
+      path: "/dashboard/esign/drives",
+      permission: "esign:drives:manage",
+    },
     { id: "setup", title: "Setup", icon: MonitorDown, path: "/dashboard/esign/setup", permission: "esign:sign" },
   ],
 }
@@ -357,6 +366,7 @@ export function matchPath(pathname: string): PageMatch {
       if (second === "requests") return { kind: "esign-requests" }
       if (second === "new") return { kind: "esign-new" }
       if (second === "sign") return { kind: "esign-sign" }
+      if (second === "drives") return { kind: "esign-drives" }
       if (second === "setup") return { kind: "esign-setup" }
     }
     if (second === "requests" && third !== undefined && /^[0-9a-f-]{36}$/i.test(third)) {
@@ -403,6 +413,7 @@ export function serviceFor(match: PageMatch): Service {
     case "esign-request":
     case "esign-new":
     case "esign-sign":
+    case "esign-drives":
     case "esign-setup":
       return esign
     case "reports-open":
@@ -452,6 +463,8 @@ export function sectionFor(match: PageMatch): Section | null {
     case "esign-request":
     case "esign-new":
       return section(esign, "requests")
+    case "esign-drives":
+      return section(esign, "drives")
     case "esign-setup":
       return section(esign, "setup")
     case "reports-open":