@bevel-software/platform-core-backend 0.1.0

package/dist/modules/access/roles-edit.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Pure parse → edit → re-emit editor for `roles.yaml`.
+ *
+ * WHY re-emit and not a line-splice (cf. `access-splice.ts`): `access-splice.ts`
+ * splices `access.md` line-by-line specifically because those files carry a
+ * markdown BODY below the frontmatter (the repo-root one is a whole README)
+ * that a parse→emit round-trip would silently delete. `roles.yaml` has no body
+ * and no frontmatter fence — it is a plain `roles:` mapping of display-name →
+ * email list — and no real `roles.yaml` in the repo carries comments. So we
+ * parse the file into a model, apply the edit, and re-emit a canonical,
+ * deterministic file. Re-emit is idempotent (re-emitting an unchanged model
+ * yields byte-identical text), so a single edit moves only the lines it
+ * actually changes. The trade-off — hand-written comments are not preserved —
+ * is a documented non-goal.
+ *
+ *   roles:                       (always the top-level key)
+ *     Admin:                     (role display name, indent 2)
+ *       - a@x.eu                 (member email, indent 4)
+ *       - b@x.eu
+ *     Empty Role: []             (the only empty-list form the subset parser
+ *                                  reads back — a bare `Empty Role:` parses to
+ *                                  null and fails parseRolesYaml's list check)
+ *
+ * Every mutation returns `{ text, changed }`; `changed: false` means the edit
+ * was a no-op (e.g. adding a member who already exists) and the caller should
+ * skip the commit. Role ORDER is preserved as parsed; a newly created role is
+ * appended last. Member emails within a role are canonicalised + de-duplicated.
+ *
+ * This module does NOT enforce the Admin-must-exist / no-self-lockout
+ * invariants — those are policy and live in `roles-admin.service.ts`. It only
+ * guarantees the emitted text is structurally well-formed YAML the resolver can
+ * load (the service additionally runs `validateRolesYaml` as a backstop gate).
+ */
+/** Bad-input failure when editing roles.yaml (invalid name/email, unknown role). */
+export declare class RolesEditError extends Error {
+    readonly status: number;
+    constructor(message: string, status?: number);
+}
+/** One role in parse order: display name + its de-duplicated member emails. */
+export interface RoleModel {
+    displayName: string;
+    /** canonicalised, de-duplicated, in first-seen order */
+    members: string[];
+}
+export type RolesModel = RoleModel[];
+export interface EditResult {
+    text: string;
+    changed: boolean;
+}
+/**
+ * Reject role display names whose characters would corrupt the emitted YAML.
+ * `canonicalRoleName` only trims/lowercases/collapses spaces — it does NOT
+ * reject structural characters, so a name like `Sales: West` or `#temp` would
+ * round-trip into a broken file. This guard is the structural complement to the
+ * reserved/duplicate checks the service layer applies.
+ *
+ *   `:`        mis-tokenises as a nested mapping key
+ *   `#`        truncated as a comment by the subset parser's stripComment
+ *   `<` / `>`  collide with the `Name <email>` user-reference shape
+ *   leading -  tokenises as a list item
+ *   \x00-\x1f  control chars / newlines break line structure outright
+ */
+export declare function assertSafeRoleDisplayName(displayName: string): void;
+/**
+ * Parse `roles.yaml` text into the ordered model. Tolerant of an empty/missing
+ * file (yields `[]`). Throws RolesEditError on structurally-broken YAML — the
+ * caller reads under the lock, so a broken on-disk file is an operator problem
+ * surfaced as a 422, not a silent reset.
+ */
+export declare function parseRolesModel(text: string): RolesModel;
+/**
+ * Re-emit the model as canonical `roles.yaml` text. Deterministic: same model →
+ * same bytes. An empty role is emitted as `Name: []` (round-trippable); a role
+ * with members is emitted as a block list. Always ends with a trailing newline.
+ */
+export declare function emitRolesModel(model: RolesModel): string;
+/** Create a new empty role. 422 on reserved/duplicate/structurally-unsafe name. */
+export declare function createRole(text: string, displayName: string): EditResult;
+/** Delete a role by canonical name. 404 if absent. */
+export declare function deleteRole(text: string, canonical: string): EditResult;
+/** Add a member email to a role. Idempotent. 422 bad email; 404 unknown role. */
+export declare function addMember(text: string, canonical: string, rawEmail: string): EditResult;
+/** Remove a member email from a role. 404 unknown role; no-op if not a member. */
+export declare function removeMember(text: string, canonical: string, rawEmail: string): EditResult;
+/**
+ * Rename a role's display name. The canonical name MAY change (the service
+ * layer is responsible for the reference rewrite + Admin guard when it does).
+ * 404 unknown source; 422 reserved/duplicate/unsafe target.
+ */
+export declare function renameRoleDisplay(text: string, canonical: string, newDisplayName: string): EditResult;
+//# sourceMappingURL=roles-edit.d.ts.map

package/dist/modules/access/roles-edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles-edit.d.ts","sourceRoot":"","sources":["../../../src/modules/access/roles-edit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAUH,oFAAoF;AACpF,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,MAAM,SAAM;CAK1C;AAED,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,EAAE,CAAC;AAErC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAanE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAyCxD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAWxD;AAqBD,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CAYxE;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAMtE;AAED,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CASvF;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAS1F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,UAAU,CAcrG"}

package/dist/modules/access/roles-edit.js

@@ -0,0 +1,232 @@
+/**
+ * Pure parse → edit → re-emit editor for `roles.yaml`.
+ *
+ * WHY re-emit and not a line-splice (cf. `access-splice.ts`): `access-splice.ts`
+ * splices `access.md` line-by-line specifically because those files carry a
+ * markdown BODY below the frontmatter (the repo-root one is a whole README)
+ * that a parse→emit round-trip would silently delete. `roles.yaml` has no body
+ * and no frontmatter fence — it is a plain `roles:` mapping of display-name →
+ * email list — and no real `roles.yaml` in the repo carries comments. So we
+ * parse the file into a model, apply the edit, and re-emit a canonical,
+ * deterministic file. Re-emit is idempotent (re-emitting an unchanged model
+ * yields byte-identical text), so a single edit moves only the lines it
+ * actually changes. The trade-off — hand-written comments are not preserved —
+ * is a documented non-goal.
+ *
+ *   roles:                       (always the top-level key)
+ *     Admin:                     (role display name, indent 2)
+ *       - a@x.eu                 (member email, indent 4)
+ *       - b@x.eu
+ *     Empty Role: []             (the only empty-list form the subset parser
+ *                                  reads back — a bare `Empty Role:` parses to
+ *                                  null and fails parseRolesYaml's list check)
+ *
+ * Every mutation returns `{ text, changed }`; `changed: false` means the edit
+ * was a no-op (e.g. adding a member who already exists) and the caller should
+ * skip the commit. Role ORDER is preserved as parsed; a newly created role is
+ * appended last. Member emails within a role are canonicalised + de-duplicated.
+ *
+ * This module does NOT enforce the Admin-must-exist / no-self-lockout
+ * invariants — those are policy and live in `roles-admin.service.ts`. It only
+ * guarantees the emitted text is structurally well-formed YAML the resolver can
+ * load (the service additionally runs `validateRolesYaml` as a backstop gate).
+ */
+import { parseYamlSubset, canonicalRoleName, canonicalEmail, EMAIL_REGEX, RESERVED_ROLE_NAMES, } from './access-control.service.js';
+/** Bad-input failure when editing roles.yaml (invalid name/email, unknown role). */
+export class RolesEditError extends Error {
+    status;
+    constructor(message, status = 422) {
+        super(message);
+        this.name = 'RolesEditError';
+        this.status = status;
+    }
+}
+/**
+ * Reject role display names whose characters would corrupt the emitted YAML.
+ * `canonicalRoleName` only trims/lowercases/collapses spaces — it does NOT
+ * reject structural characters, so a name like `Sales: West` or `#temp` would
+ * round-trip into a broken file. This guard is the structural complement to the
+ * reserved/duplicate checks the service layer applies.
+ *
+ *   `:`        mis-tokenises as a nested mapping key
+ *   `#`        truncated as a comment by the subset parser's stripComment
+ *   `<` / `>`  collide with the `Name <email>` user-reference shape
+ *   leading -  tokenises as a list item
+ *   \x00-\x1f  control chars / newlines break line structure outright
+ */
+export function assertSafeRoleDisplayName(displayName) {
+    const trimmed = displayName.trim();
+    if (!trimmed)
+        throw new RolesEditError('role name must not be empty');
+    if (/[:#<>]/.test(trimmed)) {
+        throw new RolesEditError(`role name must not contain ':', '#', '<', or '>': ${JSON.stringify(displayName)}`);
+    }
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x1f]/.test(trimmed)) {
+        throw new RolesEditError(`role name must not contain control characters: ${JSON.stringify(displayName)}`);
+    }
+    if (trimmed.startsWith('-')) {
+        throw new RolesEditError(`role name must not start with '-': ${JSON.stringify(displayName)}`);
+    }
+}
+/**
+ * Parse `roles.yaml` text into the ordered model. Tolerant of an empty/missing
+ * file (yields `[]`). Throws RolesEditError on structurally-broken YAML — the
+ * caller reads under the lock, so a broken on-disk file is an operator problem
+ * surfaced as a 422, not a silent reset.
+ */
+export function parseRolesModel(text) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        return [];
+    const parsed = parseYamlSubset(text);
+    if (!parsed.ok)
+        throw new RolesEditError(`roles.yaml: ${parsed.error}`);
+    const root = parsed.value;
+    if (root == null || typeof root !== 'object' || Array.isArray(root)) {
+        throw new RolesEditError('roles.yaml: must be a top-level mapping');
+    }
+    const rolesNode = root.roles;
+    if (rolesNode == null)
+        return [];
+    if (typeof rolesNode !== 'object' || Array.isArray(rolesNode)) {
+        throw new RolesEditError("roles.yaml: 'roles' must be a mapping");
+    }
+    const model = [];
+    for (const [displayName, value] of Object.entries(rolesNode)) {
+        const members = [];
+        // A role value must be a list of emails, an empty list (`[]`), or null
+        // (`Role:` with no members). Any OTHER shape (a scalar string, a nested
+        // mapping) is a malformed file — surface it as the documented 422 rather
+        // than silently coercing it to an empty role (CodeRabbit: a coerce would
+        // let an unrelated edit rewrite a broken roles.yaml).
+        if (value !== null && !Array.isArray(value)) {
+            throw new RolesEditError(`roles.yaml: role '${displayName.trim()}' must be a list of emails`);
+        }
+        if (Array.isArray(value)) {
+            const seen = new Set();
+            for (const raw of value) {
+                // A non-string member entry is malformed — reject, don't drop.
+                if (typeof raw !== 'string') {
+                    throw new RolesEditError(`roles.yaml: role '${displayName.trim()}' has a non-string member`);
+                }
+                const email = canonicalEmail(raw);
+                if (!email || seen.has(email))
+                    continue;
+                seen.add(email);
+                members.push(email);
+            }
+        }
+        model.push({ displayName: displayName.trim(), members });
+    }
+    return model;
+}
+/**
+ * Re-emit the model as canonical `roles.yaml` text. Deterministic: same model →
+ * same bytes. An empty role is emitted as `Name: []` (round-trippable); a role
+ * with members is emitted as a block list. Always ends with a trailing newline.
+ */
+export function emitRolesModel(model) {
+    const lines = ['roles:'];
+    for (const role of model) {
+        if (role.members.length === 0) {
+            lines.push(`  ${role.displayName}: []`);
+        }
+        else {
+            lines.push(`  ${role.displayName}:`);
+            for (const email of role.members)
+                lines.push(`    - ${email}`);
+        }
+    }
+    return lines.join('\n') + '\n';
+}
+function findRole(model, canonical) {
+    return model.find((r) => canonicalRoleName(r.displayName) === canonical);
+}
+function reemit(original, model) {
+    const text = emitRolesModel(model);
+    // Compare against a re-emit of the ORIGINAL so a pure formatting difference
+    // (e.g. legacy spacing) doesn't masquerade as a content change — `changed`
+    // tracks whether the canonical model moved, which is what the commit cares
+    // about.
+    let originalCanonical;
+    try {
+        originalCanonical = emitRolesModel(parseRolesModel(original));
+    }
+    catch {
+        originalCanonical = original;
+    }
+    return { text, changed: text !== originalCanonical };
+}
+/** Create a new empty role. 422 on reserved/duplicate/structurally-unsafe name. */
+export function createRole(text, displayName) {
+    assertSafeRoleDisplayName(displayName);
+    const canonical = canonicalRoleName(displayName);
+    if (RESERVED_ROLE_NAMES.has(canonical)) {
+        throw new RolesEditError(`'${displayName.trim()}' is a reserved name and cannot be a role`);
+    }
+    const model = parseRolesModel(text);
+    if (findRole(model, canonical)) {
+        throw new RolesEditError(`a role named '${displayName.trim()}' already exists`);
+    }
+    model.push({ displayName: displayName.trim(), members: [] });
+    return reemit(text, model);
+}
+/** Delete a role by canonical name. 404 if absent. */
+export function deleteRole(text, canonical) {
+    const model = parseRolesModel(text);
+    const idx = model.findIndex((r) => canonicalRoleName(r.displayName) === canonical);
+    if (idx < 0)
+        throw new RolesEditError(`role not found: ${canonical}`, 404);
+    model.splice(idx, 1);
+    return reemit(text, model);
+}
+/** Add a member email to a role. Idempotent. 422 bad email; 404 unknown role. */
+export function addMember(text, canonical, rawEmail) {
+    const email = canonicalEmail(rawEmail);
+    if (!EMAIL_REGEX.test(email))
+        throw new RolesEditError(`malformed email: ${JSON.stringify(rawEmail)}`);
+    const model = parseRolesModel(text);
+    const role = findRole(model, canonical);
+    if (!role)
+        throw new RolesEditError(`role not found: ${canonical}`, 404);
+    if (role.members.includes(email))
+        return { text: emitRolesModel(model), changed: false };
+    role.members.push(email);
+    return reemit(text, model);
+}
+/** Remove a member email from a role. 404 unknown role; no-op if not a member. */
+export function removeMember(text, canonical, rawEmail) {
+    const email = canonicalEmail(rawEmail);
+    const model = parseRolesModel(text);
+    const role = findRole(model, canonical);
+    if (!role)
+        throw new RolesEditError(`role not found: ${canonical}`, 404);
+    const idx = role.members.indexOf(email);
+    if (idx < 0)
+        return { text: emitRolesModel(model), changed: false };
+    role.members.splice(idx, 1);
+    return reemit(text, model);
+}
+/**
+ * Rename a role's display name. The canonical name MAY change (the service
+ * layer is responsible for the reference rewrite + Admin guard when it does).
+ * 404 unknown source; 422 reserved/duplicate/unsafe target.
+ */
+export function renameRoleDisplay(text, canonical, newDisplayName) {
+    assertSafeRoleDisplayName(newDisplayName);
+    const newCanonical = canonicalRoleName(newDisplayName);
+    if (RESERVED_ROLE_NAMES.has(newCanonical)) {
+        throw new RolesEditError(`'${newDisplayName.trim()}' is a reserved name and cannot be a role`);
+    }
+    const model = parseRolesModel(text);
+    const role = findRole(model, canonical);
+    if (!role)
+        throw new RolesEditError(`role not found: ${canonical}`, 404);
+    if (newCanonical !== canonical && findRole(model, newCanonical)) {
+        throw new RolesEditError(`a role named '${newDisplayName.trim()}' already exists`);
+    }
+    role.displayName = newDisplayName.trim();
+    return reemit(text, model);
+}
+//# sourceMappingURL=roles-edit.js.map

package/dist/modules/access/roles-edit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles-edit.js","sourceRoot":"","sources":["../../../src/modules/access/roles-edit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,oFAAoF;AACpF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACxB,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,cAAc,CAAC,6BAA6B,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,cAAc,CAAC,qDAAqD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,4CAA4C;IAC5C,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,cAAc,CAAC,kDAAkD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,cAAc,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,cAAc,CAAC,yCAAyC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,SAAS,GAAI,IAAgC,CAAC,KAAK,CAAC;IAC1D,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,cAAc,CAAC,uCAAuC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;QACxF,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,cAAc,CAAC,qBAAqB,WAAW,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,+DAA+D;gBAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC5B,MAAM,IAAI,cAAc,CAAC,qBAAqB,WAAW,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;gBAC/F,CAAC;gBACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,KAAK,GAAa,CAAC,QAAQ,CAAC,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,MAAM,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAiB,EAAE,SAAiB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,KAAiB;IACjD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACnC,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,SAAS;IACT,IAAI,iBAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,iBAAiB,GAAG,cAAc,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,iBAAiB,EAAE,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,WAAmB;IAC1D,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,cAAc,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,2CAA2C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,cAAc,CAAC,iBAAiB,WAAW,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB;IACxD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC;IACnF,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,mBAAmB,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3E,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB,EAAE,QAAgB;IACzE,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,cAAc,CAAC,mBAAmB,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB,EAAE,QAAgB;IAC5E,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,cAAc,CAAC,mBAAmB,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiB,EAAE,cAAsB;IACvF,yBAAyB,CAAC,cAAc,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,cAAc,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,2CAA2C,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,cAAc,CAAC,mBAAmB,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,cAAc,CAAC,iBAAiB,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/modules/access/roles-yaml-guard.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pre-disk validity gate for `roles.yaml`.
+ *
+ * WHY this exists: `roles.yaml` is the single point of failure for the whole
+ * app. The runtime resolver's `loadModel` HARD-THROWS `AccessConfigError` on a
+ * parse failure, and `isAdmin` swallows that into `false` for EVERYONE — so a
+ * single malformed `roles.yaml` is an app-wide, in-app-unrecoverable admin
+ * lockout. The dedicated Roles & Members service already validates every
+ * candidate before writing (`assertLoadable`), but the two RAW write paths do
+ * not:
+ *   - the human editor save  (`PUT /workspace/:id/file`)
+ *   - the agent's file tools (`LockingFilesystem.writeFile` / `writeFiles`)
+ *
+ * Both of those let an admin (or an admin-driven agent) commit a broken file.
+ * This guard plugs them: it runs the resolver's OWN parser on the candidate
+ * BEFORE a byte hits disk, and refuses the write with a 422 on any error. A
+ * write that passes here is loadable by `loadModel`, so the lockout becomes
+ * structurally unreachable through normal edits.
+ *
+ * The break-glass recovery path (for a file that got broken some OTHER way —
+ * a direct git push, a pre-guard commit) lives in `roles-admin.service.ts`.
+ */
+import type { FileContent } from '@mastra/core/workspace';
+import { WorkflowDomainError } from '../workflow/workflow.errors.js';
+/** Repo-relative basename of the roles file (it lives at the KB repo root). */
+export declare const ROLES_YAML_BASENAME = "roles.yaml";
+/**
+ * A raw write whose candidate `roles.yaml` would not parse. 422 (bad input) —
+ * the edit is refused and nothing is written. Carries the parser errors so the
+ * editor / agent can show exactly what's wrong.
+ */
+export declare class RolesYamlInvalidError extends WorkflowDomainError {
+    readonly errors: string[];
+    constructor(errors: string[]);
+}
+/**
+ * True iff `workspaceRelPath` targets the KB's `roles.yaml` (the file at
+ * `<kbDirName>/roles.yaml`). Both the human save route and the agent's
+ * `LockingFilesystem` speak workspace-relative paths, so this is the form we
+ * key on. A bare `roles.yaml` (no KB prefix) is also accepted defensively.
+ */
+export declare function isRolesYamlPath(workspaceRelPath: string, kbDirName: string): boolean;
+/**
+ * Throw {@link RolesYamlInvalidError} if `content` does not parse as a valid
+ * `roles.yaml` per the resolver's own parser. No-op on valid content.
+ */
+export declare function assertRolesYamlParsable(content: string): void;
+/**
+ * A `LockingFilesystem` write-validator scoped to a KB dir: refuses a raw write
+ * that would leave `roles.yaml` unparseable. Pass the returned closure as the
+ * filesystem's `validateWrite` hook. Only string writes are checked — every
+ * code path that writes `roles.yaml` writes it as text; a binary write to that
+ * path is nonsensical and left alone.
+ */
+export declare function makeRolesYamlWriteValidator(kbDirName: string): (path: string, content: FileContent) => void;
+//# sourceMappingURL=roles-yaml-guard.d.ts.map

package/dist/modules/access/roles-yaml-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles-yaml-guard.d.ts","sourceRoot":"","sources":["../../../src/modules/access/roles-yaml-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACd,MAAM,EAAE,MAAM,EAAE;CAS7B;AAOD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAGpF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAChB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,IAAI,CAM9C"}

package/dist/modules/access/roles-yaml-guard.js

@@ -0,0 +1,79 @@
+/**
+ * Pre-disk validity gate for `roles.yaml`.
+ *
+ * WHY this exists: `roles.yaml` is the single point of failure for the whole
+ * app. The runtime resolver's `loadModel` HARD-THROWS `AccessConfigError` on a
+ * parse failure, and `isAdmin` swallows that into `false` for EVERYONE — so a
+ * single malformed `roles.yaml` is an app-wide, in-app-unrecoverable admin
+ * lockout. The dedicated Roles & Members service already validates every
+ * candidate before writing (`assertLoadable`), but the two RAW write paths do
+ * not:
+ *   - the human editor save  (`PUT /workspace/:id/file`)
+ *   - the agent's file tools (`LockingFilesystem.writeFile` / `writeFiles`)
+ *
+ * Both of those let an admin (or an admin-driven agent) commit a broken file.
+ * This guard plugs them: it runs the resolver's OWN parser on the candidate
+ * BEFORE a byte hits disk, and refuses the write with a 422 on any error. A
+ * write that passes here is loadable by `loadModel`, so the lockout becomes
+ * structurally unreachable through normal edits.
+ *
+ * The break-glass recovery path (for a file that got broken some OTHER way —
+ * a direct git push, a pre-guard commit) lives in `roles-admin.service.ts`.
+ */
+import { parseRolesYaml } from './access-control.service.js';
+import { WorkflowDomainError } from '../workflow/workflow.errors.js';
+/** Repo-relative basename of the roles file (it lives at the KB repo root). */
+export const ROLES_YAML_BASENAME = 'roles.yaml';
+/**
+ * A raw write whose candidate `roles.yaml` would not parse. 422 (bad input) —
+ * the edit is refused and nothing is written. Carries the parser errors so the
+ * editor / agent can show exactly what's wrong.
+ */
+export class RolesYamlInvalidError extends WorkflowDomainError {
+    errors;
+    constructor(errors) {
+        super(`roles.yaml would be invalid and was not saved: ${errors.join('; ')}`, 422, { kind: 'roles-yaml-invalid', rolesYamlErrors: errors });
+        this.name = 'RolesYamlInvalidError';
+        this.errors = errors;
+    }
+}
+/** Normalise a workspace-relative path: backslashes → `/`, strip a leading `./`. */
+function normalizeWsPath(p) {
+    return p.replace(/\\/g, '/').replace(/^\.\//, '');
+}
+/**
+ * True iff `workspaceRelPath` targets the KB's `roles.yaml` (the file at
+ * `<kbDirName>/roles.yaml`). Both the human save route and the agent's
+ * `LockingFilesystem` speak workspace-relative paths, so this is the form we
+ * key on. A bare `roles.yaml` (no KB prefix) is also accepted defensively.
+ */
+export function isRolesYamlPath(workspaceRelPath, kbDirName) {
+    const norm = normalizeWsPath(workspaceRelPath);
+    return norm === `${kbDirName}/${ROLES_YAML_BASENAME}` || norm === ROLES_YAML_BASENAME;
+}
+/**
+ * Throw {@link RolesYamlInvalidError} if `content` does not parse as a valid
+ * `roles.yaml` per the resolver's own parser. No-op on valid content.
+ */
+export function assertRolesYamlParsable(content) {
+    const parsed = parseRolesYaml(content);
+    if (!parsed.ok)
+        throw new RolesYamlInvalidError(parsed.errors);
+}
+/**
+ * A `LockingFilesystem` write-validator scoped to a KB dir: refuses a raw write
+ * that would leave `roles.yaml` unparseable. Pass the returned closure as the
+ * filesystem's `validateWrite` hook. Only string writes are checked — every
+ * code path that writes `roles.yaml` writes it as text; a binary write to that
+ * path is nonsensical and left alone.
+ */
+export function makeRolesYamlWriteValidator(kbDirName) {
+    return (path, content) => {
+        if (typeof content !== 'string')
+            return;
+        if (!isRolesYamlPath(path, kbDirName))
+            return;
+        assertRolesYamlParsable(content);
+    };
+}
+//# sourceMappingURL=roles-yaml-guard.js.map

package/dist/modules/access/roles-yaml-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles-yaml-guard.js","sourceRoot":"","sources":["../../../src/modules/access/roles-yaml-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,MAAM,CAAW;IAC1B,YAAY,MAAgB;QAC1B,KAAK,CACH,kDAAkD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,EAAE,CACxD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB,EAAE,SAAiB;IACzE,MAAM,IAAI,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAC/C,OAAO,IAAI,KAAK,GAAG,SAAS,IAAI,mBAAmB,EAAE,IAAI,IAAI,KAAK,mBAAmB,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB;IAEjB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO;QACxC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,OAAO;QAC9C,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/admin/admin-access.routes.d.ts

@@ -0,0 +1,18 @@
+import express from 'express';
+import type { IAdminAccessService } from './admin.interface.js';
+import '../auth/auth.middleware.js';
+/**
+ * The CORE slice of the admin surface: just the admin-status resolver the
+ * frontend branches on (AdminMenu's "Admin only" section, the roles-recovery
+ * banner). The full admin router (feedback inbox, user administration /
+ * GDPR erasure) is an enterprise extension mounted via
+ * `ServerExtensions.authed`.
+ *
+ * NOTE (core split): in bevel-platform this endpoint lives in the enterprise
+ * `admin.routes.ts`; core serves it itself so a core-only deployment can
+ * resolve admin status. Express keeps first-match-wins, so an enterprise
+ * overlay's own `/admin/access` (mounted later) never shadows this one —
+ * both resolve through the same {@link IAdminAccessService}.
+ */
+export declare function createAdminAccessRoutes(adminAccess: IAdminAccessService): express.Router;
+//# sourceMappingURL=admin-access.routes.d.ts.map

package/dist/modules/admin/admin-access.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-access.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAWxF"}

package/dist/modules/admin/admin-access.routes.js

@@ -0,0 +1,26 @@
+import express from 'express';
+import '../auth/auth.middleware.js'; // Express Request augmentation
+/**
+ * The CORE slice of the admin surface: just the admin-status resolver the
+ * frontend branches on (AdminMenu's "Admin only" section, the roles-recovery
+ * banner). The full admin router (feedback inbox, user administration /
+ * GDPR erasure) is an enterprise extension mounted via
+ * `ServerExtensions.authed`.
+ *
+ * NOTE (core split): in bevel-platform this endpoint lives in the enterprise
+ * `admin.routes.ts`; core serves it itself so a core-only deployment can
+ * resolve admin status. Express keeps first-match-wins, so an enterprise
+ * overlay's own `/admin/access` (mounted later) never shadows this one —
+ * both resolve through the same {@link IAdminAccessService}.
+ */
+export function createAdminAccessRoutes(adminAccess) {
+    const router = express.Router();
+    // Open to any authenticated user — returns `false` for non-admins instead of
+    // 403 so the frontend can branch on the answer without treating a normal
+    // user as an error case.
+    router.get('/admin/access', async (req, res) => {
+        res.json({ isAdmin: await adminAccess.isAdmin(req.userEmail) });
+    });
+    return router;
+}
+//# sourceMappingURL=admin-access.routes.js.map

package/dist/modules/admin/admin-access.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-access.routes.js","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,4BAA4B,CAAC,CAAC,+BAA+B;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAgC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,6EAA6E;IAC7E,yEAAyE;IACzE,yBAAyB;IACzB,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/admin/admin-access.service.d.ts

@@ -0,0 +1,24 @@
+import type { IAccessControl } from '../access/access-control.interface.js';
+import { type WorkspaceService } from '../workspace/workspace.service.js';
+import type { IAdminAccessService } from './admin.interface.js';
+/**
+ * Admin = holder of the `Admin` role in `roles.yaml`. We resolve it through the
+ * access model exactly as the rest of the app does — `canWrite('roles.yaml')` is
+ * the existing source of truth for Admin-role membership (only admins may write
+ * `roles.yaml`). Read from the default-branch workspace so admin status doesn't
+ * depend on whichever branch the caller happens to be on.
+ *
+ * There is no env allow-list (`ADMIN_EMAILS` is gone) — `roles.yaml` is the
+ * single source of truth.
+ */
+export declare class AdminAccessService implements IAdminAccessService {
+    private readonly accessControl;
+    private readonly workspaceService;
+    /** Branch whose `roles.yaml` defines admins (the authoritative default branch). */
+    private readonly branch;
+    constructor(accessControl: IAccessControl, workspaceService: WorkspaceService, 
+    /** Branch whose `roles.yaml` defines admins (the authoritative default branch). */
+    branch: string);
+    isAdmin(email: string | undefined): Promise<boolean>;
+}
+//# sourceMappingURL=admin-access.service.d.ts.map

package/dist/modules/admin/admin-access.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-access.service.d.ts","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,KAAK,gBAAgB,EAAwB,MAAM,mCAAmC,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAE1D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB;IACnD,mFAAmF;IAClE,MAAM,EAAE,MAAM;IAG3B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;CAe3D"}

package/dist/modules/admin/admin-access.service.js

@@ -0,0 +1,41 @@
+import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+/**
+ * Admin = holder of the `Admin` role in `roles.yaml`. We resolve it through the
+ * access model exactly as the rest of the app does — `canWrite('roles.yaml')` is
+ * the existing source of truth for Admin-role membership (only admins may write
+ * `roles.yaml`). Read from the default-branch workspace so admin status doesn't
+ * depend on whichever branch the caller happens to be on.
+ *
+ * There is no env allow-list (`ADMIN_EMAILS` is gone) — `roles.yaml` is the
+ * single source of truth.
+ */
+export class AdminAccessService {
+    accessControl;
+    workspaceService;
+    branch;
+    constructor(accessControl, workspaceService, 
+    /** Branch whose `roles.yaml` defines admins (the authoritative default branch). */
+    branch) {
+        this.accessControl = accessControl;
+        this.workspaceService = workspaceService;
+        this.branch = branch;
+    }
+    async isAdmin(email) {
+        if (!email)
+            return false;
+        try {
+            // Ensure the authoritative clone is on disk, then resolve Admin-role
+            // membership via the access model. Any failure (missing/invalid
+            // roles.yaml, clone error) resolves to "not admin" — the safe default.
+            await this.workspaceService.getOrCreateForBranch(this.branch);
+            return await this.accessControl.canWrite(workspaceIdForBranch(this.branch), email, 'roles.yaml');
+        }
+        catch (err) {
+            // Log so an admin lockout caused by a clone / roles.yaml failure is
+            // diagnosable rather than a silent denial.
+            console.warn('[admin] isAdmin resolution failed:', err instanceof Error ? err.message : String(err));
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=admin-access.service.js.map

package/dist/modules/admin/admin-access.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-access.service.js","sourceRoot":"","sources":["../../../src/modules/admin/admin-access.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGhG;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAEV;IACA;IAEA;IAJnB,YACmB,aAA6B,EAC7B,gBAAkC;IACnD,mFAAmF;IAClE,MAAc;QAHd,kBAAa,GAAb,aAAa,CAAgB;QAC7B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAElC,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,qEAAqE;YACrE,gEAAgE;YAChE,uEAAuE;YACvE,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9D,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,2CAA2C;YAC3C,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACrG,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/modules/admin/admin.interface.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Contract for the deployment admin check. A user is an admin iff they hold the
+ * `Admin` role in the KB's `roles.yaml` — the same source of truth the access
+ * model uses for `canWrite('roles.yaml')`. Async because resolving it reads the
+ * access model from the default-branch workspace. Kept as an interface so tests
+ * can swap a static stub without loading the access tree.
+ */
+export interface IAdminAccessService {
+    isAdmin(email: string | undefined): Promise<boolean>;
+}
+//# sourceMappingURL=admin.interface.d.ts.map

package/dist/modules/admin/admin.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/admin/admin.interface.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD"}

package/dist/modules/admin/admin.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin.interface.js.map

package/dist/modules/admin/admin.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.interface.js","sourceRoot":"","sources":["../../../src/modules/admin/admin.interface.ts"],"names":[],"mappings":""}