@bevel-software/platform-core-backend 0.1.0

package/dist/core-config.js

@@ -0,0 +1,240 @@
+import dotenv from 'dotenv';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { defaultKbTemplateDir } from './assets.js';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+dotenv.config({ path: path.resolve(__dirname, '../../../.env') });
+/**
+ * Configuration for the CORE platform: the git-backed workspace/workflow,
+ * skills, tools, secrets vault, access control, and the MCP surface. Contains
+ * NO LLM, connector, or SSO-provider settings — those live on the enterprise
+ * `AppConfig` (config.ts), which extends this class. A core-only deployment
+ * boots from exactly these env vars.
+ */
+export class CoreConfig {
+    port;
+    databaseUrl;
+    nodeEnv;
+    /**
+     * Tenant slug injected into every credential prefix so a deploy can brand its
+     * keys (`<tenant>_…` external API keys, `<tenant>-int_…` internal tokens,
+     * `<tenant>-up_…` upload tokens). Defaults to `bevel`. Changing it on an
+     * existing deployment invalidates previously minted keys/tokens (their
+     * prefix no longer matches), so pick it once. Lowercase alphanumeric only —
+     * `_` and `-` are reserved as prefix separators.
+     */
+    tenantId;
+    workspacesRoot;
+    /**
+     * Sibling-to-`workspacesRoot` location for the diff-review backup ledger.
+     * Layout mirrors `workspacesRoot` one-to-one: each user's repo lives at
+     * `<workspacesRoot>/<userId>/<repo>/...` and its backup at
+     * `<backupsRoot>/<userId>/<repo>/...`. Default sits next to workspaces so
+     * the two move together when ops point them at a different volume.
+     */
+    backupsRoot;
+    /**
+     * Sibling-to-`workspacesRoot` location for `call_tool_chain` spill files —
+     * oversized tool-chain results parked outside any workspace so any agent (in-
+     * process or external over MCP) can read them back via `read_file`. Ephemeral,
+     * never committed, best-effort GC'd on write.
+     */
+    spillRoot;
+    jwtSecret;
+    testPassword;
+    /** Clone/push URL for the KB repo. Any https git host (GitHub, GitLab, Bitbucket, Azure DevOps, self-hosted). */
+    kbRepoUrl;
+    /** Directory name the KB lives under inside each user's workspace dir. */
+    kbDirName;
+    /**
+     * Username sent in the git-over-HTTPS Basic credential (password = the git
+     * token). All major hosts accept a token as the password but differ on the
+     * username: GitHub `x-access-token` (default), GitLab `oauth2`, Bitbucket
+     * `x-token-auth`, Azure DevOps any non-empty value. Set `GIT_USERNAME` per
+     * host. Restricted to a safe charset because it's interpolated into the
+     * credential-helper shell snippet.
+     */
+    gitUsername;
+    /**
+     * Filesystem path to the KB seed template (the `kb-template/` folder shipped
+     * inside this package — see `defaultKbTemplateDir()`). The seeder reads this
+     * to initialise an empty KB remote, and to top-up missing scaffolding on an
+     * existing one. Override with `KB_TEMPLATE_DIR`.
+     */
+    kbTemplateDir;
+    /**
+     * Admin emails written into the generated `roles.yaml` when a fresh KB repo is
+     * seeded. Comma/whitespace-separated. A freshly-seeded repo with no Admin is
+     * unusable (access resolution requires ≥1 Admin), so seeding an EMPTY remote
+     * fails fast when this is empty. Not needed once the remote is already seeded.
+     */
+    seedAdminEmails;
+    /**
+     * Ontology-session boundary kill-switch. When true (default), an agent run
+     * that has read across more than one ontology can no longer write. A no-op on
+     * a single-ontology KB. Set `ONTOLOGY_SESSION_BLOCK=false` to disable.
+     *
+     * Stays on CORE config (not `AppConfig`) even though the write BLOCK itself
+     * is an enterprise-registered hook: the flag also switches off the core-owned
+     * touch TRACKING (the gate skips entirely when false — see
+     * `session-ontology.gate.ts`), so it must exist wherever the tracking runs.
+     */
+    ontologySessionBlock;
+    /**
+     * Password-login toggle for the login screen. Default enabled; set
+     * `LOGIN_PASSWORD=false` to hide the method AND reject `/auth/login`
+     * server-side. SSO methods are separate `AuthProviderPlugin`s wired by the
+     * composition root — their toggles live with their configuration.
+     */
+    loginPasswordEnabled;
+    /**
+     * Optional allow-list of email domains. When non-empty, ONLY emails whose
+     * domain matches (exactly, or as a subdomain) may log in via ANY method
+     * (shared-password or SSO). Comma/whitespace-separated; empty (default)
+     * allows any email. A leading `@` or `.` on an entry is tolerated, so
+     * `ALLOWED_EMAIL_DOMAINS=bevel.software, example.com` works as expected.
+     */
+    allowedEmailDomains;
+    /**
+     * 32-byte key (hex or base64) for AES-256-GCM encryption of core at-rest
+     * secrets: the secrets-vault values and the MCP OAuth client secrets/tokens.
+     * Read from `SECRETS_ENC_KEY`, falling back to the legacy
+     * `CONNECTOR_CONFIG_ENC_KEY` → `SHAREPOINT_TOKEN_ENC_KEY` chain so existing
+     * deploys keep decrypting without re-keying. Empty = secret values can't be
+     * saved (a clear error surfaces only when a secret is actually written/read).
+     */
+    secretsEncKey;
+    /**
+     * Public base URL of THIS backend, used to build OAuth redirect URIs.
+     * Must match a redirect URI registered with the OAuth provider(s).
+     */
+    publicBackendUrl;
+    /** Public base URL of the frontend, where callbacks redirect post-login. */
+    publicFrontendUrl;
+    constructor() {
+        this.port = parseInt(process.env.PORT || '3001', 10);
+        this.databaseUrl = process.env.DATABASE_URL || 'postgresql://bevel:bevel@localhost:5432/bevel';
+        this.nodeEnv = process.env.NODE_ENV || 'development';
+        this.tenantId = (process.env.TENANT_ID || 'bevel').trim().toLowerCase();
+        if (!/^[a-z0-9]+$/.test(this.tenantId)) {
+            throw new Error(`TENANT_ID must be lowercase alphanumeric (no separators); got "${this.tenantId}"`);
+        }
+        this.workspacesRoot = process.env.WORKSPACES_ROOT || path.resolve(process.cwd(), 'workspaces');
+        this.backupsRoot = process.env.BACKUPS_ROOT || path.resolve(this.workspacesRoot, '..', 'backups');
+        this.spillRoot = process.env.SPILL_ROOT || path.resolve(this.workspacesRoot, '..', 'tool-chain-spills');
+        this.jwtSecret = process.env.JWT_SECRET || '';
+        this.testPassword = process.env.TEST_PASSWORD || '';
+        // No default: the KB repo is deployment-specific, and a wrong fallback
+        // would surface much later as a confusing clone failure. Fail at boot.
+        this.kbRepoUrl = (process.env.KB_REPO_URL || '').trim();
+        if (this.kbRepoUrl === '') {
+            throw new Error('KB_REPO_URL is required — the https clone/push URL of the git repository that stores your knowledge base.');
+        }
+        this.kbDirName = process.env.KB_DIR_NAME || 'knowledge-base';
+        // Provider-neutral git token: operators can set GIT_TOKEN (or the legacy
+        // GITHUB_TOKEN / GH_TOKEN). Normalize onto GITHUB_TOKEN — the name the
+        // credential helper and every `$GITHUB_TOKEN` read + redaction use — so all
+        // three work unchanged. GIT_TOKEN takes PRECEDENCE: it's the provider-neutral
+        // name, so setting it must override a stale legacy GITHUB_TOKEN (e.g. when
+        // switching the KB from GitHub to GitLab), not be shadowed by it.
+        const gitToken = process.env.GIT_TOKEN || process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+        if (gitToken)
+            process.env.GITHUB_TOKEN = gitToken;
+        this.gitUsername = (process.env.GIT_USERNAME || 'x-access-token').trim();
+        // Interpolated into the credential-helper shell snippet, so reject anything
+        // that isn't a plain token — no quotes, spaces, or shell metacharacters.
+        if (!/^[A-Za-z0-9._-]+$/.test(this.gitUsername)) {
+            throw new Error(`GIT_USERNAME must match [A-Za-z0-9._-]+ (a plain auth username); got "${this.gitUsername}"`);
+        }
+        // Default: the `kb-template/` folder shipped inside this package (works
+        // both from src/ and compiled dist/ — see assets.ts).
+        this.kbTemplateDir = process.env.KB_TEMPLATE_DIR || defaultKbTemplateDir();
+        this.seedAdminEmails = (process.env.SEED_ADMIN_EMAILS || '')
+            .split(/[\s,]+/)
+            .map((e) => e.trim().toLowerCase())
+            .filter((e) => e.length > 0);
+        this.ontologySessionBlock =
+            (process.env.ONTOLOGY_SESSION_BLOCK ?? 'true').trim().toLowerCase() !== 'false';
+        this.loginPasswordEnabled =
+            (process.env.LOGIN_PASSWORD ?? 'true').trim().toLowerCase() !== 'false';
+        this.allowedEmailDomains = (process.env.ALLOWED_EMAIL_DOMAINS || '')
+            .split(/[\s,]+/)
+            .map((d) => d.trim().toLowerCase().replace(/^[@.]+/, ''))
+            .filter((d) => d.length > 0);
+        this.secretsEncKey = (process.env.SECRETS_ENC_KEY ||
+            process.env.CONNECTOR_CONFIG_ENC_KEY ||
+            process.env.SHAREPOINT_TOKEN_ENC_KEY ||
+            '').trim();
+        this.publicBackendUrl = (process.env.PUBLIC_BACKEND_URL || `http://localhost:${this.port}`)
+            .trim()
+            .replace(/\/+$/, '');
+        this.publicFrontendUrl = (process.env.PUBLIC_FRONTEND_URL || 'http://localhost:5173')
+            .trim()
+            .replace(/\/+$/, '');
+        // Parse-validate so a malformed URL fails at boot rather than producing a
+        // broken OAuth redirect later. (We intentionally don't force https / reject
+        // localhost in production: local Docker runs prod mode over http://localhost.)
+        for (const [name, value] of [
+            ['PUBLIC_BACKEND_URL', this.publicBackendUrl],
+            ['PUBLIC_FRONTEND_URL', this.publicFrontendUrl],
+        ]) {
+            try {
+                new URL(value);
+            }
+            catch {
+                throw new Error(`${name} is not a valid URL: "${value}"`);
+            }
+        }
+        // Validate format now so a typo surfaces at boot, not at first-seed time.
+        // Emptiness is NOT an error here: an already-seeded remote never needs it.
+        for (const email of this.seedAdminEmails) {
+            if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+                throw new Error(`SEED_ADMIN_EMAILS contains an invalid email: "${email}"`);
+            }
+        }
+        this.validateKbIdentity();
+    }
+    /** Prefix for external API keys (connection keys): `<tenant>_`. */
+    get externalApiKeyPrefix() {
+        return `${this.tenantId}_`;
+    }
+    /** Prefix for in-process internal HMAC tokens: `<tenant>-int_`. */
+    get internalTokenPrefix() {
+        return `${this.tenantId}-int_`;
+    }
+    /** Prefix for scoped single-use bulk-upload tokens: `<tenant>-up_`. */
+    get uploadTokenPrefix() {
+        return `${this.tenantId}-up_`;
+    }
+    /** Prefix for MCP OAuth access tokens: `<tenant>-mcp_`. */
+    get mcpOAuthTokenPrefix() {
+        return `${this.tenantId}-mcp_`;
+    }
+    validateKbIdentity() {
+        // Validate the two KB-identity inputs up front: `kbRepoUrl` (the clone/push
+        // URL) must be a valid https URL, and `kbDirName` (the dir the clone lives
+        // under in each workspace) must be a single safe path segment. A bad value
+        // in either otherwise surfaces much later as a confusing clone/path failure.
+        let parsed;
+        try {
+            parsed = new URL(this.kbRepoUrl);
+        }
+        catch {
+            throw new Error(`KB_REPO_URL is not a valid URL: ${this.kbRepoUrl}`);
+        }
+        if (parsed.protocol !== 'https:') {
+            throw new Error(`KB_REPO_URL must use https://: ${this.kbRepoUrl}`);
+        }
+        // Joined with workspace paths via path.join — separators or ".." would let it
+        // escape the workspace dir.
+        if (!this.kbDirName ||
+            this.kbDirName === '.' ||
+            this.kbDirName === '..' ||
+            this.kbDirName.includes('/') ||
+            this.kbDirName.includes('\\') ||
+            path.isAbsolute(this.kbDirName)) {
+            throw new Error(`KB_DIR_NAME must be a single path segment: ${this.kbDirName}`);
+        }
+    }
+}
+//# sourceMappingURL=core-config.js.map

package/dist/core-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-config.js","sourceRoot":"","sources":["../src/core-config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,OAAO,CAAS;IACzB;;;;;;;OAOG;IACM,QAAQ,CAAS;IACjB,cAAc,CAAS;IAChC;;;;;;OAMG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,YAAY,CAAS;IAC9B,iHAAiH;IACxG,SAAS,CAAS;IAC3B,0EAA0E;IACjE,SAAS,CAAS;IAC3B;;;;;;;OAOG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,aAAa,CAAS;IAC/B;;;;;OAKG;IACM,eAAe,CAAW;IACnC;;;;;;;;;OASG;IACM,oBAAoB,CAAU;IACvC;;;;;OAKG;IACM,oBAAoB,CAAU;IACvC;;;;;;OAMG;IACM,mBAAmB,CAAW;IACvC;;;;;;;OAOG;IACM,aAAa,CAAS;IAC/B;;;OAGG;IACM,gBAAgB,CAAS;IAClC,4EAA4E;IACnE,iBAAiB,CAAS;IAEnC;QACE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,+CAA+C,CAAC;QAC/F,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,kEAAkE,IAAI,CAAC,QAAQ,GAAG,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/F,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;QACpD,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,gBAAgB,CAAC;QAC7D,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,8EAA8E;QAC9E,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3F,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,CAAC,WAAW,GAAG,CAC7F,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC3E,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACzD,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAClF,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAC1E,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;aACjE,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,CACnB,OAAO,CAAC,GAAG,CAAC,eAAe;YAC3B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;aACxF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;aAClF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;YAC1B,CAAC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7C,CAAC,qBAAqB,EAAE,IAAI,CAAC,iBAAiB,CAAC;SACvC,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,GAAG,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,IAAI,oBAAoB;QACtB,OAAO,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;IAC7B,CAAC;IAED,mEAAmE;IACnE,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAED,uEAAuE;IACvE,IAAI,iBAAiB;QACnB,OAAO,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;IAChC,CAAC;IAED,2DAA2D;IAC3D,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAEO,kBAAkB;QACxB,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,8EAA8E;QAC9E,4BAA4B;QAC5B,IACE,CAAC,IAAI,CAAC,SAAS;YACf,IAAI,CAAC,SAAS,KAAK,GAAG;YACtB,IAAI,CAAC,SAAS,KAAK,IAAI;YACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @bevel-software/platform-core-backend — the open-source core of the Bevel platform:
+ * git-backed knowledge workspace, workflow (branches / change requests /
+ * locks / SSE), skills, tool manuals + registry + auth, secrets vault, access
+ * control, diff/backup ledger, code-mode and the remote MCP surface.
+ *
+ * Composition entry points:
+ *   - `new CoreConfig()`                     — env-driven core configuration
+ *   - `createCoreServices(config, ports)`    — construct every core service
+ *   - `createCoreServer(core, ext, opts)`    — the Express app (fixed mount order)
+ *
+ * Importing this package ALSO applies the global Express `Request`
+ * augmentation (`req.userId` / `req.userEmail` / token payloads) — the
+ * middleware modules re-exported below carry the `declare global` blocks, so
+ * consumers get the augmented types without a side-effect import of their own.
+ *
+ * Finer-grained internals are available via the `./modules/*` subpath exports.
+ */
+export { CoreConfig } from './core-config.js';
+export { createCoreServices, type CoreServices } from './core/create-core-services.js';
+export { createCoreServer, type ServerExtensions, type ToolSurfaceCtx, } from './core/create-core-server.js';
+export { noopRecoveryAgent, type CorePorts } from './core/core-ports.js';
+export { coreMigrationsDir, defaultKbTemplateDir } from './assets.js';
+export { runCoreMigrations, runEnterpriseMigrations, } from './modules/database/migrate.js';
+export { getDb, type Database } from './modules/database/connection.js';
+export { GIT_SHA, resolveGitSha } from './version.js';
+export { createAuthMiddleware, AUTH_COOKIE_NAME } from './modules/auth/auth.middleware.js';
+export { createToolAuthMiddleware, createManualAuthMiddleware, } from './modules/tool-auth/tool-auth.middleware.js';
+export type { IExternalApiKeyService, ExternalApiKeySummary, } from './modules/tool-auth/external-api-key.interface.js';
+export type { ISessionSink } from './modules/workspace/session-sink.js';
+export type { ISystemNoticeSink, RecoveryAgentRunner, } from './modules/workflow/pending-commits.worker.js';
+export type { ILlmUsageMeter } from './modules/tool-auth/llm-usage-meter.js';
+export type { AuthProviderPlugin } from './modules/auth/auth.routes.js';
+export type { IErasureParticipant } from './modules/auth/account-erasure.service.js';
+export { WorkflowHooks, type CommitValidationHook, type CommitValidationContext, type PreWriteHook, type PreWriteContext, } from './modules/workflow/workflow-hooks.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGzE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAGxE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAMtD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AACrD,YAAY,EACV,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,mDAAmD,CAAC;AAG3D,YAAY,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACxE,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,8CAA8C,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,YAAY,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,MAAM,sCAAsC,CAAC"}

package/dist/index.js

@@ -0,0 +1,36 @@
+/**
+ * @bevel-software/platform-core-backend — the open-source core of the Bevel platform:
+ * git-backed knowledge workspace, workflow (branches / change requests /
+ * locks / SSE), skills, tool manuals + registry + auth, secrets vault, access
+ * control, diff/backup ledger, code-mode and the remote MCP surface.
+ *
+ * Composition entry points:
+ *   - `new CoreConfig()`                     — env-driven core configuration
+ *   - `createCoreServices(config, ports)`    — construct every core service
+ *   - `createCoreServer(core, ext, opts)`    — the Express app (fixed mount order)
+ *
+ * Importing this package ALSO applies the global Express `Request`
+ * augmentation (`req.userId` / `req.userEmail` / token payloads) — the
+ * middleware modules re-exported below carry the `declare global` blocks, so
+ * consumers get the augmented types without a side-effect import of their own.
+ *
+ * Finer-grained internals are available via the `./modules/*` subpath exports.
+ */
+export { CoreConfig } from './core-config.js';
+export { createCoreServices } from './core/create-core-services.js';
+export { createCoreServer, } from './core/create-core-server.js';
+export { noopRecoveryAgent } from './core/core-ports.js';
+// Packaged assets (migrations/, kb-template/) + the migration runners.
+export { coreMigrationsDir, defaultKbTemplateDir } from './assets.js';
+export { runCoreMigrations, runEnterpriseMigrations, } from './modules/database/migrate.js';
+export { getDb } from './modules/database/connection.js';
+// Build identity surfaced by GET /api/health.
+export { GIT_SHA, resolveGitSha } from './version.js';
+// Express `Request` augmentation carriers (userId/userEmail — auth.middleware;
+// token payloads — tool-auth + external-api-key interface). Re-exported by
+// VALUE/type so the `declare global` blocks land in this package's public
+// declaration graph.
+export { createAuthMiddleware, AUTH_COOKIE_NAME } from './modules/auth/auth.middleware.js';
+export { createToolAuthMiddleware, createManualAuthMiddleware, } from './modules/tool-auth/tool-auth.middleware.js';
+export { WorkflowHooks, } from './modules/workflow/workflow-hooks.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAqB,MAAM,gCAAgC,CAAC;AACvF,OAAO,EACL,gBAAgB,GAGjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAkB,MAAM,sBAAsB,CAAC;AAEzE,uEAAuE;AACvE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,KAAK,EAAiB,MAAM,kCAAkC,CAAC;AAExE,8CAA8C;AAC9C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEtD,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,qBAAqB;AACrB,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AAerD,OAAO,EACL,aAAa,GAKd,MAAM,sCAAsC,CAAC"}