@bevel-software/platform-core-backend 0.11.1 → 0.11.2

package/src/modules/{access → access-model}/access-splice.ts

@@ -33,7 +33,7 @@ import {
   canonicalEmail,
   canonicalRoleName,
   accessMdDeclaresBodyRules,
-} from './access-control.service.js';
+} from './access-grammar.js';
 
 /**
  * Which rule block a mutation edits.

package/src/modules/access-model/creator.ts

@@ -0,0 +1,79 @@
+/**
+ * The pure half of the creator read-grant story: the creator identity, the
+ * grant-plan contract the creation surfaces consume, and the splice-safe
+ * principal for a creator. The service that DECIDES when a creation needs a
+ * grant (filesystem stats, access checks) is `modules/access/creator-access.ts`;
+ * this file carries only the types and pure helpers so downstream modules
+ * (kb-fs, plugins, tool-helpers) never need an edge into the access module.
+ */
+
+import type { Principal } from './access-splice.js';
+
+/**
+ * How a pending creation gets its creator read grant.
+ *   - `seed-access-md`: merge the grant into `wsRelPath` (a new directory's
+ *     own `access.md`, workspace-relative) — BEFORE or alongside the creation,
+ *     via the caller's own lock+commit machinery. The caller MUST re-read the
+ *     file's CURRENT text under its lock and write `apply(current)` ('' when
+ *     absent), never a precomputed fresh file: two concurrent creators can
+ *     both plan a seed for the same new directory, and a blind overwrite
+ *     would silently revoke whichever grant landed first. Skip the write when
+ *     `apply` returns the input unchanged, and call `noteAccessFileWritten`
+ *     after a write so the resolver cache drops.
+ *   - `frontmatter`: run the new file's content through `apply` before
+ *     writing it, so the grant lands atomically inside the created file.
+ */
+export type CreationGrantPlan =
+  | { kind: 'seed-access-md'; wsRelPath: string; apply: (current: string) => string }
+  | { kind: 'frontmatter'; apply: (content: string) => string };
+
+/** The creator identity a grant is written for. */
+export interface Creator {
+  name: string;
+  email: string;
+}
+
+/**
+ * Injection seam for the creation surfaces (routes, lock-aware filesystem,
+ * upload apply). Kept as an interface so callers depend on the contract, not
+ * the class.
+ */
+export interface ICreatorAccess {
+  planForCreate(
+    workspaceId: string,
+    creator: Creator,
+    wsRelPath: string,
+    kind: 'file' | 'dir',
+  ): Promise<CreationGrantPlan | null>;
+
+  grantInExtractedFile(
+    workspaceId: string,
+    creator: Creator,
+    wsRelPath: string,
+  ): Promise<string | null>;
+
+  noteAccessFileWritten(workspaceId: string): void;
+}
+
+/**
+ * The splice-safe principal for a creator — exported because plugin
+ * provisioning (`PluginProvisionService`) writes the same `Name <email>`
+ * entries into the access.md files it seeds, and two spellings of the same
+ * person would read as two people.
+ */
+export function creatorPrincipal(creator: Creator): Principal {
+  return { kind: 'user', email: creator.email, displayName: safeDisplayName(creator) };
+}
+
+/**
+ * `Name <email>`-safe display name: `validatePrincipal` rejects control
+ * chars, `<`, `>`, and `#`, so strip those from the user's name and fall
+ * back to the email local part (which the email regex already keeps free of
+ * `<>`/whitespace) when nothing usable remains.
+ */
+function safeDisplayName(creator: Creator): string {
+  const strip = (s: string) =>
+    // eslint-disable-next-line no-control-regex -- same intentional control-char guard as access-splice
+    s.replace(/[<>#\u0000-\u001f\u007f]/g, ' ').replace(/\s+/g, ' ').trim();
+  return strip(creator.name) || strip(creator.email.split('@')[0] ?? '') || 'KB user';
+}

package/src/modules/{access → access-model}/group-files.ts

@@ -6,7 +6,7 @@ import {
   canonicalEmail,
   canonicalRoleName,
   parseYamlSubset,
-} from './access-control.service.js';
+} from './access-grammar.js';
 
 /**
  * Group files — the "who you are" half of the roles/groups split.

package/src/modules/{access → access-model}/render-roles-yaml.ts

@@ -1,4 +1,4 @@
-import { parseRolesYaml } from './access-control.service.js';
+import { parseRolesYaml } from './access-grammar.js';
 
 /**
  * Render a `roles.yaml` granting Admin to each email — the ONE renderer every

package/src/modules/{access → access-model}/roles-yaml-guard.ts

@@ -22,8 +22,8 @@
  */
 
 import type { FileContent } from '@mastra/core/workspace';
-import { parseRolesYaml } from './access-control.service.js';
-import { WorkflowDomainError } from '../workflow/workflow.errors.js';
+import { parseRolesYaml } from './access-grammar.js';
+import { WorkflowDomainError } from '../../shared/domain-errors.js';
 
 /** Repo-relative basename of the roles file (it lives at the KB repo root). */
 export const ROLES_YAML_BASENAME = 'roles.yaml';

package/src/modules/admin/admin-access.service.ts

@@ -1,5 +1,6 @@
 import type { IAccessControl } from '../access/access-control.interface.js';
-import { type WorkspaceService, workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { type WorkspaceService } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import type { IAdminAccessService } from './admin.interface.js';
 
 /**

package/src/modules/diff/__tests__/diff.routes.rejectPathsLocked.test.ts

@@ -4,8 +4,8 @@ import path from 'node:path';
 import os from 'node:os';
 import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared';
 import type { IDiffService } from '../diff.interface.js';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
-import { WorkflowValidationError } from '../../workflow/workflow.errors.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
+import { WorkflowValidationError } from '../../../shared/domain-errors.js';
 import { rejectPathsLocked } from '../diff.routes.js';
 
 /**

package/src/modules/diff/__tests__/diff.service.seed-atomicity.test.ts

@@ -2,8 +2,9 @@ import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import { WorkspaceService, workspaceIdForBranch } from '../../workspace/workspace.service.js';
-import { WorkspaceMutex } from '../../workflow/git/mutex.js';
+import { WorkspaceService } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
+import { WorkspaceMutex } from '../../kb-fs/mutex.js';
 import { DiffService } from '../diff.service.js';
 
 /**

package/src/modules/diff/__tests__/diff.service.test.ts

@@ -2,8 +2,9 @@ import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import { WorkspaceService, workspaceIdForBranch } from '../../workspace/workspace.service.js';
-import { WorkspaceMutex } from '../../workflow/git/mutex.js';
+import { WorkspaceService } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
+import { WorkspaceMutex } from '../../kb-fs/mutex.js';
 import { DiffService } from '../diff.service.js';
 
 async function mkTmpRoot(prefix: string): Promise<string> {

package/src/modules/diff/diff.routes.ts

@@ -3,10 +3,10 @@ import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared
 import type { IDiffService } from './diff.interface.js';
 import type { AuthService } from '../auth/auth.service.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
-import { toKbRelative, resolveReadableMap } from '../access/kb-read-filter.js';
-import { WorkflowDomainError, WorkflowValidationError } from '../workflow/workflow.errors.js';
-import { LockingFilesystem } from '../workflow/locking-filesystem.js';
-import { branchForWorkspaceId } from '../workspace/workspace.service.js';
+import { toKbRelative, resolveReadableMap } from '../access-model/kb-read-filter.js';
+import { WorkflowDomainError, WorkflowValidationError } from '../../shared/domain-errors.js';
+import { LockingFilesystem } from '../kb-fs/locking-filesystem.js';
+import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import '../auth/auth.middleware.js';
 
 function toHttpError(

package/src/modules/diff/diff.service.ts

@@ -3,7 +3,7 @@ import path from 'node:path';
 import type { FileDiffPayload, PendingChange, ReviewSession, ChangeKind } from '@bevel-software/platform-shared';
 import type { IDiffService } from './diff.interface.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import type { WorkspaceMutex } from '../workflow/git/mutex.js';
+import type { WorkspaceMutex } from '../kb-fs/mutex.js';
 import { BevelIgnoreStack } from '../workspace/bevel-ignore.js';
 import { isDiffable } from './diff.config.js';
 import { assertWithinDirectory } from './diff-paths.js';

package/src/modules/{workflow/git → kb-fs}/__tests__/branch-name.test.ts

@@ -4,7 +4,7 @@ import {
   assertValidRelativePath,
   isProtectedBranch,
 } from '../branch-name.js';
-import { BranchNameError, WorkflowValidationError } from '../../workflow.errors.js';
+import { BranchNameError, WorkflowValidationError } from '../../../shared/domain-errors.js';
 
 describe('assertValidBranchName', () => {
   it.each([

package/src/modules/{workflow → kb-fs}/__tests__/locking-filesystem.test.ts

@@ -5,7 +5,7 @@ import os from 'node:os';
 import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared';
 import { LocalFilesystem } from '@mastra/core/workspace';
 import { LockingFilesystem } from '../locking-filesystem.js';
-import { PushNeedsAgentResolutionError } from '../workflow.errors.js';
+import { PushNeedsAgentResolutionError } from '../../../shared/domain-errors.js';
 
 const USER: AuthUser = {
   id: 'user-1',

package/src/modules/{workflow/git → kb-fs}/branch-name.ts

@@ -1,4 +1,4 @@
-import { BranchNameError, WorkflowValidationError } from '../workflow.errors.js';
+import { BranchNameError, WorkflowValidationError } from '../../shared/domain-errors.js';
 
 // Single source of truth for the protected-branch list lives in `@bevel-software/platform-shared` so
 // the backend guard and the frontend banner/disabling logic can't drift apart.

package/src/modules/{workflow → kb-fs}/locking-filesystem.ts

@@ -42,9 +42,9 @@ import {
   type WriteOptions,
 } from '@mastra/core/workspace';
 import type { AuthUser, Change, IWorkflowService } from '@bevel-software/platform-shared';
-import { PushNeedsAgentResolutionError } from './workflow.errors.js';
+import { PushNeedsAgentResolutionError } from '../../shared/domain-errors.js';
 import type { FileChangeNotifier } from './file-change-notifier.js';
-import type { CreationGrantPlan, ICreatorAccess } from '../access/creator-access.js';
+import type { CreationGrantPlan, ICreatorAccess } from '../access-model/creator.js';
 
 /** How many times to retry a contended acquire before giving up. */
 const ACQUIRE_RETRY_ATTEMPTS = 3;

package/src/modules/plugins/__tests__/join-requests.service.test.ts

@@ -6,10 +6,8 @@ import {
   type ChangeRequest,
   type IWorkflowService,
 } from '@bevel-software/platform-shared';
-import {
-  workspaceIdForBranch,
-  type WorkspaceService,
-} from '../../workspace/workspace.service.js';
+import { type WorkspaceService } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { JoinRequestsService } from '../join-requests.service.js';
 
 /**

package/src/modules/plugins/__tests__/plugin-index.service.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { PluginIndexService } from '../plugins.service.js';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { ISkillService, SkillSummary } from '../../skills/skills.contract.js';

package/src/modules/plugins/__tests__/plugins.routes.test.ts

@@ -8,7 +8,7 @@ import { describe, it, expect, afterEach, vi } from 'vitest';
 
 import { DEFAULT_BRANCH, joinBranchFor } from '@bevel-software/platform-shared';
 import type { ChangeRequest, IWorkflowService } from '@bevel-software/platform-shared';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { ISkillService, SkillSummary } from '../../skills/skills.contract.js';

package/src/modules/plugins/join-proposals.ts

@@ -3,7 +3,7 @@ import {
   parseAccessFile,
   type ParsedEntry,
   type Verb,
-} from '../access/access-control.service.js';
+} from '../access-model/access-grammar.js';
 
 /**
  * What a join branch is PROPOSING, relative to the default branch.

package/src/modules/plugins/join-requests.service.ts

@@ -5,7 +5,8 @@ import {
   type ChangeRequest,
   type IWorkflowService,
 } from '@bevel-software/platform-shared';
-import { workspaceIdForBranch, type WorkspaceService } from '../workspace/workspace.service.js';
+import { type WorkspaceService } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import { pendingProposals, type JoinProposal } from './join-proposals.js';
 
 /** One open join change request, with what it still proposes. */

package/src/modules/plugins/plugin-provision.service.ts

@@ -47,9 +47,9 @@ import {
 } from '@bevel-software/platform-shared';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
-import { creatorPrincipal } from '../access/creator-access.js';
-import { spliceGrant } from '../access/access-splice.js';
-import { WorkspaceMutex } from '../workflow/git/mutex.js';
+import { creatorPrincipal } from '../access-model/creator.js';
+import { spliceGrant } from '../access-model/access-splice.js';
+import { WorkspaceMutex } from '../kb-fs/mutex.js';
 
 /** Commit machinery the provision rides — the pending-commit pipeline, run inline. */
 export interface ProvisionCommitDriver {

package/src/modules/plugins/plugins.routes.ts

@@ -8,8 +8,8 @@ import {
   type IWorkflowService,
 } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../access/access-control.interface.js';
-import { spliceGrant } from '../access/access-splice.js';
-import { WorkflowDomainError } from '../workflow/workflow.errors.js';
+import { spliceGrant } from '../access-model/access-splice.js';
+import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
 import { pluginsWorkspaceId } from './plugins.service.js';
 import { PluginProvisionError, type PluginProvisionService } from './plugin-provision.service.js';

package/src/modules/plugins/plugins.service.ts

@@ -8,7 +8,7 @@ import {
   isPersonalPluginFolder,
 } from '@bevel-software/platform-shared';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import type { ISkillService } from '../skills/skills.contract.js';
 import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';

package/src/modules/secrets-vault/secrets-vault.routes.ts

@@ -12,7 +12,7 @@ import {
 import type { IToolManualService, ToolManualSummary, ToolVariable } from '../tool-manuals/tool-manuals.contract.js';
 import { utcpNamespacedKey } from '../../shared/utcp-namespace.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
-import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import '../auth/auth.middleware.js'; // Express Request augmentation (req.userId / req.userEmail)
 
 export interface SecretsVaultRoutesDeps {

package/src/modules/skills/__tests__/skills.service.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { SkillService } from '../skills.service.js';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import { readFile as fsReadFile } from 'node:fs/promises';

package/src/modules/skills/pending-skills.service.ts

@@ -4,7 +4,8 @@ import {
   type ChangeRequest,
   type IWorkflowService,
 } from '@bevel-software/platform-shared';
-import { workspaceIdForBranch, type WorkspaceService } from '../workspace/workspace.service.js';
+import { type WorkspaceService } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import { hashEmail } from '../../shared/hash-email.js';
 import { resolveDeclaredId } from '../../shared/frontmatter-id.js';

package/src/modules/skills/skills.service.ts

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import { parseDocument } from 'yaml';
 import { DEFAULT_BRANCH, PLUGINS_DIR } from '@bevel-software/platform-shared';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import { extractFrontmatter, resolveDeclaredId, dedupeById } from '../../shared/frontmatter-id.js';
 import { walkFiles } from '../../shared/fs-walk.js';

package/src/modules/tool-helpers/tool-context.ts

@@ -1,10 +1,11 @@
 import { LocalFilesystem } from '@mastra/core/workspace';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
-import { LockingFilesystem } from '../workflow/locking-filesystem.js';
-import { ReadOnlyFilesystem } from '../workflow/read-only-filesystem.js';
-import { makeRolesYamlWriteValidator } from '../access/roles-yaml-guard.js';
-import type { ICreatorAccess } from '../access/creator-access.js';
-import { branchForWorkspaceId, type WorkspaceService } from '../workspace/workspace.service.js';
+import { LockingFilesystem } from '../kb-fs/locking-filesystem.js';
+import { ReadOnlyFilesystem } from '../kb-fs/read-only-filesystem.js';
+import { makeRolesYamlWriteValidator } from '../access-model/roles-yaml-guard.js';
+import type { ICreatorAccess } from '../access-model/creator.js';
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import type { WorkflowEventBus } from '../workflow/event-bus.js';
 import type { AuthService } from '../auth/auth.service.js';
 import { ToolError, type ToolContext } from './tool.contract.js';

package/src/modules/tool-manuals/__tests__/mcp-server-edit.service.test.ts

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { DEFAULT_BRANCH, type AuthUser } from '@bevel-software/platform-shared';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { IToolManualService, ToolManualSummary } from '../tool-manuals.contract.js';

package/src/modules/tool-manuals/__tests__/tool-manuals.archive.route.test.ts

@@ -6,7 +6,7 @@ import express from 'express';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { createToolManualsAgentRoutes } from '../tool-manuals.routes.js';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { IToolManualService } from '../tool-manuals.contract.js';

package/src/modules/tool-manuals/__tests__/tool-manuals.detail.route.test.ts

@@ -7,7 +7,7 @@ import { afterEach, describe, expect, it, test, vi } from 'vitest';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { createToolManualsBrowserRoutes } from '../tool-manuals.routes.js';
 import { ToolManualService } from '../tool-manuals.service.js';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { IToolManualService, ToolManualDetail } from '../tool-manuals.contract.js';

package/src/modules/tool-manuals/__tests__/tool-manuals.mcp-oauth.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { ToolManualService, type McpAuthDiscoveryPort } from '../tool-manuals.service.js';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 

package/src/modules/tool-manuals/__tests__/tool-manuals.service.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { ToolManualService } from '../tool-manuals.service.js';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 

package/src/modules/tool-manuals/mcp-server-edit.service.ts

@@ -8,7 +8,8 @@ import {
   PLUGIN_MCP_FILE,
   type AuthUser,
 } from '@bevel-software/platform-shared';
-import { workspaceIdForBranch, type WorkspaceService } from '../workspace/workspace.service.js';
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import { validatedVariables } from './mcp-json-discovery.js';
 import { assertSafeFetchUrl } from '../../shared/ssrf.js';
 import { containsVariableReference, findReservedVariableRef } from '../../shared/variable-refs.js';

package/src/modules/tool-manuals/tool-manuals.routes.ts

@@ -3,7 +3,8 @@ import path from 'node:path';
 import fs from 'node:fs/promises';
 import AdmZip from 'adm-zip';
 import { DEFAULT_BRANCH, PLUGINS_DIR } from '@bevel-software/platform-shared';
-import { workspaceIdForBranch, type WorkspaceService } from '../workspace/workspace.service.js';
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import '@utcp/http'; // side effect: register the 'http' call-template type
 import { CallTemplateSerializer, type CallTemplate } from '@utcp/sdk';

package/src/modules/tool-manuals/tool-manuals.service.ts

@@ -17,7 +17,7 @@ import {
 } from '@bevel-software/platform-shared';
 import { descriptorsFromMcpJson } from './mcp-json-discovery.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import { assertSafeFetchUrl } from '../../shared/ssrf.js';
 import { RESERVED_VARIABLE_NAMES, findReservedVariableRef } from '../../shared/variable-refs.js';

package/src/modules/tool-manuals/tool-manuals.tools.ts

@@ -5,7 +5,7 @@ import type { ToolContext } from '../tool-helpers/tool.contract.js';
 import { toolDef } from '../tool-helpers/tool-def.js';
 import type { ToolHandlerFactory } from '../tool-helpers/tool-handler.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
-import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import { utcpNamespacedKey } from '../../shared/utcp-namespace.js';
 import type { IToolManualService } from './tool-manuals.contract.js';
 

package/src/modules/workflow/__tests__/preserve-roles-yaml.test.ts

@@ -12,7 +12,7 @@ import { FileLockService } from '../file-lock.service.js';
 import { PendingCommitsService } from '../pending-commits.service.js';
 import { WorkflowService } from '../workflow.service.js';
 import type { Database } from '../../database/connection.js';
-import { RolesYamlPreservationError } from '../workflow.errors.js';
+import { RolesYamlPreservationError } from '../../../shared/domain-errors.js';
 
 /**
  * Focused tests for the roles.yaml-preservation guard inside

package/src/modules/workflow/__tests__/workflow.service.commitFileWhileLocked.test.ts

@@ -10,7 +10,7 @@ import { PendingCommitsService } from '../pending-commits.service.js';
 import { WorkflowEventBus } from '../event-bus.js';
 import { WorkflowService } from '../workflow.service.js';
 import type { Database } from '../../database/connection.js';
-import { WorkflowValidationError } from '../workflow.errors.js';
+import { WorkflowValidationError } from '../../../shared/domain-errors.js';
 
 /**
  * `commitFileWhileLocked` (autosave checkpoint) has subtler semantics

package/src/modules/workflow/__tests__/workflow.service.facade.test.ts

@@ -12,7 +12,7 @@ import type { IAccessControl } from '../../access/access-control.interface.js';
 import { FileLockService } from '../file-lock.service.js';
 import { PendingCommitsService } from '../pending-commits.service.js';
 import { WorkflowService } from '../workflow.service.js';
-import { PullRebaseConflictError } from '../workflow.errors.js';
+import { PullRebaseConflictError } from '../../../shared/domain-errors.js';
 import type { Database } from '../../database/connection.js';
 
 // `deleteBranch`'s open-request guard is the only DB touch these tests

package/src/modules/workflow/__tests__/workflow.service.releaseLock.test.ts

@@ -14,7 +14,7 @@ import {
   PullRebaseConflictError,
   PushNeedsAgentResolutionError,
   WorkflowValidationError,
-} from '../workflow.errors.js';
+} from '../../../shared/domain-errors.js';
 
 /**
  * Two surfaces under test:

package/src/modules/workflow/agent-tools/workflow.tools.ts

@@ -5,7 +5,7 @@ import { ToolError, type ToolContext, type ToolHandler } from '../../tool-helper
 import { toolDef, withBranchInput } from '../../tool-helpers/tool-def.js';
 import type { ToolHandlerFactory } from '../../tool-helpers/tool-handler.js';
 import { requireInternalSource } from '../../tool-auth/tool-auth.middleware.js';
-import { workspaceIdForBranch } from '../../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 
 // A function, not a constant: the branch model is applied during boot, and a
 // module-scope capture would freeze this at the empty set that exists before it.

package/src/modules/workflow/file-lock.service.ts

@@ -21,7 +21,7 @@ import { and, eq, gt, lte } from 'drizzle-orm';
 import type { Database } from '../database/connection.js';
 import { fileLocks } from '../database/schema.js';
 import type { AcquireLockResult, AuthUser, FileLock } from '@bevel-software/platform-shared';
-import { WorkflowValidationError } from './workflow.errors.js';
+import { WorkflowValidationError } from '../../shared/domain-errors.js';
 
 /**
  * Lock lifetime without a heartbeat. The client is expected to heartbeat

package/src/modules/workflow/git/__tests__/git.service.accessGating.test.ts

@@ -9,7 +9,7 @@ import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import type { IAccessControl } from '../../../access/access-control.interface.js';
 import { GitService } from '../git.service.js';
-import { AccessDeniedError } from '../../../access/access-errors.js';
+import { AccessDeniedError } from '../../../access-model/access-errors.js';
 
 const execFileAsync = promisify(execFile);
 const PROCESS_MAP_DIR = 'knowledge-base';

package/src/modules/workflow/git/__tests__/git.service.deleteBranch.test.ts

@@ -13,7 +13,7 @@ import {
   BranchAuthorshipError,
   ProtectedBranchError,
   WorkflowValidationError,
-} from '../../workflow.errors.js';
+} from '../../../../shared/domain-errors.js';
 
 const execFileAsync = promisify(execFile);
 

package/src/modules/workflow/git/__tests__/git.service.diffFileAtCommit.test.ts

@@ -7,7 +7,7 @@ import os from 'node:os';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import { GitService } from '../git.service.js';
-import { WorkflowValidationError } from '../../workflow.errors.js';
+import { WorkflowValidationError } from '../../../../shared/domain-errors.js';
 
 const execFileAsync = promisify(execFile);
 const PROCESS_MAP_DIR = 'knowledge-base';

package/src/modules/workflow/git/__tests__/git.service.diffFileBetweenBranches.test.ts

@@ -7,7 +7,7 @@ import os from 'node:os';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import { GitService } from '../git.service.js';
-import { WorkflowValidationError, BranchNameError } from '../../workflow.errors.js';
+import { WorkflowValidationError, BranchNameError } from '../../../../shared/domain-errors.js';
 
 const execFileAsync = promisify(execFile);
 const PROCESS_MAP_DIR = 'knowledge-base';

package/src/modules/workflow/git/__tests__/git.service.pull.test.ts

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
 import { GitService } from '../git.service.js';
-import { PullRebaseConflictError } from '../../workflow.errors.js';
+import { PullRebaseConflictError } from '../../../../shared/domain-errors.js';
 import { runGit, gitOut, stubWorkflowHooks, stubWorkspaceService } from './git-test-helpers.js';
 
 /** See git.service.createBranch.test.ts — same prod-mirroring layout. */