@bevel-software/platform-core-backend 0.11.1 → 0.12.0

package/src/modules/workflow/file-lock.service.ts

@@ -21,7 +21,7 @@ import { and, eq, gt, lte } from 'drizzle-orm';
 import type { Database } from '../database/connection.js';
 import { fileLocks } from '../database/schema.js';
 import type { AcquireLockResult, AuthUser, FileLock } from '@bevel-software/platform-shared';
-import { WorkflowValidationError } from './workflow.errors.js';
+import { WorkflowValidationError } from '../../shared/domain-errors.js';
 
 /**
  * Lock lifetime without a heartbeat. The client is expected to heartbeat

package/src/modules/workflow/git/__tests__/git.service.accessGating.test.ts

@@ -9,7 +9,7 @@ import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import type { IAccessControl } from '../../../access/access-control.interface.js';
 import { GitService } from '../git.service.js';
-import { AccessDeniedError } from '../../../access/access-errors.js';
+import { AccessDeniedError } from '../../../access-model/access-errors.js';
 
 const execFileAsync = promisify(execFile);
 const PROCESS_MAP_DIR = 'knowledge-base';

package/src/modules/workflow/git/__tests__/git.service.deleteBranch.test.ts

@@ -13,7 +13,7 @@ import {
   BranchAuthorshipError,
   ProtectedBranchError,
   WorkflowValidationError,
-} from '../../workflow.errors.js';
+} from '../../../../shared/domain-errors.js';
 
 const execFileAsync = promisify(execFile);
 

package/src/modules/workflow/git/__tests__/git.service.diffFileAtCommit.test.ts

@@ -7,7 +7,7 @@ import os from 'node:os';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import { GitService } from '../git.service.js';
-import { WorkflowValidationError } from '../../workflow.errors.js';
+import { WorkflowValidationError } from '../../../../shared/domain-errors.js';
 
 const execFileAsync = promisify(execFile);
 const PROCESS_MAP_DIR = 'knowledge-base';

package/src/modules/workflow/git/__tests__/git.service.diffFileBetweenBranches.test.ts

@@ -7,7 +7,7 @@ import os from 'node:os';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import { GitService } from '../git.service.js';
-import { WorkflowValidationError, BranchNameError } from '../../workflow.errors.js';
+import { WorkflowValidationError, BranchNameError } from '../../../../shared/domain-errors.js';
 
 const execFileAsync = promisify(execFile);
 const PROCESS_MAP_DIR = 'knowledge-base';

package/src/modules/workflow/git/__tests__/git.service.pull.test.ts

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
 import { GitService } from '../git.service.js';
-import { PullRebaseConflictError } from '../../workflow.errors.js';
+import { PullRebaseConflictError } from '../../../../shared/domain-errors.js';
 import { runGit, gitOut, stubWorkflowHooks, stubWorkspaceService } from './git-test-helpers.js';
 
 /** See git.service.createBranch.test.ts — same prod-mirroring layout. */

package/src/modules/workflow/git/git.service.ts

@@ -15,9 +15,9 @@ import type {
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { WorkflowHooks, CommitValidationContext } from '../workflow-hooks.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
-import { AccessDeniedError } from '../../access/access-errors.js';
-import { WorkspaceMutex } from './mutex.js';
-import { cloneTrackingConfigArgs, SAFE_IMPLICIT_FETCH_ARGS } from './clone-config.js';
+import { AccessDeniedError } from '../../access-model/access-errors.js';
+import { WorkspaceMutex } from '../../kb-fs/mutex.js';
+import { cloneTrackingConfigArgs, SAFE_IMPLICIT_FETCH_ARGS } from '../../kb-fs/clone-config.js';
 import {
   assertValidBranchName,
   assertValidRelativePath,
@@ -25,13 +25,13 @@ import {
   isOwnSuggestionsBranch,
   isProtectedBranch,
   PROTECTED_BRANCHES,
-} from './branch-name.js';
+} from '../../kb-fs/branch-name.js';
 import {
   BranchAuthorshipError,
   WorkflowValidationError,
   ProtectedBranchError,
   PullRebaseConflictError,
-} from '../workflow.errors.js';
+} from '../../../shared/domain-errors.js';
 
 const execFileAsync = promisify(execFile);
 

package/src/modules/workflow/git/pull-request.service.ts

@@ -13,7 +13,7 @@ import { changeRequests } from '../../database/schema.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { GitService } from './git.service.js';
-import { WorkflowValidationError } from '../workflow.errors.js';
+import { WorkflowValidationError } from '../../../shared/domain-errors.js';
 import { hashEmail } from '../../../shared/hash-email.js';
 
 const LIST_PR_CACHE_TTL_MS = 30_000;

package/src/modules/workflow/review-workflow/__tests__/cancel-pr.test.ts

@@ -6,7 +6,7 @@ import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import type { GitService } from '../../git/git.service.js';
 import type { IAccessControl } from '../../../access/access-control.interface.js';
 import { hashEmail } from '../../../../shared/hash-email.js';
-import { WorkflowValidationError } from '../../workflow.errors.js';
+import { WorkflowValidationError } from '../../../../shared/domain-errors.js';
 
 // Cancel is now a DB state flip (no `gh`): `update(change_requests) … WHERE
 // number = ? AND state = 'open'`. This spy stands in for the update's

package/src/modules/workflow/review-workflow/review-workflow.service.ts

@@ -13,13 +13,13 @@ import type {
 import type { Database } from '../../database/connection.js';
 import { changeRequests, prComments, prFileApprovals, prMergeLog } from '../../database/schema.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
-import { isAccessMdPath } from '../../access/access-control.service.js';
+import { isAccessMdPath } from '../../access-model/access-grammar.js';
 import type { GitService } from '../git/git.service.js';
 import {
   ChangeRequestConflictsError,
   WorkflowDomainError,
   WorkflowValidationError,
-} from '../workflow.errors.js';
+} from '../../../shared/domain-errors.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import { hashEmail } from '../../../shared/hash-email.js';
 import type {

package/src/modules/workflow/session-ontology.service.ts

@@ -37,7 +37,7 @@ import { ontologyOf } from '../../shared/kb-layout.js';
 import type { Database } from '../database/connection.js';
 import { sessionOntologyTouches } from '../database/schema.js';
 import { recordTouch, decideWrite, type WriteDecision } from './session-ontology.policy.js';
-import { WorkspaceMutex } from './git/mutex.js';
+import { WorkspaceMutex } from '../kb-fs/mutex.js';
 
 export type OperationDecision =
   | { allow: true; touched: string[] }

package/src/modules/workflow/workflow.routes.ts

@@ -27,9 +27,9 @@ import type {
 } from '@bevel-software/platform-shared';
 import type { AuthService } from '../auth/auth.service.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import { branchForWorkspaceId } from '../workspace/workspace.service.js';
+import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import type { WorkflowEventBus } from './event-bus.js';
-import { WorkflowDomainError } from './workflow.errors.js';
+import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import '../auth/auth.middleware.js'; // Express Request augmentation
 
 function toHttpError(

package/src/modules/workflow/workflow.service.ts

@@ -49,14 +49,14 @@ import type { GitService } from './git/git.service.js';
 import type { PullRequestService } from './git/pull-request.service.js';
 import type { IReviewWorkflowService } from './review-workflow/review-workflow.interface.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import { FileLockService } from './file-lock.service.js';
 import { PendingCommitsService } from './pending-commits.service.js';
 import type { WorkflowEventBus } from './event-bus.js';
-import type { FileChangeNotifier } from './file-change-notifier.js';
+import type { FileChangeNotifier } from '../kb-fs/file-change-notifier.js';
 import { WorkflowHooks } from './workflow-hooks.js';
-import { WorkspaceMutex } from './git/mutex.js';
+import { WorkspaceMutex } from '../kb-fs/mutex.js';
 import { hashEmail } from '../../shared/hash-email.js';
 import {
   ChangeRequestConflictsError,
@@ -66,9 +66,9 @@ import {
   PushNeedsAgentResolutionError,
   WorkflowDomainError,
   WorkflowValidationError,
-} from './workflow.errors.js';
+} from '../../shared/domain-errors.js';
 import { RECOVERY_BOT_EMAIL, RECOVERY_BOT_NAME } from './recovery-bot.js';
-import { AccessDeniedError } from '../access/access-errors.js';
+import { AccessDeniedError } from '../access-model/access-errors.js';
 
 const execFileAsync = promisify(execFile);
 

package/src/modules/workspace/__tests__/workspace.routes.create-grant.test.ts

@@ -4,7 +4,7 @@ import express from 'express';
 import { describe, it, expect, afterEach, vi } from 'vitest';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../../access/access-control.interface.js';
-import type { ICreatorAccess } from '../../access/creator-access.js';
+import type { ICreatorAccess } from '../../access-model/creator.js';
 import type { WorkflowEventBus } from '../../workflow/event-bus.js';
 import type { AuthService } from '../../auth/auth.service.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';

package/src/modules/workspace/__tests__/workspace.routes.delete.test.ts

@@ -11,7 +11,7 @@ import type { WorkflowEventBus } from '../../workflow/event-bus.js';
 import type { AuthService } from '../../auth/auth.service.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';
 import { createWorkspaceRoutes } from '../workspace.routes.js';
-import type { ICreatorAccess } from '../../access/creator-access.js';
+import type { ICreatorAccess } from '../../access-model/creator.js';
 import type { WorkspaceService } from '../workspace.service.js';
 
 const stubCreatorAccess: ICreatorAccess = {

package/src/modules/workspace/__tests__/workspace.routes.download.test.ts

@@ -6,10 +6,10 @@ import type { IWorkflowService } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { WorkflowEventBus } from '../../workflow/event-bus.js';
 import type { AuthService } from '../../auth/auth.service.js';
-import { AccessConfigError } from '../../access/access-errors.js';
+import { AccessConfigError } from '../../access-model/access-errors.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';
 import { createWorkspaceRoutes } from '../workspace.routes.js';
-import type { ICreatorAccess } from '../../access/creator-access.js';
+import type { ICreatorAccess } from '../../access-model/creator.js';
 import { FolderTooLargeError, type WorkspaceService } from '../workspace.service.js';
 
 const stubCreatorAccess: ICreatorAccess = {

package/src/modules/workspace/__tests__/workspace.routes.read-gate.test.ts

@@ -4,7 +4,7 @@ import express from 'express';
 import { describe, it, expect, afterEach, vi } from 'vitest';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../../access/access-control.interface.js';
-import type { ICreatorAccess } from '../../access/creator-access.js';
+import type { ICreatorAccess } from '../../access-model/creator.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';
 import type { WorkflowEventBus } from '../../workflow/event-bus.js';
 import type { AuthService } from '../../auth/auth.service.js';

package/src/modules/workspace/__tests__/workspace.service.read-filter.test.ts

@@ -2,11 +2,8 @@ import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import {
-  WorkspaceService,
-  workspaceIdForBranch,
-  type ReadTreeFilter,
-} from '../workspace.service.js';
+import { WorkspaceService, type ReadTreeFilter } from '../workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 
 const KB = 'knowledge-base';
 

package/src/modules/workspace/__tests__/workspace.service.test.ts

@@ -4,7 +4,8 @@ import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import { WorkspaceService, workspaceIdForBranch } from '../workspace.service.js';
+import { WorkspaceService } from '../workspace.service.js';
+import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 
 const execFileAsync = promisify(execFile);
 
@@ -62,6 +63,17 @@ describe('WorkspaceService — branch-keyed identity', () => {
     expect(workspaceIdForBranch('alice/feature')).toBe('alice%2Ffeature');
   });
 
+  it('a malformed workspace id (bad percent-escape) rejects as a 400 BranchNameError, not a 500', async () => {
+    const svc = new WorkspaceService(root, 'https://github.com/Bevel-Software/knowledge-base.git', 'knowledge-base');
+    // `%zz` fails decodeURIComponent, falls back to itself, and `%` never
+    // passes the branch-name rules — the cold-path bootstrap must surface
+    // that as the status-carrying domain error, not a wrapped plain Error.
+    await expect(svc.readFile('%zz', 'roles.yaml')).rejects.toMatchObject({
+      name: 'BranchNameError',
+      status: 400,
+    });
+  });
+
   it('returns workspace info derived from the branch — no .workspace.json on disk', async () => {
     const { workspaceId, workspaceDir } = await seedBranchWorkspace(root, 'target-company-state');
     const svc = new WorkspaceService(root, 'https://github.com/Bevel-Software/knowledge-base.git', 'knowledge-base');