@bevel-software/platform-core-backend 0.15.1 → 0.20.0

package/dist/shared/canonical-file-identity.js

@@ -0,0 +1,92 @@
+/**
+ * ONE canonical identity for a workspace file, plus the refusals the file
+ * verbs already answer with, as a single throwing call.
+ *
+ * `canonicalRelativePath` (in `@bevel-software/platform-shared`) collapses the
+ * spellings of one file: `x/a.md`, `./x/a.md` and `x//a.md` are the same file
+ * and all three become `x/a.md`. What it deliberately does NOT do is launder:
+ * a path it cannot canonicalise comes back UNCHANGED, so every gate downstream
+ * still sees what the caller actually sent. That leaves the caller holding an
+ * un-refused path, which is fine for `PUT /file` (the workspace service's own
+ * guards run right after) and wrong for anything that coordinates on the path
+ * WITHOUT ever touching disk. The file-lock service is exactly that: nothing
+ * below it resolves the path against a workspace directory, so a spelling that
+ * escapes or launders would quietly become a lock row of its own.
+ *
+ * This helper is therefore the canonicaliser AND the refusal, in the order the
+ * file verbs run them, so both surfaces answer the same thing for the same
+ * input:
+ *
+ *   1. `validateRelativePath` refuses `.` and `..` segments, backslashes and
+ *      an empty path. Repeated slashes it does NOT refuse: `x//a.md` is a
+ *      spelling of `x/a.md`, and the canonicaliser has already collapsed it by
+ *      the time the validator runs. `WorkspaceService.withPathTurn` runs the
+ *      same check first (via the shared `assertValidRelativePath`) and its
+ *      `Invalid path: ...` message is what `workspace.routes.sendError` turns
+ *      into a 400. Same message here, raised as a 400 `WorkflowValidationError`.
+ *   2. Containment. `withPathTurn` then resolves the path against the
+ *      workspace directory and refuses anything landing outside it, which
+ *      `sendError` turns into a 403. Step 1 has already rejected every `..`,
+ *      so the only spelling that can still escape is an absolute one, and
+ *      that is the whole of what this step refuses. It is refused AS absolute
+ *      rather than by resolving it against a stand-in root: `/workspace/a.md`
+ *      would resolve to inside any stand-in named `/workspace` and read as
+ *      contained, while the real workspace directory is `<workspacesRoot>/<id>`
+ *      and never literally `/workspace`, so the file verbs resolve that same
+ *      path outside their workspace and answer 403. With `..` gone and
+ *      absolute refused, every remaining spelling is relative and cannot
+ *      leave whatever directory it is resolved against — there is nothing
+ *      left for a resolve-and-compare to decide, so there is none here.
+ *
+ * Case is left alone, for the reason `canonicalRelativePath` documents: the
+ * deployment target is Linux, where `Foo.md` and `foo.md` are two files.
+ *
+ * What this deliberately does NOT answer is whether the path reaches its file
+ * through a symbolic link. That question is about what is on disk, not about
+ * how the path is spelled, and it is answered where the disk is:
+ * `WorkspaceService.assertNotThroughLink`, on the verbs that read and write
+ * bytes. A lock row is a coordination key and the lock service holds no
+ * workspace directory to resolve against, so a link can only change which
+ * bytes a WRITE touches, and that write is refused by the verb that performs
+ * it while the lock is merely held.
+ */
+import { canonicalRelativePath, validateRelativePath } from '@bevel-software/platform-shared';
+import { PathTraversalError, WorkflowValidationError } from './domain-errors.js';
+/**
+ * The canonical spelling of `targetPath`, or a throw carrying the status the
+ * file verbs answer with for that same input.
+ *
+ * @throws {WorkflowValidationError} 400, when the path is not a usable
+ *   workspace-relative path (not a string at all, a `.` or `..` segment, a
+ *   backslash, empty).
+ * @throws {PathTraversalError} 403, when the path resolves outside the
+ *   workspace (an absolute path).
+ */
+export function canonicalFileIdentity(targetPath) {
+    // A JSON body can hold anything and the lock routes' own guard only tests
+    // falsiness, so a truthy non-string (`{"path": 123}`) arrives here. The
+    // canonicaliser calls `.startsWith` on it and throws a bare `TypeError`,
+    // which `toHttpError` can only read as a 500 — for what is a client
+    // mistake. `PUT /file` answers 400 for that same body (its `requestPath`
+    // type-guards before canonicalising), and this surface answers what that one
+    // answers. The message is the validator's own for a non-string, so the two
+    // 400s read identically as well.
+    if (typeof targetPath !== 'string') {
+        throw new WorkflowValidationError('Invalid path: Path is required');
+    }
+    const canonical = canonicalRelativePath(targetPath);
+    const reason = validateRelativePath(canonical);
+    if (reason)
+        throw new WorkflowValidationError(`Invalid path: ${reason}`);
+    // `validateRelativePath` ACCEPTS `/workspace/a.md` (its leading empty
+    // segment is filtered out, leaving two ordinary segments), so absolute is
+    // refused here, on its own terms: a workspace-relative path is never
+    // absolute, and the file verbs treat one as the escape it is. This is the
+    // only containment refusal there is — see step 2 in the header for why a
+    // resolve-and-compare against a stand-in root would decide nothing more.
+    if (canonical.startsWith('/')) {
+        throw new PathTraversalError();
+    }
+    return canonical;
+}
+//# sourceMappingURL=canonical-file-identity.js.map

package/dist/shared/canonical-file-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-file-identity.js","sourceRoot":"","sources":["../../src/shared/canonical-file-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAEjF;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,iCAAiC;IACjC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAAC,gCAAgC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/shared/domain-errors.d.ts

@@ -107,11 +107,30 @@ export declare class PullRebaseConflictError extends WorkflowDomainError {
     readonly kind: "pull-rebase-conflict";
     constructor(branch: string, conflictedPaths: string[], detail: string);
 }
+/**
+ * The platform has never heard of this branch: nothing it has cloned, and
+ * nothing any listing of origin's branches has mentioned. Distinct from
+ * `RemoteBranchGoneError`, which is the SAME git failure about a branch the
+ * platform did know — and answering that for a name nobody ever pushed told
+ * the reader their typo "no longer exists on the remote", which implies it
+ * once did. 404, and the message names the branch and nothing else: no git
+ * output, no remote URL.
+ */
+export declare class BranchNotFoundError extends WorkflowDomainError {
+    readonly branch: string;
+    readonly kind: "branch-not-found";
+    constructor(branch: string);
+}
 /**
  * The clone's branch no longer exists on origin: the fetch that refreshes
  * `refs/remotes/origin/<branch>` found no such ref. Distinct from an
  * unreachable remote — the host answered, and the answer was "gone" — so a
  * caller can treat the clone as stale rather than the sync as failed. 410.
+ *
+ * Only for a branch the platform KNEW: a clone of it, or a listing that named
+ * it. For a name it has never heard of, the same git failure is a
+ * `BranchNotFoundError` — see `WorkspaceService.hasHeardOfBranch`. A sync
+ * always has the clone in hand, so it is always this one.
  */
 export declare class RemoteBranchGoneError extends WorkflowDomainError {
     readonly branch: string;
@@ -127,6 +146,35 @@ export declare class RemoteBranchGoneError extends WorkflowDomainError {
  * a wording learned by one is learned by both.
  */
 export declare function isMissingRemoteBranchFailure(message: string): boolean;
+/**
+ * The caller named a path that resolves outside the workspace it was asked
+ * for. In practice that means an absolute path: a `..` climb is refused one
+ * step earlier, as an invalid path, by the same validator the file verbs run
+ * first.
+ *
+ * 403 carrying the exact message the file verbs answer, because
+ * `WorkspaceService.assertWithinWorkspace` throws a bare `Error` with this
+ * text and `workspace.routes.sendError` maps that text to 403. The lock
+ * service raises this instead of a bare `Error`, because `toHttpError` on the
+ * workflow routes reads the status off the class and would otherwise call it
+ * a 500. Both surfaces then answer identically for the same input. See
+ * `canonicalFileIdentity`.
+ */
+export declare class PathTraversalError extends WorkflowDomainError {
+    readonly kind: "path-traversal";
+    constructor();
+}
+/**
+ * The caller named a path inside the repository's internal git folder: any
+ * `.git` segment, in any case, however it was spelled or reached (see
+ * `shared/git-internals.ts`). One message for every such path, whether or not
+ * anything is there, so the refusal is not an existence oracle.
+ */
+export declare const GIT_INTERNALS_MESSAGE = "That path is inside the repository's internal git data and is not available.";
+export declare class GitInternalsError extends WorkflowDomainError {
+    readonly kind: "git-internals";
+    constructor();
+}
 /**
  * Generic 400 for workflow-input validation (malformed branch names, missing
  * fields, etc.). Carries an optional payload so callers can attach typed
@@ -136,6 +184,54 @@ export declare function isMissingRemoteBranchFailure(message: string): boolean;
 export declare class WorkflowValidationError extends WorkflowDomainError {
     constructor(message: string, payload?: Record<string, unknown>);
 }
+/**
+ * The next step a missing path always offers, in one sentence.
+ *
+ * Lives HERE, the layer with no module imports, because both surfaces that
+ * answer a missing path need it and they sit on opposite sides of a module
+ * boundary: this class (raised by services, rendered by the HTTP routes) and
+ * `modules/workspace/not-found.ts` (the file tools), which re-exports the
+ * constant under its own name. One sentence, written once, so the two cannot
+ * drift apart.
+ */
+export declare const NOT_FOUND_NEXT_STEP = "Check the path with list_files.";
+/**
+ * Nothing is at the path the caller named.
+ *
+ * Raised by a SERVICE that probed the path itself, where the file tools' own
+ * `not-found` helper (modules/workspace/not-found.ts) cannot reach: the zip
+ * reader, for instance, answers "ADM-ZIP: Invalid filename" for a missing
+ * archive, which is not a filesystem error at all and would otherwise be
+ * dressed up as an unreadable archive. The helper recognises this class and
+ * the raw `ENOENT`/`ENOTDIR` shapes alike, so both end as the one 404.
+ *
+ * 404 with a `not_found` kind and the requested path, which is also what the
+ * HTTP routes answer — a path that is not there gets one answer whichever
+ * surface asked. The MESSAGE AND THE PAYLOAD ARE BUILT HERE, not by whoever
+ * catches it, because not every surface catches it: the tools pass through
+ * `orDeclaredNotFound`, which re-renders the same three parts, but
+ * `POST /workspace/:id/unzip` sends this error straight to `domainErrorBody`.
+ * Sanitizing the path and appending the next step in the constructor is what
+ * makes those two answers the same answer.
+ */
+export declare class PathNotFoundError extends WorkflowDomainError {
+    readonly kind: "not_found";
+    /** The requested path, sanitized — never the path on disk. */
+    readonly path: string;
+    constructor(path: string);
+}
+/**
+ * An archive the caller uploaded that the zip reader cannot open. 422, not
+ * 400: the request is well-formed and the path is fine — the BYTES are not a
+ * readable zip, which is the caller's to fix but not their spelling's.
+ *
+ * A type, because the route used to recognise this by the `Could not read zip
+ * file` prefix its message happens to start with, and a reworded message
+ * would silently have turned it into a 500.
+ */
+export declare class UnreadableArchiveError extends WorkflowDomainError {
+    constructor(reason: string);
+}
 /**
  * The draft branch doesn't share history with the target branch, so GitHub
  * would reject the change request with `no history in common`. Surfaced as
@@ -187,6 +283,18 @@ export declare class ChangeRequestConflictsError extends WorkflowDomainError {
     readonly kind: "change-request-conflicts";
     constructor(sourceBranch: string, targetBranch: string, conflictedPaths: string[]);
 }
+/**
+ * A direct branch merge was asked to do what an open change request is
+ * waiting for a person to do: merge `sourceBranch` into `targetBranch`.
+ * Carries the request's number so the caller can point the person at it.
+ */
+export declare class OpenChangeRequestBlocksMergeError extends WorkflowDomainError {
+    readonly sourceBranch: string;
+    readonly targetBranch: string;
+    readonly number: number;
+    readonly kind: "open-change-request-blocks-merge";
+    constructor(sourceBranch: string, targetBranch: string, number: number);
+}
 /**
  * Caller tried to open a change request for a `(source, target)` pair that
  * already has one open. Spec rule: A→B blocks A→B (B→A is allowed). Carries

package/dist/shared/domain-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain-errors.d.ts","sourceRoot":"","sources":["../../src/shared/domain-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAExE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAM/E;AAED,qBAAa,eAAgB,SAAQ,mBAAmB;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAA3C,MAAM,EAAE,MAAM,EAAW,UAAU,EAAE,MAAM;CAIxD;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAA3C,UAAU,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAIjE;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAEhD,QAAQ,CAAC,UAAU,EAAE,MAAM;IADvC,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACxB,UAAU,EAAE,MAAM;CAQxC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,6BAA8B,SAAQ,mBAAmB;IAGlE,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM;IALjC,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;gBAEtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM;CAiBlC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,uBAAwB,SAAQ,mBAAmB;IAG5D,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBAErC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EAAE,EACzB,MAAM,EAAE,MAAM;CAe1B;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAEhD,QAAQ,CAAC,MAAM,EAAE,MAAM;IADnC,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;gBACzB,MAAM,EAAE,MAAM;CAOpC;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,mBAAmB;gBAClD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,mBAAmB;IAE/C,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IADxD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACxB,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CASzD;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;gBAC1B,MAAM,EAAE,gBAAgB;CAerC;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAEtD,QAAQ,CAAC,OAAO,EAAE,MAAM;IADpC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;gBACtB,OAAO,EAAE,MAAM;CAQrC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAGhE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE;IAJpC,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;gBAEzC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EAAE;CAgBrC;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAGhE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM;IAJjC,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;gBAEzC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM;CAclC;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAS3B"}
+{"version":3,"file":"domain-errors.d.ts","sourceRoot":"","sources":["../../src/shared/domain-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAM/E;AAED,qBAAa,eAAgB,SAAQ,mBAAmB;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAA3C,MAAM,EAAE,MAAM,EAAW,UAAU,EAAE,MAAM;CAIxD;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAA3C,UAAU,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAIjE;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAEhD,QAAQ,CAAC,UAAU,EAAE,MAAM;IADvC,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACxB,UAAU,EAAE,MAAM;CAQxC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,6BAA8B,SAAQ,mBAAmB;IAGlE,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM;IALjC,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;gBAEtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM;CAiBlC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,uBAAwB,SAAQ,mBAAmB;IAG5D,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBAErC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EAAE,EACzB,MAAM,EAAE,MAAM;CAe1B;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,mBAAmB;IAE9C,QAAQ,CAAC,MAAM,EAAE,MAAM;IADnC,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAU;gBACvB,MAAM,EAAE,MAAM;CAOpC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAEhD,QAAQ,CAAC,MAAM,EAAE,MAAM;IADnC,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;gBACzB,MAAM,EAAE,MAAM;CAOpC;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,SAAQ,mBAAmB;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;;CAK3C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,iFAAiF,CAAC;AAEpH,qBAAa,iBAAkB,SAAQ,mBAAmB;IACxD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;;CAK1C;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,mBAAmB;gBAClD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAkB,SAAQ,mBAAmB;IACxD,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAU;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM;CAUzB;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,MAAM,EAAE,MAAM;CAI3B;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,mBAAmB;IAE/C,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IADxD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACxB,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CASzD;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;gBAC1B,MAAM,EAAE,gBAAgB;CAerC;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAEtD,QAAQ,CAAC,OAAO,EAAE,MAAM;IADpC,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;gBACtB,OAAO,EAAE,MAAM;CAQrC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAGhE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE;IAJpC,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;gBAEzC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,EAAE;CAgBrC;AAED;;;;GAIG;AACH,qBAAa,iCAAkC,SAAQ,mBAAmB;IAGtE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,IAAI,EAAG,kCAAkC,CAAU;gBAEjD,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM;CAU1B;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,mBAAmB;IAGhE,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM;IAJjC,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;gBAEzC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM;CAclC;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAS3B"}

package/dist/shared/domain-errors.js

@@ -16,6 +16,7 @@
  * (`NoSharedHistoryError`), the name keeps its git flavour because
  * consumers actually need to discriminate on it.
  */
+import { sanitizedPath } from './printable.js';
 export class WorkflowDomainError extends Error {
     status;
     payload;
@@ -157,11 +158,37 @@ export class PullRebaseConflictError extends WorkflowDomainError {
         this.name = 'PullRebaseConflictError';
     }
 }
+/**
+ * The platform has never heard of this branch: nothing it has cloned, and
+ * nothing any listing of origin's branches has mentioned. Distinct from
+ * `RemoteBranchGoneError`, which is the SAME git failure about a branch the
+ * platform did know — and answering that for a name nobody ever pushed told
+ * the reader their typo "no longer exists on the remote", which implies it
+ * once did. 404, and the message names the branch and nothing else: no git
+ * output, no remote URL.
+ */
+export class BranchNotFoundError extends WorkflowDomainError {
+    branch;
+    kind = 'branch-not-found';
+    constructor(branch) {
+        super(`There is no branch named ${branch}.`, 404, {
+            kind: 'branch-not-found',
+            branch,
+        });
+        this.branch = branch;
+        this.name = 'BranchNotFoundError';
+    }
+}
 /**
  * The clone's branch no longer exists on origin: the fetch that refreshes
  * `refs/remotes/origin/<branch>` found no such ref. Distinct from an
  * unreachable remote — the host answered, and the answer was "gone" — so a
  * caller can treat the clone as stale rather than the sync as failed. 410.
+ *
+ * Only for a branch the platform KNEW: a clone of it, or a listing that named
+ * it. For a name it has never heard of, the same git failure is a
+ * `BranchNotFoundError` — see `WorkspaceService.hasHeardOfBranch`. A sync
+ * always has the clone in hand, so it is always this one.
  */
 export class RemoteBranchGoneError extends WorkflowDomainError {
     branch;
@@ -186,6 +213,41 @@ export class RemoteBranchGoneError extends WorkflowDomainError {
 export function isMissingRemoteBranchFailure(message) {
     return /Remote branch .* not found in upstream|couldn't find remote ref/i.test(message);
 }
+/**
+ * The caller named a path that resolves outside the workspace it was asked
+ * for. In practice that means an absolute path: a `..` climb is refused one
+ * step earlier, as an invalid path, by the same validator the file verbs run
+ * first.
+ *
+ * 403 carrying the exact message the file verbs answer, because
+ * `WorkspaceService.assertWithinWorkspace` throws a bare `Error` with this
+ * text and `workspace.routes.sendError` maps that text to 403. The lock
+ * service raises this instead of a bare `Error`, because `toHttpError` on the
+ * workflow routes reads the status off the class and would otherwise call it
+ * a 500. Both surfaces then answer identically for the same input. See
+ * `canonicalFileIdentity`.
+ */
+export class PathTraversalError extends WorkflowDomainError {
+    kind = 'path-traversal';
+    constructor() {
+        super('Path traversal detected', 403, { kind: 'path-traversal' });
+        this.name = 'PathTraversalError';
+    }
+}
+/**
+ * The caller named a path inside the repository's internal git folder: any
+ * `.git` segment, in any case, however it was spelled or reached (see
+ * `shared/git-internals.ts`). One message for every such path, whether or not
+ * anything is there, so the refusal is not an existence oracle.
+ */
+export const GIT_INTERNALS_MESSAGE = "That path is inside the repository's internal git data and is not available.";
+export class GitInternalsError extends WorkflowDomainError {
+    kind = 'git-internals';
+    constructor() {
+        super(GIT_INTERNALS_MESSAGE, 403, { kind: 'git-internals' });
+        this.name = 'GitInternalsError';
+    }
+}
 /**
  * Generic 400 for workflow-input validation (malformed branch names, missing
  * fields, etc.). Carries an optional payload so callers can attach typed
@@ -198,6 +260,62 @@ export class WorkflowValidationError extends WorkflowDomainError {
         this.name = 'WorkflowValidationError';
     }
 }
+/**
+ * The next step a missing path always offers, in one sentence.
+ *
+ * Lives HERE, the layer with no module imports, because both surfaces that
+ * answer a missing path need it and they sit on opposite sides of a module
+ * boundary: this class (raised by services, rendered by the HTTP routes) and
+ * `modules/workspace/not-found.ts` (the file tools), which re-exports the
+ * constant under its own name. One sentence, written once, so the two cannot
+ * drift apart.
+ */
+export const NOT_FOUND_NEXT_STEP = 'Check the path with list_files.';
+/**
+ * Nothing is at the path the caller named.
+ *
+ * Raised by a SERVICE that probed the path itself, where the file tools' own
+ * `not-found` helper (modules/workspace/not-found.ts) cannot reach: the zip
+ * reader, for instance, answers "ADM-ZIP: Invalid filename" for a missing
+ * archive, which is not a filesystem error at all and would otherwise be
+ * dressed up as an unreadable archive. The helper recognises this class and
+ * the raw `ENOENT`/`ENOTDIR` shapes alike, so both end as the one 404.
+ *
+ * 404 with a `not_found` kind and the requested path, which is also what the
+ * HTTP routes answer — a path that is not there gets one answer whichever
+ * surface asked. The MESSAGE AND THE PAYLOAD ARE BUILT HERE, not by whoever
+ * catches it, because not every surface catches it: the tools pass through
+ * `orDeclaredNotFound`, which re-renders the same three parts, but
+ * `POST /workspace/:id/unzip` sends this error straight to `domainErrorBody`.
+ * Sanitizing the path and appending the next step in the constructor is what
+ * makes those two answers the same answer.
+ */
+export class PathNotFoundError extends WorkflowDomainError {
+    kind = 'not_found';
+    /** The requested path, sanitized — never the path on disk. */
+    path;
+    constructor(path) {
+        const safe = sanitizedPath(path);
+        super(`There is no file or directory at "${safe}" in this workspace. ${NOT_FOUND_NEXT_STEP}`, 404, { kind: 'not_found', path: safe });
+        this.name = 'PathNotFoundError';
+        this.path = safe;
+    }
+}
+/**
+ * An archive the caller uploaded that the zip reader cannot open. 422, not
+ * 400: the request is well-formed and the path is fine — the BYTES are not a
+ * readable zip, which is the caller's to fix but not their spelling's.
+ *
+ * A type, because the route used to recognise this by the `Could not read zip
+ * file` prefix its message happens to start with, and a reworded message
+ * would silently have turned it into a 500.
+ */
+export class UnreadableArchiveError extends WorkflowDomainError {
+    constructor(reason) {
+        super(`Could not read zip file: ${reason}`, 422, { kind: 'unreadable-archive' });
+        this.name = 'UnreadableArchiveError';
+    }
+}
 /**
  * The draft branch doesn't share history with the target branch, so GitHub
  * would reject the change request with `no history in common`. Surfaced as
@@ -282,6 +400,25 @@ export class ChangeRequestConflictsError extends WorkflowDomainError {
         this.name = 'ChangeRequestConflictsError';
     }
 }
+/**
+ * A direct branch merge was asked to do what an open change request is
+ * waiting for a person to do: merge `sourceBranch` into `targetBranch`.
+ * Carries the request's number so the caller can point the person at it.
+ */
+export class OpenChangeRequestBlocksMergeError extends WorkflowDomainError {
+    sourceBranch;
+    targetBranch;
+    number;
+    kind = 'open-change-request-blocks-merge';
+    constructor(sourceBranch, targetBranch, number) {
+        super(`Change request #${number} proposes merging "${sourceBranch}" into "${targetBranch}" and is still open. ` +
+            `A change request is merged by a person: ask the user to review #${number} in the app.`, 409, { kind: 'open-change-request-blocks-merge', sourceBranch, targetBranch, number });
+        this.sourceBranch = sourceBranch;
+        this.targetBranch = targetBranch;
+        this.number = number;
+        this.name = 'OpenChangeRequestBlocksMergeError';
+    }
+}
 /**
  * Caller tried to open a change request for a `(source, target)` pair that
  * already has one open. Spec rule: A→B blocks A→B (B→A is allowed). Carries

package/dist/shared/domain-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-errors.js","sourceRoot":"","sources":["../../src/shared/domain-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,OAAO,CAA2B;IAC3C,YAAY,OAAe,EAAE,MAAc,EAAE,OAAiC;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACjB;IAArC,YAAY,MAAc,EAAW,UAAkB;QACrD,KAAK,CAAC,wBAAwB,UAAU,MAAM,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAD1B,eAAU,GAAV,UAAU,CAAQ;QAErD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IACtC;IAA6B;IAAlD,YAAqB,UAAkB,EAAW,MAAc;QAC9D,KAAK,CAAC,WAAW,UAAU,oBAAoB,MAAM,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAD3D,eAAU,GAAV,UAAU,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;QAE9D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IAEvC;IADZ,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAqB,UAAkB;QACrC,KAAK,CACH,uBAAuB,UAAU,kBAAkB,EACnD,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAC1C,CAAC;QALiB,eAAU,GAAV,UAAU,CAAQ;QAMrC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,6BAA8B,SAAQ,mBAAmB;IAGzD;IACA;IACA;IACA;IALF,IAAI,GAAG,uBAAgC,CAAC;IACjD,YACW,MAAc,EACd,IAAY,EACZ,cAAsB,EACtB,cAAsB;QAE/B,KAAK,CACH,qBAAqB,MAAM,qDAAqD;YAC9E,2BAA2B,IAAI,mDAAmD;YAClF,8BAA8B,EAChC,GAAG,EACH;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM;YACN,IAAI;YACJ,cAAc;YACd,cAAc;SACf,CACF,CAAC;QAjBO,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QACZ,mBAAc,GAAd,cAAc,CAAQ;QACtB,mBAAc,GAAd,cAAc,CAAQ;QAe/B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAGnD;IACA;IACA;IAJF,IAAI,GAAG,sBAA+B,CAAC;IAChD,YACW,MAAc,EACd,eAAyB,EACzB,MAAc;QAEvB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,CACH,aAAa,MAAM,kCAAkC,eAAe,CAAC,MAAM,aAAa,IAAI,IAAI;YAC9F,gDAAgD,EAClD,GAAG,EACH;YACE,IAAI,EAAE,sBAAsB;YAC5B,MAAM;YACN,eAAe;SAChB,CACF,CAAC;QAdO,WAAM,GAAN,MAAM,CAAQ;QACd,oBAAe,GAAf,eAAe,CAAU;QACzB,WAAM,GAAN,MAAM,CAAQ;QAavB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IAEvC;IADZ,IAAI,GAAG,oBAA6B,CAAC;IAC9C,YAAqB,MAAc;QACjC,KAAK,CAAC,WAAW,MAAM,mCAAmC,EAAE,GAAG,EAAE;YAC/D,IAAI,EAAE,oBAAoB;YAC1B,MAAM;SACP,CAAC,CAAC;QAJgB,WAAM,GAAN,MAAM,CAAQ;QAKjC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,OAAO,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAC9D,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAEtC;IAAuB;IADnC,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAqB,IAAY,EAAW,IAAY;QACtD,KAAK,CACH,cAAc,IAAI,iCAAiC,IAAI,KAAK;YAC1D,mEAAmE,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAC1C,CAAC;QANiB,SAAI,GAAJ,IAAI,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;QAOtD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,UAAU,CAAmB;IACtC,YAAY,MAAwB;QAClC,KAAK,CACH,uCAAuC,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,EACnF,GAAG,EACH;YACE,UAAU,EAAE;gBACV,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;SACF,CACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAE7C;IADZ,IAAI,GAAG,iBAA0B,CAAC;IAC3C,YAAqB,OAAe;QAClC,KAAK,CACH,qBAAqB,OAAO,yCAAyC,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CACrC,CAAC;QALiB,YAAO,GAAP,OAAO,CAAQ;QAMlC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAGvD;IACA;IACA;IAJF,IAAI,GAAG,0BAAmC,CAAC;IACpD,YACW,YAAoB,EACpB,YAAoB,EACpB,eAAyB;QAElC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,CACH,sBAAsB,YAAY,WAAW,YAAY,KAAK;YAC5D,GAAG,eAAe,CAAC,MAAM,aAAa,IAAI,iBAAiB,YAAY,kBAAkB,EAC3F,GAAG,EACH;YACE,IAAI,EAAE,0BAA0B;YAChC,YAAY;YACZ,YAAY;YACZ,eAAe;SAChB,CACF,CAAC;QAfO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,oBAAe,GAAf,eAAe,CAAU;QAclC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAGvD;IACA;IACA;IAJF,IAAI,GAAG,0BAAmC,CAAC;IACpD,YACW,YAAoB,EACpB,YAAoB,EACpB,cAAsB;QAE/B,KAAK,CACH,+CAA+C,YAAY,SAAS,YAAY,OAAO,cAAc,IAAI,EACzG,GAAG,EACH;YACE,IAAI,EAAE,0BAA0B;YAChC,YAAY;YACZ,YAAY;YACZ,cAAc;SACf,CACF,CAAC;QAbO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,mBAAc,GAAd,cAAc,CAAQ;QAY/B,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,mBAAmB;IACxD,IAAI,GAAG,gCAAyC,CAAC;IAC1D;;;;OAIG;IACM,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CACH,+GAA+G,EAC/G,GAAG,EACH,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAC3C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"domain-errors.js","sourceRoot":"","sources":["../../src/shared/domain-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,OAAO,CAA2B;IAC3C,YAAY,OAAe,EAAE,MAAc,EAAE,OAAiC;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACjB;IAArC,YAAY,MAAc,EAAW,UAAkB;QACrD,KAAK,CAAC,wBAAwB,UAAU,MAAM,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAD1B,eAAU,GAAV,UAAU,CAAQ;QAErD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IACtC;IAA6B;IAAlD,YAAqB,UAAkB,EAAW,MAAc;QAC9D,KAAK,CAAC,WAAW,UAAU,oBAAoB,MAAM,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAD3D,eAAU,GAAV,UAAU,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;QAE9D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IAEvC;IADZ,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAqB,UAAkB;QACrC,KAAK,CACH,uBAAuB,UAAU,kBAAkB,EACnD,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAC1C,CAAC;QALiB,eAAU,GAAV,UAAU,CAAQ;QAMrC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,6BAA8B,SAAQ,mBAAmB;IAGzD;IACA;IACA;IACA;IALF,IAAI,GAAG,uBAAgC,CAAC;IACjD,YACW,MAAc,EACd,IAAY,EACZ,cAAsB,EACtB,cAAsB;QAE/B,KAAK,CACH,qBAAqB,MAAM,qDAAqD;YAC9E,2BAA2B,IAAI,mDAAmD;YAClF,8BAA8B,EAChC,GAAG,EACH;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM;YACN,IAAI;YACJ,cAAc;YACd,cAAc;SACf,CACF,CAAC;QAjBO,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QACZ,mBAAc,GAAd,cAAc,CAAQ;QACtB,mBAAc,GAAd,cAAc,CAAQ;QAe/B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAGnD;IACA;IACA;IAJF,IAAI,GAAG,sBAA+B,CAAC;IAChD,YACW,MAAc,EACd,eAAyB,EACzB,MAAc;QAEvB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,CACH,aAAa,MAAM,kCAAkC,eAAe,CAAC,MAAM,aAAa,IAAI,IAAI;YAC9F,gDAAgD,EAClD,GAAG,EACH;YACE,IAAI,EAAE,sBAAsB;YAC5B,MAAM;YACN,eAAe;SAChB,CACF,CAAC;QAdO,WAAM,GAAN,MAAM,CAAQ;QACd,oBAAe,GAAf,eAAe,CAAU;QACzB,WAAM,GAAN,MAAM,CAAQ;QAavB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAErC;IADZ,IAAI,GAAG,kBAA2B,CAAC;IAC5C,YAAqB,MAAc;QACjC,KAAK,CAAC,4BAA4B,MAAM,GAAG,EAAE,GAAG,EAAE;YAChD,IAAI,EAAE,kBAAkB;YACxB,MAAM;SACP,CAAC,CAAC;QAJgB,WAAM,GAAN,MAAM,CAAQ;QAKjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IAEvC;IADZ,IAAI,GAAG,oBAA6B,CAAC;IAC9C,YAAqB,MAAc;QACjC,KAAK,CAAC,WAAW,MAAM,mCAAmC,EAAE,GAAG,EAAE;YAC/D,IAAI,EAAE,oBAAoB;YAC1B,MAAM;SACP,CAAC,CAAC;QAJgB,WAAM,GAAN,MAAM,CAAQ;QAKjC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,OAAO,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAmB,SAAQ,mBAAmB;IAChD,IAAI,GAAG,gBAAyB,CAAC;IAC1C;QACE,KAAK,CAAC,yBAAyB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,8EAA8E,CAAC;AAEpH,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IAC/C,IAAI,GAAG,eAAwB,CAAC;IACzC;QACE,KAAK,CAAC,qBAAqB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAC9D,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IAC/C,IAAI,GAAG,WAAoB,CAAC;IACrC,8DAA8D;IACrD,IAAI,CAAS;IACtB,YAAY,IAAY;QACtB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,CACH,qCAAqC,IAAI,wBAAwB,mBAAmB,EAAE,EACtF,GAAG,EACH,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,MAAc;QACxB,KAAK,CAAC,4BAA4B,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAEtC;IAAuB;IADnC,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAqB,IAAY,EAAW,IAAY;QACtD,KAAK,CACH,cAAc,IAAI,iCAAiC,IAAI,KAAK;YAC1D,mEAAmE,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAC1C,CAAC;QANiB,SAAI,GAAJ,IAAI,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;QAOtD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,mBAAmB;IACnD,UAAU,CAAmB;IACtC,YAAY,MAAwB;QAClC,KAAK,CACH,uCAAuC,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,EACnF,GAAG,EACH;YACE,UAAU,EAAE;gBACV,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B;SACF,CACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAE7C;IADZ,IAAI,GAAG,iBAA0B,CAAC;IAC3C,YAAqB,OAAe;QAClC,KAAK,CACH,qBAAqB,OAAO,yCAAyC,EACrE,GAAG,EACH,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CACrC,CAAC;QALiB,YAAO,GAAP,OAAO,CAAQ;QAMlC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAGvD;IACA;IACA;IAJF,IAAI,GAAG,0BAAmC,CAAC;IACpD,YACW,YAAoB,EACpB,YAAoB,EACpB,eAAyB;QAElC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,CACH,sBAAsB,YAAY,WAAW,YAAY,KAAK;YAC5D,GAAG,eAAe,CAAC,MAAM,aAAa,IAAI,iBAAiB,YAAY,kBAAkB,EAC3F,GAAG,EACH;YACE,IAAI,EAAE,0BAA0B;YAChC,YAAY;YACZ,YAAY;YACZ,eAAe;SAChB,CACF,CAAC;QAfO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,oBAAe,GAAf,eAAe,CAAU;QAclC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iCAAkC,SAAQ,mBAAmB;IAG7D;IACA;IACA;IAJF,IAAI,GAAG,kCAA2C,CAAC;IAC5D,YACW,YAAoB,EACpB,YAAoB,EACpB,MAAc;QAEvB,KAAK,CACH,mBAAmB,MAAM,sBAAsB,YAAY,WAAW,YAAY,uBAAuB;YACvG,mEAAmE,MAAM,cAAc,EACzF,GAAG,EACH,EAAE,IAAI,EAAE,kCAAkC,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,CACjF,CAAC;QATO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,WAAM,GAAN,MAAM,CAAQ;QAQvB,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAGvD;IACA;IACA;IAJF,IAAI,GAAG,0BAAmC,CAAC;IACpD,YACW,YAAoB,EACpB,YAAoB,EACpB,cAAsB;QAE/B,KAAK,CACH,+CAA+C,YAAY,SAAS,YAAY,OAAO,cAAc,IAAI,EACzG,GAAG,EACH;YACE,IAAI,EAAE,0BAA0B;YAChC,YAAY;YACZ,YAAY;YACZ,cAAc;SACf,CACF,CAAC;QAbO,iBAAY,GAAZ,YAAY,CAAQ;QACpB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,mBAAc,GAAd,cAAc,CAAQ;QAY/B,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,mBAAmB;IACxD,IAAI,GAAG,gCAAyC,CAAC;IAC1D;;;;OAIG;IACM,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CACH,+GAA+G,EAC/G,GAAG,EACH,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAC3C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/shared/email-identity.d.ts

@@ -0,0 +1,32 @@
+/**
+ * THE canonical spelling of an email address: trimmed, lowercased.
+ *
+ * Everything that compares two addresses, keys a row by one, or hashes one
+ * has to agree on this — a grant written `Mia@x.io` and a caller arriving as
+ * `mia@x.io ` are the same person, and any reader that decides otherwise
+ * denies access the knowledge base plainly gives. The rule was written out
+ * inline in a dozen places (`user.email.trim().toLowerCase()`) and named
+ * once in the access grammar; this is the one place it lives now, and the
+ * grammar's `canonicalEmail` is this function.
+ *
+ * Deliberately NOT full RFC normalization: no dot-folding, no plus-tag
+ * stripping, no IDN mapping. Those differ per provider, and a rule that
+ * guessed would silently merge two identities the operator's directory
+ * treats as distinct.
+ */
+export declare function canonicalEmail(email: string): string;
+/**
+ * Canonical user-identity hash: SHA-256 over the {@link canonicalEmail} form,
+ * returned as hex. Used wherever Bevel needs a stable email-derived identifier
+ * without storing the raw email — PR author-id markers, self-approval
+ * detection, the reverse lookup behind `findEmailByHash`.
+ *
+ * All callers MUST use this single function, and it must normalise exactly as
+ * `canonicalEmail` does: a drift between the two would silently de-attribute
+ * every PR the bot opens, because the hash embedded in the PR body would no
+ * longer match the hash computed at lookup time. That is not hypothetical —
+ * the access resolver carried its own copy of this expression, used by the
+ * very lookup that has to agree with it.
+ */
+export declare function hashEmail(email: string): string;
+//# sourceMappingURL=email-identity.d.ts.map

package/dist/shared/email-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-identity.d.ts","sourceRoot":"","sources":["../../src/shared/email-identity.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/shared/email-identity.js

@@ -0,0 +1,37 @@
+import { createHash } from 'node:crypto';
+/**
+ * THE canonical spelling of an email address: trimmed, lowercased.
+ *
+ * Everything that compares two addresses, keys a row by one, or hashes one
+ * has to agree on this — a grant written `Mia@x.io` and a caller arriving as
+ * `mia@x.io ` are the same person, and any reader that decides otherwise
+ * denies access the knowledge base plainly gives. The rule was written out
+ * inline in a dozen places (`user.email.trim().toLowerCase()`) and named
+ * once in the access grammar; this is the one place it lives now, and the
+ * grammar's `canonicalEmail` is this function.
+ *
+ * Deliberately NOT full RFC normalization: no dot-folding, no plus-tag
+ * stripping, no IDN mapping. Those differ per provider, and a rule that
+ * guessed would silently merge two identities the operator's directory
+ * treats as distinct.
+ */
+export function canonicalEmail(email) {
+    return email.trim().toLowerCase();
+}
+/**
+ * Canonical user-identity hash: SHA-256 over the {@link canonicalEmail} form,
+ * returned as hex. Used wherever Bevel needs a stable email-derived identifier
+ * without storing the raw email — PR author-id markers, self-approval
+ * detection, the reverse lookup behind `findEmailByHash`.
+ *
+ * All callers MUST use this single function, and it must normalise exactly as
+ * `canonicalEmail` does: a drift between the two would silently de-attribute
+ * every PR the bot opens, because the hash embedded in the PR body would no
+ * longer match the hash computed at lookup time. That is not hypothetical —
+ * the access resolver carried its own copy of this expression, used by the
+ * very lookup that has to agree with it.
+ */
+export function hashEmail(email) {
+    return createHash('sha256').update(canonicalEmail(email)).digest('hex');
+}
+//# sourceMappingURL=email-identity.js.map

package/dist/shared/email-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-identity.js","sourceRoot":"","sources":["../../src/shared/email-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}