@bevel-software/platform-core-backend 0.19.0 → 0.21.0

package/src/tenancy/tenant-host.ts

@@ -0,0 +1,261 @@
+import express, { type Express, type Request } from 'express';
+import path from 'node:path';
+import { isIP } from 'node:net';
+import type { ProcessConfig } from '../core-config.js';
+import { GIT_SHA } from '../version.js';
+import { logger } from '../shared/logging.js';
+import { TenantRuntime, type TenantRuntimeDeps } from './tenant-runtime.js';
+import { TENANT_SLUG_PATTERN, normalizeHost, type TenantDescriptor, type TenantSource } from './tenant-source.contract.js';
+
+const log = logger('tenancy');
+
+/**
+ * The path prefix under which a process reaches ONE of its own tenants over
+ * loopback: `http://127.0.0.1:<port>/_tenant/<slug>/api/...`. The MCP proxy
+ * and the UTCP manuals it seeds dial the tenant's own REST surface this way,
+ * because a loopback request carries no tenant host name and a header cannot
+ * ride a UTCP call (the proxy is a passthrough; it reshapes nothing).
+ *
+ * The host honours the prefix only for a request that came from this
+ * machine AND was forwarded by nobody: the socket peer is loopback and there
+ * is no `X-Forwarded-For`. A reverse proxy on the same host (nginx, a
+ * Coolify proxy) delivers every public request from a loopback socket, and
+ * every such proxy adds that header; the process's own dial never does.
+ * What the prefix could grant anyone who got past this is only what the
+ * tenant's host name grants already — sessions, keys and tokens are per
+ * tenant — but the addressing rule is stated so it can be relied on.
+ */
+export const LOOPBACK_TENANT_PREFIX = '/_tenant';
+
+/** The base URL a tenant's graph dials itself at — see {@link LOOPBACK_TENANT_PREFIX}. */
+export function loopbackTenantBaseUrl(port: number, slug: string): string {
+  return `http://127.0.0.1:${port}${LOOPBACK_TENANT_PREFIX}/${slug}`;
+}
+
+/** Whether `address` is this machine talking to itself. */
+export function isLoopbackAddress(address: string | undefined): boolean {
+  if (!address) return false;
+  const bare = address.startsWith('::ffff:') ? address.slice('::ffff:'.length) : address;
+  if (bare === '::1') return true;
+  return isIP(bare) === 4 && bare.startsWith('127.');
+}
+
+/** How a request names its tenant: by the loopback prefix, or by its host. */
+export type TenantSelector = { kind: 'slug'; slug: string; rest: string } | { kind: 'host'; host: string };
+
+/**
+ * Which tenant a request is for. The loopback prefix wins, but only from a
+ * loopback peer that no proxy forwarded (no `X-Forwarded-For`); everything
+ * else is decided by the host name (the `X-Forwarded-Host` a trusted proxy
+ * set, else `Host`), lowercase and without its port.
+ */
+export function selectTenant(req: {
+  hostname: string;
+  url: string;
+  peer: string | undefined;
+  forwardedFor?: string | string[] | undefined;
+}): TenantSelector {
+  const forwarded = Array.isArray(req.forwardedFor) ? req.forwardedFor.length > 0 : Boolean(req.forwardedFor);
+  if (isLoopbackAddress(req.peer) && !forwarded && req.url.startsWith(`${LOOPBACK_TENANT_PREFIX}/`)) {
+    const afterPrefix = req.url.slice(LOOPBACK_TENANT_PREFIX.length + 1);
+    const end = afterPrefix.search(/[/?#]/);
+    const slug = end === -1 ? afterPrefix : afterPrefix.slice(0, end);
+    if (TENANT_SLUG_PATTERN.test(slug)) {
+      const rest = end === -1 ? '/' : afterPrefix.slice(end).replace(/^(?=[?#])/, '/');
+      return { kind: 'slug', slug, rest };
+    }
+  }
+  return { kind: 'host', host: normalizeHost(req.hostname || '') };
+}
+
+export interface TenantHostOptions {
+  source: TenantSource;
+  process: ProcessConfig;
+  /** The built SPA, served once for every resolved tenant. */
+  staticDir?: string;
+  /** Minutes without a request after which a tenant's graph is stopped. Default 30; 0 never evicts. */
+  idleMinutes?: number;
+  /** How long a request waits for an activation in flight before answering 503. Default 60s. */
+  activationWaitMs?: number;
+  /** Seams for the runtimes the host builds — a suite's fake graphs. */
+  runtime?: TenantRuntimeDeps;
+  /** How often idle tenants are looked for. Default: once a minute. */
+  sweepIntervalMs?: number;
+}
+
+export interface TenantHost {
+  /** The app the process listens on. */
+  app: Express;
+  /** The runtimes built so far, by slug. */
+  runtimes(): ReadonlyMap<string, TenantRuntime>;
+  /** Stop every active tenant; the host keeps serving and reactivates on demand. */
+  evictAll(): Promise<void>;
+  /** Stop the idle sweep and every tenant: the process's shutdown. */
+  stop(): Promise<void>;
+}
+
+const DEFAULT_ACTIVATION_WAIT_MS = 60_000;
+const DEFAULT_IDLE_MINUTES = 30;
+const DEFAULT_SWEEP_INTERVAL_MS = 60_000;
+
+/** `promise`, or `null` once `ms` have passed. */
+function within<T>(promise: Promise<T>, ms: number): Promise<T | null> {
+  let timer: NodeJS.Timeout | undefined;
+  const late = new Promise<null>((resolve) => {
+    timer = setTimeout(() => resolve(null), ms);
+  });
+  return Promise.race([promise, late]).finally(() => clearTimeout(timer));
+}
+
+/**
+ * One Express app in front of many tenants' apps. It answers process health
+ * itself, resolves each request to a tenant (see {@link selectTenant}),
+ * activates that tenant's graph on first use, hands the request to the
+ * tenant's app, and serves the SPA for whatever the tenant's app leaves
+ * unhandled. Nothing below it knows there are other tenants: each graph was
+ * built by the same composition root a single-tenant deployment uses.
+ */
+export function createTenantHost(opts: TenantHostOptions): TenantHost {
+  const runtimes = new Map<string, TenantRuntime>();
+  const activationWaitMs = opts.activationWaitMs ?? DEFAULT_ACTIVATION_WAIT_MS;
+  const idleMs = (opts.idleMinutes ?? DEFAULT_IDLE_MINUTES) * 60_000;
+
+  const runtimeFor = (descriptor: TenantDescriptor): TenantRuntime => {
+    let runtime = runtimes.get(descriptor.slug);
+    if (!runtime) {
+      runtime = new TenantRuntime(descriptor, opts.runtime);
+      runtimes.set(descriptor.slug, runtime);
+    }
+    return runtime;
+  };
+
+  const app = express();
+  // Forwarded headers are honoured exactly as a single-tenant deployment
+  // honours them, and for the same reason: `req.hostname` is what picks the
+  // tenant, and behind a proxy it lives in `X-Forwarded-Host`.
+  if (opts.process.trustProxy) {
+    const raw = opts.process.trustProxy;
+    app.set('trust proxy', /^\d+$/.test(raw) ? Number(raw) : raw);
+  }
+
+  // The process's own health, before any tenant is involved: a load balancer
+  // asks with whatever host name it likes, and a process with no active
+  // tenant is still a healthy process.
+  app.get('/api/health', (_req, res) => {
+    res.json({ status: 'ok', sha: GIT_SHA, timestamp: Date.now(), tenants: runtimes.size });
+  });
+
+  app.use(async (req: Request, res, next) => {
+    const selector = selectTenant({
+      hostname: req.hostname,
+      url: req.url,
+      peer: req.socket.remoteAddress,
+      forwardedFor: req.headers['x-forwarded-for'],
+    });
+    let descriptor: TenantDescriptor | null;
+    try {
+      descriptor =
+        selector.kind === 'slug'
+          ? await opts.source.describe(selector.slug)
+          : await opts.source.resolveByHost(selector.host);
+    } catch (err) {
+      log.error('tenant lookup failed:', { err });
+      res.status(503).set('Retry-After', '5').json({ error: 'Tenant lookup failed' });
+      return;
+    }
+    if (!descriptor) {
+      if (req.path.startsWith('/api/') || req.path.startsWith(LOOPBACK_TENANT_PREFIX)) {
+        res.status(404).json({ error: 'No workspace at this address' });
+      } else {
+        res.status(404).type('text/plain').send('No workspace at this address.');
+      }
+      return;
+    }
+    if (selector.kind === 'slug') req.url = selector.rest;
+
+    const runtime = runtimeFor(descriptor);
+    // Counted from here, before the graph is even asked for, until the
+    // response closes however it ends — a 503 below included. An open
+    // response is what keeps a tenant from being evicted from under it.
+    // Left exactly once: a client that dropped during the tenant lookup
+    // above has had its `close` already, and that event will not come
+    // again, so the socket is asked directly; a socket destroyed but not
+    // yet closed would otherwise be left twice, once here and once by the
+    // listener, taking another request's count with it.
+    runtime.enter();
+    let left = false;
+    const leave = () => {
+      if (left) return;
+      left = true;
+      runtime.leave();
+    };
+    res.on('close', leave);
+    if (req.socket.destroyed) {
+      leave();
+      return;
+    }
+    let graph: Awaited<ReturnType<TenantRuntime['handle']>> | null;
+    try {
+      graph = await within(runtime.handle(), activationWaitMs);
+    } catch {
+      // Logged by the runtime; the caller learns only that it may try again.
+      res.status(503).set('Retry-After', '5').json({ error: 'This workspace could not be started; try again shortly' });
+      return;
+    }
+    if (!graph) {
+      res.status(503).set('Retry-After', '5').json({ error: 'This workspace is starting; try again shortly' });
+      return;
+    }
+    graph.app(req, res, next);
+  });
+
+  // Whatever a tenant's app left unhandled: the SPA, with the same rule a
+  // single-tenant deployment applies to the namespaces that must never
+  // resolve to `index.html` (see `createCoreServer`).
+  if (opts.staticDir) {
+    const frontendDist = opts.staticDir;
+    app.use(express.static(frontendDist));
+    app.get('{*path}', (req, res) => {
+      if (
+        req.path.startsWith('/.well-known/') ||
+        req.path.startsWith('/api/') ||
+        req.path.startsWith('/login/oauth/')
+      ) {
+        res.status(404).json({ error: 'Not found' });
+        return;
+      }
+      res.sendFile(path.join(frontendDist, 'index.html'));
+    });
+  }
+
+  // Idle tenants are stopped on a timer, never on the request that would
+  // have been their last: a graph whose last response closed `idleMs` ago,
+  // with none still open and no queued commit, is not worth its pool and
+  // its lease. `busy()` is what keeps an event stream's tenant alive.
+  const sweep = async () => {
+    for (const runtime of runtimes.values()) {
+      if (runtime.state !== 'active' || runtime.idleFor() < idleMs) continue;
+      if (await runtime.busy()) continue;
+      await runtime.evict().catch((err: unknown) => log.warn(`evicting tenant "${runtime.slug}" failed:`, { err }));
+    }
+  };
+  const sweeper =
+    idleMs > 0
+      ? setInterval(() => void sweep(), Math.min(opts.sweepIntervalMs ?? DEFAULT_SWEEP_INTERVAL_MS, idleMs))
+      : null;
+  sweeper?.unref();
+
+  const evictAll = async () => {
+    await Promise.all([...runtimes.values()].map((runtime) => runtime.evict().catch(() => undefined)));
+  };
+
+  return {
+    app,
+    runtimes: () => runtimes,
+    evictAll,
+    async stop() {
+      if (sweeper) clearInterval(sweeper);
+      await evictAll();
+    },
+  };
+}

package/src/tenancy/tenant-runtime.ts

@@ -0,0 +1,208 @@
+import type { Express } from 'express';
+import { createCoreServices, type CoreServices } from '../core/create-core-services.js';
+import { createCoreServer } from '../core/create-core-server.js';
+import { stopCore } from '../core/lifecycle.js';
+import { logger } from '../shared/logging.js';
+import type { TenantDescriptor } from './tenant-source.contract.js';
+
+const log = logger('tenancy');
+
+/** A tenant's running graph: its services and the Express app that serves them. */
+export interface TenantGraph {
+  core: CoreServices;
+  app: Express;
+}
+
+export type TenantState = 'idle' | 'activating' | 'active' | 'evicting';
+
+/** The lifecycle seams, so a suite can drive a runtime without a database. */
+export interface TenantRuntimeDeps {
+  /** Build and start the graph. Default: `createCoreServices` + `createCoreServer`. */
+  activate?: (descriptor: TenantDescriptor) => Promise<TenantGraph>;
+  /** Stop a graph. Default: `stopCore`. */
+  stop?: (graph: TenantGraph) => Promise<void>;
+  /** Whether the graph has work in flight that an eviction would strand. Default: queued commits. */
+  busy?: (graph: TenantGraph) => Promise<boolean>;
+  now?: () => number;
+  /**
+   * How long a failed activation is remembered before the next request tries
+   * again: `initialMs` after the first failure, doubling per consecutive
+   * failure up to `maxMs`. Defaults: 5 s to 60 s.
+   */
+  retry?: { initialMs?: number; maxMs?: number };
+}
+
+const DEFAULT_RETRY_INITIAL_MS = 5_000;
+const DEFAULT_RETRY_MAX_MS = 60_000;
+
+/**
+ * How a tenant's graph is built with the composition root as a distribution
+ * calls it, plus the one thing a host must say: no mirroring onto the shared
+ * package's process-wide bindings, since this process has several graphs and
+ * no single value to put there.
+ */
+async function activateWithCore(descriptor: TenantDescriptor): Promise<TenantGraph> {
+  const core = await createCoreServices(descriptor.config, { ...descriptor.ports, mirrorSharedBindings: false });
+  try {
+    // No static dir: the host serves the SPA once, for every tenant.
+    const app = await createCoreServer(core, descriptor.extensions ?? {}, {});
+    return { core, app };
+  } catch (err) {
+    // A graph whose boot failed still holds a pool and a lease.
+    await stopCore(core).catch(() => undefined);
+    throw err;
+  }
+}
+
+async function queuedCommits(graph: TenantGraph): Promise<boolean> {
+  return (await graph.core.pendingCommitsService.oldestQueuedAt()) !== null;
+}
+
+/**
+ * One tenant's graph, brought up on first use and stopped when the host
+ * says so: `idle → activating → active → evicting → idle`.
+ *
+ * ACTIVATE ONCE. Requests arriving while the graph is being built all await
+ * the one activation in flight. A failed activation is remembered for a
+ * short, growing window and answered from memory inside it, so a tenant
+ * whose remote is down or whose token is wrong costs one clone attempt per
+ * window rather than one per request; past the window the next request
+ * tries again, since the remote may be back or the token fixed. An eviction
+ * that lands mid-activation waits for the activation and then stops what it
+ * produced, so a graph is never left running behind an evicted runtime.
+ *
+ * IN USE MEANS A RESPONSE IS OPEN. The host tells the runtime when it hands
+ * a request over and when that response closes, so idleness counts from the
+ * last response that ENDED, and a tenant with any response still open — an
+ * event stream a browser holds, a clone in flight — is busy and never
+ * evicted from under it.
+ */
+export class TenantRuntime {
+  private graph: TenantGraph | null = null;
+  private activation: Promise<TenantGraph> | null = null;
+  private eviction: Promise<void> | null = null;
+  private failure: { error: unknown; until: number; backoffMs: number } | null = null;
+  private openResponses = 0;
+  private lastUsedAt: number;
+  private readonly activate: (descriptor: TenantDescriptor) => Promise<TenantGraph>;
+  private readonly stopGraph: (graph: TenantGraph) => Promise<void>;
+  private readonly isBusy: (graph: TenantGraph) => Promise<boolean>;
+  private readonly now: () => number;
+  private readonly retryInitialMs: number;
+  private readonly retryMaxMs: number;
+
+  constructor(
+    readonly descriptor: TenantDescriptor,
+    deps: TenantRuntimeDeps = {},
+  ) {
+    this.activate = deps.activate ?? activateWithCore;
+    this.stopGraph = deps.stop ?? ((graph) => stopCore(graph.core));
+    this.isBusy = deps.busy ?? queuedCommits;
+    this.now = deps.now ?? Date.now;
+    this.retryInitialMs = deps.retry?.initialMs ?? DEFAULT_RETRY_INITIAL_MS;
+    this.retryMaxMs = deps.retry?.maxMs ?? DEFAULT_RETRY_MAX_MS;
+    this.lastUsedAt = this.now();
+  }
+
+  /** A request was handed to this tenant; paired with {@link leave} when its response closes. */
+  enter(): void {
+    this.openResponses += 1;
+    this.lastUsedAt = this.now();
+  }
+
+  /** A response to this tenant closed, however it ended. */
+  leave(): void {
+    if (this.openResponses > 0) this.openResponses -= 1;
+    this.lastUsedAt = this.now();
+  }
+
+  /** Responses handed over and not yet closed. */
+  get open(): number {
+    return this.openResponses;
+  }
+
+  get slug(): string {
+    return this.descriptor.slug;
+  }
+
+  get state(): TenantState {
+    if (this.eviction) return 'evicting';
+    if (this.graph) return 'active';
+    if (this.activation) return 'activating';
+    return 'idle';
+  }
+
+  /** Milliseconds since a request last touched this tenant. */
+  idleFor(): number {
+    return this.now() - this.lastUsedAt;
+  }
+
+  /**
+   * The graph, built if it is not running. Every caller of a concurrent
+   * first burst gets the same promise; a caller that arrives during an
+   * eviction waits for it, then starts the graph afresh.
+   */
+  async handle(): Promise<TenantGraph> {
+    this.lastUsedAt = this.now();
+    if (this.eviction) await this.eviction;
+    if (this.graph) return this.graph;
+    if (this.failure && this.now() < this.failure.until) throw this.failure.error;
+    this.activation ??= this.activate(this.descriptor).then(
+      (graph) => {
+        this.graph = graph;
+        this.activation = null;
+        this.failure = null;
+        log.info(`tenant "${this.slug}" activated`);
+        return graph;
+      },
+      (err: unknown) => {
+        this.activation = null;
+        const backoffMs = Math.min(this.failure ? this.failure.backoffMs * 2 : this.retryInitialMs, this.retryMaxMs);
+        this.failure = { error: err, until: this.now() + backoffMs, backoffMs };
+        log.error(`tenant "${this.slug}" failed to activate; not asked again for ${backoffMs}ms:`, { err });
+        throw err;
+      },
+    );
+    return this.activation;
+  }
+
+  /**
+   * Whether an eviction would strand something: a response still open, or
+   * work the graph reports (queued commits). False when nothing runs.
+   */
+  async busy(): Promise<boolean> {
+    if (this.openResponses > 0) return true;
+    return this.graph ? this.isBusy(this.graph) : false;
+  }
+
+  /**
+   * Stop the graph, if one runs or is being built. Idempotent: a second call
+   * joins the eviction under way. Afterwards the runtime is idle and the
+   * next {@link handle} builds a fresh graph.
+   */
+  evict(): Promise<void> {
+    if (this.eviction) return this.eviction;
+    const eviction = (async () => {
+      if (this.activation) {
+        // Whatever the build produces is stopped; a build that fails has
+        // stopped its own graph already.
+        await this.activation.catch(() => undefined);
+      }
+      const graph = this.graph;
+      this.graph = null;
+      if (graph) {
+        await this.stopGraph(graph);
+        log.info(`tenant "${this.slug}" evicted`);
+      }
+    })();
+    // Assigned, then cleared by identity: an eviction with nothing to stop
+    // settles before this line runs, and a `finally` inside it would have
+    // cleared a field that was not yet set — leaving the settled promise
+    // in place as an eviction forever under way.
+    this.eviction = eviction;
+    void eviction.finally(() => {
+      if (this.eviction === eviction) this.eviction = null;
+    });
+    return eviction;
+  }
+}

package/src/tenancy/tenant-secrets.ts

@@ -0,0 +1,41 @@
+import { hkdfSync } from 'node:crypto';
+
+/** The three secrets every graph needs, derived rather than stored. */
+export interface TenantSecrets {
+  /** Signs the tenant's login sessions and OAuth state. */
+  jwtSecret: string;
+  /** 32 bytes, base64: encrypts the tenant's vault values, MCP OAuth tokens and stored git credential. */
+  secretsEncKey: string;
+  /** HMAC key for the tenant's internal (loopback) tool tokens. */
+  internalTokenSecret: string;
+}
+
+/** The least a master key may hold: 32 characters is 256 bits of a random string. */
+const MIN_MASTER_KEY_LENGTH = 32;
+
+/**
+ * A tenant's secrets from ONE master key and its slug, with HKDF-SHA256:
+ * the slug is the salt and each secret's name the info, so the three are
+ * independent of each other and of every other tenant's.
+ *
+ * Derived, not generated and stored, for the hand-over: a tenant that leaves
+ * for a dedicated deployment takes a `pg_dump` whose vault rows and stored
+ * git token are encrypted under its `secretsEncKey`. With derivation the key
+ * is reproducible from the master key and the slug on the day of the
+ * export, and nothing per tenant has to be kept safe in the meantime. The
+ * cloud app's registry calls this with the same inputs and gets the same
+ * answer.
+ */
+export function deriveTenantSecrets(masterKey: string, slug: string): TenantSecrets {
+  if (masterKey.length < MIN_MASTER_KEY_LENGTH) {
+    throw new Error(`TENANT_MASTER_KEY must be at least ${MIN_MASTER_KEY_LENGTH} characters of random text`);
+  }
+  if (!slug) throw new Error('A tenant slug is required to derive its secrets');
+  const derive = (info: string): string =>
+    Buffer.from(hkdfSync('sha256', masterKey, `hexis-tenant:${slug}`, info, 32)).toString('base64');
+  return {
+    jwtSecret: derive('jwt-secret'),
+    secretsEncKey: derive('secrets-enc-key'),
+    internalTokenSecret: derive('internal-token-secret'),
+  };
+}

package/src/tenancy/tenant-source.contract.ts

@@ -0,0 +1,59 @@
+import type { TenantConfig } from '../core-config.js';
+import type { CorePorts } from '../core/core-ports.js';
+import type { ServerExtensions } from '../core/create-core-server.js';
+
+/**
+ * A tenant, as the host needs to know it: which host names reach it, what
+ * its service graph is built from, and what a distribution adds to that
+ * graph. One of these is one `createCoreServices` + `createCoreServer`, run
+ * on demand and stopped again when idle — see `tenant-runtime.ts`.
+ *
+ * `ports` and `extensions` are per tenant on purpose: everything the
+ * enterprise overlay does per deployment (its SSO plugin, session sink,
+ * erasure participants, extra startup steps) it does per tenant here, through
+ * the same two seams, with nothing below the front door knowing the
+ * difference.
+ */
+export interface TenantDescriptor {
+  /** The tenant's stable name: lowercase, `[a-z][a-z0-9-]*`, at most 40 characters. */
+  readonly slug: string;
+  /** Host names (no port) whose requests belong to this tenant, lowercase. */
+  readonly hosts: readonly string[];
+  readonly config: TenantConfig;
+  readonly ports?: CorePorts;
+  readonly extensions?: ServerExtensions;
+}
+
+/**
+ * Where tenants come from. Core ships {@link StaticTenantSource}, which
+ * reads a file, for development and tests; the cloud app implements this
+ * over its own registry, where subdomains are provisioned and plans live.
+ * A source answers `null` for a host or slug it does not know, and the host
+ * turns that into a 404 without building anything.
+ */
+export interface TenantSource {
+  resolveByHost(host: string): Promise<TenantDescriptor | null>;
+  describe(slug: string): Promise<TenantDescriptor | null>;
+}
+
+/** What a slug may look like: it names a schema, a folder and a loopback path. */
+export const TENANT_SLUG_PATTERN = /^[a-z][a-z0-9-]{0,39}$/;
+
+export function assertTenantSlug(slug: string): string {
+  if (!TENANT_SLUG_PATTERN.test(slug)) {
+    throw new Error(`Tenant slug must match ${TENANT_SLUG_PATTERN} (lowercase, digits, hyphens); got "${slug}"`);
+  }
+  return slug;
+}
+
+/**
+ * A host name the way the host compares it: lowercase, without a port or a
+ * trailing dot. `Host` headers and `X-Forwarded-Host` values arrive in every
+ * spelling a client or proxy chooses.
+ */
+export function normalizeHost(host: string): string {
+  const trimmed = host.trim().toLowerCase().replace(/\.$/, '');
+  // `[::1]:3001` keeps its brackets; `example.test:3001` loses its port.
+  if (trimmed.startsWith('[')) return trimmed.replace(/\]:\d+$/, ']');
+  return trimmed.replace(/:\d+$/, '');
+}

package/dist/modules/access/access-errors.d.ts

@@ -1,34 +0,0 @@
-import { WorkflowDomainError } from '../workflow/workflow.errors.js';
-export interface AccessDeniedDetails {
-    /** repo-relative POSIX path the caller tried to write */
-    path: string;
-    /** Display names of roles that would grant write at this path. */
-    eligibleRoles: string[];
-    /** Direct user grants at this path, in `{name, email}` form. */
-    eligibleUsers: {
-        name: string;
-        email: string;
-    }[];
-}
-/**
- * Thrown when a user lacks the `write` permission on a path under the
- * access-control rules in `roles.yaml` + `access.md`.
- *
- * Carries enough detail in the JSON payload for the frontend to render
- * "you don't have permission to write to <path>; eligible: <roles + users>"
- * without a follow-up roundtrip.
- */
-export declare class AccessDeniedError extends WorkflowDomainError {
-    readonly access: AccessDeniedDetails;
-    constructor(details: AccessDeniedDetails);
-}
-/**
- * Thrown when the access-control config (roles.yaml or access.md) is missing
- * or malformed at runtime — distinct from AccessDeniedError because the cause
- * is a config bug, not a permission decision.
- */
-export declare class AccessConfigError extends WorkflowDomainError {
-    readonly errors: string[];
-    constructor(errors: string[]);
-}
-//# sourceMappingURL=access-errors.d.ts.map

package/dist/modules/access/access-errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-errors.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gEAAgE;IAChE,aAAa,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,mBAAmB;IACxD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;gBAEzB,OAAO,EAAE,mBAAmB;CAkBzC;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,mBAAmB;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAEd,MAAM,EAAE,MAAM,EAAE;CAS7B"}

package/dist/modules/access/access-errors.js

@@ -1,40 +0,0 @@
-import { WorkflowDomainError } from '../workflow/workflow.errors.js';
-/**
- * Thrown when a user lacks the `write` permission on a path under the
- * access-control rules in `roles.yaml` + `access.md`.
- *
- * Carries enough detail in the JSON payload for the frontend to render
- * "you don't have permission to write to <path>; eligible: <roles + users>"
- * without a follow-up roundtrip.
- */
-export class AccessDeniedError extends WorkflowDomainError {
-    access;
-    constructor(details) {
-        const rolesPart = details.eligibleRoles.length
-            ? details.eligibleRoles.join(', ')
-            : 'none';
-        const usersPart = details.eligibleUsers.length
-            ? details.eligibleUsers
-                .map((u) => (u.name ? `${u.name} <${u.email}>` : u.email))
-                .join(', ')
-            : '';
-        const eligible = [rolesPart, usersPart].filter(Boolean).join('; ');
-        super(`You don't have permission to write to "${details.path}". Eligible: ${eligible}.`, 403, { access: details });
-        this.name = 'AccessDeniedError';
-        this.access = details;
-    }
-}
-/**
- * Thrown when the access-control config (roles.yaml or access.md) is missing
- * or malformed at runtime — distinct from AccessDeniedError because the cause
- * is a config bug, not a permission decision.
- */
-export class AccessConfigError extends WorkflowDomainError {
-    errors;
-    constructor(errors) {
-        super(`Access-control config is invalid: ${errors.join('; ')}`, 500, { accessConfigErrors: errors });
-        this.name = 'AccessConfigError';
-        this.errors = errors;
-    }
-}
-//# sourceMappingURL=access-errors.js.map

package/dist/modules/access/access-errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-errors.js","sourceRoot":"","sources":["../../../src/modules/access/access-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAWrE;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IAC/C,MAAM,CAAsB;IAErC,YAAY,OAA4B;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM;YAC5C,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,CAAC,CAAC,MAAM,CAAC;QACX,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM;YAC5C,CAAC,CAAC,OAAO,CAAC,aAAa;iBAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;iBACzD,IAAI,CAAC,IAAI,CAAC;YACf,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,KAAK,CACH,0CAA0C,OAAO,CAAC,IAAI,gBAAgB,QAAQ,GAAG,EACjF,GAAG,EACH,EAAE,MAAM,EAAE,OAAO,EAAE,CACpB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;IACxB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IAC/C,MAAM,CAAW;IAE1B,YAAY,MAAgB;QAC1B,KAAK,CACH,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxD,GAAG,EACH,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAC/B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}