@bevel-software/platform-core-backend 0.19.0 → 0.21.0

package/dist/modules/workflow/file-change-notifier.js

@@ -1,22 +0,0 @@
-export class FileChangeNotifier {
-    listeners = new Set();
-    /** Register a listener. Returns an unsubscribe fn. */
-    onFilesChanged(listener) {
-        this.listeners.add(listener);
-        return () => this.listeners.delete(listener);
-    }
-    /** Fan a change out to every listener; isolate + log each so one can't break the commit. */
-    emit(change) {
-        if (change.paths.length === 0)
-            return;
-        for (const listener of this.listeners) {
-            try {
-                listener(change);
-            }
-            catch (err) {
-                console.error('[file-change] listener threw:', err instanceof Error ? err.message : err);
-            }
-        }
-    }
-}
-//# sourceMappingURL=file-change-notifier.js.map

package/dist/modules/workflow/file-change-notifier.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-change-notifier.js","sourceRoot":"","sources":["../../../src/modules/workflow/file-change-notifier.ts"],"names":[],"mappings":"AAiCA,MAAM,OAAO,kBAAkB;IACZ,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE7D,sDAAsD;IACtD,cAAc,CAAC,QAA8B;QAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IAC5F,IAAI,CAAC,MAAmB;QACtB,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACtC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/modules/workflow/git/branch-name.d.ts

@@ -1,10 +0,0 @@
-export { PROTECTED_BRANCHES, isProtectedBranch } from '@bevel-software/platform-shared';
-export { branchAuthorLocalpart, isBranchAuthoredBy, isOwnSuggestionsBranch, } from '@bevel-software/platform-shared';
-/** Throw if `name` cannot safely be passed to `git` as a branch name. */
-export declare function assertValidBranchName(name: string): void;
-/**
- * Guard against path traversal and shell-unsafe characters on any workspace-relative
- * path we pass to `git` as a pathspec. Must stay within the repo; forward slashes only.
- */
-export declare function assertValidRelativePath(relativePath: string): void;
-//# sourceMappingURL=branch-name.d.ts.map

package/dist/modules/workflow/git/branch-name.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"branch-name.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/git/branch-name.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAKxF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAIzC,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAwBxD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAyBlE"}

package/dist/modules/workflow/git/branch-name.js

@@ -1,76 +0,0 @@
-import { BranchNameError, WorkflowValidationError } from '../workflow.errors.js';
-// Single source of truth for the protected-branch list lives in `@bevel-software/platform-shared` so
-// the backend guard and the frontend banner/disabling logic can't drift apart.
-export { PROTECTED_BRANCHES, isProtectedBranch } from '@bevel-software/platform-shared';
-// Authorship inference lives in `@bevel-software/platform-shared` for the same reason — the
-// picker's `canDelete` rule and the backend authorisation check on
-// `deleteBranch` must agree on every edge case (uppercase email, dotted
-// localpart, etc.).
-export { branchAuthorLocalpart, isBranchAuthoredBy, isOwnSuggestionsBranch, } from '@bevel-software/platform-shared';
-const VALID_BRANCH_REGEX = /^[A-Za-z0-9][A-Za-z0-9/_\-.]*$/;
-/** Throw if `name` cannot safely be passed to `git` as a branch name. */
-export function assertValidBranchName(name) {
-    if (!name)
-        throw new BranchNameError('empty name', name);
-    if (name.length > 255)
-        throw new BranchNameError('too long', name);
-    if (!VALID_BRANCH_REGEX.test(name)) {
-        throw new BranchNameError('contains invalid characters', name);
-    }
-    if (name.includes('..'))
-        throw new BranchNameError('contains ".."', name);
-    if (name.includes('//'))
-        throw new BranchNameError('contains "//"', name);
-    if (name.endsWith('/') || name.endsWith('.')) {
-        throw new BranchNameError('ends with "/" or "."', name);
-    }
-    if (name.startsWith('-'))
-        throw new BranchNameError('starts with "-"', name);
-    if (name.includes('@{'))
-        throw new BranchNameError('contains "@{"', name);
-    // Per-segment rules: git forbids any `/`-separated segment from beginning
-    // with "." or ending with ".lock" (e.g. `foo/.tmp`, `foo.lock/bar`).
-    // The whole-name checks above can't catch nested violations.
-    for (const segment of name.split('/')) {
-        if (segment.startsWith('.')) {
-            throw new BranchNameError('segment starts with "."', name);
-        }
-        if (segment.endsWith('.lock')) {
-            throw new BranchNameError('segment ends with ".lock"', name);
-        }
-    }
-}
-/**
- * Guard against path traversal and shell-unsafe characters on any workspace-relative
- * path we pass to `git` as a pathspec. Must stay within the repo; forward slashes only.
- */
-export function assertValidRelativePath(relativePath) {
-    if (!relativePath)
-        throw new WorkflowValidationError('path is required');
-    if (relativePath.length > 1024)
-        throw new WorkflowValidationError('path too long');
-    if (relativePath.includes('\0'))
-        throw new WorkflowValidationError('path contains NUL');
-    if (relativePath.includes('\\')) {
-        throw new WorkflowValidationError('path must use forward slashes only');
-    }
-    if (relativePath.startsWith('/') || /^[A-Za-z]:/.test(relativePath)) {
-        throw new WorkflowValidationError('path must be relative');
-    }
-    const parts = relativePath.split('/');
-    if (parts.some((p) => p === '..' || p === '.')) {
-        throw new WorkflowValidationError('path must not contain "." or ".."');
-    }
-    if (relativePath.startsWith('-')) {
-        throw new WorkflowValidationError('path must not start with "-"');
-    }
-    // Pathspec glob characters (`*`, `?`, `[`, `]`, `!`) and pathspec magic (`:(…)`)
-    // would otherwise be interpreted by `git add -- <path>` / `git log -- <path>`
-    // and match the wrong files. `GitService.git()` sets `GIT_LITERAL_PATHSPECS=1`
-    // on every git subprocess, which forces literal interpretation across the
-    // board — so KB filenames containing `[Approved]`, `[New]`, etc. round-trip
-    // through commit cleanly. The shared `validateFilename` already rejects `:`
-    // along with the rest of Windows-forbidden characters before paths reach this
-    // layer, so a redundant check here would only confuse the error message.
-}
-//# sourceMappingURL=branch-name.js.map

package/dist/modules/workflow/git/branch-name.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"branch-name.js","sourceRoot":"","sources":["../../../../src/modules/workflow/git/branch-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,qGAAqG;AACrG,+EAA+E;AAC/E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACxF,4FAA4F;AAC5F,mEAAmE;AACnE,wEAAwE;AACxE,oBAAoB;AACpB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,6DAA6D;IAC7D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IACxF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,CAAC,CAAC;IACpE,CAAC;IACD,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;AAC3E,CAAC"}

package/dist/modules/workflow/git/clone-config.d.ts

@@ -1,61 +0,0 @@
-/**
- * The git configuration a per-branch workspace clone must have for its branch
- * to track exactly ONE upstream ref.
- *
- * Why this exists: a clone's config is append-only from git's point of view,
- * and several things write to it:
- *
- *   - `git config --add branch.<name>.merge …` / `git branch --set-upstream-to`
- *     run out of band (an agent shell session in the workspace, a manual fix)
- *     leaves a SECOND `branch.<name>.merge` value;
- *   - `git remote set-branches --add origin …`, a re-run `git remote add`, or a
- *     hand-edited `.git/config` leaves a SECOND `remote.origin.fetch` refspec,
- *     so one fetch maps the same remote branch in twice.
- *
- * A multi-valued `branch.<name>.merge` is what makes a BARE `git fetch origin`
- * write more than one *for-merge* entry into the clone's shared
- * `.git/FETCH_HEAD` — git adds one per configured merge ref. That is the
- * ammunition behind the reported failure: `git pull` reads its rebase target
- * out of that same shared file, so when one of the app's unmutexed bare
- * fetches lands inside the pull's fetch→read window, the pull sees two merge
- * heads and dies with `fatal: Cannot rebase onto multiple branches.`
- *
- * The drift alone is NOT sufficient — an explicit `git pull --rebase origin
- * <branch>` survives every drift shape on its own (verified across the shapes
- * above on git 2.39.5); it takes the concurrent fetch too. `GitService.pull`
- * closes the other half by never reading or writing FETCH_HEAD; normalising
- * the config here removes the ammunition.
- *
- * These are the three keys that pin the clone back to "this branch tracks
- * `origin/<branch>`, nothing else"; applied with `--replace-all` they collapse
- * any accumulated duplicates into one value.
- *
- * Lives here — next to `assertValidBranchName` — as a leaf-level primitive
- * shared by the git layer (self-heal before every pull) and `WorkspaceService`
- * (stamped on new clones, and re-stamped on existing ones the first time this
- * process opens them, which is the migration for clones already on disk).
- */
-/** The single fetch refspec a workspace clone of the KB is created with. */
-export declare const ORIGIN_FETCH_REFSPEC = "+refs/heads/*:refs/remotes/origin/*";
-/**
- * The one safe shape for an implicit background fetch of a workspace clone —
- * shared by `GitService.fetchOriginIfStale` and
- * `WorkspaceService.ensureRemotesFetched`, both of which run OUTSIDE the
- * workspace mutex. `--no-write-fetch-head` is what makes that safe: without it
- * a bare fetch rewrites the clone's shared `.git/FETCH_HEAD` underneath
- * whatever else is running in it, which is how the post-merge `git pull` read
- * two merge heads and died with "Cannot rebase onto multiple branches" (see
- * the header comment above and `GitService.pull`). These paths only want the
- * remote-tracking refs refreshed; `--prune` keeps deleted remote branches from
- * lingering. Callers prepend their own runner context (`-C <dir>` /
- * `-c http.*` options) but must not vary these arguments.
- */
-export declare const SAFE_IMPLICIT_FETCH_ARGS: readonly string[];
-/**
- * `git` argument lists that normalise a clone's tracking config for `branch`.
- * Returns the arguments rather than running them so each caller can use its own
- * git runner (the git service's mutex-aware wrapper, `git -C` from the
- * workspace service) — no process is spawned here.
- */
-export declare function cloneTrackingConfigArgs(branch: string): string[][];
-//# sourceMappingURL=clone-config.d.ts.map

package/dist/modules/workflow/git/clone-config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"clone-config.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/git/clone-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,wCAAwC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAErD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CAMlE"}

package/dist/modules/workflow/git/clone-config.js

@@ -1,69 +0,0 @@
-/**
- * The git configuration a per-branch workspace clone must have for its branch
- * to track exactly ONE upstream ref.
- *
- * Why this exists: a clone's config is append-only from git's point of view,
- * and several things write to it:
- *
- *   - `git config --add branch.<name>.merge …` / `git branch --set-upstream-to`
- *     run out of band (an agent shell session in the workspace, a manual fix)
- *     leaves a SECOND `branch.<name>.merge` value;
- *   - `git remote set-branches --add origin …`, a re-run `git remote add`, or a
- *     hand-edited `.git/config` leaves a SECOND `remote.origin.fetch` refspec,
- *     so one fetch maps the same remote branch in twice.
- *
- * A multi-valued `branch.<name>.merge` is what makes a BARE `git fetch origin`
- * write more than one *for-merge* entry into the clone's shared
- * `.git/FETCH_HEAD` — git adds one per configured merge ref. That is the
- * ammunition behind the reported failure: `git pull` reads its rebase target
- * out of that same shared file, so when one of the app's unmutexed bare
- * fetches lands inside the pull's fetch→read window, the pull sees two merge
- * heads and dies with `fatal: Cannot rebase onto multiple branches.`
- *
- * The drift alone is NOT sufficient — an explicit `git pull --rebase origin
- * <branch>` survives every drift shape on its own (verified across the shapes
- * above on git 2.39.5); it takes the concurrent fetch too. `GitService.pull`
- * closes the other half by never reading or writing FETCH_HEAD; normalising
- * the config here removes the ammunition.
- *
- * These are the three keys that pin the clone back to "this branch tracks
- * `origin/<branch>`, nothing else"; applied with `--replace-all` they collapse
- * any accumulated duplicates into one value.
- *
- * Lives here — next to `assertValidBranchName` — as a leaf-level primitive
- * shared by the git layer (self-heal before every pull) and `WorkspaceService`
- * (stamped on new clones, and re-stamped on existing ones the first time this
- * process opens them, which is the migration for clones already on disk).
- */
-/** The single fetch refspec a workspace clone of the KB is created with. */
-export const ORIGIN_FETCH_REFSPEC = '+refs/heads/*:refs/remotes/origin/*';
-/**
- * The one safe shape for an implicit background fetch of a workspace clone —
- * shared by `GitService.fetchOriginIfStale` and
- * `WorkspaceService.ensureRemotesFetched`, both of which run OUTSIDE the
- * workspace mutex. `--no-write-fetch-head` is what makes that safe: without it
- * a bare fetch rewrites the clone's shared `.git/FETCH_HEAD` underneath
- * whatever else is running in it, which is how the post-merge `git pull` read
- * two merge heads and died with "Cannot rebase onto multiple branches" (see
- * the header comment above and `GitService.pull`). These paths only want the
- * remote-tracking refs refreshed; `--prune` keeps deleted remote branches from
- * lingering. Callers prepend their own runner context (`-C <dir>` /
- * `-c http.*` options) but must not vary these arguments.
- */
-export const SAFE_IMPLICIT_FETCH_ARGS = [
-    'fetch', '--prune', '--no-write-fetch-head', 'origin',
-];
-/**
- * `git` argument lists that normalise a clone's tracking config for `branch`.
- * Returns the arguments rather than running them so each caller can use its own
- * git runner (the git service's mutex-aware wrapper, `git -C` from the
- * workspace service) — no process is spawned here.
- */
-export function cloneTrackingConfigArgs(branch) {
-    return [
-        ['config', '--replace-all', 'remote.origin.fetch', ORIGIN_FETCH_REFSPEC],
-        ['config', '--replace-all', `branch.${branch}.remote`, 'origin'],
-        ['config', '--replace-all', `branch.${branch}.merge`, `refs/heads/${branch}`],
-    ];
-}
-//# sourceMappingURL=clone-config.js.map

package/dist/modules/workflow/git/clone-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"clone-config.js","sourceRoot":"","sources":["../../../../src/modules/workflow/git/clone-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ;CACtD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO;QACL,CAAC,QAAQ,EAAE,eAAe,EAAE,qBAAqB,EAAE,oBAAoB,CAAC;QACxE,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,MAAM,SAAS,EAAE,QAAQ,CAAC;QAChE,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,MAAM,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/modules/workflow/git/mutex.d.ts

@@ -1,11 +0,0 @@
-/**
- * Serializes async operations by key. Two `run(k, ...)` calls with the same key
- * execute sequentially in call order; different keys run independently.
- *
- * Prevents interleaved `git` invocations against a single workspace.
- */
-export declare class WorkspaceMutex {
-    private readonly tails;
-    run<T>(key: string, fn: () => Promise<T>): Promise<T>;
-}
-//# sourceMappingURL=mutex.d.ts.map

package/dist/modules/workflow/git/mutex.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mutex.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/git/mutex.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAEvD,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAY5D"}

package/dist/modules/workflow/git/mutex.js

@@ -1,23 +0,0 @@
-/**
- * Serializes async operations by key. Two `run(k, ...)` calls with the same key
- * execute sequentially in call order; different keys run independently.
- *
- * Prevents interleaved `git` invocations against a single workspace.
- */
-export class WorkspaceMutex {
-    tails = new Map();
-    async run(key, fn) {
-        const prev = this.tails.get(key) ?? Promise.resolve();
-        const next = prev.catch(() => undefined).then(fn);
-        this.tails.set(key, next);
-        try {
-            return await next;
-        }
-        finally {
-            if (this.tails.get(key) === next) {
-                this.tails.delete(key);
-            }
-        }
-    }
-}
-//# sourceMappingURL=mutex.js.map

package/dist/modules/workflow/git/mutex.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mutex.js","sourceRoot":"","sources":["../../../../src/modules/workflow/git/mutex.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACR,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,EAAoB;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/modules/workflow/locking-filesystem.d.ts

@@ -1,137 +0,0 @@
-/**
- * A `LocalFilesystem` that wraps every mutating operation in a workflow
- * lock acquire → super-call → release-with-auto-commit-and-push cycle.
- * This is the agent's file edit surface — Mastra hands the agent the
- * workspace's filesystem tools (write_file / edit_file / etc.), and those
- * call directly into this class, so the agent's edits go through the same
- * lock + commit + push pipeline as the human editor's saves.
- *
- * Per the workflow spec (PLAN.md §2):
- *   - Each tool call is one acquire/release cycle. The agent never holds a
- *     lock while it's "thinking" between tool calls — a fast human editor
- *     can always grab a file the agent isn't actively writing.
- *   - On lock contention (someone else holds the lock) we retry 3× at
- *     2-second intervals (~6s ceiling) then surface a structured error
- *     so the agent can skip the file and continue with the rest of its
- *     turn rather than aborting the whole call.
- *   - Lock-release inside `WorkflowService.releaseLock` is the thing that
- *     actually commits + pushes the file — see that method for the
- *     `commitFile → release → push` sequence. We don't repeat the commit
- *     step here; releasing IS committing.
- *   - `rmdir` is refused. The workflow invariant is "each change touches
- *     exactly one file" and a recursive directory delete violates that.
- *     The agent must delete entries individually via `deleteFile`.
- *   - `mkdir` followed by a `.gitkeep` write is the canonical way to land
- *     "create empty folder" as a one-file change — the locking write of
- *     `.gitkeep` carries the commit.
- *
- * Path conventions: Mastra's `inputPath` is workspace-relative (e.g.
- * `knowledge-base/Knowledge/Foo.md`) — the same shape the human
- * editor's `openFilePath` carries, so locks acquired by the agent and
- * the user collide on the same key. That's why the human can't sneak
- * an edit in while the agent is writing the same file.
- */
-import { LocalFilesystem, type LocalFilesystemOptions, type CopyOptions, type FileContent, type RemoveOptions, type WriteOptions } from '@mastra/core/workspace';
-import type { AuthUser, Change, IWorkflowService } from '@bevel-software/platform-shared';
-import type { FileChangeNotifier } from './file-change-notifier.js';
-import type { ICreatorAccess } from '../access/creator-access.js';
-/**
- * Dependencies the wrapper needs to talk to the workflow lock service.
- * Captured at construction time so every per-method call resolves to the
- * same `(workspace, branch, user)` triple — the agent can't accidentally
- * target a different workspace through this filesystem.
- */
-export interface LockingFilesystemContext {
-    workflow: IWorkflowService;
-    workspaceId: string;
-    branch: string;
-    user: AuthUser;
-    /**
-     * Optional pre-disk write validator. Invoked with the (workspace-relative
-     * path, full content) of every WHOLE-FILE write BEFORE the bytes land. Throw
-     * to refuse the write — nothing hits disk and the lock is released without a
-     * commit. Used to reject a `roles.yaml` edit that would lock out admins; see
-     * `roles-yaml-guard.ts`. Whole-file writes only (`writeFile` / `writeFiles`);
-     * partial ops (`appendFile`) are not validated.
-     */
-    validateWrite?: (path: string, content: FileContent) => void;
-    /**
-     * Post-commit hook for the BATCH `writeFiles` path (which commits via
-     * `commitChanges` and so skips `runPendingCommit`'s emit). Single-file ops
-     * emit through the queue instead, so they don't need this. Optional.
-     */
-    fileChanges?: FileChangeNotifier;
-    /**
-     * Optional creator read-grant planner (see `modules/access/creator-access`).
-     * When present, a write/mkdir that CREATES a KB node the acting user can't
-     * read gets an automatic `read:` grant — seeded into a new directory's
-     * `access.md` or folded into a new markdown file's frontmatter — so the
-     * agent's creations don't vanish from the driving user's explorer under
-     * default-deny reads. Absent (tests, non-KB filesystems) → no grants.
-     */
-    creatorAccess?: ICreatorAccess;
-}
-export declare class LockingFilesystem extends LocalFilesystem {
-    private readonly lockContext;
-    constructor(options: LocalFilesystemOptions, lockContext: LockingFilesystemContext);
-    writeFile(inputPath: string, content: FileContent, options?: WriteOptions): Promise<void>;
-    appendFile(inputPath: string, content: FileContent): Promise<void>;
-    deleteFile(inputPath: string, options?: RemoveOptions): Promise<void>;
-    copyFile(src: string, dest: string, options?: CopyOptions): Promise<void>;
-    moveFile(src: string, dest: string, options?: CopyOptions): Promise<void>;
-    /**
-     * Write several files and commit them as ONE atomic change — the multi-file
-     * counterpart to `writeFile`, for the rare case where a set of files must
-     * land together or not at all (e.g. a role rename rewriting `roles.yaml` plus
-     * every reference; a partial rewrite would be a silent access drop). Where
-     * `writeFile` takes one lock cycle per file and lets the deferred queue commit
-     * it, this wraps the WHOLE batch in one cycle: acquire every path's lock up
-     * front, write every file to disk, then commit the whole set synchronously as
-     * one change via the workflow service's `commitChanges` (one `git add` + one
-     * `git commit`, then push), and release WITHOUT a per-file commit. Fail-closed:
-     * if any lock can't be acquired, or a write/commit throws, nothing is committed
-     * (the failure-path `releaseLockNoCommit` discards the uncommitted bytes).
-     * The ONE exception is `PushNeedsAgentResolutionError` — a POST-commit
-     * failure (the commit landed, the push didn't): locks release via
-     * `releaseLock` so the enqueued release commit arms the pending-commits
-     * worker's push retry, and the error still propagates to the caller.
-     *
-     * `writes[].path` is workspace-relative (like `writeFile`). We do the disk
-     * write here; `commitChanges` only stages + commits what's on disk (the git
-     * layer never writes content).
-     */
-    writeFiles(writes: {
-        path: string;
-        content: FileContent;
-    }[], summary: string, deletes?: string[]): Promise<Change | null>;
-    mkdir(inputPath: string, options?: {
-        recursive?: boolean;
-    }): Promise<void>;
-    rmdir(_inputPath: string, _options?: RemoveOptions): Promise<void>;
-    /**
-     * Land a `seed-access-md` creation-grant plan: under the access.md's own
-     * lock (single acquire+release cycle → one commit), re-read the CURRENT
-     * bytes and splice the grant into them — never a blind overwrite, so a
-     * concurrent creator's just-landed grant on the same new directory
-     * survives. Best-effort by contract: a contended lock, read, write, or
-     * release failure here logs and returns — it must never fail the creation
-     * that triggered the seed.
-     */
-    private seedAccessMd;
-    /**
-     * Plan the creator read grant for a pending creation at `inputPath`
-     * (workspace-relative, same shape every override receives). Null when no
-     * planner is wired, the path isn't a grantable KB creation, or planning
-     * fails — the grant is best-effort UX and must never block the write.
-     */
-    private planCreate;
-    /**
-     * Acquire the lock, run `op`, release. The release does the commit +
-     * push via `WorkflowService.releaseLock`. On contention we retry a few
-     * times before surfacing a structured failure — long enough to ride
-     * out a human typing a quick edit, short enough that the agent doesn't
-     * stall a whole turn waiting for someone to step away from a file.
-     */
-    private withLock;
-}
-//# sourceMappingURL=locking-filesystem.d.ts.map

package/dist/modules/workflow/locking-filesystem.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"locking-filesystem.d.ts","sourceRoot":"","sources":["../../../src/modules/workflow/locking-filesystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAE1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAOrF;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;gBAGrD,OAAO,EAAE,sBAAsB,EAC/B,WAAW,EAAE,wBAAwB;IAMxB,SAAS,CACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,IAAI,CAAC;IAiBD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBxF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CACd,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAE,EAAE,EAChD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,MAAM,EAAO,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAySV,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC1E,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;;;;;OAQG;YACW,YAAY;IA0B1B;;;;;OAKG;YACW,UAAU;IAiBxB;;;;;;OAMG;YACW,QAAQ;CAoDvB"}