@bevel-software/platform-core-backend 0.30.0 → 0.32.0

package/dist/shared/git.contract.js

@@ -148,4 +148,13 @@ export function assertOneSpecPerLine(specs) {
 export function isGitTimeout(err) {
     return err instanceof GitRunError && err.timedOut;
 }
+/**
+ * A full object id (SHA-1 or SHA-256, lowercase hex): what every at-ref
+ * access gate resolves its ref to before reading, and the one spelling the
+ * history tools accept for a commit — anything shorter or mixed-case is a
+ * name, which a fetch can move.
+ */
+export function isCommitSha(ref) {
+    return /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(ref);
+}
 //# sourceMappingURL=git.contract.js.map

package/dist/shared/git.contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.contract.js","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AA6CH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAE5C,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC9D,QAAQ,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;CAClB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAC5B,WAAoC,oBAAoB,EACxD,QAA+C,IAAI;IAEnD,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;IACxE,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACjE,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,oBAAoB;QAC9C,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAgC;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,wEAAwE;IACxE,2EAA2E;IAC3E,wCAAwC;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AA8CD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IACjD,QAAQ,CAAU;IAC3B,+DAA+D;IACtD,MAAM,CAAU;IACzB,+DAA+D;IACtD,QAAQ,CAAU;IAE3B;;;;;OAKG;IACH,YAAY,OAAe,EAAE,OAAmE,EAAE;QAChG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC;AACpD,CAAC"}
+{"version":3,"file":"git.contract.js","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AA6CH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAE5C,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC9D,QAAQ,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;CAClB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAC5B,WAAoC,oBAAoB,EACxD,QAA+C,IAAI;IAEnD,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;IACxE,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACjE,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,oBAAoB;QAC9C,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAgC;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,wEAAwE;IACxE,2EAA2E;IAC3E,wCAAwC;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AA8CD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IACjD,QAAQ,CAAU;IAC3B,+DAA+D;IACtD,MAAM,CAAU;IACzB,+DAA+D;IACtD,QAAQ,CAAU;IAE3B;;;;;OAKG;IACH,YAAY,OAAe,EAAE,OAAmE,EAAE;QAChG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC"}

package/dist/shared/listener-seam.d.ts

@@ -0,0 +1,34 @@
+import type { ILogger } from './logger.contract.js';
+/**
+ * A listener answers how it reached the people an event concerns — a
+ * non-empty channel name, `'email'` say — or null when it did not (nothing
+ * configured, nobody to tell, the send failed). It is awaited: the caller's
+ * answer says who was notified, truthfully, so a listener bounds its own
+ * wait. A throw is logged and counts as null; it never fails the caller. An
+ * empty name is no channel and counts as null too.
+ */
+export type NotifyingListener<E> = (event: E) => Promise<string | null>;
+/**
+ * The one way core runs the notification listeners a deployment registers
+ * on a seam (an account invited, a change request opened): every listener
+ * in registration order, each awaited, the channels that reached somebody
+ * collected in that order, a failure logged and counted as "did not" so the
+ * event's own effect — the account made, the request opened — stands
+ * whatever the listeners do. A seam wraps one of these per event and keeps
+ * its own typed registration method, so the rule above is written once.
+ */
+export declare class ListenerSeam<E> {
+    private readonly log;
+    private readonly failed;
+    private readonly listeners;
+    /**
+     * @param log Where a failed listener is reported.
+     * @param failed The line logged for one, said in the seam's own terms
+     *   ("an account-invited listener failed; the person was not notified by it:").
+     */
+    constructor(log: ILogger, failed: string);
+    add(listener: NotifyingListener<E>): void;
+    /** Run every listener in registration order; the channels that reached somebody, in that order. */
+    run(event: E): Promise<string[]>;
+}
+//# sourceMappingURL=listener-seam.d.ts.map

package/dist/shared/listener-seam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listener-seam.d.ts","sourceRoot":"","sources":["../../src/shared/listener-seam.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,qBAAa,YAAY,CAAC,CAAC;IASvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;IAExD;;;;OAIG;gBAEgB,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM;IAGjC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,IAAI;IAIzC,mGAAmG;IAC7F,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAYvC"}

package/dist/shared/listener-seam.js

@@ -0,0 +1,42 @@
+/**
+ * The one way core runs the notification listeners a deployment registers
+ * on a seam (an account invited, a change request opened): every listener
+ * in registration order, each awaited, the channels that reached somebody
+ * collected in that order, a failure logged and counted as "did not" so the
+ * event's own effect — the account made, the request opened — stands
+ * whatever the listeners do. A seam wraps one of these per event and keeps
+ * its own typed registration method, so the rule above is written once.
+ */
+export class ListenerSeam {
+    log;
+    failed;
+    listeners = [];
+    /**
+     * @param log Where a failed listener is reported.
+     * @param failed The line logged for one, said in the seam's own terms
+     *   ("an account-invited listener failed; the person was not notified by it:").
+     */
+    constructor(log, failed) {
+        this.log = log;
+        this.failed = failed;
+    }
+    add(listener) {
+        this.listeners.push(listener);
+    }
+    /** Run every listener in registration order; the channels that reached somebody, in that order. */
+    async run(event) {
+        const notified = [];
+        for (const listener of this.listeners) {
+            try {
+                const channel = await listener(event);
+                if (channel !== null && channel !== '')
+                    notified.push(channel);
+            }
+            catch (err) {
+                this.log.error(this.failed, { err });
+            }
+        }
+        return notified;
+    }
+}
+//# sourceMappingURL=listener-seam.js.map

package/dist/shared/listener-seam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listener-seam.js","sourceRoot":"","sources":["../../src/shared/listener-seam.ts"],"names":[],"mappings":"AAYA;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IASJ;IACA;IATF,SAAS,GAA2B,EAAE,CAAC;IAExD;;;;OAIG;IACH,YACmB,GAAY,EACZ,MAAc;QADd,QAAG,GAAH,GAAG,CAAS;QACZ,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,GAAG,CAAC,QAA8B;QAChC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,GAAG,CAAC,KAAQ;QAChB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,EAAE;oBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/shared/no-link-below.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The first folder between `base` (exclusive) and `absolute` (inclusive)
+ * that is a symbolic link, or null when none is — judged by `lstat` on each
+ * ancestor, so a path that would be followed out of `base` is named before
+ * anything reads or writes through it. ONE rule for every sink that resolves
+ * a repository path on disk: the locking filesystem's moves and the merge's
+ * conflict reads and writes.
+ */
+export declare function linkedAncestor(base: string, absolute: string): Promise<string | null>;
+//# sourceMappingURL=no-link-below.d.ts.map

package/dist/shared/no-link-below.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-link-below.d.ts","sourceRoot":"","sources":["../../src/shared/no-link-below.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiB3F"}

package/dist/shared/no-link-below.js

@@ -0,0 +1,30 @@
+import path from 'node:path';
+import { lstatOrNull } from './rename-no-replace.js';
+/**
+ * The first folder between `base` (exclusive) and `absolute` (inclusive)
+ * that is a symbolic link, or null when none is — judged by `lstat` on each
+ * ancestor, so a path that would be followed out of `base` is named before
+ * anything reads or writes through it. ONE rule for every sink that resolves
+ * a repository path on disk: the locking filesystem's moves and the merge's
+ * conflict reads and writes.
+ */
+export async function linkedAncestor(base, absolute) {
+    const root = path.resolve(base);
+    // Below `root` means past a separator after it: `/tmp/repository` is a
+    // sibling of `/tmp/repo`, not inside it, and is never walked or stat'ed. A
+    // filesystem root already ends with its separator.
+    const inside = root.endsWith(path.sep) ? root : root + path.sep;
+    let current = path.resolve(absolute);
+    const ancestors = [];
+    while (current.startsWith(inside)) {
+        ancestors.push(current);
+        current = path.dirname(current);
+    }
+    for (const ancestor of ancestors) {
+        const stat = await lstatOrNull(ancestor);
+        if (stat?.isSymbolicLink())
+            return ancestor;
+    }
+    return null;
+}
+//# sourceMappingURL=no-link-below.js.map

package/dist/shared/no-link-below.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-link-below.js","sourceRoot":"","sources":["../../src/shared/no-link-below.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,uEAAuE;IACvE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;IAChE,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,IAAI,EAAE,cAAc,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/migrations/0018_agent_events_page.sql

@@ -0,0 +1,11 @@
+-- A page's calls in the Audit log: an HTML page of the knowledge base that
+-- calls the viewer's tools is recorded under its own path (`page_path`), as a
+-- third kind of principal beside the connection key and the agent connection,
+-- and a call the viewer refused it is recorded as `refused`. Exactly one
+-- principal per row still holds, now over the three columns.
+ALTER TABLE "agent_events" DROP CONSTRAINT "agent_events_outcome";--> statement-breakpoint
+ALTER TABLE "agent_events" DROP CONSTRAINT "agent_events_principal";--> statement-breakpoint
+ALTER TABLE "agent_events" ADD COLUMN "page_path" text;--> statement-breakpoint
+CREATE INDEX "agent_events_by_page" ON "agent_events" USING btree ("user_id","page_path","at");--> statement-breakpoint
+ALTER TABLE "agent_events" ADD CONSTRAINT "agent_events_outcome" CHECK ("agent_events"."outcome" IN ('ok', 'error', 'denied', 'refused'));--> statement-breakpoint
+ALTER TABLE "agent_events" ADD CONSTRAINT "agent_events_principal" CHECK (num_nonnulls("agent_events"."key_id", "agent_events"."connection_id", "agent_events"."page_path") = 1);

package/migrations/0019_oauth_token_rotated_at.sql

@@ -0,0 +1,7 @@
+-- When a refresh of the row's refresh token minted its successor. Rotation
+-- sets it; a revoke never does, so the two are told apart: a rotated row's
+-- access token still verifies until its own expiry, and its refresh token is
+-- honoured once more within the reuse grace, while a revoked row does neither
+-- (see `exchangeRefreshToken` in bevel-oauth-provider.ts). Null on every
+-- existing row, which rotation then marks as it does any other.
+ALTER TABLE "oauth_tokens" ADD COLUMN "rotated_at" timestamp;