@bevel-software/platform-core-backend 0.31.0 → 0.33.0

package/src/modules/access/access-view.ts

@@ -14,7 +14,7 @@ import {
   KNOWN_VERBS,
   ROLE_TOKEN_PREFIX,
   type Verb,
-} from '../access-model/access-grammar.js';
+} from '../access-model/index.js';
 
 /**
  * The resolved access view of one target, as the Manage access dialog reads it

package/src/modules/access/access.routes.ts

@@ -17,15 +17,13 @@ import type {
   GrantPrincipal,
   GrantSources,
 } from './access-control.interface.js';
-import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { WorkspaceService } from '../workspace/index.js';
 import type { KbContext } from '../../shared/kb-context.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
-import type { AuthService } from '../auth/auth.service.js';
-import type { IAccountSwitchGuard } from '../auth/account-switch-guard.js';
-import type { WorkflowService } from '../workflow/workflow.service.js';
-import type { WorkflowEventBus } from '../workflow/event-bus.js';
+import type { AuthService, IAccountSwitchGuard } from '../auth/index.js';
+import type { WorkflowService, WorkflowEventBus } from '../workflow/index.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
-import { AccessDeniedError } from '../access-model/access-errors.js';
+import { AccessDeniedError } from '../access-model/index.js';
 import {
   AccessMutationService,
   AccessMutationError,
@@ -43,17 +41,17 @@ import {
   ROLE_TOKEN_PREFIX,
   type PluginTokenVerb,
   type Verb,
-} from '../access-model/access-grammar.js';
+} from '../access-model/index.js';
 import { listAccessDeclarationsUnder } from './access-declarations.js';
 import { emailsInView, holderPrincipals, labelAccountHolders, resolveAccessView } from './access-view.js';
 import type { AccessView, LabelledAccessView } from './access-view.js';
 import { toHttpError as sharedToHttpError, requireNonEmptyString as sharedRequireNonEmptyString } from './admin-route-helpers.js';
 import { RolesAdminService } from './roles-admin.service.js';
-import type { Principal } from '../access-model/access-splice.js';
-import type { Database } from '../database/connection.js';
-import { users } from '../database/schema.js';
+import type { Principal } from '../access-model/index.js';
+import type { Database } from '../database/index.js';
+import { users } from '../database/index.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
-import '../auth/auth.middleware.js';
+import '../auth/index.js';
 
 /** Verbs the share UI may grant. Verbs are independent — `download` is grantable on its own. */
 const GRANTABLE_VERBS = new Set<string>(['read', 'write', 'owner', 'download']);

package/src/modules/access/admin-locked-commit.ts

@@ -48,8 +48,9 @@
 import path from 'node:path';
 import { logger } from '../../shared/logging.js';
 
-import { LockingFilesystem, type WriteValidator } from '../kb-fs/locking-filesystem.js';
-import { PushNeedsAgentResolutionError, WorkflowDomainError } from '../../shared/domain-errors.js';
+import { type WriteValidator, LockingFilesystem } from '../kb-fs/index.js';
+import type { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { PushNeedsAgentResolutionError } from '../../shared/domain-errors.js';
 import { isAbsence } from '../../shared/fs.contract.js';
 import type { AuthUser, IWorkspaceService, IWorkflowService } from '@bevel-software/platform-shared';
 

package/src/modules/access/capability-registry.ts

@@ -18,7 +18,7 @@
  * really a group; the roles admin surface flags it with a convert action.
  */
 
-import { ADMIN_CANONICAL, canonicalRoleName } from '../access-model/access-grammar.js';
+import { ADMIN_CANONICAL, canonicalRoleName } from '../access-model/index.js';
 
 /** A capability an app surface gates on. Grow this union with the gates. */
 export type Capability =

package/src/modules/access/change-read-gate.ts

@@ -18,12 +18,10 @@ import path from 'node:path';
 import { creatableRootDirNames, type KbLayout } from '@bevel-software/platform-shared';
 import type { IFsProbe } from '../../shared/fs.contract.js';
 import type { KbContext } from '../../shared/kb-context.js';
-import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { WorkspaceService } from '../workspace/index.js';
 import type { IAccessControl } from './access-control.interface.js';
-import { AccessConfigError, AccessDeniedError } from '../access-model/access-errors.js';
-import { SYNCED_GROUPS_YAML } from '../access-model/group-files.js';
-import { toKbRelative } from '../access-model/kb-read-filter.js';
-import type { ChangeReadVerdict, ChangeTargetKind, IChangeReadGate } from '../access-model/change-gate.js';
+import { AccessConfigError, AccessDeniedError, SYNCED_GROUPS_YAML, toKbRelative } from '../access-model/index.js';
+import type { ChangeReadVerdict, ChangeTargetKind, IChangeReadGate } from '../access-model/index.js';
 
 /**
  * Whether `kbRel` (repo-relative) is, or lies inside, a folder directly under

package/src/modules/access/creator-access.ts

@@ -34,17 +34,15 @@ const log = logger('creator-access');
 
 import type { IFsProbe } from '../../shared/fs.contract.js';
 import type { KbContext } from '../../shared/kb-context.js';
-import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { WorkspaceService } from '../workspace/index.js';
 import type { IAccessControl } from './access-control.interface.js';
-import { spliceGrant, type Principal } from '../access-model/access-splice.js';
-import { isAccessMdPath } from '../access-model/access-grammar.js';
-import { toKbRelative } from '../access-model/kb-read-filter.js';
+import { spliceGrant, type Principal, isAccessMdPath, toKbRelative } from '../access-model/index.js';
 import {
   creatorPrincipal,
   type CreationGrantPlan,
   type Creator,
   type ICreatorAccess,
-} from '../access-model/creator.js';
+} from '../access-model/index.js';
 
 export class CreatorAccessService implements ICreatorAccess {
   constructor(

package/src/modules/access/directory-sync-bot.ts

@@ -3,8 +3,8 @@ import { logger } from '../../shared/logging.js';
 
 const log = logger('directory-sync');
 import type { AuthUser } from '@bevel-software/platform-shared';
-import type { Database } from '../database/connection.js';
-import { users } from '../database/core-schema.js';
+import type { Database } from '../database/index.js';
+import { users } from '../database/index.js';
 
 /**
  * Synthetic identity for the synced-groups materializer's commits: every

package/src/modules/access/groups-admin.routes.ts

@@ -1,10 +1,10 @@
 import express from 'express';
 import type { AuthUser } from '@bevel-software/platform-shared';
-import type { IAdminAccessService } from '../admin/admin.interface.js';
-import { canonicalRoleName } from '../access-model/access-grammar.js';
+import type { IAdminAccessService } from '../admin/index.js';
+import { canonicalRoleName } from '../access-model/index.js';
 import { sendError as sharedSendError, requireNonEmptyString as sharedRequireNonEmptyString } from './admin-route-helpers.js';
 import type { GroupsAdminService } from './groups-admin.service.js';
-import '../auth/auth.middleware.js'; // Express Request augmentation
+import '../auth/index.js'; // Express Request augmentation
 
 /**
  * Admin surface for GROUPS — the "who you are" half of the roles/groups

package/src/modules/access/groups-admin.service.ts

@@ -26,7 +26,7 @@
  */
 
 import { workspaceIdForBranch } from '../../shared/workspace-id.js';
-import type { WorkflowEventBus } from '../workflow/event-bus.js';
+import type { WorkflowEventBus } from '../workflow/index.js';
 import type { AuthUser, IWorkspaceService, IWorkflowService } from '@bevel-software/platform-shared';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import type { IAccessControl } from './access-control.interface.js';
@@ -34,11 +34,10 @@ import {
   GROUP_REF_PREFIX,
   canonicalRoleName,
   hasAccessFrontmatterExtension,
-} from '../access-model/access-grammar.js';
+} from '../access-model/index.js';
 import { loadActiveGroups, type GroupsHealth } from './access-control.service.js';
-import { GROUPS_YAML, SYNCED_GROUPS_YAML, validateGroupsFile } from '../access-model/group-files.js';
+import { GROUPS_YAML, SYNCED_GROUPS_YAML, validateGroupsFile, makeRolesYamlWriteValidator } from '../access-model/index.js';
 import { parseRolesModel, removeGroupRefsEverywhere, renameGroupRefs, isGroupRefMember } from './roles-edit.js';
-import { makeRolesYamlWriteValidator } from '../access-model/roles-yaml-guard.js';
 import {
   GroupsEditError,
   parseGroupsModel,

package/src/modules/access/groups-edit.ts

@@ -20,8 +20,8 @@ import {
   EMAIL_REGEX,
   GROUP_REF_PREFIX,
   RESERVED_ROLE_NAMES,
-} from '../access-model/access-grammar.js';
-import { GROUPS_YAML, parseGroupsFile, unsafeNameReason } from '../access-model/group-files.js';
+} from '../access-model/index.js';
+import { GROUPS_YAML, parseGroupsFile, unsafeNameReason } from '../access-model/index.js';
 
 /** Bad-input failure when editing groups.yaml. */
 export class GroupsEditError extends Error {

package/src/modules/access/index.ts

@@ -0,0 +1,17 @@
+/**
+ * What the access module offers the other modules: the contract of the access
+ * service — who may read, write and own what. The implementation is wired by
+ * the composition root.
+ */
+export type { IAccessControl } from './access-control.interface.js';
+// Reached by other modules; exported here so they stop importing the files.
+export type { AccessDecisionSource, AccessTargetKind } from './access-control.interface.js';
+export { accessMdPathForFolder, fileCarriesAccessRules, governingFolderOf } from './access-mutation.service.js';
+export type { AccessMutationService, IAccessMutation, TargetKind } from './access-mutation.service.js';
+export { folderTarget, rulesFileFor } from './access-requests.contract.js';
+export type { AccessRequestTarget, IAccessRequestLifecycle } from './access-requests.contract.js';
+export type { AccessRequestsService, IAccessRequests } from './access-requests.service.js';
+export { accessRoster, resolveAccessView } from './access-view.js';
+export { sendError } from './admin-route-helpers.js';
+export { DIRECTORY_SYNC_BOT_EMAIL } from './directory-sync-bot.js';
+export type { UserAccessRemovalService } from './user-access-removal.service.js';

package/src/modules/access/reference-scan.ts

@@ -31,7 +31,7 @@ import {
   isAccessMdPath,
   parseAccessEntry,
   stripComment,
-} from '../access-model/access-grammar.js';
+} from '../access-model/index.js';
 
 /**
  * Resolve the [start, end) line range that role rewrites may touch — the YAML

package/src/modules/access/roles-admin.service.ts

@@ -36,7 +36,7 @@ import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('roles.recover');
-import type { WorkflowEventBus } from '../workflow/event-bus.js';
+import type { WorkflowEventBus } from '../workflow/index.js';
 import type { AuthUser, IWorkspaceService, IWorkflowService } from '@bevel-software/platform-shared';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import type { IAccessControl } from './access-control.interface.js';
@@ -45,10 +45,9 @@ import {
   ROLE_TOKEN_PREFIX,
   canonicalRoleName,
   canonicalEmail,
-} from '../access-model/access-grammar.js';
+} from '../access-model/index.js';
 import { loadActiveGroups } from './access-control.service.js';
-import { makeRolesYamlWriteValidator } from '../access-model/roles-yaml-guard.js';
-import { renderRolesYaml } from '../access-model/render-roles-yaml.js';
+import { makeRolesYamlWriteValidator, renderRolesYaml, GROUPS_YAML, SYNCED_GROUPS_YAML, validateGroupsFile, GROUP_REF_PREFIX, RESERVED_ROLE_NAMES } from '../access-model/index.js';
 import {
   parseRolesModel,
   deleteRole as editDeleteRole,
@@ -60,7 +59,6 @@ import {
   RolesEditError,
   type EditResult,
 } from './roles-edit.js';
-import { GROUPS_YAML, SYNCED_GROUPS_YAML, validateGroupsFile } from '../access-model/group-files.js';
 import {
   GroupsEditError,
   assertSafeGroupDisplayName,
@@ -68,7 +66,6 @@ import {
   parseGroupsModel,
 } from './groups-edit.js';
 import { capabilityRoleFor, isLegacyPeopleSetRole } from './capability-registry.js';
-import { GROUP_REF_PREFIX, RESERVED_ROLE_NAMES } from '../access-model/access-grammar.js';
 import { AdminLockedCommits } from './admin-locked-commit.js';
 import { KbReferenceScanner } from './reference-scan.js';
 

package/src/modules/access/roles-edit.ts

@@ -39,7 +39,7 @@ import {
   canonicalEmail,
   EMAIL_REGEX,
   GROUP_REF_PREFIX,
-} from '../access-model/access-grammar.js';
+} from '../access-model/index.js';
 
 /** Bad-input failure when editing roles.yaml (invalid name/email, unknown role). */
 export class RolesEditError extends Error {

package/src/modules/access/synced-groups-committer.ts

@@ -3,12 +3,12 @@ import { logger } from '../../shared/logging.js';
 
 const log = logger('directory-sync');
 import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared';
-import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { WorkspaceService } from '../workspace/index.js';
 import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import type { AccessControlService } from './access-control.service.js';
-import { SYNCED_GROUPS_YAML } from '../access-model/group-files.js';
-import type { WorkflowEventBus } from '../workflow/event-bus.js';
-import { LockingFilesystem } from '../kb-fs/locking-filesystem.js';
+import { SYNCED_GROUPS_YAML } from '../access-model/index.js';
+import type { WorkflowEventBus } from '../workflow/index.js';
+import { LockingFilesystem } from '../kb-fs/index.js';
 import { PushNeedsAgentResolutionError, WorkflowDomainError } from '../../shared/domain-errors.js';
 import { isAbsence } from '../../shared/fs.contract.js';
 import type { SyncedGroupsWriterDeps } from './synced-groups-writer.js';

package/src/modules/access/synced-groups-writer.ts

@@ -4,8 +4,8 @@ import {
   canonicalEmail,
   canonicalRoleName,
   RESERVED_ROLE_NAMES,
-} from '../access-model/access-grammar.js';
-import { unsafeNameReason } from '../access-model/group-files.js';
+} from '../access-model/index.js';
+import { unsafeNameReason } from '../access-model/index.js';
 import { printable } from '../../shared/printable.js';
 
 /**

package/src/modules/access/user-access-removal.service.ts

@@ -37,7 +37,7 @@
  */
 
 import { workspaceIdForBranch } from '../../shared/workspace-id.js';
-import type { WorkflowEventBus } from '../workflow/event-bus.js';
+import type { WorkflowEventBus } from '../workflow/index.js';
 import type { AuthUser, IWorkspaceService, IWorkflowService } from '@bevel-software/platform-shared';
 import { PushNeedsAgentResolutionError, WorkflowDomainError } from '../../shared/domain-errors.js';
 import type { IAccessControl } from './access-control.interface.js';
@@ -55,11 +55,8 @@ import {
   stripComment,
   type ParsedEntry,
   type Verb,
-} from '../access-model/access-grammar.js';
-import { spliceRevoke } from '../access-model/access-splice.js';
-import { scanFrontmatter } from '../access-model/frontmatter-lines.js';
-import { GROUPS_YAML, SYNCED_GROUPS_YAML, validateGroupsFile } from '../access-model/group-files.js';
-import { makeRolesYamlWriteValidator } from '../access-model/roles-yaml-guard.js';
+} from '../access-model/index.js';
+import { spliceRevoke, scanFrontmatter, GROUPS_YAML, SYNCED_GROUPS_YAML, validateGroupsFile, makeRolesYamlWriteValidator } from '../access-model/index.js';
 import { emitRolesModel, isGroupRefMember, parseRolesModel } from './roles-edit.js';
 import { emitGroupsModel, parseGroupsModel } from './groups-edit.js';
 import { AdminLockedCommits, type LockedWrite } from './admin-locked-commit.js';

package/src/modules/access-model/index.ts

@@ -0,0 +1,29 @@
+/**
+ * The access model's public entry: what another module imports of it.
+ *
+ * The module is the grammar of `access.md` (how principals, roles, groups
+ * and verbs are spelled), the errors a refused access is reported with, the
+ * gate a change is read through, and the single-path read verdict every
+ * surface shares, so a module that must hide what a person may not read asks
+ * the same question the file routes ask. A consumer outside the module
+ * imports from here, not from the files; the files are the module's own
+ * layout and free to move. The `access` module's own files predate this
+ * entry and still import the files directly — they move here as they are
+ * touched.
+ */
+export * from './access-grammar.js';
+export * from './access-errors.js';
+export type { ChangeReadVerdict, ChangeTargetKind, IChangeReadGate } from './change-gate.js';
+export { canReadWorkspacePath } from './kb-read-filter.js';
+// Reached by other modules; exported here so they stop importing the files.
+export { AccessSpliceError, spliceGrant, spliceRevoke, validatePrincipal } from './access-splice.js';
+export type { Principal, TokenMatch } from './access-splice.js';
+export { creatorPrincipal } from './creator.js';
+export type { CreationGrantPlan, Creator, ICreatorAccess } from './creator.js';
+export { scanFrontmatter } from './frontmatter-lines.js';
+export { GROUPS_YAML, SYNCED_GROUPS_YAML, parseGroupsFile, unsafeNameReason, validateGroupsFile } from './group-files.js';
+export type { GroupsIndex } from './group-files.js';
+export { resolveReadableMap, toKbRelative } from './kb-read-filter.js';
+export { synthesizePluginPrincipals } from './plugin-principals.js';
+export { renderRolesYaml } from './render-roles-yaml.js';
+export { ROLES_YAML_BASENAME, assertRolesYamlParsable, isRolesYamlPath, makeAgentRolesYamlWriteValidator, makeRolesYamlWriteValidator } from './roles-yaml-guard.js';

package/src/modules/access-model/roles-yaml-guard.ts

@@ -25,7 +25,7 @@ import type { FileContent } from '@mastra/core/workspace';
 import { GROUP_REF_PREFIX, canonicalRoleName, parseRolesYaml, parseYamlSubset } from './access-grammar.js';
 import type { GroupsIndex } from './group-files.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
-import type { WriteValidator } from '../kb-fs/locking-filesystem.js';
+import type { WriteValidator } from '../kb-fs/index.js';
 
 /** Repo-relative basename of the roles file (it lives at the KB repo root). */
 export const ROLES_YAML_BASENAME = 'roles.yaml';

package/src/modules/admin/admin-access.routes.ts

@@ -1,6 +1,6 @@
 import express from 'express';
 import type { IAdminAccessService } from './admin.interface.js';
-import '../auth/auth.middleware.js'; // Express Request augmentation
+import '../auth/index.js'; // Express Request augmentation
 
 /**
  * The CORE slice of the admin surface: just the admin-status resolver the

package/src/modules/admin/admin-access.service.ts

@@ -1,8 +1,8 @@
-import type { IAccessControl } from '../access/access-control.interface.js';
+import type { IAccessControl } from '../access/index.js';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('admin');
-import { type WorkspaceService } from '../workspace/workspace.service.js';
+import { type WorkspaceService } from '../workspace/index.js';
 import { workspaceIdForBranch } from '../../shared/workspace-id.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
 import type { IAdminAccessService } from './admin.interface.js';

package/src/modules/admin/index.ts

@@ -0,0 +1,7 @@
+/**
+ * What the admin module offers the other modules: the contract of the
+ * deployment admin check — a person is an admin iff they hold the `Admin`
+ * role in the knowledge base's `roles.yaml`. Routes that gate on it take the
+ * contract; the implementation is wired by the composition root.
+ */
+export type { IAdminAccessService } from './admin.interface.js';

package/src/modules/agent-guide/__tests__/agent-guide.test.ts

@@ -387,6 +387,11 @@ describe('the HTML views section', () => {
     }
     expect(text).toContain('`window.bevel.tools` is `null` wherever tools are not available');
     expect(text).toContain('Check it before every use');
+    // The skill page answers a page's tools as the file page does
+    // (htmlToolBridge.ts's host list): the guide says so, and never that a
+    // skill page leaves `tools` null.
+    expect(text).toContain("on the app's file page and on a skill's page");
+    expect(text).not.toMatch(/on a skill page and in any preview/);
     expect(text).toContain('**Reading runs at once; writing asks first.**');
     expect(text).toContain('"<page name> wants to write to the knowledge base"');
     expect(text).toContain('Allow while open and Deny');

package/src/modules/agent-guide/agent-guide.tools.ts

@@ -1,10 +1,8 @@
 import type { Router, RequestHandler } from 'express';
-import type { IToolRegistry, UtcpTool } from '../tool-registry/tool.contract.js';
-import { GET_AGENT_GUIDE_TOOL } from '../tool-registry/guide-first.js';
-import { TOOL_DESCRIPTION_CAP } from '../tool-registry/description-length.js';
-import { ToolError } from '../tool-helpers/tool.contract.js';
-import { toolDef } from '../tool-helpers/tool-def.js';
-import type { ToolHandlerFactory } from '../tool-helpers/tool-handler.js';
+import type { IToolRegistry, UtcpTool } from '../tool-registry/index.js';
+import { GET_AGENT_GUIDE_TOOL, TOOL_DESCRIPTION_CAP } from '../tool-registry/index.js';
+import { ToolError, toolDef } from '../tool-helpers/index.js';
+import type { ToolHandlerFactory } from '../tool-helpers/index.js';
 import { AGENT_GUIDE_FILE, joinGuideSections, type AgentGuideSectionsReader } from './agent-guide.js';
 
 export { GET_AGENT_GUIDE_TOOL };

package/src/modules/agent-guide/agent-guide.ts

@@ -35,7 +35,7 @@ import {
   type KbLayout,
 } from '@bevel-software/platform-shared';
 import { agentGuideDir } from '../../assets.js';
-import { sharedFileRulesSection } from '../agent-instructions/shared-file-rules.js';
+import { sharedFileRulesSection } from '../agent-instructions/index.js';
 
 /** One section of the guide. */
 export interface AgentGuideSection {

package/src/modules/agent-guide/index.ts

@@ -19,4 +19,4 @@ export {
   type RenderedGuideSection,
 } from './agent-guide.js';
 export { GET_AGENT_GUIDE_TOOL, registerAgentGuideTool } from './agent-guide.tools.js';
-export { GUIDE_FIRST_SENTENCE, withGuideFirst } from '../tool-registry/guide-first.js';
+export { GUIDE_FIRST_SENTENCE, withGuideFirst } from '../tool-registry/index.js';

package/src/modules/agent-instructions/read-preamble.ts

@@ -2,7 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { KbContext } from '../../shared/kb-context.js';
 import { isAbsence, type IFsProbe } from '../../shared/fs.contract.js';
-import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { WorkspaceService } from '../workspace/index.js';
 import { PREAMBLE_FILE } from './compose.js';
 
 /** The one reader both the hosted proxy and the agent-facing route call. */

package/src/modules/audit/agent-audit.service.ts

@@ -1,8 +1,8 @@
 import { and, count, desc, eq, isNotNull, isNull, lt, max, min, or, type SQL } from 'drizzle-orm';
 import { logger } from '../../shared/logging.js';
-import type { Database } from '../database/connection.js';
-import { agentConnections, agentEvents, externalApiKeys, oauthTokens, users } from '../database/schema.js';
-import type { IExternalApiKeyService } from '../tool-auth/external-api-key.interface.js';
+import type { Database } from '../database/index.js';
+import { agentConnections, agentEvents, externalApiKeys, oauthTokens, users } from '../database/index.js';
+import type { IExternalApiKeyService } from '../tool-auth/index.js';
 import {
   AuditPrincipalNotFoundError,
   InvalidCursorError,

package/src/modules/audit/agent-connection.routes.ts

@@ -1,7 +1,7 @@
 import express from 'express';
 import { logger } from '../../shared/logging.js';
 import type { IAgentConnectionStatus } from './audit.contract.js';
-import '../auth/auth.middleware.js'; // Express Request augmentation (req.userId)
+import '../auth/index.js'; // Express Request augmentation (req.userId)
 
 const log = logger('audit');
 

package/src/modules/audit/agent-rest-audit.middleware.ts

@@ -2,7 +2,7 @@ import type { RequestHandler } from 'express';
 import { logger } from '../../shared/logging.js';
 import type { IAgentEventRecorder } from './audit.contract.js';
 import { classifyToolCall, skillReadPath, type SkillFolder } from './event-classifier.js';
-import '../tool-auth/tool-auth.middleware.js'; // Express Request augmentation (req.toolAuth)
+import '../tool-auth/index.js'; // Express Request augmentation (req.toolAuth)
 
 const log = logger('audit');
 

package/src/modules/audit/audit.routes.ts

@@ -1,8 +1,8 @@
 import express from 'express';
 import { logger } from '../../shared/logging.js';
-import type { IAdminAccessService } from '../admin/admin.interface.js';
-import { TokenNotFoundError } from '../tool-auth/external-api-key.errors.js';
-import type { IExternalApiKeyService } from '../tool-auth/external-api-key.interface.js';
+import type { IAdminAccessService } from '../admin/index.js';
+import { TokenNotFoundError } from '../tool-auth/index.js';
+import type { IExternalApiKeyService } from '../tool-auth/index.js';
 import {
   AuditPrincipalNotFoundError,
   InvalidCursorError,
@@ -12,7 +12,7 @@ import {
   type IAgentAuditService,
 } from './audit.contract.js';
 import { MAX_EVENT_PAGE } from './agent-audit.service.js';
-import '../auth/auth.middleware.js'; // Express Request augmentation (req.userId / req.userEmail)
+import '../auth/index.js'; // Express Request augmentation (req.userId / req.userEmail)
 
 const log = logger('audit');
 

package/src/modules/auth/__tests__/account-deactivation.test.ts

@@ -25,10 +25,17 @@ import { RECOVERY_BOT_EMAIL } from '../../workflow/recovery-bot.js';
  * shows up as `db:`.
  */
 function makeFakeDb(queue: unknown[]) {
-  const captured: { values: Record<string, unknown>[]; set: Record<string, unknown>[]; order: string[] } = {
+  const captured: {
+    values: Record<string, unknown>[];
+    set: Record<string, unknown>[];
+    order: string[];
+    /** Every `where` predicate, rendered to the SQL it would send. */
+    where: { sql: string; params: unknown[] }[];
+  } = {
     values: [],
     set: [],
     order: [],
+    where: [],
   };
   const dialect = new PgDialect();
   function nextChain(): unknown {
@@ -42,7 +49,10 @@ function makeFakeDb(queue: unknown[]) {
     Object.assign(chain, {
       values: passthrough((a) => captured.values.push(a)),
       set: passthrough((a) => captured.set.push(a)),
-      where: passthrough(),
+      where: passthrough((a) => {
+        const { sql, params } = dialect.sqlToQuery(a as unknown as SQL);
+        captured.where.push({ sql, params });
+      }),
       limit: passthrough(),
       from: passthrough(),
       orderBy: passthrough(),
@@ -124,6 +134,32 @@ describe('signing in with a switched-off account', () => {
   });
 });
 
+describe('the accounts a change request\'s approvers resolve to', () => {
+  it('are read in one indexed query through the email blind index, live accounts only, keyed by canonical address', async () => {
+    const { db, captured } = makeFakeDb([[{ id: 'user-1', email: 'Alice@Example.com', name: 'Alice' }]]);
+    const svc = new AuthService(db, makeConfig());
+    const found = await svc.findActiveAccountsByEmail(['ALICE@example.com', 'alice@example.com', 'bob@example.com']);
+    // One read, by the blind index, with the addresses canonicalised and
+    // deduplicated, and a switched-off account excluded in the query itself.
+    expect((db as unknown as { select: ReturnType<typeof vi.fn> }).select).toHaveBeenCalledTimes(1);
+    expect(captured.where).toHaveLength(1);
+    expect(captured.where[0]!.sql).toMatch(/"users"."email_bidx" in \(\$1, \$2\) and "users"."deactivated_at" is null/);
+    // The blind-index column hashes each address with the handle's key as
+    // the query is sent; what was asked for is the canonical plain address.
+    expect(captured.where[0]!.params.map((p) => (p as { plain: string }).plain)).toEqual(['alice@example.com', 'bob@example.com']);
+    // Keyed by the canonical address, whatever spelling the row holds.
+    expect([...found.keys()]).toEqual(['alice@example.com']);
+    expect(found.get('alice@example.com')).toEqual({ id: 'user-1', email: 'Alice@Example.com', name: 'Alice' });
+  });
+
+  it('asks nothing for no addresses', async () => {
+    const { db } = makeFakeDb([]);
+    const svc = new AuthService(db, makeConfig());
+    expect(await svc.findActiveAccountsByEmail([])).toEqual(new Map());
+    expect((db as unknown as { select: ReturnType<typeof vi.fn> }).select).not.toHaveBeenCalled();
+  });
+});
+
 describe('a session that outlives a deactivation', () => {
   it('stops being accepted once the account is switched off', async () => {
     const { db } = makeFakeDb([[ROW], [{ deactivatedAt: new Date() }]]);

package/src/modules/auth/account-erasure.service.ts

@@ -4,8 +4,8 @@ import { logger } from '../../shared/logging.js';
 const log = logger('account-erasure');
 import { and, eq, notExists } from 'drizzle-orm';
 import { isEncryptedBlob } from '../../shared/column-crypto.js';
-import type { Database } from '../database/connection.js';
-import type { IReviewWorkflowService } from '../workflow/review-workflow/review-workflow.interface.js';
+import type { Database } from '../database/index.js';
+import type { IReviewWorkflowService } from '../workflow/index.js';
 import {
   changeRequests,
   externalApiKeys,
@@ -14,11 +14,10 @@ import {
   oauthTokens,
   pendingCommits,
   pluginJoinRequests,
-  prComments,
   prFileApprovals,
   prMergeLog,
   users,
-} from '../database/schema.js';
+} from '../database/index.js';
 
 /** The anonymised id of one erasure — how a commit or log may name the account. */
 export function erasedAccountId(erasureId: string): string {
@@ -88,7 +87,7 @@ export interface IErasureParticipant {
  *    CASCADE (account links, watchlist sources/findings, connector configs,
  *    vault secrets); deleting a connection key cascades its usage metering.
  *  - Audit rows that must survive for the review trail (approvals, merge log,
- *    review comments, change requests, queued commits — and, via participants,
+ *    change requests, queued commits — and, via participants,
  *    e.g. routine authorship) are kept but ANONYMIZED with the per-erasure
  *    placeholder identity.
  *
@@ -225,10 +224,6 @@ export class AccountErasureService implements IAccountErasureService {
         .update(prMergeLog)
         .set({ triggeredByEmail: target.erasedEmail, triggeredByEmailBidx: erasedBidx, triggeredByName: target.erasedName })
         .where(eq(prMergeLog.triggeredByEmailBidx, emailBidx));
-      await tx
-        .update(prComments)
-        .set({ authorEmail: target.erasedEmail, authorEmailBidx: erasedBidx, authorName: target.erasedName })
-        .where(eq(prComments.authorEmailBidx, emailBidx));
       await tx
         .update(changeRequests)
         .set({ authorEmail: target.erasedEmail, authorEmailBidx: erasedBidx, authorName: target.erasedName })