@bevel-software/platform-core-backend 0.32.0 → 0.34.0

package/dist/modules/workspace/workspace-tmp.d.ts

@@ -0,0 +1,146 @@
+import { type Stats } from 'node:fs';
+import { type ITreeWalker } from '../../shared/fs.contract.js';
+/**
+ * A workspace's `tmp/` folder, reached through a reserved ref.
+ *
+ * Every workspace directory holds its checkout and, beside it, a `tmp/`
+ * folder: the chat stages attachments there, the SharePoint reader stages
+ * documents there, and nothing in it is ever committed. The file tools place
+ * every path under the checkout (see `kb-fs/repo-path.ts`), so the folder is
+ * named by a REF instead — `__tmp__/<path>` — which `read_file`, `file_stat`,
+ * `grep` and `copy_file` (as its source) accept beside a repository path, and
+ * every other tool refuses (`kb-fs/tmp-ref.ts`, the one admission gate every
+ * tool's path inputs pass). A plain `tmp/…` path is not that ref and never
+ * will be: `tmp` is a legal folder name inside a repository, and the
+ * normaliser's rule is what keeps every other path in it.
+ *
+ * The ref is scoped twice. To the WORKSPACE: it is resolved against the
+ * workspace of the branch the call names, exactly like a repository path. And
+ * to the CALLER: what a person stages lands under their own folder,
+ * `tmp/<owner id>/` ({@link stageTmpRef}, the one way in), and a ref resolves
+ * inside the caller's own folder and nowhere else ({@link resolveTmpRef}). A
+ * file somebody else staged is therefore not there — the plain not-found,
+ * the same answer as for a file that never existed — rather than something an
+ * access rule has to refuse: the folder is outside the repository, where no
+ * `access.md` governs anything, and the only person a staged attachment is
+ * for is the one who attached it. The ref names ONE file — no folder, no
+ * listing — and nothing outside the caller's folder is reachable through it,
+ * links included. Every resolution goes through {@link resolveTmpRef}; there
+ * is no second reader of the folder.
+ *
+ * Entries live for {@link TMP_MAX_AGE_MS} after their last modification, then
+ * the platform's periodic sweep removes them ({@link sweepTmpFolder},
+ * scheduled by {@link TmpSweeper}) — or sooner, when a distribution clears a
+ * workspace's whole `tmp/` after a run of its own (`clearTmp`): "up to seven
+ * days" is the promise, not "seven days".
+ */
+/** The folder the ref reaches, beside the checkout in every workspace directory. */
+export declare const WORKSPACE_TMP_DIR = "tmp";
+/** How long an entry of a `tmp/` folder lives after its last modification: seven days. */
+export declare const TMP_MAX_AGE_MS: number;
+/** How often the platform sweeps every workspace's `tmp/` folder: hourly. */
+export declare const TMP_SWEEP_INTERVAL_MS: number;
+/**
+ * THE resolution of a ref, against one owner's folder in one workspace
+ * directory: the file's absolute path and its stat, or a refusal. Every read
+ * of the folder starts here.
+ *
+ * - The lexical rules first ({@link tmpRefSegments}), before the disk is
+ *   asked anything.
+ * - Nothing there — the owner's folder included, which a person who has
+ *   staged nothing does not have — is a {@link PathNotFoundError} naming the
+ *   REF, never the path on disk: the answer every file tool turns into its
+ *   ordinary 404. What another person staged is "nothing there" too. Every
+ *   other failure names the ref alone as well ({@link tmpRefFailure}).
+ * - The file's REAL path must lie inside the owner's folder's real path, so a
+ *   link — anywhere along the ref — that leads out of it (into another
+ *   owner's folder included) is refused rather than followed. A link that
+ *   stays inside is the file it points at.
+ * - A folder is refused by the rule, never listed.
+ */
+export declare function resolveTmpRef(workspaceDir: string, ownerId: string, ref: string): Promise<{
+    absolutePath: string;
+    stat: Stats;
+}>;
+/** The bytes of the one file a ref names in `ownerId`'s folder of `workspaceDir`'s tmp (see {@link resolveTmpRef}). */
+export declare function readTmpRef(workspaceDir: string, ownerId: string, ref: string): Promise<Buffer>;
+/** What `file_stat` reports about a staged file: the fields a repository file's stat carries. */
+export interface TmpFileStat {
+    /** The file's own name, the last segment of the ref. */
+    name: string;
+    size: number;
+    createdAt: Date;
+    modifiedAt: Date;
+}
+/** The stat of the one file a ref names (see {@link resolveTmpRef}). */
+export declare function statTmpRef(workspaceDir: string, ownerId: string, ref: string): Promise<TmpFileStat>;
+/**
+ * Stage `bytes` at `relativePath` in `ownerId`'s folder of `workspaceDir`'s
+ * tmp, and answer the ref the owner reads it back with: the ONE way a file
+ * gets into the folder the ref reaches, so the convention — one folder per
+ * owner, the file's path inside it — is this function's and no stager's.
+ * `relativePath` obeys a ref's own rules (one file, no `..`, no absolute
+ * path, no backslash, no control character); the refusal names the rule.
+ * Replaces the FILE at the path: a staged file is the stager's own scratch,
+ * and the chat names uploads by their content. Never writes through a link:
+ * not one standing where `tmp/` or the owner's folder should be, not one on
+ * the way, and not one at the file's own name (judged by `lstat`, which is
+ * what every platform has; the check and the write are two steps, as they
+ * are everywhere else in this file).
+ */
+export declare function stageTmpRef(workspaceDir: string, ownerId: string, relativePath: string, bytes: Uint8Array): Promise<string>;
+/**
+ * Remove every file of one `tmp/` folder, at any depth, whose last
+ * modification is older than `maxAgeMs`, and every folder in it that the
+ * sweep leaves empty and that was itself older than that before the sweep
+ * touched it. Judged per FILE, because the stagers keep a long-lived folder
+ * each (`chat-uploads/`, …) whose own mtime moves with every new upload: a
+ * folder judged as a whole would keep an old file for as long as anyone kept
+ * uploading beside it. Everything is judged by its own `lstat`, and a link is
+ * removed as the link, never followed. The `tmp/` folder itself stays. A
+ * folder that is not there is nothing to sweep. Returns the paths removed,
+ * relative to `tmp/`.
+ *
+ * The tree is read by THE walk (`walker`, see `shared/fs.contract.ts`), not a
+ * loop of its own: its files, its other entries (a link, a socket — never
+ * entered) and its folders are collected, each folder's age read as it is
+ * listed, so before anything in it goes. A folder that cannot be listed is
+ * the walk's hole: logged, and walked around. The removals follow the walk —
+ * the entries first, then the folders deepest first, so a folder emptied by
+ * the sweep is judged after its contents.
+ *
+ * `signal` ends the sweep early: once it is aborted the walk stops listing
+ * and nothing more is removed — it is asked again right before each removal,
+ * after every awaited look — and what is already gone is returned.
+ */
+export declare function sweepTmpFolder(walker: ITreeWalker, workspaceDir: string, maxAgeMs: number, now: number, signal?: AbortSignal): Promise<string[]>;
+/**
+ * The periodic sweep of every workspace's `tmp/` folder, on a timer.
+ *
+ * Started with the graph (`startCore`) and stopped with it (`stopCore`):
+ * stopping clears the timer and CANCELS the sweep in flight — its signal is
+ * aborted, so it removes nothing more and ends at the next entry it would
+ * have looked at — and `drainSweep` waits for it to end. `stopCore` bounds
+ * that wait by its own deadline, like every other drain there: a sweep stuck
+ * inside one filesystem call (a hung mount) can outlive the wait, but it
+ * removes nothing once that call returns. The first sweep runs at start, not
+ * one interval later, so what a previous process left past its age goes
+ * without waiting. The timer is `unref`'d: nothing here is worth keeping a
+ * process alive for.
+ */
+export declare class TmpSweeper {
+    private readonly sweep;
+    private timer;
+    private sweeping;
+    private stop;
+    constructor(sweep: (signal: AbortSignal) => Promise<unknown>);
+    /** Sweep now, and every `intervalMs` after. Idempotent. */
+    startSweeping(intervalMs?: number): void;
+    /** Clear the timer and cancel the sweep in flight; {@link drainSweep} waits for it to end. */
+    stopSweeping(): void;
+    /** Wait for the sweep in flight, if any, to end. */
+    drainSweep(): Promise<void>;
+    /** One sweep, unless one is still running; its failure is logged. */
+    private tick;
+}
+//# sourceMappingURL=workspace-tmp.d.ts.map

package/dist/modules/workspace/workspace-tmp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-tmp.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspace-tmp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAMrD,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAM1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,0FAA0F;AAC1F,eAAO,MAAM,cAAc,QAA0B,CAAC;AAEtD,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AAiGpD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CA8BhD;AAED,uHAAuH;AACvH,wBAAsB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOpG;AAED,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,wEAAwE;AACxE,wBAAsB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAGzG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BjI;AA2BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAqEnB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,UAAU;IAKT,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJlC,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,IAAI,CAAgC;gBAEf,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC;IAE7E,2DAA2D;IAC3D,aAAa,CAAC,UAAU,GAAE,MAA8B,GAAG,IAAI;IAQ/D,8FAA8F;IAC9F,YAAY,IAAI,IAAI;IAOpB,oDAAoD;IAC9C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,qEAAqE;IACrE,OAAO,CAAC,IAAI;CAUb"}

package/dist/modules/workspace/workspace-tmp.js

@@ -0,0 +1,435 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { PathNotFoundError, WorkflowDomainError, WorkflowValidationError } from '../../shared/domain-errors.js';
+import { assertWithinDirectory } from '../../shared/path-containment.js';
+import { sanitizedPath } from '../../shared/printable.js';
+import { hasControlCharacter, TMP_REF_PREFIX } from '../kb-fs/index.js';
+import { isAbsence } from '../../shared/fs.contract.js';
+import { logger } from '../../shared/logging.js';
+import { lstatOrNull } from '../../shared/rename-no-replace.js';
+const log = logger('workspace-tmp');
+/**
+ * A workspace's `tmp/` folder, reached through a reserved ref.
+ *
+ * Every workspace directory holds its checkout and, beside it, a `tmp/`
+ * folder: the chat stages attachments there, the SharePoint reader stages
+ * documents there, and nothing in it is ever committed. The file tools place
+ * every path under the checkout (see `kb-fs/repo-path.ts`), so the folder is
+ * named by a REF instead — `__tmp__/<path>` — which `read_file`, `file_stat`,
+ * `grep` and `copy_file` (as its source) accept beside a repository path, and
+ * every other tool refuses (`kb-fs/tmp-ref.ts`, the one admission gate every
+ * tool's path inputs pass). A plain `tmp/…` path is not that ref and never
+ * will be: `tmp` is a legal folder name inside a repository, and the
+ * normaliser's rule is what keeps every other path in it.
+ *
+ * The ref is scoped twice. To the WORKSPACE: it is resolved against the
+ * workspace of the branch the call names, exactly like a repository path. And
+ * to the CALLER: what a person stages lands under their own folder,
+ * `tmp/<owner id>/` ({@link stageTmpRef}, the one way in), and a ref resolves
+ * inside the caller's own folder and nowhere else ({@link resolveTmpRef}). A
+ * file somebody else staged is therefore not there — the plain not-found,
+ * the same answer as for a file that never existed — rather than something an
+ * access rule has to refuse: the folder is outside the repository, where no
+ * `access.md` governs anything, and the only person a staged attachment is
+ * for is the one who attached it. The ref names ONE file — no folder, no
+ * listing — and nothing outside the caller's folder is reachable through it,
+ * links included. Every resolution goes through {@link resolveTmpRef}; there
+ * is no second reader of the folder.
+ *
+ * Entries live for {@link TMP_MAX_AGE_MS} after their last modification, then
+ * the platform's periodic sweep removes them ({@link sweepTmpFolder},
+ * scheduled by {@link TmpSweeper}) — or sooner, when a distribution clears a
+ * workspace's whole `tmp/` after a run of its own (`clearTmp`): "up to seven
+ * days" is the promise, not "seven days".
+ */
+/** The folder the ref reaches, beside the checkout in every workspace directory. */
+export const WORKSPACE_TMP_DIR = 'tmp';
+/** How long an entry of a `tmp/` folder lives after its last modification: seven days. */
+export const TMP_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+/** How often the platform sweeps every workspace's `tmp/` folder: hourly. */
+export const TMP_SWEEP_INTERVAL_MS = 60 * 60 * 1000;
+/** A ref that breaks one of the rules, with the rule named. */
+function invalidRef(ref, rule) {
+    const shown = sanitizedPath(ref);
+    return new WorkflowValidationError(`"${shown}" is not a valid tmp ref: ${rule}`, { kind: 'tmp-ref-invalid', path: shown });
+}
+/**
+ * The folder of one owner inside a workspace's `tmp/`: `tmp/<owner id>/`.
+ * The id is an account id, which the platform mints and which is one path
+ * segment by construction; one that is not — empty, a separator in it, a
+ * `.`/`..`, a control character — is a programming error, never a file to
+ * look for, and is refused as one.
+ */
+function ownerFolder(workspaceDir, ownerId) {
+    if (ownerId === '' ||
+        ownerId === '.' ||
+        ownerId === '..' ||
+        ownerId.includes('/') ||
+        ownerId.includes('\\') ||
+        hasControlCharacter(ownerId) ||
+        ownerId.length > 255) {
+        throw new Error(`Invalid tmp owner id "${sanitizedPath(ownerId)}": an owner's tmp folder is one path segment.`);
+    }
+    return path.join(workspaceDir, WORKSPACE_TMP_DIR, ownerId);
+}
+/**
+ * What a failed look at the folder answers, naming the REF and never the path
+ * on disk — the raw error (which carries that path) is the server log's, not
+ * the caller's: nothing there is the ordinary not-found; a loop of links is
+ * refused by the link rule; anything else (a permission, an I/O error) is a
+ * 500 that says the ref could not be read.
+ */
+function tmpRefFailure(ref, err) {
+    if (isAbsence(err))
+        return new PathNotFoundError(ref);
+    const shown = sanitizedPath(ref);
+    const code = err?.code;
+    if (code === 'ELOOP') {
+        return invalidRef(ref, 'it goes through a link that cannot be followed (a link that leads back to itself).');
+    }
+    log.warn('could not read a tmp ref:', { err, ref: shown });
+    return new WorkflowDomainError(`"${shown}" could not be read from the workspace's tmp folder.`, 500, {
+        kind: 'tmp-ref-unreadable',
+        path: shown,
+    });
+}
+/**
+ * The ref's path inside the `tmp/` folder, as segments — or the refusal that
+ * names the rule it breaks. Lexical only: the folder and link rules need the
+ * disk and are {@link resolveTmpRef}'s.
+ */
+function tmpRefSegments(ref) {
+    const rest = ref.startsWith(TMP_REF_PREFIX) ? ref.slice(TMP_REF_PREFIX.length) : '';
+    // First, because the refusal below would otherwise quote the character
+    // that forges a second line — and a line break is a separator to git and
+    // to every line-oriented log this ref may reach.
+    if (hasControlCharacter(ref)) {
+        throw invalidRef(ref, 'it contains a control character (a line break, a NUL or another invisible byte), which is part of no file name.');
+    }
+    if (rest === '') {
+        throw invalidRef(ref, `it names the tmp folder itself. A tmp ref names one file: \`${TMP_REF_PREFIX}<path to the file>\`.`);
+    }
+    if (rest.startsWith('/') || /^[A-Za-z]:/.test(rest)) {
+        throw invalidRef(ref, 'the path after the prefix is absolute. It is a path inside the workspace\'s tmp folder, written without a leading slash.');
+    }
+    if (rest.includes('\\')) {
+        throw invalidRef(ref, 'it contains a backslash. Separate folders with `/`.');
+    }
+    if (rest.endsWith('/')) {
+        throw invalidRef(ref, 'it ends with `/`, which names a folder. A tmp ref names one file; the tmp folder is not listed.');
+    }
+    const segments = rest.split('/');
+    if (segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        throw invalidRef(ref, 'it contains a `.` or `..` segment (or an empty one). A tmp ref names one file inside the workspace\'s tmp folder and cannot climb out of it.');
+    }
+    return segments;
+}
+/**
+ * `folder` is absent, or a real directory — never a link, never a file. The
+ * `tmp/` folder and an owner's folder are judged by this before anything
+ * resolves or lands under them: a link standing in either place would carry
+ * the whole folder somewhere else, and a real-path containment check judged
+ * against the link's target would not notice.
+ */
+async function assertOwnFolder(folder, ref, failed) {
+    const stat = await lstatOrNull(folder).catch(failed);
+    if (stat !== null && !stat.isDirectory()) {
+        throw invalidRef(ref, "its tmp folder is not a folder of this workspace's own (a link or a file stands where it should be).");
+    }
+}
+/**
+ * THE resolution of a ref, against one owner's folder in one workspace
+ * directory: the file's absolute path and its stat, or a refusal. Every read
+ * of the folder starts here.
+ *
+ * - The lexical rules first ({@link tmpRefSegments}), before the disk is
+ *   asked anything.
+ * - Nothing there — the owner's folder included, which a person who has
+ *   staged nothing does not have — is a {@link PathNotFoundError} naming the
+ *   REF, never the path on disk: the answer every file tool turns into its
+ *   ordinary 404. What another person staged is "nothing there" too. Every
+ *   other failure names the ref alone as well ({@link tmpRefFailure}).
+ * - The file's REAL path must lie inside the owner's folder's real path, so a
+ *   link — anywhere along the ref — that leads out of it (into another
+ *   owner's folder included) is refused rather than followed. A link that
+ *   stays inside is the file it points at.
+ * - A folder is refused by the rule, never listed.
+ */
+export async function resolveTmpRef(workspaceDir, ownerId, ref) {
+    const segments = tmpRefSegments(ref);
+    const ownerDir = ownerFolder(workspaceDir, ownerId);
+    const absent = (err) => {
+        throw tmpRefFailure(ref, err);
+    };
+    // `tmp/` and the owner's folder must BE folders of this workspace, not
+    // links to ones somewhere else: the containment below is judged against
+    // the owner's folder's real path, which a link would move along with it.
+    await assertOwnFolder(path.join(workspaceDir, WORKSPACE_TMP_DIR), ref, absent);
+    await assertOwnFolder(ownerDir, ref, absent);
+    if ((await lstatOrNull(ownerDir).catch(absent)) === null)
+        throw new PathNotFoundError(ref);
+    const realOwnerDir = await fs.realpath(ownerDir).catch(absent);
+    const real = await fs.realpath(path.join(ownerDir, ...segments)).catch(absent);
+    // THE containment check (shared/path-containment.ts), on the real paths;
+    // its refusal is answered as the link rule, naming the ref. The folder
+    // itself passes it, and is refused below as a folder.
+    try {
+        assertWithinDirectory(real, realOwnerDir);
+    }
+    catch {
+        throw invalidRef(ref, 'it goes through a link that leads out of your tmp folder, and links out of it are never followed.');
+    }
+    const stat = await fs.stat(real).catch(absent);
+    if (stat.isDirectory()) {
+        throw invalidRef(ref, 'it names a folder. A tmp ref names one file; the tmp folder is not listed.');
+    }
+    if (!stat.isFile()) {
+        throw invalidRef(ref, 'it names something that is not a file.');
+    }
+    return { absolutePath: real, stat };
+}
+/** The bytes of the one file a ref names in `ownerId`'s folder of `workspaceDir`'s tmp (see {@link resolveTmpRef}). */
+export async function readTmpRef(workspaceDir, ownerId, ref) {
+    const { absolutePath } = await resolveTmpRef(workspaceDir, ownerId, ref);
+    return fs.readFile(absolutePath).catch((err) => {
+        // Swept or replaced between the resolve and the read: the same answer a
+        // moment later would give, still naming the ref.
+        throw tmpRefFailure(ref, err);
+    });
+}
+/** The stat of the one file a ref names (see {@link resolveTmpRef}). */
+export async function statTmpRef(workspaceDir, ownerId, ref) {
+    const { stat } = await resolveTmpRef(workspaceDir, ownerId, ref);
+    return { name: ref.slice(ref.lastIndexOf('/') + 1), size: stat.size, createdAt: stat.birthtime, modifiedAt: stat.mtime };
+}
+/**
+ * Stage `bytes` at `relativePath` in `ownerId`'s folder of `workspaceDir`'s
+ * tmp, and answer the ref the owner reads it back with: the ONE way a file
+ * gets into the folder the ref reaches, so the convention — one folder per
+ * owner, the file's path inside it — is this function's and no stager's.
+ * `relativePath` obeys a ref's own rules (one file, no `..`, no absolute
+ * path, no backslash, no control character); the refusal names the rule.
+ * Replaces the FILE at the path: a staged file is the stager's own scratch,
+ * and the chat names uploads by their content. Never writes through a link:
+ * not one standing where `tmp/` or the owner's folder should be, not one on
+ * the way, and not one at the file's own name (judged by `lstat`, which is
+ * what every platform has; the check and the write are two steps, as they
+ * are everywhere else in this file).
+ */
+export async function stageTmpRef(workspaceDir, ownerId, relativePath, bytes) {
+    const ref = TMP_REF_PREFIX + relativePath;
+    const segments = tmpRefSegments(ref);
+    const ownerDir = ownerFolder(workspaceDir, ownerId);
+    const rethrow = (err) => {
+        throw err;
+    };
+    await assertOwnFolder(path.join(workspaceDir, WORKSPACE_TMP_DIR), ref, rethrow);
+    await assertOwnFolder(ownerDir, ref, rethrow);
+    // The workspace directory itself may not exist yet: a staged file belongs
+    // beside the checkout whether or not the branch is cloned, and the
+    // directory's path is the root's own (`workspaceDirWithinRoot`), nothing
+    // the ref names — so it is simply made.
+    await fs.mkdir(workspaceDir, { recursive: true });
+    // The folders on the way — `tmp/` and the owner's folder included, when a
+    // first staging has yet to make them — made one at a time and each judged
+    // before the next is entered: never through a link, which a recursive
+    // mkdir would follow, creating folders wherever the link leads before
+    // anything could refuse it. The one rule for the whole path, the folders
+    // already there included.
+    await makeFoldersWithin(workspaceDir, [WORKSPACE_TMP_DIR, ownerId, ...segments.slice(0, -1)], ref);
+    const target = path.join(ownerDir, ...segments);
+    // The name itself: a file to replace, nothing yet, or something that is
+    // neither — a link (which a write would follow) or a folder — refused.
+    const standing = await lstatOrNull(target);
+    if (standing !== null && !standing.isFile()) {
+        throw invalidRef(ref, 'it names something that is not a file.');
+    }
+    await fs.writeFile(target, bytes);
+    return ref;
+}
+/**
+ * The folders of `segments` under `base`, each one entered only once it is
+ * known to be a real directory of the owner's folder: a missing one is made
+ * (and judged again, since another stage may have made it meanwhile), and a
+ * link or a file standing in its place is refused as the link rule — before
+ * any folder is made beyond it, so a link on the way creates nothing where it
+ * leads. `lstat`, as everywhere in this file, so a link is seen as a link.
+ */
+async function makeFoldersWithin(base, segments, ref) {
+    let at = base;
+    for (const segment of segments) {
+        at = path.join(at, segment);
+        let standing = await lstatOrNull(at);
+        if (standing === null) {
+            await fs.mkdir(at).catch((err) => {
+                if (err.code !== 'EEXIST')
+                    throw err;
+            });
+            standing = await lstatOrNull(at);
+        }
+        if (standing === null || !standing.isDirectory()) {
+            throw invalidRef(ref, 'it goes through a link that leads out of your tmp folder, and links out of it are never followed.');
+        }
+    }
+}
+/**
+ * Remove every file of one `tmp/` folder, at any depth, whose last
+ * modification is older than `maxAgeMs`, and every folder in it that the
+ * sweep leaves empty and that was itself older than that before the sweep
+ * touched it. Judged per FILE, because the stagers keep a long-lived folder
+ * each (`chat-uploads/`, …) whose own mtime moves with every new upload: a
+ * folder judged as a whole would keep an old file for as long as anyone kept
+ * uploading beside it. Everything is judged by its own `lstat`, and a link is
+ * removed as the link, never followed. The `tmp/` folder itself stays. A
+ * folder that is not there is nothing to sweep. Returns the paths removed,
+ * relative to `tmp/`.
+ *
+ * The tree is read by THE walk (`walker`, see `shared/fs.contract.ts`), not a
+ * loop of its own: its files, its other entries (a link, a socket — never
+ * entered) and its folders are collected, each folder's age read as it is
+ * listed, so before anything in it goes. A folder that cannot be listed is
+ * the walk's hole: logged, and walked around. The removals follow the walk —
+ * the entries first, then the folders deepest first, so a folder emptied by
+ * the sweep is judged after its contents.
+ *
+ * `signal` ends the sweep early: once it is aborted the walk stops listing
+ * and nothing more is removed — it is asked again right before each removal,
+ * after every awaited look — and what is already gone is returned.
+ */
+export async function sweepTmpFolder(walker, workspaceDir, maxAgeMs, now, signal) {
+    const tmpDir = path.join(workspaceDir, WORKSPACE_TMP_DIR);
+    // `lstat` the folder itself: a `tmp` that is a link is not a folder of
+    // this workspace's to sweep (the walk would follow it). Not there is
+    // nothing to sweep.
+    if ((await lstatOrNull(tmpDir))?.isDirectory() !== true)
+        return [];
+    const join = (dir, name) => (dir === '' ? name : `${dir}/${name}`);
+    const entries = [];
+    const oldDirs = [];
+    const stopped = () => signal?.aborted === true;
+    // The entry's own `lstat` (shared/rename-no-replace.ts), or null when it is
+    // gone; any other failure spoils that one entry: logged, and left alone.
+    const entryStat = async (rel) => {
+        try {
+            return await lstatOrNull(path.join(tmpDir, rel));
+        }
+        catch (err) {
+            log.warn('could not stat a tmp entry:', { err, entry: sanitizedPath(rel) });
+            return null;
+        }
+    };
+    await walker.walk(tmpDir, { until: stopped }, [
+        {
+            async onDir(rel) {
+                if (rel === '')
+                    return;
+                // Its age is read BEFORE its contents go: removing them moves it.
+                const stat = await entryStat(rel);
+                if (stat && now - stat.mtimeMs > maxAgeMs)
+                    oldDirs.push(rel);
+            },
+            onFile(dir, name) {
+                entries.push(join(dir, name));
+            },
+            onOther(dir, entry) {
+                entries.push(join(dir, entry.name));
+            },
+            onHole(rel, err) {
+                log.warn('could not list a tmp folder:', { err, folder: sanitizedPath(rel) });
+            },
+        },
+    ]);
+    const removed = [];
+    const attempt = async (rel, remove) => {
+        try {
+            await remove(path.join(tmpDir, rel));
+            removed.push(rel);
+        }
+        catch (err) {
+            // Gone mid-sweep is what the sweep wanted, and a folder something is
+            // still in stays; anything else spoils one entry, not the sweep.
+            const code = err?.code;
+            if (!isAbsence(err) && code !== 'ENOTEMPTY' && code !== 'EEXIST') {
+                log.warn('could not sweep a tmp entry:', { err, entry: sanitizedPath(rel) });
+            }
+        }
+    };
+    for (const rel of entries) {
+        if (stopped())
+            return removed;
+        const stat = await entryStat(rel);
+        if (!stat || now - stat.mtimeMs <= maxAgeMs)
+            continue;
+        // Asked again AFTER the awaited look: a stop that came while it ran
+        // removes nothing more, this entry included.
+        if (stopped())
+            return removed;
+        // A file, or a link removed as the link.
+        await attempt(rel, (abs) => fs.unlink(abs));
+    }
+    // Walk order lists a folder before what is in it, so the reverse is deepest first.
+    for (const rel of oldDirs.reverse()) {
+        if (stopped())
+            return removed;
+        await attempt(rel, (abs) => fs.rmdir(abs));
+    }
+    return removed;
+}
+/**
+ * The periodic sweep of every workspace's `tmp/` folder, on a timer.
+ *
+ * Started with the graph (`startCore`) and stopped with it (`stopCore`):
+ * stopping clears the timer and CANCELS the sweep in flight — its signal is
+ * aborted, so it removes nothing more and ends at the next entry it would
+ * have looked at — and `drainSweep` waits for it to end. `stopCore` bounds
+ * that wait by its own deadline, like every other drain there: a sweep stuck
+ * inside one filesystem call (a hung mount) can outlive the wait, but it
+ * removes nothing once that call returns. The first sweep runs at start, not
+ * one interval later, so what a previous process left past its age goes
+ * without waiting. The timer is `unref`'d: nothing here is worth keeping a
+ * process alive for.
+ */
+export class TmpSweeper {
+    sweep;
+    timer = null;
+    sweeping = null;
+    stop = null;
+    constructor(sweep) {
+        this.sweep = sweep;
+    }
+    /** Sweep now, and every `intervalMs` after. Idempotent. */
+    startSweeping(intervalMs = TMP_SWEEP_INTERVAL_MS) {
+        if (this.timer)
+            return;
+        this.stop = new AbortController();
+        this.tick();
+        this.timer = setInterval(() => this.tick(), intervalMs);
+        this.timer.unref?.();
+    }
+    /** Clear the timer and cancel the sweep in flight; {@link drainSweep} waits for it to end. */
+    stopSweeping() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+        this.stop?.abort();
+        this.stop = null;
+    }
+    /** Wait for the sweep in flight, if any, to end. */
+    async drainSweep() {
+        await this.sweeping;
+    }
+    /** One sweep, unless one is still running; its failure is logged. */
+    tick() {
+        if (this.sweeping || !this.stop)
+            return;
+        const running = this.sweep(this.stop.signal)
+            .then(() => undefined)
+            .catch((err) => log.warn('could not sweep the workspaces\' tmp folders:', { err }))
+            .finally(() => {
+            if (this.sweeping === running)
+                this.sweeping = null;
+        });
+        this.sweeping = running;
+    }
+}
+//# sourceMappingURL=workspace-tmp.js.map

package/dist/modules/workspace/workspace-tmp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-tmp.js","sourceRoot":"","sources":["../../../src/modules/workspace/workspace-tmp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAc,MAAM,SAAS,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAoB,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAEhE,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,+DAA+D;AAC/D,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY;IAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,IAAI,uBAAuB,CAAC,IAAI,KAAK,6BAA6B,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7H,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,YAAoB,EAAE,OAAe;IACxD,IACE,OAAO,KAAK,EAAE;QACd,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,mBAAmB,CAAC,OAAO,CAAC;QAC5B,OAAO,CAAC,MAAM,GAAG,GAAG,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,aAAa,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,GAAY;IAC9C,IAAI,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC,GAAG,EAAE,oFAAoF,CAAC,CAAC;IAC/G,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,OAAO,IAAI,mBAAmB,CAAC,IAAI,KAAK,sDAAsD,EAAE,GAAG,EAAE;QACnG,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,uEAAuE;IACvE,yEAAyE;IACzE,iDAAiD;IACjD,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,CAAC,GAAG,EAAE,iHAAiH,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,UAAU,CAAC,GAAG,EAAE,+DAA+D,cAAc,uBAAuB,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,UAAU,CAAC,GAAG,EAAE,0HAA0H,CAAC,CAAC;IACpJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,UAAU,CAAC,GAAG,EAAE,qDAAqD,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,UAAU,CAAC,GAAG,EAAE,iGAAiG,CAAC,CAAC;IAC3H,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACtF,MAAM,UAAU,CAAC,GAAG,EAAE,8IAA8I,CAAC,CAAC;IACxK,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,GAAW,EAAE,MAA+B;IACzF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACzC,MAAM,UAAU,CAAC,GAAG,EAAE,sGAAsG,CAAC,CAAC;IAChI,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,YAAoB,EACpB,OAAe,EACf,GAAW;IAEX,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,GAAY,EAAS,EAAE;QACrC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC3F,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/E,yEAAyE;IACzE,uEAAuE;IACvE,sDAAsD;IACtD,IAAI,CAAC;QACH,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,CAAC,GAAG,EAAE,mGAAmG,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,MAAM,UAAU,CAAC,GAAG,EAAE,4EAA4E,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,UAAU,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,YAAoB,EAAE,OAAe,EAAE,GAAW;IACjF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtD,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAWD,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,YAAoB,EAAE,OAAe,EAAE,GAAW;IACjF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,OAAe,EAAE,YAAoB,EAAE,KAAiB;IAC9G,MAAM,GAAG,GAAG,cAAc,GAAG,YAAY,CAAC;IAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,GAAY,EAAS,EAAE;QACtC,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAChF,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,0BAA0B;IAC1B,MAAM,iBAAiB,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC;IAChD,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,MAAM,UAAU,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAA2B,EAAE,GAAW;IACrF,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACxC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACjD,MAAM,UAAU,CAAC,GAAG,EAAE,mGAAmG,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,GAAW,EACX,MAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC1D,uEAAuE;IACvE,qEAAqE;IACrE,oBAAoB;IACpB,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAY,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IACxD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,SAAS,GAAG,KAAK,EAAE,GAAW,EAAyB,EAAE;QAC7D,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5C;YACE,KAAK,CAAC,KAAK,CAAC,GAAG;gBACb,IAAI,GAAG,KAAK,EAAE;oBAAE,OAAO;gBACvB,kEAAkE;gBAClE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,IAAI;gBACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,KAAK;gBAChB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,GAAG;gBACb,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;SACF;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAE,MAAsC,EAAiB,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;YACtD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjE,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,OAAO,EAAE;YAAE,OAAO,OAAO,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ;YAAE,SAAS;QACtD,oEAAoE;QACpE,6CAA6C;QAC7C,IAAI,OAAO,EAAE;YAAE,OAAO,OAAO,CAAC;QAC9B,yCAAyC;QACzC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,mFAAmF;IACnF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACpC,IAAI,OAAO,EAAE;YAAE,OAAO,OAAO,CAAC;QAC9B,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,UAAU;IAKQ;IAJrB,KAAK,GAA0C,IAAI,CAAC;IACpD,QAAQ,GAAyB,IAAI,CAAC;IACtC,IAAI,GAA2B,IAAI,CAAC;IAE5C,YAA6B,KAAgD;QAAhD,UAAK,GAAL,KAAK,CAA2C;IAAG,CAAC;IAEjF,2DAA2D;IAC3D,aAAa,CAAC,aAAqB,qBAAqB;QACtD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,8FAA8F;IAC9F,YAAY;QACV,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,qEAAqE;IAC7D,IAAI;QACV,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aACzC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACrB,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;aAC3F,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtD,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;CACF"}

package/dist/modules/workspace/workspace.routes.d.ts

@@ -1,15 +1,14 @@
 import { type ITreeWalker } from '../../shared/fs.contract.js';
-import type { IAdminAccessService } from '../admin/admin.interface.js';
+import type { IAdminAccessService } from '../admin/index.js';
 import express from 'express';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
-import type { KbContext } from '../../shared/kb-context.js';
 import { type WorkspaceService } from './workspace.service.js';
-import type { AuthService } from '../auth/auth.service.js';
-import type { IAccessControl } from '../access/access-control.interface.js';
-import type { ICreatorAccess } from '../access-model/creator.js';
-import type { IChangeReadGate } from '../access-model/change-gate.js';
-import type { WorkflowEventBus } from '../workflow/event-bus.js';
-import '../auth/auth.middleware.js';
+import type { KbContext } from '../../shared/kb-context.js';
+import type { AuthService } from '../auth/index.js';
+import type { IAccessControl } from '../access/index.js';
+import type { ICreatorAccess, IChangeReadGate } from '../access-model/index.js';
+import type { WorkflowEventBus } from '../workflow/index.js';
+import '../auth/index.js';
 import type { SkillSaveCheck } from './workspace.tools.js';
 /**
  * Workspaces are per-branch (PLAN §3). Any authenticated user can access

package/dist/modules/workspace/workspace.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspace.routes.ts"],"names":[],"mappings":"AAKA,OAAO,EAA8B,KAAK,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAiBlF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQjE,OAAO,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwB3D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,gBAAgB,EACjC,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,EAAE,cAAc,EAC7B,EAAE,EAAE,SAAS,EACb,aAAa,EAAE,cAAc,EAC7B,WAAW,EAAE,mBAAmB,EAChC,IAAI,EAAE,WAAW;AACjB,4GAA4G;AAC5G,cAAc,CAAC,EAAE,cAAc;AAC/B;;;;;GAKG;AACH,UAAU,CAAC,EAAE,eAAe,GAC3B,OAAO,CAAC,MAAM,CAwgDhB"}
+{"version":3,"file":"workspace.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspace.routes.ts"],"names":[],"mappings":"AAKA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAelF,OAAO,EAA8D,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE3H,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAQ7D,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwB3D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,gBAAgB,EACjC,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,EAAE,cAAc,EAC7B,EAAE,EAAE,SAAS,EACb,aAAa,EAAE,cAAc,EAC7B,WAAW,EAAE,mBAAmB,EAChC,IAAI,EAAE,WAAW;AACjB,4GAA4G;AAC5G,cAAc,CAAC,EAAE,cAAc;AAC/B;;;;;GAKG;AACH,UAAU,CAAC,EAAE,eAAe,GAC3B,OAAO,CAAC,MAAM,CAm/ChB"}