@bevel-software/platform-core-backend 0.32.0 → 0.34.0

package/src/modules/auth/auth.routes.ts

@@ -2,19 +2,26 @@ import express from 'express';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('auth');
-import type { AuthService } from './auth.service.js';
-import { AUTH_COOKIE_NAME } from './auth.middleware.js'; // also imports Express Request augmentation
+import { PasswordChangedMeanwhileError, PasswordRefusedError, type AuthService } from './auth.service.js';
+import { setAuthCookie } from './auth.middleware.js'; // also imports Express Request augmentation
 import { FixedWindowRateLimiter } from './rate-limit.js';
 import { AccountDeactivatedError } from './account-admission.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
 
-/**
- * Max age of the JWT cookie (seconds). Matches the JWT's own `expiresIn:
- * '7d'` so the cookie expires when the token does — browsers stop
- * sending it past expiry, sparing the auth middleware verifying tokens
- * that are guaranteed to fail.
- */
-export const AUTH_COOKIE_MAX_AGE_S = 7 * 24 * 60 * 60;
+// The cookie's lifetime lives beside its one issue site now; still offered
+// here for the providers that learnt it from this file.
+export { AUTH_COOKIE_MAX_AGE_S } from './auth.middleware.js';
+
+/** What {@link createAuthRoutes} takes beyond its services. */
+export interface AuthRoutesOptions {
+  /**
+   * Whether the auth cookie is marked `Secure`: the composition root derives
+   * it from the deployment's public URL (`authCookieSecure`), the one rule
+   * every provider's cookie follows too. Absent — a harness that mounts the
+   * routes on their own — it falls back to `NODE_ENV === 'production'`.
+   */
+  cookieSecure?: boolean;
+}
 
 /**
  * A pluggable SSO login method. Core ships password login and (when
@@ -49,8 +56,10 @@ export function createAuthRoutes(
   authMiddleware: express.RequestHandler,
   providers: AuthProviderPlugin[] = [],
   passwordLoginEnabled = true,
+  options: AuthRoutesOptions = {},
 ): express.Router {
   const router = express.Router();
+  const cookieSecure = options.cookieSecure ?? process.env.NODE_ENV === 'production';
 
   // Brute-force guards on the password endpoints (scrypt also makes each
   // attempt expensive server-side, so these double as DoS protection):
@@ -100,18 +109,7 @@ export function createAuthRoutes(
       // attempts isn't rate-limited on their next visit. (The wider per-ip
       // window intentionally keeps counting.)
       loginPairLimiter.reset(pairKey);
-      // Also set the JWT as an HttpOnly cookie so transports that can't
-      // carry headers (EventSource for SSE, image tags) authenticate
-      // automatically. JSON callers continue to use the Bearer header
-      // returned in the body. Secure in production; off in dev so the
-      // cookie survives `http://localhost` requests.
-      res.cookie(AUTH_COOKIE_NAME, result.token, {
-        httpOnly: true,
-        sameSite: 'lax',
-        secure: process.env.NODE_ENV === 'production',
-        maxAge: AUTH_COOKIE_MAX_AGE_S * 1000,
-        path: '/',
-      });
+      setAuthCookie(res, result.token, cookieSecure);
       res.json(result);
     } catch (error) {
       // The password was right and an admin switched the account off: said
@@ -144,6 +142,9 @@ export function createAuthRoutes(
   // POST /api/auth/change-password — self-service (protected). Requires the
   // current password whenever one is set; an SSO-only account sets its first
   // password without one.
+  //
+  // A change ends every session opened before it, this one included, so the
+  // caller is handed a fresh token (body and cookie) to carry on with.
   router.post('/auth/change-password', authMiddleware, async (req, res) => {
     const { currentPassword, newPassword } = req.body as {
       currentPassword?: string;
@@ -158,13 +159,27 @@ export function createAuthRoutes(
       return;
     }
     try {
-      await authService.changePassword(req.userId!, currentPassword, newPassword);
-      res.json({ ok: true });
+      const { token } = await authService.changePassword(req.userId!, currentPassword, newPassword);
+      setAuthCookie(res, token, cookieSecure);
+      res.json({ ok: true, token });
     } catch (error) {
-      const msg = error instanceof Error ? error.message : 'Unknown error';
-      // Policy violations and a wrong current password are caller errors, not
-      // server faults — and the message is safe to show verbatim.
-      res.status(400).json({ error: msg });
+      // Another session changed the password first: what this one proved is
+      // no longer current, and nothing was written.
+      if (error instanceof PasswordChangedMeanwhileError) {
+        res.status(409).json({ error: error.message });
+        return;
+      }
+      // A refusal the service made on purpose — a policy violation, a wrong
+      // current password, an account whose password is not kept here — is
+      // the caller's to fix, and its words are written for them.
+      if (error instanceof PasswordRefusedError) {
+        res.status(400).json({ error: error.message });
+        return;
+      }
+      // Anything else is a fault, not a verdict: logged in full, answered
+      // generic, so a driver's message never reaches a browser.
+      log.error('Change-password error:', { err: error });
+      res.status(500).json({ error: 'Could not change the password' });
     }
   });
 
@@ -216,8 +231,10 @@ export function createAuthRoutes(
       }
       res.json(user);
     } catch (error) {
-      const msg = error instanceof Error ? error.message : 'Unknown error';
-      res.status(500).json({ error: msg });
+      // Logged in full, returned generic — the rule every route here follows:
+      // a raw driver message would hand the caller the schema or the host.
+      log.error('Auth me error:', { err: error });
+      res.status(500).json({ error: 'Could not load your account' });
     }
   });
 

package/src/modules/auth/auth.service.ts

@@ -1,7 +1,7 @@
 import jwt from 'jsonwebtoken';
 import { and, eq, getTableColumns, inArray, isNotNull, isNull, sql } from 'drizzle-orm';
-import type { Database } from '../database/connection.js';
-import { users } from '../database/schema.js';
+import type { Database } from '../database/index.js';
+import { users } from '../database/index.js';
 import type { AuthUser } from '@bevel-software/platform-shared';
 import { canonicalEmail } from '../../shared/email-identity.js';
 import {
@@ -9,6 +9,7 @@ import {
   AccountChangeRefusedError,
   AccountDeactivatedError,
   AuthBackendError,
+  SessionEndedError,
   admitEveryone,
   type AccountProvisionReason,
   type IAccountAdmission,
@@ -19,8 +20,8 @@ import {
   timingSafeStringEqual,
   MIN_PASSWORD_LENGTH,
 } from './password-hash.js';
-import { RECOVERY_BOT_EMAIL } from '../workflow/recovery-bot.js';
-import { DIRECTORY_SYNC_BOT_EMAIL } from '../access/directory-sync-bot.js';
+import { RECOVERY_BOT_EMAIL } from '../workflow/index.js';
+import { DIRECTORY_SYNC_BOT_EMAIL } from '../access/index.js';
 import { takeAccountSwitchLock } from './account-switch-lock.js';
 import type { IAccountSwitchGuard } from './account-switch-guard.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
@@ -32,6 +33,8 @@ const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  * request carrying a credential asks, so the answer is kept briefly rather
  * than read each time; switching an account off or on in THIS process
  * forgets it at once, and another replica sees the change within this long.
+ * A session token never waits on it: {@link AuthService.resolveSession}
+ * reads the row each time, so a password change ends it everywhere at once.
  */
 const ACTIVE_CACHE_MS = 30_000;
 
@@ -69,6 +72,33 @@ export const OWNER_SWITCH_OFF_REFUSAL = "The owner can't be switched off.";
 /** What an admin is told when deleting an owner's account would leave them no way to sign in. */
 export const OWNER_DELETE_REFUSAL = "The owner's account can't be deleted: they would have no way to sign in.";
 
+/**
+ * A password change refused because the password it proved is no longer the
+ * account's: another session changed it between this change's read and its
+ * write. Nothing was written; the routes answer it with a 409 and its words.
+ */
+export class PasswordChangedMeanwhileError extends Error {
+  constructor() {
+    super('Your password was changed from another session while this change was being made, so nothing was changed. Sign in with the new password.');
+    this.name = 'PasswordChangedMeanwhileError';
+  }
+}
+
+/**
+ * A password write the service refuses on purpose: the policy, a wrong
+ * current password, an account whose password is not kept here. The message
+ * is written for the caller, and a route answers it with a 400 — unlike any
+ * other error a password write raises, which is a fault and answered generic.
+ */
+export class PasswordRefusedError extends Error {
+  readonly status = 400;
+
+  constructor(message: string) {
+    super(message);
+    this.name = 'PasswordRefusedError';
+  }
+}
+
 /**
  * Decoy hash verified when the email is unknown or has no password set, so
  * those paths cost the same scrypt work as a real wrong-password attempt —
@@ -271,7 +301,7 @@ export class AuthService implements IAccountSwitchGuard {
       const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
       await this.assertAdmitted(normalizedEmail, 'bootstrap');
       const admin = await this.clearOwnerSwitchOff(await this.upsertUserByEmail(normalizedEmail, defaultName));
-      return { token: this.signToken(admin.id, admin.email), user: this.toClientUser(admin) };
+      return { token: this.signToken(admin), user: this.toClientUser(admin) };
     }
 
     // Always run one scrypt verification — against the stored hash when there
@@ -287,7 +317,7 @@ export class AuthService implements IAccountSwitchGuard {
     // is switched off would tell them it has an account.
     const signedIn = await this.clearOwnerSwitchOff(user);
     if (signedIn.deactivatedAt) throw new AccountDeactivatedError();
-    return { token: this.signToken(signedIn.id, signedIn.email), user: this.toClientUser(signedIn) };
+    return { token: this.signToken(signedIn), user: this.toClientUser(signedIn) };
   }
 
   /**
@@ -319,7 +349,7 @@ export class AuthService implements IAccountSwitchGuard {
     const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
     const user = await this.clearOwnerSwitchOff(await this.upsertUserByEmail(normalizedEmail, displayName));
     if (user.deactivatedAt) throw new AccountDeactivatedError();
-    return { token: this.signToken(user.id, user.email), user: this.toClientUser(user) };
+    return { token: this.signToken(user), user: this.toClientUser(user) };
   }
 
   /**
@@ -361,7 +391,7 @@ export class AuthService implements IAccountSwitchGuard {
     // than sending the admin off to pick a longer password first.
     this.assertNotSystemAccount(normalizedEmail);
     if (this.isEnvAdminEmail(normalizedEmail)) {
-      throw new Error(ENV_ADMIN_PASSWORD_REFUSAL);
+      throw new PasswordRefusedError(ENV_ADMIN_PASSWORD_REFUSAL);
     }
     this.assertPasswordPolicy(password);
     await this.assertAdmitted(normalizedEmail, 'admin-create');
@@ -370,16 +400,22 @@ export class AuthService implements IAccountSwitchGuard {
     // EXPLICITLY supplied name is persisted too; a blank name keeps the
     // existing display name rather than clobbering it with the local-part
     // fallback. `returning()` yields the authoritative row either way.
+    // A reset is a password change like any other: the session generation
+    // moves on with it, so every session opened with the old password ends,
+    // and a self-service change that read the row before it is refused
+    // rather than overwriting the reset (see {@link changePassword}).
+    const sessionVersion = sql`${users.sessionVersion} + 1`;
     const [row] = await this.db
       .insert(users)
       .values({ email: normalizedEmail, emailBidx: normalizedEmail, name: displayName, passwordHash })
       .onConflictDoUpdate({
         target: users.emailBidx,
         set: suppliedName
-          ? { passwordHash, name: suppliedName, updatedAt: new Date() }
-          : { passwordHash, updatedAt: new Date() },
+          ? { passwordHash, sessionVersion, name: suppliedName, updatedAt: new Date() }
+          : { passwordHash, sessionVersion, updatedAt: new Date() },
       })
       .returning();
+    this.activeCache.delete(row.id);
     return this.toClientUser(row);
   }
 
@@ -443,21 +479,26 @@ export class AuthService implements IAccountSwitchGuard {
       if (existing) {
         return { user: this.toClientUser(existing), created: false, passwordSet: false, deactivated: existing.deactivatedAt != null };
       }
-      throw new Error(ENV_ADMIN_PASSWORD_REFUSAL);
+      throw new PasswordRefusedError(ENV_ADMIN_PASSWORD_REFUSAL);
     }
     this.assertPasswordPolicy(password);
     await this.assertAdmitted(normalizedEmail, 'admin-create');
     const passwordHash = await hashPassword(password);
     const displayName = normalizedEmail.split('@')[0] || normalizedEmail;
+    // A first password on an existing account is a password write like any
+    // other, so the session generation moves on with it: a self-service
+    // first password that read the row before this one is refused rather
+    // than overwriting it (see {@link changePassword}).
     const [row] = await this.db
       .insert(users)
       .values({ email: normalizedEmail, emailBidx: normalizedEmail, name: displayName, passwordHash })
       .onConflictDoUpdate({
         target: users.emailBidx,
-        set: { passwordHash, updatedAt: new Date() },
+        set: { passwordHash, sessionVersion: sql`${users.sessionVersion} + 1`, updatedAt: new Date() },
         setWhere: and(isNull(users.passwordHash), isNull(users.deactivatedAt)),
       })
       .returning({ ...getTableColumns(users), created: CREATED });
+    if (row) this.activeCache.delete(row.id);
     if (row) return { user: this.toClientUser(row), created: row.created === true, passwordSet: true, deactivated: false };
     // The conflicting account has a password or is switched off: untouched.
     const [existing] = await this.db.select().from(users).where(eq(users.emailBidx, normalizedEmail)).limit(1);
@@ -586,31 +627,49 @@ export class AuthService implements IAccountSwitchGuard {
    * environment password is the platform's rescue path into a deployment and
    * is changed there, which is what the Account page says in place of the
    * form.
+   *
+   * A change ends every session opened before it: the row's
+   * `sessionVersion` moves on in the same write, so every token issued
+   * before it is refused at its next request (see {@link resolveSession}).
+   * The caller's own session is the one exception: the token returned here
+   * carries the new generation and is what the caller keeps using.
+   *
+   * The write only lands on the row as it was read. If another session
+   * changed the password between the read and the write, the current
+   * password this one proved is no longer current, so it is refused with
+   * {@link PasswordChangedMeanwhileError} and nothing is written. Two clicks
+   * of one form are the same race.
    */
   async changePassword(
     userId: string,
     currentPassword: string | undefined,
     newPassword: string,
-  ): Promise<void> {
+  ): Promise<{ token: string }> {
     const [user] = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
-    if (!user) throw new Error('User not found');
+    if (!user) throw new PasswordRefusedError('User not found');
     // Before the policy check, so the deployment admin is told the real reason
     // rather than being sent to fix a password that would be refused anyway.
     this.assertNotSystemAccount(user.email);
     if (this.isEnvAdminEmail(user.email)) {
-      throw new Error(ENV_ADMIN_PASSWORD_REFUSAL);
+      throw new PasswordRefusedError(ENV_ADMIN_PASSWORD_REFUSAL);
     }
     this.assertPasswordPolicy(newPassword);
     if (user.passwordHash) {
       if (!currentPassword || !(await verifyPassword(currentPassword, user.passwordHash))) {
-        throw new Error('Current password is incorrect');
+        throw new PasswordRefusedError('Current password is incorrect');
       }
     }
     const passwordHash = await hashPassword(newPassword);
-    await this.db
+    const [changed] = await this.db
       .update(users)
-      .set({ passwordHash, updatedAt: new Date() })
-      .where(eq(users.id, userId));
+      .set({ passwordHash, sessionVersion: sql`${users.sessionVersion} + 1`, updatedAt: new Date() })
+      .where(and(eq(users.id, userId), eq(users.sessionVersion, user.sessionVersion)))
+      .returning();
+    if (!changed) throw new PasswordChangedMeanwhileError();
+    // Sessions read the row fresh (see resolveSession); the cached entry is
+    // dropped so nothing in this process keeps the old generation either.
+    this.activeCache.delete(userId);
+    return { token: this.signToken(changed) };
   }
 
   /**
@@ -664,18 +723,24 @@ export class AuthService implements IAccountSwitchGuard {
   /** Every password write calls this first: the system accounts never get one. */
   private assertNotSystemAccount(normalizedEmail: string): void {
     if (SYSTEM_ACCOUNT_EMAILS.includes(normalizedEmail)) {
-      throw new Error(SYSTEM_ACCOUNT_PASSWORD_REFUSAL);
+      throw new PasswordRefusedError(SYSTEM_ACCOUNT_PASSWORD_REFUSAL);
     }
   }
 
   private assertPasswordPolicy(password: string): void {
     if ((password ?? '').length < MIN_PASSWORD_LENGTH) {
-      throw new Error(`Password must be at least ${MIN_PASSWORD_LENGTH} characters`);
+      throw new PasswordRefusedError(`Password must be at least ${MIN_PASSWORD_LENGTH} characters`);
     }
   }
 
-  private signToken(userId: string, email: string): string {
-    return jwt.sign({ userId, email }, this.config.jwtSecret, { expiresIn: '7d' });
+  /**
+   * A session token for `user`, stamped with the session generation its row
+   * is at (`sv`): {@link resolveSession} refuses it once the row moves on.
+   */
+  private signToken(user: { id: string; email: string; sessionVersion: number }): string {
+    return jwt.sign({ userId: user.id, email: user.email, sv: user.sessionVersion }, this.config.jwtSecret, {
+      expiresIn: '7d',
+    });
   }
 
   /**
@@ -710,39 +775,55 @@ export class AuthService implements IAccountSwitchGuard {
 
   /**
    * The signature and expiry of a session token, and nothing else — whether
-   * its account is still on is {@link resolveSession}'s question. Every
+   * its account is still on, and whether the session is still honoured, are
+   * {@link resolveSession}'s questions. Every
    * place a session is ACCEPTED goes through that one.
    */
   verifyToken(token: string): { userId: string; email: string } {
+    const { userId, email } = this.decodeSession(token);
+    return { userId, email };
+  }
+
+  /** {@link verifyToken} plus the session generation the token was issued at. */
+  private decodeSession(token: string): { userId: string; email: string; sessionVersion: number } {
     const decoded = jwt.verify(token, this.config.jwtSecret) as {
       userId: string;
       email: string;
+      sv?: number;
     };
-    return { userId: decoded.userId, email: decoded.email };
+    // A token issued before sessions had generations carries none: it is of
+    // the first one, which is where every row started.
+    return { userId: decoded.userId, email: decoded.email, sessionVersion: decoded.sv ?? 0 };
   }
 
   /**
-   * A session token that may still be used: signed by us, not expired, and
-   * its account still on. A token outlives a deactivation by up to seven
+   * A session token that may still be used: signed by us, not expired, its
+   * account still on, and issued since the account's password last changed.
+   * A token outlives a deactivation or a password change by up to seven
    * days, so the signature alone no longer says the bearer may enter.
-   * Throws for an invalid token, {@link AccountDeactivatedError} for one
-   * whose account was switched off.
+   * Throws for an invalid token, {@link SessionEndedError} for one a
+   * password change ended, {@link AccountDeactivatedError} for one whose
+   * account was switched off.
    */
   async resolveSession(token: string): Promise<{ userId: string; email: string }> {
-    const claim = this.verifyToken(token);
-    let active: boolean;
+    const { sessionVersion, ...claim } = this.decodeSession(token);
+    let account: { active: boolean; sessionVersion: number };
     try {
-      active = await this.isActive(claim.userId);
+      // Read fresh, never from the cache: a password changed on another
+      // replica must end this token at its very next request, and only the
+      // row can say it was.
+      account = await this.accountState(claim.userId, { fresh: true });
     } catch (err) {
       // The token is fine; the database is not. Said apart from a refusal, so
       // an outage is a 500 and not a sign-out (see `AuthBackendError`).
       throw new AuthBackendError(err);
     }
-    if (!active) throw new AccountDeactivatedError();
+    if (!account.active) throw new AccountDeactivatedError();
+    if (sessionVersion !== account.sessionVersion) throw new SessionEndedError();
     return claim;
   }
 
-  private readonly activeCache = new Map<string, { active: boolean; at: number }>();
+  private readonly activeCache = new Map<string, { active: boolean; sessionVersion: number; at: number }>();
 
   /**
    * Whether the account behind a credential is on: it exists and no admin
@@ -762,18 +843,38 @@ export class AuthService implements IAccountSwitchGuard {
    * ({@link clearOwnerSwitchOff}).
    */
   async isActive(userId: string): Promise<boolean> {
+    return (await this.accountState(userId)).active;
+  }
+
+  /**
+   * {@link isActive}'s answer and the session generation the account is at,
+   * read and cached together; a password change in this process forgets the
+   * entry at once, as switching an account off does. `fresh` reads the row
+   * whatever the cache holds (and refreshes it): {@link resolveSession}'s
+   * question, since a session's generation must hold on every replica.
+   */
+  private async accountState(
+    userId: string,
+    { fresh = false }: { fresh?: boolean } = {},
+  ): Promise<{ active: boolean; sessionVersion: number }> {
     const now = Date.now();
     const hit = this.activeCache.get(userId);
-    if (hit && now - hit.at < ACTIVE_CACHE_MS) return hit.active;
+    if (!fresh && hit && now - hit.at < ACTIVE_CACHE_MS) return hit;
     const [found] = await this.db
-      .select({ id: users.id, email: users.email, deactivatedAt: users.deactivatedAt })
+      .select({
+        id: users.id,
+        email: users.email,
+        deactivatedAt: users.deactivatedAt,
+        sessionVersion: users.sessionVersion,
+      })
       .from(users)
       .where(eq(users.id, userId))
       .limit(1);
     const row = found && (await this.clearOwnerSwitchOff(found));
     const active = row !== undefined && (!row.deactivatedAt || this.isEnvAdminEmail(row.email ?? ''));
-    this.activeCache.set(userId, { active, at: now });
-    return active;
+    const entry = { active, sessionVersion: row?.sessionVersion ?? 0, at: now };
+    this.activeCache.set(userId, entry);
+    return entry;
   }
 
   /**

package/src/modules/auth/index.ts

@@ -15,6 +15,8 @@ export {
   AccountChangeRefusedError,
   AccountDeactivatedError,
   AuthBackendError,
+  SESSION_ENDED_MESSAGE,
+  SessionEndedError,
   admitEveryone,
   type AccountAdmissionVerdict,
   type AccountProvisionReason,
@@ -27,3 +29,6 @@ export { timingSafeStringEqual } from './password-hash.js';
 // The Express `Request` augmentation (`req.userId`, …): a module whose routes
 // read it imports this entry, never the middleware file.
 import './auth.middleware.js';
+// Reached by other modules; exported here so they stop importing the files.
+export type { IAccountSwitchGuard } from './account-switch-guard.js';
+export type { AuthService } from './auth.service.js';

package/src/modules/auth/oidc-auth-provider.ts

@@ -4,11 +4,10 @@ import { logger } from '../../shared/logging.js';
 const log = logger('oidc');
 import type express from 'express';
 import type { AuthProviderPlugin } from './auth.routes.js';
-import { AUTH_COOKIE_MAX_AGE_S } from './auth.routes.js';
-import { AUTH_COOKIE_NAME } from './auth.middleware.js';
+import { setAuthCookie } from './auth.middleware.js';
 import type { AuthService } from './auth.service.js';
 import { AccountAdmissionRefusedError, AccountDeactivatedError } from './account-admission.js';
-import { normalizeIssuerUrl } from '../settings/oidc-check.js';
+import { normalizeIssuerUrl } from '../settings/index.js';
 
 // Short-lived CSRF state + PKCE verifier for the OAuth round-trip: set before
 // redirecting to the provider, verified/consumed on callback.
@@ -311,13 +310,7 @@ export class OidcAuthProvider implements AuthProviderPlugin {
         } catch (error) {
           log.error('OIDC sign-in record failed:', { err: error });
         }
-        res.cookie(AUTH_COOKIE_NAME, token, {
-          httpOnly: true,
-          sameSite: 'lax',
-          secure: cookieSecure,
-          maxAge: AUTH_COOKIE_MAX_AGE_S * 1000,
-          path: '/',
-        });
+        setAuthCookie(res, token, cookieSecure);
         res.redirect(`${publicFrontendUrl}/auth/oidc/callback#token=${encodeURIComponent(token)}`);
       } catch (error) {
         // A refused provisioning is not a failed sign-in: the identity was

package/src/modules/code-mode/code-mode.tool.ts

@@ -13,7 +13,7 @@ import {
   runToolChain,
   withCallExample,
 } from '@bevel-software/platform-mcp-core';
-import type { SpillStore } from '../workspace/spill-store.js';
+import type { SpillStore } from '../workspace/index.js';
 import { utcpNameToTsInterfaceName, findToolByName, AmbiguousToolNameError } from './code-mode-names.js';
 
 /**

package/src/modules/connection-probe/connection-probe.service.ts

@@ -7,12 +7,9 @@ import '@utcp/mcp'; // side effect: registers the 'mcp' protocol (remote MCP `.t
 import { CommunicationProtocol, UtcpClientConfigSerializer, type CallTemplate } from '@utcp/sdk';
 import { CodeModeUtcpClient } from '@utcp/code-mode';
 import { registerManual } from '@bevel-software/platform-mcp-core';
-import type { IToolManualService, ToolHealthCheck, ToolProbeTarget } from '../tool-manuals/tool-manuals.contract.js';
-import type { ISecretsVaultService } from '../secrets-vault/secrets-vault.contract.js';
-// The concrete module, NOT the `secrets-vault` barrel: that barrel re-exports
-// the routes, and the routes import this module's contract — so going through
-// it would close an import cycle between the two modules.
-import { bevelSecretsLoaderConfig } from '../secrets-vault/secrets-variable-loader.js';
+import type { IToolManualService, ToolHealthCheck, ToolProbeTarget } from '../tool-manuals/index.js';
+import type { ISecretsVaultService } from '../secrets-vault/index.js';
+import { bevelSecretsLoaderConfig } from '../secrets-vault/index.js';
 import { utcpNamespacedKey } from '../../shared/utcp-namespace.js';
 import { assertSafeFetchUrl } from '../../shared/ssrf.js';
 import type { IConnectionProbeService, ProbeStatus, ProbeVerdict } from './connection-probe.contract.js';