@bevel-software/platform-core-backend 0.34.0 → 0.36.1

package/src/modules/database/__tests__/advisory-lock.test.ts

@@ -1,169 +1,169 @@
-import { describe, it, expect } from 'vitest';
-import { AdvisoryLock, advisoryLockKey, withAdvisoryLock } from '../advisory-lock.js';
-import type { Database } from '../connection.js';
-
-/**
- * A pool whose connections record what was asked of them. The SQL a lock
- * issues IS its observable behaviour — there is nothing else to see from
- * outside — so these suites drive `withAdvisoryLock` with a crafted pool and
- * read back the statements and the release.
- */
-interface RecordedClient {
-  queries: string[];
-  released: boolean;
-  releasedWith: Error | undefined;
-}
-
-function fakePool(opts: { failOn?: (sql: string) => Error; hangOn?: (sql: string) => boolean } = {}) {
-  const clients: RecordedClient[] = [];
-  const pool = {
-    async connect() {
-      const record: RecordedClient = { queries: [], released: false, releasedWith: undefined };
-      clients.push(record);
-      return {
-        async query(sql: string) {
-          record.queries.push(sql);
-          // A statement the database never answers: the promise stays pending.
-          if (opts.hangOn?.(sql)) return new Promise<never>(() => undefined);
-          const failure = opts.failOn?.(sql);
-          if (failure) throw failure;
-          return { rows: [] };
-        },
-        release(err?: Error) {
-          record.released = true;
-          record.releasedWith = err;
-        },
-      };
-    },
-  };
-  return { clients, db: { $client: pool } as unknown as Database };
-}
-
-/** The error shape `pg` raises when `lock_timeout` expires. */
-function lockTimeoutError(): Error {
-  return Object.assign(new Error('canceling statement due to lock timeout'), { code: '55P03' });
-}
-
-describe('withAdvisoryLock', () => {
-  it('holds the lock across the callback and releases it by ending the transaction', async () => {
-    const { clients, db } = fakePool();
-    let queriesWhenBodyRan: string[] = [];
-
-    const result = await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-      queriesWhenBodyRan = [...clients[0].queries];
-      return 'migrated';
-    });
-
-    expect(result).toBe('migrated');
-    // The lock is taken before the body starts...
-    expect(queriesWhenBodyRan.some((q) => q.includes('pg_advisory_xact_lock'))).toBe(true);
-    expect(queriesWhenBodyRan).not.toContain('rollback');
-    // ...and the transaction that holds it ends after the body, which is what
-    // releases both the lock and the transaction-local lock_timeout.
-    expect(clients[0].queries.at(-1)).toBe('rollback');
-    expect(clients[0].released).toBe(true);
-    expect(clients[0].releasedWith).toBeUndefined();
-  });
-
-  it('bounds the wait rather than blocking the boot forever', async () => {
-    const { clients, db } = fakePool();
-
-    await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => undefined, { waitMs: 1234 });
-
-    // Transaction-local, so the setting leaves with the transaction and the
-    // connection goes back to the pool as it arrived.
-    const setTimeoutCall = clients[0].queries.find((q) => q.includes('set_config'));
-    expect(setTimeoutCall).toContain('lock_timeout');
-    expect(setTimeoutCall).toContain('true');
-  });
-
-  it('releases the lock when the callback throws, and propagates the failure', async () => {
-    const { clients, db } = fakePool();
-    const boom = new Error('migration 0004 failed');
-
-    await expect(
-      withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-        throw boom;
-      }),
-    ).rejects.toBe(boom);
-
-    expect(clients[0].queries.at(-1)).toBe('rollback');
-    expect(clients[0].released).toBe(true);
-  });
-
-  it('never runs the callback when the lock cannot be taken in time', async () => {
-    const { clients, db } = fakePool({
-      failOn: (sql) => (sql.includes('pg_advisory_xact_lock') ? lockTimeoutError() : undefined!),
-    });
-    let ran = false;
-
-    await expect(
-      withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-        ran = true;
-      }),
-    ).rejects.toThrow(/Migrations advisory lock/);
-
-    expect(ran).toBe(false);
-    // Still cleaned up: a failed acquire leaves an open transaction behind
-    // otherwise, and the connection would carry it back into the pool.
-    expect(clients[0].queries.at(-1)).toBe('rollback');
-    expect(clients[0].released).toBe(true);
-  });
-
-  it('fails the boot, and destroys the connection without rolling back, when the database stops answering', async () => {
-    // The socket is up, the server is gone: `begin` never returns. Waiting on
-    // a rollback would queue behind it and hang the boot after all.
-    const { clients, db } = fakePool({ hangOn: (sql) => sql === 'begin' });
-    let ran = false;
-    await expect(
-      withAdvisoryLock(
-        db,
-        AdvisoryLock.Migrations,
-        async () => {
-          ran = true;
-        },
-        { waitMs: 20 },
-      ),
-    ).rejects.toThrow(/did not answer/);
-    expect(ran).toBe(false);
-    expect(clients[0].queries).not.toContain('rollback');
-    expect(clients[0].released).toBe(true);
-    expect(clients[0].releasedWith).toBeInstanceOf(Error);
-  });
-
-  it('destroys a connection it could not roll back instead of pooling it', async () => {
-    const { clients, db } = fakePool({
-      failOn: (sql) => (sql === 'rollback' ? new Error('connection terminated') : undefined!),
-    });
-
-    await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => undefined);
-
-    // Releasing with an error is how `pg` is told to discard the connection.
-    // Ending its session is also what actually releases a lock we may still
-    // be holding, so this path is the fallback for the rollback itself failing.
-    expect(clients[0].released).toBe(true);
-    expect(clients[0].releasedWith).toBeInstanceOf(Error);
-  });
-});
-
-describe('advisoryLockKey', () => {
-  it('keeps the ids a single-tenant deployment always used when no tenant is named', () => {
-    expect(advisoryLockKey(AdvisoryLock.Migrations)).toBe(AdvisoryLock.Migrations);
-    expect(advisoryLockKey(AdvisoryLock.CommitWorker, '')).toBe(AdvisoryLock.CommitWorker);
-  });
-
-  it('gives each tenant its own key for each lock, stable across calls and inside int4', () => {
-    const a = advisoryLockKey(AdvisoryLock.CommitWorker, 't_acme');
-    const b = advisoryLockKey(AdvisoryLock.CommitWorker, 't_globex');
-    expect(a).toBe(advisoryLockKey(AdvisoryLock.CommitWorker, 't_acme'));
-    expect(a).not.toBe(b);
-    expect(a).not.toBe(AdvisoryLock.CommitWorker);
-    // The two locks of one tenant stay two locks.
-    expect(advisoryLockKey(AdvisoryLock.Migrations, 't_acme')).not.toBe(a);
-    for (const key of [a, b]) {
-      expect(Number.isInteger(key)).toBe(true);
-      expect(key).toBeGreaterThanOrEqual(-(2 ** 31));
-      expect(key).toBeLessThanOrEqual(2 ** 31 - 1);
-    }
-  });
-});
+import { describe, it, expect } from 'vitest';
+import { AdvisoryLock, advisoryLockKey, withAdvisoryLock } from '../advisory-lock.js';
+import type { Database } from '../connection.js';
+
+/**
+ * A pool whose connections record what was asked of them. The SQL a lock
+ * issues IS its observable behaviour — there is nothing else to see from
+ * outside — so these suites drive `withAdvisoryLock` with a crafted pool and
+ * read back the statements and the release.
+ */
+interface RecordedClient {
+  queries: string[];
+  released: boolean;
+  releasedWith: Error | undefined;
+}
+
+function fakePool(opts: { failOn?: (sql: string) => Error; hangOn?: (sql: string) => boolean } = {}) {
+  const clients: RecordedClient[] = [];
+  const pool = {
+    async connect() {
+      const record: RecordedClient = { queries: [], released: false, releasedWith: undefined };
+      clients.push(record);
+      return {
+        async query(sql: string) {
+          record.queries.push(sql);
+          // A statement the database never answers: the promise stays pending.
+          if (opts.hangOn?.(sql)) return new Promise<never>(() => undefined);
+          const failure = opts.failOn?.(sql);
+          if (failure) throw failure;
+          return { rows: [] };
+        },
+        release(err?: Error) {
+          record.released = true;
+          record.releasedWith = err;
+        },
+      };
+    },
+  };
+  return { clients, db: { $client: pool } as unknown as Database };
+}
+
+/** The error shape `pg` raises when `lock_timeout` expires. */
+function lockTimeoutError(): Error {
+  return Object.assign(new Error('canceling statement due to lock timeout'), { code: '55P03' });
+}
+
+describe('withAdvisoryLock', () => {
+  it('holds the lock across the callback and releases it by ending the transaction', async () => {
+    const { clients, db } = fakePool();
+    let queriesWhenBodyRan: string[] = [];
+
+    const result = await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
+      queriesWhenBodyRan = [...clients[0].queries];
+      return 'migrated';
+    });
+
+    expect(result).toBe('migrated');
+    // The lock is taken before the body starts...
+    expect(queriesWhenBodyRan.some((q) => q.includes('pg_advisory_xact_lock'))).toBe(true);
+    expect(queriesWhenBodyRan).not.toContain('rollback');
+    // ...and the transaction that holds it ends after the body, which is what
+    // releases both the lock and the transaction-local lock_timeout.
+    expect(clients[0].queries.at(-1)).toBe('rollback');
+    expect(clients[0].released).toBe(true);
+    expect(clients[0].releasedWith).toBeUndefined();
+  });
+
+  it('bounds the wait rather than blocking the boot forever', async () => {
+    const { clients, db } = fakePool();
+
+    await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => undefined, { waitMs: 1234 });
+
+    // Transaction-local, so the setting leaves with the transaction and the
+    // connection goes back to the pool as it arrived.
+    const setTimeoutCall = clients[0].queries.find((q) => q.includes('set_config'));
+    expect(setTimeoutCall).toContain('lock_timeout');
+    expect(setTimeoutCall).toContain('true');
+  });
+
+  it('releases the lock when the callback throws, and propagates the failure', async () => {
+    const { clients, db } = fakePool();
+    const boom = new Error('migration 0004 failed');
+
+    await expect(
+      withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
+        throw boom;
+      }),
+    ).rejects.toBe(boom);
+
+    expect(clients[0].queries.at(-1)).toBe('rollback');
+    expect(clients[0].released).toBe(true);
+  });
+
+  it('never runs the callback when the lock cannot be taken in time', async () => {
+    const { clients, db } = fakePool({
+      failOn: (sql) => (sql.includes('pg_advisory_xact_lock') ? lockTimeoutError() : undefined!),
+    });
+    let ran = false;
+
+    await expect(
+      withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
+        ran = true;
+      }),
+    ).rejects.toThrow(/Migrations advisory lock/);
+
+    expect(ran).toBe(false);
+    // Still cleaned up: a failed acquire leaves an open transaction behind
+    // otherwise, and the connection would carry it back into the pool.
+    expect(clients[0].queries.at(-1)).toBe('rollback');
+    expect(clients[0].released).toBe(true);
+  });
+
+  it('fails the boot, and destroys the connection without rolling back, when the database stops answering', async () => {
+    // The socket is up, the server is gone: `begin` never returns. Waiting on
+    // a rollback would queue behind it and hang the boot after all.
+    const { clients, db } = fakePool({ hangOn: (sql) => sql === 'begin' });
+    let ran = false;
+    await expect(
+      withAdvisoryLock(
+        db,
+        AdvisoryLock.Migrations,
+        async () => {
+          ran = true;
+        },
+        { waitMs: 20 },
+      ),
+    ).rejects.toThrow(/did not answer/);
+    expect(ran).toBe(false);
+    expect(clients[0].queries).not.toContain('rollback');
+    expect(clients[0].released).toBe(true);
+    expect(clients[0].releasedWith).toBeInstanceOf(Error);
+  });
+
+  it('destroys a connection it could not roll back instead of pooling it', async () => {
+    const { clients, db } = fakePool({
+      failOn: (sql) => (sql === 'rollback' ? new Error('connection terminated') : undefined!),
+    });
+
+    await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => undefined);
+
+    // Releasing with an error is how `pg` is told to discard the connection.
+    // Ending its session is also what actually releases a lock we may still
+    // be holding, so this path is the fallback for the rollback itself failing.
+    expect(clients[0].released).toBe(true);
+    expect(clients[0].releasedWith).toBeInstanceOf(Error);
+  });
+});
+
+describe('advisoryLockKey', () => {
+  it('keeps the ids a single-tenant deployment always used when no tenant is named', () => {
+    expect(advisoryLockKey(AdvisoryLock.Migrations)).toBe(AdvisoryLock.Migrations);
+    expect(advisoryLockKey(AdvisoryLock.CommitWorker, '')).toBe(AdvisoryLock.CommitWorker);
+  });
+
+  it('gives each tenant its own key for each lock, stable across calls and inside int4', () => {
+    const a = advisoryLockKey(AdvisoryLock.CommitWorker, 't_acme');
+    const b = advisoryLockKey(AdvisoryLock.CommitWorker, 't_globex');
+    expect(a).toBe(advisoryLockKey(AdvisoryLock.CommitWorker, 't_acme'));
+    expect(a).not.toBe(b);
+    expect(a).not.toBe(AdvisoryLock.CommitWorker);
+    // The two locks of one tenant stay two locks.
+    expect(advisoryLockKey(AdvisoryLock.Migrations, 't_acme')).not.toBe(a);
+    for (const key of [a, b]) {
+      expect(Number.isInteger(key)).toBe(true);
+      expect(key).toBeGreaterThanOrEqual(-(2 ** 31));
+      expect(key).toBeLessThanOrEqual(2 ** 31 - 1);
+    }
+  });
+});

package/src/modules/database/__tests__/migrations-unqualified.test.ts

@@ -1,32 +1,32 @@
-import { describe, it, expect } from 'vitest';
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { coreMigrationsDir } from '../../../assets.js';
-
-/**
- * A knowledge base hosted beside others lives in a schema of its own, found
- * through `search_path`. A migration that spells `public.` runs against the
- * wrong schema there — creating the table in `public`, or guarding on a
- * constraint that lives elsewhere — and the tenant that runs it is the first
- * to find out. So no migration may name a schema: this reads every file the
- * runner would, so the rule cannot be forgotten by the next one.
- */
-describe('core migrations', () => {
-  it('never qualify a table with a schema', async () => {
-    const dir = coreMigrationsDir();
-    const files = (await fs.readdir(dir)).filter((name) => name.endsWith('.sql')).sort();
-    expect(files.length).toBeGreaterThan(0);
-    const offenders: string[] = [];
-    for (const name of files) {
-      const text = await fs.readFile(path.join(dir, name), 'utf8');
-      text.split('\n').forEach((line, i) => {
-        // Bare (`public.users`) and quoted (`"public"."users"`) alike: the
-        // quoted spelling is what drizzle generates, and it is what a live
-        // two-tenant run found still pointing every tenant's foreign keys at
-        // a `public.users` that does not exist there.
-        if (/\bpublic"?\./.test(line)) offenders.push(`${name}:${i + 1}: ${line.trim()}`);
-      });
-    }
-    expect(offenders).toEqual([]);
-  });
-});
+import { describe, it, expect } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { coreMigrationsDir } from '../../../assets.js';
+
+/**
+ * A knowledge base hosted beside others lives in a schema of its own, found
+ * through `search_path`. A migration that spells `public.` runs against the
+ * wrong schema there — creating the table in `public`, or guarding on a
+ * constraint that lives elsewhere — and the tenant that runs it is the first
+ * to find out. So no migration may name a schema: this reads every file the
+ * runner would, so the rule cannot be forgotten by the next one.
+ */
+describe('core migrations', () => {
+  it('never qualify a table with a schema', async () => {
+    const dir = coreMigrationsDir();
+    const files = (await fs.readdir(dir)).filter((name) => name.endsWith('.sql')).sort();
+    expect(files.length).toBeGreaterThan(0);
+    const offenders: string[] = [];
+    for (const name of files) {
+      const text = await fs.readFile(path.join(dir, name), 'utf8');
+      text.split('\n').forEach((line, i) => {
+        // Bare (`public.users`) and quoted (`"public"."users"`) alike: the
+        // quoted spelling is what drizzle generates, and it is what a live
+        // two-tenant run found still pointing every tenant's foreign keys at
+        // a `public.users` that does not exist there.
+        if (/\bpublic"?\./.test(line)) offenders.push(`${name}:${i + 1}: ${line.trim()}`);
+      });
+    }
+    expect(offenders).toEqual([]);
+  });
+});

package/src/modules/database/core-schema.ts

@@ -1,5 +1,5 @@
 /**
- * CORE platform tables — the git-backed workspace/workflow, auth, access,
+ * CORE platform tables — the git-backed workspace and version control, auth, access,
  * change requests, locks, the pending-commits queue, connection keys, MCP
  * OAuth, the Secrets Vault, and the embed's Atlassian account links. A
  * core-only deployment migrates and runs on exactly these tables.
@@ -323,7 +323,7 @@ export const fileLocks = pgTable('file_locks', {
   holderName: encryptedText('holder_name').notNull(),
   // How the lock was acquired. 'edit' (the default) is a normal write hold —
   // the holder is editing and the release publishes their bytes.
-  // 'coordination' is a pure-mutex hold (see IWorkflowService.acquireLock)
+  // 'coordination' is a pure-mutex hold (see IVersionControlService.acquireLock)
   // that grants NO write authority. Persisted on the row — not inferred at
   // release time — so the write/checkpoint/commit-enqueue paths can refuse
   // to treat a coordination hold as write possession for as long as the row

package/src/modules/diff/__tests__/diff.routes.read-gate.test.ts

@@ -2,7 +2,7 @@ import type { Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 import express from 'express';
 import { describe, it, expect, afterEach, vi } from 'vitest';
-import type { IWorkflowService } from '@bevel-software/platform-shared';
+import type { IVersionControlService } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { AuthService } from '../../auth/auth.service.js';
 import type { IDiffService } from '../diff.interface.js';
@@ -46,7 +46,7 @@ async function makeHarness(opts: {
     (req as unknown as { userId: string }).userId = USER.id;
     next();
   });
-  app.use('/api', createDiffRoutes(diffService, authService, {} as unknown as IWorkflowService, accessControl, KB));
+  app.use('/api', createDiffRoutes(diffService, authService, {} as unknown as IVersionControlService, accessControl, KB));
   const server = await new Promise<Server>((resolve) => {
     const s = app.listen(0, () => resolve(s));
   });

package/src/modules/diff/__tests__/diff.routes.rejectPathsLocked.test.ts

@@ -2,10 +2,10 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared';
+import type { AuthUser, IVersionControlService } from '@bevel-software/platform-shared';
 import type { IDiffService } from '../diff.interface.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
-import { WorkflowValidationError } from '../../../shared/domain-errors.js';
+import { VersionControlValidationError } from '../../../shared/domain-errors.js';
 import { rejectPathsLocked } from '../diff.routes.js';
 
 /**
@@ -21,7 +21,7 @@ const BRANCH = 'alice/revert-test';
 const WORKSPACE_ID = workspaceIdForBranch(BRANCH);
 
 interface Harness {
-  workflow: IWorkflowService;
+  versionControl: IVersionControlService;
   diff: IDiffService;
   calls: string[];
   workspaceDir: string;
@@ -56,7 +56,7 @@ async function makeHarness(overrides: {
     overrides.commit?.();
     return { sha: 'abc', summary } as never;
   });
-  const workflow = { acquireLock, releaseLockNoCommit, commitChanges } as unknown as IWorkflowService;
+  const versionControl = { acquireLock, releaseLockNoCommit, commitChanges } as unknown as IVersionControlService;
 
   const revertPlan = vi.fn(async (_ws: string, paths: string[]) => ({
     workspaceDir,
@@ -66,7 +66,7 @@ async function makeHarness(overrides: {
     deletes: paths.filter((p) => p.endsWith('added.md')),
   }));
   const diff = { revertPlan } as unknown as IDiffService;
-  return { workflow, diff, calls, workspaceDir };
+  return { versionControl, diff, calls, workspaceDir };
 }
 
 describe('rejectPathsLocked', () => {
@@ -82,7 +82,7 @@ describe('rejectPathsLocked', () => {
     const h = await makeHarness();
     workspaceDir = h.workspaceDir;
 
-    await rejectPathsLocked(h.workflow, h.diff, WORKSPACE_ID, USER, 'knowledge-base', [
+    await rejectPathsLocked(h.versionControl, h.diff, WORKSPACE_ID, USER, 'knowledge-base', [
       'knowledge-base/a.md',
       'knowledge-base/added.md',
     ]);
@@ -104,7 +104,7 @@ describe('rejectPathsLocked', () => {
     const h = await makeHarness();
     workspaceDir = h.workspaceDir;
     await expect(
-      rejectPathsLocked(h.workflow, h.diff, WORKSPACE_ID, USER, 'knowledge-base', []),
+      rejectPathsLocked(h.versionControl, h.diff, WORKSPACE_ID, USER, 'knowledge-base', []),
     ).resolves.toBeUndefined();
     expect(h.calls).toEqual([]);
   });
@@ -119,11 +119,11 @@ describe('rejectPathsLocked', () => {
     workspaceDir = h.workspaceDir;
 
     await expect(
-      rejectPathsLocked(h.workflow, h.diff, WORKSPACE_ID, USER, 'knowledge-base', [
+      rejectPathsLocked(h.versionControl, h.diff, WORKSPACE_ID, USER, 'knowledge-base', [
         'knowledge-base/a.md',
         'knowledge-base/added.md',
       ]),
-    ).rejects.toBeInstanceOf(WorkflowValidationError);
+    ).rejects.toBeInstanceOf(VersionControlValidationError);
 
     // No commit landed and the disk is untouched — the batch is atomic.
     expect(h.calls.some((c) => c.startsWith('commit:'))).toBe(false);
@@ -131,7 +131,7 @@ describe('rejectPathsLocked', () => {
     await expect(fs.access(path.join(h.workspaceDir, 'knowledge-base/added.md'))).resolves.toBeUndefined();
   }, 15_000);
 
-  it('surfaces a commit failure as a WorkflowValidationError and releases without committing', async () => {
+  it('surfaces a commit failure as a VersionControlValidationError and releases without committing', async () => {
     const h = await makeHarness({
       commit: () => {
         throw new Error('push rejected');
@@ -140,10 +140,10 @@ describe('rejectPathsLocked', () => {
     workspaceDir = h.workspaceDir;
 
     await expect(
-      rejectPathsLocked(h.workflow, h.diff, WORKSPACE_ID, USER, 'knowledge-base', [
+      rejectPathsLocked(h.versionControl, h.diff, WORKSPACE_ID, USER, 'knowledge-base', [
         'knowledge-base/a.md',
       ]),
-    ).rejects.toBeInstanceOf(WorkflowValidationError);
+    ).rejects.toBeInstanceOf(VersionControlValidationError);
     // Locks were dropped via the no-commit path after the failure.
     expect(h.calls.filter((c) => c.startsWith('releaseNoCommit:'))).toHaveLength(1);
   });

package/src/modules/diff/diff.routes.ts

@@ -1,10 +1,10 @@
 import express from 'express';
-import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared';
+import type { AuthUser, IVersionControlService } from '@bevel-software/platform-shared';
 import type { IDiffService } from './diff.interface.js';
 import type { AuthService } from '../auth/index.js';
 import type { IAccessControl } from '../access/index.js';
 import { canReadWorkspacePath, toKbRelative, resolveReadableMap } from '../access-model/index.js';
-import { WorkflowDomainError, WorkflowValidationError } from '../../shared/domain-errors.js';
+import { VersionControlDomainError, VersionControlValidationError } from '../../shared/domain-errors.js';
 import { domainErrorBody } from '../../shared/http-errors.js';
 import { LockingFilesystem } from '../kb-fs/index.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
@@ -13,7 +13,7 @@ import '../auth/index.js';
 function toHttpError(
   err: unknown,
 ): { status: number; body: Record<string, unknown> } {
-  if (err instanceof WorkflowDomainError) {
+  if (err instanceof VersionControlDomainError) {
     return { status: err.status, body: domainErrorBody(err) };
   }
   const message = err instanceof Error ? err.message : 'Unknown error';
@@ -39,7 +39,7 @@ function toHttpError(
  * the first disk mutation, so a restore can never race a concurrent editor.
  */
 export async function rejectPathsLocked(
-  workflowService: IWorkflowService,
+  versionControlService: IVersionControlService,
   diffService: IDiffService,
   workspaceId: string,
   user: AuthUser,
@@ -53,7 +53,7 @@ export async function rejectPathsLocked(
   if (total === 0) return;
   const lockingFs = new LockingFilesystem(
     { basePath: plan.workspaceDir, contained: true },
-    { workflow: workflowService, workspaceId, branch, user, kbDirName },
+    { versionControl: versionControlService, workspaceId, branch, user, kbDirName },
   );
   try {
     await lockingFs.writeFiles(
@@ -71,7 +71,7 @@ export async function rejectPathsLocked(
     const reason = contended
       ? `"${contended[1]}" is being edited by ${contended[2]}`
       : raw.replace(/\.\s*$/, '');
-    throw new WorkflowValidationError(
+    throw new VersionControlValidationError(
       `Couldn't revert: ${reason}. No changes were committed — try again when the files are free.`,
     );
   }
@@ -88,7 +88,7 @@ export async function rejectPathsLocked(
 export function createDiffRoutes(
   diffService: IDiffService,
   authService: AuthService,
-  workflowService: IWorkflowService,
+  versionControlService: IVersionControlService,
   accessControl: IAccessControl,
   kbDirName: string,
 ): express.Router {
@@ -268,7 +268,7 @@ export function createDiffRoutes(
           current?.changes.map((c) => c.path) ?? [],
         );
       }
-      await rejectPathsLocked(workflowService, diffService, req.params.id, user, kbDirName, paths);
+      await rejectPathsLocked(versionControlService, diffService, req.params.id, user, kbDirName, paths);
       res.json({ session: await diffService.currentSession(req.params.id) });
     } catch (err) {
       const { status, body } = toHttpError(err);

package/src/modules/embed/__tests__/embed.service.lock.test.ts

@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { AuthUser } from '@bevel-software/platform-shared';
-import { FileLockService } from '../../workflow/file-lock.service.js';
-import { makeFakeLockDb, type FakeLockDb } from '../../workflow/__tests__/fake-file-lock-db.js';
+import { FileLockService } from '../../version-control/file-lock.service.js';
+import { makeFakeLockDb, type FakeLockDb } from '../../version-control/__tests__/fake-file-lock-db.js';
 import { createFileReaderRegistry } from '../../workspace/file-readers/file-reader.registry.js';
 import type { DocExtractOutcome, DocExtractService } from '../../workspace/file-readers/doc-extract.service.js';
 import { makeRolesYamlWriteValidator } from '../../access-model/roles-yaml-guard.js';
@@ -19,8 +19,8 @@ import { EmbedLockedError } from '../embed.errors.js';
  * shares the human's user id, and must not steal their edit). On a real boot
  * every Save from the embed answered 409 against the writer's own Edit lock.
  *
- * So the lock half of the workflow service here is the real `FileLockService`
- * over the in-memory `file_locks` table the workflow suites use — the
+ * So the lock half of the version-control service here is the real `FileLockService`
+ * over the in-memory `file_locks` table the version-control suites use — the
  * contention rules come from the code that enforces them.
  */
 
@@ -55,7 +55,7 @@ function build() {
   };
   // The lock verbs go straight to the real service; release drops the row as
   // the real `releaseLock` does once it has enqueued the commit.
-  const workflowService = {
+  const versionControlService = {
     getLock: vi.fn((id: string, branch: string, path: string) => locks.get(id, branch, path)),
     acquireLock: vi.fn((id: string, branch: string, path: string, user: AuthUser) =>
       locks.acquire(id, branch, path, user),
@@ -80,13 +80,13 @@ function build() {
       isEmailDomainAllowed: () => true,
       isActive: async () => true,
     } as never,
-    workflowService as never,
+    versionControlService as never,
     { remoteBranchExists: async () => false } as never,
     { getUserId: async () => null } as never,
     createFileReaderRegistry(noDocExtract()),
     makeRolesYamlWriteValidator(KB),
   );
-  return { service, workspaceService, workflowService };
+  return { service, workspaceService, versionControlService };
 }
 
 beforeEach(() => {