@bevel-software/platform-core-backend 0.35.0 → 0.36.1

package/dist/modules/{workflow → version-control}/git/git.service.js

@@ -10,7 +10,7 @@ import { utf8Text } from '../../../shared/utf8-text.js';
 import { lstatOrNull } from '../../../shared/rename-no-replace.js';
 import { linkedAncestor } from '../../../shared/no-link-below.js';
 import { assertValidBranchName, assertValidRelativePath, isBranchAuthoredBy, isOwnSuggestionsBranch, } from '../../kb-fs/index.js';
-import { AppliedChangeMismatchError, BranchAuthorshipError, BranchDeleteRefusedError, WorkflowDomainError, WorkflowValidationError, ProtectedBranchError, PullRebaseConflictError, RemoteBranchGoneError, VersionNotOnBranchError, isMissingRemoteBranchFailure, } from '../../../shared/domain-errors.js';
+import { AppliedChangeMismatchError, BranchAuthorshipError, BranchDeleteRefusedError, VersionControlDomainError, VersionControlValidationError, ProtectedBranchError, PullRebaseConflictError, RemoteBranchGoneError, VersionNotOnBranchError, isMissingRemoteBranchFailure, } from '../../../shared/domain-errors.js';
 import { GitRunError, assertOneSpecPerLine, redactGitToken, } from '../../../shared/git.contract.js';
 import { NodeGitRunner } from './node-git-runner.js';
 import { printable } from '../../../shared/printable.js';
@@ -19,7 +19,7 @@ import { sanitizeError } from '../sanitize-error.js';
 const log = logger('git');
 const crLog = logger('cr');
 /**
- * Fallback committer identity. Every workflow commit overrides the author via
+ * Fallback committer identity. Every version-control commit overrides the author via
  * `--author=…` so the real human shows up in `git log`; this is just the
  * committer git records need. Mirrors the value `WorkspaceService` stamps on
  * each clone — set again where an operation must not depend on that ambient
@@ -99,13 +99,13 @@ function buildDefaultCommitSummary(repoRelativePath) {
 }
 function assertValidAuthor(user) {
     if (!user.name || !user.email) {
-        throw new WorkflowValidationError('commit author name and email are required');
+        throw new VersionControlValidationError('commit author name and email are required');
     }
     if (/[\r\n<>]/.test(user.name)) {
-        throw new WorkflowValidationError('commit author name contains invalid characters');
+        throw new VersionControlValidationError('commit author name contains invalid characters');
     }
     if (/[\r\n<>\s]/.test(user.email) || !/^[^@\s]+@[^@\s]+$/.test(user.email)) {
-        throw new WorkflowValidationError('commit author email is not a valid address');
+        throw new VersionControlValidationError('commit author email is not a valid address');
     }
 }
 /**
@@ -260,7 +260,7 @@ export class GitService {
     static CHANGED_ENTRIES_MAX = 4096;
     constructor(workspaceService, 
     /**
-     * Workflow lifecycle hooks. This service only consults the ADVISORY
+     * Version-control lifecycle hooks. This service only consults the ADVISORY
      * `commitValidation` hooks (registered by the enterprise kb module in the
      * composition root — the constructor-injected `IKbValidator` this
      * replaced). No hooks registered = no commit-time validation, which is
@@ -705,7 +705,7 @@ export class GitService {
             const cwd = await this.repoDir(workspaceId);
             const current = await this.currentBranch(cwd);
             if (current === name) {
-                throw new WorkflowValidationError(`Cannot delete "${name}" while it's the checked-out branch.`);
+                throw new VersionControlValidationError(`Cannot delete "${name}" while it's the checked-out branch.`);
             }
             if (opts.systemCleanup) {
                 // Internal post-merge retirement (never reachable from a route): the
@@ -719,7 +719,7 @@ export class GitService {
                 // not just their own — but keep the "refuse if origin still has the
                 // ref" safety: a present remote means the branch is still live.
                 if (await this.refExists(cwd, `refs/remotes/origin/${name}`)) {
-                    throw new WorkflowValidationError(`Branch "${name}" still exists on origin — refusing to auto-prune.`);
+                    throw new VersionControlValidationError(`Branch "${name}" still exists on origin — refusing to auto-prune.`);
                 }
             }
             else if (!(await this.mayDeleteBranch(workspaceId, name, user))) {
@@ -892,12 +892,12 @@ export class GitService {
     async commit(workspaceId, user, req) {
         const subject = req.summary?.trim();
         if (!subject)
-            throw new WorkflowValidationError('commit summary is required');
+            throw new VersionControlValidationError('commit summary is required');
         if (subject.length > 200) {
-            throw new WorkflowValidationError('commit summary must be ≤ 200 characters');
+            throw new VersionControlValidationError('commit summary must be ≤ 200 characters');
         }
         if (subject.includes('\n')) {
-            throw new WorkflowValidationError('commit summary must be a single line');
+            throw new VersionControlValidationError('commit summary must be a single line');
         }
         assertValidAuthor(user);
         return this.mutex.run(workspaceId, async () => {
@@ -915,12 +915,12 @@ export class GitService {
             ]);
             const touched = parsePorcelainZ(porcelain);
             if (touched.length === 0) {
-                throw new WorkflowValidationError('No pending changes to commit', {
+                throw new VersionControlValidationError('No pending changes to commit', {
                     kind: 'no-pending-changes',
                 });
             }
             if (touched.length > 1) {
-                throw new WorkflowValidationError(`Each change must affect exactly one file. ${touched.length} files are currently pending: ${touched.join(', ')}. Commit them one at a time.`, { kind: 'too-many-files-dirty', paths: touched });
+                throw new VersionControlValidationError(`Each change must affect exactly one file. ${touched.length} files are currently pending: ${touched.join(', ')}. Commit them one at a time.`, { kind: 'too-many-files-dirty', paths: touched });
             }
             // Gate by access-control rules — but ONLY on protected branches.
             // Feature/draft branches are free-for-all: anyone can commit anything
@@ -1047,7 +1047,7 @@ export class GitService {
             // **No access check at commit time.** Per the "disk is the source of
             // truth" rule, by the time content is on disk it must not be rejected.
             // The permission check that used to live here now runs at lock
-            // acquisition (see `WorkflowService.acquireLock`'s
+            // acquisition (see `VersionControlService.acquireLock`'s
             // `assertCanWriteAtPath`), so a user can't even start editing a file
             // they lack write permission on — they never reach this commit. The
             // legacy gate could destroy a user's edits when access changed
@@ -1069,10 +1069,10 @@ export class GitService {
             await this.git(cwd, ['add', '--', repoRelativePath]);
             const subject = summary?.trim() || buildDefaultCommitSummary(repoRelativePath);
             if (subject.length > 200) {
-                throw new WorkflowValidationError('commit summary must be ≤ 200 characters');
+                throw new VersionControlValidationError('commit summary must be ≤ 200 characters');
             }
             if (subject.includes('\n')) {
-                throw new WorkflowValidationError('commit summary must be a single line');
+                throw new VersionControlValidationError('commit summary must be a single line');
             }
             await this.git(cwd, [
                 'commit',
@@ -1119,11 +1119,11 @@ export class GitService {
         assertValidAuthor(user);
         const subject = summary?.trim();
         if (!subject)
-            throw new WorkflowValidationError('commit summary is required');
+            throw new VersionControlValidationError('commit summary is required');
         if (subject.length > 200)
-            throw new WorkflowValidationError('commit summary must be ≤ 200 characters');
+            throw new VersionControlValidationError('commit summary must be ≤ 200 characters');
         if (subject.includes('\n'))
-            throw new WorkflowValidationError('commit summary must be a single line');
+            throw new VersionControlValidationError('commit summary must be a single line');
         return this.mutex.run(workspaceId, async () => {
             const cwd = await this.repoDir(workspaceId);
             const branch = await this.currentBranch(cwd);
@@ -1289,7 +1289,7 @@ export class GitService {
             }
         }
     }
-    // `forcePush` method removed. The workflow layer no longer auto-force-pushes
+    // `forcePush` method removed. The version-control layer no longer auto-force-pushes
     // as a recovery — when the cooperative `pull --rebase` + retry can't
     // reconcile, we throw `PushNeedsAgentResolutionError` and hand off to the
     // agent. The agent has git + gh CLI access and can choose to run a raw
@@ -1301,7 +1301,7 @@ export class GitService {
     // automatic-recovery path.
     /**
      * Attempt a local merge of `origin/<targetBranch>` into the currently-
-     * checked-out branch. Used by the workflow module to auto-merge target →
+     * checked-out branch. Used by the version-control module to auto-merge target →
      * source when a change request is opened or refreshed (PLAN §1).
      *
      * Two outcomes:
@@ -1350,7 +1350,7 @@ export class GitService {
         assertValidBranchName(fromBranch);
         assertValidAuthor(user);
         if (/\n\s*\n/.test(opts.subject)) {
-            throw new WorkflowValidationError('merge commit subject must be a single paragraph');
+            throw new VersionControlValidationError('merge commit subject must be a single paragraph');
         }
         // Every resolution names a repository path; which of them are conflicted
         // is only known inside the merge, where they are matched exactly.
@@ -1365,13 +1365,13 @@ export class GitService {
             const p = this.stripRepoPrefix(r.path);
             const ways = [r.content !== undefined, r.choose !== undefined].filter(Boolean).length;
             if (ways !== 1) {
-                throw new WorkflowValidationError(`resolution for "${p}": give either \`content\` or \`choose\`, not ${ways === 0 ? 'neither' : 'both'}`);
+                throw new VersionControlValidationError(`resolution for "${p}": give either \`content\` or \`choose\`, not ${ways === 0 ? 'neither' : 'both'}`);
             }
             if (r.choose !== undefined && !['ours', 'theirs', 'delete'].includes(r.choose)) {
-                throw new WorkflowValidationError(`resolution for "${p}": \`choose\` is \`ours\`, \`theirs\` or \`delete\``);
+                throw new VersionControlValidationError(`resolution for "${p}": \`choose\` is \`ours\`, \`theirs\` or \`delete\``);
             }
             if (resolutions.has(p))
-                throw new WorkflowValidationError(`"${p}" is resolved twice`);
+                throw new VersionControlValidationError(`"${p}" is resolved twice`);
             resolutions.set(p, { ...r, path: p });
         }
         return this.mutex.run(workspaceId, async () => this.mergeRefIntoCheckout(workspaceId, await this.repoDir(workspaceId), branch, fromBranch, user, {
@@ -1400,7 +1400,7 @@ export class GitService {
      *
      * `publish` runs over the merge commit inside this same reservation, so no
      * save or sync can land between the commit and its push; it is the
-     * caller's push policy (the workflow's `pushWithRecovery`: one replay onto
+     * caller's push policy (the version-control service's `pushWithRecovery`: one replay onto
      * the moved branch with the merge kept, `--rebase-merges`, then the typed
      * hand-off) over this checkout's own unlocked moves.
      */
@@ -1409,14 +1409,14 @@ export class GitService {
         if (opts.guardCheckout) {
             const checkedOut = await this.currentBranch(cwd);
             if (checkedOut !== branch) {
-                throw new WorkflowValidationError(`the workspace is on "${checkedOut}", not on "${branch}"`);
+                throw new VersionControlValidationError(`the workspace is on "${checkedOut}", not on "${branch}"`);
             }
             // A merge rewrites tracked files. Edits still on their way to a commit
             // (a save the worker has not landed) would be swept into the merge
             // commit under this user's name, or lost under the merge's version.
             const { stdout: dirty } = await this.git(cwd, ['status', '--porcelain=v1', '-z']);
             if (parsePorcelainZ(dirty).length > 0) {
-                throw new WorkflowDomainError(`"${branch}" has edits that are not committed yet. Try again once they are saved.`, 409, { kind: 'branch-busy', branch });
+                throw new VersionControlDomainError(`"${branch}" has edits that are not committed yet. Try again once they are saved.`, 409, { kind: 'branch-busy', branch });
             }
         }
         // `git merge`/`git commit` need a committer identity (see `mergeChangeRequest`).
@@ -1440,7 +1440,7 @@ export class GitService {
         // A merge with nothing to settle leaves no resolution a place to go: one
         // supplied anyway names a path that is not conflicted, and is refused as
         // such rather than dropped on the floor behind a published merge.
-        const noConflictsFor = () => new WorkflowValidationError(`nothing conflicted, so nothing is resolved here: ${[...opts.resolutions.keys()].join(', ')}.`, { kind: 'not-conflicted', paths: [...opts.resolutions.keys()] });
+        const noConflictsFor = () => new VersionControlValidationError(`nothing conflicted, so nothing is resolved here: ${[...opts.resolutions.keys()].join(', ')}.`, { kind: 'not-conflicted', paths: [...opts.resolutions.keys()] });
         // Nothing to merge is a question of ANCESTRY, not of content: a source
         // the branch already reaches is merged; one it does not reach is merged
         // in even when the two trees are identical, so the branch records that
@@ -1468,7 +1468,7 @@ export class GitService {
                     // locks. Refused whole, before any resolution is applied — naming
                     // the caller's own paths only, never the conflicted set (which the
                     // caller is told of, cut to what they may read, by the answer).
-                    throw new WorkflowValidationError(`not conflicted, so not resolved here: ${stray.join(', ')}.`, { kind: 'not-conflicted', paths: stray });
+                    throw new VersionControlValidationError(`not conflicted, so not resolved here: ${stray.join(', ')}.`, { kind: 'not-conflicted', paths: stray });
                 }
                 const unresolved = conflicted.filter((p) => !opts.resolutions.has(p));
                 if (unresolved.length > 0) {
@@ -1640,7 +1640,7 @@ export class GitService {
         // the way that is a link is refused, and a path that is itself a link is
         // replaced as a path (the link removed first), never written through.
         if ((await linkedAncestor(cwd, path.dirname(file))) !== null) {
-            throw new WorkflowValidationError(`"${r.path}" is reached through a link, so it is not resolved here`);
+            throw new VersionControlValidationError(`"${r.path}" is reached through a link, so it is not resolved here`);
         }
         if (r.content !== undefined) {
             if ((await lstatOrNull(file))?.isSymbolicLink())
@@ -1718,7 +1718,7 @@ export class GitService {
         // `mergeCommitSubject` already flattens the title it builds from; this is the
         // guard that keeps any other caller from reintroducing the break.
         if (/\n\s*\n/.test(commit.subject)) {
-            throw new WorkflowValidationError('merge commit subject must be a single paragraph');
+            throw new VersionControlValidationError('merge commit subject must be a single paragraph');
         }
         const MAX_ATTEMPTS = 3;
         return this.mutex.run(baseWorkspaceId, async () => {
@@ -1733,7 +1733,7 @@ export class GitService {
                 const { stdout: dirty } = await this.git(cwd, ['status', '--porcelain=v1', '-z']);
                 const unpushed = await this.hasUnpushedCommitsAt(cwd);
                 if (parsePorcelainZ(dirty).length > 0 || unpushed) {
-                    throw new WorkflowDomainError(`"${targetBranch}" has edits that are not shared yet. Try the merge again once they are saved.`, 409, { kind: 'merge-target-busy', targetBranch });
+                    throw new VersionControlDomainError(`"${targetBranch}" has edits that are not shared yet. Try the merge again once they are saved.`, 409, { kind: 'merge-target-busy', targetBranch });
                 }
             }
             for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt += 1) {
@@ -2108,7 +2108,7 @@ export class GitService {
     }
     /**
      * Rebase the checked-out branch onto `remoteRef`, turning a content
-     * conflict into the typed error the workflow layer queues recovery for.
+     * conflict into the typed error the version-control layer queues recovery for.
      * Shared by `pull` and `syncFromRemote` so the two cannot drift.
      */
     async rebaseOntoRemote(cwd, branch, remoteRef, opts = {}) {
@@ -2183,7 +2183,7 @@ export class GitService {
                 abortSucceeded = false;
             });
             if (abortSucceeded && conflictedPaths.length > 0) {
-                // Typed so the workflow layer can queue background recovery — this
+                // Typed so the version-control layer can queue background recovery — this
                 // divergence never resolves on its own (every retry pull hits the
                 // same conflict) and the unpushed local commits are someone's saved
                 // content stuck violating save=share.
@@ -2620,7 +2620,7 @@ export class GitService {
                     // Only the genuinely empty separator lines are skipped.
                     const touched = nameLine.endsWith('\r') ? nameLine.slice(0, -1) : nameLine;
                     if (touched && touched !== repoRelativePath) {
-                        throw new WorkflowValidationError(`"${relativePath}" is a directory at that point in history — history is served per file`);
+                        throw new VersionControlValidationError(`"${relativePath}" is a directory at that point in history — history is served per file`);
                     }
                 }
             }
@@ -2648,7 +2648,7 @@ export class GitService {
     async diffFileAtCommit(workspaceId, relativePath, sha) {
         assertValidRelativePath(relativePath);
         if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-            throw new WorkflowValidationError('invalid commit sha');
+            throw new VersionControlValidationError('invalid commit sha');
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {
@@ -2696,7 +2696,7 @@ export class GitService {
     async fileContentsAtCommit(workspaceId, relativePath, sha) {
         assertValidRelativePath(relativePath);
         if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-            throw new WorkflowValidationError('invalid commit sha');
+            throw new VersionControlValidationError('invalid commit sha');
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {
@@ -2732,7 +2732,7 @@ export class GitService {
         assertValidBranchName(fromBranch);
         assertValidBranchName(toBranch);
         if (fromBranch === toBranch) {
-            throw new WorkflowValidationError('from and to branches must differ');
+            throw new VersionControlValidationError('from and to branches must differ');
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {
@@ -2850,7 +2850,7 @@ export class GitService {
         if (opts.at) {
             for (const sha of [opts.at.baseSha, opts.at.headSha]) {
                 if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-                    throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+                    throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
                 }
             }
         }
@@ -2963,7 +2963,7 @@ export class GitService {
      * side for a merge commit, and for a squashed or fast-forwarded commit it is
      * simply the commit before — the same answer either way.
      *
-     * Throws `WorkflowValidationError` whenever the recorded commit cannot be
+     * Throws `VersionControlValidationError` whenever the recorded commit cannot be
      * PROVEN to be this request's own merge commit — see
      * {@link appliedChangeShas}. Every caller reads that as "the file set could
      * not be resolved" and falls back to its own fail-closed answer, which is what
@@ -2973,7 +2973,7 @@ export class GitService {
     async appliedEnds(cwd, applied) {
         const { mergeSha, number } = applied;
         if (!/^[0-9a-f]{40,64}$/.test(mergeSha)) {
-            throw new WorkflowValidationError(`invalid commit sha: ${mergeSha}`);
+            throw new VersionControlValidationError(`invalid commit sha: ${mergeSha}`);
         }
         const revParse = async (rev) => {
             try {
@@ -2998,7 +2998,7 @@ export class GitService {
         // or a message that does not name the request) never becomes it, and is
         // reported as a mismatch the caller may remember.
         if (!(await revParse(`${mergeSha}^{commit}`))) {
-            throw new WorkflowValidationError(`commit ${mergeSha} is not in this clone, so change request #${number} cannot be read from it yet`);
+            throw new VersionControlValidationError(`commit ${mergeSha} is not in this clone, so change request #${number} cannot be read from it yet`);
         }
         // The SECOND parent first, because its absence is the whole P1: a merge
         // `--no-ff` always has one, and a commit that does not is not a merge this
@@ -3125,7 +3125,7 @@ export class GitService {
         // concurrent `fetch --prune origin` (`ensureRemotesFetched` and
         // `fetchPrRefs` both run outside this mutex, deliberately) can drop a
         // remote-tracking ref between the two, and re-resolving inside the mutex
-        // would then throw `WorkflowValidationError` — which `touchedPathsFor`
+        // would then throw `VersionControlValidationError` — which `touchedPathsFor`
         // swallows into an empty touched-path set, i.e. exactly the change
         // request missing from its own author's tree that the skip is guarded
         // against. The commits stay readable whatever happens to the ref names.
@@ -3274,7 +3274,7 @@ export class GitService {
     async forkPointForPr(workspaceId, at) {
         for (const sha of [at.baseSha, at.headSha]) {
             if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-                throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+                throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
             }
         }
         const cwd = await this.repoDir(workspaceId);
@@ -3314,7 +3314,7 @@ export class GitService {
     async pathsChangedBetween(workspaceId, fromSha, toSha) {
         for (const sha of [fromSha, toSha]) {
             if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-                throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+                throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
             }
         }
         const cwd = await this.repoDir(workspaceId);
@@ -3339,7 +3339,7 @@ export class GitService {
         assertValidBranchName(baseBranch);
         assertValidRelativePath(relativePath);
         if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-            throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+            throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {
@@ -3350,7 +3350,7 @@ export class GitService {
             }
             catch (err) {
                 if (err.exitCode === 1) {
-                    throw new WorkflowDomainError(`That commit is not part of "${baseBranch}" — it is not this request's fork point.`, 404);
+                    throw new VersionControlDomainError(`That commit is not part of "${baseBranch}" — it is not this request's fork point.`, 404);
                 }
                 throw err;
             }
@@ -3532,7 +3532,7 @@ export class GitService {
             return await this.publishedPrEnds(cwd, baseBranch, headBranch);
         }
         catch (err) {
-            if (err instanceof WorkflowValidationError)
+            if (err instanceof VersionControlValidationError)
                 return null;
             throw err;
         }
@@ -3584,7 +3584,7 @@ export class GitService {
                     throw err;
             }
         }
-        throw new WorkflowValidationError(`unknown branch: ${branch}`);
+        throw new VersionControlValidationError(`unknown branch: ${branch}`);
     }
     /**
      * Every commit `branch` resolves to in this repository — its local head
@@ -3623,7 +3623,7 @@ export class GitService {
                 // Try the next candidate.
             }
         }
-        throw new WorkflowValidationError(`unknown branch: ${branch}`);
+        throw new VersionControlValidationError(`unknown branch: ${branch}`);
     }
     // ── internals ──────────────────────────────────────────────────────────
     async statusInternal(workspaceId) {
@@ -3759,7 +3759,7 @@ export class GitService {
             throw err;
         }
         if (kind === 'tree') {
-            throw new WorkflowValidationError(`"${displayPath}" is a directory at that point in history — history is served per file`);
+            throw new VersionControlValidationError(`"${displayPath}" is a directory at that point in history — history is served per file`);
         }
     }
     async readFileAtRef(workspaceId, ref, repoRelativePath) {
@@ -3899,7 +3899,7 @@ export class GitService {
     async fileBytesAtCommit(workspaceId, relativePath, sha, side) {
         assertValidRelativePath(relativePath);
         if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-            throw new WorkflowValidationError('invalid commit sha');
+            throw new VersionControlValidationError('invalid commit sha');
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {