@bevel-software/platform-core-backend 0.35.0 → 0.36.1

package/src/modules/access/__tests__/admin-route-helpers.test.ts

@@ -1,14 +1,14 @@
 import { describe, it, expect, vi, afterEach } from 'vitest';
 
 import { toHttpError, requireNonEmptyString } from '../admin-route-helpers.js';
-import { WorkflowDomainError } from '../../../shared/domain-errors.js';
+import { VersionControlDomainError } from '../../../shared/domain-errors.js';
 import { AccessMutationError } from '../access-mutation.service.js';
 
 describe('toHttpError — the shared access-family error shape', () => {
   afterEach(() => vi.restoreAllMocks());
 
   it('a sub-500 domain error keeps its status, message, and payload', () => {
-    const err = new WorkflowDomainError('groups are being edited', 409, { kind: 'idp-mode' });
+    const err = new VersionControlDomainError('groups are being edited', 409, { kind: 'idp-mode' });
     expect(toHttpError(err, 'test')).toEqual({
       status: 409,
       body: { error: 'groups are being edited', kind: 'idp-mode' },
@@ -37,7 +37,7 @@ describe('toHttpError — the shared access-family error shape', () => {
   });
 
   it("a payload key named 'error' cannot overwrite the client-facing message", () => {
-    const err = new WorkflowDomainError('the real message', 422, { error: 'spoofed', kind: 'x' });
+    const err = new VersionControlDomainError('the real message', 422, { error: 'spoofed', kind: 'x' });
     const { body } = toHttpError(err, 'test');
     expect(body.error).toBe('the real message');
     expect(body.kind).toBe('x');
@@ -54,8 +54,8 @@ describe('requireNonEmptyString', () => {
       } catch (err) {
         caught = err;
       }
-      expect(caught).toBeInstanceOf(WorkflowDomainError);
-      expect((caught as WorkflowDomainError).status).toBe(400);
+      expect(caught).toBeInstanceOf(VersionControlDomainError);
+      expect((caught as VersionControlDomainError).status).toBe(400);
     }
   });
 });

package/src/modules/access/__tests__/groups-admin.service.test.ts

@@ -5,7 +5,7 @@ import path from 'node:path';
 import os from 'node:os';
 
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
-import type { WorkflowService } from '../../workflow/workflow.service.js';
+import type { VersionControlService } from '../../version-control/version-control.service.js';
 import type { AuthUser, FileTreeEntry } from '@bevel-software/platform-shared';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { AccessControlService } from '../access-control.service.js';
@@ -61,7 +61,7 @@ function stubWorkspace(workspaceDir: string): WorkspaceService {
   } as unknown as WorkspaceService;
 }
 
-function stubWorkflow() {
+function stubVersionControl() {
   const commits: { summary: string }[] = [];
   // Strict per-path locks — a live row is contended even for the same user,
   // exactly like FileLockService (nesting bugs must fail here too).
@@ -88,7 +88,7 @@ function stubWorkflow() {
       commits.push({ summary });
       return {} as unknown;
     },
-  } as unknown as WorkflowService;
+  } as unknown as VersionControlService;
   return { svc, commits };
 }
 
@@ -105,11 +105,11 @@ describe('GroupsAdminService', () => {
     await write(repo, 'groups.yaml', GROUPS);
     await write(repo, 'access.md', '---\nwrite:\n  - Admin\n---\n');
     const workspace = stubWorkspace(root);
-    const workflow = stubWorkflow();
-    commits = workflow.commits;
+    const versionControl = stubVersionControl();
+    commits = versionControl.commits;
     service = new GroupsAdminService(
       workspace,
-      workflow.svc,
+      versionControl.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
       new NodeFs(),
       KB,
@@ -290,18 +290,18 @@ describe('GroupsAdminService', () => {
     function gatedService(): { gated: GroupsAdminService; gatedCommits: { summary: string }[] } {
       const workspace = stubWorkspace(root);
       const access = new AccessControlService(workspace as never, KB, new NodeFs());
-      const workflow = stubWorkflow();
-      const svc = workflow.svc as unknown as Record<string, unknown>;
+      const versionControl = stubVersionControl();
+      const svc = versionControl.svc as unknown as Record<string, unknown>;
       svc.commitChanges = async (ws: string, user: AuthUser, summary: string, onlyPaths: string[] = []) => {
         const rel = onlyPaths.map((p) => p.slice(KB.length + 1));
         const verdicts = await access.canWriteBatch(ws, user.email, rel);
         const denied = rel.find((p) => verdicts.get(p) !== true);
         if (denied) throw new AccessDeniedError({ path: denied, eligibleRoles: [], eligibleUsers: [] });
-        workflow.commits.push({ summary });
+        versionControl.commits.push({ summary });
         return {} as unknown;
       };
-      const gated = new GroupsAdminService(workspace, workflow.svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH);
-      return { gated, gatedCommits: workflow.commits };
+      const gated = new GroupsAdminService(workspace, versionControl.svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH);
+      return { gated, gatedCommits: versionControl.commits };
     }
 
     const SARA_ACCESS = '---\nread:\n  - deny everyone\n  - Sara <sara@x.io>\nwrite:\n  - Sara <sara@x.io>\n---\n';
@@ -388,13 +388,13 @@ describe('GroupsAdminService', () => {
   it('rollback of a failed commit DELETES a file this edit created (no empty artifact)', async () => {
     await fs.rm(path.join(repo, 'groups.yaml'));
     const workspace = stubWorkspace(root);
-    const workflow = stubWorkflow();
-    (workflow.svc as unknown as { commitChanges: unknown }).commitChanges = async () => {
+    const versionControl = stubVersionControl();
+    (versionControl.svc as unknown as { commitChanges: unknown }).commitChanges = async () => {
       throw new Error('commit exploded');
     };
     const svc = new GroupsAdminService(
       workspace,
-      workflow.svc,
+      versionControl.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
       new NodeFs(),
       KB,
@@ -408,8 +408,8 @@ describe('GroupsAdminService', () => {
 
   it('a path whose restore failed is released WITHOUT commit (discard, never partial publish)', async () => {
     const workspace = stubWorkspace(root);
-    const workflow = stubWorkflow();
-    const wf = workflow.svc as unknown as {
+    const versionControl = stubVersionControl();
+    const wf = versionControl.svc as unknown as {
       commitChanges: (...a: unknown[]) => Promise<unknown>;
       releaseLock: (...a: unknown[]) => Promise<void>;
       releaseLockNoCommit: (...a: unknown[]) => Promise<void>;
@@ -419,8 +419,8 @@ describe('GroupsAdminService', () => {
     };
     const committingReleases: string[] = [];
     const discardingReleases: string[] = [];
-    const origRelease = wf.releaseLock.bind(workflow.svc);
-    const origNoCommit = wf.releaseLockNoCommit.bind(workflow.svc);
+    const origRelease = wf.releaseLock.bind(versionControl.svc);
+    const origNoCommit = wf.releaseLockNoCommit.bind(versionControl.svc);
     wf.releaseLock = async (...a) => {
       committingReleases.push(a[2] as string);
       return origRelease(...a);
@@ -441,7 +441,7 @@ describe('GroupsAdminService', () => {
     };
     const svc = new GroupsAdminService(
       workspace,
-      workflow.svc,
+      versionControl.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
       new NodeFs(),
       KB,
@@ -468,11 +468,11 @@ describe('GroupsAdminService', () => {
     // away. Checked under the lock, the just-created file is seen and retired.
     await fs.rm(path.join(repo, 'groups.yaml'));
     const workspace = stubWorkspace(root);
-    const workflow = stubWorkflow();
-    const wf = workflow.svc as unknown as {
+    const versionControl = stubVersionControl();
+    const wf = versionControl.svc as unknown as {
       acquireLock: (w: string, b: string, p: string, u: AuthUser) => Promise<unknown>;
     };
-    const origAcquire = wf.acquireLock.bind(workflow.svc);
+    const origAcquire = wf.acquireLock.bind(versionControl.svc);
     wf.acquireLock = async (w, b, p, u) => {
       if (p === `${KB}/groups.yaml`) {
         await write(repo, 'groups.yaml', 'groups:\n  Late Team:\n    - late@x.io\n');
@@ -481,7 +481,7 @@ describe('GroupsAdminService', () => {
     };
     const svc = new GroupsAdminService(
       workspace,
-      workflow.svc,
+      versionControl.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
       new NodeFs(),
       KB,
@@ -489,7 +489,7 @@ describe('GroupsAdminService', () => {
     );
     expect(await svc.retireManualGroups(ADMIN)).toBe(true);
     await expect(groupsYaml()).rejects.toMatchObject({ code: 'ENOENT' });
-    expect(workflow.commits.some((c) => c.summary.includes('Retire manual groups'))).toBe(true);
+    expect(versionControl.commits.some((c) => c.summary.includes('Retire manual groups'))).toBe(true);
   });
 });
 
@@ -537,7 +537,7 @@ describe('groups roster referencedBy — the mirror of the roles roster attribut
       const workspace = stubWorkspace(root2);
       const svc = new GroupsAdminService(
         workspace,
-        stubWorkflow().svc,
+        stubVersionControl().svc,
         new AccessControlService(workspace as never, KB, new NodeFs()),
         new NodeFs(),
         KB,
@@ -582,7 +582,7 @@ describe('groups roster referencedBy — the mirror of the roles roster attribut
       await write(repo2, 'secret/Plan.md', '---\nread:\n  - deny everyone\n  - Reviewer\n---\n# Plan\n');
       const workspace = stubWorkspace(root2);
       const access = new AccessControlService(workspace as never, KB, new NodeFs());
-      const svc = new GroupsAdminService(workspace, stubWorkflow().svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH);
+      const svc = new GroupsAdminService(workspace, stubVersionControl().svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH);
       const rowsFor = async (email: string) =>
         (await svc.getRoster(email)).groups.find((g) => g.canonical === 'reviewer')!.bareNameResolvesToRole;
 
@@ -619,7 +619,7 @@ describe('groups roster referencedBy — the mirror of the roles roster attribut
       const workspace = stubWorkspace(root2);
       const svc = new GroupsAdminService(
         workspace,
-        stubWorkflow().svc,
+        stubVersionControl().svc,
         new AccessControlService(workspace as never, KB, new NodeFs()),
         new NodeFs(),
         KB,

package/src/modules/access/__tests__/roles-admin.security.test.ts

@@ -6,16 +6,17 @@ import os from 'node:os';
 import express from 'express';
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 
-import { NodeFs } from '../../kb-fs/node-fs.js';
+// Another module's implementation is never constructed here: the real disk,
+// the admin check and the account routes come from the root fixtures that
+// stand in for the composition root, as the entries hold contracts only.
+import { realDisk } from '../../../__tests__/real-disk.js';
+import { realAccountRoutes, realAdminAccess } from '../../../__tests__/account-admin.js';
 import { AccessControlService } from '../access-control.service.js';
 import { RolesAdminService } from '../roles-admin.service.js';
-import { AdminAccessService } from '../../admin/admin-access.service.js';
-import { createAccountRoutes } from '../../auth/account.routes.js';
+import type { AuthService, IAccountErasureService } from '../../auth/index.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
-import type { WorkspaceService } from '../../workspace/workspace.service.js';
-import type { WorkflowService } from '../../workflow/workflow.service.js';
-import type { AuthService } from '../../auth/auth.service.js';
-import type { IAccountErasureService } from '../../auth/account-erasure.service.js';
+import type { WorkspaceService } from '../../workspace/index.js';
+import type { VersionControlService } from '../../version-control/index.js';
 import type { AuthUser } from '@bevel-software/platform-shared';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 
@@ -73,7 +74,7 @@ function stubWorkspace(workspaceDir: string): WorkspaceService {
 }
 
 /** Lock/commit stub: the real LockingFilesystem writes the bytes to disk. */
-function stubWorkflow(): WorkflowService {
+function stubVersionControl(): VersionControlService {
   const locks = new Map<string, AuthUser>();
   const row = (h: AuthUser) => ({ holderUserId: h.id, holderName: h.name });
   return {
@@ -90,7 +91,7 @@ function stubWorkflow(): WorkflowService {
     releaseLock: async (_w: string, _b: string, p: string) => void locks.delete(p),
     releaseLockNoCommit: async (_w: string, _b: string, p: string) => void locks.delete(p),
     commitChanges: async () => ({}) as unknown,
-  } as unknown as WorkflowService;
+  } as unknown as VersionControlService;
 }
 
 function close(s: Server): Promise<void> {
@@ -126,11 +127,11 @@ describe('SECURITY: Admin-role removal takes effect on the next request', () =>
     // how the composition root wires it. A second instance would have its own
     // cache and could pass this test while production still served stale
     // verdicts, which is the failure mode worth guarding.
-    access = new AccessControlService(ws, KB, new NodeFs(), [OWNER]);
-    rolesAdmin = new RolesAdminService(ws, stubWorkflow(), access, new NodeFs(), KB, () => DEFAULT_BRANCH, undefined, [
+    access = new AccessControlService(ws, KB, realDisk(), [OWNER]);
+    rolesAdmin = new RolesAdminService(ws, stubVersionControl(), access, realDisk(), KB, () => DEFAULT_BRANCH, undefined, [
       OWNER,
     ]);
-    const adminAccess = new AdminAccessService(access, ws, DEFAULT_BRANCH, [OWNER]);
+    const adminAccess = realAdminAccess(access, ws, DEFAULT_BRANCH, [OWNER]);
 
     const authService = {
       listAccounts: async () => [],
@@ -146,7 +147,7 @@ describe('SECURITY: Admin-role removal takes effect on the next request', () =>
       (req as unknown as { userEmail?: string }).userEmail = req.header('x-test-email') ?? undefined;
       next();
     });
-    app.use('/api', createAccountRoutes(authService, adminAccess, erasure, { runAccountInvited: async () => [] }));
+    app.use('/api', realAccountRoutes(authService, adminAccess, erasure, { runAccountInvited: async () => [], runAccountDeactivated: async () => [] }));
     server = await new Promise<Server>((resolve) => {
       const s = app.listen(0, () => resolve(s));
     });

package/src/modules/access/__tests__/roles-admin.service.test.ts

@@ -5,9 +5,9 @@ import path from 'node:path';
 import os from 'node:os';
 
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
-import type { WorkflowService } from '../../workflow/workflow.service.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
-import type { FileTreeEntry, WorkflowEventPayload } from '@bevel-software/platform-shared';
+import type { VersionControlService } from '../../version-control/version-control.service.js';
+import type { VersionControlEventBus } from '../../version-control/event-bus.js';
+import type { FileTreeEntry, VersionControlEventPayload } from '@bevel-software/platform-shared';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { AccessControlService } from '../access-control.service.js';
 import { RolesAdminService } from '../roles-admin.service.js';
@@ -80,7 +80,7 @@ function stubWorkspace(workspaceDir: string): WorkspaceService {
 }
 
 /**
- * WorkflowService stub backed by the real temp repo. Models the two write paths
+ * VersionControlService stub backed by the real temp repo. Models the two write paths
  * the service uses:
  *   - Single-file ops go through a real LockingFilesystem, which calls
  *     acquireLock → (LocalFilesystem writes to disk) → releaseLock. We track the
@@ -91,7 +91,7 @@ function stubWorkspace(workspaceDir: string): WorkspaceService {
  *     (non-deferred) atomic write straight to the repo. Records commits so tests
  *     can assert one-per-op.
  */
-function stubWorkflow() {
+function stubVersionControl() {
   const commits: { summary: string }[] = [];
   const resets: string[] = [];
   /** Per-path lock rows with STRICT acquire — mirrors FileLockService: a
@@ -133,19 +133,19 @@ function stubWorkflow() {
     resetToRemote: async (_ws: string, branch: string) => {
       resets.push(branch);
     },
-  } as unknown as WorkflowService;
+  } as unknown as VersionControlService;
   return { svc, commits, resets };
 }
 
 /** Event bus stub that records every emitted payload for assertions. */
 function stubEventBus() {
-  const events: WorkflowEventPayload[] = [];
+  const events: VersionControlEventPayload[] = [];
   const bus = {
-    emit: (payload: WorkflowEventPayload) => {
+    emit: (payload: VersionControlEventPayload) => {
       events.push(payload);
       return {} as unknown;
     },
-  } as unknown as WorkflowEventBus;
+  } as unknown as VersionControlEventBus;
   return { bus, events };
 }
 
@@ -154,7 +154,7 @@ describe('RolesAdminService', () => {
   let repo: string;
   let access: AccessControlService;
   let ws: WorkspaceService;
-  let workflow: ReturnType<typeof stubWorkflow>;
+  let versionControl: ReturnType<typeof stubVersionControl>;
   let bus: ReturnType<typeof stubEventBus>;
   let svc: RolesAdminService;
 
@@ -169,9 +169,9 @@ describe('RolesAdminService', () => {
     await write(repo, 'roles.yaml', ROLES);
     ws = stubWorkspace(workspaceDir);
     access = new AccessControlService(ws, KB, new NodeFs());
-    workflow = stubWorkflow();
+    versionControl = stubVersionControl();
     bus = stubEventBus();
-    svc = new RolesAdminService(ws, workflow.svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH, bus.bus, [
+    svc = new RolesAdminService(ws, versionControl.svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH, bus.bus, [
       'recovery-admin@example.com',
     ]);
   });
@@ -193,7 +193,7 @@ describe('RolesAdminService', () => {
     // `DEFAULT_BRANCH` and froze it — every roles route then failed branch
     // validation with `Invalid branch name "": empty name` until a restart.
     let branch = '';
-    const late = new RolesAdminService(ws, workflow.svc, access, new NodeFs(), KB, () => branch, bus.bus);
+    const late = new RolesAdminService(ws, versionControl.svc, access, new NodeFs(), KB, () => branch, bus.bus);
     branch = DEFAULT_BRANCH;
     const roster = await late.getRoster(ADMIN.email);
     expect(roster.map((r) => r.canonical)).toEqual(['admin', 'sales']);
@@ -225,7 +225,7 @@ describe('RolesAdminService', () => {
 
     // Recovery syncs the clone to origin's default branch BEFORE writing, so the
     // restoring commit fast-forwards on push instead of diverging.
-    expect(workflow.resets).toEqual([DEFAULT_BRANCH]);
+    expect(versionControl.resets).toEqual([DEFAULT_BRANCH]);
     // Corrupted bytes parked verbatim in old-roles.yaml.
     expect(await fs.readFile(path.join(repo, 'old-roles.yaml'), 'utf-8')).toBe(corrupt);
     // roles.yaml restored to a parseable default with an Admin role.
@@ -257,7 +257,7 @@ describe('RolesAdminService', () => {
     const corrupt = 'roles:\n  Admin:\n    - a@x.eu\n  Admin:\n    - b@x.eu\n';
     await write(repo, 'roles.yaml', corrupt);
     access.invalidate(WS);
-    const adminless = new RolesAdminService(ws, workflow.svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH, bus.bus);
+    const adminless = new RolesAdminService(ws, versionControl.svc, access, new NodeFs(), KB, () => DEFAULT_BRANCH, bus.bus);
     // 409, not 500: the route helper hides >=500 bodies behind a generic
     // message, and this break-glass refusal must reach the operator verbatim.
     await expect(adminless.recover(ADMIN)).rejects.toMatchObject({
@@ -298,9 +298,9 @@ describe('RolesAdminService', () => {
   it('addMember persists + is idempotent', async () => {
     await svc.addMember(ADMIN, 'sales', 'New@example.com');
     expect(await readRoles()).toContain('new@example.com');
-    const before = workflow.commits.length;
+    const before = versionControl.commits.length;
     await svc.addMember(ADMIN, 'sales', 'new@example.com'); // duplicate → no commit
-    expect(workflow.commits.length).toBe(before);
+    expect(versionControl.commits.length).toBe(before);
   });
 
   it('removeMember refuses to empty the Admin role', async () => {
@@ -359,7 +359,7 @@ describe('RolesAdminService', () => {
     // — no commit, roles.yaml byte-for-byte unchanged, admin status intact. This
     // catches a regression that would write/commit before validating.
     const before = await readRoles();
-    const commitsBefore = workflow.commits.length;
+    const commitsBefore = versionControl.commits.length;
     const realValidate = access.validateRolesYaml.bind(access);
     access.validateRolesYaml = () => ({ ok: false, errors: ['forced parse failure'] });
     try {
@@ -367,21 +367,21 @@ describe('RolesAdminService', () => {
     } finally {
       access.validateRolesYaml = realValidate;
     }
-    expect(workflow.commits.length).toBe(commitsBefore); // nothing committed
+    expect(versionControl.commits.length).toBe(commitsBefore); // nothing committed
     expect(await readRoles()).toBe(before); // file untouched
     expect(await access.canWrite(WS, 'razvan@bevel.software', 'roles.yaml')).toBe(true);
   });
 
   it('a post-commit push failure does NOT revert the landed edit (saved; retried later)', async () => {
-    // workflowService.commitChanges throwing PushNeedsAgentResolutionError
+    // versionControlService.commitChanges throwing PushNeedsAgentResolutionError
     // means the COMMIT landed and only the push needs help. The old twins
     // restored pre-edit bytes here — publishing a compensating revert of a
     // landed commit. The shared helper must keep the new bytes and surface
     // the typed 409 as-is.
-    const failing = workflow.svc as unknown as {
+    const failing = versionControl.svc as unknown as {
       commitChanges: (...args: unknown[]) => Promise<unknown>;
     };
-    const realCommit = failing.commitChanges.bind(workflow.svc);
+    const realCommit = failing.commitChanges.bind(versionControl.svc);
     failing.commitChanges = async (...args: unknown[]) => {
       await realCommit(...args); // the commit records — it "landed"
       throw new PushNeedsAgentResolutionError(DEFAULT_BRANCH, 'roles.yaml', 'rejected', 'conflict');
@@ -401,7 +401,7 @@ describe('RolesAdminService', () => {
   it('concurrent edit is serialized — a mutation 409s while another admin holds the lock', async () => {
     // Another admin is mid-edit (holds the roles.yaml lock). The getLock
     // pre-check sees a different holder and refuses with a friendly 409.
-    await workflow.svc.acquireLock(WS, DEFAULT_BRANCH, `${KB}/roles.yaml`, OTHER_ADMIN);
+    await versionControl.svc.acquireLock(WS, DEFAULT_BRANCH, `${KB}/roles.yaml`, OTHER_ADMIN);
     await expect(svc.addMember(ADMIN, 'sales', 'x@example.com')).rejects.toMatchObject({ status: 409 });
   });
 
@@ -571,7 +571,7 @@ describe('roster referencedBy under group shadowing', () => {
     const ws = stubWorkspace(workspaceDir);
     svc = new RolesAdminService(
       ws,
-      stubWorkflow().svc,
+      stubVersionControl().svc,
       new AccessControlService(ws, KB, new NodeFs()),
       new NodeFs(),
       KB,
@@ -623,13 +623,13 @@ describe('Admin fixed members — the deployment admin', () => {
   let root: string;
   let repo: string;
   let ws: WorkspaceService;
-  let workflow: ReturnType<typeof stubWorkflow>;
+  let versionControl: ReturnType<typeof stubVersionControl>;
 
   /** Service whose configured deployment admins are `admins`. */
   function serviceWith(admins: readonly string[]): RolesAdminService {
     return new RolesAdminService(
       ws,
-      workflow.svc,
+      versionControl.svc,
       new AccessControlService(ws, KB, new NodeFs()),
       new NodeFs(),
       KB,
@@ -645,7 +645,7 @@ describe('Admin fixed members — the deployment admin', () => {
     repo = path.join(workspaceDir, KB);
     await write(repo, 'roles.yaml', ROLES);
     ws = stubWorkspace(workspaceDir);
-    workflow = stubWorkflow();
+    versionControl = stubVersionControl();
   });
 
   afterEach(async () => {

package/src/modules/access/__tests__/roles-capabilities.test.ts

@@ -5,7 +5,7 @@ import path from 'node:path';
 import os from 'node:os';
 
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
-import type { WorkflowService } from '../../workflow/workflow.service.js';
+import type { VersionControlService } from '../../version-control/version-control.service.js';
 import type { AuthUser, FileTreeEntry } from '@bevel-software/platform-shared';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { AccessControlService } from '../access-control.service.js';
@@ -65,7 +65,7 @@ function stubWorkspace(workspaceDir: string): WorkspaceService {
   } as unknown as WorkspaceService;
 }
 
-function stubWorkflow() {
+function stubVersionControl() {
   const commits: { summary: string }[] = [];
   // Strict per-path locks — a live row is contended even for the same user,
   // exactly like FileLockService (nesting bugs must fail here too).
@@ -107,7 +107,7 @@ function stubWorkflow() {
       commits.push({ summary });
       return {} as unknown;
     },
-  } as unknown as WorkflowService;
+  } as unknown as VersionControlService;
   return { svc, commits, acquireCalls };
 }
 
@@ -126,11 +126,11 @@ describe('RolesAdminService — capabilities, group assignment, conversion', ()
     await write(repo, 'groups.yaml', 'groups:\n  GTM Team:\n    - sara@x.io\n');
     await write(repo, 'access.md', '---\nwrite:\n  - Admin\nread:\n  - Product\n---\n');
     const workspace = stubWorkspace(root);
-    const workflow = stubWorkflow();
-    commits = workflow.commits;
+    const versionControl = stubVersionControl();
+    commits = versionControl.commits;
     service = new RolesAdminService(
       workspace,
-      workflow.svc,
+      versionControl.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
       new NodeFs(),
       KB,
@@ -212,10 +212,10 @@ describe('RolesAdminService — capabilities, group assignment, conversion', ()
     // that claims no write authority. A write-intent acquire here would fail
     // EVERY manual-mode conversion at lock acquisition.
     const workspace = stubWorkspace(root);
-    const workflow = stubWorkflow();
+    const versionControl = stubVersionControl();
     const svc = new RolesAdminService(
       workspace,
-      workflow.svc,
+      versionControl.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
       new NodeFs(),
       KB,
@@ -226,12 +226,12 @@ describe('RolesAdminService — capabilities, group assignment, conversion', ()
     expect(await groupsYaml()).toContain('Product:');
     // The synced file WAS locked (the serialization is real), via coordination;
     // the written files keep their write-gated acquires.
-    expect(workflow.acquireCalls).toContainEqual({
+    expect(versionControl.acquireCalls).toContainEqual({
       path: `${KB}/synced-groups.yaml`,
       coordination: true,
     });
-    expect(workflow.acquireCalls).toContainEqual({ path: `${KB}/roles.yaml`, coordination: false });
-    expect(workflow.acquireCalls).toContainEqual({ path: `${KB}/groups.yaml`, coordination: false });
+    expect(versionControl.acquireCalls).toContainEqual({ path: `${KB}/roles.yaml`, coordination: false });
+    expect(versionControl.acquireCalls).toContainEqual({ path: `${KB}/groups.yaml`, coordination: false });
   });
 
   it('conversion refusals: capability role, group-assigned role, IdP mode', async () => {
@@ -259,8 +259,8 @@ describe('RolesAdminService — capabilities, group assignment, conversion', ()
     // write nothing (committing a groups.yaml group in IdP mode writes a
     // retired file).
     const workspace = stubWorkspace(root);
-    const workflow = stubWorkflow();
-    const wf = workflow.svc as unknown as {
+    const versionControl = stubVersionControl();
+    const wf = versionControl.svc as unknown as {
       acquireLock: (
         w: string,
         b: string,
@@ -269,7 +269,7 @@ describe('RolesAdminService — capabilities, group assignment, conversion', ()
         opts?: { coordination?: boolean },
       ) => Promise<unknown>;
     };
-    const origAcquire = wf.acquireLock.bind(workflow.svc);
+    const origAcquire = wf.acquireLock.bind(versionControl.svc);
     wf.acquireLock = async (w, b, p, u, opts) => {
       if (p === `${KB}/synced-groups.yaml`) {
         // The sync's provisioning push won the race for this lock and landed.
@@ -279,7 +279,7 @@ describe('RolesAdminService — capabilities, group assignment, conversion', ()
     };
     const svc = new RolesAdminService(
       workspace,
-      workflow.svc,
+      versionControl.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
       new NodeFs(),
       KB,
@@ -292,19 +292,19 @@ describe('RolesAdminService — capabilities, group assignment, conversion', ()
     // Nothing moved.
     expect(await rolesYaml()).toBe(ROLES);
     expect(await groupsYaml()).not.toContain('Product');
-    expect(workflow.commits).toHaveLength(0);
+    expect(versionControl.commits).toHaveLength(0);
   });
 
   it('a failed conversion with NO pre-existing groups.yaml leaves no groups.yaml behind', async () => {
     await fs.rm(path.join(repo, 'groups.yaml'));
     const workspace = stubWorkspace(root);
-    const workflow = stubWorkflow();
-    (workflow.svc as unknown as { commitChanges: unknown }).commitChanges = async () => {
+    const versionControl = stubVersionControl();
+    (versionControl.svc as unknown as { commitChanges: unknown }).commitChanges = async () => {
       throw new Error('commit exploded');
     };
     const svc = new RolesAdminService(
       workspace,
-      workflow.svc,
+      versionControl.svc,
       new AccessControlService(workspace as never, KB, new NodeFs()),
       new NodeFs(),
       KB,

package/src/modules/access/__tests__/roles.routes.test.ts

@@ -12,8 +12,8 @@ import { NodeFs } from '../../kb-fs/node-fs.js';
 import type { IAccessControl } from '../access-control.interface.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import { AuthService } from '../../auth/auth.service.js';
-import type { WorkflowService } from '../../workflow/workflow.service.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import type { VersionControlService } from '../../version-control/version-control.service.js';
+import type { VersionControlEventBus } from '../../version-control/event-bus.js';
 import type { FileTreeEntry } from '@bevel-software/platform-shared';
 import { createAccessRoutes } from '../access.routes.js';
 import { usersDbDouble } from './users-db-double.js';
@@ -113,7 +113,7 @@ async function makeHarness(
   // exactly like FileLockService (nesting bugs must fail here too).
   const locks = new Map<string, { id: string; name: string }>();
   const lockRow = (h: { id: string; name: string }) => ({ holderUserId: h.id, holderName: h.name });
-  const workflowService = {
+  const versionControlService = {
     getLock: vi.fn(async (_w: string, _b: string, p: string) => {
       const h = locks.get(p);
       return h ? lockRow(h) : null;
@@ -131,9 +131,9 @@ async function makeHarness(
     // Write-free: the lock-aware filesystem writes to disk; this just commits the
     // dirty tree. Not exercised by these route tests (no rename), but kept honest.
     commitChanges: vi.fn(async () => ({})),
-  } as unknown as WorkflowService;
+  } as unknown as VersionControlService;
 
-  const eventBus = { emit: vi.fn() } as unknown as WorkflowEventBus;
+  const eventBus = { emit: vi.fn() } as unknown as VersionControlEventBus;
   const accounts = [
     { email: 'off@example.com', deactivatedAt: new Date('2026-09-01T00:00:00Z') },
     'on@example.com',
@@ -182,7 +182,7 @@ async function makeHarness(
     (req as unknown as { userId: string }).userId = ADMIN.id;
     next();
   });
-  app.use('/api', createAccessRoutes(accessControl, workspaceService, authService, authService, workflowService, eventBus, db, testKbContext({ kbDirName: KB }), new NodeFs()));
+  app.use('/api', createAccessRoutes(accessControl, workspaceService, authService, authService, versionControlService, eventBus, db, testKbContext({ kbDirName: KB }), new NodeFs()));
 
   const server = await new Promise<Server>((resolve) => {
     const s = app.listen(0, () => resolve(s));