@bevel-software/platform-core-backend 0.35.0 → 0.37.0

package/src/modules/access/__tests__/roles.routes.test.ts

@@ -7,13 +7,13 @@ import express from 'express';
 import { PgDialect } from 'drizzle-orm/pg-core';
 import type { SQL } from 'drizzle-orm';
 import { describe, it, expect, afterEach, vi } from 'vitest';
-import { NodeFs } from '../../kb-fs/node-fs.js';
+import { realDisk } from '../../../__tests__/real-disk.js';
 
 import type { IAccessControl } from '../access-control.interface.js';
-import type { WorkspaceService } from '../../workspace/workspace.service.js';
-import { AuthService } from '../../auth/auth.service.js';
-import type { WorkflowService } from '../../workflow/workflow.service.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import type { WorkspaceService } from '../../workspace/index.js';
+import { realAuthService } from '../../../__tests__/real-auth.js';
+import type { VersionControlService } from '../../version-control/index.js';
+import type { VersionControlEventBus } from '../../version-control/index.js';
 import type { FileTreeEntry } from '@bevel-software/platform-shared';
 import { createAccessRoutes } from '../access.routes.js';
 import { usersDbDouble } from './users-db-double.js';
@@ -64,7 +64,7 @@ async function makeHarness(
   const realAccess = new AccessControlService(
     { getWorkspacePath: async () => workspaceDir, readFile: async () => ROLES } as unknown as WorkspaceService,
     KB,
-    new NodeFs(),
+    realDisk(),
   );
   const accessControl = {
     // Admin gate: the route's assertCanMutate calls canWrite('roles.yaml').
@@ -113,7 +113,7 @@ async function makeHarness(
   // exactly like FileLockService (nesting bugs must fail here too).
   const locks = new Map<string, { id: string; name: string }>();
   const lockRow = (h: { id: string; name: string }) => ({ holderUserId: h.id, holderName: h.name });
-  const workflowService = {
+  const versionControlService = {
     getLock: vi.fn(async (_w: string, _b: string, p: string) => {
       const h = locks.get(p);
       return h ? lockRow(h) : null;
@@ -131,9 +131,9 @@ async function makeHarness(
     // Write-free: the lock-aware filesystem writes to disk; this just commits the
     // dirty tree. Not exercised by these route tests (no rename), but kept honest.
     commitChanges: vi.fn(async () => ({})),
-  } as unknown as WorkflowService;
+  } as unknown as VersionControlService;
 
-  const eventBus = { emit: vi.fn() } as unknown as WorkflowEventBus;
+  const eventBus = { emit: vi.fn() } as unknown as VersionControlEventBus;
   const accounts = [
     { email: 'off@example.com', deactivatedAt: new Date('2026-09-01T00:00:00Z') },
     'on@example.com',
@@ -173,7 +173,7 @@ async function makeHarness(
 
   // The real auth service over the same double, so the promotion's switch
   // lock and read run as they do in production (`whileSwitchedOn`).
-  const authService = new AuthService(db, { jwtSecret: 'test', adminEmail: '', adminPassword: '', allowedEmailDomains: [] });
+  const authService = realAuthService(db, { jwtSecret: 'test', adminEmail: '', adminPassword: '', allowedEmailDomains: [] });
   vi.spyOn(authService, 'getUserById').mockImplementation(async () => ADMIN);
 
   const app = express();
@@ -182,7 +182,7 @@ async function makeHarness(
     (req as unknown as { userId: string }).userId = ADMIN.id;
     next();
   });
-  app.use('/api', createAccessRoutes(accessControl, workspaceService, authService, authService, workflowService, eventBus, db, testKbContext({ kbDirName: KB }), new NodeFs()));
+  app.use('/api', createAccessRoutes(accessControl, workspaceService, authService, authService, versionControlService, eventBus, db, testKbContext({ kbDirName: KB }), realDisk()));
 
   const server = await new Promise<Server>((resolve) => {
     const s = app.listen(0, () => resolve(s));

package/src/modules/access/__tests__/synced-groups-committer.test.ts

@@ -3,12 +3,12 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
 
-import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared';
-import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { AuthUser, IVersionControlService } from '@bevel-software/platform-shared';
+import type { WorkspaceService } from '../../workspace/index.js';
 import type { AccessControlService } from '../access-control.service.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import type { VersionControlEventBus } from '../../version-control/index.js';
 import { createSyncedGroupsCommitter } from '../synced-groups-committer.js';
-import { PushNeedsAgentResolutionError, WorkflowValidationError } from '../../../shared/domain-errors.js';
+import { PushNeedsAgentResolutionError, VersionControlValidationError } from '../../../shared/domain-errors.js';
 
 const KB = 'knowledge-base';
 const BOT: AuthUser = { id: 'bot-1', email: 'directory-sync@bevel.local', name: 'Directory Sync Bot' };
@@ -26,7 +26,7 @@ describe('createSyncedGroupsCommitter.persist — post-commit push failures', ()
   });
 
   function makeDeps(
-    workflowOverrides: Partial<
+    versionControlOverrides: Partial<
       Record<'commitChanges' | 'releaseLock' | 'hasQueuedCommit' | 'hasUnpushedCommits', unknown>
     > = {},
   ) {
@@ -44,7 +44,7 @@ describe('createSyncedGroupsCommitter.persist — post-commit push failures', ()
     // Default: the branch still carries the landed-but-unpushed commit — the
     // truthful answer everywhere except the worker-won-the-race scenario.
     const hasUnpushedCommits = vi.fn(async () => true);
-    const workflowService = {
+    const versionControlService = {
       acquireLock: vi.fn(async () => ({ acquired: true, lock: {} })),
       releaseLock,
       releaseLockNoCommit,
@@ -52,13 +52,13 @@ describe('createSyncedGroupsCommitter.persist — post-commit push failures', ()
       hasQueuedCommit,
       hasUnpushedCommits,
       commitChanges: vi.fn(async () => ({})),
-      ...workflowOverrides,
-    } as unknown as IWorkflowService;
+      ...versionControlOverrides,
+    } as unknown as IVersionControlService;
     const accessControl = { invalidate: vi.fn() } as unknown as AccessControlService;
-    const eventBus = { emit: vi.fn() } as unknown as WorkflowEventBus;
+    const eventBus = { emit: vi.fn() } as unknown as VersionControlEventBus;
     const committer = createSyncedGroupsCommitter({
       workspaceService,
-      workflowService,
+      versionControlService,
       accessControl,
       eventBus,
       kbDirName: KB,
@@ -99,7 +99,7 @@ describe('createSyncedGroupsCommitter.persist — post-commit push failures', ()
       .mockResolvedValueOnce(undefined)
       // The committer's arm probe: nothing left to release.
       .mockRejectedValue(
-        new WorkflowValidationError('Cannot release lock: not held by you.', {
+        new VersionControlValidationError('Cannot release lock: not held by you.', {
           kind: 'lock-not-held',
         }),
       );
@@ -125,7 +125,7 @@ describe('createSyncedGroupsCommitter.persist — post-commit push failures', ()
     // unpublished forever. With the queue consulted directly, an empty queue
     // must surface the original push failure.
     const releaseLock = vi.fn().mockRejectedValue(
-      new WorkflowValidationError('Cannot release lock: not held by you.', {
+      new VersionControlValidationError('Cannot release lock: not held by you.', {
         kind: 'lock-not-held',
       }),
     );
@@ -154,7 +154,7 @@ describe('createSyncedGroupsCommitter.persist — post-commit push failures', ()
       .fn()
       .mockResolvedValueOnce(undefined) // writeFiles' release: enqueued + dropped
       .mockRejectedValue(
-        new WorkflowValidationError('Cannot release lock: not held by you.', {
+        new VersionControlValidationError('Cannot release lock: not held by you.', {
           kind: 'lock-not-held',
         }),
       );
@@ -171,7 +171,7 @@ describe('createSyncedGroupsCommitter.persist — post-commit push failures', ()
 
   it('REJECTS when the queue itself cannot be read (armed must be PROVEN, never assumed)', async () => {
     const releaseLock = vi.fn().mockRejectedValue(
-      new WorkflowValidationError('Cannot release lock: not held by you.', {
+      new VersionControlValidationError('Cannot release lock: not held by you.', {
         kind: 'lock-not-held',
       }),
     );

package/src/modules/access/__tests__/user-access-removal.service.test.ts

@@ -1,12 +1,12 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import { NodeFs } from '../../kb-fs/node-fs.js';
+import { realDisk } from '../../../__tests__/real-disk.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 
-import type { WorkspaceService } from '../../workspace/workspace.service.js';
-import type { WorkflowService } from '../../workflow/workflow.service.js';
+import type { WorkspaceService } from '../../workspace/index.js';
+import type { VersionControlService } from '../../version-control/index.js';
 import type { AuthUser } from '@bevel-software/platform-shared';
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import { PushNeedsAgentResolutionError } from '../../../shared/domain-errors.js';
@@ -62,7 +62,7 @@ function stubWorkspace(workspaceDir: string): WorkspaceService {
   } as unknown as WorkspaceService;
 }
 
-function stubWorkflow(opts: { failCommit?: boolean; pushNeedsResolution?: boolean } = {}) {
+function stubVersionControl(opts: { failCommit?: boolean; pushNeedsResolution?: boolean } = {}) {
   const commits: { summary: string; paths: string[]; author: string }[] = [];
   const locks = new Map<string, AuthUser>();
   const lockRow = (h: AuthUser) => ({ holderUserId: h.id, holderName: h.name });
@@ -89,7 +89,7 @@ function stubWorkflow(opts: { failCommit?: boolean; pushNeedsResolution?: boolea
       if (opts.pushNeedsResolution) throw new PushNeedsAgentResolutionError(DEFAULT_BRANCH, paths[0], 'diverged', 'rebase failed');
       return {} as unknown;
     },
-  } as unknown as WorkflowService;
+  } as unknown as VersionControlService;
   return { svc, commits, locks };
 }
 
@@ -167,11 +167,11 @@ describe('UserAccessRemovalService', () => {
 
   const read = (rel: string) => fs.readFile(path.join(repo, rel), 'utf-8');
 
-  function build(workflow = stubWorkflow(), owners: string[] = ['owner@x.io'], disk: ITreeWalker = new NodeFs()) {
-    const access = new AccessControlService(workspace as never, KB, new NodeFs());
+  function build(versionControl = stubVersionControl(), owners: string[] = ['owner@x.io'], disk: ITreeWalker = realDisk()) {
+    const access = new AccessControlService(workspace as never, KB, realDisk());
     return {
-      workflow,
-      service: new UserAccessRemovalService(workspace, workflow.svc, access, disk, KB, () => DEFAULT_BRANCH, undefined, owners),
+      versionControl,
+      service: new UserAccessRemovalService(workspace, versionControl.svc, access, disk, KB, () => DEFAULT_BRANCH, undefined, owners),
     };
   }
 
@@ -236,12 +236,12 @@ describe('UserAccessRemovalService', () => {
   });
 
   it('removes the address from all four kinds of file in ONE commit named by the anonymised id', async () => {
-    const { service, workflow } = build();
+    const { service, versionControl } = build();
     const before = await read('access.md');
     const result = await service.remove(ADMIN, LEE, 'deleted-1234');
 
-    expect(workflow.commits).toHaveLength(1);
-    const [commit] = workflow.commits;
+    expect(versionControl.commits).toHaveLength(1);
+    const [commit] = versionControl.commits;
     expect(commit.summary).toBe('Remove erased account deleted-1234 from roles, groups and access rules');
     expect(commit.summary).not.toContain('lee');
     expect(commit.author).toBe('admin@x.io');
@@ -258,15 +258,15 @@ describe('UserAccessRemovalService', () => {
     expect(await read('Sales/access.md')).not.toContain('lee@x.io');
     expect((await service.report(LEE)).total).toBe(0);
     // No locks left behind.
-    expect(workflow.locks.size).toBe(0);
+    expect(versionControl.locks.size).toBe(0);
   });
 
   it('counts synced groups but never writes them, reporting the file as still naming the user', async () => {
     await write(repo, 'synced-groups.yaml', 'groups:\n  Engineering:\n    - lee@x.io\n');
-    const { service, workflow } = build();
+    const { service, versionControl } = build();
     expect((await service.report(LEE)).groups).toBe(2);
     const result = await service.remove(ADMIN, LEE, 'deleted-1');
-    expect(workflow.commits[0].paths).not.toContain(`${KB}/synced-groups.yaml`);
+    expect(versionControl.commits[0].paths).not.toContain(`${KB}/synced-groups.yaml`);
     expect(result.stillNamedIn).toEqual(['synced-groups.yaml']);
   });
 
@@ -278,11 +278,11 @@ describe('UserAccessRemovalService', () => {
       .spyOn(AccessControlService.prototype, 'canWriteBatchAtRef')
       .mockImplementation(async (_ws, _ref, _email, paths) => new Map(paths.map((p) => [p, p !== 'Sales/Plan.md'])));
     try {
-      const { service, workflow } = build();
+      const { service, versionControl } = build();
       const result = await service.remove(ADMIN, LEE, 'deleted-1');
 
-      expect(workflow.commits).toHaveLength(1);
-      expect(workflow.commits[0].paths.sort()).toEqual(
+      expect(versionControl.commits).toHaveLength(1);
+      expect(versionControl.commits[0].paths.sort()).toEqual(
         ['Sales/access.md', 'groups.yaml', 'roles.yaml'].map((p) => `${KB}/${p}`).sort(),
       );
       expect(result.removedFrom.sort()).toEqual(['Sales/access.md', 'groups.yaml', 'roles.yaml']);
@@ -291,7 +291,7 @@ describe('UserAccessRemovalService', () => {
       expect(await read('Sales/Plan.md')).toBe(NODE);
       expect(await read('roles.yaml')).not.toContain('lee@x.io');
       expect(await read('Sales/access.md')).not.toContain('lee@x.io');
-      expect(workflow.locks.size).toBe(0);
+      expect(versionControl.locks.size).toBe(0);
     } finally {
       canWrite.mockRestore();
     }
@@ -308,9 +308,9 @@ describe('UserAccessRemovalService', () => {
 
       // The pre-check only ever narrows the set; with nothing known, attempt
       // them all — the lock gate remains the authority.
-      const { service, workflow } = build();
+      const { service, versionControl } = build();
       const result = await service.remove(ADMIN, LEE, 'deleted-1');
-      expect(workflow.commits).toHaveLength(1);
+      expect(versionControl.commits).toHaveLength(1);
       expect(result.removedFrom.sort()).toEqual(['Sales/Plan.md', 'Sales/access.md', 'groups.yaml', 'roles.yaml']);
       expect(result.stillNamedIn).toEqual([]);
     } finally {
@@ -330,25 +330,25 @@ describe('UserAccessRemovalService', () => {
   });
 
   it('refuses the owner and the last Admin, writing nothing', async () => {
-    const { service, workflow } = build(stubWorkflow(), ['Lee@x.io']);
+    const { service, versionControl } = build(stubVersionControl(), ['Lee@x.io']);
     const report = await service.report(LEE);
     expect(report.removable).toBe(false);
     expect(report.blockedReason).toBe('The owner stays in roles and access rules.');
     await expect(service.remove(ADMIN, LEE, 'deleted-1')).rejects.toMatchObject({ status: 409 });
 
-    const other = build(stubWorkflow(), []);
+    const other = build(stubVersionControl(), []);
     expect((await other.service.report('admin@x.io')).removable).toBe(true);
     await write(repo, 'roles.yaml', 'roles:\n  Admin:\n    - lee@x.io\n');
     expect((await other.service.report(LEE)).blockedReason).toMatch(/last Admin/);
     await expect(other.service.remove(ADMIN, LEE, 'deleted-1')).rejects.toMatchObject({ status: 409 });
 
-    expect(workflow.commits).toHaveLength(0);
-    expect(other.workflow.commits).toHaveLength(0);
+    expect(versionControl.commits).toHaveLength(0);
+    expect(other.versionControl.commits).toHaveLength(0);
     expect(await read('groups.yaml')).toBe(GROUPS);
   });
 
   it('a failed commit restores every file and leaves them naming the user', async () => {
-    const { service } = build(stubWorkflow({ failCommit: true }));
+    const { service } = build(stubVersionControl({ failCommit: true }));
     await expect(service.remove(ADMIN, LEE, 'deleted-1')).rejects.toThrow(/push rejected/);
     expect(await read('roles.yaml')).toBe(ROLES);
     expect(await read('Sales/access.md')).toBe(SALES_ACCESS);
@@ -356,19 +356,19 @@ describe('UserAccessRemovalService', () => {
   });
 
   it('refuses to commit a partial cleanup when a folder cannot be listed', async () => {
-    const real = new NodeFs();
+    const real = realDisk();
     const holey = {
       walkKb: async (...args: Parameters<ITreeWalker['walkKb']>) => {
         const result = await real.walkKb(...args);
         return { ...result, holes: [...result.holes, 'Secret'] };
       },
     } as unknown as ITreeWalker;
-    const { service, workflow } = build(stubWorkflow(), ['owner@x.io'], holey);
+    const { service, versionControl } = build(stubVersionControl(), ['owner@x.io'], holey);
     await expect(service.remove(ADMIN, LEE, 'deleted-1')).rejects.toMatchObject({
       status: 422,
       message: expect.stringMatching(/could not be read \(Secret\)/),
     });
-    expect(workflow.commits).toHaveLength(0);
+    expect(versionControl.commits).toHaveLength(0);
     expect(await read('roles.yaml')).toBe(ROLES);
   });
 
@@ -377,9 +377,9 @@ describe('UserAccessRemovalService', () => {
       throw new Error('cache gone');
     });
     try {
-      const { service, workflow } = build();
+      const { service, versionControl } = build();
       const result = await service.remove(ADMIN, LEE, 'deleted-1');
-      expect(workflow.commits).toHaveLength(1);
+      expect(versionControl.commits).toHaveLength(1);
       expect(result.removedFrom.sort()).toEqual(['Sales/Plan.md', 'Sales/access.md', 'groups.yaml', 'roles.yaml']);
       expect(result.stillNamedIn).toEqual([]);
       // The refresh really ran after the commit and really threw.
@@ -391,9 +391,9 @@ describe('UserAccessRemovalService', () => {
   });
 
   it('a commit whose push needs resolution is reported as removed, publishing pending', async () => {
-    const { service, workflow } = build(stubWorkflow({ pushNeedsResolution: true }));
+    const { service, versionControl } = build(stubVersionControl({ pushNeedsResolution: true }));
     const result = await service.remove(ADMIN, LEE, 'deleted-1');
-    expect(workflow.commits).toHaveLength(1);
+    expect(versionControl.commits).toHaveLength(1);
     expect(result.publishPending).toBe(true);
     expect(result.removedFrom.sort()).toEqual(['Sales/Plan.md', 'Sales/access.md', 'groups.yaml', 'roles.yaml']);
     expect(result.stillNamedIn).toEqual([]);

package/src/modules/access/access-control.service.ts

@@ -8,7 +8,7 @@ const log = logger('access');
 import { isAbsence, type ITreeWalker, type WalkListener } from '../../shared/fs.contract.js';
 import { assertOneSpecPerLine, isCommitSha, isGitTimeout, type IGitRunner } from '../../shared/git.contract.js';
 import { hashEmail } from '../../shared/email-identity.js';
-import { NodeGitRunner } from '../workflow/index.js';
+import { NodeGitRunner } from '../version-control/index.js';
 import { readRevSha } from '../kb-fs/index.js';
 import type { WorkspaceService } from '../workspace/index.js';
 import type {

package/src/modules/access/access-declarations.ts

@@ -1,5 +1,5 @@
 import type { FileTreeEntry, IWorkspaceService } from '@bevel-software/platform-shared';
-import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { VersionControlDomainError } from '../../shared/domain-errors.js';
 import { accessMdPathForFolder } from './access-mutation.service.js';
 import {
   EVERYONE_CANONICAL,
@@ -75,7 +75,7 @@ export interface AccessDeclaration {
 export const DECLARATION_SCAN_FILE_CAP = 400;
 
 /** 400 for a target that is not a folder. */
-export class AccessDeclarationsError extends WorkflowDomainError {
+export class AccessDeclarationsError extends VersionControlDomainError {
   constructor(message: string, status = 400) {
     super(message, status);
     this.name = 'AccessDeclarationsError';

package/src/modules/access/access-mutation.service.ts

@@ -53,7 +53,7 @@ import {
   AccessSpliceError,
 } from '../access-model/index.js';
 import type { Verb, Principal, TokenMatch } from '../access-model/index.js';
-import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { VersionControlDomainError } from '../../shared/domain-errors.js';
 import {
   canCarryFrontmatter,
   FOLDER_GOVERNS_ACCESS_KIND,
@@ -64,7 +64,7 @@ import {
 export type TargetKind = 'folder' | 'file';
 
 /** Bad-request-class mutation failure (invalid principal, unknown role/group, lockout). */
-export class AccessMutationError extends WorkflowDomainError {
+export class AccessMutationError extends VersionControlDomainError {
   constructor(message: string, status = 400, payload?: Record<string, unknown>) {
     super(message, status, payload);
     this.name = 'AccessMutationError';

package/src/modules/access/access-requests.routes.ts

@@ -1,5 +1,5 @@
 import express from 'express';
-import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared';
+import type { AuthUser, IVersionControlService } from '@bevel-software/platform-shared';
 import { logger } from '../../shared/logging.js';
 import type { KbContext } from '../../shared/kb-context.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
@@ -48,15 +48,15 @@ export function createAccessRequestRoutes(deps: {
   accessControl: IAccessControl;
   workspaceService: WorkspaceService;
   authService: AuthService;
-  workflow: IWorkflowService;
+  versionControl: IVersionControlService;
   lifecycle: IAccessRequestLifecycle;
   kb: KbContext;
 }): express.Router {
-  const { accessControl, workspaceService, authService, workflow, lifecycle, kb } = deps;
+  const { accessControl, workspaceService, authService, versionControl, lifecycle, kb } = deps;
   const { kbDirName } = kb;
   const router = express.Router({ mergeParams: true });
   const mutation = new AccessMutationService(workspaceService, accessControl, kbDirName);
-  const requests = new AccessRequestsService({ workflow, workspaceService, lifecycle, kb });
+  const requests = new AccessRequestsService({ versionControl, workspaceService, lifecycle, kb });
 
   async function requireUser(
     req: express.Request,
@@ -228,7 +228,7 @@ export function createAccessRequestRoutes(deps: {
         res.json({ requests: [] });
         return;
       }
-      const crs = await workflow.listChangeRequests();
+      const crs = await versionControl.listChangeRequests();
       const rows = await lifecycle.list(target.path, target, crs, user);
       // The note is the request's own column, read back per request.
       // Bounded by the open requests on ONE item — a handful at most — and a
@@ -236,7 +236,7 @@ export function createAccessRequestRoutes(deps: {
       // belongs to.
       const withNotes = await Promise.all(
         rows.map(async (row) => {
-          const detail = await workflow
+          const detail = await versionControl
             .getChangeRequestDetail(row.number, { patches: false })
             .catch(() => null);
           const note = detail?.accessRequest?.note;
@@ -265,7 +265,7 @@ export function createAccessRequestRoutes(deps: {
         res.status(400).json({ error: 'Invalid change request number' });
         return;
       }
-      const cr = await workflow.getChangeRequest(number);
+      const cr = await versionControl.getChangeRequest(number);
       if (!cr) {
         res.status(404).json({ error: 'Not found' });
         return;

package/src/modules/access/access-requests.service.ts

@@ -2,7 +2,7 @@ import path from 'node:path';
 import {
   joinBranchFor,
   type AuthUser,
-  type IWorkflowService,
+  type IVersionControlService,
 } from '@bevel-software/platform-shared';
 import {
   ChangeRequestConflictsError,
@@ -78,7 +78,7 @@ export function escapeMarkdown(text: string): string {
 export class AccessRequestsService {
   constructor(
     private readonly deps: {
-      workflow: IWorkflowService;
+      versionControl: IVersionControlService;
       workspaceService: WorkspaceService;
       lifecycle: IAccessRequestLifecycle;
       kb: Pick<KbContext, 'defaultBranch' | 'defaultWorkspaceId' | 'kbDirName'>;
@@ -103,7 +103,7 @@ export class AccessRequestsService {
   }): Promise<{ number: number; level: RequestLevel }> {
     const { user, target, itemName, level } = input;
     const note = (input.note ?? '').trim();
-    const { workflow, workspaceService, kb } = this.deps;
+    const { versionControl, workspaceService, kb } = this.deps;
     const wsId = kb.defaultWorkspaceId();
     const branch = this.branchFor(user.email, target);
 
@@ -113,7 +113,7 @@ export class AccessRequestsService {
     // it is recut below. The branch name already carries the person, so
     // matching it is matching them.
     const openOnBranch = async () =>
-      (await workflow.listChangeRequests({ fresh: true })).find(
+      (await versionControl.listChangeRequests({ fresh: true })).find(
         (cr) => cr.state === 'open' && cr.branch === branch,
       );
     const existing = await openOnBranch();
@@ -124,7 +124,7 @@ export class AccessRequestsService {
     // got there first, and a message is not a contract. STRICT: the list
     // proves absence, and a listing that could not fetch proves nothing.
     const branchExists = async () =>
-      (await workflow.listBranches(wsId, { freshFetch: true, strictFetch: true })).some(
+      (await versionControl.listBranches(wsId, { freshFetch: true, strictFetch: true })).some(
         (b) => b.name === branch,
       );
     // A branch still standing here belonged to an ANSWERED request: it holds a
@@ -144,7 +144,7 @@ export class AccessRequestsService {
     let present = await branchExists();
     if (present) {
       try {
-        await workflow.deleteBranch(wsId, branch, user);
+        await versionControl.deleteBranch(wsId, branch, user);
         // A delete that RETURNED is proof enough; re-probing here would let a
         // ref list that has not caught up talk us out of cutting the branch we
         // just removed, and the proposal would have nowhere to go.
@@ -165,7 +165,7 @@ export class AccessRequestsService {
     }
     if (!present) {
       try {
-        await workflow.createBranch(wsId, branch, kb.defaultBranch);
+        await versionControl.createBranch(wsId, branch, kb.defaultBranch);
       } catch (err) {
         if (!(await branchExists())) throw err;
       }
@@ -195,7 +195,7 @@ export class AccessRequestsService {
       });
     if (onBranch !== spliced.text) {
       await workspaceService.writeFile(ws.id, wsRulesPath, spliced.text);
-      await workflow.commitChanges(
+      await versionControl.commitChanges(
         ws.id,
         user,
         `Request ${LEVEL_LABEL[level].toLowerCase()} access to ${itemName}`,
@@ -206,7 +206,7 @@ export class AccessRequestsService {
       // The level and the note are the request's own columns — what the
       // dialog and the editors' banner read back. The description is for the
       // people who read the request, and says the same things in prose.
-      const detail = await workflow.openChangeRequest(ws.id, user, {
+      const detail = await versionControl.openChangeRequest(ws.id, user, {
         sourceBranch: branch,
         targetBranch: kb.defaultBranch,
         title: `Access request: ${itemName}`,
@@ -260,10 +260,10 @@ export class AccessRequestsService {
    *                 claiming a refusal nobody made.
    */
   async status(user: AuthUser, target: AccessRequestTarget): Promise<AccessRequestStatus> {
-    const { workflow } = this.deps;
+    const { versionControl } = this.deps;
     const branch = this.branchFor(user.email, target);
 
-    const open = (await workflow.listChangeRequests({ fresh: true })).find(
+    const open = (await versionControl.listChangeRequests({ fresh: true })).find(
       (cr) => cr.state === 'open' && cr.branch === branch,
     );
     if (open) {
@@ -272,7 +272,7 @@ export class AccessRequestsService {
 
     const level = await this.levelAskedOn(branch, target, user.email);
     if (!level) return { state: 'none' };
-    const last = await workflow.latestClosedChangeRequest(user.email, branch);
+    const last = await versionControl.latestClosedChangeRequest(user.email, branch);
     return last ? { state: 'not-accepted', level, number: last.number } : { state: 'none' };
   }
 
@@ -288,7 +288,7 @@ export class AccessRequestsService {
    * for, and Can edit is the lesser claim.
    */
   private async levelOf(number: number): Promise<RequestLevel> {
-    const detail = await this.deps.workflow
+    const detail = await this.deps.versionControl
       .getChangeRequestDetail(number, { patches: false })
       .catch(() => null);
     return detail?.accessRequest?.level ?? 'write';

package/src/modules/access/access.routes.ts

@@ -22,8 +22,8 @@ import type { KbContext } from '../../shared/kb-context.js';
 import type { ITreeWalker } from '../../shared/fs.contract.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import type { AuthService, IAccountSwitchGuard } from '../auth/index.js';
-import type { WorkflowService, WorkflowEventBus } from '../workflow/index.js';
-import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import type { VersionControlService, VersionControlEventBus } from '../version-control/index.js';
+import { VersionControlDomainError } from '../../shared/domain-errors.js';
 import { AccessDeniedError } from '../access-model/index.js';
 import {
   AccessMutationService,
@@ -90,8 +90,8 @@ export function createAccessRoutes(
   authService: AuthService,
   /** Auth's switch-off coordination, for the invite's promotion (`ifActive`). */
   switchGuard: IAccountSwitchGuard,
-  workflowService: WorkflowService,
-  eventBus: WorkflowEventBus,
+  versionControlService: VersionControlService,
+  eventBus: VersionControlEventBus,
   db: Database,
   kb: KbContext,
   /** The composition root's walk, for the roles admin's reference scan. */
@@ -104,7 +104,7 @@ export function createAccessRoutes(
   const mutation = new AccessMutationService(workspaceService, accessControl, kbDirName);
   const rolesAdmin = new RolesAdminService(
     workspaceService,
-    workflowService,
+    versionControlService,
     accessControl,
     disk,
     kbDirName,
@@ -878,7 +878,7 @@ export function createAccessRoutes(
     user: AuthUser,
     op: () => Promise<void>,
   ): Promise<void> {
-    const existing = await workflowService.getLock(workspaceId, branch, wsEditPath);
+    const existing = await versionControlService.getLock(workspaceId, branch, wsEditPath);
     if (existing && existing.holderUserId === user.id) {
       // Caller already holds the lock (mid-edit) — write without touching it.
       await op();
@@ -894,7 +894,7 @@ export function createAccessRoutes(
       eventBus.emit({ kind: 'fs-tree-changed', workspaceId, branch });
       return;
     }
-    const acquired = await workflowService.acquireLock(workspaceId, branch, wsEditPath, user);
+    const acquired = await versionControlService.acquireLock(workspaceId, branch, wsEditPath, user);
     if (!acquired.acquired) {
       const holder = acquired.lock.holderName || 'another user';
       const err: Error & { status?: number } = new Error(
@@ -913,16 +913,16 @@ export function createAccessRoutes(
         // upload. Every other failure may have left partial bytes, so it keeps
         // the discarding release.
         if (isFolderGovernsRefusal(err)) {
-          await workflowService.releaseLockUntouched(workspaceId, branch, wsEditPath, user);
+          await versionControlService.releaseLockUntouched(workspaceId, branch, wsEditPath, user);
         } else {
-          await workflowService.releaseLockNoCommit(workspaceId, branch, wsEditPath, user);
+          await versionControlService.releaseLockNoCommit(workspaceId, branch, wsEditPath, user);
         }
       } catch {
         /* best-effort */
       }
       throw err;
     }
-    await workflowService.releaseLock(workspaceId, branch, wsEditPath, user);
+    await versionControlService.releaseLock(workspaceId, branch, wsEditPath, user);
     eventBus.emit({ kind: 'fs-tree-changed', workspaceId, branch });
   }
 
@@ -1238,7 +1238,7 @@ export function createAccessRoutes(
       if (err instanceof AccessDeniedError || err instanceof AccessMutationError) {
         logger('access.revoke.denied').warn(
           `ws=${workspaceId} byUserId=${user.id} -> ${
-            err instanceof WorkflowDomainError ? err.status : 500
+            err instanceof VersionControlDomainError ? err.status : 500
           }`,
         );
       }