@bevel-software/platform-core-backend 0.35.0 → 0.37.0

package/src/modules/plugins/__tests__/join-requests.settlement.test.ts

@@ -4,7 +4,7 @@ import {
   joinBranchFor,
   type AuthUser,
   type ChangeRequest,
-  type IWorkflowService,
+  type IVersionControlService,
 } from '@bevel-software/platform-shared';
 import { type WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
@@ -82,10 +82,10 @@ function makeHarness(
       return text;
     }),
   } as unknown as WorkspaceService;
-  const workflow = {
+  const versionControl = {
     rejectChangeRequest: vi.fn(async () => ({ number: 7, state: 'closed' })),
     deleteBranch: vi.fn(async () => undefined),
-  } as unknown as IWorkflowService;
+  } as unknown as IVersionControlService;
   const asked: { verb: string; path: string; email: string }[] = [];
   const answer = (verb: 'canRead' | 'canWrite' | 'canOwner' | 'canDownload') =>
     vi.fn(async (_ws: string, email: string, path: string) => {
@@ -99,8 +99,8 @@ function makeHarness(
     canDownload: answer('canDownload'),
   } as unknown as IAccessControl;
   return {
-    svc: new JoinRequestsService(workspaceService, workflow, testKbContext(), accessControl),
-    workflow,
+    svc: new JoinRequestsService(workspaceService, versionControl, testKbContext(), accessControl),
+    versionControl,
     asked,
     fetches,
   };
@@ -112,8 +112,8 @@ describe('a request settles once the person holds what it asked for', () => {
     // so an owner grant made in the dialog retires the Can edit request.
     const h = makeHarness(ASKS_WRITE, { canWrite: true });
     await expect(h.svc.list('GTM', folderTarget(FOLDER), [cr()], ACTOR)).resolves.toEqual([]);
-    expect(h.workflow.rejectChangeRequest).toHaveBeenCalled();
-    expect(h.workflow.deleteBranch).toHaveBeenCalledWith(expect.anything(), BRANCH, ACTOR);
+    expect(h.versionControl.rejectChangeRequest).toHaveBeenCalled();
+    expect(h.versionControl.deleteBranch).toHaveBeenCalledWith(expect.anything(), BRANCH, ACTOR);
   });
 
   it('asks about the ITEM, not its rules file — a folder request is about the folder', async () => {
@@ -134,7 +134,7 @@ describe('a request settles once the person holds what it asked for', () => {
     const out = await h.svc.list('GTM', folderTarget(FOLDER), [cr()], ACTOR);
     expect(out).toHaveLength(1);
     expect(out[0].proposals.map((p) => p.verb)).toEqual(['write']);
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
   });
 
   it('keeps today\'s literal rule for a proposal naming a ROLE', async () => {
@@ -145,7 +145,7 @@ describe('a request settles once the person holds what it asked for', () => {
     const out = await h.svc.list('GTM', folderTarget(FOLDER), [cr()], ACTOR);
     expect(out).toHaveLength(1);
     expect(out[0].proposals.map((p) => p.label)).toEqual(['role/Analysts']);
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
   });
 
   it('leaves the request open when the resolver cannot answer', async () => {
@@ -155,7 +155,7 @@ describe('a request settles once the person holds what it asked for', () => {
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
     const out = await h.svc.list('GTM', folderTarget(FOLDER), [cr()], ACTOR);
     expect(out).toHaveLength(1);
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
     warn.mockRestore();
   });
 });
@@ -182,27 +182,27 @@ describe('a branch that cannot be read settles nothing', () => {
     expect(h.fetches.some((f) => f.force)).toBe(true);
     expect(out).toHaveLength(1);
     expect(out[0].proposals.map((p) => p.verb)).toEqual(['write']);
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
   });
 
   it('leaves the request open — and unclosed — when the branch still cannot be read', async () => {
     const h = makeHarness(undefined);
     await expect(h.svc.list('GTM', folderTarget(FOLDER), [cr()], ACTOR)).resolves.toEqual([]);
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
-    expect(h.workflow.deleteBranch).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.deleteBranch).not.toHaveBeenCalled();
   });
 
   it('reconcile refuses to settle one it could not read', async () => {
     const h = makeHarness(undefined);
     await expect(h.svc.reconcile('GTM', folderTarget(FOLDER), cr(), ACTOR)).resolves.toBe(false);
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
   });
 
   it('still settles a branch it DID read that proposes nothing', async () => {
     // The distinction has to cut both ways, or nothing would ever retire.
     const h = makeHarness(DEFAULT_MD);
     await expect(h.svc.reconcile('GTM', folderTarget(FOLDER), cr(), ACTOR)).resolves.toBe(true);
-    expect(h.workflow.rejectChangeRequest).toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).toHaveBeenCalled();
   });
 });
 
@@ -227,7 +227,7 @@ describe('a person the rules explicitly deny', () => {
     const out = await h.svc.list('GTM', folderTarget(FOLDER), [cr()], ACTOR);
     expect(out).toHaveLength(1);
     expect(out[0].proposals.map((p) => p.verb)).toEqual(['write']);
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
   });
 
   it('retires it once the grant has landed and the resolver says they write', async () => {
@@ -254,8 +254,8 @@ describe('a stale ref must not be mistaken for a finished request', () => {
     const h = staleHarness();
     const out = await h.svc.list('GTM', folderTarget(FOLDER), [cr()], ACTOR);
 
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
-    expect(h.workflow.deleteBranch).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.deleteBranch).not.toHaveBeenCalled();
     // And having fetched, it reports the proposal rather than nothing.
     expect(out).toHaveLength(1);
     expect(out[0].proposals.map((p) => p.verb)).toEqual(['write']);
@@ -264,7 +264,7 @@ describe('a stale ref must not be mistaken for a finished request', () => {
   it('reconcile refuses to settle it either', async () => {
     const h = staleHarness();
     await expect(h.svc.reconcile('GTM', folderTarget(FOLDER), cr(), ACTOR)).resolves.toBe(false);
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
   });
 
   it('confirms with a FORCED fetch before closing anything', async () => {
@@ -272,7 +272,7 @@ describe('a stale ref must not be mistaken for a finished request', () => {
     await h.svc.list('GTM', folderTarget(FOLDER), [cr()], ACTOR);
     expect(h.fetches.some((f) => f.force)).toBe(true);
     // Genuinely finished — the confirming read agrees, so it closes.
-    expect(h.workflow.rejectChangeRequest).toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).toHaveBeenCalled();
   });
 });
 
@@ -318,10 +318,10 @@ describe('a request whose target is a FILE', () => {
         return text;
       }),
     } as unknown as WorkspaceService;
-    const workflow = {
+    const versionControl = {
       rejectChangeRequest: vi.fn(async () => ({ number: 7, state: 'closed' })),
       deleteBranch: vi.fn(async () => undefined),
-    } as unknown as IWorkflowService;
+    } as unknown as IVersionControlService;
     const answer = (verb: string) => vi.fn(async () => holds[verb] ?? false);
     const accessControl = {
       canRead: answer('canRead'),
@@ -330,8 +330,8 @@ describe('a request whose target is a FILE', () => {
       canDownload: answer('canDownload'),
     } as unknown as IAccessControl;
     return {
-      svc: new JoinRequestsService(workspaceService, workflow, testKbContext(), accessControl),
-      workflow,
+      svc: new JoinRequestsService(workspaceService, versionControl, testKbContext(), accessControl),
+      versionControl,
       workspaceService,
     };
   }
@@ -342,8 +342,8 @@ describe('a request whose target is a FILE', () => {
 
     expect(out).toHaveLength(1);
     expect(out[0].proposals.map((p) => p.verb)).toEqual(['write']);
-    expect(h.workflow.rejectChangeRequest).not.toHaveBeenCalled();
-    expect(h.workflow.deleteBranch).not.toHaveBeenCalled();
+    expect(h.versionControl.rejectChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.deleteBranch).not.toHaveBeenCalled();
   });
 
   it('reads the FILE itself, never an access.md beside it', async () => {

package/src/modules/plugins/__tests__/plugin-rename.service.test.ts

@@ -1,13 +1,12 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
-import { NodeFs } from '../../kb-fs/node-fs.js';
-import type { TreeWalkOptions, WalkListener, WalkResult } from '../../../shared/fs.contract.js';
+import { realDisk } from '../../../__tests__/real-disk.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
 import { DEFAULT_BRANCH, pluginDisplayNameOf, type AuthUser } from '@bevel-software/platform-shared';
 
-import type { WorkspaceService } from '../../workspace/workspace.service.js';
-import { AccessControlService } from '../../access/access-control.service.js';
+import type { WorkspaceService } from '../../workspace/index.js';
+import { realAccessControl } from '../../../__tests__/real-access.js';
 import { PushNeedsAgentResolutionError } from '../../../shared/domain-errors.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { KbPluginSource } from '../discovery/kb-plugin-source.js';
@@ -16,22 +15,22 @@ import { testKbContext } from '../../../__tests__/kb-context.js';
 
 // The one walk of the checkout, with a switch that makes it report a hole —
 // the way a folder it cannot list would — to every listener on it. The
-// walk is injected, so the switch is a disk that lies, not a module mock.
+// walk is injected, so the switch is a disk that lies, not a module mock:
+// the real disk the shared fixture hands out, its walk wrapped.
 const walkMock = { holeInTheWalk: false };
-class HoledFs extends NodeFs {
-  override async walkKb(
-    root: string,
-    listeners: readonly WalkListener[],
-    options?: Omit<TreeWalkOptions, 'skip'>,
-  ): Promise<WalkResult> {
-    const result = await super.walkKb(root, listeners, options);
+function holedDisk(): ReturnType<typeof realDisk> {
+  const disk = realDisk();
+  const walkKb = disk.walkKb.bind(disk);
+  disk.walkKb = async (root, listeners, options) => {
+    const result = await walkKb(root, listeners, options);
     if (walkMock.holeInTheWalk) {
       const err = Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' });
       for (const l of listeners) await l.onHole?.('KnowledgeBase/Notes', err);
       result.holes.push('KnowledgeBase/Notes');
     }
     return result;
-  }
+  };
+  return disk;
 }
 
 /**
@@ -58,15 +57,19 @@ describe('PluginRenameService', () => {
   let repo: string;
   let commits: { summary: string; paths: string[] }[];
   let failNextCommit: Error | null;
+  /** What each workspace-relative path last read as when it was committed — the driver's picture of the tree. */
+  let committed: Map<string, string>;
   let failWriteMatching: string | null;
   let invalidated: number;
-  let access: AccessControlService;
+  let access: ReturnType<typeof realAccessControl>;
   let svc: PluginRenameService;
 
+  // A seed is a committed file: what origin has before the rename runs.
   const write = async (rel: string, text: string) => {
     const abs = path.join(repo, rel);
     await fs.mkdir(path.dirname(abs), { recursive: true });
     await fs.writeFile(abs, text);
+    committed.set(`${KB_DIR}/${rel}`, text);
   };
   const read = (rel: string) => fs.readFile(path.join(repo, rel), 'utf-8');
   const manifest = async () => JSON.parse(await read('Plugins/GTM/plugin.json'));
@@ -77,6 +80,7 @@ describe('PluginRenameService', () => {
     commits = [];
     failNextCommit = null;
     failWriteMatching = null;
+    committed = new Map();
     walkMock.holeInTheWalk = false;
     invalidated = 0;
     const workspaceService = {
@@ -101,7 +105,19 @@ describe('PluginRenameService', () => {
           failNextCommit = null;
           throw err;
         }
+        // Git's rule: a tree whose files all read as they were last committed
+        // has nothing to commit, and the service is answered null.
+        let changed = false;
+        for (const p of paths) {
+          const now = await fs.readFile(path.join(root, wsId, p), 'utf-8');
+          if (now !== committed.get(p)) {
+            changed = true;
+            committed.set(p, now);
+          }
+        }
+        if (!changed) return null;
         commits.push({ summary, paths });
+        return { sha: 'c0ffee' } as never;
       },
     };
 
@@ -114,8 +130,8 @@ describe('PluginRenameService', () => {
     await write('Skills/Eng/deploy/access.md', DEPLOY_RULES);
     await write('Skills/Eng/deploy/SKILL.md', '---\ndescription: Ship it.\n---\n');
 
-    access = new AccessControlService(workspaceService, KB_DIR, new NodeFs());
-    const disk = new HoledFs();
+    access = realAccessControl(workspaceService, KB_DIR, realDisk());
+    const disk = holedDisk();
     svc = new PluginRenameService(workspaceService, driver, access, new KbPluginSource(disk, testKbContext({ kbDirName: KB_DIR })), disk, testKbContext({ kbDirName: KB_DIR }), undefined, () => {
       invalidated += 1;
     });
@@ -125,7 +141,7 @@ describe('PluginRenameService', () => {
   it('refuses to claim a name against a listing with a hole in it — an unreadable folder may hold that very plugin', async () => {
     // Discovery as the walker reports it when a folder exists but could not
     // be read: the plugins it did see, plus the hole.
-    const real = new KbPluginSource(new NodeFs(), testKbContext({ kbDirName: KB_DIR }));
+    const real = new KbPluginSource(realDisk(), testKbContext({ kbDirName: KB_DIR }));
     const holed = {
       dialect: 'kb',
       discover: async (root: string) => ({ ...(await real.discover(root)), unreadable: ['Plugins/Hidden'] }),
@@ -135,7 +151,7 @@ describe('PluginRenameService', () => {
       { commitChanges: async () => { throw new Error('must not commit'); } },
       access,
       holed,
-      new NodeFs(),
+      realDisk(),
       testKbContext({ kbDirName: KB_DIR }),
     );
     await expect(svcOverHole.rename(manager, 'gtm', { name: 'go-to-market' })).rejects.toMatchObject({
@@ -156,7 +172,7 @@ describe('PluginRenameService', () => {
   });
 
   it('tells a NON-manager nothing about the tree — a holed discovery is still just "unknown plugin" to them', async () => {
-    const real = new KbPluginSource(new NodeFs(), testKbContext({ kbDirName: KB_DIR }));
+    const real = new KbPluginSource(realDisk(), testKbContext({ kbDirName: KB_DIR }));
     const holed = {
       dialect: 'kb',
       discover: async (root: string) => ({ ...(await real.discover(root)), unreadable: ['Plugins/Hidden'] }),
@@ -166,7 +182,7 @@ describe('PluginRenameService', () => {
       { commitChanges: async () => { throw new Error('must not commit'); } },
       access,
       holed,
-      new NodeFs(),
+      realDisk(),
       testKbContext({ kbDirName: KB_DIR }),
     );
     const refusal = await svcOverHole.rename(member, 'gtm', { name: 'go-to-market' }).catch((e: unknown) => e);
@@ -270,7 +286,7 @@ describe('PluginRenameService', () => {
       expect(await read('Skills/Eng/deploy/access.md')).toBe(DEPLOY_RULES);
       // The three answers that must never diverge: the rename's, the
       // discovery source's, and the shared reader's over the file itself.
-      const { plugins } = await new KbPluginSource(new NodeFs(), testKbContext({ kbDirName: KB_DIR })).discover(repo);
+      const { plugins } = await new KbPluginSource(realDisk(), testKbContext({ kbDirName: KB_DIR })).discover(repo);
       const found = plugins.find((p) => p.folder === 'Plugins/GTM')!;
       expect([found.name, found.displayName]).toEqual([result.name, result.displayName]);
       expect(pluginDisplayNameOf(JSON.parse(await read('Plugins/GTM/plugin.json')))).toBe(result.displayName);
@@ -413,6 +429,15 @@ describe('PluginRenameService', () => {
     expect(await access.canRead(wsId, member.email, 'Skills/Eng/deploy/SKILL.md')).toBe(true);
   });
 
+  it('changes no bytes when the manifest already reads as the rename writes it — a clean tree, nothing to commit', async () => {
+    // The manifest already reads exactly as the rename will write it.
+    const asWritten = `${JSON.stringify({ name: 'gtm', version: '1.0.0', displayName: 'GTM' }, null, 2)}\n`;
+    await write('Plugins/GTM/plugin.json', asWritten);
+    await svc.rename(manager, 'gtm', { displayName: 'GTM' });
+    expect(await read('Plugins/GTM/plugin.json')).toBe(asWritten);
+    expect(commits).toEqual([]);
+  });
+
   it('will not rename a plugin read from an external format — that repository owns its name', async () => {
     await write('Plugins/Ext/plugin.bundle.json', '{"name":"ext"}');
     await write('Plugins/Ext/access.md', GTM_RULES);

package/src/modules/plugins/__tests__/plugins.routes.test.ts

@@ -5,16 +5,16 @@ import path from 'node:path';
 import os from 'node:os';
 import express from 'express';
 import { describe, it, expect, afterEach, vi } from 'vitest';
-import { NodeFs } from '../../kb-fs/node-fs.js';
+import { realDisk } from '../../../__tests__/real-disk.js';
 import { KbPluginSource } from '../discovery/kb-plugin-source.js';
 
 import { DEFAULT_BRANCH, joinBranchFor } from '@bevel-software/platform-shared';
-import type { ChangeRequest, IWorkflowService } from '@bevel-software/platform-shared';
+import type { ChangeRequest, IVersionControlService } from '@bevel-software/platform-shared';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
-import type { WorkspaceService } from '../../workspace/workspace.service.js';
-import type { IAccessControl } from '../../access/access-control.interface.js';
-import type { ISkillService, SkillSummary } from '../../skills/skills.contract.js';
-import type { IToolManualService, ToolManualSummary } from '../../tool-manuals/tool-manuals.contract.js';
+import type { WorkspaceService } from '../../workspace/index.js';
+import type { IAccessControl } from '../../access/index.js';
+import type { ISkillService, SkillSummary } from '../../skills/index.js';
+import type { IToolManualService, ToolManualSummary } from '../../tool-manuals/index.js';
 import { PluginIndexService } from '../plugins.service.js';
 import { createPluginCreationRoutes, createPluginsRoutes } from '../plugins.routes.js';
 import type { JoinRequestsService } from '../join-requests.service.js';
@@ -30,7 +30,7 @@ import { testKbContext } from '../../../__tests__/kb-context.js';
  * verdicts), the fail-closed omission of plugins with no verdict at all, and
  * the join flow that rides on plain change requests.
  *
- * The plugin index is REAL over a temp KB; access control and the workflow are
+ * The plugin index is REAL over a temp KB; access control and the version-control service are
  * stubs, because what's under test here is the route's use of them.
  */
 
@@ -137,7 +137,7 @@ async function makeHarness(opts: HarnessOpts = {}) {
     eligibleReaders: async () => ({ restricted: true, roles: ['GTM Team'], users: [OLGA] }),
   } as unknown as IAccessControl;
 
-  const workflow = {
+  const versionControl = {
     listChangeRequestsAuthoredBy: vi.fn(async () => opts.authoredCrs ?? []),
     listChangeRequests: vi.fn(async () => opts.authoredCrs ?? []),
     getChangeRequest: vi.fn(
@@ -147,7 +147,7 @@ async function makeHarness(opts: HarnessOpts = {}) {
     listBranches: vi.fn(async () => []),
     commitChanges: vi.fn(async () => null),
     openChangeRequest: vi.fn(async () => ({ number: 42 })),
-  } as unknown as IWorkflowService;
+  } as unknown as IVersionControlService;
 
   const skillService = { listSkills: async () => opts.skills ?? [] } as unknown as ISkillService;
   const toolService = {
@@ -162,7 +162,7 @@ async function makeHarness(opts: HarnessOpts = {}) {
       skillService,
       toolService,
       testKbContext({ kbDirName: KB }),
-      new KbPluginSource(new NodeFs(), testKbContext({ kbDirName: KB })),
+      new KbPluginSource(realDisk(), testKbContext({ kbDirName: KB })),
     );
 
   const email = opts.email === undefined ? ALI : opts.email;
@@ -183,7 +183,7 @@ async function makeHarness(opts: HarnessOpts = {}) {
   // The records half is REAL over an in-memory table, because the route's
   // whole contract now is "write a row, answer, then do the git" — a stub
   // would assert the route called something, not that the row and the change
-  // request are one-to-one. The git it eventually does is the workflow stub
+  // request are one-to-one. The git it eventually does is the version-control service stub
   // above, as it always was.
   const joinRequestStore = new FakeJoinRequestStore();
   // The change requests the store can see are the ones the listing is told
@@ -191,7 +191,7 @@ async function makeHarness(opts: HarnessOpts = {}) {
   // telling the record it names that the request is over.
   for (const c of opts.authoredCrs ?? []) joinRequestStore.changeRequests.set(c.number, c.state);
   const joinRequestJobs = new PluginJoinRequestJobs(joinRequestStore, {
-    workflow,
+    versionControl,
     workspaceService,
     kb: testKbContext({ kbDirName: KB }),
     target: async (pluginKey) => {
@@ -224,7 +224,7 @@ async function makeHarness(opts: HarnessOpts = {}) {
     createPluginsRoutes(
       index,
       accessControl,
-      workflow,
+      versionControl,
       joinRequests,
       joinRequestJobs,
       provision as never,
@@ -241,7 +241,7 @@ async function makeHarness(opts: HarnessOpts = {}) {
     server,
     baseUrl: `http://127.0.0.1:${addr.port}`,
     accessControl,
-    workflow,
+    versionControl,
     workspaceService,
     joinRequests,
     joinRequestJobs,
@@ -516,9 +516,9 @@ describe('/api/plugins routes', () => {
     const h = await makeHarness({ readable: { [ALI]: ['Plugins/Finance/access.md'] } });
     server = h.server;
     // The one thing the endpoint may not do any more is wait for a clone. A
-    // workflow that never settles stands in for one: the answer must arrive
+    // a version-control service that never settles stands in for one: the answer must arrive
     // anyway, and say the request is recorded and not yet carried.
-    (h.workflow.createBranch as ReturnType<typeof vi.fn>).mockReturnValue(new Promise(() => {}));
+    (h.versionControl.createBranch as ReturnType<typeof vi.fn>).mockReturnValue(new Promise(() => {}));
 
     const res = await fetch(`${h.baseUrl}/api/plugins/finance/join-request`, { method: 'POST' });
     expect(res.status).toBe(200);
@@ -526,13 +526,13 @@ describe('/api/plugins routes', () => {
     expect(h.joinRequestStore.all()).toMatchObject([
       { requesterEmail: ALI, pluginKey: 'Finance', status: 'pending', changeRequestNumber: null },
     ]);
-    expect(h.workflow.openChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.openChangeRequest).not.toHaveBeenCalled();
   });
 
   it('join-request: the recorded request is REPORTED as requested before its CR exists', async () => {
     const h = await makeHarness({ readable: { [ALI]: ['Plugins/Finance/access.md'] } });
     server = h.server;
-    (h.workflow.createBranch as ReturnType<typeof vi.fn>).mockReturnValue(new Promise(() => {}));
+    (h.versionControl.createBranch as ReturnType<typeof vi.fn>).mockReturnValue(new Promise(() => {}));
     await fetch(`${h.baseUrl}/api/plugins/finance/join-request`, { method: 'POST' });
 
     // A reload one second after the click. No change request exists — the
@@ -557,7 +557,7 @@ describe('/api/plugins routes', () => {
     // The branch is cut from the FOLDER name, as every join branch before the
     // manifest became the identity was — so none of them is orphaned.
     const branch = joinBranchFor(ALI, 'Finance');
-    expect(h.workflow.createBranch).toHaveBeenCalledWith(wsId, branch, DEFAULT_BRANCH);
+    expect(h.versionControl.createBranch).toHaveBeenCalledWith(wsId, branch, DEFAULT_BRANCH);
     // The write went to the plugin's access.md and added the caller to the
     // BODY's read list (folder rules), leaving the discovery frontmatter alone.
     const write = (h.workspaceService.writeFile as ReturnType<typeof vi.fn>).mock.calls[0];
@@ -566,8 +566,8 @@ describe('/api/plugins routes', () => {
     expect((write[2] as string).indexOf('everyone')).toBeLessThan(
       (write[2] as string).indexOf('Ali Baba'),
     );
-    expect(h.workflow.commitChanges).toHaveBeenCalled();
-    expect(h.workflow.openChangeRequest).toHaveBeenCalledWith(
+    expect(h.versionControl.commitChanges).toHaveBeenCalled();
+    expect(h.versionControl.openChangeRequest).toHaveBeenCalledWith(
       workspaceIdForBranch(branch),
       expect.objectContaining({ email: ALI }),
       expect.objectContaining({
@@ -591,7 +591,7 @@ describe('/api/plugins routes', () => {
     await h.joinRequestJobs.drain();
     const branch = joinBranchFor(ALI, 'teams/GTM');
     expect(branch).not.toBe(joinBranchFor(ALI, 'GTM'));
-    expect(h.workflow.createBranch).toHaveBeenCalledWith(wsId, branch, DEFAULT_BRANCH);
+    expect(h.versionControl.createBranch).toHaveBeenCalledWith(wsId, branch, DEFAULT_BRANCH);
   });
 
   it('join-request adopts an existing open join CR instead of opening a second one', async () => {
@@ -603,8 +603,8 @@ describe('/api/plugins routes', () => {
     const res = await fetch(`${h.baseUrl}/api/plugins/finance/join-request`, { method: 'POST' });
     expect(res.status).toBe(200);
     await h.joinRequestJobs.drain();
-    expect(h.workflow.createBranch).not.toHaveBeenCalled();
-    expect(h.workflow.openChangeRequest).not.toHaveBeenCalled();
+    expect(h.versionControl.createBranch).not.toHaveBeenCalled();
+    expect(h.versionControl.openChangeRequest).not.toHaveBeenCalled();
     // The record ends up pointing at the request that was already there.
     expect(h.joinRequestStore.all()).toMatchObject([{ status: 'opened', changeRequestNumber: 9 }]);
   });
@@ -639,13 +639,13 @@ describe('/api/plugins routes', () => {
     await h.joinRequestJobs.drain();
 
     expect(h.joinRequestStore.all()).toHaveLength(1);
-    expect(h.workflow.openChangeRequest).toHaveBeenCalledTimes(1);
+    expect(h.versionControl.openChangeRequest).toHaveBeenCalledTimes(1);
   });
 
   it('join-request: a failure is recorded, and the listing hands the plugin back with the reason', async () => {
     const error = vi.spyOn(console, 'error').mockImplementation(() => {});
     const h = await makeHarness({ readable: { [ALI]: ['Plugins/Finance/access.md'] } });
-    (h.workflow.openChangeRequest as ReturnType<typeof vi.fn>).mockRejectedValue(
+    (h.versionControl.openChangeRequest as ReturnType<typeof vi.fn>).mockRejectedValue(
       new Error('the remote refused the push'),
     );
     server = h.server;
@@ -670,7 +670,7 @@ describe('/api/plugins routes', () => {
   it('join-request: a click after a failure RETRIES the recorded request rather than recording a second', async () => {
     const error = vi.spyOn(console, 'error').mockImplementation(() => {});
     const h = await makeHarness({ readable: { [ALI]: ['Plugins/Finance/access.md'] } });
-    (h.workflow.openChangeRequest as ReturnType<typeof vi.fn>).mockRejectedValueOnce(
+    (h.versionControl.openChangeRequest as ReturnType<typeof vi.fn>).mockRejectedValueOnce(
       new Error('the remote refused the push'),
     );
     server = h.server;
@@ -685,7 +685,7 @@ describe('/api/plugins routes', () => {
     expect(rows).toHaveLength(1);
     expect(rows[0].id).toBe(failed.id);
     expect(rows[0]).toMatchObject({ status: 'opened', changeRequestNumber: 42, failureReason: null });
-    expect(h.workflow.openChangeRequest).toHaveBeenCalledTimes(2);
+    expect(h.versionControl.openChangeRequest).toHaveBeenCalledTimes(2);
     error.mockRestore();
   });
 
@@ -706,7 +706,7 @@ describe('/api/plugins routes', () => {
     await h.joinRequestJobs.sweep();
     await h.joinRequestJobs.drain();
 
-    expect(h.workflow.openChangeRequest).toHaveBeenCalledTimes(1);
+    expect(h.versionControl.openChangeRequest).toHaveBeenCalledTimes(1);
     expect(h.joinRequestStore.all()).toMatchObject([{ status: 'opened', changeRequestNumber: 42 }]);
   });
 
@@ -761,7 +761,7 @@ describe('/api/plugins routes', () => {
     expect(rows).toHaveLength(1);
     expect(rows[0].id).toBe(answered.id);
     expect(rows[0]).toMatchObject({ status: 'opened', changeRequestNumber: 42 });
-    expect(h.workflow.openChangeRequest).toHaveBeenCalledTimes(1);
+    expect(h.versionControl.openChangeRequest).toHaveBeenCalledTimes(1);
   });
 
   it('an opened record whose request is still open counts, before the open listing knows it', async () => {
@@ -811,7 +811,7 @@ describe('/api/plugins routes', () => {
 
   it('degrades hasRequested to false when the CR lookup throws', async () => {
     const h = await makeHarness({ readable: { [ALI]: ['Plugins/Finance/access.md'] } });
-    (h.workflow.listChangeRequestsAuthoredBy as ReturnType<typeof vi.fn>).mockRejectedValueOnce(
+    (h.versionControl.listChangeRequestsAuthoredBy as ReturnType<typeof vi.fn>).mockRejectedValueOnce(
       new Error('gh down'),
     );
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});

package/src/modules/plugins/join-request-jobs.service.ts

@@ -2,11 +2,11 @@ import {
   joinBranchFor,
   type AuthUser,
   type ChangeRequestState,
-  type IWorkflowService,
+  type IVersionControlService,
 } from '@bevel-software/platform-shared';
 import { DrizzleQueryError } from 'drizzle-orm';
 import { spliceGrant } from '../access-model/index.js';
-import { sanitizeError } from '../workflow/index.js';
+import { sanitizeError } from '../version-control/index.js';
 import { logger } from '../../shared/logging.js';
 import { printable } from '../../shared/printable.js';
 import type { KbContext } from '../../shared/kb-context.js';
@@ -139,8 +139,8 @@ export interface JoinRequestTarget {
 }
 
 export interface JoinRequestJobsDeps {
-  workflow: Pick<
-    IWorkflowService,
+  versionControl: Pick<
+    IVersionControlService,
     | 'createBranch'
     | 'listBranches'
     | 'commitChanges'
@@ -521,7 +521,7 @@ export class PluginJoinRequestJobs {
     claim: ClaimedJoinRequest,
     stillOurs: () => Promise<void>,
   ): Promise<void> {
-    const { workflow, workspaceService, kb } = this.deps;
+    const { versionControl, workspaceService, kb } = this.deps;
     const { kbDirName } = kb;
     const target = await this.deps.target(record.pluginKey);
     if (!target) throw new Error('the plugin is no longer available');
@@ -540,7 +540,7 @@ export class PluginJoinRequestJobs {
     // shows nothing to adopt. Paying a round-trip here is the point: it buys
     // the "one recorded request, one change request" promise, and it is off
     // the answer path entirely.
-    const mine = await workflow.listChangeRequestsAuthoredBy(record.requesterEmail, {
+    const mine = await versionControl.listChangeRequestsAuthoredBy(record.requesterEmail, {
       fresh: true,
     });
     const open = mine.find((cr) => cr.state === 'open' && cr.branch === branch);
@@ -596,7 +596,7 @@ export class PluginJoinRequestJobs {
       // replaced, and it left recorded requests owed forever.
       await stillOurs();
       await workspaceService.writeFile(ws.id, accessPath, spliced.text);
-      await workflow.commitChanges(ws.id, user, `Request access to ${target.displayName}`);
+      await versionControl.commitChanges(ws.id, user, `Request access to ${target.displayName}`);
     }
     // The last gate, and the one that matters most: everything above is
     // idempotent and reusable — a branch, a commit on it — but a change
@@ -619,7 +619,7 @@ export class PluginJoinRequestJobs {
     if (!still || still.id !== user.id) {
       throw new Error('the account that asked no longer exists');
     }
-    const detail = await workflow.openChangeRequest(ws.id, user, {
+    const detail = await versionControl.openChangeRequest(ws.id, user, {
       sourceBranch: branch,
       targetBranch: kb.defaultBranch,
       // People read these: the display name, not the identifier.
@@ -653,10 +653,10 @@ export class PluginJoinRequestJobs {
   private async ensureBranch(branch: string): Promise<void> {
     const wsId = this.deps.kb.defaultWorkspaceId();
     try {
-      await this.deps.workflow.createBranch(wsId, branch, this.deps.kb.defaultBranch);
+      await this.deps.versionControl.createBranch(wsId, branch, this.deps.kb.defaultBranch);
       return;
     } catch (err) {
-      const branches = await this.deps.workflow.listBranches(wsId, {
+      const branches = await this.deps.versionControl.listBranches(wsId, {
         freshFetch: true,
         strictFetch: true,
       });