@bevel-software/platform-core-backend 0.4.0 → 0.5.0

package/dist/modules/workflow/git/branch-name.js

@@ -6,7 +6,7 @@ export { PROTECTED_BRANCHES, isProtectedBranch } from '@bevel-software/platform-
 // picker's `canDelete` rule and the backend authorisation check on
 // `deleteBranch` must agree on every edge case (uppercase email, dotted
 // localpart, etc.).
-export { branchAuthorLocalpart, isBranchAuthoredBy } from '@bevel-software/platform-shared';
+export { branchAuthorLocalpart, isBranchAuthoredBy, isOwnSuggestionsBranch, } from '@bevel-software/platform-shared';
 const VALID_BRANCH_REGEX = /^[A-Za-z0-9][A-Za-z0-9/_\-.]*$/;
 /** Throw if `name` cannot safely be passed to `git` as a branch name. */
 export function assertValidBranchName(name) {

package/dist/modules/workflow/git/branch-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"branch-name.js","sourceRoot":"","sources":["../../../../src/modules/workflow/git/branch-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,qGAAqG;AACrG,+EAA+E;AAC/E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACxF,4FAA4F;AAC5F,mEAAmE;AACnE,wEAAwE;AACxE,oBAAoB;AACpB,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAE5F,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,6DAA6D;IAC7D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IACxF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,CAAC,CAAC;IACpE,CAAC;IACD,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;AAC3E,CAAC"}
+{"version":3,"file":"branch-name.js","sourceRoot":"","sources":["../../../../src/modules/workflow/git/branch-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,qGAAqG;AACrG,+EAA+E;AAC/E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACxF,4FAA4F;AAC5F,mEAAmE;AACnE,wEAAwE;AACxE,oBAAoB;AACpB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,6DAA6D;IAC7D,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IACxF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,CAAC,CAAC;IACpE,CAAC;IACD,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;AAC3E,CAAC"}

package/dist/modules/workflow/git/git.service.d.ts

@@ -114,6 +114,7 @@ export declare class GitService implements IGitService {
     createBranch(workspaceId: string, name: string, fromBase?: string): Promise<BranchInfo>;
     deleteBranch(workspaceId: string, name: string, user: AuthUser, opts?: {
         onlyIfNoRemote?: boolean;
+        systemCleanup?: boolean;
     }): Promise<void>;
     /**
      * True iff the given ref (e.g. `refs/heads/foo`, `refs/remotes/origin/foo`)
@@ -172,7 +173,9 @@ export declare class GitService implements IGitService {
      * (mirrors `commitFile` + `push`).
      */
     commitChanges(workspaceId: string, user: AuthUser, summary: string): Promise<CommitAttribution | null>;
-    push(workspaceId: string, user: AuthUser): Promise<void>;
+    push(workspaceId: string, user: AuthUser, opts?: {
+        systemAuthorized?: boolean;
+    }): Promise<void>;
     /**
      * Attempt a local merge of `origin/<targetBranch>` into the currently-
      * checked-out branch. Used by the workflow module to auto-merge target →
@@ -330,9 +333,20 @@ export declare class GitService implements IGitService {
      * excluded — the caller gets exactly the working tree's committed contents.
      */
     listTrackedFiles(workspaceId: string): Promise<string[]>;
-    revertCommit(workspaceId: string, user: AuthUser, sha: string): Promise<CommitAttribution>;
     logForFile(workspaceId: string, relativePath: string, limit?: number): Promise<CommitAttribution[]>;
     diffFileAtCommit(workspaceId: string, relativePath: string, sha: string): Promise<string>;
+    /**
+     * Full file contents on both sides of one commit: `baseline` is the file at
+     * `<sha>^` (the parent), `current` at `<sha>`. Null means the file is absent
+     * at that ref — added files have `baseline: null`, deleted files
+     * `current: null`. A root commit (no parent) also yields `baseline: null`.
+     * Feeds the rendered-markdown history view, which needs before/after text
+     * rather than the patch `diffFileAtCommit` returns.
+     */
+    fileContentsAtCommit(workspaceId: string, relativePath: string, sha: string): Promise<{
+        baseline: string | null;
+        current: string | null;
+    }>;
     diffFileBetweenBranches(workspaceId: string, relativePath: string, fromBranch: string, toBranch: string): Promise<string>;
     /**
      * Head/base commit SHAs for a change request, computed locally — no provider
@@ -364,6 +378,21 @@ export declare class GitService implements IGitService {
      * routing. `changedFilesForPr` is the full version with statuses + diffs.
      */
     changedPathsForPr(workspaceId: string, baseBranch: string, headBranch: string): Promise<string[]>;
+    /**
+     * The merge-base commit of a change request's two branches (their origin
+     * refs), or null when they share no history. This is the "before" the CR's
+     * three-dot diff is read against — the ref a per-file revert restores from,
+     * so the reverted file drops OUT of that same diff.
+     */
+    mergeBaseForPr(workspaceId: string, baseBranch: string, headBranch: string): Promise<string | null>;
+    /**
+     * Restore one path in the working tree (and index) to its content at `ref`;
+     * a path ABSENT at `ref` is deleted — the revert of an added file is its
+     * removal. Byte-exact via git itself (`checkout <ref> -- <path>`), never a
+     * read-as-string round-trip that would mangle binary files. The caller owns
+     * committing the result (see `commitFile`).
+     */
+    restorePathFromRef(workspaceId: string, ref: string, repoRelativePath: string): Promise<void>;
     /** Fetch the two branches a CR spans so origin refs reflect the latest push. */
     private fetchPrRefs;
     /** Unified-diff patch for one file across the CR range (rename-aware). */

package/dist/modules/workflow/git/git.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.service.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/git/git.service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,QAAQ,EACR,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAA2B,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAKL,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AA8B1B;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBxD;AA2ID,qBAAa,UAAW,YAAW,WAAW;IAiB1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,aAAa;IArBhC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAKtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAK;gBAGtC,gBAAgB,EAAE,gBAAgB;IACnD;;;;;;OAMG;IACc,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,cAAqC,EAC5C,aAAa,GAAE,cAAc,GAAG,IAAW;IAG9D;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB,CAA4D;IAEvF,sBAAsB,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAI9E;;;;;OAKG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAI/C;;;;;;;OAOG;YACW,wBAAwB;IAiBtC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,mBAAmB;IA0B3B,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIvD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO,CAAC,UAAU,EAAE,CAAC;IAuGxB;;;;;;;;;;OAUG;YACW,kBAAkB;IAuD1B,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC;IAuEhB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,IAAI,GAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO,GACtC,OAAO,CAAC,IAAI,CAAC;IAoEhB;;;;;;;;;;OAUG;YACW,SAAS;IA2BjB,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,iBAAiB,CAAC;IAiG7B;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCrE,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA4EpC;;;;;;;;;;;;;OAaG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA0C9B,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC9D;;;;;;;;;;;;;;;;;OAiBG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,QAAQ,GACb,OAAO,CACN;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,GAC3C;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CACzC;IA0ED;;;;;;;;;;;;OAYG;IACG,kBAAkB,CACtB,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACzC,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA6FpF,6EAA6E;YAC/D,eAAe;IAS7B;;;;;OAKG;YACW,oBAAoB;IAoB5B,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;YACW,sBAAsB;IAW9B,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwD9C;;;;;;;;;;;;OAYG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa/D;;;;;;;;;;;;;;;OAeG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBjE,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgBlF;;;;;;;OAOG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAclB;;;;;OAKG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IAyBb,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoB/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQ5D;;;;OAIG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQxD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,CAAC;IAkDvB,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,SAAK,GACT,OAAO,CAAC,iBAAiB,EAAE,CAAC;IA8BzB,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC;IA0BZ,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAkElB;;;;;OAKG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBhD;;;;;;;;;;OAUG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC;IA4D7B;;;;OAIG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBpB,gFAAgF;YAClE,WAAW;IAmBzB,0EAA0E;YAC5D,cAAc;IA2B5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;OAMG;YACW,gBAAgB;YAchB,cAAc;YA2Dd,aAAa;IAK3B;;;;;;OAMG;YACW,oBAAoB;YAoBpB,cAAc;IAmB5B;;;;;;OAMG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAqBX,OAAO;YAIP,eAAe;YAWf,GAAG;CA4ClB;AAeD,UAAU,eAAe;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAsB/D;AAED,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE,CAwBzD;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"git.service.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/git/git.service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,QAAQ,EACR,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAA2B,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAML,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AA8B1B;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBxD;AA2ID,qBAAa,UAAW,YAAW,WAAW;IAiB1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,aAAa;IArBhC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAKtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAK;gBAGtC,gBAAgB,EAAE,gBAAgB;IACnD;;;;;;OAMG;IACc,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,cAAqC,EAC5C,aAAa,GAAE,cAAc,GAAG,IAAW;IAG9D;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB,CAA4D;IAEvF,sBAAsB,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAI9E;;;;;OAKG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAI/C;;;;;;;OAOG;YACW,wBAAwB;IAiBtC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,mBAAmB;IA0B3B,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIvD,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO,CAAC,UAAU,EAAE,CAAC;IAuGxB;;;;;;;;;;OAUG;YACW,kBAAkB;IAuD1B,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC;IAuEhB,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,IAAI,GAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAO,GAC/D,OAAO,CAAC,IAAI,CAAC;IA+EhB;;;;;;;;;;OAUG;YACW,SAAS;IA2BjB,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,iBAAiB,CAAC;IAiG7B;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCrE,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,EAChB,aAAa,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA4EpC;;;;;;;;;;;;;OAaG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA0C9B,IAAI,CACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC,IAAI,CAAC;IA6ChB;;;;;;;;;;;;;;;;;OAiBG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,QAAQ,GACb,OAAO,CACN;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,GAC3C;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CACzC;IA0ED;;;;;;;;;;;;OAYG;IACG,kBAAkB,CACtB,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EACzC,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA6FpF,6EAA6E;YAC/D,eAAe;IAS7B;;;;;OAKG;YACW,oBAAoB;IAoB5B,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;YACW,sBAAsB;IAW9B,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmE9C;;;;;;;;;;;;OAYG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAa/D;;;;;;;;;;;;;;;OAeG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBjE,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgBlF;;;;;;;OAOG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAclB;;;;;OAKG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IAyBb,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoB/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQ5D;;;;OAIG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQxD,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,SAAK,GACT,OAAO,CAAC,iBAAiB,EAAE,CAAC;IA8BzB,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC;IA0BlB;;;;;;;OAOG;IACG,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IA0BzD,uBAAuB,CAC3B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAkElB;;;;;OAKG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBhD;;;;;;;;;;OAUG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC;IAwE7B;;;;OAIG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,EAAE,CAAC;IA0BpB;;;;;OAKG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoBzB;;;;;;OAMG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC;IA4BhB,gFAAgF;YAClE,WAAW;IAmBzB,0EAA0E;YAC5D,cAAc;IA2B5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;OAMG;YACW,gBAAgB;YAchB,cAAc;YA2Dd,aAAa;IAK3B;;;;;;OAMG;YACW,oBAAoB;YAoBpB,cAAc;IAmB5B;;;;;;OAMG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAqBX,OAAO;YAIP,eAAe;YAWf,GAAG;CA4ClB;AAeD,UAAU,eAAe;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAsB/D;AAED,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE,CAwBzD;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/modules/workflow/git/git.service.js

@@ -5,7 +5,7 @@ import { promisify } from 'node:util';
 import { AccessDeniedError } from '../../access/access-errors.js';
 import { WorkspaceMutex } from './mutex.js';
 import { cloneTrackingConfigArgs, SAFE_IMPLICIT_FETCH_ARGS } from './clone-config.js';
-import { assertValidBranchName, assertValidRelativePath, isBranchAuthoredBy, isProtectedBranch, PROTECTED_BRANCHES, } from './branch-name.js';
+import { assertValidBranchName, assertValidRelativePath, isBranchAuthoredBy, isOwnSuggestionsBranch, isProtectedBranch, PROTECTED_BRANCHES, } from './branch-name.js';
 import { BranchAuthorshipError, WorkflowValidationError, ProtectedBranchError, PullRebaseConflictError, } from '../workflow.errors.js';
 const execFileAsync = promisify(execFile);
 function redact(msg) {
@@ -539,7 +539,13 @@ export class GitService {
             if (current === name) {
                 throw new WorkflowValidationError(`Cannot delete "${name}" while it's the checked-out branch.`);
             }
-            if (opts.onlyIfNoRemote) {
+            if (opts.systemCleanup) {
+                // Internal post-merge retirement (never reachable from a route): the
+                // merge that emptied this branch was itself authorized, so no
+                // authorship check — the protected-branch and checked-out guards
+                // above still hold.
+            }
+            else if (opts.onlyIfNoRemote) {
                 // Legacy orphan-cleanup path (PR merged + remote head pruned). Skip
                 // the authorship check — callers prune any orphan they encounter,
                 // not just their own — but keep the "refuse if origin still has the
@@ -558,7 +564,12 @@ export class GitService {
                 // that predicate is the existing source of truth for `Admin`-role
                 // membership inside the access model — no separate `isAdmin()` plumbing
                 // needed.
-                const isAuthor = isBranchAuthoredBy(name, user.email);
+                // Two authorship conventions: `<localpart>/…` UI drafts, and the
+                // `suggestions/<who>-<id8>/…` namespace the propose flow files its
+                // branches under — a user resetting THEIR OWN suggestion bundle is
+                // deleting their own branch.
+                const isAuthor = isBranchAuthoredBy(name, user.email) ||
+                    isOwnSuggestionsBranch(name, { email: user.email, id: user.id });
                 const isAdmin = this.accessControl
                     ? await this.accessControl.canWrite(workspaceId, user.email, 'roles.yaml')
                     : false;
@@ -881,7 +892,7 @@ export class GitService {
             };
         });
     }
-    async push(workspaceId, user) {
+    async push(workspaceId, user, opts) {
         return this.mutex.run(workspaceId, async () => {
             const cwd = await this.repoDir(workspaceId);
             const branch = await this.currentBranch(cwd);
@@ -893,7 +904,14 @@ export class GitService {
             // PR. Gate against `origin/<branch>` — the published state — for
             // protected pushes; that's defence-in-depth against local rebases or
             // `commit-tree` shenanigans that might bypass the commit-time gate.
-            if (isProtectedBranch(branch)) {
+            // `systemAuthorized` skips the gate for flows whose ENDPOINT is the
+            // authorization — group provisioning commits an access.md into a
+            // folder that does not exist at origin yet, which this gate can only
+            // ever read as "write: Admin". The provisioning service has already
+            // decided the write is legitimate (unused name, exclusive create);
+            // gating it here again just refuses every non-admin the product
+            // promised a group to.
+            if (isProtectedBranch(branch) && !opts?.systemAuthorized) {
                 const touched = await this.unpushedTouchedPaths(cwd);
                 await this.assertCanWriteAtRef(workspaceId, `origin/${branch}`, user.email, touched);
             }
@@ -1235,12 +1253,23 @@ export class GitService {
                 // A failed rebase leaves the repo in a "REBASE_HEAD" / detached-apply state,
                 // which makes every subsequent git command behave unexpectedly. Return the
                 // working tree to a clean state before surfacing the original error.
-                await this.git(cwd, ['rebase', '--abort']).catch(() => undefined);
-                if (conflictedPaths.length > 0) {
+                let abortSucceeded = true;
+                await this.git(cwd, ['rebase', '--abort']).catch(() => {
+                    abortSucceeded = false;
+                });
+                if (abortSucceeded && conflictedPaths.length > 0) {
                     // Typed so the workflow layer can queue background recovery — this
                     // divergence never resolves on its own (every retry pull hits the
                     // same conflict) and the unpushed local commits are someone's saved
                     // content stuck violating save=share.
+                    //
+                    // Gated on the abort succeeding: a failed abort means either no
+                    // rebase was ever active (the unmerged paths pre-date this pull —
+                    // some earlier operation left the index broken) or the clone is in
+                    // a state git itself can't unwind. Queueing recovery there would
+                    // point the worker's commitFile at a repo mid-conflict, risking a
+                    // commit full of conflict markers — surface the raw error instead
+                    // and leave diagnosis to a human.
                     throw new PullRebaseConflictError(branch, conflictedPaths, err instanceof Error ? err.message : String(err));
                 }
                 throw err;
@@ -1415,50 +1444,6 @@ export class GitService {
             return stdout.split('\0').filter(Boolean);
         });
     }
-    async revertCommit(workspaceId, user, sha) {
-        if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-            throw new WorkflowValidationError('invalid commit sha');
-        }
-        assertValidAuthor(user);
-        return this.mutex.run(workspaceId, async () => {
-            const cwd = await this.repoDir(workspaceId);
-            const branch = await this.currentBranch(cwd);
-            // Revert creates a new commit reversing `sha`. Same model as commit:
-            // gate only on protected branches; reverts on feature/draft branches
-            // are free (they produce a commit that would still need to merge via
-            // PR to affect canonical state).
-            if (isProtectedBranch(branch)) {
-                const { stdout: diffOut } = await this.git(cwd, [
-                    'diff-tree', '--no-commit-id', '--name-only', '-r', sha,
-                ]);
-                const touched = diffOut.split('\n').map((s) => s.trim()).filter(Boolean);
-                await this.assertCanWriteAtRef(workspaceId, 'HEAD', user.email, touched);
-            }
-            await this.git(cwd, [
-                'revert',
-                '--no-edit',
-                `--author=${user.name} <${user.email}>`,
-                sha,
-            ]);
-            const { stdout } = await this.git(cwd, [
-                'log',
-                '-1',
-                '--pretty=format:%H%x00%an%x00%ae%x00%s%x00%aI',
-            ]);
-            const [headSha, authorName, authorEmail, subj, committedAt] = stdout.split('\x00');
-            // A revert may have touched roles.yaml or access.md — drop cached
-            // access state so the next gate read reflects the rolled-back tree.
-            // Mirrors the commit / pull paths.
-            this.accessControl?.invalidate(workspaceId);
-            return {
-                sha: headSha?.trim() ?? '',
-                authorName: authorName ?? '',
-                authorEmail: authorEmail ?? '',
-                subject: subj ?? '',
-                committedAt: committedAt?.trim() ?? new Date().toISOString(),
-            };
-        });
-    }
     async logForFile(workspaceId, relativePath, limit = 20) {
         assertValidRelativePath(relativePath);
         const max = Math.max(1, Math.min(limit, 100));
@@ -1511,6 +1496,41 @@ export class GitService {
             }
         });
     }
+    /**
+     * Full file contents on both sides of one commit: `baseline` is the file at
+     * `<sha>^` (the parent), `current` at `<sha>`. Null means the file is absent
+     * at that ref — added files have `baseline: null`, deleted files
+     * `current: null`. A root commit (no parent) also yields `baseline: null`.
+     * Feeds the rendered-markdown history view, which needs before/after text
+     * rather than the patch `diffFileAtCommit` returns.
+     */
+    async fileContentsAtCommit(workspaceId, relativePath, sha) {
+        assertValidRelativePath(relativePath);
+        if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
+            throw new WorkflowValidationError('invalid commit sha');
+        }
+        const repoRelativePath = this.stripRepoPrefix(relativePath);
+        return this.mutex.run(workspaceId, async () => {
+            const current = await this.readFileAtRef(workspaceId, sha, repoRelativePath);
+            let baseline;
+            try {
+                baseline = await this.readFileAtRef(workspaceId, `${sha}^`, repoRelativePath);
+            }
+            catch (err) {
+                // `readFileAtRef` maps "path absent at ref" to null but propagates an
+                // unresolvable ref. `<sha>^` on a root commit is exactly that (git
+                // reports it as "invalid object name '<sha>^'", or "unknown/bad
+                // revision" in other codepaths), and it legitimately means "no parent
+                // side" — fold it into null. Anything else stays fatal.
+                const stderr = err.stderr ?? (err instanceof Error ? err.message : String(err));
+                if (/invalid object name|unknown revision|bad revision/i.test(stderr))
+                    baseline = null;
+                else
+                    throw err;
+            }
+            return { baseline, current };
+        });
+    }
     async diffFileBetweenBranches(workspaceId, relativePath, fromBranch, toBranch) {
         assertValidRelativePath(relativePath);
         assertValidBranchName(fromBranch);
@@ -1621,8 +1641,21 @@ export class GitService {
                 this.git(cwd, ['diff', '-M', '-z', '--name-status', range]),
                 this.git(cwd, ['diff', '-M', '-z', '--numstat', range]),
             ]);
-            const statuses = parseNameStatusZ(nameStatusOut);
-            const counts = parseNumstatZ(numstatOut);
+            let statuses = parseNameStatusZ(nameStatusOut);
+            let counts = parseNumstatZ(numstatOut);
+            // roles.yaml can NEVER change through a merge — `preserveBaseRolesYaml`
+            // restores the base copy onto the source branch before every merge — so
+            // listing it as "changed" claims something the merge will not do, and
+            // (worse) makes its approval a requirement for a change that cannot
+            // land. Filter it from the review surface entirely; the neutralisation
+            // reads the raw refs itself and is unaffected. Both lists are filtered
+            // IN STEP so the index-zip below stays aligned.
+            if (statuses.some((s) => s.path === 'roles.yaml')) {
+                const keep = statuses.map((s) => s.path !== 'roles.yaml');
+                statuses = statuses.filter((_, i) => keep[i]);
+                if (counts.length === keep.length)
+                    counts = counts.filter((_, i) => keep[i]);
+            }
             // `--name-status` and `--numstat` enumerate the same files in the same
             // order (same `-M` over the same range), so we zip by index. If the two
             // ever disagree in length, the index alignment is unsafe — fall back to
@@ -1678,7 +1711,77 @@ export class GitService {
             const { stdout } = await this.git(cwd, [
                 'diff', '-M', '--name-only', `${baseRef}...${headRef}`,
             ]);
-            return stdout.split('\n').map((s) => s.trim()).filter(Boolean);
+            return (stdout
+                .split('\n')
+                .map((s) => s.trim())
+                .filter(Boolean)
+                // Same rule as `changedFilesForPr`: a roles.yaml change never
+                // survives a merge, so it is not a touched path for routing or
+                // summaries either.
+                .filter((p) => p !== 'roles.yaml'));
+        });
+    }
+    /**
+     * The merge-base commit of a change request's two branches (their origin
+     * refs), or null when they share no history. This is the "before" the CR's
+     * three-dot diff is read against — the ref a per-file revert restores from,
+     * so the reverted file drops OUT of that same diff.
+     */
+    async mergeBaseForPr(workspaceId, baseBranch, headBranch) {
+        assertValidBranchName(baseBranch);
+        assertValidBranchName(headBranch);
+        const cwd = await this.repoDir(workspaceId);
+        await this.fetchPrRefs(cwd, baseBranch, headBranch);
+        return this.mutex.run(workspaceId, async () => {
+            const baseRef = await this.resolveBranchRef(cwd, baseBranch);
+            const headRef = await this.resolveBranchRef(cwd, headBranch);
+            try {
+                const { stdout } = await this.git(cwd, ['merge-base', baseRef, headRef]);
+                return stdout.trim() || null;
+            }
+            catch (err) {
+                // Exit 1 is git's specific "no common ancestor" answer; anything else
+                // is an infra failure that must not masquerade as it.
+                if (err.exitCode === 1)
+                    return null;
+                throw err;
+            }
+        });
+    }
+    /**
+     * Restore one path in the working tree (and index) to its content at `ref`;
+     * a path ABSENT at `ref` is deleted — the revert of an added file is its
+     * removal. Byte-exact via git itself (`checkout <ref> -- <path>`), never a
+     * read-as-string round-trip that would mangle binary files. The caller owns
+     * committing the result (see `commitFile`).
+     */
+    async restorePathFromRef(workspaceId, ref, repoRelativePath) {
+        assertValidRelativePath(repoRelativePath);
+        return this.mutex.run(workspaceId, async () => {
+            const cwd = await this.repoDir(workspaceId);
+            let existsAtRef = true;
+            try {
+                await this.git(cwd, ['cat-file', '-e', `${ref}:${repoRelativePath}`]);
+            }
+            catch {
+                existsAtRef = false;
+            }
+            if (existsAtRef) {
+                await this.git(cwd, ['checkout', ref, '--', repoRelativePath]);
+            }
+            else {
+                // First re-align the INDEX with HEAD for this path. A previous failed
+                // attempt (the git-rm era of this method) can have left a staged
+                // deletion — index entry gone — and `git add` can only stage a
+                // deletion for a path the index still tracks. No-op on a clean tree.
+                await this.git(cwd, ['reset', '-q', 'HEAD', '--', repoRelativePath]);
+                // Then delete from the WORKING TREE only, never `git rm`: the
+                // follow-up `commitFile` stages via `git add -- <path>`, and dropping
+                // the index entry too made that add match nothing — the whole revert
+                // failed with "pathspec did not match any files". A tracked file
+                // missing from disk is exactly what `git add` records as deleted.
+                await fs.rm(path.join(cwd, repoRelativePath), { force: true });
+            }
         });
     }
     /** Fetch the two branches a CR spans so origin refs reflect the latest push. */