@bevel-software/platform-core-backend 0.4.0 → 0.5.0

package/dist/core-config.d.ts

@@ -1,3 +1,21 @@
+/**
+ * The Postgres connection string: `DATABASE_URL` if given, otherwise built
+ * from the `POSTGRES_*` parts.
+ *
+ * The composition lives HERE rather than in docker-compose because expressing
+ * it there needed a nested default — `${DATABASE_URL:-postgresql://${POSTGRES_USER:-…}…}`
+ * — and deployment UIs that scan compose with a regex rather than a YAML
+ * parser truncate that at the first closing brace, offering the operator a
+ * variable whose value is the fragment `postgresql://${POSTGRES_USER:-bevel`.
+ * A malformed connection string presented as configuration is worse than no
+ * configuration at all.
+ *
+ * It is also the better home for it: the parts are URL-ENCODED, which shell
+ * interpolation cannot do — a password containing `@`, `/` or `:` silently
+ * produced an unparseable URL, and "check your password" is not the error
+ * anyone got.
+ */
+export declare function resolveDatabaseUrl(env?: NodeJS.ProcessEnv): string;
 /**
  * Configuration for the CORE platform: the git-backed workspace/workflow,
  * skills, tools, secrets vault, access control, and the MCP surface. Contains
@@ -36,16 +54,31 @@ export declare class CoreConfig {
     readonly spillRoot: string;
     readonly jwtSecret: string;
     /**
-     * Bootstrap admin credential, checked directly against the environment at
-     * login time (never stored). Lets a fresh deployment sign in before any
-     * account exists; that admin (or any user with the Admin role in
-     * `roles.yaml`) then creates per-user accounts from Roles & Members.
-     * Remove EITHER variable and the credential stops working immediately —
-     * accounts created in the database are unaffected. The email is also
-     * always recognized as an admin (see AdminAccessService), so a fresh KB
-     * whose `roles.yaml` doesn't list it yet is still administrable.
+     * The deployment's owner. REQUIRED — three separate jobs rest on it, and a
+     * deployment without one has no way to be administered:
+     *
+     *  - always recognized as an admin (see AdminAccessService), whatever the
+     *    sign-in method, so a KB whose `roles.yaml` does not list them yet is
+     *    still administrable;
+     *  - written as the sole Admin into the `roles.yaml` generated when an EMPTY
+     *    KB remote is seeded (this replaced `SEED_ADMIN_EMAILS`, which asked for
+     *    the same answer a second time);
+     *  - half of the bootstrap password credential below.
      */
     readonly adminEmail: string;
+    /**
+     * Password half of the bootstrap credential, checked directly against the
+     * environment at login time (never stored) so a fresh deployment can sign in
+     * before any account exists. Captured ONCE here, so changing or unsetting it
+     * takes effect on the next restart rather than at once — accounts in the
+     * database are unaffected either way.
+     *
+     * Required only when password login is ENABLED. An SSO-only deployment
+     * (`LOGIN_PASSWORD=false`) would otherwise have to mint a shared password
+     * the server is configured to reject — an unused credential someone still
+     * has to store and rotate. The admin identity above is required either way,
+     * so "there is always an identifiable admin" holds regardless.
+     */
     readonly adminPassword: string;
     /**
      * Generic OIDC single sign-on (any spec-compliant provider: Entra, Okta,
@@ -81,13 +114,6 @@ export declare class CoreConfig {
      * existing one. Override with `KB_TEMPLATE_DIR`.
      */
     readonly kbTemplateDir: string;
-    /**
-     * Admin emails written into the generated `roles.yaml` when a fresh KB repo is
-     * seeded. Comma/whitespace-separated. A freshly-seeded repo with no Admin is
-     * unusable (access resolution requires ≥1 Admin), so seeding an EMPTY remote
-     * fails fast when this is empty. Not needed once the remote is already seeded.
-     */
-    readonly seedAdminEmails: string[];
     /**
      * Ontology-session boundary kill-switch. When true (default), an agent run
      * that has read across more than one ontology can no longer write. A no-op on
@@ -107,10 +133,24 @@ export declare class CoreConfig {
      */
     readonly loginPasswordEnabled: boolean;
     /**
-     * Optional allow-list of email domains. When non-empty, ONLY emails whose
-     * domain matches (exactly, or as a subdomain) may log in via ANY method
-     * (shared-password or SSO). Comma/whitespace-separated; empty (default)
-     * allows any email. A leading `@` or `.` on an entry is tolerated, so
+     * Optional allow-list of email domains for SSO — part of the OIDC
+     * configuration, and only meaningful alongside it.
+     *
+     * SSO AUTO-PROVISIONS: `loginWithSso` upserts the account on first sign-in,
+     * with no admin approval step. Against a single-tenant issuer the issuer is
+     * already the boundary and this is belt-and-braces; against a multi-tenant
+     * one (Google, the Entra `common` endpoint, Auth0 with social connections)
+     * it is the ONLY boundary — without it, anyone the issuer will authenticate
+     * provisions themselves into the deployment.
+     *
+     * Deliberately NOT applied to the other two entry points. An account an
+     * admin created is vetted by the act of creating it, and password login can
+     * only reach an account that already exists — so a check there would gate
+     * nothing while being able to lock out a bootstrap admin whose own address
+     * sits outside the list.
+     *
+     * Comma/whitespace-separated; empty (default) allows any email. Matches the
+     * domain exactly or as a subdomain, and a leading `@` or `.` is tolerated:
      * `ALLOWED_EMAIL_DOMAINS=bevel.software, example.com` works as expected.
      */
     readonly allowedEmailDomains: string[];
@@ -119,8 +159,12 @@ export declare class CoreConfig {
      * secrets: the secrets-vault values and the MCP OAuth client secrets/tokens.
      * Read from `SECRETS_ENC_KEY`, falling back to the legacy
      * `CONNECTOR_CONFIG_ENC_KEY` → `SHAREPOINT_TOKEN_ENC_KEY` chain so existing
-     * deploys keep decrypting without re-keying. Empty = secret values can't be
-     * saved (a clear error surfaces only when a secret is actually written/read).
+     * deploys keep decrypting without re-keying.
+     *
+     * REQUIRED. It used to be optional, with the failure surfacing only when
+     * somebody wrote a secret — which now includes the git token typed into the
+     * setup screen, so an unset key turns the first-run flow into a dead end at
+     * the last step. Refusing to boot names the variable instead.
      */
     readonly secretsEncKey: string;
     /**
@@ -158,6 +202,11 @@ export declare class CoreConfig {
     get uploadTokenPrefix(): string;
     /** Prefix for MCP OAuth access tokens: `<tenant>-mcp_`. */
     get mcpOAuthTokenPrefix(): string;
+    /**
+     * Validate the KB-identity inputs THAT WERE SUPPLIED. Absent is fine — the
+     * setup screen collects them — but a present-and-malformed value fails at
+     * boot rather than later, as a clone error nobody can read.
+     */
     private validateKbIdentity;
 }
 //# sourceMappingURL=core-config.d.ts.map

package/dist/core-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-config.d.ts","sourceRoot":"","sources":["../src/core-config.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,iHAAiH;IACjH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;;IAiHnC,mEAAmE;IACnE,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,mEAAmE;IACnE,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,uEAAuE;IACvE,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,2DAA2D;IAC3D,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,OAAO,CAAC,kBAAkB;CA4B3B"}
+{"version":3,"file":"core-config.d.ts","sourceRoot":"","sources":["../src/core-config.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAU/E;AAED;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,iHAAiH;IACjH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IACvC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;;IAuInC,mEAAmE;IACnE,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAED,mEAAmE;IACnE,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,uEAAuE;IACvE,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED,2DAA2D;IAC3D,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;CA0B3B"}

package/dist/core-config.js

@@ -4,6 +4,35 @@ import { fileURLToPath } from 'node:url';
 import { defaultKbTemplateDir } from './assets.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 dotenv.config({ path: path.resolve(__dirname, '../../../.env') });
+/**
+ * The Postgres connection string: `DATABASE_URL` if given, otherwise built
+ * from the `POSTGRES_*` parts.
+ *
+ * The composition lives HERE rather than in docker-compose because expressing
+ * it there needed a nested default — `${DATABASE_URL:-postgresql://${POSTGRES_USER:-…}…}`
+ * — and deployment UIs that scan compose with a regex rather than a YAML
+ * parser truncate that at the first closing brace, offering the operator a
+ * variable whose value is the fragment `postgresql://${POSTGRES_USER:-bevel`.
+ * A malformed connection string presented as configuration is worse than no
+ * configuration at all.
+ *
+ * It is also the better home for it: the parts are URL-ENCODED, which shell
+ * interpolation cannot do — a password containing `@`, `/` or `:` silently
+ * produced an unparseable URL, and "check your password" is not the error
+ * anyone got.
+ */
+export function resolveDatabaseUrl(env = process.env) {
+    const explicit = (env.DATABASE_URL || '').trim();
+    if (explicit)
+        return explicit;
+    const user = encodeURIComponent(env.POSTGRES_USER || 'bevel');
+    const password = encodeURIComponent(env.POSTGRES_PASSWORD || 'bevel');
+    // `localhost` suits a local `pnpm dev`; compose passes the service name.
+    const host = (env.POSTGRES_HOST || 'localhost').trim();
+    const port = (env.POSTGRES_PORT || '5432').trim();
+    const database = encodeURIComponent(env.POSTGRES_DB || 'bevel');
+    return `postgresql://${user}:${password}@${host}:${port}/${database}`;
+}
 /**
  * Configuration for the CORE platform: the git-backed workspace/workflow,
  * skills, tools, secrets vault, access control, and the MCP surface. Contains
@@ -42,16 +71,31 @@ export class CoreConfig {
     spillRoot;
     jwtSecret;
     /**
-     * Bootstrap admin credential, checked directly against the environment at
-     * login time (never stored). Lets a fresh deployment sign in before any
-     * account exists; that admin (or any user with the Admin role in
-     * `roles.yaml`) then creates per-user accounts from Roles & Members.
-     * Remove EITHER variable and the credential stops working immediately —
-     * accounts created in the database are unaffected. The email is also
-     * always recognized as an admin (see AdminAccessService), so a fresh KB
-     * whose `roles.yaml` doesn't list it yet is still administrable.
+     * The deployment's owner. REQUIRED — three separate jobs rest on it, and a
+     * deployment without one has no way to be administered:
+     *
+     *  - always recognized as an admin (see AdminAccessService), whatever the
+     *    sign-in method, so a KB whose `roles.yaml` does not list them yet is
+     *    still administrable;
+     *  - written as the sole Admin into the `roles.yaml` generated when an EMPTY
+     *    KB remote is seeded (this replaced `SEED_ADMIN_EMAILS`, which asked for
+     *    the same answer a second time);
+     *  - half of the bootstrap password credential below.
      */
     adminEmail;
+    /**
+     * Password half of the bootstrap credential, checked directly against the
+     * environment at login time (never stored) so a fresh deployment can sign in
+     * before any account exists. Captured ONCE here, so changing or unsetting it
+     * takes effect on the next restart rather than at once — accounts in the
+     * database are unaffected either way.
+     *
+     * Required only when password login is ENABLED. An SSO-only deployment
+     * (`LOGIN_PASSWORD=false`) would otherwise have to mint a shared password
+     * the server is configured to reject — an unused credential someone still
+     * has to store and rotate. The admin identity above is required either way,
+     * so "there is always an identifiable admin" holds regardless.
+     */
     adminPassword;
     /**
      * Generic OIDC single sign-on (any spec-compliant provider: Entra, Okta,
@@ -87,13 +131,6 @@ export class CoreConfig {
      * existing one. Override with `KB_TEMPLATE_DIR`.
      */
     kbTemplateDir;
-    /**
-     * Admin emails written into the generated `roles.yaml` when a fresh KB repo is
-     * seeded. Comma/whitespace-separated. A freshly-seeded repo with no Admin is
-     * unusable (access resolution requires ≥1 Admin), so seeding an EMPTY remote
-     * fails fast when this is empty. Not needed once the remote is already seeded.
-     */
-    seedAdminEmails;
     /**
      * Ontology-session boundary kill-switch. When true (default), an agent run
      * that has read across more than one ontology can no longer write. A no-op on
@@ -113,10 +150,24 @@ export class CoreConfig {
      */
     loginPasswordEnabled;
     /**
-     * Optional allow-list of email domains. When non-empty, ONLY emails whose
-     * domain matches (exactly, or as a subdomain) may log in via ANY method
-     * (shared-password or SSO). Comma/whitespace-separated; empty (default)
-     * allows any email. A leading `@` or `.` on an entry is tolerated, so
+     * Optional allow-list of email domains for SSO — part of the OIDC
+     * configuration, and only meaningful alongside it.
+     *
+     * SSO AUTO-PROVISIONS: `loginWithSso` upserts the account on first sign-in,
+     * with no admin approval step. Against a single-tenant issuer the issuer is
+     * already the boundary and this is belt-and-braces; against a multi-tenant
+     * one (Google, the Entra `common` endpoint, Auth0 with social connections)
+     * it is the ONLY boundary — without it, anyone the issuer will authenticate
+     * provisions themselves into the deployment.
+     *
+     * Deliberately NOT applied to the other two entry points. An account an
+     * admin created is vetted by the act of creating it, and password login can
+     * only reach an account that already exists — so a check there would gate
+     * nothing while being able to lock out a bootstrap admin whose own address
+     * sits outside the list.
+     *
+     * Comma/whitespace-separated; empty (default) allows any email. Matches the
+     * domain exactly or as a subdomain, and a leading `@` or `.` is tolerated:
      * `ALLOWED_EMAIL_DOMAINS=bevel.software, example.com` works as expected.
      */
     allowedEmailDomains;
@@ -125,8 +176,12 @@ export class CoreConfig {
      * secrets: the secrets-vault values and the MCP OAuth client secrets/tokens.
      * Read from `SECRETS_ENC_KEY`, falling back to the legacy
      * `CONNECTOR_CONFIG_ENC_KEY` → `SHAREPOINT_TOKEN_ENC_KEY` chain so existing
-     * deploys keep decrypting without re-keying. Empty = secret values can't be
-     * saved (a clear error surfaces only when a secret is actually written/read).
+     * deploys keep decrypting without re-keying.
+     *
+     * REQUIRED. It used to be optional, with the failure surfacing only when
+     * somebody wrote a secret — which now includes the git token typed into the
+     * setup screen, so an unset key turns the first-run flow into a dead end at
+     * the last step. Refusing to boot names the variable instead.
      */
     secretsEncKey;
     /**
@@ -157,7 +212,7 @@ export class CoreConfig {
     publicFrontendUrl;
     constructor() {
         this.port = parseInt(process.env.PORT || '3001', 10);
-        this.databaseUrl = process.env.DATABASE_URL || 'postgresql://bevel:bevel@localhost:5432/bevel';
+        this.databaseUrl = resolveDatabaseUrl();
         this.nodeEnv = process.env.NODE_ENV || 'development';
         this.tenantId = (process.env.TENANT_ID || 'bevel').trim().toLowerCase();
         if (!/^[a-z0-9]+$/.test(this.tenantId)) {
@@ -166,12 +221,36 @@ export class CoreConfig {
         this.workspacesRoot = process.env.WORKSPACES_ROOT || path.resolve(process.cwd(), 'workspaces');
         this.backupsRoot = process.env.BACKUPS_ROOT || path.resolve(this.workspacesRoot, '..', 'backups');
         this.spillRoot = process.env.SPILL_ROOT || path.resolve(this.workspacesRoot, '..', 'tool-chain-spills');
-        this.jwtSecret = process.env.JWT_SECRET || '';
+        // Required, and checked BEFORE the auth routes it signs for are ever
+        // mounted. Empty, the first login attempt fails deep inside the JWT library
+        // with a message about a missing key — a boot error naming the variable is
+        // the same information, hours earlier.
+        this.jwtSecret = (process.env.JWT_SECRET || '').trim();
+        if (!this.jwtSecret) {
+            throw new Error('JWT_SECRET is required — it signs login sessions. Generate one with: ' +
+                `node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"`);
+        }
+        // Parsed here rather than beside the other toggles below: whether the
+        // bootstrap PASSWORD is required depends on it.
+        this.loginPasswordEnabled =
+            (process.env.LOGIN_PASSWORD ?? 'true').trim().toLowerCase() !== 'false';
         this.adminEmail = (process.env.ADMIN_EMAIL || '').trim().toLowerCase();
         this.adminPassword = process.env.ADMIN_PASSWORD || '';
-        if (this.adminEmail && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(this.adminEmail)) {
+        if (!this.adminEmail) {
+            throw new Error('ADMIN_EMAIL is required — the address that owns this deployment. It is ' +
+                'always treated as an admin (whatever the sign-in method) and is written ' +
+                'as the initial Admin when an empty knowledge-base repo is seeded.');
+        }
+        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(this.adminEmail)) {
             throw new Error(`ADMIN_EMAIL is not a valid email: "${this.adminEmail}"`);
         }
+        // Only when password login can actually be used. An SSO-only deployment
+        // has no use for this value and should not have to hold one.
+        if (this.loginPasswordEnabled && !this.adminPassword) {
+            throw new Error('ADMIN_PASSWORD is required while password login is enabled — it is the ' +
+                'credential that signs in before any account exists. Set it, or set ' +
+                'LOGIN_PASSWORD=false if this deployment signs in through SSO only.');
+        }
         this.oidcIssuerUrl = (process.env.OIDC_ISSUER_URL || '').trim().replace(/\/+$/, '');
         this.oidcClientId = (process.env.OIDC_CLIENT_ID || '').trim();
         this.oidcClientSecret = (process.env.OIDC_CLIENT_SECRET || '').trim();
@@ -186,13 +265,14 @@ export class CoreConfig {
                 throw new Error(`OIDC_ISSUER_URL is not a valid URL: "${this.oidcIssuerUrl}"`);
             }
         }
-        // No default: the KB repo is deployment-specific, and a wrong fallback
-        // would surface much later as a confusing clone failure. Fail at boot.
+        // No default, and no longer fatal when absent: an unconfigured deployment
+        // boots into the setup screen, where an admin supplies it (and where the
+        // value can be verified against the real remote before it is saved). What
+        // stays fatal is a value that is present and WRONG — see
+        // `validateKbIdentity` — because that surfaces later as a confusing clone
+        // failure instead of a clear one now.
         this.kbRepoUrl = (process.env.KB_REPO_URL || '').trim();
-        if (this.kbRepoUrl === '') {
-            throw new Error('KB_REPO_URL is required — the https clone/push URL of the git repository that stores your knowledge base.');
-        }
-        this.kbDirName = process.env.KB_DIR_NAME || 'knowledge-base';
+        this.kbDirName = (process.env.KB_DIR_NAME || '').trim();
         // Provider-neutral git token: operators can set GIT_TOKEN (or the legacy
         // GITHUB_TOKEN / GH_TOKEN). Normalize onto GITHUB_TOKEN — the name the
         // credential helper and every `$GITHUB_TOKEN` read + redaction use — so all
@@ -211,14 +291,8 @@ export class CoreConfig {
         // Default: the `kb-template/` folder shipped inside this package (works
         // both from src/ and compiled dist/ — see assets.ts).
         this.kbTemplateDir = process.env.KB_TEMPLATE_DIR || defaultKbTemplateDir();
-        this.seedAdminEmails = (process.env.SEED_ADMIN_EMAILS || '')
-            .split(/[\s,]+/)
-            .map((e) => e.trim().toLowerCase())
-            .filter((e) => e.length > 0);
         this.ontologySessionBlock =
             (process.env.ONTOLOGY_SESSION_BLOCK ?? 'true').trim().toLowerCase() !== 'false';
-        this.loginPasswordEnabled =
-            (process.env.LOGIN_PASSWORD ?? 'true').trim().toLowerCase() !== 'false';
         this.allowedEmailDomains = (process.env.ALLOWED_EMAIL_DOMAINS || '')
             .split(/[\s,]+/)
             .map((d) => d.trim().toLowerCase().replace(/^[@.]+/, ''))
@@ -227,6 +301,11 @@ export class CoreConfig {
             process.env.CONNECTOR_CONFIG_ENC_KEY ||
             process.env.SHAREPOINT_TOKEN_ENC_KEY ||
             '').trim();
+        if (!this.secretsEncKey) {
+            throw new Error('SECRETS_ENC_KEY is required — it encrypts the secrets vault, the MCP OAuth ' +
+                'tokens and the git credential saved from the setup screen. Generate one ' +
+                `with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"`);
+        }
         this.internalTokenSecret = (process.env.INTERNAL_TOKEN_SECRET || '').trim();
         this.trustProxy = (process.env.TRUST_PROXY || '').trim();
         this.publicBackendUrl = (process.env.PUBLIC_BACKEND_URL || `http://localhost:${this.port}`)
@@ -249,13 +328,6 @@ export class CoreConfig {
                 throw new Error(`${name} is not a valid URL: "${value}"`);
             }
         }
-        // Validate format now so a typo surfaces at boot, not at first-seed time.
-        // Emptiness is NOT an error here: an already-seeded remote never needs it.
-        for (const email of this.seedAdminEmails) {
-            if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
-                throw new Error(`SEED_ADMIN_EMAILS contains an invalid email: "${email}"`);
-            }
-        }
         this.validateKbIdentity();
     }
     /** Prefix for external API keys (connection keys): `<tenant>_`. */
@@ -274,25 +346,29 @@ export class CoreConfig {
     get mcpOAuthTokenPrefix() {
         return `${this.tenantId}-mcp_`;
     }
+    /**
+     * Validate the KB-identity inputs THAT WERE SUPPLIED. Absent is fine — the
+     * setup screen collects them — but a present-and-malformed value fails at
+     * boot rather than later, as a clone error nobody can read.
+     */
     validateKbIdentity() {
-        // Validate the two KB-identity inputs up front: `kbRepoUrl` (the clone/push
-        // URL) must be a valid https URL, and `kbDirName` (the dir the clone lives
-        // under in each workspace) must be a single safe path segment. A bad value
-        // in either otherwise surfaces much later as a confusing clone/path failure.
-        let parsed;
-        try {
-            parsed = new URL(this.kbRepoUrl);
-        }
-        catch {
-            throw new Error(`KB_REPO_URL is not a valid URL: ${this.kbRepoUrl}`);
-        }
-        if (parsed.protocol !== 'https:') {
-            throw new Error(`KB_REPO_URL must use https://: ${this.kbRepoUrl}`);
+        if (this.kbRepoUrl) {
+            let parsed;
+            try {
+                parsed = new URL(this.kbRepoUrl);
+            }
+            catch {
+                throw new Error(`KB_REPO_URL is not a valid URL: ${this.kbRepoUrl}`);
+            }
+            if (parsed.protocol !== 'https:') {
+                throw new Error(`KB_REPO_URL must use https://: ${this.kbRepoUrl}`);
+            }
         }
         // Joined with workspace paths via path.join — separators or ".." would let it
         // escape the workspace dir.
-        if (!this.kbDirName ||
-            this.kbDirName === '.' ||
+        if (!this.kbDirName)
+            return;
+        if (this.kbDirName === '.' ||
             this.kbDirName === '..' ||
             this.kbDirName.includes('/') ||
             this.kbDirName.includes('\\') ||

package/dist/core-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-config.js","sourceRoot":"","sources":["../src/core-config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,OAAO,CAAS;IACzB;;;;;;;OAOG;IACM,QAAQ,CAAS;IACjB,cAAc,CAAS;IAChC;;;;;;OAMG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,SAAS,CAAS;IAClB,SAAS,CAAS;IAC3B;;;;;;;;;OASG;IACM,UAAU,CAAS;IACnB,aAAa,CAAS;IAC/B;;;;;;OAMG;IACM,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,gBAAgB,CAAS;IAClC,yEAAyE;IAChE,UAAU,CAAS;IAC5B,qDAAqD;IAC5C,iBAAiB,CAAS;IACnC,iHAAiH;IACxG,SAAS,CAAS;IAC3B,0EAA0E;IACjE,SAAS,CAAS;IAC3B;;;;;;;OAOG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,aAAa,CAAS;IAC/B;;;;;OAKG;IACM,eAAe,CAAW;IACnC;;;;;;;;;OASG;IACM,oBAAoB,CAAU;IACvC;;;;;OAKG;IACM,oBAAoB,CAAU;IACvC;;;;;;OAMG;IACM,mBAAmB,CAAW;IACvC;;;;;;;OAOG;IACM,aAAa,CAAS;IAC/B;;;;;;;OAOG;IACM,mBAAmB,CAAS;IACrC;;;;;;;;OAQG;IACM,UAAU,CAAS;IAC5B;;;OAGG;IACM,gBAAgB,CAAS;IAClC,4EAA4E;IACnE,iBAAiB,CAAS;IAEnC;QACE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,+CAA+C,CAAC;QAC/F,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,kEAAkE,IAAI,CAAC,QAAQ,GAAG,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/F,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACtD,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,uEAAuE;YACvE,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,gBAAgB,CAAC;QAC7D,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,8EAA8E;QAC9E,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3F,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,CAAC,WAAW,GAAG,CAC7F,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC3E,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACzD,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAClF,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAC1E,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;aACjE,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,CACnB,OAAO,CAAC,GAAG,CAAC,eAAe;YAC3B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;aACxF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;aAClF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;YAC1B,CAAC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7C,CAAC,qBAAqB,EAAE,IAAI,CAAC,iBAAiB,CAAC;SACvC,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,GAAG,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,IAAI,oBAAoB;QACtB,OAAO,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;IAC7B,CAAC;IAED,mEAAmE;IACnE,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAED,uEAAuE;IACvE,IAAI,iBAAiB;QACnB,OAAO,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;IAChC,CAAC;IAED,2DAA2D;IAC3D,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAEO,kBAAkB;QACxB,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,8EAA8E;QAC9E,4BAA4B;QAC5B,IACE,CAAC,IAAI,CAAC,SAAS;YACf,IAAI,CAAC,SAAS,KAAK,GAAG;YACtB,IAAI,CAAC,SAAS,KAAK,IAAI;YACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"core-config.js","sourceRoot":"","sources":["../src/core-config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC;IACtE,yEAAyE;IACzE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC;IAChE,OAAO,gBAAgB,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,OAAO,CAAS;IACzB;;;;;;;OAOG;IACM,QAAQ,CAAS;IACjB,cAAc,CAAS;IAChC;;;;;;OAMG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,SAAS,CAAS;IAClB,SAAS,CAAS;IAC3B;;;;;;;;;;;OAWG;IACM,UAAU,CAAS;IAC5B;;;;;;;;;;;;OAYG;IACM,aAAa,CAAS;IAC/B;;;;;;OAMG;IACM,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,gBAAgB,CAAS;IAClC,yEAAyE;IAChE,UAAU,CAAS;IAC5B,qDAAqD;IAC5C,iBAAiB,CAAS;IACnC,iHAAiH;IACxG,SAAS,CAAS;IAC3B,0EAA0E;IACjE,SAAS,CAAS;IAC3B;;;;;;;OAOG;IACM,WAAW,CAAS;IAC7B;;;;;OAKG;IACM,aAAa,CAAS;IAC/B;;;;;;;;;OASG;IACM,oBAAoB,CAAU;IACvC;;;;;OAKG;IACM,oBAAoB,CAAU;IACvC;;;;;;;;;;;;;;;;;;;;OAoBG;IACM,mBAAmB,CAAW;IACvC;;;;;;;;;;;OAWG;IACM,aAAa,CAAS;IAC/B;;;;;;;OAOG;IACM,mBAAmB,CAAS;IACrC;;;;;;;;OAQG;IACM,UAAU,CAAS;IAC5B;;;OAGG;IACM,gBAAgB,CAAS;IAClC,4EAA4E;IACnE,iBAAiB,CAAS;IAEnC;QACE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,kBAAkB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,kEAAkE,IAAI,CAAC,QAAQ,GAAG,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QAC/F,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxG,qEAAqE;QACrE,4EAA4E;QAC5E,2EAA2E;QAC3E,uCAAuC;QACvC,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,uEAAuE;gBACrE,6EAA6E,CAChF,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAC1E,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,0EAA0E;gBAC1E,mEAAmE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,qEAAqE;gBACrE,oEAAoE,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,uEAAuE;YACvE,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,yDAAyD;QACzD,0EAA0E;QAC1E,sCAAsC;QACtC,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,8EAA8E;QAC9E,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3F,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,CAAC,WAAW,GAAG,CAC7F,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC3E,IAAI,CAAC,oBAAoB;YACvB,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAClF,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;aACjE,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;aACxD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,CACnB,OAAO,CAAC,GAAG,CAAC,eAAe;YAC3B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,0EAA0E;gBAC1E,mFAAmF,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,mBAAmB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;aACxF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;aAClF,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;YAC1B,CAAC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,CAAC;YAC7C,CAAC,qBAAqB,EAAE,IAAI,CAAC,iBAAiB,CAAC;SACvC,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,IAAI,oBAAoB;QACtB,OAAO,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;IAC7B,CAAC;IAED,mEAAmE;IACnE,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAED,uEAAuE;IACvE,IAAI,iBAAiB;QACnB,OAAO,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;IAChC,CAAC;IAED,2DAA2D;IAC3D,IAAI,mBAAmB;QACrB,OAAO,GAAG,IAAI,CAAC,QAAQ,OAAO,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACK,kBAAkB;QACxB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,4BAA4B;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,IACE,IAAI,CAAC,SAAS,KAAK,GAAG;YACtB,IAAI,CAAC,SAAS,KAAK,IAAI;YACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}

package/dist/modules/access/access-control.interface.d.ts

@@ -116,6 +116,12 @@ export interface IAccessControl {
      * UI so users know who to contact for more information on a node.
      */
     canOwner(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
+    /**
+     * Batched `canOwner` — one config load per call, same `owner:`-lists-only
+     * resolution (no admin rescue). Used by group enumeration to answer "which
+     * of these folders does the caller own?" without one model load per group.
+     */
+    canOwnerBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
     /**
      * The set of principals (roles + direct users) that own this path — i.e.
      * who to contact about it. Resolved from `owner:` lists only. Used by the

package/dist/modules/access/access-control.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;OASG;IACH,QAAQ,CACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;OAIG;IACH,cAAc,CACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1E;;;;;;OAMG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1E;;;;;;;;OAQG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE/F;;;;;;;OAOG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1E;;;;;;;;OAQG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;OASG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;;;;OAYG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC;;;;;;;;;OASG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAEhF;;;;;;;;;OASG;IACH,gBAAgB,CACd,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IAE7C;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE5E;;;;;;;;;OASG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE1D;;;;;;;;;OASG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;;;OAOG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,4EAA4E;QAC5E,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB;;;;;WAKG;QACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC,CAAC;CACX"}
+{"version":3,"file":"access-control.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access-control.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;AAExC,mFAAmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEjD,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;;;;;;;;;OAYG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;OASG;IACH,QAAQ,CACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEjC;;;;OAIG;IACH,cAAc,CACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1E;;;;;;OAMG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1E;;;;;;;;OAQG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE/F;;;;;;;OAOG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE1E;;;;;;;;OAQG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;OASG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAEzD;;;;;;;;;;;;OAYG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB;;;;OAIG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC;;;;;;;;;OASG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAEhF;;;;;;;;;OASG;IACH,gBAAgB,CACd,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IAE7C;;;;;;;;OAQG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC,CAAC;IAE5E;;;;;;;;;OASG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE1D;;;;;;;;;OASG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEjF;;;;;;;OAOG;IACH,4BAA4B,CAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CACZ,MAAM,EACN;QACE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,4EAA4E;QAC5E,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB;;;;;WAKG;QACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAC9B,CACF,GAAG,IAAI,CAAC,CAAC;CACX"}

package/dist/modules/access/access-control.service.d.ts

@@ -53,6 +53,18 @@ export interface UserEntry {
     deny: boolean;
 }
 export type ParsedEntry = RoleEntry | UserEntry;
+export interface AccessFile {
+    /** repo-relative POSIX path — e.g. `access.md`, `Knowledge/Sales/access.md`. */
+    path: string;
+    /** repo-relative POSIX directory — `''` for root. */
+    dir: string;
+    /**
+     * Verb → list of grants/denials. Always carries an entry for every
+     * known verb (empty array when the verb wasn't declared in the file) so
+     * the resolver doesn't need to null-check at every chain step.
+     */
+    entries: Record<Verb, ParsedEntry[]>;
+}
 export declare function isAccessMdPath(p: string): boolean;
 interface RolesIndex {
     byCanonical: Map<string, {
@@ -80,6 +92,8 @@ export declare function extractFrontmatter(text: string): {
     ok: false;
     error: string;
 };
+/** The text AFTER the closing frontmatter fence ('' when there is no fence). */
+export declare function bodyAfterFrontmatter(text: string): string;
 export declare function canonicalRoleName(name: string): string;
 export declare function canonicalEmail(email: string): string;
 export declare function parseAccessEntry(raw: unknown): {
@@ -96,6 +110,59 @@ export declare function parseRolesYaml(text: string): {
     ok: false;
     errors: string[];
 };
+/**
+ * Does an `access.md` body declare access rules — i.e. is the file in the NEW
+ * (body-governs-the-folder) format?
+ *
+ * The two-format story: historically the FRONTMATTER carried the folder's
+ * rules and the file could not govern itself. The new format follows the
+ * convention every other file uses — frontmatter is about the FILE (who may
+ * read/write `access.md` itself), and the content (the body) is the folder's
+ * rules. The compat rule, applied per file: **when the body is not parsable as
+ * rules, the frontmatter is resolved for the folder as before.**
+ *
+ * "Parsable as rules" is deliberately shallow — the body YAML-parses to a
+ * mapping that names at least one known verb. A prose body (the repo-root
+ * README-style file) fails the YAML parse or carries no verb key and stays
+ * legacy. A body that DOES name a verb has claimed to be rules: shape errors
+ * inside it (a scalar verb, a malformed entry) are then hard parse ERRORS of
+ * the file, never a silent fallback to the frontmatter — falling back would
+ * let a typo in the body hand the folder to the frontmatter's (possibly
+ * `read: everyone`) self-rules.
+ */
+export declare function accessMdDeclaresBodyRules(text: string): boolean;
+/**
+ * The access verbs an `access.md` declares FOR ITSELF — its frontmatter, and
+ * only in the new format (body-governed). A legacy file cannot govern itself:
+ * its frontmatter IS the folder's rules, so returning them as own-entries
+ * would double-apply them at the file scope.
+ *
+ * Parsed forgivingly (like node frontmatter): the new-format frontmatter may
+ * carry non-access keys, and a typo there must not make the file unreadable.
+ */
+export declare function accessMdSelfEntries(text: string): Record<Verb, ParsedEntry[]> | null;
+/**
+ * Parse one `access.md`'s FOLDER rules into its per-verb entry lists.
+ *
+ * Two formats (see {@link accessMdDeclaresBodyRules}): when the body declares
+ * rules, the body is parsed (new format — frontmatter then governs the file
+ * itself via {@link accessMdSelfEntries}); otherwise the frontmatter is parsed
+ * (legacy format), exactly as before.
+ *
+ * Exported so read-only surfaces can report WHERE rules are declared without
+ * reimplementing the parse (see `access-declarations.ts`). Exporting changes
+ * nothing about resolution — this is the same function the resolver builds its
+ * model from, so a display of declarations can never drift from the rules that
+ * are actually enforced.
+ */
+export declare function parseAccessFile(text: string, relativePath: string): {
+    ok: true;
+    file: AccessFile;
+    warnings: string[];
+} | {
+    ok: false;
+    errors: string[];
+};
 /**
  * Per-verb access entries declared in a single node file's *own* frontmatter
  * (the same YAML block that carries `nodeType:`). This is the most-specific
@@ -187,6 +254,7 @@ export declare class AccessControlService implements IAccessControl {
     canReadBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
     canWriteBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
     canDownload(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
+    canOwnerBatch(workspaceId: string, userEmail: string, relativePaths: string[]): Promise<Map<string, boolean>>;
     canOwner(workspaceId: string, userEmail: string, relativePath: string): Promise<boolean>;
     eligibleOwners(workspaceId: string, relativePath: string): Promise<{
         roles: string[];
@@ -260,11 +328,12 @@ export declare class AccessControlService implements IAccessControl {
     private collectAccessFiles;
     private repoDir;
     /**
-     * Read the access verbs a node file declares in its own frontmatter from the
-     * working tree. Returns null when the file has no per-file access config
-     * (the common case). `access.md` and `roles.yaml` are skipped — `access.md`
-     * frontmatter governs its directory (handled by the dir chain), not itself,
-     * and `roles.yaml` is not a node.
+     * Read the access verbs a file declares FOR ITSELF from the working tree.
+     * Returns null when the file has no per-file access config (the common
+     * case). `roles.yaml` is never a node; an `access.md` governs itself only
+     * in the new (body-governed) format, where its frontmatter is self-access —
+     * see {@link accessMdSelfEntries}. A legacy `access.md` still yields null:
+     * its frontmatter IS the folder rules the dir chain already applies.
      */
     private readOwnEntries;
     /**