@bevel-software/platform-shared 0.1.0

package/dist/workflow/events.js

@@ -0,0 +1,48 @@
+/**
+ * Workflow event bus types — what the backend pushes over SSE to keep the
+ * frontend in sync with state changes, including those triggered by other
+ * users on the same branch or by the agent acting server-side.
+ *
+ * **Scope model** — events have one of three scopes, set by the variant:
+ *
+ *   - **Workspace-scoped** (`workspaceId` field). Pushed to every connected
+ *     session whose current focus is `workspaceId`. Examples: a file changed
+ *     on this branch, someone took the lock on a file. Anyone editing this
+ *     branch cares.
+ *
+ *   - **User-scoped** (`forUserId` field, no `workspaceId`). Pushed only to
+ *     sessions opened by `forUserId`, regardless of their current focus.
+ *     Examples: an agent turn called a tool on your behalf, your view should
+ *     navigate to a different branch. Other users on the same branch don't
+ *     care.
+ *
+ *   - **Global** (no `workspaceId`, no `forUserId`). Pushed to every
+ *     authenticated session. Examples: change requests opening / merging /
+ *     being rejected — any user with access to the repo might care.
+ *
+ * **Identity + replay** — every event carries an `id` (monotonic int) and an
+ * ISO `ts`. Clients reconnecting with `Last-Event-ID: <id>` get the buffered
+ * tail replayed (server's ring buffer is finite — see `WorkflowEventBus`).
+ * If `id` is older than what the buffer still has, the server sends a
+ * `{ kind: 'resync' }` instead so the client refetches the world cleanly.
+ *
+ * **Idempotency over exactly-once** — clients tolerate duplicates and
+ * out-of-order delivery: every payload carries enough state for the UI to
+ * reach the right end state regardless of how many times it sees the event
+ * (e.g. `file-changed` includes the new SHA — UI only refreshes if the open
+ * tab's SHA differs).
+ */
+/** True for events scoped to a workspace — the focus filter applies. */
+export function isWorkspaceScoped(e) {
+    return (e.kind === 'file-changed' ||
+        e.kind === 'lock-acquired' ||
+        e.kind === 'lock-released' ||
+        e.kind === 'fs-tree-changed');
+}
+/** True for events scoped to a specific user — the user filter applies. */
+export function isUserScoped(e) {
+    return (e.kind === 'agent-tool-call' ||
+        e.kind === 'branch-switched' ||
+        e.kind === 'change-request-merge-failed');
+}
+//# sourceMappingURL=events.js.map

package/dist/workflow/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/workflow/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAwNH,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAC/B,CAAuB;IAEvB,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,cAAc;QACzB,CAAC,CAAC,IAAI,KAAK,eAAe;QAC1B,CAAC,CAAC,IAAI,KAAK,eAAe;QAC1B,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAC7B,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAC1B,CAAuB;IAEvB,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,iBAAiB;QAC5B,CAAC,CAAC,IAAI,KAAK,iBAAiB;QAC5B,CAAC,CAAC,IAAI,KAAK,6BAA6B,CACzC,CAAC;AACJ,CAAC"}

package/dist/workflow/interface.d.ts

@@ -0,0 +1,233 @@
+/**
+ * `IWorkflowService` — the abstraction the rest of the app talks to instead
+ * of raw git/gh. See `bevel-platform/PLAN.md` for the motivation and the spec the
+ * methods here encode (protected branches, atomic per-file changes, file
+ * locks, change requests as branch-pair reconciliations).
+ *
+ * Naming convention: methods speak workflow vocabulary (`commitChange`,
+ * `openChangeRequest`, `acquireLock`), never git vocabulary (`commit`,
+ * `createPr`, no analogue for locks). Implementations may delegate to the
+ * existing git/PR/review-workflow services until those are folded into
+ * `modules/workflow`; callers should not depend on that fact.
+ *
+ * Some methods on this interface have no backing service yet — file locks,
+ * `openChangeRequest`, `updateFromTarget`. The facade implementation throws
+ * `NotImplementedWorkflowError` from those until the underlying support
+ * lands. The interface defines them up-front so consumers can plan against
+ * the final surface area.
+ */
+import type { AuthUser } from '../auth/types.js';
+import type { AcquireLockResult, Branch, BranchWorkspaceStatus, CancelChangeRequestResult, Change, ChangeInput, ChangeRequest, ChangeRequestComment, ChangeRequestDetail, ChangeRequestState, ChangedFile, FileApproval, FileLock, MergeChangeRequestOutcome, OpenChangeRequestInput, PostChangeRequestCommentInput } from './types.js';
+export interface IWorkflowService {
+    listBranches(workspaceId: string, opts?: {
+        freshFetch?: boolean;
+    }): Promise<Branch[]>;
+    /**
+     * Create a new unprotected branch. Protected branches cannot be created
+     * via the workflow — the protected set is bootstrapped from the KB repo's
+     * initial state and never grown at runtime.
+     */
+    createBranch(workspaceId: string, name: string, fromBase?: string): Promise<Branch>;
+    /**
+     * Delete a branch. Removes both local and origin refs in one call. The
+     * branch's author (per `<email-localpart>/...` naming) OR an admin (per the
+     * workspace's `roles.yaml`) can delete it. Admins can additionally remove
+     * unprefixed CLI-created branches that have no recognisable author.
+     *
+     * `onlyIfNoRemote: true` is the legacy orphan-cleanup path: bypasses the
+     * author/admin check (callers prune any orphan they encounter) and refuses
+     * if origin still has the ref. Protected and current branches always reject.
+     */
+    deleteBranch(workspaceId: string, name: string, user: AuthUser, opts?: {
+        onlyIfNoRemote?: boolean;
+    }): Promise<void>;
+    /** Current branch's workspace status — currently just the branch name + upstream sync state. */
+    branchStatus(workspaceId: string): Promise<BranchWorkspaceStatus>;
+    /**
+     * Push the current branch upstream so other users (and change requests)
+     * can see the commits on it. Workflow term: "share current branch". The
+     * underlying implementation is `git push -u origin <branch>`.
+     */
+    shareCurrentBranch(workspaceId: string, user: AuthUser): Promise<void>;
+    /**
+     * Number of commits on `branch` that aren't on `baseBranch` — exactly
+     * what a CR from `branch` to `baseBranch` would propose for review.
+     * Implemented as `git rev-list --count <baseBranch>..<branch>` against
+     * the workspace's clone; returns 0 when the branch has no unmerged
+     * commits (a fresh fork that nobody wrote to) and when either ref
+     * cannot be resolved. Background runs use this to decide whether a
+     * routine branch deserves a change request — without it, a run where
+     * the agent commits files but forgets to call `open_change_request`
+     * would silently lose its work to the no-changes cleanup path.
+     */
+    countCommitsAhead(workspaceId: string, branch: string, baseBranch: string): Promise<number>;
+    /** Fetch remote refs without modifying the working tree. */
+    refreshRemotes(workspaceId: string): Promise<void>;
+    /** Pull the latest remote state into the current branch (rebase strategy). */
+    updateFromRemote(workspaceId: string): Promise<void>;
+    /**
+     * Hard-reset the workspace's checked-out branch to `origin/<branch>` (fetch
+     * first), discarding any local divergence. Break-glass primitive for
+     * roles.yaml recovery so the restoring commit can fast-forward on push.
+     */
+    resetToRemote(workspaceId: string, branch: string): Promise<void>;
+    /**
+     * Best-fit protected branch that `branch` was forked from — picks the
+     * protected branch on origin yielding the smallest "ahead" count.
+     * Returns null if no protected branch can be reached.
+     */
+    resolveForkBase(workspaceId: string, branch: string): Promise<string | null>;
+    /**
+     * Paths that the next `commitChange` would include — what `git add -A`
+     * would stage: modified + deleted + renamed + untracked (honouring
+     * `.gitignore`). Returns only paths.
+     */
+    listPendingChangePaths(workspaceId: string): Promise<string[]>;
+    /**
+     * Commit one atomic change. The current backing implementation packs every
+     * dirty path in the working tree into the commit; the workflow spec
+     * eventually constrains this to one file per change, enforced at the
+     * commit boundary. Until that lands, callers should already commit
+     * one-file-at-a-time by convention.
+     */
+    commitChange(workspaceId: string, user: AuthUser, input: ChangeInput): Promise<Change>;
+    /**
+     * Commit whatever the caller has already written to the working tree as ONE
+     * atomic change, then push. Unlike `commitChange` (one file at a time, guarded
+     * at the commit boundary) this commits the whole dirty set together — for the
+     * rare case where a group of files must land together or not at all (e.g. a
+     * role rename rewriting `roles.yaml` + every reference). Does NOT write
+     * content: the caller writes the files first (e.g. via the lock-aware
+     * filesystem) and is responsible for any validation. Returns null on a no-op
+     * (clean tree).
+     */
+    commitChanges(workspaceId: string, user: AuthUser, summary: string): Promise<Change | null>;
+    /** Per-file history. Newest first; clamps to ≤ 100 entries. */
+    listChangesForFile(workspaceId: string, path: string, limit?: number): Promise<Change[]>;
+    /**
+     * Revert a single change by creating a new change that undoes it.
+     * Refused on protected branches; refused without write permission on the
+     * touched paths.
+     */
+    revertChange(workspaceId: string, user: AuthUser, sha: string): Promise<Change>;
+    /**
+     * Diff of one file between two branches. Both names must resolve to a
+     * known branch on this workspace (local head or remote-tracking). Returns
+     * the raw unified diff body — empty when identical, includes the
+     * "new file" / "deleted file" headers when the file only exists on one
+     * side.
+     */
+    compareFile(workspaceId: string, path: string, fromBranch: string, toBranch: string): Promise<string>;
+    /**
+     * Diff of one file at a specific change (sha) — i.e. `git show <sha> -- <path>`.
+     * Used by the File viewer's History tab.
+     */
+    showFileAtChange(workspaceId: string, path: string, sha: string): Promise<string>;
+    /**
+     * Try to acquire an edit lock on `(branch, path)` for the caller. Returns
+     * `{ acquired: true, lock }` on success; `{ acquired: false, lock }` if
+     * someone else already holds it (the existing lock is included so the UI
+     * can render "Locked by X" without a follow-up call).
+     *
+     * Pessimistic per the spec. Auto-released when the lock expires past TTL
+     * without a heartbeat — stale locks must not block forever.
+     */
+    acquireLock(workspaceId: string, branch: string, path: string, user: AuthUser): Promise<AcquireLockResult>;
+    /** Heartbeat to keep an acquired lock alive past its current TTL. */
+    heartbeatLock(workspaceId: string, branch: string, path: string, user: AuthUser): Promise<FileLock>;
+    /**
+     * Commit the lock-held file's accumulated edits as a change *without*
+     * releasing the lock. Used by the client-side autosave checkpoint timer
+     * so the lock stays exclusively the caller's across many interim
+     * commits — releasing + reacquiring around every checkpoint would let
+     * another user grab the lock in the gap. Returns `null` when the file
+     * has no pending edits (idempotent). Refused when the lock isn't held
+     * by `user`.
+     */
+    commitFileWhileLocked(workspaceId: string, branch: string, path: string, user: AuthUser, summary?: string): Promise<Change | null>;
+    /**
+     * Release a held lock. The "I'm done editing this file" terminal signal.
+     *
+     * **Does not commit or push synchronously.** This method enqueues a row in
+     * `pending_commits` and drops the lock, then returns `void`. The background
+     * `PendingCommitsWorker` claims the row, synthesises the commit subject
+     * (callers do *not* supply one — the worker derives a default from the path
+     * and any worker-side metadata), runs `commitFile` against whatever bytes
+     * are on disk, and pushes the result. Decoupling the user-visible lock
+     * release from git means a transient push failure no longer wedges the
+     * editor, and a process crash mid-commit becomes resumable instead of
+     * leaving an orphan on disk. See `lock-decoupling-plan.md` for the full
+     * design.
+     *
+     * The autosave-checkpoint timer and explicit `commitChange` calls land
+     * commits directly (no queue); `releaseLock` is queue-only.
+     */
+    releaseLock(workspaceId: string, branch: string, path: string, user: AuthUser): Promise<void>;
+    /**
+     * Drop the lock **without committing**. Used on the failure path of a
+     * lock-aware write — when the underlying op threw, we don't want the
+     * normal `releaseLock` to commit + push whatever partial state happens
+     * to be on disk. The lock row goes away (so the next caller can edit
+     * the file); the working tree is left as-is. Idempotent like
+     * `releaseLock`: a no-op when the caller doesn't hold the lock.
+     */
+    releaseLockNoCommit(workspaceId: string, branch: string, path: string, user: AuthUser): Promise<void>;
+    /** Current lock holder for `(branch, path)`, or null when nobody holds it. */
+    getLock(workspaceId: string, branch: string, path: string): Promise<FileLock | null>;
+    listChangeRequests(opts?: {
+        fresh?: boolean;
+    }): Promise<ChangeRequest[]>;
+    /** Change requests authored by the caller (hash-matched against the body marker). */
+    listChangeRequestsAuthoredBy(emailOrLogin: string): Promise<ChangeRequest[]>;
+    /** Change requests touching files the user has write permission on. */
+    listChangeRequestsForUser(workspaceId: string, email: string, opts?: {
+        fresh?: boolean;
+    }): Promise<ChangeRequest[]>;
+    getChangeRequest(number: number): Promise<ChangeRequest | null>;
+    getChangeRequestDetail(number: number, opts?: {
+        fresh?: boolean;
+        workspaceId?: string;
+        viewerEmail?: string;
+    }): Promise<ChangeRequestDetail | null>;
+    /**
+     * Open a new change request. Per spec, auto-merges `targetBranch` into
+     * `sourceBranch` and surfaces the resulting diff as the changes to review.
+     * Throws `NotImplementedWorkflowError` until the backing create-PR path
+     * lands in the workflow module (today the agent shells `gh pr create`
+     * directly).
+     */
+    openChangeRequest(workspaceId: string, user: AuthUser, input: OpenChangeRequestInput): Promise<ChangeRequestDetail>;
+    /**
+     * Re-run `targetBranch → sourceBranch` merge on an existing change request.
+     * Used when the target has advanced since the change request was opened.
+     * Throws `NotImplementedWorkflowError` until the backing merge path lands.
+     */
+    updateFromTarget(workspaceId: string, user: AuthUser, number: number): Promise<ChangeRequestDetail>;
+    listComments(number: number): Promise<ChangeRequestComment[]>;
+    postComment(number: number, user: AuthUser, input: PostChangeRequestCommentInput, headSha: string): Promise<ChangeRequestComment>;
+    editComment(commentId: string, number: number, user: AuthUser, body: string): Promise<ChangeRequestComment>;
+    deleteComment(commentId: string, number: number, user: AuthUser): Promise<void>;
+    approveFile(number: number, path: string, user: AuthUser, files: ChangedFile[], headSha: string, baseBranch: string, authorIdHash: string | null, workspaceId: string): Promise<FileApproval[]>;
+    unapproveFile(number: number, path: string, user: AuthUser, files: ChangedFile[], headSha: string, baseBranch: string, authorIdHash: string | null, workspaceId: string): Promise<FileApproval[]>;
+    /**
+     * Reject a change request without merging. Authorized for the author or
+     * for users with write permission to every changed file on the target
+     * branch.
+     */
+    rejectChangeRequest(number: number, user: AuthUser, state: ChangeRequestState, authorIdHash: string | null, baseBranch: string, workspaceId: string): Promise<CancelChangeRequestResult>;
+    /**
+     * Merge a change request. The workflow tries a direct merge first; on
+     * conflicts it returns a `conflicts-need-resolution` outcome and the
+     * caller (typically the agent) is responsible for resolving them as new
+     * changes on the source branch. Once the source contains target cleanly,
+     * a subsequent `mergeChangeRequest` call lands the merge.
+     *
+     * The hard merge invariant — only this method may invoke `gh pr merge` —
+     * is preserved through the facade by delegating to
+     * `IReviewWorkflowService.mergePr`.
+     */
+    mergeChangeRequest(number: number, user: AuthUser, headSha: string, approvals: FileApproval[], state: ChangeRequestState, title: string, baseBranch: string, workspaceId: string, opts?: {
+        bypass?: boolean;
+    }): Promise<MergeChangeRequestOutcome>;
+}
+//# sourceMappingURL=interface.d.ts.map

package/dist/workflow/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/workflow/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EACV,iBAAiB,EACjB,MAAM,EACN,qBAAqB,EACrB,yBAAyB,EACzB,MAAM,EACN,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,yBAAyB,EACzB,sBAAsB,EACtB,6BAA6B,EAC9B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAG/B,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF;;;;OAIG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpF;;;;;;;;;OASG;IACH,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,GAClC,OAAO,CAAC,IAAI,CAAC,CAAC;IAQjB,gGAAgG;IAChG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAGlE;;;;OAIG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5F,4DAA4D;IAC5D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,8EAA8E;IAC9E,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;OAIG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;OAIG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7E;;;;OAIG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAQ/D;;;;;;OAMG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvF;;;;;;;;;OASG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1B,+DAA+D;IAC/D,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF;;;;OAIG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChF;;;;;;OAMG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAIlF;;;;;;;;OAQG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,qEAAqE;IACrE,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpG;;;;;;;;OAQG;IACH,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE1B;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;OAOG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8EAA8E;IAC9E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAIrF,kBAAkB,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACzE,qFAAqF;IACrF,4BAA4B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC7E,uEAAuE;IACvE,yBAAyB,CACvB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACzB,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5B,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAChE,sBAAsB,CACpB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACrE,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAEvC;;;;;;OAMG;IACH,iBAAiB,CACf,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhC;;;;OAIG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAGpG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC9D,WAAW,CACT,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,6BAA6B,EACpC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5G,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAIhF,WAAW,CACT,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,WAAW,EAAE,EACpB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3B,aAAa,CACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,WAAW,EAAE,EACpB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE3B;;;;OAIG;IACH,mBAAmB,CACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;;;OAUG;IACH,kBAAkB,CAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,YAAY,EAAE,EACzB,KAAK,EAAE,kBAAkB,EACzB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1B,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACvC"}

package/dist/workflow/interface.js

@@ -0,0 +1,20 @@
+/**
+ * `IWorkflowService` — the abstraction the rest of the app talks to instead
+ * of raw git/gh. See `bevel-platform/PLAN.md` for the motivation and the spec the
+ * methods here encode (protected branches, atomic per-file changes, file
+ * locks, change requests as branch-pair reconciliations).
+ *
+ * Naming convention: methods speak workflow vocabulary (`commitChange`,
+ * `openChangeRequest`, `acquireLock`), never git vocabulary (`commit`,
+ * `createPr`, no analogue for locks). Implementations may delegate to the
+ * existing git/PR/review-workflow services until those are folded into
+ * `modules/workflow`; callers should not depend on that fact.
+ *
+ * Some methods on this interface have no backing service yet — file locks,
+ * `openChangeRequest`, `updateFromTarget`. The facade implementation throws
+ * `NotImplementedWorkflowError` from those until the underlying support
+ * lands. The interface defines them up-front so consumers can plan against
+ * the final surface area.
+ */
+export {};
+//# sourceMappingURL=interface.js.map

package/dist/workflow/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/workflow/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/workflow/types.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Workflow vocabulary — the abstraction our app speaks instead of raw git/gh.
+ *
+ * Most types here alias existing engineering types in `@bevel-software/platform-shared/git/*` so
+ * the workflow layer is a single source of truth without duplicating the
+ * payload shapes our backend already produces. The point of the aliases is the
+ * *name*: callers depend on `Change` / `ChangeRequest` / `Branch`, never on
+ * `Commit` / `PullRequest` / `Branch` from the git module. When we eventually
+ * collapse `modules/git` and `modules/review-workflow` into `modules/workflow`,
+ * the alias targets move with the implementation; the consumer-facing names
+ * don't need to.
+ *
+ * New types that have no git counterpart (file locks, change-request open
+ * inputs, conflict-resolution payloads) live here directly.
+ */
+import type { BranchInfo, CommitAttribution, ShareChangesRequest, WorkingTreeStatus } from '../git/types.js';
+import type { CancelPrResult, FileApprovalState, MergePrResult, PullRequestDetail, PullRequestState, PullRequestSummary, PostPrCommentInput, PrReviewComment, PullRequestFile } from '../git/pr.types.js';
+/** A variation of the ontology. Protected or not. */
+export type Branch = BranchInfo;
+/**
+ * Snapshot of the workspace tied to a branch — currently-checked-out branch,
+ * dirty bit, unshared commit count. Mirrors `WorkingTreeStatus` from the git
+ * module. Renames to `BranchWorkspaceStatus` in the workflow domain to signal
+ * "this describes the branch's workspace state", not raw git plumbing.
+ */
+export type BranchWorkspaceStatus = WorkingTreeStatus;
+/**
+ * A change is the atomic unit of history. Each change affects exactly one file.
+ * Creating an empty folder is modeled as a change creating a `.gitkeep` in it.
+ * Renames are a single change touching one path with the old path removed in
+ * the same atomic operation. Aliases `CommitAttribution` because that's
+ * exactly the shape the backend already returns for a single commit.
+ */
+export type Change = CommitAttribution;
+/**
+ * Input shape for committing a change. `summary` is required and single-line;
+ * `description` is optional and supports a multi-line body. Aliases
+ * `ShareChangesRequest` for now — once the workflow module owns the validator
+ * gate end-to-end, this shape may grow workflow-specific fields (lock token,
+ * forced single-path scope).
+ */
+export type ChangeInput = ShareChangesRequest;
+/**
+ * A live edit lock on one (branch, path). Per the workflow spec:
+ *   - acquired on first edit in edit mode, or on agent write
+ *   - per-(branch, path); the same file on another branch is independently lockable
+ *   - autosave checkpoint timer extends the lock and produces intermediate changes
+ *   - stale locks (no heartbeat past TTL) auto-release so a disconnected client
+ *     can't hold a file hostage
+ *
+ * Holder identity carries both `userId` (the join key against the users table)
+ * and `holderName` (display name, denormalised so consumers can render a
+ * "locked by Alice" badge without an extra round-trip). For agent-driven
+ * writes the holder is the user driving the agent.
+ */
+export interface FileLock {
+    branch: string;
+    path: string;
+    holderUserId: string;
+    holderName: string;
+    /** ISO timestamp when the lock was first acquired. */
+    acquiredAt: string;
+    /** ISO timestamp of the most recent heartbeat — the autosave/keepalive ping. */
+    lastHeartbeatAt: string;
+    /** ISO timestamp after which a non-heartbeated lock is considered stale and may be reclaimed. */
+    expiresAt: string;
+}
+/**
+ * Result of attempting to acquire a lock. `acquired: false` carries the
+ * current holder so the UI can render "Locked by X" without a follow-up call.
+ */
+export type AcquireLockResult = {
+    acquired: true;
+    lock: FileLock;
+} | {
+    acquired: false;
+    lock: FileLock;
+};
+/**
+ * A change request is the reconciliation of two branches. In the current
+ * implementation this is backed by a GitHub pull request; the alias hides
+ * that from callers. `state` values map 1:1 (`open`/`merged`/`closed`).
+ *
+ * Opening a change request is defined in the spec as auto-merging target →
+ * source first; that part isn't yet implemented in the backing services, so
+ * `openChangeRequest` on `IWorkflowService` currently throws
+ * `NotImplementedWorkflowError`.
+ */
+export type ChangeRequest = PullRequestSummary;
+export type ChangeRequestDetail = PullRequestDetail;
+export type ChangeRequestState = PullRequestState;
+export type ChangedFile = PullRequestFile;
+export type FileApproval = FileApprovalState;
+export type MergeChangeRequestResult = MergePrResult;
+export type CancelChangeRequestResult = CancelPrResult;
+export type ChangeRequestComment = PrReviewComment;
+export type PostChangeRequestCommentInput = PostPrCommentInput;
+/**
+ * Input for opening a new change request. The workflow auto-merges
+ * `targetBranch` into `sourceBranch` as part of opening, so callers don't
+ * pass a head SHA — the workflow resolves the head itself.
+ *
+ * `title` + `description` are the change request's metadata; the description
+ * is plain text (no GitHub-flavoured markdown affordances exposed at this
+ * layer). The implementation may still render this as the PR body when the
+ * underlying GitHub PR is created.
+ */
+export interface OpenChangeRequestInput {
+    sourceBranch: string;
+    targetBranch: string;
+    title: string;
+    description?: string;
+}
+/**
+ * Result of asking the workflow to merge a change request. Mirrors
+ * `MergePrResult` — caller learns the resulting change (commit) sha and the
+ * timestamp the merge landed.
+ *
+ * When the merge attempt hits conflicts the workflow falls back to an
+ * agent-driven resolution path; the caller does NOT get a `MergeChangeRequestResult`
+ * back in that case — they get a `ConflictPending` shape instead so the UI
+ * can route into the resolution flow.
+ */
+export type MergeChangeRequestOutcome = {
+    kind: 'merged';
+    result: MergeChangeRequestResult;
+} | {
+    kind: 'conflicts-need-resolution';
+    conflictedPaths: string[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/workflow/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/workflow/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAI5B,qDAAqD;AACrD,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAItD;;;;;;GAMG;AACH,MAAM,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAI9C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAIxC;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAC/C,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACpD,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAClD,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAC7C,MAAM,MAAM,wBAAwB,GAAG,aAAa,CAAC;AACrD,MAAM,MAAM,yBAAyB,GAAG,cAAc,CAAC;AACvD,MAAM,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACnD,MAAM,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,2BAA2B,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC"}

package/dist/workflow/types.js

@@ -0,0 +1,17 @@
+/**
+ * Workflow vocabulary — the abstraction our app speaks instead of raw git/gh.
+ *
+ * Most types here alias existing engineering types in `@bevel-software/platform-shared/git/*` so
+ * the workflow layer is a single source of truth without duplicating the
+ * payload shapes our backend already produces. The point of the aliases is the
+ * *name*: callers depend on `Change` / `ChangeRequest` / `Branch`, never on
+ * `Commit` / `PullRequest` / `Branch` from the git module. When we eventually
+ * collapse `modules/git` and `modules/review-workflow` into `modules/workflow`,
+ * the alias targets move with the implementation; the consumer-facing names
+ * don't need to.
+ *
+ * New types that have no git counterpart (file locks, change-request open
+ * inputs, conflict-resolution payloads) live here directly.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/workflow/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/workflow/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/workspace/filename.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Cross-platform filename validation. A name that passes here must be writable
+ * as-is on Windows (NTFS), macOS (APFS), and Linux (ext4) — so the same
+ * workspace can round-trip between dev machines, the backend container, and
+ * any user's local clone without `git checkout` failing on a forbidden name.
+ *
+ * Used by:
+ *  - frontend: gate the create / rename inputs in FileExplorer
+ *  - backend: reject API requests at the workspace service boundary
+ *  - agent prompt: the same rules are described to the LLM so it picks valid
+ *    names when authoring KB files
+ *
+ * Keep this file dependency-free — both bundle targets import it directly.
+ */
+/**
+ * Validate a single path component (file or folder name — no `/`, no `\`).
+ * Returns `null` if valid, or a short reason string suitable for surfacing
+ * in a UI error or API 400 body.
+ */
+export declare function validateFilename(name: string): string | null;
+/**
+ * Validate a workspace-relative path: a `/`-separated string of components.
+ * Each component is checked with {@link validateFilename}. Backslashes are
+ * rejected outright — the workspace API uses `/` everywhere and accepting
+ * `\` would round-trip differently on Windows vs the Linux container.
+ */
+export declare function validateRelativePath(relativePath: string): string | null;
+/**
+ * Throwing wrapper for the backend service layer — keeps call sites a single
+ * line and produces a clear `Error` the route handler can surface as a 400.
+ */
+export declare function assertValidRelativePath(relativePath: string): void;
+//# sourceMappingURL=filename.d.ts.map

package/dist/workspace/filename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filename.d.ts","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsBH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2B5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAGlE"}

package/dist/workspace/filename.js

@@ -0,0 +1,98 @@
+/**
+ * Cross-platform filename validation. A name that passes here must be writable
+ * as-is on Windows (NTFS), macOS (APFS), and Linux (ext4) — so the same
+ * workspace can round-trip between dev machines, the backend container, and
+ * any user's local clone without `git checkout` failing on a forbidden name.
+ *
+ * Used by:
+ *  - frontend: gate the create / rename inputs in FileExplorer
+ *  - backend: reject API requests at the workspace service boundary
+ *  - agent prompt: the same rules are described to the LLM so it picks valid
+ *    names when authoring KB files
+ *
+ * Keep this file dependency-free — both bundle targets import it directly.
+ */
+/** Windows-reserved device names. Case-insensitive; the bare name AND
+ *  `<name>.<ext>` are both reserved (e.g. `NUL.txt` is invalid on Windows). */
+const WINDOWS_RESERVED_NAMES = new Set([
+    'CON', 'PRN', 'AUX', 'NUL',
+    'COM0', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9',
+    'LPT0', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9',
+]);
+/** Characters Windows forbids in any filename component. `/` is the path
+ *  separator on Unix, included for the same reason. `\` is also a path
+ *  separator on Windows. Control chars (0x00–0x1F) are rejected separately. */
+// eslint-disable-next-line no-control-regex
+const FORBIDDEN_CHARS = /[<>:"/\\|?*\x00-\x1F]/;
+/** Per-component byte limit: NTFS = 255 UTF-16 units, ext4 = 255 bytes,
+ *  APFS = 255 UTF-8 bytes. Use UTF-8 bytes — the strictest of the three. */
+const MAX_NAME_BYTES = 255;
+const utf8 = new TextEncoder();
+/**
+ * Validate a single path component (file or folder name — no `/`, no `\`).
+ * Returns `null` if valid, or a short reason string suitable for surfacing
+ * in a UI error or API 400 body.
+ */
+export function validateFilename(name) {
+    if (typeof name !== 'string')
+        return 'Name is required';
+    if (name.length === 0)
+        return 'Name cannot be empty';
+    if (name !== name.trim())
+        return 'Name cannot start or end with whitespace';
+    if (name === '.' || name === '..')
+        return 'Name cannot be "." or ".."';
+    if (FORBIDDEN_CHARS.test(name)) {
+        return 'Name cannot contain any of these characters: < > : " / \\ | ? *';
+    }
+    // Windows trims trailing dots and spaces silently — a name ending in either
+    // becomes a different filename on disk, breaking sync between OSes.
+    if (name.endsWith('.') || name.endsWith(' ')) {
+        return 'Name cannot end with a "." or a space';
+    }
+    // Windows reserved device names — match `NAME` and `NAME.ext`, case-insensitive.
+    const stem = name.split('.')[0].toUpperCase();
+    if (WINDOWS_RESERVED_NAMES.has(stem)) {
+        return `"${name}" is a reserved system name on Windows`;
+    }
+    if (utf8.encode(name).length > MAX_NAME_BYTES) {
+        return `Name is too long (max ${MAX_NAME_BYTES} bytes)`;
+    }
+    return null;
+}
+/**
+ * Validate a workspace-relative path: a `/`-separated string of components.
+ * Each component is checked with {@link validateFilename}. Backslashes are
+ * rejected outright — the workspace API uses `/` everywhere and accepting
+ * `\` would round-trip differently on Windows vs the Linux container.
+ */
+export function validateRelativePath(relativePath) {
+    if (typeof relativePath !== 'string' || relativePath.length === 0) {
+        return 'Path is required';
+    }
+    if (relativePath.includes('\\')) {
+        return 'Path cannot contain "\\" — use "/" as the separator';
+    }
+    // Strip a single leading `./` so callers that build paths from a base dir
+    // (`./<name>`) don't get a spurious "." segment rejection.
+    const normalized = relativePath.replace(/^\.\//, '');
+    const segments = normalized.split('/').filter((s) => s.length > 0);
+    if (segments.length === 0)
+        return 'Path is required';
+    for (const segment of segments) {
+        const reason = validateFilename(segment);
+        if (reason)
+            return `Invalid path segment "${segment}": ${reason}`;
+    }
+    return null;
+}
+/**
+ * Throwing wrapper for the backend service layer — keeps call sites a single
+ * line and produces a clear `Error` the route handler can surface as a 400.
+ */
+export function assertValidRelativePath(relativePath) {
+    const reason = validateRelativePath(relativePath);
+    if (reason)
+        throw new Error(`Invalid path: ${reason}`);
+}
+//# sourceMappingURL=filename.js.map

package/dist/workspace/filename.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filename.js","sourceRoot":"","sources":["../../src/workspace/filename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;+EAC+E;AAC/E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC/E,CAAC,CAAC;AAEH;;+EAE+E;AAC/E,4CAA4C;AAC5C,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD;4EAC4E;AAC5E,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,0CAA0C,CAAC;IAC5E,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,4BAA4B,CAAC;IAEvE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,iEAAiE,CAAC;IAC3E,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,uCAAuC,CAAC;IACjD,CAAC;IAED,iFAAiF;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,IAAI,wCAAwC,CAAC;IAC1D,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAC9C,OAAO,yBAAyB,cAAc,SAAS,CAAC;IAC1D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,yBAAyB,OAAO,MAAM,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC"}

package/dist/workspace/frontmatter.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The ONE `---` frontmatter splitter, shared by backend and frontend so no file
+ * type grows its own regex. Splits a leading `---`-fenced YAML block from the
+ * body; null when the text doesn't open with a fence. Parsing the YAML inside is
+ * the caller's concern (the access-control resolver deliberately keeps its own
+ * hardened line-based reader — see `modules/access/access-splice.ts`).
+ */
+export declare function extractFrontmatter(text: string): {
+    frontmatter: string;
+    body: string;
+} | null;
+/**
+ * Set a top-level scalar key in a file's `---` frontmatter, LINE-based: replace an
+ * existing `<key>:` line's value, else insert `<key>: <value>` at the top of the
+ * block (creating a `---` block if the file has none). Deliberately NOT a
+ * parse-and-re-serialize — a KB node's `nodeType:` quoted-markdown-link and access
+ * lines are read by a hand-rolled regex parser that a full YAML re-emit would
+ * corrupt, so every other line is preserved byte-for-byte. `value` is emitted as a
+ * bare scalar; callers pass simple id/name strings (no quoting/escaping needed for
+ * the `[a-z0-9_-]` id grammar).
+ */
+export declare function setFrontmatterField(text: string, key: string, value: string): string;
+//# sourceMappingURL=frontmatter.d.ts.map