@bevel-software/platform-shared 0.1.0

package/src/git/pr.types.ts

@@ -0,0 +1,274 @@
+export type PullRequestState = 'open' | 'merged' | 'closed';
+
+export interface PullRequestAuthor {
+  login: string;
+  name?: string;
+}
+
+export interface PullRequestReviewStatus {
+  approvals: number;
+  changesRequested: number;
+  /** GitHub logins of reviewers with a pending request (no review yet). */
+  pendingLogins: string[];
+}
+
+export interface PullRequestSummary {
+  number: number;
+  title: string;
+  author: PullRequestAuthor;
+  /**
+   * Opaque SHA-256 hash of the authoring user's email. Embedded in the PR body via a hidden
+   * marker so `/pr/mine` can filter by identity without leaking raw emails into bodies. Absent
+   * on PRs not created through this backend. `author.login` is always the GitHub account that
+   * actually opened the PR (typically our service account). Compare by re-hashing the caller's
+   * email; there is no reverse lookup.
+   */
+  authorId?: string;
+  /**
+   * The app user (not the GitHub account) who triggered this PR. Resolved server-side by
+   * matching `authorId` against the hash of every app user's email. Use this in user-facing
+   * surfaces — `author.login` is always the shared service account.
+   *
+   * Display name only — no email. Other authenticated workspace members don't need raw
+   * emails to render PR attribution. The hash in `authorId` is the stable identity if
+   * downstream code needs to compare against the current user.
+   *
+   * Absent when no app user matches the hash (e.g. PRs opened outside this backend, or after
+   * an app user was removed from the users table).
+   */
+  appAuthor?: { name: string };
+  branch: string;
+  base: string;
+  state: PullRequestState;
+  createdAt: string;
+  /** Relative paths within `knowledge-base/`. Empty if not yet computed. */
+  touchedNodePaths: string[];
+  review: PullRequestReviewStatus;
+  url: string;
+}
+
+export type PrFileStatus =
+  | 'added'
+  | 'modified'
+  | 'removed'
+  | 'renamed'
+  | 'copied'
+  | 'changed'
+  | 'unchanged';
+
+/**
+ * A single file in a PR. Patch is GitHub's unified-diff text; it's absent for
+ * binary files and for files larger than the API cutoff (~3 MB). `previousPath`
+ * is populated for renames/copies.
+ */
+export interface PullRequestFile {
+  path: string;
+  previousPath?: string;
+  status: PrFileStatus;
+  additions: number;
+  deletions: number;
+  patch?: string;
+  isBinary: boolean;
+  /** Blob SHA at the PR head — stable identifier for caching raw content. */
+  sha: string;
+  /** Authenticated `raw.githubusercontent.com`-style URL for the blob at head. */
+  rawUrl: string;
+}
+
+/**
+ * One comment in the Bevel-owned PR discussion. GitHub never sees these —
+ * they live only in our DB, attributed to the authenticated user. Shape
+ * encodes three comment kinds:
+ *
+ *   General         → path undefined, line undefined
+ *   File-level      → path set,      line undefined
+ *   Inline (line)   → path set,      line set
+ *
+ * Threading: `parentId` points at the root of the thread; top-level comments
+ * have it undefined.
+ */
+export interface PrReviewComment {
+  id: string;
+  author: { email: string; name: string };
+  body: string;
+  path?: string;
+  line?: number;
+  /** The head SHA the comment was authored against — lets the UI grey out stale inline pins. */
+  headSha: string;
+  parentId?: string;
+  createdAt: string;
+  updatedAt?: string;
+}
+
+export interface PostPrCommentInput {
+  body: string;
+  path?: string;
+  line?: number;
+  parentId?: string;
+}
+
+/**
+ * One owner's approval on one file. Stored straight from the
+ * `pr_file_approvals` row, with derived flags the UI needs.
+ */
+export interface FileApprovalEntry {
+  email: string;
+  name: string;
+  approvedAt: string;
+  /** True when this approval was captured against a SHA that is no longer the PR head. */
+  isStale: boolean;
+  /** True when the approver is the PR author (hash-matched against the PR body marker). */
+  isSelfApproval: boolean;
+}
+
+/**
+ * Per-file approval state the PR viewer needs to render the approval badge,
+ * the Approve button, and the merge gate.
+ *
+ * `eligibleApprovers` lists everyone who could approve this file at the PR
+ * head SHA, derived from the access tree (`roles.yaml` + `access.md`). A
+ * file is approved when any non-author user holding one of those roles (or
+ * directly named) submits a non-stale approval. The built-in role `everyone`
+ * means any signed-in approver is eligible.
+ */
+export interface FileApprovalState {
+  path: string;
+  /**
+   * Roles + direct user grants that confer write access on this file as of
+   * the PR head. `roles` may include the built-in role `everyone`. Empty roles
+   * + empty users means the file is outside the access-controlled surface (no
+   * rule grants write); the merge gate silently excludes such entries instead
+   * of blocking on them.
+   */
+  eligibleApprovers: {
+    roles: string[];
+    users: { name: string; email: string }[];
+  };
+  approvedBy: FileApprovalEntry[];
+  /**
+   * True iff at least one eligible approver has submitted a non-stale
+   * approval. Always `false` when `eligibleApprovers` is empty — with no
+   * eligible set, nobody can satisfy the check.
+   * Whether the gate *cares* about this file is a separate concern handled
+   * by the merge-gate logic: non-md files and files with no eligible
+   * approvers are silently excluded from the gate, so `isApproved: false`
+   * on one of them does not block merge.
+   */
+  isApproved: boolean;
+  /**
+   * Pre-computed for the requesting viewer: would `approveFile` accept their
+   * click? True iff their email resolves to `write` on this path under the
+   * access tree at `origin/<baseBranch>`. The frontend uses this to gate the
+   * Approve button — without it, the button shows for any user whenever the
+   * eligible-roles list is non-empty, which is misleading because most users
+   * aren't actually in those roles. Backend remains authoritative; this is a
+   * UX hint, not a security boundary.
+   */
+  viewerCanApprove: boolean;
+}
+
+/**
+ * Full read-only PR detail for the in-app viewer. Extends the summary with
+ * body, SHAs, file list, and the Bevel-owned comments. Later phases add
+ * `approvals` and merge-gate fields — this shape grows incrementally.
+ */
+export interface PullRequestDetail extends PullRequestSummary {
+  body: string;
+  headSha: string;
+  baseSha: string;
+  files: PullRequestFile[];
+  comments: PrReviewComment[];
+  /**
+   * One entry per file in `files`, same order. Empty when the caller had no
+   * resolvable workspace to do the owner lookup against.
+   */
+  approvals: FileApprovalState[];
+  /**
+   * True iff no *hard* block applies — the PR is open, has files, and isn't
+   * merged/closed. Soft warnings (missing owner approvals on md files) do
+   * **not** set this to false; the UI handles them via the bypass dialog.
+   * The button is disabled only when this is false.
+   */
+  mergeableInBevel: boolean;
+  /**
+   * Hard-block reasons — merging is impossible until these resolve (PR state,
+   * no files, etc.). Empty when the PR can be merged (possibly after bypass).
+   */
+  mergeBlockedReasons: string[];
+  /**
+   * Soft warnings — md files with an owner who hasn't approved (or whose
+   * approval is stale). Merging is allowed but the UI asks for an explicit
+   * bypass confirmation first. Non-md files and ownerless md files are silent.
+   */
+  mergeWarnings: string[];
+  /**
+   * True iff the viewer holds write on `roles.yaml` at `origin/<base>` —
+   * i.e. they're in the Admin role on the canonical access tree. The
+   * frontend uses this to hide / disable the bypass action for non-admins;
+   * the backend enforces the same check on the merge route. False when no
+   * viewer was passed (anonymous detail fetch) or when the access tree on
+   * base can't be resolved.
+   */
+  viewerCanBypassMerge: boolean;
+  /**
+   * True iff the viewer is allowed to cancel this change request: the PR is
+   * open AND the viewer is either its author (hash-matched against the body
+   * marker) or an admin (write on `roles.yaml` at `origin/<base>` — same
+   * predicate `viewerCanBypassMerge` uses). The frontend renders the Cancel
+   * button as disabled when this is false; the backend re-checks server-side
+   * on `POST /pr/:n/cancel`, so this is a UX hint, not a security boundary.
+   * False when no viewer was passed, the state isn't `open`, or the access
+   * tree can't be resolved.
+   */
+  viewerCanCancel: boolean;
+}
+
+/**
+ * Result of a successful merge via the in-app gate. `sha` is the merge commit
+ * GitHub produced; the UI uses it to link to the resulting commit and to
+ * invalidate any stale views.
+ */
+export interface MergePrResult {
+  prNumber: number;
+  sha: string;
+  mergedAt: string;
+}
+
+/**
+ * Result of a successful cancel via `POST /pr/:n/cancel`. No SHA — closing a
+ * PR without merging produces no merge commit. `cancelledAt` is the
+ * server-side timestamp the close was recorded; useful for audit display.
+ */
+export interface CancelPrResult {
+  prNumber: number;
+  cancelledAt: string;
+}
+
+export interface IPullRequestService {
+  /**
+   * `opts.fresh` bypasses the internal 30s list cache — used when the UI has
+   * a reason to believe the server-side state just changed (agent-opened PR
+   * via `gh pr create`) and the user expects to see the update immediately.
+   */
+  listOpenPrs(opts?: { fresh?: boolean }): Promise<PullRequestSummary[]>;
+  listPrsAuthoredBy(githubLoginOrEmail: string): Promise<PullRequestSummary[]>;
+  /**
+   * PRs whose touched paths have an owner with the given email.
+   * Resolution uses the given workspace's KB — caller passes their own workspaceId.
+   */
+  listPrsForOwnerEmail(
+    workspaceId: string,
+    email: string,
+    opts?: { fresh?: boolean },
+  ): Promise<PullRequestSummary[]>;
+  getPr(prNumber: number): Promise<PullRequestSummary | null>;
+  /**
+   * Full detail for the in-app PR viewer. `opts.fresh` bypasses the detail cache
+   * — use for event-driven refreshes (post-merge, share-dialog create).
+   * `opts.viewerEmail` pre-computes `viewerCanApprove` per file.
+   */
+  getPrDetail(
+    prNumber: number,
+    opts?: { fresh?: boolean; workspaceId?: string; viewerEmail?: string },
+  ): Promise<PullRequestDetail | null>;
+}

package/src/git/protected.ts

@@ -0,0 +1,121 @@
+/**
+ * Authoritative, env-overridable registry of the default branch + the set of
+ * protected branch slugs in the KB repo, plus their user-visible display names.
+ *
+ * Single source of truth for BOTH sides of the app:
+ *  - Backend (Node) reads `process.env.*` at runtime — the values are populated
+ *    from the environment / the `.env` loaded by `config.ts`, which runs before
+ *    this module is first evaluated (see `backend/src/index.ts` import order).
+ *  - Frontend (browser) can't read `process.env` at runtime, so Vite statically
+ *    replaces the `process.env.DEFAULT_BRANCH` / `process.env.PROTECTED_BRANCHES`
+ *    references at build time via `define` in `frontend/vite.config.ts`. Keep
+ *    those references written as the literal `process.env.<NAME>` member access
+ *    so the static replacement keeps matching.
+ *
+ * Both the backend (server-side enforcement — refusing commit/push/revert and
+ * rejecting `createBranch` on protected names) and the frontend (disabling UI
+ * actions, showing the protected-branch banner, branch sort order) consume this
+ * single table so the two can never drift. Don't re-declare or hard-code the
+ * names elsewhere.
+ *
+ * Env vars (both REQUIRED — no fallback; the module throws at load if either is
+ * missing/empty, so a misconfigured deploy fails fast instead of silently
+ * defaulting to the wrong branches). Note the frontend needs them present at
+ * BUILD time (Vite `define`), the backend at runtime:
+ *  - `DEFAULT_BRANCH`      — the branch a user lands on / the default propose
+ *                            target.
+ *  - `PROTECTED_BRANCHES`  — comma/space-separated list of protected slugs.
+ *                            Display names are auto-derived from each slug
+ *                            (`target-company-state` → "Target company state").
+ */
+
+// `process` is supplied by Node at runtime on the backend and statically
+// replaced by Vite at build time on the frontend (vite.config.ts `define`).
+// Declared locally — narrowed to just `env` — so this shared module typechecks
+// without pulling @types/node into the @bevel-software/platform-shared package. On the backend
+// build (which has @types/node) this module-scoped declaration simply shadows
+// the global `process`, which is harmless here.
+declare const process: { env: Record<string, string | undefined> };
+
+function parseBranchList(raw: string | undefined): string[] {
+  return (raw ?? '')
+    .split(/[\s,]+/)
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0);
+}
+
+/**
+ * Human-readable name derived from a kebab/snake slug: lowercase words joined by
+ * spaces with only the first letter capitalised — e.g. `target-company-state` →
+ * "Target company state". Matches the historical hand-written display names.
+ */
+function deriveDisplayName(slug: string): string {
+  const spaced = slug.replace(/[-_]+/g, ' ').trim();
+  if (!spaced) return slug;
+  return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+
+/**
+ * The branch a logged-in user lands on when they don't explicitly pick one, and
+ * the default destination for shared drafts. Env-overridable via `DEFAULT_BRANCH`.
+ */
+export const DEFAULT_BRANCH: string = (process.env.DEFAULT_BRANCH ?? '').trim();
+if (!DEFAULT_BRANCH) {
+  throw new Error(
+    'DEFAULT_BRANCH env var is required (no fallback). Set it on the backend ' +
+      'runtime and at the frontend build (Vite reads it via define).',
+  );
+}
+
+const PROTECTED_BRANCH_LIST: string[] = parseBranchList(process.env.PROTECTED_BRANCHES);
+if (PROTECTED_BRANCH_LIST.length === 0) {
+  throw new Error(
+    'PROTECTED_BRANCHES env var is required (no fallback). Provide a ' +
+      'comma/space-separated list of protected branch slugs.',
+  );
+}
+// The default branch is where users land and the default propose target — it
+// must itself be protected, or `isProtectedBranch(DEFAULT_BRANCH)` is false and
+// the protected-branch guards silently don't apply to it. Fail fast on a
+// misconfigured pair rather than shipping that inconsistency.
+if (!PROTECTED_BRANCH_LIST.includes(DEFAULT_BRANCH)) {
+  throw new Error(
+    `DEFAULT_BRANCH ("${DEFAULT_BRANCH}") must be one of PROTECTED_BRANCHES ` +
+      `(${PROTECTED_BRANCH_LIST.join(', ')}).`,
+  );
+}
+
+export const PROTECTED_BRANCH_DISPLAY_NAMES: Readonly<Record<string, string>> =
+  Object.freeze(
+    Object.fromEntries(
+      PROTECTED_BRANCH_LIST.map((slug) => [slug, deriveDisplayName(slug)]),
+    ),
+  );
+
+export const PROTECTED_BRANCHES: ReadonlySet<string> = new Set(PROTECTED_BRANCH_LIST);
+
+export function isProtectedBranch(name: string | null | undefined): boolean {
+  return !!name && Object.prototype.hasOwnProperty.call(
+    PROTECTED_BRANCH_DISPLAY_NAMES,
+    name,
+  );
+}
+
+/**
+ * Capitalised, human-readable name for a protected branch — e.g.
+ * `current-company-state` → "Current company state".
+ *
+ * Use this everywhere the branch name appears in user-visible body copy
+ * (banners, tooltips, button labels). The raw kebab slug is fine in small
+ * monospace badges for power users / debug surfaces, but body copy should
+ * never read "merge into current-company-state" to a non-developer.
+ *
+ * Returns `null` for unknown / non-protected names so the caller can decide
+ * whether to fall back to the raw string or hide the affordance.
+ */
+export function protectedBranchDisplayName(
+  name: string | null | undefined,
+): string | null {
+  if (!name) return null;
+  return PROTECTED_BRANCH_DISPLAY_NAMES[name] ?? null;
+}

package/src/git/review.types.ts

@@ -0,0 +1,51 @@
+export type ChangeKind = 'added' | 'modified' | 'deleted' | 'renamed';
+
+/**
+ * A single pending change — the diff between the on-disk backup ledger
+ * (the user's last-confirmed state) and the current working tree for one path.
+ */
+export interface PendingChange {
+  /** Current path (for added/modified/renamed) or original path (for deleted). */
+  path: string;
+  /** Populated only when kind === 'renamed' — the pre-rename path. */
+  oldPath?: string;
+  kind: ChangeKind;
+  isBinary: boolean;
+  /**
+   * Line counts from an LCS diff. Null in two cases:
+   * - the file is binary (no line concept), or
+   * - the text diff exceeds the backend's LCS cap and exact counts were
+   *   skipped to avoid OOM. Consumers should treat null as "not computed".
+   */
+  linesAdded: number | null;
+  linesRemoved: number | null;
+}
+
+/**
+ * Pending-changes envelope returned by the review API. Backed by the
+ * on-disk backup ledger (a sibling-to-workspaces folder containing each
+ * diffable file's last-confirmed contents). `baselineRef` is retained for
+ * wire-shape compatibility but is empty under the backup-folder model;
+ * the frontend reads `changes` and `branchName` only.
+ */
+export interface ReviewSession {
+  branchName: string;
+  /** Always empty in the backup-folder model — kept for wire compatibility. */
+  baselineRef: string;
+  createdAt: string;
+  changes: PendingChange[];
+}
+
+/**
+ * Full before/after content for one path in an active session. The UI renders
+ * this through a line-level LCS diff.
+ */
+export interface FileDiffPayload {
+  path: string;
+  kind: ChangeKind;
+  /** Content at the baseline. Null for `added` or binary files. */
+  baseline: string | null;
+  /** Current working-tree content. Null for `deleted` or binary files. */
+  current: string | null;
+  isBinary: boolean;
+}

package/src/git/types.ts

@@ -0,0 +1,170 @@
+import type { AuthUser } from '../auth/types.js';
+
+export interface BranchInfo {
+  name: string;
+  isProtected: boolean;
+  // Commits ahead/behind the branch's upstream (falls back to the nearest
+  // protected branch on origin). Null when neither can be resolved, e.g. a
+  // freshly-created local branch that has never been pushed.
+  ahead: number | null;
+  behind: number | null;
+  /**
+   * True iff `refs/remotes/origin/<name>` exists after the last `fetch --prune`.
+   * False means the branch is local-only — either never pushed, or its remote
+   * counterpart was deleted (typically after a PR merged + branch cleanup on
+   * GitHub). The UI uses this to offer a "delete local branch" affordance.
+   */
+  hasRemote: boolean;
+  // `isCurrent` removed: under the per-branch workspace model the workspace
+  // IS the current branch — every consumer can derive it as
+  // `branch.name === decodeURIComponent(workspaceId)`. The server-side
+  // `git rev-parse` that used to compute this is no longer needed.
+}
+
+/**
+ * Per-workspace branch sync state. Slimmed down from the legacy
+ * "one workspace, many branches via checkout" model: fields like `isDirty`,
+ * `unpushedCommits`, and `conflicted` are gone because save=share guarantees
+ * the working tree is never dirty, there are no committed-but-unpushed
+ * commits, and conflicts are resolved before lock release. What's left is
+ * the upstream-sync signal that drives the auto-update flow + the branch
+ * name (kept as a server-side cross-check against the URL-derived branch).
+ */
+export interface WorkingTreeStatus {
+  branch: string;
+  // False when the current branch has no configured upstream — typically a
+  // freshly-created local draft that has never been pushed. Drives the
+  // "this draft has never been shared" affordance.
+  hasUpstream: boolean;
+  // True when origin/<branch> has commits this clone hasn't merged in yet —
+  // e.g. a teammate pushed to the same branch from their workspace. The
+  // auto-pull hook + PullNeededBanner key off this; everything else has
+  // gone with the legacy dirty-tree model.
+  unmergedFromUpstream: boolean;
+}
+
+// `WorkingTreeFile` + `WorkingTreeFileStatus` removed: the working tree is
+// never dirty under save=share, so the "list dirty files with their per-file
+// status" surface has no meaningful content.
+
+export interface CommitAttribution {
+  authorName: string;
+  authorEmail: string;
+  sha: string;
+  subject: string;
+  committedAt: string;
+}
+
+export interface ShareChangesRequest {
+  summary: string;
+  description?: string;
+}
+
+export interface ValidationReport {
+  ok: boolean;
+  mustFix: string[];
+  warnings: string[];
+  rawOutput: string;
+}
+
+export interface IGitService {
+  status(workspaceId: string): Promise<WorkingTreeStatus>;
+  listBranches(workspaceId: string, opts?: { freshFetch?: boolean }): Promise<BranchInfo[]>;
+  createBranch(
+    workspaceId: string,
+    name: string,
+    fromBase?: string,
+  ): Promise<BranchInfo>;
+  // No `switchBranch` here on purpose — see the comment in IWorkflowService.
+  // Branch is workspace identity under the per-branch workspace model.
+  /**
+   * Delete a branch. Removes the local ref (if present) AND the origin ref
+   * (if present); both sides go in one call so the picker's "discard draft"
+   * affordance leaves no orphan behind.
+   *
+   * Authorisation: the branch's author OR an admin can delete it. Authorship
+   * is inferred from the `<email-localpart>/...` naming convention — see
+   * `isBranchAuthoredBy`. Admins (per the workspace's `roles.yaml`) can
+   * additionally remove unprefixed CLI-created branches that have no
+   * recognisable author.
+   *
+   * `onlyIfNoRemote: true` is the legacy orphan-cleanup path used after a
+   * PR merge prunes the remote head: it BYPASSES the author/admin check
+   * (callers prune any orphan they encounter) and REFUSES if origin still
+   * has the ref (the safety property the flag has always provided).
+   * Protected branches and the currently-checked-out branch are always
+   * rejected.
+   */
+  deleteBranch(
+    workspaceId: string,
+    name: string,
+    user: AuthUser,
+    opts?: { onlyIfNoRemote?: boolean },
+  ): Promise<void>;
+  // `forkCurrentToDraft` removed: under the per-branch workspace model each
+  // branch is its own workspace by construction, so the "carry uncommitted
+  // edits onto a new draft" escape hatch can't fire. Use `createBranch` +
+  // workspace-bootstrap navigation instead.
+  //
+  // `discardChanges` removed: under save=share the working tree is never
+  // dirty, so there's nothing to discard.
+  commit(
+    workspaceId: string,
+    user: AuthUser,
+    req: ShareChangesRequest,
+  ): Promise<CommitAttribution>;
+  push(workspaceId: string, user: AuthUser): Promise<void>;
+  fetch(workspaceId: string): Promise<void>;
+  pull(workspaceId: string): Promise<void>;
+  diffStat(workspaceId: string, base?: string): Promise<string[]>;
+  /**
+   * Paths in the working tree that the next commit would include — the set
+   * `git add -A` would stage: modified + deleted + renamed + untracked files
+   * (honouring `.gitignore`). Use this for share-dialog previews; for the
+   * committed delta vs a base ref (e.g. PR owner lookup), use `diffStat`.
+   */
+  pendingChanges(workspaceId: string): Promise<string[]>;
+  /**
+   * Best-fit protected branch a feature branch was forked from, resolved by
+   * picking whichever protected branch on origin yields the smallest "ahead"
+   * count. Returns null if no protected branch can be reached.
+   */
+  resolveForkBase(workspaceId: string, branch: string): Promise<string | null>;
+  revertCommit(
+    workspaceId: string,
+    user: AuthUser,
+    sha: string,
+  ): Promise<CommitAttribution>;
+  logForFile(
+    workspaceId: string,
+    relativePath: string,
+    limit?: number,
+  ): Promise<CommitAttribution[]>;
+  diffFileAtCommit(
+    workspaceId: string,
+    relativePath: string,
+    sha: string,
+  ): Promise<string>;
+  /**
+   * Unified diff of a single file between two branches. Both names must
+   * resolve to a known branch on this workspace (local head or
+   * `refs/remotes/origin/<name>`); arbitrary refspecs and SHAs are
+   * rejected upstream. Returns the raw `git diff` output — empty string
+   * when the file is identical on both sides, a unified-diff body
+   * otherwise (including the "new file mode" / "deleted file mode"
+   * headers when the file only exists on one side).
+   *
+   * Read-only: nothing is checked out, fetched, or written.
+   */
+  diffFileBetweenBranches(
+    workspaceId: string,
+    relativePath: string,
+    fromBranch: string,
+    toBranch: string,
+  ): Promise<string>;
+  // `workingStatus` + `diffFileWorking` removed: under save=share the
+  // working tree is never dirty, so listing dirty files / diffing them
+  // against HEAD reports the empty state by definition. Cross-branch
+  // comparison (`diffFileBetweenBranches`) + history (`diffFileAtCommit`)
+  // still cover the meaningful diff cases.
+}

package/src/index.ts

@@ -0,0 +1,23 @@
+// Auth
+export * from './auth/types.js';
+
+// Chat
+export * from './chat/types.js';
+
+// Workspace
+export * from './workspace/types.js';
+export * from './workspace/filename.js';
+export * from './workspace/kb-layout.js';
+export * from './workspace/frontmatter.js';
+
+// Git
+export * from './git/types.js';
+export * from './git/pr.types.js';
+export * from './git/protected.js';
+export * from './git/branchAuthor.js';
+export * from './git/review.types.js';
+
+// Workflow — abstraction layer over git/PR/review-workflow. See PLAN.md.
+export * from './workflow/types.js';
+export * from './workflow/interface.js';
+export * from './workflow/events.js';