@braidhq/server 0.0.1 → 0.1.0

package/dist/policy/Capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Capability.d.ts","sourceRoot":"","sources":["../../src/policy/Capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,sKAsBjB,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/policy/Capability.js

@@ -0,0 +1,31 @@
+/**
+ * Closed enumeration of capability identifiers known to the core
+ * platform. Plugins can register their own checks under custom string
+ * ids; this list is the central catalog so first-party code has a
+ * type-safe handle.
+ *
+ * New capability = add to CAPABILITY_IDS + write a CapabilityCheck
+ * class implementing it. Existing checks don't care about new ids.
+ */
+export const CAPABILITY_IDS = [
+    // Server-scope. No workspace member required; resolveViewer is built
+    // with member=undefined so only admins resolve to effectiveRole='owner'.
+    'workspace.create', // scaffold a new workspace or register a path
+    // Workspace-scope. Each resource has at most one read and one write
+    // capability. "Read" means see, "write" means change anything mutable
+    // in that resource. We deliberately don't split write into submit /
+    // approve / delete sub-verbs. If you can change anything, you can
+    // change everything inside that resource.
+    'workspace.read', // open the workspace, see settings, sources, members, graph, history
+    'workspace.write', // edit PRODUCT.md / sources / plugins / ontology / members / delete
+    'proposal.read', // list and read pending or decided proposals
+    'proposal.write', // submit, apply, reject
+    'clarify.read', // list and read clarify tickets
+    'clarify.write', // answer, skip
+    'history.write', // restore a past commit, manage tags
+    // Skill execution carries a per-(member, skill) override matrix on
+    // top of role default, so it can't be collapsed into a plain
+    // read/write pair. Kept as its own verb for that reason.
+    'skill.run',
+];
+//# sourceMappingURL=Capability.js.map

package/dist/policy/Capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Capability.js","sourceRoot":"","sources":["../../src/policy/Capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,qEAAqE;IACrE,yEAAyE;IACzE,kBAAkB,EAAE,8CAA8C;IAElE,oEAAoE;IACpE,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,0CAA0C;IAC1C,gBAAgB,EAAE,qEAAqE;IACvF,iBAAiB,EAAE,oEAAoE;IACvF,eAAe,EAAE,6CAA6C;IAC9D,gBAAgB,EAAE,wBAAwB;IAC1C,cAAc,EAAE,gCAAgC;IAChD,eAAe,EAAE,eAAe;IAChC,eAAe,EAAE,qCAAqC;IAEtD,mEAAmE;IACnE,6DAA6D;IAC7D,yDAAyD;IACzD,WAAW;CACH,CAAA"}

package/dist/policy/CapabilityCheck.d.ts

@@ -0,0 +1,14 @@
+import type { Capability } from './Capability.js';
+import type { ViewerContext } from './ViewerContext.js';
+/**
+ * Each capability owns its decision logic in a single class. This is
+ * the Strategy interface; concrete checks live under `./checks/`.
+ *
+ * Implementations MUST be pure (no I/O, no time, no rng) so the same
+ * `(viewer)` always produces the same answer.
+ */
+export interface CapabilityCheck {
+    readonly id: Capability;
+    evaluate: (viewer: ViewerContext) => boolean;
+}
+//# sourceMappingURL=CapabilityCheck.d.ts.map

package/dist/policy/CapabilityCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityCheck.d.ts","sourceRoot":"","sources":["../../src/policy/CapabilityCheck.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAA;IACvB,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAA;CAC7C"}

package/dist/policy/CapabilityCheck.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CapabilityCheck.js.map

package/dist/policy/CapabilityCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityCheck.js","sourceRoot":"","sources":["../../src/policy/CapabilityCheck.ts"],"names":[],"mappings":""}

package/dist/policy/PermissionRegistry.d.ts

@@ -0,0 +1,23 @@
+import type { Capability } from './Capability.js';
+import type { CapabilityCheck } from './CapabilityCheck.js';
+import type { ViewerContext } from './ViewerContext.js';
+/**
+ * Open registry of capability strategies. Adding a new capability =
+ * `registry.register(new MyCheck())`; existing checks are untouched.
+ *
+ * Unknown capability ids resolve to `false` (default deny). This makes
+ * it safe to typo a capability id; the call denies instead of
+ * accidentally allowing.
+ */
+export declare class PermissionRegistry {
+    private readonly checks;
+    register(check: CapabilityCheck): this;
+    has(capability: Capability): boolean;
+    /**
+     * Decide whether a viewer can perform a capability. The viewer
+     * already carries its own resource (e.g. skill for skill.run); the
+     * caller is responsible for building the right viewer.
+     */
+    can(capability: Capability, viewer: ViewerContext): boolean;
+}
+//# sourceMappingURL=PermissionRegistry.d.ts.map

package/dist/policy/PermissionRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionRegistry.d.ts","sourceRoot":"","sources":["../../src/policy/PermissionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAKtC,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO;IAIpC;;;;OAIG;IACH,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO;CAG5D"}

package/dist/policy/PermissionRegistry.js

@@ -0,0 +1,27 @@
+/**
+ * Open registry of capability strategies. Adding a new capability =
+ * `registry.register(new MyCheck())`; existing checks are untouched.
+ *
+ * Unknown capability ids resolve to `false` (default deny). This makes
+ * it safe to typo a capability id; the call denies instead of
+ * accidentally allowing.
+ */
+export class PermissionRegistry {
+    checks = new Map();
+    register(check) {
+        this.checks.set(check.id, check);
+        return this;
+    }
+    has(capability) {
+        return this.checks.has(capability);
+    }
+    /**
+     * Decide whether a viewer can perform a capability. The viewer
+     * already carries its own resource (e.g. skill for skill.run); the
+     * caller is responsible for building the right viewer.
+     */
+    can(capability, viewer) {
+        return this.checks.get(capability)?.evaluate(viewer) ?? false;
+    }
+}
+//# sourceMappingURL=PermissionRegistry.js.map

package/dist/policy/PermissionRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionRegistry.js","sourceRoot":"","sources":["../../src/policy/PermissionRegistry.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAA;IAEhE,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,GAAG,CAAC,UAAsB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,UAAsB,EAAE,MAAqB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;IAC/D,CAAC;CACF"}

package/dist/policy/ViewerContext.d.ts

@@ -0,0 +1,27 @@
+import type { SkillFrontmatter, User, WorkspaceMember, WorkspaceRole } from '@braidhq/schema';
+/**
+ * The single resolved-identity object that every capability check
+ * reads. Built once per request by `resolveViewer`; passed unchanged
+ * into the registry.
+ *
+ * `effectiveRole` is what permission gates use: admins always land as
+ * `'owner'` here, regardless of whether they have an explicit member
+ * row. `member` is the stored row when present (used for display +
+ * skillOverrides lookup) and is independent of effectiveRole. Admin
+ * who joined as Guest has member.role='guest' but effectiveRole='owner'.
+ *
+ * `resource` is the per-action context the check needs:
+ *   - skill.run uses `skill` (manifest) + `skillId`
+ *   - future checks can extend this without breaking siblings
+ */
+export interface ViewerContext {
+    readonly user: User;
+    readonly member: WorkspaceMember | undefined;
+    readonly effectiveRole: WorkspaceRole | null;
+    readonly resource?: ViewerResource | undefined;
+}
+export interface ViewerResource {
+    readonly skill?: SkillFrontmatter;
+    readonly skillId?: string;
+}
+//# sourceMappingURL=ViewerContext.d.ts.map

package/dist/policy/ViewerContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ViewerContext.d.ts","sourceRoot":"","sources":["../../src/policy/ViewerContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE7F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B"}

package/dist/policy/ViewerContext.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ViewerContext.js.map

package/dist/policy/ViewerContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ViewerContext.js","sourceRoot":"","sources":["../../src/policy/ViewerContext.ts"],"names":[],"mappings":""}

package/dist/policy/checks.d.ts

@@ -0,0 +1,15 @@
+import type { CapabilityCheck } from './CapabilityCheck.js';
+/**
+ * First-party capability checks, mirrored byte-equivalent in
+ * `packages/studio/src/policy/checks.ts`. The server is the
+ * authoritative gate; the client copy lets Studio render Locked-style
+ * affordances without hitting a 403.
+ *
+ * Workspace-scope verbs collapse to `read` + `write` per resource.
+ * Workspace.create is server-scope (resolveViewer with no member).
+ * Skill.run keeps its own verb because its three-step resolution
+ * (owner short-circuit, per-member override, manifest allowedRoles)
+ * doesn't fit a read/write pair.
+ */
+export declare const checks: readonly CapabilityCheck[];
+//# sourceMappingURL=checks.d.ts.map

package/dist/policy/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/policy/checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,EAAE,SAAS,eAAe,EAsC5C,CAAA"}

package/dist/policy/checks.js

@@ -0,0 +1,52 @@
+/**
+ * First-party capability checks, mirrored byte-equivalent in
+ * `packages/studio/src/policy/checks.ts`. The server is the
+ * authoritative gate; the client copy lets Studio render Locked-style
+ * affordances without hitting a 403.
+ *
+ * Workspace-scope verbs collapse to `read` + `write` per resource.
+ * Workspace.create is server-scope (resolveViewer with no member).
+ * Skill.run keeps its own verb because its three-step resolution
+ * (owner short-circuit, per-member override, manifest allowedRoles)
+ * doesn't fit a read/write pair.
+ */
+export const checks = [
+    { id: 'workspace.create', evaluate: v => v.effectiveRole === 'owner' },
+    { id: 'workspace.read', evaluate: v => v.effectiveRole !== null },
+    { id: 'workspace.write', evaluate: v => v.effectiveRole === 'owner' },
+    {
+        id: 'proposal.read',
+        evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
+    },
+    {
+        id: 'proposal.write',
+        evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
+    },
+    {
+        id: 'clarify.read',
+        evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
+    },
+    {
+        id: 'clarify.write',
+        evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
+    },
+    { id: 'history.write', evaluate: v => v.effectiveRole === 'owner' },
+    {
+        id: 'skill.run',
+        evaluate: (v) => {
+            const skill = v.resource?.skill;
+            const skillId = v.resource?.skillId;
+            if (!skill || !skillId)
+                return false;
+            if (v.effectiveRole === null)
+                return false;
+            if (v.effectiveRole === 'owner')
+                return true;
+            const override = v.member?.skillOverrides?.[skillId];
+            if (override)
+                return override === 'allow';
+            return skill.braid.allowedRoles.includes(v.effectiveRole);
+        },
+    },
+];
+//# sourceMappingURL=checks.js.map

package/dist/policy/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/policy/checks.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,MAAM,GAA+B;IAChD,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACtE,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE;IACjE,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACrE;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACnE;QACE,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAA;YAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAA;YACnC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBACpB,OAAO,KAAK,CAAA;YACd,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI;gBAC1B,OAAO,KAAK,CAAA;YACd,IAAI,CAAC,CAAC,aAAa,KAAK,OAAO;gBAC7B,OAAO,IAAI,CAAA;YACb,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,OAA+C,CAAC,CAAA;YAC5F,IAAI,QAAQ;gBACV,OAAO,QAAQ,KAAK,OAAO,CAAA;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;QAC3D,CAAC;KACF;CACF,CAAA"}

package/dist/policy/defaultRegistry.d.ts

@@ -0,0 +1,10 @@
+import { PermissionRegistry } from './PermissionRegistry.js';
+/**
+ * Default registry preloaded with the platform's first-party
+ * capabilities. Plugins that want to register their own checks should
+ * call `register()` on this instance; tests can build a fresh registry
+ * via `new PermissionRegistry()` to inject mocks.
+ */
+export declare function buildDefaultPermissionRegistry(): PermissionRegistry;
+export declare const defaultPermissionRegistry: PermissionRegistry;
+//# sourceMappingURL=defaultRegistry.d.ts.map

package/dist/policy/defaultRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultRegistry.d.ts","sourceRoot":"","sources":["../../src/policy/defaultRegistry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;;GAKG;AACH,wBAAgB,8BAA8B,IAAI,kBAAkB,CAKnE;AAED,eAAO,MAAM,yBAAyB,oBAAmC,CAAA"}

package/dist/policy/defaultRegistry.js

@@ -0,0 +1,16 @@
+import { checks } from './checks.js';
+import { PermissionRegistry } from './PermissionRegistry.js';
+/**
+ * Default registry preloaded with the platform's first-party
+ * capabilities. Plugins that want to register their own checks should
+ * call `register()` on this instance; tests can build a fresh registry
+ * via `new PermissionRegistry()` to inject mocks.
+ */
+export function buildDefaultPermissionRegistry() {
+    const registry = new PermissionRegistry();
+    for (const check of checks)
+        registry.register(check);
+    return registry;
+}
+export const defaultPermissionRegistry = buildDefaultPermissionRegistry();
+//# sourceMappingURL=defaultRegistry.js.map

package/dist/policy/defaultRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultRegistry.js","sourceRoot":"","sources":["../../src/policy/defaultRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM;QACxB,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC1B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,EAAE,CAAA"}

package/dist/policy/index.d.ts

@@ -0,0 +1,8 @@
+export type { Capability } from './Capability.js';
+export { CAPABILITY_IDS } from './Capability.js';
+export type { CapabilityCheck } from './CapabilityCheck.js';
+export { buildDefaultPermissionRegistry, defaultPermissionRegistry } from './defaultRegistry.js';
+export { PermissionRegistry } from './PermissionRegistry.js';
+export { resolveViewer } from './resolveViewer.js';
+export type { ViewerContext, ViewerResource } from './ViewerContext.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/policy/index.js

@@ -0,0 +1,5 @@
+export { CAPABILITY_IDS } from './Capability.js';
+export { buildDefaultPermissionRegistry, defaultPermissionRegistry } from './defaultRegistry.js';
+export { PermissionRegistry } from './PermissionRegistry.js';
+export { resolveViewer } from './resolveViewer.js';
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/policy/resolveViewer.d.ts

@@ -0,0 +1,16 @@
+import type { User, WorkspaceMember } from '@braidhq/schema';
+import type { ViewerContext, ViewerResource } from './ViewerContext.js';
+/**
+ * The sole place server-admin promotion happens. Every other layer
+ * (middleware, capability checks, Studio mirror) consumes the resulting
+ * `effectiveRole` and never re-derives it.
+ *
+ * Resolution:
+ *   1. user.serverRole === 'admin'  → effectiveRole = 'owner'
+ *      (the stored member.role, if any, is kept on `member` for
+ *      display, but ignored by gates)
+ *   2. member present                → effectiveRole = member.role
+ *   3. otherwise                     → effectiveRole = null (no access)
+ */
+export declare function resolveViewer(user: User, member: WorkspaceMember | undefined, resource?: ViewerResource): ViewerContext;
+//# sourceMappingURL=resolveViewer.d.ts.map

package/dist/policy/resolveViewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveViewer.d.ts","sourceRoot":"","sources":["../../src/policy/resolveViewer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEvE;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,QAAQ,CAAC,EAAE,cAAc,GACxB,aAAa,CAuBf"}

package/dist/policy/resolveViewer.js

@@ -0,0 +1,37 @@
+/**
+ * The sole place server-admin promotion happens. Every other layer
+ * (middleware, capability checks, Studio mirror) consumes the resulting
+ * `effectiveRole` and never re-derives it.
+ *
+ * Resolution:
+ *   1. user.serverRole === 'admin'  → effectiveRole = 'owner'
+ *      (the stored member.role, if any, is kept on `member` for
+ *      display, but ignored by gates)
+ *   2. member present                → effectiveRole = member.role
+ *   3. otherwise                     → effectiveRole = null (no access)
+ */
+export function resolveViewer(user, member, resource) {
+    if (user.serverRole === 'admin') {
+        return {
+            user,
+            member,
+            effectiveRole: 'owner',
+            ...(resource ? { resource } : {}),
+        };
+    }
+    if (member) {
+        return {
+            user,
+            member,
+            effectiveRole: member.role,
+            ...(resource ? { resource } : {}),
+        };
+    }
+    return {
+        user,
+        member: undefined,
+        effectiveRole: null,
+        ...(resource ? { resource } : {}),
+    };
+}
+//# sourceMappingURL=resolveViewer.js.map

package/dist/policy/resolveViewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveViewer.js","sourceRoot":"","sources":["../../src/policy/resolveViewer.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAU,EACV,MAAmC,EACnC,QAAyB;IAEzB,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO;YACL,IAAI;YACJ,MAAM;YACN,aAAa,EAAE,OAAO;YACtB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAA;IACH,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI;YACJ,MAAM;YACN,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAA;IACH,CAAC;IACD,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,SAAS;QACjB,aAAa,EAAE,IAAI;QACnB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC"}

package/dist/routes/_shared.d.ts

@@ -0,0 +1,198 @@
+import { z } from '@hono/zod-openapi';
+export declare const WorkspaceIdParam: z.ZodObject<{
+    workspaceId: z.ZodBranded<z.ZodString, "WorkspaceId">;
+}, "strip", z.ZodTypeAny, {
+    workspaceId: string & z.BRAND<"WorkspaceId">;
+}, {
+    workspaceId: string;
+}>;
+export declare const ProblemJsonResponseContent: {
+    'application/problem+json': {
+        schema: z.ZodObject<{
+            type: z.ZodString;
+            title: z.ZodString;
+            status: z.ZodNumber;
+            code: z.ZodString;
+            detail: z.ZodOptional<z.ZodString>;
+            issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                code: z.ZodBranded<z.ZodString, "ValidationCode">;
+                severity: z.ZodEnum<["error", "warning", "info"]>;
+                message: z.ZodString;
+                nodeId: z.ZodOptional<z.ZodBranded<z.ZodString, "NodeId">>;
+                edgeId: z.ZodOptional<z.ZodBranded<z.ZodString, "EdgeId">>;
+                path: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                code: string & z.BRAND<"ValidationCode">;
+                message: string;
+                severity: "error" | "warning" | "info";
+                path?: string | undefined;
+                nodeId?: (string & z.BRAND<"NodeId">) | undefined;
+                edgeId?: (string & z.BRAND<"EdgeId">) | undefined;
+            }, {
+                code: string;
+                message: string;
+                severity: "error" | "warning" | "info";
+                path?: string | undefined;
+                nodeId?: string | undefined;
+                edgeId?: string | undefined;
+            }>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            code: string;
+            type: string;
+            title: string;
+            status: number;
+            issues?: {
+                code: string & z.BRAND<"ValidationCode">;
+                message: string;
+                severity: "error" | "warning" | "info";
+                path?: string | undefined;
+                nodeId?: (string & z.BRAND<"NodeId">) | undefined;
+                edgeId?: (string & z.BRAND<"EdgeId">) | undefined;
+            }[] | undefined;
+            detail?: string | undefined;
+        }, {
+            code: string;
+            type: string;
+            title: string;
+            status: number;
+            issues?: {
+                code: string;
+                message: string;
+                severity: "error" | "warning" | "info";
+                path?: string | undefined;
+                nodeId?: string | undefined;
+                edgeId?: string | undefined;
+            }[] | undefined;
+            detail?: string | undefined;
+        }>;
+    };
+};
+export declare const NotFoundResponse: {
+    readonly description: "The requested entity does not exist.";
+    readonly content: {
+        'application/problem+json': {
+            schema: z.ZodObject<{
+                type: z.ZodString;
+                title: z.ZodString;
+                status: z.ZodNumber;
+                code: z.ZodString;
+                detail: z.ZodOptional<z.ZodString>;
+                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    code: z.ZodBranded<z.ZodString, "ValidationCode">;
+                    severity: z.ZodEnum<["error", "warning", "info"]>;
+                    message: z.ZodString;
+                    nodeId: z.ZodOptional<z.ZodBranded<z.ZodString, "NodeId">>;
+                    edgeId: z.ZodOptional<z.ZodBranded<z.ZodString, "EdgeId">>;
+                    path: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    code: string & z.BRAND<"ValidationCode">;
+                    message: string;
+                    severity: "error" | "warning" | "info";
+                    path?: string | undefined;
+                    nodeId?: (string & z.BRAND<"NodeId">) | undefined;
+                    edgeId?: (string & z.BRAND<"EdgeId">) | undefined;
+                }, {
+                    code: string;
+                    message: string;
+                    severity: "error" | "warning" | "info";
+                    path?: string | undefined;
+                    nodeId?: string | undefined;
+                    edgeId?: string | undefined;
+                }>, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                code: string;
+                type: string;
+                title: string;
+                status: number;
+                issues?: {
+                    code: string & z.BRAND<"ValidationCode">;
+                    message: string;
+                    severity: "error" | "warning" | "info";
+                    path?: string | undefined;
+                    nodeId?: (string & z.BRAND<"NodeId">) | undefined;
+                    edgeId?: (string & z.BRAND<"EdgeId">) | undefined;
+                }[] | undefined;
+                detail?: string | undefined;
+            }, {
+                code: string;
+                type: string;
+                title: string;
+                status: number;
+                issues?: {
+                    code: string;
+                    message: string;
+                    severity: "error" | "warning" | "info";
+                    path?: string | undefined;
+                    nodeId?: string | undefined;
+                    edgeId?: string | undefined;
+                }[] | undefined;
+                detail?: string | undefined;
+            }>;
+        };
+    };
+};
+export declare const ValidationFailureResponse: {
+    readonly description: "Request body or query failed validation.";
+    readonly content: {
+        'application/problem+json': {
+            schema: z.ZodObject<{
+                type: z.ZodString;
+                title: z.ZodString;
+                status: z.ZodNumber;
+                code: z.ZodString;
+                detail: z.ZodOptional<z.ZodString>;
+                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    code: z.ZodBranded<z.ZodString, "ValidationCode">;
+                    severity: z.ZodEnum<["error", "warning", "info"]>;
+                    message: z.ZodString;
+                    nodeId: z.ZodOptional<z.ZodBranded<z.ZodString, "NodeId">>;
+                    edgeId: z.ZodOptional<z.ZodBranded<z.ZodString, "EdgeId">>;
+                    path: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    code: string & z.BRAND<"ValidationCode">;
+                    message: string;
+                    severity: "error" | "warning" | "info";
+                    path?: string | undefined;
+                    nodeId?: (string & z.BRAND<"NodeId">) | undefined;
+                    edgeId?: (string & z.BRAND<"EdgeId">) | undefined;
+                }, {
+                    code: string;
+                    message: string;
+                    severity: "error" | "warning" | "info";
+                    path?: string | undefined;
+                    nodeId?: string | undefined;
+                    edgeId?: string | undefined;
+                }>, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                code: string;
+                type: string;
+                title: string;
+                status: number;
+                issues?: {
+                    code: string & z.BRAND<"ValidationCode">;
+                    message: string;
+                    severity: "error" | "warning" | "info";
+                    path?: string | undefined;
+                    nodeId?: (string & z.BRAND<"NodeId">) | undefined;
+                    edgeId?: (string & z.BRAND<"EdgeId">) | undefined;
+                }[] | undefined;
+                detail?: string | undefined;
+            }, {
+                code: string;
+                type: string;
+                title: string;
+                status: number;
+                issues?: {
+                    code: string;
+                    message: string;
+                    severity: "error" | "warning" | "info";
+                    path?: string | undefined;
+                    nodeId?: string | undefined;
+                    edgeId?: string | undefined;
+                }[] | undefined;
+                detail?: string | undefined;
+            }>;
+        };
+    };
+};
+//# sourceMappingURL=_shared.d.ts.map

package/dist/routes/_shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_shared.d.ts","sourceRoot":"","sources":["../../src/routes/_shared.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAErC,eAAO,MAAM,gBAAgB;;;;;;EAK3B,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAEtC,CAAA;AAED,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGnB,CAAA;AAEV,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAG5B,CAAA"}

package/dist/routes/_shared.js

@@ -0,0 +1,29 @@
+/**
+ * Shared OpenAPI building blocks used across workspace-scoped routes.
+ *
+ * Path parameters declared on parent app.route() mounts are NOT
+ * automatically merged into child routes' OpenAPI definitions. Each
+ * route under `/workspaces/:workspaceId/*` must therefore re-declare
+ * `workspaceId` in its `request.params`. Use `WorkspaceIdParam` to
+ * keep the declaration consistent.
+ */
+import { BraidProblemJson, WorkspaceId } from '@braidhq/schema';
+import { z } from '@hono/zod-openapi';
+export const WorkspaceIdParam = z.object({
+    workspaceId: WorkspaceId.openapi({
+        param: { name: 'workspaceId', in: 'path' },
+        example: 'my-workspace',
+    }),
+});
+export const ProblemJsonResponseContent = {
+    'application/problem+json': { schema: BraidProblemJson },
+};
+export const NotFoundResponse = {
+    description: 'The requested entity does not exist.',
+    content: ProblemJsonResponseContent,
+};
+export const ValidationFailureResponse = {
+    description: 'Request body or query failed validation.',
+    content: ProblemJsonResponseContent,
+};
+//# sourceMappingURL=_shared.js.map

package/dist/routes/_shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_shared.js","sourceRoot":"","sources":["../../src/routes/_shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAErC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE;QAC1C,OAAO,EAAE,cAAc;KACxB,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,0BAA0B,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;CACzD,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,sCAAsC;IACnD,OAAO,EAAE,0BAA0B;CAC3B,CAAA;AAEV,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,WAAW,EAAE,0CAA0C;IACvD,OAAO,EAAE,0BAA0B;CAC3B,CAAA"}

package/dist/routes/admin.d.ts

@@ -0,0 +1,13 @@
+import type { WorkspaceService } from '@braidhq/core';
+import type { AccessPolicy } from '../infrastructure/auth/AccessPolicy.js';
+import type { WorkspaceRegistryFile } from '../infrastructure/fs/WorkspaceRegistryFile.js';
+import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
+import { OpenAPIHono } from '@hono/zod-openapi';
+export interface AdminRouterDeps {
+    userRegistry: UserRegistryFile;
+    accessPolicy: AccessPolicy;
+    workspaceRegistry: WorkspaceRegistryFile;
+    workspaceService: WorkspaceService;
+}
+export declare function createAdminRouter(deps: AdminRouterDeps): OpenAPIHono;
+//# sourceMappingURL=admin.d.ts.map

package/dist/routes/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAA;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AAGnF,OAAO,EAAe,WAAW,EAAK,MAAM,mBAAmB,CAAA;AA6C/D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,gBAAgB,CAAA;IAC9B,YAAY,EAAE,YAAY,CAAA;IAC1B,iBAAiB,EAAE,qBAAqB,CAAA;IACxC,gBAAgB,EAAE,gBAAgB,CAAA;CACnC;AAqHD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CA0FpE"}