@braidhq/server 0.0.1 → 0.1.0

package/dist/routes/skills.js

@@ -1,39 +1,109 @@
-import { SkillId as SkillIdSchema } from '@braidhq/schema';
-import { zValidator } from '@hono/zod-validator';
-import { Hono } from 'hono';
-import { z } from 'zod';
+import { SkillId as SkillIdSchema, SkillManifest, SkillRunId } from '@braidhq/schema';
+import { createRoute, OpenAPIHono, z } from '@hono/zod-openapi';
+import { extractBearerToken } from '../middleware/auth.js';
+import { requirePermission } from '../middleware/workspaceAccess.js';
 import { getWorkspaceId } from '../middleware/workspaceId.js';
+import { NotFoundResponse, WorkspaceIdParam } from './_shared.js';
 import { loadWorkspaceById } from './helpers.js';
-const RunBodySchema = z.object({
+const RunBody = z.object({
     args: z.string().default(''),
     /** Continue an existing claude conversation (from a prior session-started event). */
     resumeSessionId: z.string().min(1).optional(),
+}).openapi('SkillRunBody');
+const SkillIdParam = WorkspaceIdParam.extend({
+    skillId: SkillIdSchema.openapi({ param: { name: 'skillId', in: 'path' } }),
+});
+const SkillListResponse = z.object({
+    items: z.array(SkillManifest),
+}).openapi('SkillListResponse');
+const RunCreatedResponse = z.object({
+    runId: SkillRunId,
+}).openapi('RunCreatedResponse');
+const listSkillsRoute = createRoute({
+    method: 'get',
+    path: '/',
+    operationId: 'listSkills',
+    summary: 'List skills available in a workspace (builtin + plugin + workspace + extension overlays).',
+    tags: ['skills'],
+    request: { params: WorkspaceIdParam },
+    responses: {
+        200: {
+            description: 'The skill list.',
+            content: { 'application/json': { schema: SkillListResponse } },
+        },
+    },
+});
+const getSkillRoute = createRoute({
+    method: 'get',
+    path: '/{skillId}',
+    operationId: 'getSkill',
+    summary: 'Fetch a single skill manifest by id.',
+    tags: ['skills'],
+    request: { params: SkillIdParam },
+    responses: {
+        200: {
+            description: 'The skill manifest.',
+            content: { 'application/json': { schema: SkillManifest } },
+        },
+        404: NotFoundResponse,
+    },
+});
+const runSkillRoute = createRoute({
+    method: 'post',
+    path: '/{skillId}/run',
+    operationId: 'runSkill',
+    summary: 'Fire-and-forget run of a skill. Returns the runId to subscribe to via SSE.',
+    description: 'The subprocess + event drain runs in the background; events are persisted to JSONL and broadcast to subscribers regardless of whether the client stays connected. Tail progress via GET /workspaces/{workspaceId}/runs/{runId}/events.',
+    tags: ['skills'],
+    request: {
+        params: SkillIdParam,
+        body: { content: { 'application/json': { schema: RunBody } } },
+    },
+    responses: {
+        202: {
+            description: 'The accepted run id.',
+            content: { 'application/json': { schema: RunCreatedResponse } },
+        },
+        403: {
+            description: 'Caller is not permitted to run this skill in this workspace.',
+            content: { 'application/problem+json': { schema: z.object({}).passthrough() } },
+        },
+        404: NotFoundResponse,
+    },
 });
 export function createSkillsRouter(deps) {
-    const router = new Hono();
-    router.get('/', async (context) => {
+    const router = new OpenAPIHono();
+    // skill.run is the only capability that needs a per-request resource
+    // (the skill manifest). The resource builder fetches the workspace +
+    // manifest once and hands the result to the policy check.
+    router.use('/:skillId/run', requirePermission('skill.run', async (context) => {
+        const workspace = await loadWorkspaceById(getWorkspaceId(context), deps.workspaceRepository);
+        const skillId = SkillIdSchema.parse(context.req.param('skillId'));
+        const manifest = await deps.skillRegistry.get(workspace, skillId);
+        return { skill: manifest.toData().frontmatter, skillId };
+    }));
+    router.openapi(listSkillsRoute, async (context) => {
         const workspace = await loadWorkspaceById(getWorkspaceId(context), deps.workspaceRepository);
         const manifests = await deps.skillRegistry.list(workspace);
         return context.json({
             items: manifests.map(manifest => manifest.toData()),
-        });
+        }, 200);
     });
-    router.get('/:skillId', async (context) => {
+    router.openapi(getSkillRoute, async (context) => {
         const workspace = await loadWorkspaceById(getWorkspaceId(context), deps.workspaceRepository);
-        const skillId = SkillIdSchema.parse(context.req.param('skillId'));
+        const { skillId } = context.req.valid('param');
         const manifest = await deps.skillRegistry.get(workspace, skillId);
-        return context.json(manifest.toData());
+        return context.json(manifest.toData(), 200);
     });
-    // Fire-and-forget run. The subprocess + event drain runs in the background;
-    // events are persisted to JSONL and broadcast to subscribers regardless of
-    // whether the client stays connected. The client tails progress via
-    // `GET /workspaces/:ws/runs/:runId/events`, which can be opened and closed
-    // freely without affecting the run.
-    router.post('/:skillId/run', zValidator('json', RunBodySchema), async (context) => {
+    router.openapi(runSkillRoute, async (context) => {
         const workspace = await loadWorkspaceById(getWorkspaceId(context), deps.workspaceRepository);
-        const skillId = SkillIdSchema.parse(context.req.param('skillId'));
+        const { skillId } = context.req.valid('param');
         const { args, resumeSessionId } = context.req.valid('json');
-        const options = resumeSessionId ? { resumeSessionId } : undefined;
+        const callerToken = extractBearerToken(context);
+        const options = {
+            ...(resumeSessionId ? { resumeSessionId } : {}),
+            ...(callerToken ? { callerToken } : {}),
+        };
         const runId = await deps.skillRunner.start(workspace, skillId, args, options);
         return context.json({ runId }, 202);
     });

package/dist/routes/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/routes/skills.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5B,qFAAqF;IACrF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAA;AAQF,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IAEzB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC5F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1D,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;SACpD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC5F,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACjE,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,2EAA2E;IAC3E,oEAAoE;IACpE,2EAA2E;IAC3E,oCAAoC;IACpC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC5F,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACjE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,OAAkB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACxF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/routes/skills.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACrF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5B,qFAAqF;IACrF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;AAE1B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CAC3E,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CAC9B,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;AAE/B,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,UAAU;CAClB,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;AAQhC,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,2FAA2F;IACpG,IAAI,EAAE,CAAC,QAAQ,CAAC;IAChB,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACrC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,iBAAiB;YAC9B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE;SAC/D;KACF;CACF,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,WAAW,CAAC;IAChC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,UAAU;IACvB,OAAO,EAAE,sCAAsC;IAC/C,IAAI,EAAE,CAAC,QAAQ,CAAC;IAChB,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;IACjC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;SAC3D;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,WAAW,CAAC;IAChC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,UAAU;IACvB,OAAO,EAAE,4EAA4E;IACrF,WAAW,EAAE,wOAAwO;IACrP,IAAI,EAAE,CAAC,QAAQ,CAAC;IAChB,OAAO,EAAE;QACP,MAAM,EAAE,YAAY;QACpB,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;KAC/D;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,sBAAsB;YACnC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE;SAChE;QACD,GAAG,EAAE;YACH,WAAW,EAAE,8DAA8D;YAC3E,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE;SAChF;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,qEAAqE;IACrE,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3E,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC5F,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACjE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,CAAA;IAC1D,CAAC,CAAC,CAAC,CAAA;IAEH,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC5F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1D,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;SACpD,EAAE,GAAG,CAAC,CAAA;IACT,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC5F,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACjE,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC5F,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC3D,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAA;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC7E,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/sourceLoaders.d.ts

@@ -0,0 +1,7 @@
+import type { PluginRegistry } from '@braidhq/core';
+import { OpenAPIHono } from '@hono/zod-openapi';
+export interface SourceLoadersRouterDeps {
+    pluginRegistry: PluginRegistry;
+}
+export declare function createSourceLoadersRouter(deps: SourceLoadersRouterDeps): OpenAPIHono;
+//# sourceMappingURL=sourceLoaders.d.ts.map

package/dist/routes/sourceLoaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceLoaders.d.ts","sourceRoot":"","sources":["../../src/routes/sourceLoaders.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,EAAe,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE5D,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,cAAc,CAAA;CAC/B;AAiBD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,WAAW,CAapF"}

package/dist/routes/sourceLoaders.js

@@ -0,0 +1,29 @@
+import { ListSourceLoadersResponse } from '@braidhq/schema';
+import { createRoute, OpenAPIHono } from '@hono/zod-openapi';
+const listSourceLoadersRoute = createRoute({
+    method: 'get',
+    path: '/',
+    operationId: 'listSourceLoaders',
+    summary: 'List source-loader plugins registered on this server.',
+    description: 'Studio uses this to populate its loader dropdown without hardcoding `git / github / gdrive`. The list reflects what `composeFsApp` registered plus any `extraSourceLoaderPlugins` the caller passed in. The `manual` choice in the Studio UI is not a plugin and is not returned here.',
+    tags: ['plugins'],
+    responses: {
+        200: {
+            description: 'Source-loader plugins currently registered.',
+            content: { 'application/json': { schema: ListSourceLoadersResponse } },
+        },
+    },
+});
+export function createSourceLoadersRouter(deps) {
+    const router = new OpenAPIHono();
+    router.openapi(listSourceLoadersRoute, (context) => {
+        const plugins = deps.pluginRegistry.sourceLoaders();
+        const loaders = plugins.map(plugin => ({
+            kind: plugin.kind,
+            pluginId: plugin.id,
+        }));
+        return context.json(ListSourceLoadersResponse.parse({ loaders }), 200);
+    });
+    return router;
+}
+//# sourceMappingURL=sourceLoaders.js.map

package/dist/routes/sourceLoaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceLoaders.js","sourceRoot":"","sources":["../../src/routes/sourceLoaders.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAM5D,MAAM,sBAAsB,GAAG,WAAW,CAAC;IACzC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,mBAAmB;IAChC,OAAO,EAAE,uDAAuD;IAChE,WAAW,EAAE,wRAAwR;IACrS,IAAI,EAAE,CAAC,SAAS,CAAC;IACjB,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE;SACvE;KACF;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,yBAAyB,CAAC,IAA6B;IACrE,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,OAAO,EAAE,EAAE;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAA;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,EAAE;SACpB,CAAC,CAAC,CAAA;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/sourceUnitStates.d.ts

@@ -0,0 +1,7 @@
+import type { SourceUnitStateService } from '@braidhq/core';
+import { OpenAPIHono } from '@hono/zod-openapi';
+export interface SourceUnitStatesRouterDeps {
+    sourceUnitStateService: SourceUnitStateService;
+}
+export declare function createSourceUnitStatesRouter(deps: SourceUnitStatesRouterDeps): OpenAPIHono;
+//# sourceMappingURL=sourceUnitStates.d.ts.map

package/dist/routes/sourceUnitStates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceUnitStates.d.ts","sourceRoot":"","sources":["../../src/routes/sourceUnitStates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAE3D,OAAO,EAAe,WAAW,EAAK,MAAM,mBAAmB,CAAA;AAY/D,MAAM,WAAW,0BAA0B;IACzC,sBAAsB,EAAE,sBAAsB,CAAA;CAC/C;AAyBD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B,GAAG,WAAW,CAa1F"}

package/dist/routes/sourceUnitStates.js

@@ -0,0 +1,45 @@
+import { SourceId, SourceUnitState } from '@braidhq/schema';
+import { createRoute, OpenAPIHono, z } from '@hono/zod-openapi';
+import { getWorkspaceId } from '../middleware/workspaceId.js';
+import { ValidationFailureResponse, WorkspaceIdParam } from './_shared.js';
+const ListQuery = z.object({
+    sourceId: SourceId.optional().openapi({ description: 'Restrict to one source.' }),
+});
+const ListResponse = z.object({
+    items: z.array(SourceUnitState),
+}).openapi('SourceUnitStateListResponse');
+const listRoute = createRoute({
+    method: 'get',
+    path: '/',
+    operationId: 'listSourceUnitStates',
+    summary: 'List recorded observations per source unit for a workspace.',
+    description: 'Returns the framework\'s current view of each source unit '
+        + 'last seen by an extract run. One entry per (sourceId, path). Used '
+        + 'by Studio to display per-unit freshness and by Reactor to compute '
+        + 'what needs re-extraction.',
+    tags: ['source-unit-states'],
+    request: {
+        params: WorkspaceIdParam,
+        query: ListQuery,
+    },
+    responses: {
+        200: {
+            description: 'The recorded observations.',
+            content: { 'application/json': { schema: ListResponse } },
+        },
+        400: ValidationFailureResponse,
+    },
+});
+export function createSourceUnitStatesRouter(deps) {
+    const router = new OpenAPIHono();
+    router.openapi(listRoute, async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const { sourceId } = context.req.valid('query');
+        const items = sourceId
+            ? await deps.sourceUnitStateService.listBySource(workspaceId, sourceId)
+            : await deps.sourceUnitStateService.listByWorkspace(workspaceId);
+        return context.json({ items: [...items] }, 200);
+    });
+    return router;
+}
+//# sourceMappingURL=sourceUnitStates.js.map

package/dist/routes/sourceUnitStates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceUnitStates.js","sourceRoot":"","sources":["../../src/routes/sourceUnitStates.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE1E,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;CAClF,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CAChC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;AAMzC,MAAM,SAAS,GAAG,WAAW,CAAC;IAC5B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,6DAA6D;IACtE,WAAW,EAAE,4DAA4D;UACrE,oEAAoE;UACpE,oEAAoE;UACpE,2BAA2B;IAC/B,IAAI,EAAE,CAAC,oBAAoB,CAAC;IAC5B,OAAO,EAAE;QACP,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,SAAS;KACjB;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,4BAA4B;YACzC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;SAC1D;QACD,GAAG,EAAE,yBAAyB;KAC/B;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,4BAA4B,CAAC,IAAgC;IAC3E,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1C,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,QAAQ;YACpB,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC;YACvE,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;QAClE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/users.d.ts

@@ -0,0 +1,9 @@
+import type { Clock } from '@braidhq/core';
+import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
+import { OpenAPIHono } from '@hono/zod-openapi';
+export interface UsersRouterDeps {
+    userRegistry: UserRegistryFile;
+    clock: Clock;
+}
+export declare function createUsersRouter(deps: UsersRouterDeps): OpenAPIHono;
+//# sourceMappingURL=users.d.ts.map

package/dist/routes/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AAGnF,OAAO,EAAe,WAAW,EAAK,MAAM,mBAAmB,CAAA;AAY/D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,gBAAgB,CAAA;IAC9B,KAAK,EAAE,KAAK,CAAA;CACb;AAoFD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CA2CpE"}

package/dist/routes/users.js

@@ -0,0 +1,127 @@
+import { newUserId, NotFoundError } from '@braidhq/core';
+import { User, UserDraft, UserId, UserPatch } from '@braidhq/schema';
+import { createRoute, OpenAPIHono, z } from '@hono/zod-openapi';
+import { getUserId } from '../middleware/userId.js';
+import { NotFoundResponse, ValidationFailureResponse } from './_shared.js';
+const UserIdParam = z.object({
+    userId: UserId.openapi({ param: { name: 'userId', in: 'path' } }),
+});
+const UserListResponse = z.object({
+    items: z.array(User),
+}).openapi('UserListResponse');
+const listUsersRoute = createRoute({
+    method: 'get',
+    path: '/',
+    operationId: 'listUsers',
+    summary: 'List all users on this server.',
+    tags: ['users'],
+    responses: {
+        200: {
+            description: 'A list of users.',
+            content: { 'application/json': { schema: UserListResponse } },
+        },
+    },
+});
+const getMeRoute = createRoute({
+    method: 'get',
+    path: '/me',
+    operationId: 'getMe',
+    summary: 'Return the user identified by the current request context.',
+    tags: ['users'],
+    responses: {
+        200: {
+            description: 'The current user.',
+            content: { 'application/json': { schema: User } },
+        },
+        404: NotFoundResponse,
+    },
+});
+const getUserRoute = createRoute({
+    method: 'get',
+    path: '/{userId}',
+    operationId: 'getUser',
+    summary: 'Fetch a single user by id.',
+    tags: ['users'],
+    request: { params: UserIdParam },
+    responses: {
+        200: {
+            description: 'The requested user.',
+            content: { 'application/json': { schema: User } },
+        },
+        404: NotFoundResponse,
+    },
+});
+const createUserRoute = createRoute({
+    method: 'post',
+    path: '/',
+    operationId: 'createUser',
+    summary: 'Create a user. Phase A: any caller; Phase B/C will gate by Admin role.',
+    tags: ['users'],
+    request: {
+        body: { content: { 'application/json': { schema: UserDraft } } },
+    },
+    responses: {
+        201: {
+            description: 'The created user.',
+            content: { 'application/json': { schema: User } },
+        },
+        400: ValidationFailureResponse,
+    },
+});
+const updateUserRoute = createRoute({
+    method: 'patch',
+    path: '/{userId}',
+    operationId: 'updateUser',
+    summary: 'Patch a user record. Phase A: any caller; Phase B/C will gate by Admin role.',
+    tags: ['users'],
+    request: {
+        params: UserIdParam,
+        body: { content: { 'application/json': { schema: UserPatch } } },
+    },
+    responses: {
+        200: {
+            description: 'The updated user.',
+            content: { 'application/json': { schema: User } },
+        },
+        404: NotFoundResponse,
+    },
+});
+export function createUsersRouter(deps) {
+    const router = new OpenAPIHono();
+    router.openapi(listUsersRoute, async (context) => {
+        const users = await deps.userRegistry.list();
+        return context.json({ items: users }, 200);
+    });
+    router.openapi(getMeRoute, async (context) => {
+        const userId = getUserId(context);
+        const user = await deps.userRegistry.get(userId);
+        if (!user)
+            throw new NotFoundError(`Current user "${userId}" not found in registry`);
+        return context.json(user, 200);
+    });
+    router.openapi(getUserRoute, async (context) => {
+        const { userId } = context.req.valid('param');
+        const user = await deps.userRegistry.get(userId);
+        if (!user)
+            throw new NotFoundError(`User "${userId}" not found`);
+        return context.json(user, 200);
+    });
+    router.openapi(createUserRoute, async (context) => {
+        const draft = context.req.valid('json');
+        const created = await deps.userRegistry.create({
+            id: newUserId(),
+            ...draft,
+            serverRole: draft.serverRole ?? 'user',
+            createdAt: deps.clock.now(),
+        });
+        return context.json(created, 201);
+    });
+    router.openapi(updateUserRoute, async (context) => {
+        const { userId } = context.req.valid('param');
+        const patch = context.req.valid('json');
+        const updated = await deps.userRegistry.update(userId, patch);
+        return context.json(updated, 200);
+    });
+    return router;
+}
+//# sourceMappingURL=users.js.map

package/dist/routes/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAA;AAE1E,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CAClE,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;CACrB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAO9B,MAAM,cAAc,GAAG,WAAW,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,WAAW;IACxB,OAAO,EAAE,gCAAgC;IACzC,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;SAC9D;KACF;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,WAAW,CAAC;IAC7B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,4DAA4D;IACrE,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,WAAW,CAAC;IAC/B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,SAAS;IACtB,OAAO,EAAE,4BAA4B;IACrC,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;IAChC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,wEAAwE;IACjF,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;KACjE;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,yBAAyB;KAC/B;CACF,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,8EAA8E;IACvF,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE;QACP,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;KACjE;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,iBAAiB,MAAM,yBAAyB,CAAC,CAAA;QAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,SAAS,MAAM,aAAa,CAAC,CAAA;QACvD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAC7C,EAAE,EAAE,SAAS,EAAE;YACf,GAAG,KAAK;YACR,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,MAAM;YACtC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC5B,CAAC,CAAA;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/workspaceMembers.d.ts

@@ -0,0 +1,11 @@
+import type { Clock, WorkspaceService } from '@braidhq/core';
+import type { WorkspaceRegistryFile } from '../infrastructure/fs/WorkspaceRegistryFile.js';
+import { Hono } from 'hono';
+export interface WorkspaceMembersRouterDeps {
+    workspaceService: WorkspaceService;
+    registry: WorkspaceRegistryFile;
+    clock: Clock;
+}
+export declare function createWorkspaceMembersRouter(deps: WorkspaceMembersRouterDeps): Hono;
+export declare function createTransferOwnershipRouter(deps: WorkspaceMembersRouterDeps): Hono;
+//# sourceMappingURL=workspaceMembers.d.ts.map

package/dist/routes/workspaceMembers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceMembers.d.ts","sourceRoot":"","sources":["../../src/routes/workspaceMembers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAA;AAI1F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAqB3B,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,KAAK,EAAE,KAAK,CAAA;CACb;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B,GAAG,IAAI,CAoDnF;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,0BAA0B,GAAG,IAAI,CAWpF"}

package/dist/routes/workspaceMembers.js

@@ -0,0 +1,81 @@
+import { NotFoundError } from '@braidhq/core';
+import { SkillPermission, UserId, WorkspaceRole } from '@braidhq/schema';
+import { zValidator } from '@hono/zod-validator';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { requirePermission } from '../middleware/workspaceAccess.js';
+import { getWorkspaceId } from '../middleware/workspaceId.js';
+const AddMemberBody = z.object({
+    userId: UserId,
+    role: WorkspaceRole.default('guest'),
+});
+const PatchMemberBody = z.object({
+    role: WorkspaceRole.optional(),
+    skillOverrides: z.record(z.string().min(1), SkillPermission).optional(),
+}).refine(body => Object.keys(body).length > 0, {
+    message: 'PATCH body must include role and/or skillOverrides',
+});
+const TransferBody = z.object({
+    newOwnerId: UserId,
+});
+export function createWorkspaceMembersRouter(deps) {
+    const router = new Hono();
+    const ownerOnly = requirePermission('workspace.write');
+    // List is open to every member of the workspace. The access
+    // middleware upstream already enforced membership.
+    router.get('/', async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const members = await deps.registry.listMembers(workspace.rootPath);
+        return context.json({ items: members });
+    });
+    router.post('/', ownerOnly, zValidator('json', AddMemberBody), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const { userId, role } = context.req.valid('json');
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const member = {
+            userId,
+            role,
+            joinedAt: deps.clock.now(),
+        };
+        await deps.registry.addMember(workspace.rootPath, member);
+        return context.json(member, 201);
+    });
+    router.patch('/:memberUserId', ownerOnly, zValidator('json', PatchMemberBody), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const memberUserId = UserId.parse(context.req.param('memberUserId'));
+        const patch = context.req.valid('json');
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const next = await deps.registry.updateMember(workspace.rootPath, memberUserId, {
+            ...(patch.role ? { role: patch.role } : {}),
+            ...(patch.skillOverrides
+                ? { skillOverrides: patch.skillOverrides }
+                : {}),
+        });
+        return context.json(next);
+    });
+    router.delete('/:memberUserId', ownerOnly, async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const memberUserId = UserId.parse(context.req.param('memberUserId'));
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const exists = await deps.registry.getMember(workspace.rootPath, memberUserId);
+        if (!exists)
+            throw new NotFoundError(`User "${memberUserId}" is not a member of this workspace`);
+        await deps.registry.removeMember(workspace.rootPath, memberUserId);
+        return context.body(null, 204);
+    });
+    return router;
+}
+export function createTransferOwnershipRouter(deps) {
+    const router = new Hono();
+    router.post('/', requirePermission('workspace.write'), zValidator('json', TransferBody), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const { newOwnerId } = context.req.valid('json');
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        await deps.registry.transferOwnership(workspace.rootPath, newOwnerId);
+        const members = await deps.registry.listMembers(workspace.rootPath);
+        return context.json({ items: members });
+    });
+    return router;
+}
+//# sourceMappingURL=workspaceMembers.js.map

package/dist/routes/workspaceMembers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceMembers.js","sourceRoot":"","sources":["../../src/routes/workspaceMembers.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAE7D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;CACrC,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;IAC9C,OAAO,EAAE,oDAAoD;CAC9D,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM;CACnB,CAAC,CAAA;AAQF,MAAM,UAAU,4BAA4B,CAAC,IAAgC;IAC3E,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IACzB,MAAM,SAAS,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;IAEtD,4DAA4D;IAC5D,mDAAmD;IACnD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,MAAM,GAAwB;YAClC,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAe;SACxC,CAAA;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACzD,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/F,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE;YAC9E,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,cAAc;gBACtB,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAA2E,EAAE;gBACvG,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAA;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3D,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QACpE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC9E,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,aAAa,CAAC,SAAS,YAAY,qCAAqC,CAAC,CAAA;QACrF,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAClE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAAgC;IAC5E,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IACzB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzG,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/workspaces.d.ts

@@ -1,8 +1,26 @@
-import type { SourceLoaderRunner, WorkspaceService } from '@braidhq/core';
+import type { SourceLoaderRunner, WorkspaceBootstrap, WorkspaceService } from '@braidhq/core';
+import type { AbsolutePath } from '@braidhq/schema';
+import type { WorkspaceRegistryFile } from '../infrastructure/fs/WorkspaceRegistryFile.js';
+import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
 import { Hono } from 'hono';
 export interface WorkspacesRouterDeps {
     workspaceService: WorkspaceService;
     sourceLoaderRunner: SourceLoaderRunner;
+    workspacesRoot: AbsolutePath;
+    bootstrap?: WorkspaceBootstrap;
+    /**
+     * Optional: when present, `GET /workspaces` filters to ones the
+     * current user is a member of, and newly registered workspaces
+     * stamp the caller as owner. Absent in tests that don't exercise
+     * membership.
+     */
+    workspaceRegistry?: WorkspaceRegistryFile;
+    /**
+     * Optional: when present, server admins see every workspace
+     * regardless of membership. Without this, only direct membership
+     * controls visibility.
+     */
+    userRegistry?: UserRegistryFile;
 }
 export declare function createWorkspacesRouter(deps: WorkspacesRouterDeps): Hono;
 //# sourceMappingURL=workspaces.d.ts.map

package/dist/routes/workspaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../../src/routes/workspaces.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAa,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAiBpF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAwB3B,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,kBAAkB,EAAE,kBAAkB,CAAA;CACvC;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAuIvE"}
+{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../../src/routes/workspaces.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAa,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACxG,OAAO,KAAK,EAAE,YAAY,EAAgD,MAAM,iBAAiB,CAAA;AAEjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAA;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AAenF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAwC3B,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,cAAc,EAAE,YAAY,CAAA;IAC5B,SAAS,CAAC,EAAE,kBAAkB,CAAA;IAC9B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,qBAAqB,CAAA;IACzC;;;;OAIG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAA;CAChC;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI,CA0OvE"}