@braidhq/server 0.0.1 → 0.1.0

package/dist/infrastructure/users/UserRegistryFile.d.ts

@@ -0,0 +1,23 @@
+import type { UserId as UserIdType, UserPatch as UserPatchType, User as UserType } from '@braidhq/schema';
+/**
+ * Persists the user registry to a JSON file at `${BRAID_HOME}/users.json`.
+ * Source of truth across server restarts; in-memory data is a derivation.
+ *
+ * Auth and ACL are server-side concerns and never enter a workspace's
+ * git history — keep this file under `~/.braid/`, not inside any
+ * workspace directory.
+ */
+export declare class UserRegistryFile {
+    private readonly filePath;
+    constructor(filePath: string);
+    list(): Promise<UserType[]>;
+    get(id: UserIdType): Promise<UserType | undefined>;
+    getByGoogleSub(sub: string): Promise<UserType | undefined>;
+    getByEmail(email: string): Promise<UserType | undefined>;
+    create(user: UserType): Promise<UserType>;
+    update(id: UserIdType, patch: UserPatchType): Promise<UserType>;
+    delete(id: UserIdType): Promise<void>;
+    private read;
+    private write;
+}
+//# sourceMappingURL=UserRegistryFile.d.ts.map

package/dist/infrastructure/users/UserRegistryFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserRegistryFile.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/users/UserRegistryFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,SAAS,IAAI,aAAa,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAazG;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEvC,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAK3B,GAAG,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAKlD,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAK1D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAMxD,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAWzC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IAmB/D,MAAM,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAQ7B,IAAI;YAeJ,KAAK;CAIpB"}

package/dist/infrastructure/users/UserRegistryFile.js

@@ -0,0 +1,91 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { NotFoundError, ValidationError } from '@braidhq/core';
+import { User } from '@braidhq/schema';
+import { z } from 'zod';
+const RegistryContent = z.object({
+    users: z.array(User).default([]),
+});
+/**
+ * Persists the user registry to a JSON file at `${BRAID_HOME}/users.json`.
+ * Source of truth across server restarts; in-memory data is a derivation.
+ *
+ * Auth and ACL are server-side concerns and never enter a workspace's
+ * git history — keep this file under `~/.braid/`, not inside any
+ * workspace directory.
+ */
+export class UserRegistryFile {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async list() {
+        const content = await this.read();
+        return content.users;
+    }
+    async get(id) {
+        const content = await this.read();
+        return content.users.find(u => u.id === id);
+    }
+    async getByGoogleSub(sub) {
+        const content = await this.read();
+        return content.users.find(u => u.googleSub === sub);
+    }
+    async getByEmail(email) {
+        const content = await this.read();
+        const lowered = email.toLowerCase();
+        return content.users.find(u => u.email?.toLowerCase() === lowered);
+    }
+    async create(user) {
+        const content = await this.read();
+        if (content.users.some(existing => existing.id === user.id))
+            throw new ValidationError(`User "${user.id}" already exists`);
+        if (user.googleSub && content.users.some(existing => existing.googleSub === user.googleSub))
+            throw new ValidationError(`User with googleSub "${user.googleSub}" already exists`);
+        content.users.push(user);
+        await this.write(content);
+        return user;
+    }
+    async update(id, patch) {
+        const content = await this.read();
+        const idx = content.users.findIndex(u => u.id === id);
+        if (idx < 0)
+            throw new NotFoundError(`User "${id}" not found`);
+        const current = content.users[idx];
+        // Drop undefined keys so `{ displayName: undefined }` doesn't blow
+        // away the existing displayName. Zod's `.partial()` widens every
+        // field to optional, but the persisted User schema still requires
+        // the non-optional fields to be present.
+        const defined = Object.fromEntries(Object.entries(patch).filter(([, v]) => v !== undefined));
+        const merged = { ...current, ...defined };
+        content.users[idx] = merged;
+        await this.write(content);
+        return merged;
+    }
+    async delete(id) {
+        const content = await this.read();
+        const filtered = content.users.filter(u => u.id !== id);
+        if (filtered.length === content.users.length)
+            return;
+        await this.write({ users: filtered });
+    }
+    async read() {
+        try {
+            const raw = await readFile(this.filePath, 'utf-8');
+            const parsed = RegistryContent.safeParse(JSON.parse(raw));
+            if (!parsed.success)
+                throw new ValidationError(`Invalid user registry at "${this.filePath}": ${parsed.error.message}`);
+            return parsed.data;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { users: [] };
+            throw error;
+        }
+    }
+    async write(content) {
+        await mkdir(dirname(this.filePath), { recursive: true });
+        await writeFile(this.filePath, `${JSON.stringify(content, null, 2)}\n`, 'utf-8');
+    }
+}
+//# sourceMappingURL=UserRegistryFile.js.map

package/dist/infrastructure/users/UserRegistryFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UserRegistryFile.js","sourceRoot":"","sources":["../../../src/infrastructure/users/UserRegistryFile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACjC,CAAC,CAAA;AAIF;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,OAAO,OAAO,CAAC,KAAK,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAc;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACnC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,OAAO,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAc;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,eAAe,CAAC,SAAS,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAA;QAC/D,IAAI,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC;YACzF,MAAM,IAAI,eAAe,CAAC,wBAAwB,IAAI,CAAC,SAAS,kBAAkB,CAAC,CAAA;QACrF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAc,EAAE,KAAoB;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACrD,IAAI,GAAG,GAAG,CAAC;YACT,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAE,CAAA;QACnC,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,yCAAyC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACpC,CAAA;QACtB,MAAM,MAAM,GAAa,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAA;QACnD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAc;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM;YAC1C,OAAM;QACR,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAClD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO;gBACjB,MAAM,IAAI,eAAe,CAAC,6BAA6B,IAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACnG,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;YACtB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAAwB;QAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,CAAC;CACF"}

package/dist/infrastructure/users/ensureLocalUser.d.ts

@@ -0,0 +1,15 @@
+import type { UserRegistryFile } from './UserRegistryFile.js';
+/**
+ * Branded id reserved for the single implicit account on a local install.
+ * `userIdMiddleware` resolves to this value when no `X-Braid-User` header
+ * is sent (the embedded sidecar path), so the registry MUST have a row
+ * for it or `getMe` and audit-trail reads break.
+ */
+export declare const LOCAL_USER_ID: string & import("zod").BRAND<"UserId">;
+/**
+ * Idempotently ensure the `local-user` row exists. Pre-existing rows
+ * are left untouched (the user may have renamed themselves, set an
+ * email, etc.). Default `displayName` comes from the OS account.
+ */
+export declare function ensureLocalUser(registry: UserRegistryFile): Promise<void>;
+//# sourceMappingURL=ensureLocalUser.d.ts.map

package/dist/infrastructure/users/ensureLocalUser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureLocalUser.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/users/ensureLocalUser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAK7D;;;;;GAKG;AACH,eAAO,MAAM,aAAa,wCAA6B,CAAA;AAEvD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/E"}

package/dist/infrastructure/users/ensureLocalUser.js

@@ -0,0 +1,38 @@
+import { userInfo } from 'node:os';
+import process from 'node:process';
+import { UserId } from '@braidhq/schema';
+/**
+ * Branded id reserved for the single implicit account on a local install.
+ * `userIdMiddleware` resolves to this value when no `X-Braid-User` header
+ * is sent (the embedded sidecar path), so the registry MUST have a row
+ * for it or `getMe` and audit-trail reads break.
+ */
+export const LOCAL_USER_ID = UserId.parse('local-user');
+/**
+ * Idempotently ensure the `local-user` row exists. Pre-existing rows
+ * are left untouched (the user may have renamed themselves, set an
+ * email, etc.). Default `displayName` comes from the OS account.
+ */
+export async function ensureLocalUser(registry) {
+    const existing = await registry.get(LOCAL_USER_ID);
+    if (existing)
+        return;
+    await registry.create({
+        id: LOCAL_USER_ID,
+        displayName: safeOsUsername(),
+        serverRole: 'admin',
+        createdAt: new Date().toISOString(),
+    });
+}
+function safeOsUsername() {
+    try {
+        const info = userInfo();
+        if (info.username && info.username.length > 0)
+            return info.username;
+    }
+    catch {
+        // Some sandboxed environments throw on userInfo(); fall through.
+    }
+    return process.env.USER ?? process.env.USERNAME ?? 'local';
+}
+//# sourceMappingURL=ensureLocalUser.js.map

package/dist/infrastructure/users/ensureLocalUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureLocalUser.js","sourceRoot":"","sources":["../../../src/infrastructure/users/ensureLocalUser.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;AAEvD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAA0B;IAC9D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,QAAQ;QACV,OAAM;IAER,MAAM,QAAQ,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,cAAc,EAAE;QAC7B,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAe;KACjD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;QACvB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC3C,OAAO,IAAI,CAAC,QAAQ,CAAA;IACxB,CAAC;IACD,MAAM,CAAC;QACL,iEAAiE;IACnE,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAA;AAC5D,CAAC"}

package/dist/infrastructure/users/ensureWorkspaceOwners.d.ts

@@ -0,0 +1,9 @@
+import type { WorkspaceRegistryFile } from '../fs/WorkspaceRegistryFile.js';
+/**
+ * Phase C migration: workspaces registered before members existed have
+ * empty `members[]`. Seed each one with `local-user` as owner so the
+ * single-tenant install keeps working with no manual steps. Idempotent
+ * — workspaces that already have members are left alone.
+ */
+export declare function ensureWorkspaceOwners(registry: WorkspaceRegistryFile): Promise<void>;
+//# sourceMappingURL=ensureWorkspaceOwners.d.ts.map

package/dist/infrastructure/users/ensureWorkspaceOwners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureWorkspaceOwners.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/users/ensureWorkspaceOwners.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAG3E;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa1F"}

package/dist/infrastructure/users/ensureWorkspaceOwners.js

@@ -0,0 +1,22 @@
+import { LOCAL_USER_ID } from './ensureLocalUser.js';
+/**
+ * Phase C migration: workspaces registered before members existed have
+ * empty `members[]`. Seed each one with `local-user` as owner so the
+ * single-tenant install keeps working with no manual steps. Idempotent
+ * — workspaces that already have members are left alone.
+ */
+export async function ensureWorkspaceOwners(registry) {
+    const rootPaths = await registry.list();
+    const now = new Date().toISOString();
+    for (const rootPath of rootPaths) {
+        const members = await registry.listMembers(rootPath);
+        if (members.length > 0)
+            continue;
+        await registry.addMember(rootPath, {
+            userId: LOCAL_USER_ID,
+            role: 'owner',
+            joinedAt: now,
+        });
+    }
+}
+//# sourceMappingURL=ensureWorkspaceOwners.js.map

package/dist/infrastructure/users/ensureWorkspaceOwners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureWorkspaceOwners.js","sourceRoot":"","sources":["../../../src/infrastructure/users/ensureWorkspaceOwners.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAA+B;IACzE,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAe,CAAA;IACjD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,SAAQ;QACV,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,GAAG;SACd,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,29 @@
+import type { MiddlewareHandler } from 'hono';
+import type { SessionStore } from '../infrastructure/auth/SessionStore.js';
+export interface AuthMiddlewareOptions {
+    readonly sessionStore: SessionStore;
+    /**
+     * When true, skip the Bearer check and let `userIdMiddleware`'s
+     * fallback (local-user via env / header) take over. The Tauri
+     * embedded sidecar sets this so the local install keeps working
+     * without an OAuth round trip; a remote deployment leaves it false
+     * so anonymous traffic is rejected.
+     *
+     * Resolution: explicit option > `BRAID_LOCAL_TRUST=true` env var.
+     * Defaults to `false` when neither is set — composeFs flips this
+     * to `true` for local development.
+     */
+    readonly localTrust?: boolean;
+}
+/**
+ * Pull a Bearer token off the request, or return `undefined` if the
+ * header is missing / malformed. Route handlers use this to forward the
+ * caller's identity to spawned skill subprocesses without re-parsing.
+ */
+export declare function extractBearerToken(context: {
+    req: {
+        header: (name: string) => string | undefined;
+    };
+}): string | undefined;
+export declare function authMiddleware(options: AuthMiddlewareOptions): MiddlewareHandler;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAmB1E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC9B;AAUD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE;QAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;KAAE,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAMzH;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,iBAAiB,CAoDhF"}

package/dist/middleware/auth.js

@@ -0,0 +1,81 @@
+import process from 'node:process';
+import { parseBoolEnv } from '../infrastructure/env.js';
+/**
+ * Routes the auth middleware never gates. Anonymous access is required
+ * here, otherwise the login flow itself becomes impossible to bootstrap.
+ *
+ * Path prefixes (not exact match) so `/auth/google/start`,
+ * `/auth/google/callback`, `/auth/whoami` all flow through without a
+ * token. `/health` stays open so platform probes don't need a token.
+ * `/openapi.json` matches the broad industry convention that OpenAPI
+ * descriptions are publicly readable (Swagger UI, codegen, MCP gateways
+ * default to fetching them without auth). It only documents shape, not
+ * data, so leaking it to anonymous callers is safe.
+ */
+const PUBLIC_EXACT = new Set(['/openapi.json']);
+const PUBLIC_PREFIXES = ['/auth/', '/health'];
+// EventSource (browser SSE) cannot send custom Authorization headers, so
+// for live-update endpoints we additionally accept a `?token=...` query
+// parameter and treat it identically to a Bearer token. Limited to paths
+// ending in `/events` so this lenient path doesn't apply to mutating routes.
+function isSseEventsPath(path) {
+    return path.endsWith('/events');
+}
+/**
+ * Pull a Bearer token off the request, or return `undefined` if the
+ * header is missing / malformed. Route handlers use this to forward the
+ * caller's identity to spawned skill subprocesses without re-parsing.
+ */
+export function extractBearerToken(context) {
+    const header = context.req.header('Authorization');
+    if (!header || !header.startsWith('Bearer '))
+        return undefined;
+    const token = header.slice('Bearer '.length).trim();
+    return token.length > 0 ? token : undefined;
+}
+export function authMiddleware(options) {
+    const localTrust = options.localTrust ?? parseBoolEnv(process.env.BRAID_LOCAL_TRUST, false);
+    return async (context, next) => {
+        const path = context.req.path;
+        if (PUBLIC_EXACT.has(path) || PUBLIC_PREFIXES.some(prefix => path.startsWith(prefix))) {
+            await next();
+            return undefined;
+        }
+        if (localTrust) {
+            // The downstream `userIdMiddleware` will stamp `local-user` (or
+            // honour an explicit `X-Braid-User` header for multi-persona
+            // dev). The auth layer has no opinion here.
+            await next();
+            return undefined;
+        }
+        const header = context.req.header('Authorization');
+        let token = header?.startsWith('Bearer ') ? header.slice('Bearer '.length).trim() : null;
+        // Fall back to a query-param token for SSE endpoints only.
+        if (!token && isSseEventsPath(path)) {
+            const queryToken = context.req.query('token');
+            if (queryToken)
+                token = queryToken;
+        }
+        if (!token) {
+            return context.json({
+                type: 'about:blank',
+                title: 'Unauthorized',
+                status: 401,
+                detail: 'Missing or invalid Authorization header. Sign in to continue.',
+            }, 401, { 'Content-Type': 'application/problem+json' });
+        }
+        const session = await options.sessionStore.resolve(token);
+        if (!session) {
+            return context.json({
+                type: 'about:blank',
+                title: 'Unauthorized',
+                status: 401,
+                detail: 'Session expired or revoked. Sign in again.',
+            }, 401, { 'Content-Type': 'application/problem+json' });
+        }
+        context.set('userId', session.userId);
+        await next();
+        return undefined;
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAA;AAC/C,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;AAkB7C,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,6EAA6E;AAC7E,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkE;IACnG,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1C,OAAO,SAAS,CAAA;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;IAC3F,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;QAC7B,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,gEAAgE;YAChE,6DAA6D;YAC7D,4CAA4C;YAC5C,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QAClD,IAAI,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACxF,2DAA2D;QAC3D,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC7C,IAAI,UAAU;gBACZ,KAAK,GAAG,UAAU,CAAA;QACtB,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,IAAI,CACjB;gBACE,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,+DAA+D;aACxE,EACD,GAAG,EACH,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAC/C,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CACjB;gBACE,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,4CAA4C;aACrD,EACD,GAAG,EACH,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAC/C,CAAA;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACrC,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC"}

package/dist/middleware/cors.js

@@ -19,7 +19,7 @@ export function corsMiddleware(options = {}) {
         }
         if (context.req.method === 'OPTIONS') {
             context.header('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
-            context.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+            context.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Braid-User');
             context.header('Access-Control-Max-Age', '86400');
             return context.body(null, 204);
         }

package/dist/middleware/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAEA,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;CACxB,CAAA;AAMD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAuB,EAAE;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,CAAA;IACtE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;YACrD,OAAO,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YAC1D,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAA;YACxF,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAA;YAC7E,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YACjD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAEA,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;CACxB,CAAA;AAMD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAuB,EAAE;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,CAAA;IACtE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;YACrD,OAAO,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YAC1D,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAA;YACxF,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,2CAA2C,CAAC,CAAA;YAC3F,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YACjD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC"}

package/dist/middleware/requireAdmin.d.ts

@@ -0,0 +1,10 @@
+import type { MiddlewareHandler } from 'hono';
+import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
+/**
+ * Server-admin gate. Composes after `authMiddleware` + `userIdMiddleware`
+ * so the resolved userId is on the context. Local-trust callers stamped
+ * as `local-user` pass through because `ensureLocalUser` seeds them
+ * with `serverRole: 'admin'`.
+ */
+export declare function requireAdmin(userRegistry: UserRegistryFile): MiddlewareHandler;
+//# sourceMappingURL=requireAdmin.d.ts.map

package/dist/middleware/requireAdmin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireAdmin.d.ts","sourceRoot":"","sources":["../../src/middleware/requireAdmin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AAGnF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,gBAAgB,GAAG,iBAAiB,CAmB9E"}

package/dist/middleware/requireAdmin.js

@@ -0,0 +1,24 @@
+import { getUserId } from './userId.js';
+/**
+ * Server-admin gate. Composes after `authMiddleware` + `userIdMiddleware`
+ * so the resolved userId is on the context. Local-trust callers stamped
+ * as `local-user` pass through because `ensureLocalUser` seeds them
+ * with `serverRole: 'admin'`.
+ */
+export function requireAdmin(userRegistry) {
+    return async (context, next) => {
+        const userId = getUserId(context);
+        const user = await userRegistry.get(userId);
+        if (!user || user.serverRole !== 'admin') {
+            return context.json({
+                type: 'about:blank',
+                title: 'Forbidden',
+                status: 403,
+                detail: 'Server admin required.',
+            }, 403, { 'Content-Type': 'application/problem+json' });
+        }
+        await next();
+        return undefined;
+    };
+}
+//# sourceMappingURL=requireAdmin.js.map

package/dist/middleware/requireAdmin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireAdmin.js","sourceRoot":"","sources":["../../src/middleware/requireAdmin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,YAA8B;IACzD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,IAAI,CACjB;gBACE,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,wBAAwB;aACjC,EACD,GAAG,EACH,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAC/C,CAAA;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC"}

package/dist/middleware/userId.d.ts

@@ -0,0 +1,16 @@
+import type { UserId as UserIdType } from '@braidhq/schema';
+import type { Context, MiddlewareHandler } from 'hono';
+declare module 'hono' {
+    interface ContextVariableMap {
+        userId: UserIdType;
+    }
+}
+/**
+ * Resolve the caller's userId from `X-Braid-User` (Phase A) and stash
+ * it on the request context. Falls back to `local-user` when the
+ * header is absent, preserving local-only behaviour for the embedded
+ * sidecar that doesn't bother sending one.
+ */
+export declare const userIdMiddleware: MiddlewareHandler;
+export declare function getUserId(context: Context): UserIdType;
+//# sourceMappingURL=userId.d.ts.map

package/dist/middleware/userId.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userId.d.ts","sourceRoot":"","sources":["../../src/middleware/userId.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAGtD,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,MAAM,EAAE,UAAU,CAAA;KACnB;CACF;AAaD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAM9B,CAAA;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAEtD"}

package/dist/middleware/userId.js

@@ -0,0 +1,27 @@
+import { UserId } from '@braidhq/schema';
+/**
+ * Header name carrying the caller's userId in Phase A (pre-auth).
+ * Phase B (Google OAuth) will replace this with `Authorization: Bearer`
+ * token resolution and `c.set('userId', ...)` upstream of this middleware;
+ * the rest of the codebase only ever calls `getUserId(c)`, so the
+ * substitution stays local to the auth layer.
+ */
+const HEADER = 'X-Braid-User';
+const DEFAULT_USER_ID = UserId.parse('local-user');
+/**
+ * Resolve the caller's userId from `X-Braid-User` (Phase A) and stash
+ * it on the request context. Falls back to `local-user` when the
+ * header is absent, preserving local-only behaviour for the embedded
+ * sidecar that doesn't bother sending one.
+ */
+export const userIdMiddleware = async (context, next) => {
+    if (context.get('userId') === undefined) {
+        const header = context.req.header(HEADER);
+        context.set('userId', header && header.length > 0 ? UserId.parse(header) : DEFAULT_USER_ID);
+    }
+    await next();
+};
+export function getUserId(context) {
+    return context.get('userId');
+}
+//# sourceMappingURL=userId.js.map

package/dist/middleware/userId.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userId.js","sourceRoot":"","sources":["../../src/middleware/userId.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAQxC;;;;;;GAMG;AACH,MAAM,MAAM,GAAG,cAAc,CAAA;AAE7B,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CAAA;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AAC9B,CAAC"}

package/dist/middleware/workspaceAccess.d.ts

@@ -0,0 +1,47 @@
+import type { WorkspaceService } from '@braidhq/core';
+import type { Context, MiddlewareHandler } from 'hono';
+import type { WorkspaceRegistryFile } from '../infrastructure/fs/WorkspaceRegistryFile.js';
+import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
+import type { Capability, ViewerContext } from '../policy/index.js';
+/**
+ * Server-scope capability guard. Used for actions that happen without
+ * a workspace context (e.g. workspace creation). Builds a viewer with
+ * member=undefined; non-admin users resolve to effectiveRole=null and
+ * fail every check by construction.
+ *
+ * Skips the gate when userRegistry isn't provided so in-memory test
+ * compositions stay open. Production deployments always pass it.
+ */
+export declare function requireServerCapability(capability: Capability, userRegistry: UserRegistryFile | undefined): MiddlewareHandler;
+declare module 'hono' {
+    interface ContextVariableMap {
+        viewerContext: ViewerContext;
+    }
+}
+export interface WorkspaceAccessOptions {
+    readonly registry: WorkspaceRegistryFile;
+    readonly workspaceService: WorkspaceService;
+    readonly userRegistry: UserRegistryFile;
+}
+/**
+ * Resolves the caller's ViewerContext for this workspace and stashes
+ * it on the Hono context for every downstream layer to read. Composes
+ * after `workspaceIdMiddleware` + `userIdMiddleware`. Outsiders (no
+ * member row + not a server admin) get 403 here.
+ *
+ * The actual policy decisions live in `policy/`; this middleware just
+ * builds the viewer and rejects unauthenticated outsiders.
+ */
+export declare function workspaceAccessMiddleware(options: WorkspaceAccessOptions): MiddlewareHandler;
+export declare function getViewerContext(context: Context): ViewerContext | undefined;
+/**
+ * Mutation guard. Returns 403 if the viewer can't perform the given
+ * capability. Optional `buildResource` lets specific capabilities
+ * (e.g. `skill.run`) attach per-request data the check needs.
+ *
+ * Test compositions that don't mount `workspaceAccessMiddleware`
+ * (in-memory tests, headless server) skip the gate. Production
+ * deployments always mount the access middleware so the gate is real.
+ */
+export declare function requirePermission(capability: Capability, buildResource?: (context: Context) => Promise<ViewerContext['resource']>): MiddlewareHandler;
+//# sourceMappingURL=workspaceAccess.d.ts.map

package/dist/middleware/workspaceAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/middleware/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAA;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKnE;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,gBAAgB,GAAG,SAAS,GACzC,iBAAiB,CAgBnB;AAED,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,aAAa,EAAE,aAAa,CAAA;KAC7B;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAA;IACxC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAA;CACxC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CAgB5F;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,UAAU,EACtB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,GACvE,iBAAiB,CAcnB"}

package/dist/middleware/workspaceAccess.js

@@ -0,0 +1,86 @@
+import { defaultPermissionRegistry, resolveViewer } from '../policy/index.js';
+import { getUserId } from './userId.js';
+import { getWorkspaceId } from './workspaceId.js';
+/**
+ * Server-scope capability guard. Used for actions that happen without
+ * a workspace context (e.g. workspace creation). Builds a viewer with
+ * member=undefined; non-admin users resolve to effectiveRole=null and
+ * fail every check by construction.
+ *
+ * Skips the gate when userRegistry isn't provided so in-memory test
+ * compositions stay open. Production deployments always pass it.
+ */
+export function requireServerCapability(capability, userRegistry) {
+    return async (context, next) => {
+        if (!userRegistry) {
+            await next();
+            return undefined;
+        }
+        const userId = getUserId(context);
+        const user = await userRegistry.get(userId);
+        if (!user)
+            return forbid(context, `Unknown user "${userId}".`);
+        const viewer = resolveViewer(user, undefined);
+        if (!defaultPermissionRegistry.can(capability, viewer))
+            return forbid(context, `Your role cannot perform "${capability}".`);
+        await next();
+        return undefined;
+    };
+}
+/**
+ * Resolves the caller's ViewerContext for this workspace and stashes
+ * it on the Hono context for every downstream layer to read. Composes
+ * after `workspaceIdMiddleware` + `userIdMiddleware`. Outsiders (no
+ * member row + not a server admin) get 403 here.
+ *
+ * The actual policy decisions live in `policy/`; this middleware just
+ * builds the viewer and rejects unauthenticated outsiders.
+ */
+export function workspaceAccessMiddleware(options) {
+    return async (context, next) => {
+        const workspaceId = getWorkspaceId(context);
+        const userId = getUserId(context);
+        const user = await options.userRegistry.get(userId);
+        if (!user)
+            return forbid(context, `Unknown user "${userId}".`);
+        const workspace = await options.workspaceService.findById(workspaceId);
+        const member = await options.registry.getMember(workspace.rootPath, userId);
+        const viewer = resolveViewer(user, member);
+        if (viewer.effectiveRole === null)
+            return forbid(context, `You are not a member of workspace "${workspaceId}".`);
+        context.set('viewerContext', viewer);
+        await next();
+        return undefined;
+    };
+}
+export function getViewerContext(context) {
+    return context.get('viewerContext');
+}
+/**
+ * Mutation guard. Returns 403 if the viewer can't perform the given
+ * capability. Optional `buildResource` lets specific capabilities
+ * (e.g. `skill.run`) attach per-request data the check needs.
+ *
+ * Test compositions that don't mount `workspaceAccessMiddleware`
+ * (in-memory tests, headless server) skip the gate. Production
+ * deployments always mount the access middleware so the gate is real.
+ */
+export function requirePermission(capability, buildResource) {
+    return async (context, next) => {
+        const base = getViewerContext(context);
+        if (!base) {
+            await next();
+            return undefined;
+        }
+        const resource = buildResource ? await buildResource(context) : undefined;
+        const viewer = resource ? { ...base, resource } : base;
+        if (!defaultPermissionRegistry.can(capability, viewer))
+            return forbid(context, `Your role cannot perform "${capability}".`);
+        await next();
+        return undefined;
+    };
+}
+function forbid(context, detail) {
+    return context.json({ type: 'about:blank', title: 'Forbidden', status: 403, detail }, 403, { 'Content-Type': 'application/problem+json' });
+}
+//# sourceMappingURL=workspaceAccess.js.map

package/dist/middleware/workspaceAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/middleware/workspaceAccess.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAsB,EACtB,YAA0C;IAE1C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI;YACP,OAAO,MAAM,CAAC,OAAO,EAAE,iBAAiB,MAAM,IAAI,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC7C,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;YACpD,OAAO,MAAM,CAAC,OAAO,EAAE,6BAA6B,UAAU,IAAI,CAAC,CAAA;QACrE,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B;IACvE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI;YACP,OAAO,MAAM,CAAC,OAAO,EAAE,iBAAiB,MAAM,IAAI,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1C,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;YAC/B,OAAO,MAAM,CAAC,OAAO,EAAE,sCAAsC,WAAW,IAAI,CAAC,CAAA;QAC/E,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;QACpC,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAsB,EACtB,aAAwE;IAExE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACzE,MAAM,MAAM,GAAkB,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;YACpD,OAAO,MAAM,CAAC,OAAO,EAAE,6BAA6B,UAAU,IAAI,CAAC,CAAA;QACrE,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,OAAgB,EAAE,MAAc;IAC9C,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAChE,GAAG,EACH,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAC/C,CAAA;AACH,CAAC"}

package/dist/policy/Capability.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Closed enumeration of capability identifiers known to the core
+ * platform. Plugins can register their own checks under custom string
+ * ids; this list is the central catalog so first-party code has a
+ * type-safe handle.
+ *
+ * New capability = add to CAPABILITY_IDS + write a CapabilityCheck
+ * class implementing it. Existing checks don't care about new ids.
+ */
+export declare const CAPABILITY_IDS: readonly ["workspace.create", "workspace.read", "workspace.write", "proposal.read", "proposal.write", "clarify.read", "clarify.write", "history.write", "skill.run"];
+export type Capability = (typeof CAPABILITY_IDS)[number];
+//# sourceMappingURL=Capability.d.ts.map