@braidhq/server 0.0.1 → 0.2.0

package/dist/middleware/workspaceAccess.js

@@ -0,0 +1,91 @@
+import { ForbiddenError } from '@braidhq/core';
+import { defaultPermissionRegistry, resolveViewer } from '../policy/index.js';
+import { getUserId } from './auth.js';
+import { getWorkspaceId } from './workspaceId.js';
+/**
+ * Server-scope capability guard for actions without a workspace context,
+ * such as workspace creation.
+ * Builds a viewer with an absent member,
+ * so non-admin users resolve to a null effectiveRole,
+ * and fail every check by construction.
+ *
+ * Skips the gate when userRegistry is absent,
+ * so in-memory test compositions stay open.
+ * Production deployments always pass it.
+ */
+export function requireServerCapability(capability, userRegistry) {
+    return async (context, next) => {
+        if (!userRegistry) {
+            await next();
+            return undefined;
+        }
+        const userId = getUserId(context);
+        const user = await userRegistry.get(userId);
+        if (!user)
+            return forbid(`Unknown user "${userId}".`);
+        const viewer = resolveViewer(user, undefined);
+        if (!defaultPermissionRegistry.can(capability, viewer))
+            return forbid(`Your role cannot perform "${capability}".`);
+        await next();
+        return undefined;
+    };
+}
+/**
+ * Resolves the caller's ViewerContext for this workspace,
+ * and stashes it on the Hono context for every downstream layer to read.
+ * Composes after `workspaceIdMiddleware` and `authMiddleware`.
+ * Outsiders get 403 here, meaning no member row and not a server admin.
+ *
+ * The actual policy decisions live in `policy/`.
+ * This middleware only builds the viewer,
+ * and rejects unauthenticated outsiders.
+ */
+export function workspaceAccessMiddleware(options) {
+    return async (context, next) => {
+        const workspaceId = getWorkspaceId(context);
+        const userId = getUserId(context);
+        const user = await options.userRegistry.get(userId);
+        if (!user)
+            return forbid(`Unknown user "${userId}".`);
+        const workspace = await options.workspaceService.findById(workspaceId);
+        const member = await options.registry.getMember(workspace.rootPath, userId);
+        const viewer = resolveViewer(user, member);
+        if (viewer.effectiveRole === null)
+            return forbid(`You are not a member of workspace "${workspaceId}".`);
+        context.set('viewerContext', viewer);
+        await next();
+        return undefined;
+    };
+}
+export function getViewerContext(context) {
+    return context.get('viewerContext');
+}
+/**
+ * Mutation guard.
+ * Returns 403 when the viewer cannot perform the given capability.
+ * Optional `buildResource` lets a capability such as `skill.run`
+ * attach per-request data the check needs.
+ *
+ * Compositions that don't mount `workspaceAccessMiddleware`,
+ * such as in-memory tests or the headless server, skip the gate.
+ * Production deployments always mount it, so the gate is real.
+ */
+export function requirePermission(capability, buildResource) {
+    return async (context, next) => {
+        const base = getViewerContext(context);
+        if (!base) {
+            await next();
+            return undefined;
+        }
+        const resource = buildResource ? await buildResource(context) : undefined;
+        const viewer = resource ? { ...base, resource } : base;
+        if (!defaultPermissionRegistry.can(capability, viewer))
+            return forbid(`Your role cannot perform "${capability}".`);
+        await next();
+        return undefined;
+    };
+}
+function forbid(detail) {
+    throw new ForbiddenError(detail);
+}
+//# sourceMappingURL=workspaceAccess.js.map

package/dist/middleware/workspaceAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/middleware/workspaceAccess.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAsB,EACtB,YAA0C;IAE1C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI;YACP,OAAO,MAAM,CAAC,iBAAiB,MAAM,IAAI,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC7C,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;YACpD,OAAO,MAAM,CAAC,6BAA6B,UAAU,IAAI,CAAC,CAAA;QAC5D,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAcD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B;IACvE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI;YACP,OAAO,MAAM,CAAC,iBAAiB,MAAM,IAAI,CAAC,CAAA;QAC5C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1C,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;YAC/B,OAAO,MAAM,CAAC,sCAAsC,WAAW,IAAI,CAAC,CAAA;QACtE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;QACpC,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAsB,EACtB,aAAwE;IAExE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACzE,MAAM,MAAM,GAAkB,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;YACpD,OAAO,MAAM,CAAC,6BAA6B,UAAU,IAAI,CAAC,CAAA;QAC5D,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC"}

package/dist/policy/CapabilityCheck.d.ts

@@ -0,0 +1,14 @@
+import type { Capability } from '@braidhq/schema';
+import type { ViewerContext } from './ViewerContext.js';
+/**
+ * The Strategy interface, where each capability owns its decision logic.
+ * A stateless check is a const object, the first-party set lives in `checks.ts`.
+ *
+ * Implementations MUST be pure, with no I/O, clock, or randomness,
+ * so the same viewer always produces the same answer.
+ */
+export interface CapabilityCheck {
+    readonly id: Capability;
+    evaluate: (viewer: ViewerContext) => boolean;
+}
+//# sourceMappingURL=CapabilityCheck.d.ts.map

package/dist/policy/CapabilityCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityCheck.d.ts","sourceRoot":"","sources":["../../src/policy/CapabilityCheck.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAA;IACvB,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAA;CAC7C"}

package/dist/policy/CapabilityCheck.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CapabilityCheck.js.map

package/dist/policy/CapabilityCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityCheck.js","sourceRoot":"","sources":["../../src/policy/CapabilityCheck.ts"],"names":[],"mappings":""}

package/dist/policy/PermissionRegistry.d.ts

@@ -0,0 +1,25 @@
+import type { Capability } from '@braidhq/schema';
+import type { CapabilityCheck } from './CapabilityCheck.js';
+import type { ViewerContext } from './ViewerContext.js';
+/**
+ * Open registry of capability strategies.
+ * A new capability arrives via `registry.register(new MyCheck())`,
+ * leaving existing checks untouched.
+ *
+ * Unknown capability ids resolve to `false`, a default deny.
+ * This makes a typo'd capability id safe,
+ * since the call denies rather than accidentally allowing.
+ */
+export declare class PermissionRegistry {
+    private readonly checks;
+    register(check: CapabilityCheck): this;
+    has(capability: Capability): boolean;
+    /**
+     * Decide whether a viewer can perform a capability.
+     * The viewer already carries its own resource,
+     * such as the skill for skill.run,
+     * so the caller is responsible for building the right viewer.
+     */
+    can(capability: Capability, viewer: ViewerContext): boolean;
+}
+//# sourceMappingURL=PermissionRegistry.d.ts.map

package/dist/policy/PermissionRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionRegistry.d.ts","sourceRoot":"","sources":["../../src/policy/PermissionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAKtC,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO;CAG5D"}

package/dist/policy/PermissionRegistry.js

@@ -0,0 +1,29 @@
+/**
+ * Open registry of capability strategies.
+ * A new capability arrives via `registry.register(new MyCheck())`,
+ * leaving existing checks untouched.
+ *
+ * Unknown capability ids resolve to `false`, a default deny.
+ * This makes a typo'd capability id safe,
+ * since the call denies rather than accidentally allowing.
+ */
+export class PermissionRegistry {
+    checks = new Map();
+    register(check) {
+        this.checks.set(check.id, check);
+        return this;
+    }
+    has(capability) {
+        return this.checks.has(capability);
+    }
+    /**
+     * Decide whether a viewer can perform a capability.
+     * The viewer already carries its own resource,
+     * such as the skill for skill.run,
+     * so the caller is responsible for building the right viewer.
+     */
+    can(capability, viewer) {
+        return this.checks.get(capability)?.evaluate(viewer) ?? false;
+    }
+}
+//# sourceMappingURL=PermissionRegistry.js.map

package/dist/policy/PermissionRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionRegistry.js","sourceRoot":"","sources":["../../src/policy/PermissionRegistry.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAA;IAEhE,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,GAAG,CAAC,UAAsB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,UAAsB,EAAE,MAAqB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;IAC/D,CAAC;CACF"}

package/dist/policy/ViewerContext.d.ts

@@ -0,0 +1,29 @@
+import type { SkillFrontmatter, User, WorkspaceMember, WorkspaceRole } from '@braidhq/schema';
+/**
+ * The single resolved-identity object that every capability check reads.
+ * Built once per request by `resolveViewer`,
+ * then passed unchanged into the registry.
+ *
+ * Permission gates read `effectiveRole`,
+ * where admins always land as owner regardless of any member row.
+ * `member` is the stored row when present,
+ * used for display and skillOverrides lookup,
+ * and stays independent of effectiveRole.
+ * An admin who joined as a guest has a guest member.role,
+ * yet an owner effectiveRole.
+ *
+ * `resource` is the per-action context the check needs.
+ * skill.run reads `skill`, the manifest, along with `skillId`.
+ * Future checks can extend it without breaking siblings.
+ */
+export interface ViewerContext {
+    readonly user: User;
+    readonly member: WorkspaceMember | undefined;
+    readonly effectiveRole: WorkspaceRole | null;
+    readonly resource?: ViewerResource | undefined;
+}
+export interface ViewerResource {
+    readonly skill?: SkillFrontmatter;
+    readonly skillId?: string;
+}
+//# sourceMappingURL=ViewerContext.d.ts.map

package/dist/policy/ViewerContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ViewerContext.d.ts","sourceRoot":"","sources":["../../src/policy/ViewerContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE7F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B"}

package/dist/policy/ViewerContext.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ViewerContext.js.map

package/dist/policy/ViewerContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ViewerContext.js","sourceRoot":"","sources":["../../src/policy/ViewerContext.ts"],"names":[],"mappings":""}

package/dist/policy/checks.d.ts

@@ -0,0 +1,15 @@
+import type { CapabilityCheck } from './CapabilityCheck.js';
+/**
+ * First-party capability checks,
+ * mirrored byte-equivalent in `packages/studio/src/policy/checks.ts`.
+ * The server is the authoritative gate.
+ * The client copy lets Studio render locked affordances, without hitting a 403.
+ *
+ * Workspace-scope verbs collapse to read and write per resource.
+ * `workspace.create` is server-scope, resolved with no member.
+ * `skill.run` keeps its own verb for its three-step resolution,
+ * covering owner short-circuit, per-member override, allowedRoles,
+ * which does not fit a read or write pair.
+ */
+export declare const checks: readonly CapabilityCheck[];
+//# sourceMappingURL=checks.d.ts.map

package/dist/policy/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/policy/checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,EAAE,SAAS,eAAe,EAyC5C,CAAA"}

package/dist/policy/checks.js

@@ -0,0 +1,55 @@
+/**
+ * First-party capability checks,
+ * mirrored byte-equivalent in `packages/studio/src/policy/checks.ts`.
+ * The server is the authoritative gate.
+ * The client copy lets Studio render locked affordances, without hitting a 403.
+ *
+ * Workspace-scope verbs collapse to read and write per resource.
+ * `workspace.create` is server-scope, resolved with no member.
+ * `skill.run` keeps its own verb for its three-step resolution,
+ * covering owner short-circuit, per-member override, allowedRoles,
+ * which does not fit a read or write pair.
+ */
+export const checks = [
+    { id: 'workspace.create', evaluate: v => v.effectiveRole === 'owner' },
+    // Server admin reads serverRole directly, not effectiveRole,
+    // since a workspace owner also resolves to an owner effectiveRole.
+    { id: 'server.admin', evaluate: v => v.user.serverRole === 'admin' },
+    { id: 'workspace.read', evaluate: v => v.effectiveRole !== null },
+    { id: 'workspace.write', evaluate: v => v.effectiveRole === 'owner' },
+    {
+        id: 'proposal.read',
+        evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
+    },
+    {
+        id: 'proposal.write',
+        evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
+    },
+    {
+        id: 'clarification.read',
+        evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
+    },
+    {
+        id: 'clarification.write',
+        evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
+    },
+    { id: 'history.write', evaluate: v => v.effectiveRole === 'owner' },
+    {
+        id: 'skill.run',
+        evaluate: (v) => {
+            const skill = v.resource?.skill;
+            const skillId = v.resource?.skillId;
+            if (!skill || !skillId)
+                return false;
+            if (v.effectiveRole === null)
+                return false;
+            if (v.effectiveRole === 'owner')
+                return true;
+            const override = v.member?.skillOverrides?.[skillId];
+            if (override)
+                return override === 'allow';
+            return skill.braid.allowedRoles.includes(v.effectiveRole);
+        },
+    },
+];
+//# sourceMappingURL=checks.js.map

package/dist/policy/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/policy/checks.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,MAAM,GAA+B;IAChD,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE;IACpE,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE;IACjE,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACrE;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACnE;QACE,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAA;YAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAA;YACnC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBACpB,OAAO,KAAK,CAAA;YACd,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI;gBAC1B,OAAO,KAAK,CAAA;YACd,IAAI,CAAC,CAAC,aAAa,KAAK,OAAO;gBAC7B,OAAO,IAAI,CAAA;YACb,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,OAA+C,CAAC,CAAA;YAC5F,IAAI,QAAQ;gBACV,OAAO,QAAQ,KAAK,OAAO,CAAA;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;QAC3D,CAAC;KACF;CACF,CAAA"}

package/dist/policy/defaultRegistry.d.ts

@@ -0,0 +1,9 @@
+import { PermissionRegistry } from './PermissionRegistry.js';
+/**
+ * Default registry preloaded with the first-party capabilities.
+ * Plugins register their own checks, calling `register()` on this instance.
+ * Tests build a fresh `PermissionRegistry` instead, to inject mocks.
+ */
+export declare function buildDefaultPermissionRegistry(): PermissionRegistry;
+export declare const defaultPermissionRegistry: PermissionRegistry;
+//# sourceMappingURL=defaultRegistry.d.ts.map

package/dist/policy/defaultRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultRegistry.d.ts","sourceRoot":"","sources":["../../src/policy/defaultRegistry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,kBAAkB,CAKnE;AAED,eAAO,MAAM,yBAAyB,oBAAmC,CAAA"}

package/dist/policy/defaultRegistry.js

@@ -0,0 +1,15 @@
+import { checks } from './checks.js';
+import { PermissionRegistry } from './PermissionRegistry.js';
+/**
+ * Default registry preloaded with the first-party capabilities.
+ * Plugins register their own checks, calling `register()` on this instance.
+ * Tests build a fresh `PermissionRegistry` instead, to inject mocks.
+ */
+export function buildDefaultPermissionRegistry() {
+    const registry = new PermissionRegistry();
+    for (const check of checks)
+        registry.register(check);
+    return registry;
+}
+export const defaultPermissionRegistry = buildDefaultPermissionRegistry();
+//# sourceMappingURL=defaultRegistry.js.map

package/dist/policy/defaultRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultRegistry.js","sourceRoot":"","sources":["../../src/policy/defaultRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;GAIG;AACH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM;QACxB,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC1B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,EAAE,CAAA"}

package/dist/policy/index.d.ts

@@ -0,0 +1,8 @@
+export type { CapabilityCheck } from './CapabilityCheck.js';
+export { buildDefaultPermissionRegistry, defaultPermissionRegistry } from './defaultRegistry.js';
+export { PermissionRegistry } from './PermissionRegistry.js';
+export { resolveViewer } from './resolveViewer.js';
+export type { ViewerContext, ViewerResource } from './ViewerContext.js';
+export type { Capability } from '@braidhq/schema';
+export { CAPABILITY_IDS } from '@braidhq/schema';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACvE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/policy/index.js

@@ -0,0 +1,5 @@
+export { buildDefaultPermissionRegistry, defaultPermissionRegistry } from './defaultRegistry.js';
+export { PermissionRegistry } from './PermissionRegistry.js';
+export { resolveViewer } from './resolveViewer.js';
+export { CAPABILITY_IDS } from '@braidhq/schema';
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAGlD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/policy/resolveViewer.d.ts

@@ -0,0 +1,16 @@
+import type { User, WorkspaceMember } from '@braidhq/schema';
+import type { ViewerContext, ViewerResource } from './ViewerContext.js';
+/**
+ * The sole place server-admin promotion happens. Every other layer,
+ * including middleware, capability checks, and the Studio mirror,
+ * consumes the resulting `effectiveRole` and never re-derives it.
+ *
+ * Resolution runs in order:
+ *   1. An admin serverRole yields an owner effectiveRole.
+ *      The stored member.role, if any, stays on `member` for display,
+ *      yet gates ignore it.
+ *   2. A present member yields effectiveRole = member.role.
+ *   3. Otherwise effectiveRole is null, meaning no access.
+ */
+export declare function resolveViewer(user: User, member: WorkspaceMember | undefined, resource?: ViewerResource): ViewerContext;
+//# sourceMappingURL=resolveViewer.d.ts.map

package/dist/policy/resolveViewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveViewer.d.ts","sourceRoot":"","sources":["../../src/policy/resolveViewer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEvE;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,QAAQ,CAAC,EAAE,cAAc,GACxB,aAAa,CAuBf"}

package/dist/policy/resolveViewer.js

@@ -0,0 +1,37 @@
+/**
+ * The sole place server-admin promotion happens. Every other layer,
+ * including middleware, capability checks, and the Studio mirror,
+ * consumes the resulting `effectiveRole` and never re-derives it.
+ *
+ * Resolution runs in order:
+ *   1. An admin serverRole yields an owner effectiveRole.
+ *      The stored member.role, if any, stays on `member` for display,
+ *      yet gates ignore it.
+ *   2. A present member yields effectiveRole = member.role.
+ *   3. Otherwise effectiveRole is null, meaning no access.
+ */
+export function resolveViewer(user, member, resource) {
+    if (user.serverRole === 'admin') {
+        return {
+            user,
+            member,
+            effectiveRole: 'owner',
+            ...(resource ? { resource } : {}),
+        };
+    }
+    if (member) {
+        return {
+            user,
+            member,
+            effectiveRole: member.role,
+            ...(resource ? { resource } : {}),
+        };
+    }
+    return {
+        user,
+        member: undefined,
+        effectiveRole: null,
+        ...(resource ? { resource } : {}),
+    };
+}
+//# sourceMappingURL=resolveViewer.js.map

package/dist/policy/resolveViewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveViewer.js","sourceRoot":"","sources":["../../src/policy/resolveViewer.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAU,EACV,MAAmC,EACnC,QAAyB;IAEzB,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO;YACL,IAAI;YACJ,MAAM;YACN,aAAa,EAAE,OAAO;YACtB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAA;IACH,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI;YACJ,MAAM;YACN,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAA;IACH,CAAC;IACD,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,SAAS;QACjB,aAAa,EAAE,IAAI;QACnB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC"}

package/dist/routes/_shared.d.ts

@@ -0,0 +1,138 @@
+import { z } from '@hono/zod-openapi';
+export declare const WorkspaceIdParam: z.ZodObject<{
+    workspaceId: z.core.$ZodBranded<z.ZodString, "WorkspaceId", "out">;
+}, z.core.$strip>;
+export declare const ProblemJsonResponseContent: {
+    'application/problem+json': {
+        schema: z.ZodObject<{
+            type: z.ZodString;
+            title: z.ZodString;
+            status: z.ZodNumber;
+            code: z.ZodEnum<{
+                "BRAID-VALIDATION": "BRAID-VALIDATION";
+                "BRAID-UNAUTHORIZED": "BRAID-UNAUTHORIZED";
+                "BRAID-NOT-FOUND": "BRAID-NOT-FOUND";
+                "BRAID-CONFLICT": "BRAID-CONFLICT";
+                "BRAID-FORBIDDEN": "BRAID-FORBIDDEN";
+                "BRAID-UNAVAILABLE": "BRAID-UNAVAILABLE";
+                "BRAID-INTERNAL": "BRAID-INTERNAL";
+            }>;
+            detail: z.ZodOptional<z.ZodString>;
+            issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                code: z.core.$ZodBranded<z.ZodString, "ValidationCode", "out">;
+                severity: z.ZodEnum<{
+                    error: "error";
+                    warning: "warning";
+                    info: "info";
+                }>;
+                message: z.ZodString;
+                nodeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "NodeId", "out">>;
+                edgeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "EdgeId", "out">>;
+                path: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>;
+    };
+};
+export declare const NotFoundResponse: {
+    readonly description: "The requested entity does not exist.";
+    readonly content: {
+        'application/problem+json': {
+            schema: z.ZodObject<{
+                type: z.ZodString;
+                title: z.ZodString;
+                status: z.ZodNumber;
+                code: z.ZodEnum<{
+                    "BRAID-VALIDATION": "BRAID-VALIDATION";
+                    "BRAID-UNAUTHORIZED": "BRAID-UNAUTHORIZED";
+                    "BRAID-NOT-FOUND": "BRAID-NOT-FOUND";
+                    "BRAID-CONFLICT": "BRAID-CONFLICT";
+                    "BRAID-FORBIDDEN": "BRAID-FORBIDDEN";
+                    "BRAID-UNAVAILABLE": "BRAID-UNAVAILABLE";
+                    "BRAID-INTERNAL": "BRAID-INTERNAL";
+                }>;
+                detail: z.ZodOptional<z.ZodString>;
+                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    code: z.core.$ZodBranded<z.ZodString, "ValidationCode", "out">;
+                    severity: z.ZodEnum<{
+                        error: "error";
+                        warning: "warning";
+                        info: "info";
+                    }>;
+                    message: z.ZodString;
+                    nodeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "NodeId", "out">>;
+                    edgeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "EdgeId", "out">>;
+                    path: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>;
+        };
+    };
+};
+export declare const ForbiddenResponse: {
+    readonly description: "The caller lacks permission for this action.";
+    readonly content: {
+        'application/problem+json': {
+            schema: z.ZodObject<{
+                type: z.ZodString;
+                title: z.ZodString;
+                status: z.ZodNumber;
+                code: z.ZodEnum<{
+                    "BRAID-VALIDATION": "BRAID-VALIDATION";
+                    "BRAID-UNAUTHORIZED": "BRAID-UNAUTHORIZED";
+                    "BRAID-NOT-FOUND": "BRAID-NOT-FOUND";
+                    "BRAID-CONFLICT": "BRAID-CONFLICT";
+                    "BRAID-FORBIDDEN": "BRAID-FORBIDDEN";
+                    "BRAID-UNAVAILABLE": "BRAID-UNAVAILABLE";
+                    "BRAID-INTERNAL": "BRAID-INTERNAL";
+                }>;
+                detail: z.ZodOptional<z.ZodString>;
+                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    code: z.core.$ZodBranded<z.ZodString, "ValidationCode", "out">;
+                    severity: z.ZodEnum<{
+                        error: "error";
+                        warning: "warning";
+                        info: "info";
+                    }>;
+                    message: z.ZodString;
+                    nodeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "NodeId", "out">>;
+                    edgeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "EdgeId", "out">>;
+                    path: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>;
+        };
+    };
+};
+export declare const ValidationFailureResponse: {
+    readonly description: "Request body or query failed validation.";
+    readonly content: {
+        'application/problem+json': {
+            schema: z.ZodObject<{
+                type: z.ZodString;
+                title: z.ZodString;
+                status: z.ZodNumber;
+                code: z.ZodEnum<{
+                    "BRAID-VALIDATION": "BRAID-VALIDATION";
+                    "BRAID-UNAUTHORIZED": "BRAID-UNAUTHORIZED";
+                    "BRAID-NOT-FOUND": "BRAID-NOT-FOUND";
+                    "BRAID-CONFLICT": "BRAID-CONFLICT";
+                    "BRAID-FORBIDDEN": "BRAID-FORBIDDEN";
+                    "BRAID-UNAVAILABLE": "BRAID-UNAVAILABLE";
+                    "BRAID-INTERNAL": "BRAID-INTERNAL";
+                }>;
+                detail: z.ZodOptional<z.ZodString>;
+                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    code: z.core.$ZodBranded<z.ZodString, "ValidationCode", "out">;
+                    severity: z.ZodEnum<{
+                        error: "error";
+                        warning: "warning";
+                        info: "info";
+                    }>;
+                    message: z.ZodString;
+                    nodeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "NodeId", "out">>;
+                    edgeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "EdgeId", "out">>;
+                    path: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>;
+        };
+    };
+};
+//# sourceMappingURL=_shared.d.ts.map

package/dist/routes/_shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_shared.d.ts","sourceRoot":"","sources":["../../src/routes/_shared.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAErC,eAAO,MAAM,gBAAgB;;iBAK3B,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAEtC,CAAA;AAED,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGnB,CAAA;AAEV,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGpB,CAAA;AAEV,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAG5B,CAAA"}

package/dist/routes/_shared.js

@@ -0,0 +1,33 @@
+/**
+ * Shared OpenAPI building blocks used across workspace-scoped routes.
+ *
+ * Path parameters on parent app.route() mounts do not merge,
+ * into a child route's OpenAPI definitions.
+ * So each route under `/workspaces/:workspaceId/*` must re-declare it,
+ * naming `workspaceId` in its own `request.params`.
+ * Use `WorkspaceIdParam` to keep the declaration consistent.
+ */
+import { BraidProblemJson, WorkspaceId } from '@braidhq/schema';
+import { z } from '@hono/zod-openapi';
+export const WorkspaceIdParam = z.object({
+    workspaceId: WorkspaceId.openapi({
+        param: { name: 'workspaceId', in: 'path' },
+        example: 'my-workspace',
+    }),
+});
+export const ProblemJsonResponseContent = {
+    'application/problem+json': { schema: BraidProblemJson },
+};
+export const NotFoundResponse = {
+    description: 'The requested entity does not exist.',
+    content: ProblemJsonResponseContent,
+};
+export const ForbiddenResponse = {
+    description: 'The caller lacks permission for this action.',
+    content: ProblemJsonResponseContent,
+};
+export const ValidationFailureResponse = {
+    description: 'Request body or query failed validation.',
+    content: ProblemJsonResponseContent,
+};
+//# sourceMappingURL=_shared.js.map

package/dist/routes/_shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_shared.js","sourceRoot":"","sources":["../../src/routes/_shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAErC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE;QAC1C,OAAO,EAAE,cAAc;KACxB,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,0BAA0B,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;CACzD,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,sCAAsC;IACnD,OAAO,EAAE,0BAA0B;CAC3B,CAAA;AAEV,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,8CAA8C;IAC3D,OAAO,EAAE,0BAA0B;CAC3B,CAAA;AAEV,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,WAAW,EAAE,0CAA0C;IACvD,OAAO,EAAE,0BAA0B;CAC3B,CAAA"}

package/dist/routes/admin.d.ts

@@ -0,0 +1,13 @@
+import type { WorkspaceService } from '@braidhq/core';
+import type { AccessPolicy } from '../infrastructure/auth/AccessPolicy.js';
+import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
+import type { WorkspaceRegistryFile } from '../infrastructure/workspace/WorkspaceRegistryFile.js';
+import { OpenAPIHono } from '@hono/zod-openapi';
+export interface AdminRouterDeps {
+    userRegistry: UserRegistryFile;
+    accessPolicy: AccessPolicy;
+    workspaceRegistry: WorkspaceRegistryFile;
+    workspaceService: WorkspaceService;
+}
+export declare function createAdminRouter(deps: AdminRouterDeps): OpenAPIHono;
+//# sourceMappingURL=admin.d.ts.map

package/dist/routes/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAA;AAGjG,OAAO,EAAe,WAAW,EAAK,MAAM,mBAAmB,CAAA;AA6C/D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,gBAAgB,CAAA;IAC9B,YAAY,EAAE,YAAY,CAAA;IAC1B,iBAAiB,EAAE,qBAAqB,CAAA;IACxC,gBAAgB,EAAE,gBAAgB,CAAA;CACnC;AAqHD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CA2FpE"}