@braidhq/server 0.0.1

package/dist/infrastructure/oauth/GoogleOAuth.d.ts

@@ -0,0 +1,60 @@
+export interface GoogleOAuthConfig {
+    /** OAuth client id from the user's GCP project. */
+    readonly clientId: string;
+    /** OAuth client secret. */
+    readonly clientSecret: string;
+    /** Absolute redirect URI registered in the GCP OAuth client. */
+    readonly redirectUri: string;
+}
+export interface AuthorizationUrlInput {
+    /** OAuth scope(s) requested. Braid passes Drive read-only. */
+    readonly scopes: readonly string[];
+    /** State token (CSRF + flow-restore). */
+    readonly state: string;
+    /** PKCE verifier; the URL embeds its SHA-256 challenge. */
+    readonly codeVerifier: string;
+}
+export interface TokenSet {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly expiresAt: string;
+    readonly scope: string;
+    readonly tokenType: string;
+}
+export interface RefreshedAccessToken {
+    readonly accessToken: string;
+    readonly expiresAt: string;
+}
+/**
+ * Minimal Google OAuth 2.0 client for installed-app / web flow.
+ *
+ * Why not `openid-client` or `google-auth-library`: we only need 4 calls
+ * (build URL, exchange code, refresh, revoke); avoiding a heavyweight
+ * dependency keeps the server's install footprint small and the auth
+ * surface auditable.
+ */
+export declare class GoogleOAuth {
+    private readonly config;
+    constructor(config: GoogleOAuthConfig);
+    /**
+     * Build the URL the user's browser is sent to. `state` and `codeVerifier`
+     * MUST be unique per flow; the caller stores them in pending-state until
+     * the callback arrives.
+     */
+    buildAuthorizationUrl(input: AuthorizationUrlInput): string;
+    exchangeCode(input: {
+        code: string;
+        codeVerifier: string;
+    }): Promise<TokenSet>;
+    refreshAccessToken(refreshToken: string): Promise<RefreshedAccessToken>;
+}
+/**
+ * Helper for callers: produce a fresh PKCE verifier (32 bytes, base64url).
+ * Caller stashes alongside the `state` token until the callback returns.
+ */
+export declare function createPkceVerifier(): string;
+/**
+ * CSRF state token. Random 16 bytes, opaque to Google.
+ */
+export declare function createOAuthState(): string;
+//# sourceMappingURL=GoogleOAuth.d.ts.map

package/dist/infrastructure/oauth/GoogleOAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleOAuth.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/oauth/GoogleOAuth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;OAIG;IACH,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM;IAgBrD,YAAY,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IA2B9E,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAsB9E;AA4BD;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC"}

package/dist/infrastructure/oauth/GoogleOAuth.js

@@ -0,0 +1,114 @@
+import { createHash, randomBytes } from 'node:crypto';
+const AUTH_ENDPOINT = 'https://accounts.google.com/o/oauth2/v2/auth';
+const TOKEN_ENDPOINT = 'https://oauth2.googleapis.com/token';
+/**
+ * Minimal Google OAuth 2.0 client for installed-app / web flow.
+ *
+ * Why not `openid-client` or `google-auth-library`: we only need 4 calls
+ * (build URL, exchange code, refresh, revoke); avoiding a heavyweight
+ * dependency keeps the server's install footprint small and the auth
+ * surface auditable.
+ */
+export class GoogleOAuth {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Build the URL the user's browser is sent to. `state` and `codeVerifier`
+     * MUST be unique per flow; the caller stores them in pending-state until
+     * the callback arrives.
+     */
+    buildAuthorizationUrl(input) {
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            response_type: 'code',
+            scope: input.scopes.join(' '),
+            access_type: 'offline', // → refresh_token in response
+            prompt: 'consent', // ensure refresh_token even on re-auth
+            include_granted_scopes: 'true',
+            state: input.state,
+            code_challenge: pkceChallenge(input.codeVerifier),
+            code_challenge_method: 'S256',
+        });
+        return `${AUTH_ENDPOINT}?${params.toString()}`;
+    }
+    async exchangeCode(input) {
+        const body = new URLSearchParams({
+            client_id: this.config.clientId,
+            client_secret: this.config.clientSecret,
+            redirect_uri: this.config.redirectUri,
+            grant_type: 'authorization_code',
+            code: input.code,
+            code_verifier: input.codeVerifier,
+        });
+        const response = await fetch(TOKEN_ENDPOINT, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body,
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`Google token exchange failed: ${response.status} ${response.statusText} ${text}`);
+        }
+        const payload = await response.json();
+        if (!payload.refresh_token) {
+            // Google only returns refresh_token on first consent. If we don't have
+            // one, the caller can't store anything useful for next time.
+            throw new Error('Google did not return a refresh_token. Add prompt=consent and ensure access_type=offline.');
+        }
+        return tokenSetFromPayload(payload);
+    }
+    async refreshAccessToken(refreshToken) {
+        const body = new URLSearchParams({
+            client_id: this.config.clientId,
+            client_secret: this.config.clientSecret,
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+        });
+        const response = await fetch(TOKEN_ENDPOINT, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body,
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`Google token refresh failed: ${response.status} ${response.statusText} ${text}`);
+        }
+        const payload = await response.json();
+        return {
+            accessToken: payload.access_token,
+            expiresAt: secondsFromNow(payload.expires_in).toISOString(),
+        };
+    }
+}
+function tokenSetFromPayload(p) {
+    return {
+        accessToken: p.access_token,
+        refreshToken: p.refresh_token,
+        expiresAt: secondsFromNow(p.expires_in).toISOString(),
+        scope: p.scope,
+        tokenType: p.token_type,
+    };
+}
+function secondsFromNow(seconds) {
+    return new Date(Date.now() + seconds * 1000);
+}
+function pkceChallenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+/**
+ * Helper for callers: produce a fresh PKCE verifier (32 bytes, base64url).
+ * Caller stashes alongside the `state` token until the callback returns.
+ */
+export function createPkceVerifier() {
+    return randomBytes(32).toString('base64url');
+}
+/**
+ * CSRF state token. Random 16 bytes, opaque to Google.
+ */
+export function createOAuthState() {
+    return randomBytes(16).toString('base64url');
+}
+//# sourceMappingURL=GoogleOAuth.js.map

package/dist/infrastructure/oauth/GoogleOAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleOAuth.js","sourceRoot":"","sources":["../../../src/infrastructure/oauth/GoogleOAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErD,MAAM,aAAa,GAAG,8CAA8C,CAAA;AACpE,MAAM,cAAc,GAAG,qCAAqC,CAAA;AAiC5D;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAE1D;;;;OAIG;IACH,qBAAqB,CAAC,KAA4B;QAChD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,WAAW,EAAE,SAAS,EAAE,8BAA8B;YACtD,MAAM,EAAE,SAAS,EAAE,uCAAuC;YAC1D,sBAAsB,EAAE,MAAM;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;YACjD,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAA;QACF,OAAO,GAAG,aAAa,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6C;QAC9D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACpG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAA;QACzD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAA;QAC9G,CAAC;QACD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAClD,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAA;QACzD,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,YAAY;YACjC,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;SAC5D,CAAA;IACH,CAAC;CACF;AAUD,SAAS,mBAAmB,CAAC,CAAmB;IAC9C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,YAAY,EAAE,CAAC,CAAC,aAAc;QAC9B,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QACrD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC"}

package/dist/infrastructure/orphanReaper.d.ts

@@ -0,0 +1,18 @@
+import type { Clock, RunRepository, WorkspaceRepository } from '@braidhq/core';
+/**
+ * Run records survive across server restarts, but the subprocess that was
+ * driving each run does not. On startup any run without a `completedAt`
+ * timestamp is an orphan: nobody is going to drain its events. We tag those
+ * with a synthetic `error` event so the UI can show why the transcript is
+ * truncated, and a `completed` event so the run leaves the active list.
+ *
+ * Idempotent: runs that are already marked completed are skipped.
+ */
+export declare function reapOrphanRuns(deps: {
+    workspaceRepository: WorkspaceRepository;
+    runRepository: RunRepository;
+    clock: Clock;
+}): Promise<{
+    reaped: number;
+}>;
+//# sourceMappingURL=orphanReaper.d.ts.map

package/dist/infrastructure/orphanReaper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orphanReaper.d.ts","sourceRoot":"","sources":["../../src/infrastructure/orphanReaper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAG9E;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,aAAa,EAAE,aAAa,CAAA;IAC5B,KAAK,EAAE,KAAK,CAAA;CACb,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B9B"}

package/dist/infrastructure/orphanReaper.js

@@ -0,0 +1,42 @@
+/**
+ * Run records survive across server restarts, but the subprocess that was
+ * driving each run does not. On startup any run without a `completedAt`
+ * timestamp is an orphan: nobody is going to drain its events. We tag those
+ * with a synthetic `error` event so the UI can show why the transcript is
+ * truncated, and a `completed` event so the run leaves the active list.
+ *
+ * Idempotent: runs that are already marked completed are skipped.
+ */
+export async function reapOrphanRuns(deps) {
+    const workspaces = await deps.workspaceRepository.list();
+    let reaped = 0;
+    for (const workspace of workspaces) {
+        const records = await deps.runRepository.listRecords(workspace);
+        for (const record of records) {
+            if (record.completedAt !== undefined)
+                continue;
+            const at = deps.clock.now();
+            const error = {
+                type: 'error',
+                message: 'Run aborted: server restarted before the subprocess finished.',
+                at,
+            };
+            const completed = {
+                type: 'completed',
+                runId: record.runId,
+                exitCode: -1,
+                at,
+            };
+            await deps.runRepository.appendEvent(workspace, record.runId, error);
+            await deps.runRepository.appendEvent(workspace, record.runId, completed);
+            await deps.runRepository.saveRecord(workspace, {
+                ...record,
+                completedAt: at,
+                exitCode: -1,
+            });
+            reaped++;
+        }
+    }
+    return { reaped };
+}
+//# sourceMappingURL=orphanReaper.js.map

package/dist/infrastructure/orphanReaper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orphanReaper.js","sourceRoot":"","sources":["../../src/infrastructure/orphanReaper.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAIpC;IACC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAA;IACxD,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAC/D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;gBAClC,SAAQ;YACV,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;YAC3B,MAAM,KAAK,GAAe;gBACxB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,+DAA+D;gBACxE,EAAE;aACH,CAAA;YACD,MAAM,SAAS,GAAe;gBAC5B,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,CAAC,CAAC;gBACZ,EAAE;aACH,CAAA;YACD,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YACpE,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YACxE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,EAAE;gBAC7C,GAAG,MAAM;gBACT,WAAW,EAAE,EAAE;gBACf,QAAQ,EAAE,CAAC,CAAC;aACb,CAAC,CAAA;YACF,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAA;AACnB,CAAC"}

package/dist/infrastructure/secrets/SecretStore.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Per-scope JSON secret storage on the local filesystem. One file per
+ * `(namespace, key)` under `<root>/<namespace>/<key>.json`. Files are
+ * written with mode 0600 so only the running user can read them; the
+ * containing directory is mode 0700.
+ *
+ * This is NOT an encrypted-at-rest store. It's appropriate for local /
+ * single-user Braid installs (the OSS target). A hosted SaaS deployment
+ * would swap this for a vault adapter (AWS Secrets Manager, Vault, …)
+ * by implementing the same interface.
+ *
+ * Layout:
+ *   <root>/
+ *     oauth-google/
+ *       <workspaceId>--<sourceId>.json  # one set of tokens per source
+ *     oauth-github/
+ *       <workspaceId>--<sourceId>.json
+ */
+export interface SecretRecord {
+    readonly value: unknown;
+    readonly updatedAt: string;
+}
+export interface SecretStore {
+    read: <T>(namespace: string, key: string) => Promise<T | undefined>;
+    write: (namespace: string, key: string, value: unknown) => Promise<void>;
+    delete: (namespace: string, key: string) => Promise<void>;
+}
+export declare class FsSecretStore implements SecretStore {
+    private readonly root;
+    constructor(root: string);
+    read<T>(namespace: string, key: string): Promise<T | undefined>;
+    write(namespace: string, key: string, value: unknown): Promise<void>;
+    delete(namespace: string, key: string): Promise<void>;
+    private pathFor;
+}
+//# sourceMappingURL=SecretStore.d.ts.map

package/dist/infrastructure/secrets/SecretStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/secrets/SecretStore.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IACnE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED,qBAAa,aAAc,YAAW,WAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAEnC,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAc/D,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3D,OAAO,CAAC,OAAO;CAGhB"}

package/dist/infrastructure/secrets/SecretStore.js

@@ -0,0 +1,44 @@
+import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+export class FsSecretStore {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    async read(namespace, key) {
+        const path = this.pathFor(namespace, key);
+        try {
+            const raw = await readFile(path, 'utf-8');
+            const record = JSON.parse(raw);
+            return record.value;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+    }
+    async write(namespace, key, value) {
+        const path = this.pathFor(namespace, key);
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        const record = { value, updatedAt: new Date().toISOString() };
+        await writeFile(path, JSON.stringify(record, null, 2), { encoding: 'utf-8', mode: 0o600 });
+        // mkdir's mode arg is ignored on some platforms; explicitly chmod the
+        // dir + file to keep the perms stable across reboots / restores.
+        await chmod(dirname(path), 0o700);
+        await chmod(path, 0o600);
+    }
+    async delete(namespace, key) {
+        const path = this.pathFor(namespace, key);
+        await rm(path, { force: true });
+    }
+    pathFor(namespace, key) {
+        return join(this.root, sanitize(namespace), `${sanitize(key)}.json`);
+    }
+}
+// Conservative: only ASCII letters / digits / `-`, `_`, `.`. Anything else
+// is replaced with `_` so a hostile workspaceId can't escape the dir.
+function sanitize(input) {
+    return input.replace(/[^\w.-]/g, '_');
+}
+//# sourceMappingURL=SecretStore.js.map

package/dist/infrastructure/secrets/SecretStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretStore.js","sourceRoot":"","sources":["../../../src/infrastructure/secrets/SecretStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AA+BzC,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,IAAI,CAAI,SAAiB,EAAE,GAAW;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAA;YAC9C,OAAO,MAAM,CAAC,KAAU,CAAA;QAC1B,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,SAAS,CAAA;YAClB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,GAAW,EAAE,KAAc;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;QAC3E,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1F,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAA;QACjC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,GAAW;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;IAEO,OAAO,CAAC,SAAiB,EAAE,GAAW;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtE,CAAC;CACF;AAED,2EAA2E;AAC3E,sEAAsE;AACtE,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;AACvC,CAAC"}

package/dist/middleware/cors.d.ts

@@ -0,0 +1,11 @@
+import type { MiddlewareHandler } from 'hono';
+export interface CorsOptions {
+    readonly allowedOrigins?: readonly string[];
+}
+/**
+ * Permissive CORS for Studio dev / Tier 1 (Tauri embedded server).
+ * Origins default to Vite dev server ports. In production deployments,
+ * pass the actual studio origin list explicitly.
+ */
+export declare function corsMiddleware(options?: CorsOptions): MiddlewareHandler;
+//# sourceMappingURL=cors.d.ts.map

package/dist/middleware/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAQ7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,WAAgB,GAAG,iBAAiB,CAkB3E"}

package/dist/middleware/cors.js

@@ -0,0 +1,30 @@
+const DEFAULT_DEV_ORIGINS = [
+    'http://localhost:5173',
+    'http://localhost:4173',
+    'http://127.0.0.1:5173',
+];
+/**
+ * Permissive CORS for Studio dev / Tier 1 (Tauri embedded server).
+ * Origins default to Vite dev server ports. In production deployments,
+ * pass the actual studio origin list explicitly.
+ */
+export function corsMiddleware(options = {}) {
+    const allowed = new Set(options.allowedOrigins ?? DEFAULT_DEV_ORIGINS);
+    return async (context, next) => {
+        const origin = context.req.header('Origin');
+        if (origin && allowed.has(origin)) {
+            context.header('Access-Control-Allow-Origin', origin);
+            context.header('Access-Control-Allow-Credentials', 'true');
+            context.header('Vary', 'Origin');
+        }
+        if (context.req.method === 'OPTIONS') {
+            context.header('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
+            context.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+            context.header('Access-Control-Max-Age', '86400');
+            return context.body(null, 204);
+        }
+        await next();
+        return undefined;
+    };
+}
+//# sourceMappingURL=cors.js.map

package/dist/middleware/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAEA,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;CACxB,CAAA;AAMD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAuB,EAAE;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,CAAA;IACtE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;YACrD,OAAO,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YAC1D,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAA;YACxF,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAA;YAC7E,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YACjD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC"}

package/dist/middleware/error.d.ts

@@ -0,0 +1,3 @@
+import type { ErrorHandler } from 'hono';
+export declare const errorHandler: ErrorHandler;
+//# sourceMappingURL=error.d.ts.map

package/dist/middleware/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/middleware/error.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAA;AA+CxC,eAAO,MAAM,YAAY,EAAE,YAkB1B,CAAA"}

package/dist/middleware/error.js

@@ -0,0 +1,52 @@
+import { BraidError, ConflictError, NotFoundError, ValidationError, } from '@braidhq/core';
+import { ZodError } from 'zod';
+const PROBLEM_BASE_URL = 'https://braid.dev/errors';
+function statusFor(error) {
+    if (error instanceof ValidationError)
+        return 400;
+    if (error instanceof NotFoundError)
+        return 404;
+    if (error instanceof ConflictError)
+        return 409;
+    return 500;
+}
+function problemFromBraidError(error) {
+    const problem = {
+        type: `${PROBLEM_BASE_URL}/${error.code.toLowerCase()}`,
+        title: error.name,
+        status: statusFor(error),
+        code: error.code,
+        detail: error.message,
+    };
+    if (error instanceof ValidationError && error.issues)
+        problem.issues = [...error.issues];
+    return problem;
+}
+function problemFromZodError(error) {
+    return {
+        type: `${PROBLEM_BASE_URL}/braid-val`,
+        title: 'ValidationError',
+        status: 400,
+        code: 'BRAID-VAL',
+        detail: error.issues.map(issue => `${issue.path.join('.')}: ${issue.message}`).join('; '),
+    };
+}
+const PROBLEM_JSON_HEADERS = { 'Content-Type': 'application/problem+json' };
+export const errorHandler = (error, context) => {
+    if (error instanceof BraidError) {
+        const problem = problemFromBraidError(error);
+        return context.json(problem, problem.status, PROBLEM_JSON_HEADERS);
+    }
+    if (error instanceof ZodError) {
+        const problem = problemFromZodError(error);
+        return context.json(problem, problem.status, PROBLEM_JSON_HEADERS);
+    }
+    return context.json({
+        type: `${PROBLEM_BASE_URL}/internal`,
+        title: 'InternalError',
+        status: 500,
+        code: 'BRAID-INTERNAL',
+        detail: error instanceof Error ? error.message : 'unknown error',
+    }, 500, PROBLEM_JSON_HEADERS);
+};
+//# sourceMappingURL=error.js.map

package/dist/middleware/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/middleware/error.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAA;AAE9B,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAEnD,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,KAAK,YAAY,eAAe;QAClC,OAAO,GAAG,CAAA;IACZ,IAAI,KAAK,YAAY,aAAa;QAChC,OAAO,GAAG,CAAA;IACZ,IAAI,KAAK,YAAY,aAAa;QAChC,OAAO,GAAG,CAAA;IACZ,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAiB;IAC9C,MAAM,OAAO,GAAqB;QAChC,IAAI,EAAE,GAAG,gBAAgB,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAA8B;QACnF,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,OAAO;KACtB,CAAA;IACD,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM;QAClD,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IACpC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe;IAC1C,OAAO;QACL,IAAI,EAAE,GAAG,gBAAgB,YAAwC;QACjE,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KAC1F,CAAA;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,EAAE,cAAc,EAAE,0BAA0B,EAAW,CAAA;AAEpF,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC3D,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,GAAG,gBAAgB,WAAW;QACpC,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KACjE,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAA;AAC/B,CAAC,CAAA"}

package/dist/middleware/workspaceId.d.ts

@@ -0,0 +1,10 @@
+import type { WorkspaceId as WorkspaceIdType } from '@braidhq/schema';
+import type { Context, MiddlewareHandler } from 'hono';
+declare module 'hono' {
+    interface ContextVariableMap {
+        workspaceId: WorkspaceIdType;
+    }
+}
+export declare const workspaceIdMiddleware: MiddlewareHandler;
+export declare function getWorkspaceId(context: Context): WorkspaceIdType;
+//# sourceMappingURL=workspaceId.d.ts.map

package/dist/middleware/workspaceId.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceId.d.ts","sourceRoot":"","sources":["../../src/middleware/workspaceId.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACrE,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAGtD,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,WAAW,EAAE,eAAe,CAAA;KAC7B;CACF;AAED,eAAO,MAAM,qBAAqB,EAAE,iBAGnC,CAAA;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CAEhE"}

package/dist/middleware/workspaceId.js

@@ -0,0 +1,9 @@
+import { WorkspaceId } from '@braidhq/schema';
+export const workspaceIdMiddleware = async (context, next) => {
+    context.set('workspaceId', WorkspaceId.parse(context.req.param('workspaceId')));
+    await next();
+};
+export function getWorkspaceId(context) {
+    return context.get('workspaceId');
+}
+//# sourceMappingURL=workspaceId.js.map

package/dist/middleware/workspaceId.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceId.js","sourceRoot":"","sources":["../../src/middleware/workspaceId.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAQ7C,MAAM,CAAC,MAAM,qBAAqB,GAAsB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9E,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IAC/E,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CAAA;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;AACnC,CAAC"}

package/dist/routes/clarify.d.ts

@@ -0,0 +1,8 @@
+import type { ClarifyTicketRepository, HITLService } from '@braidhq/core';
+import { Hono } from 'hono';
+export interface ClarifyRouterDeps {
+    hitlService: HITLService;
+    clarifyRepository: ClarifyTicketRepository;
+}
+export declare function createClarifyRouter(deps: ClarifyRouterDeps): Hono;
+//# sourceMappingURL=clarify.d.ts.map

package/dist/routes/clarify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clarify.d.ts","sourceRoot":"","sources":["../../src/routes/clarify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAGzE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AA4B3B,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,WAAW,CAAA;IACxB,iBAAiB,EAAE,uBAAuB,CAAA;CAC3C;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA6EjE"}

package/dist/routes/clarify.js

@@ -0,0 +1,84 @@
+import { ClarifyCandidateId, ClarifyDraft, ClarifyStatus, ClarifyTicketId, ProposalId, UserId } from '@braidhq/schema';
+import { zValidator } from '@hono/zod-validator';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { getWorkspaceId } from '../middleware/workspaceId.js';
+import { assertEntityInWorkspace } from './helpers.js';
+const ListQuerySchema = z.object({
+    status: z.union([ClarifyStatus, z.array(ClarifyStatus)]).optional(),
+    limit: z.coerce.number().int().positive().optional(),
+    offset: z.coerce.number().int().nonnegative().optional(),
+});
+const AnswerBodySchema = z.object({
+    candidateId: ClarifyCandidateId,
+    userId: UserId,
+});
+const SkipBodySchema = z.object({
+    reason: z.string().min(1),
+    userId: UserId,
+});
+const LinkProposalBodySchema = z.object({
+    proposalId: ProposalId,
+    userId: UserId,
+});
+const CreateBodySchema = ClarifyDraft.omit({ workspaceId: true });
+export function createClarifyRouter(deps) {
+    const router = new Hono();
+    // Skill-facing create. Body is the ClarifyDraft minus workspaceId (taken
+    // from the URL). Candidates' proposedOperations are NOT validated here;
+    // they are validated when a user picks one via answerClarifyTicket.
+    router.post('/', zValidator('json', CreateBodySchema), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const body = context.req.valid('json');
+        const ticket = await deps.hitlService.submitClarifyTicket({ workspaceId, ...body });
+        return context.json(ticket.toData(), 201);
+    });
+    router.get('/', zValidator('query', ListQuerySchema), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const { status, limit, offset } = context.req.valid('query');
+        const statuses = status === undefined ? undefined : Array.isArray(status) ? status : [status];
+        const tickets = await deps.clarifyRepository.list({ workspaceId, statuses, limit, offset });
+        return context.json({ items: tickets.map(ticket => ticket.toData()) });
+    });
+    router.get('/:clarifyTicketId', async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const ticketId = ClarifyTicketId.parse(context.req.param('clarifyTicketId'));
+        const ticket = await deps.clarifyRepository.load(ticketId);
+        assertEntityInWorkspace(workspaceId, ticket.workspaceId, 'ClarifyTicket', ticketId);
+        return context.json(ticket.toData());
+    });
+    router.post('/:clarifyTicketId/answer', zValidator('json', AnswerBodySchema), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const ticketId = ClarifyTicketId.parse(context.req.param('clarifyTicketId'));
+        const { candidateId, userId } = context.req.valid('json');
+        const ticket = await deps.clarifyRepository.load(ticketId);
+        assertEntityInWorkspace(workspaceId, ticket.workspaceId, 'ClarifyTicket', ticketId);
+        const decision = await deps.hitlService.answerClarifyTicket(ticketId, candidateId, userId);
+        return context.json(decision);
+    });
+    // Skill-facing: the braid-clarify skill calls this once it has wrapped
+    // an `answered` ticket's resolution into a Proposal. Transitions the
+    // ticket `answered → applied` and stamps the linking proposalId so the
+    // UI can navigate from a ticket back to its Proposal. No graph
+    // mutation happens here; the Proposal apply already covered that.
+    router.patch('/:clarifyTicketId', zValidator('json', LinkProposalBodySchema), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const ticketId = ClarifyTicketId.parse(context.req.param('clarifyTicketId'));
+        const { proposalId, userId } = context.req.valid('json');
+        const ticket = await deps.clarifyRepository.load(ticketId);
+        assertEntityInWorkspace(workspaceId, ticket.workspaceId, 'ClarifyTicket', ticketId);
+        const decision = await deps.hitlService.linkClarifyTicketToProposal(ticketId, proposalId, userId);
+        return context.json(decision);
+    });
+    router.post('/:clarifyTicketId/skip', zValidator('json', SkipBodySchema), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const ticketId = ClarifyTicketId.parse(context.req.param('clarifyTicketId'));
+        const { reason, userId } = context.req.valid('json');
+        const ticket = await deps.clarifyRepository.load(ticketId);
+        assertEntityInWorkspace(workspaceId, ticket.workspaceId, 'ClarifyTicket', ticketId);
+        const decision = await deps.hitlService.skipClarifyTicket(ticketId, reason, userId);
+        return context.json(decision);
+    });
+    return router;
+}
+//# sourceMappingURL=clarify.js.map

package/dist/routes/clarify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clarify.js","sourceRoot":"","sources":["../../src/routes/clarify.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,kBAAkB;IAC/B,MAAM,EAAE,MAAM;CACf,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,MAAM;CACf,CAAC,CAAA;AAEF,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,UAAU,EAAE,UAAU;IACtB,MAAM,EAAE,MAAM;CACf,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;AAOjE,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IAEzB,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvE,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;QACnF,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtE,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC7F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3F,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1D,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAA;QACnF,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CACT,0BAA0B,EAC1B,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACpC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;QAC5E,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1D,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAA;QACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;QAC1F,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,CAAC,CACF,CAAA;IAED,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,+DAA+D;IAC/D,kEAAkE;IAClE,MAAM,CAAC,KAAK,CACV,mBAAmB,EACnB,UAAU,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAC1C,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;QAC5E,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1D,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAA;QACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,2BAA2B,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACjG,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,CAAC,CACF,CAAA;IAED,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,EAClC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;QAC5E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1D,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAA;QACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACnF,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,CAAC,CACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/decisions.d.ts

@@ -0,0 +1,7 @@
+import type { DecisionRepository } from '@braidhq/core';
+import { Hono } from 'hono';
+export interface DecisionsRouterDeps {
+    decisionRepository: DecisionRepository;
+}
+export declare function createDecisionsRouter(deps: DecisionsRouterDeps): Hono;
+//# sourceMappingURL=decisions.d.ts.map

package/dist/routes/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../../src/routes/decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAGvD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAW3B,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,EAAE,kBAAkB,CAAA;CACvC;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAoBrE"}