@braidhq/server 0.1.0 → 0.2.1

package/dist/middleware/error.js

@@ -1,20 +1,22 @@
-import { BraidError, ConflictError, NotFoundError, ValidationError, } from '@braidhq/core';
+import { BraidError, ValidationError } from '@braidhq/core';
 import { ZodError } from 'zod';
 const PROBLEM_BASE_URL = 'https://braid.dev/errors';
-function statusFor(error) {
-    if (error instanceof ValidationError)
-        return 400;
-    if (error instanceof NotFoundError)
-        return 404;
-    if (error instanceof ConflictError)
-        return 409;
-    return 500;
-}
+// The HTTP status per error code, keyed by the closed BraidErrorCode enum,
+// so a new code fails to compile until it is mapped here.
+const STATUS_BY_CODE = {
+    'BRAID-VALIDATION': 400,
+    'BRAID-UNAUTHORIZED': 401,
+    'BRAID-NOT-FOUND': 404,
+    'BRAID-CONFLICT': 409,
+    'BRAID-FORBIDDEN': 403,
+    'BRAID-UNAVAILABLE': 503,
+    'BRAID-INTERNAL': 500,
+};
 function problemFromBraidError(error) {
     const problem = {
         type: `${PROBLEM_BASE_URL}/${error.code.toLowerCase()}`,
         title: error.name,
-        status: statusFor(error),
+        status: STATUS_BY_CODE[error.code],
         code: error.code,
         detail: error.message,
     };
@@ -24,10 +26,10 @@ function problemFromBraidError(error) {
 }
 function problemFromZodError(error) {
     return {
-        type: `${PROBLEM_BASE_URL}/braid-val`,
+        type: `${PROBLEM_BASE_URL}/braid-validation`,
         title: 'ValidationError',
         status: 400,
-        code: 'BRAID-VAL',
+        code: 'BRAID-VALIDATION',
         detail: error.issues.map(issue => `${issue.path.join('.')}: ${issue.message}`).join('; '),
     };
 }

package/dist/middleware/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/middleware/error.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAA;AAE9B,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAEnD,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,KAAK,YAAY,eAAe;QAClC,OAAO,GAAG,CAAA;IACZ,IAAI,KAAK,YAAY,aAAa;QAChC,OAAO,GAAG,CAAA;IACZ,IAAI,KAAK,YAAY,aAAa;QAChC,OAAO,GAAG,CAAA;IACZ,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAiB;IAC9C,MAAM,OAAO,GAAqB;QAChC,IAAI,EAAE,GAAG,gBAAgB,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAA8B;QACnF,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,OAAO;KACtB,CAAA;IACD,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM;QAClD,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IACpC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe;IAC1C,OAAO;QACL,IAAI,EAAE,GAAG,gBAAgB,YAAwC;QACjE,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KAC1F,CAAA;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,EAAE,cAAc,EAAE,0BAA0B,EAAW,CAAA;AAEpF,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC3D,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,GAAG,gBAAgB,WAAW;QACpC,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KACjE,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAA;AAC/B,CAAC,CAAA"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/middleware/error.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAA;AAE9B,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAEnD,2EAA2E;AAC3E,0DAA0D;AAC1D,MAAM,cAAc,GAAmC;IACrD,kBAAkB,EAAE,GAAG;IACvB,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,gBAAgB,EAAE,GAAG;IACrB,iBAAiB,EAAE,GAAG;IACtB,mBAAmB,EAAE,GAAG;IACxB,gBAAgB,EAAE,GAAG;CACtB,CAAA;AAED,SAAS,qBAAqB,CAAC,KAAiB;IAC9C,MAAM,OAAO,GAAqB;QAChC,IAAI,EAAE,GAAG,gBAAgB,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAA8B;QACnF,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,OAAO;KACtB,CAAA;IACD,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM;QAClD,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IACpC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe;IAC1C,OAAO;QACL,IAAI,EAAE,GAAG,gBAAgB,mBAA+C;QACxE,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KAC1F,CAAA;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,EAAE,cAAc,EAAE,0BAA0B,EAAW,CAAA;AAEpF,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC3D,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,GAAG,gBAAgB,WAAW;QACpC,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KACjE,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAA;AAC/B,CAAC,CAAA"}

package/dist/middleware/workspaceAccess.d.ts

@@ -1,16 +1,18 @@
 import type { WorkspaceService } from '@braidhq/core';
 import type { Context, MiddlewareHandler } from 'hono';
-import type { WorkspaceRegistryFile } from '../infrastructure/fs/WorkspaceRegistryFile.js';
 import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
+import type { WorkspaceRegistryFile } from '../infrastructure/workspace/WorkspaceRegistryFile.js';
 import type { Capability, ViewerContext } from '../policy/index.js';
 /**
- * Server-scope capability guard. Used for actions that happen without
- * a workspace context (e.g. workspace creation). Builds a viewer with
- * member=undefined; non-admin users resolve to effectiveRole=null and
- * fail every check by construction.
+ * Server-scope capability guard for actions without a workspace context,
+ * such as workspace creation.
+ * Builds a viewer with an absent member,
+ * so non-admin users resolve to a null effectiveRole,
+ * and fail every check by construction.
  *
- * Skips the gate when userRegistry isn't provided so in-memory test
- * compositions stay open. Production deployments always pass it.
+ * Skips the gate when userRegistry is absent,
+ * so in-memory test compositions stay open.
+ * Production deployments always pass it.
  */
 export declare function requireServerCapability(capability: Capability, userRegistry: UserRegistryFile | undefined): MiddlewareHandler;
 declare module 'hono' {
@@ -24,24 +26,26 @@ export interface WorkspaceAccessOptions {
     readonly userRegistry: UserRegistryFile;
 }
 /**
- * Resolves the caller's ViewerContext for this workspace and stashes
- * it on the Hono context for every downstream layer to read. Composes
- * after `workspaceIdMiddleware` + `userIdMiddleware`. Outsiders (no
- * member row + not a server admin) get 403 here.
+ * Resolves the caller's ViewerContext for this workspace,
+ * and stashes it on the Hono context for every downstream layer to read.
+ * Composes after `workspaceIdMiddleware` and `authMiddleware`.
+ * Outsiders get 403 here, meaning no member row and not a server admin.
  *
- * The actual policy decisions live in `policy/`; this middleware just
- * builds the viewer and rejects unauthenticated outsiders.
+ * The actual policy decisions live in `policy/`.
+ * This middleware only builds the viewer,
+ * and rejects unauthenticated outsiders.
  */
 export declare function workspaceAccessMiddleware(options: WorkspaceAccessOptions): MiddlewareHandler;
 export declare function getViewerContext(context: Context): ViewerContext | undefined;
 /**
- * Mutation guard. Returns 403 if the viewer can't perform the given
- * capability. Optional `buildResource` lets specific capabilities
- * (e.g. `skill.run`) attach per-request data the check needs.
+ * Mutation guard.
+ * Returns 403 when the viewer cannot perform the given capability.
+ * Optional `buildResource` lets a capability such as `skill.run`
+ * attach per-request data the check needs.
  *
- * Test compositions that don't mount `workspaceAccessMiddleware`
- * (in-memory tests, headless server) skip the gate. Production
- * deployments always mount the access middleware so the gate is real.
+ * Compositions that don't mount `workspaceAccessMiddleware`,
+ * such as in-memory tests or the headless server, skip the gate.
+ * Production deployments always mount it, so the gate is real.
  */
 export declare function requirePermission(capability: Capability, buildResource?: (context: Context) => Promise<ViewerContext['resource']>): MiddlewareHandler;
 //# sourceMappingURL=workspaceAccess.d.ts.map

package/dist/middleware/workspaceAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/middleware/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAA;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKnE;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,gBAAgB,GAAG,SAAS,GACzC,iBAAiB,CAgBnB;AAED,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,aAAa,EAAE,aAAa,CAAA;KAC7B;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAA;IACxC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAA;CACxC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CAgB5F;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,UAAU,EACtB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,GACvE,iBAAiB,CAcnB"}
+{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/middleware/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAA;AACjG,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAMnE;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,gBAAgB,GAAG,SAAS,GACzC,iBAAiB,CAgBnB;AAED,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,aAAa,EAAE,aAAa,CAAA;KAC7B;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAA;IACxC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CAgB5F;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAE5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,UAAU,EACtB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,GACvE,iBAAiB,CAcnB"}

package/dist/middleware/workspaceAccess.js

@@ -1,14 +1,17 @@
+import { ForbiddenError } from '@braidhq/core';
 import { defaultPermissionRegistry, resolveViewer } from '../policy/index.js';
-import { getUserId } from './userId.js';
+import { getUserId } from './auth.js';
 import { getWorkspaceId } from './workspaceId.js';
 /**
- * Server-scope capability guard. Used for actions that happen without
- * a workspace context (e.g. workspace creation). Builds a viewer with
- * member=undefined; non-admin users resolve to effectiveRole=null and
- * fail every check by construction.
+ * Server-scope capability guard for actions without a workspace context,
+ * such as workspace creation.
+ * Builds a viewer with an absent member,
+ * so non-admin users resolve to a null effectiveRole,
+ * and fail every check by construction.
  *
- * Skips the gate when userRegistry isn't provided so in-memory test
- * compositions stay open. Production deployments always pass it.
+ * Skips the gate when userRegistry is absent,
+ * so in-memory test compositions stay open.
+ * Production deployments always pass it.
  */
 export function requireServerCapability(capability, userRegistry) {
     return async (context, next) => {
@@ -19,22 +22,23 @@ export function requireServerCapability(capability, userRegistry) {
         const userId = getUserId(context);
         const user = await userRegistry.get(userId);
         if (!user)
-            return forbid(context, `Unknown user "${userId}".`);
+            return forbid(`Unknown user "${userId}".`);
         const viewer = resolveViewer(user, undefined);
         if (!defaultPermissionRegistry.can(capability, viewer))
-            return forbid(context, `Your role cannot perform "${capability}".`);
+            return forbid(`Your role cannot perform "${capability}".`);
         await next();
         return undefined;
     };
 }
 /**
- * Resolves the caller's ViewerContext for this workspace and stashes
- * it on the Hono context for every downstream layer to read. Composes
- * after `workspaceIdMiddleware` + `userIdMiddleware`. Outsiders (no
- * member row + not a server admin) get 403 here.
+ * Resolves the caller's ViewerContext for this workspace,
+ * and stashes it on the Hono context for every downstream layer to read.
+ * Composes after `workspaceIdMiddleware` and `authMiddleware`.
+ * Outsiders get 403 here, meaning no member row and not a server admin.
  *
- * The actual policy decisions live in `policy/`; this middleware just
- * builds the viewer and rejects unauthenticated outsiders.
+ * The actual policy decisions live in `policy/`.
+ * This middleware only builds the viewer,
+ * and rejects unauthenticated outsiders.
  */
 export function workspaceAccessMiddleware(options) {
     return async (context, next) => {
@@ -42,12 +46,12 @@ export function workspaceAccessMiddleware(options) {
         const userId = getUserId(context);
         const user = await options.userRegistry.get(userId);
         if (!user)
-            return forbid(context, `Unknown user "${userId}".`);
+            return forbid(`Unknown user "${userId}".`);
         const workspace = await options.workspaceService.findById(workspaceId);
         const member = await options.registry.getMember(workspace.rootPath, userId);
         const viewer = resolveViewer(user, member);
         if (viewer.effectiveRole === null)
-            return forbid(context, `You are not a member of workspace "${workspaceId}".`);
+            return forbid(`You are not a member of workspace "${workspaceId}".`);
         context.set('viewerContext', viewer);
         await next();
         return undefined;
@@ -57,13 +61,14 @@ export function getViewerContext(context) {
     return context.get('viewerContext');
 }
 /**
- * Mutation guard. Returns 403 if the viewer can't perform the given
- * capability. Optional `buildResource` lets specific capabilities
- * (e.g. `skill.run`) attach per-request data the check needs.
+ * Mutation guard.
+ * Returns 403 when the viewer cannot perform the given capability.
+ * Optional `buildResource` lets a capability such as `skill.run`
+ * attach per-request data the check needs.
  *
- * Test compositions that don't mount `workspaceAccessMiddleware`
- * (in-memory tests, headless server) skip the gate. Production
- * deployments always mount the access middleware so the gate is real.
+ * Compositions that don't mount `workspaceAccessMiddleware`,
+ * such as in-memory tests or the headless server, skip the gate.
+ * Production deployments always mount it, so the gate is real.
  */
 export function requirePermission(capability, buildResource) {
     return async (context, next) => {
@@ -75,12 +80,12 @@ export function requirePermission(capability, buildResource) {
         const resource = buildResource ? await buildResource(context) : undefined;
         const viewer = resource ? { ...base, resource } : base;
         if (!defaultPermissionRegistry.can(capability, viewer))
-            return forbid(context, `Your role cannot perform "${capability}".`);
+            return forbid(`Your role cannot perform "${capability}".`);
         await next();
         return undefined;
     };
 }
-function forbid(context, detail) {
-    return context.json({ type: 'about:blank', title: 'Forbidden', status: 403, detail }, 403, { 'Content-Type': 'application/problem+json' });
+function forbid(detail) {
+    throw new ForbiddenError(detail);
 }
 //# sourceMappingURL=workspaceAccess.js.map

package/dist/middleware/workspaceAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/middleware/workspaceAccess.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAsB,EACtB,YAA0C;IAE1C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI;YACP,OAAO,MAAM,CAAC,OAAO,EAAE,iBAAiB,MAAM,IAAI,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC7C,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;YACpD,OAAO,MAAM,CAAC,OAAO,EAAE,6BAA6B,UAAU,IAAI,CAAC,CAAA;QACrE,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B;IACvE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI;YACP,OAAO,MAAM,CAAC,OAAO,EAAE,iBAAiB,MAAM,IAAI,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1C,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;YAC/B,OAAO,MAAM,CAAC,OAAO,EAAE,sCAAsC,WAAW,IAAI,CAAC,CAAA;QAC/E,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;QACpC,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAsB,EACtB,aAAwE;IAExE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACzE,MAAM,MAAM,GAAkB,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;YACpD,OAAO,MAAM,CAAC,OAAO,EAAE,6BAA6B,UAAU,IAAI,CAAC,CAAA;QACrE,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,OAAgB,EAAE,MAAc;IAC9C,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAChE,GAAG,EACH,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAC/C,CAAA;AACH,CAAC"}
+{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/middleware/workspaceAccess.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAsB,EACtB,YAA0C;IAE1C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI;YACP,OAAO,MAAM,CAAC,iBAAiB,MAAM,IAAI,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC7C,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;YACpD,OAAO,MAAM,CAAC,6BAA6B,UAAU,IAAI,CAAC,CAAA;QAC5D,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAcD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B;IACvE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI;YACP,OAAO,MAAM,CAAC,iBAAiB,MAAM,IAAI,CAAC,CAAA;QAC5C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1C,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;YAC/B,OAAO,MAAM,CAAC,sCAAsC,WAAW,IAAI,CAAC,CAAA;QACtE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;QACpC,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAsB,EACtB,aAAwE;IAExE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACzE,MAAM,MAAM,GAAkB,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;YACpD,OAAO,MAAM,CAAC,6BAA6B,UAAU,IAAI,CAAC,CAAA;QAC5D,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC"}

package/dist/policy/CapabilityCheck.d.ts

@@ -1,11 +1,11 @@
-import type { Capability } from './Capability.js';
+import type { Capability } from '@braidhq/schema';
 import type { ViewerContext } from './ViewerContext.js';
 /**
- * Each capability owns its decision logic in a single class. This is
- * the Strategy interface; concrete checks live under `./checks/`.
+ * The Strategy interface, where each capability owns its decision logic.
+ * A stateless check is a const object, the first-party set lives in `checks.ts`.
  *
- * Implementations MUST be pure (no I/O, no time, no rng) so the same
- * `(viewer)` always produces the same answer.
+ * Implementations MUST be pure, with no I/O, clock, or randomness,
+ * so the same viewer always produces the same answer.
  */
 export interface CapabilityCheck {
     readonly id: Capability;

package/dist/policy/PermissionRegistry.d.ts

@@ -1,22 +1,24 @@
-import type { Capability } from './Capability.js';
+import type { Capability } from '@braidhq/schema';
 import type { CapabilityCheck } from './CapabilityCheck.js';
 import type { ViewerContext } from './ViewerContext.js';
 /**
- * Open registry of capability strategies. Adding a new capability =
- * `registry.register(new MyCheck())`; existing checks are untouched.
+ * Open registry of capability strategies.
+ * A new capability arrives via `registry.register(new MyCheck())`,
+ * leaving existing checks untouched.
  *
- * Unknown capability ids resolve to `false` (default deny). This makes
- * it safe to typo a capability id; the call denies instead of
- * accidentally allowing.
+ * Unknown capability ids resolve to `false`, a default deny.
+ * This makes a typo'd capability id safe,
+ * since the call denies rather than accidentally allowing.
  */
 export declare class PermissionRegistry {
     private readonly checks;
     register(check: CapabilityCheck): this;
     has(capability: Capability): boolean;
     /**
-     * Decide whether a viewer can perform a capability. The viewer
-     * already carries its own resource (e.g. skill for skill.run); the
-     * caller is responsible for building the right viewer.
+     * Decide whether a viewer can perform a capability.
+     * The viewer already carries its own resource,
+     * such as the skill for skill.run,
+     * so the caller is responsible for building the right viewer.
      */
     can(capability: Capability, viewer: ViewerContext): boolean;
 }

package/dist/policy/PermissionRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionRegistry.d.ts","sourceRoot":"","sources":["../../src/policy/PermissionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAKtC,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO;IAIpC;;;;OAIG;IACH,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO;CAG5D"}
+{"version":3,"file":"PermissionRegistry.d.ts","sourceRoot":"","sources":["../../src/policy/PermissionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAKtC,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO;CAG5D"}

package/dist/policy/PermissionRegistry.js

@@ -1,10 +1,11 @@
 /**
- * Open registry of capability strategies. Adding a new capability =
- * `registry.register(new MyCheck())`; existing checks are untouched.
+ * Open registry of capability strategies.
+ * A new capability arrives via `registry.register(new MyCheck())`,
+ * leaving existing checks untouched.
  *
- * Unknown capability ids resolve to `false` (default deny). This makes
- * it safe to typo a capability id; the call denies instead of
- * accidentally allowing.
+ * Unknown capability ids resolve to `false`, a default deny.
+ * This makes a typo'd capability id safe,
+ * since the call denies rather than accidentally allowing.
  */
 export class PermissionRegistry {
     checks = new Map();
@@ -16,9 +17,10 @@ export class PermissionRegistry {
         return this.checks.has(capability);
     }
     /**
-     * Decide whether a viewer can perform a capability. The viewer
-     * already carries its own resource (e.g. skill for skill.run); the
-     * caller is responsible for building the right viewer.
+     * Decide whether a viewer can perform a capability.
+     * The viewer already carries its own resource,
+     * such as the skill for skill.run,
+     * so the caller is responsible for building the right viewer.
      */
     can(capability, viewer) {
         return this.checks.get(capability)?.evaluate(viewer) ?? false;

package/dist/policy/PermissionRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionRegistry.js","sourceRoot":"","sources":["../../src/policy/PermissionRegistry.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAA;IAEhE,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,GAAG,CAAC,UAAsB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,UAAsB,EAAE,MAAqB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;IAC/D,CAAC;CACF"}
+{"version":3,"file":"PermissionRegistry.js","sourceRoot":"","sources":["../../src/policy/PermissionRegistry.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAA;IAEhE,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,GAAG,CAAC,UAAsB;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,UAAsB,EAAE,MAAqB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAA;IAC/D,CAAC;CACF"}

package/dist/policy/ViewerContext.d.ts

@@ -1,18 +1,20 @@
 import type { SkillFrontmatter, User, WorkspaceMember, WorkspaceRole } from '@braidhq/schema';
 /**
- * The single resolved-identity object that every capability check
- * reads. Built once per request by `resolveViewer`; passed unchanged
- * into the registry.
+ * The single resolved-identity object that every capability check reads.
+ * Built once per request by `resolveViewer`,
+ * then passed unchanged into the registry.
  *
- * `effectiveRole` is what permission gates use: admins always land as
- * `'owner'` here, regardless of whether they have an explicit member
- * row. `member` is the stored row when present (used for display +
- * skillOverrides lookup) and is independent of effectiveRole. Admin
- * who joined as Guest has member.role='guest' but effectiveRole='owner'.
+ * Permission gates read `effectiveRole`,
+ * where admins always land as owner regardless of any member row.
+ * `member` is the stored row when present,
+ * used for display and skillOverrides lookup,
+ * and stays independent of effectiveRole.
+ * An admin who joined as a guest has a guest member.role,
+ * yet an owner effectiveRole.
  *
- * `resource` is the per-action context the check needs:
- *   - skill.run uses `skill` (manifest) + `skillId`
- *   - future checks can extend this without breaking siblings
+ * `resource` is the per-action context the check needs.
+ * skill.run reads `skill`, the manifest, along with `skillId`.
+ * Future checks can extend it without breaking siblings.
  */
 export interface ViewerContext {
     readonly user: User;

package/dist/policy/ViewerContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ViewerContext.d.ts","sourceRoot":"","sources":["../../src/policy/ViewerContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE7F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B"}
+{"version":3,"file":"ViewerContext.d.ts","sourceRoot":"","sources":["../../src/policy/ViewerContext.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE7F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B"}

package/dist/policy/checks.d.ts

@@ -1,15 +1,15 @@
 import type { CapabilityCheck } from './CapabilityCheck.js';
 /**
- * First-party capability checks, mirrored byte-equivalent in
- * `packages/studio/src/policy/checks.ts`. The server is the
- * authoritative gate; the client copy lets Studio render Locked-style
- * affordances without hitting a 403.
+ * First-party capability checks,
+ * mirrored byte-equivalent in `packages/studio/src/policy/checks.ts`.
+ * The server is the authoritative gate.
+ * The client copy lets Studio render locked affordances, without hitting a 403.
  *
- * Workspace-scope verbs collapse to `read` + `write` per resource.
- * Workspace.create is server-scope (resolveViewer with no member).
- * Skill.run keeps its own verb because its three-step resolution
- * (owner short-circuit, per-member override, manifest allowedRoles)
- * doesn't fit a read/write pair.
+ * Workspace-scope verbs collapse to read and write per resource.
+ * `workspace.create` is server-scope, resolved with no member.
+ * `skill.run` keeps its own verb for its three-step resolution,
+ * covering owner short-circuit, per-member override, allowedRoles,
+ * which does not fit a read or write pair.
  */
 export declare const checks: readonly CapabilityCheck[];
 //# sourceMappingURL=checks.d.ts.map

package/dist/policy/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/policy/checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,EAAE,SAAS,eAAe,EAsC5C,CAAA"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/policy/checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,EAAE,SAAS,eAAe,EAyC5C,CAAA"}

package/dist/policy/checks.js

@@ -1,17 +1,20 @@
 /**
- * First-party capability checks, mirrored byte-equivalent in
- * `packages/studio/src/policy/checks.ts`. The server is the
- * authoritative gate; the client copy lets Studio render Locked-style
- * affordances without hitting a 403.
+ * First-party capability checks,
+ * mirrored byte-equivalent in `packages/studio/src/policy/checks.ts`.
+ * The server is the authoritative gate.
+ * The client copy lets Studio render locked affordances, without hitting a 403.
  *
- * Workspace-scope verbs collapse to `read` + `write` per resource.
- * Workspace.create is server-scope (resolveViewer with no member).
- * Skill.run keeps its own verb because its three-step resolution
- * (owner short-circuit, per-member override, manifest allowedRoles)
- * doesn't fit a read/write pair.
+ * Workspace-scope verbs collapse to read and write per resource.
+ * `workspace.create` is server-scope, resolved with no member.
+ * `skill.run` keeps its own verb for its three-step resolution,
+ * covering owner short-circuit, per-member override, allowedRoles,
+ * which does not fit a read or write pair.
  */
 export const checks = [
     { id: 'workspace.create', evaluate: v => v.effectiveRole === 'owner' },
+    // Server admin reads serverRole directly, not effectiveRole,
+    // since a workspace owner also resolves to an owner effectiveRole.
+    { id: 'server.admin', evaluate: v => v.user.serverRole === 'admin' },
     { id: 'workspace.read', evaluate: v => v.effectiveRole !== null },
     { id: 'workspace.write', evaluate: v => v.effectiveRole === 'owner' },
     {
@@ -23,11 +26,11 @@ export const checks = [
         evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
     },
     {
-        id: 'clarify.read',
+        id: 'clarification.read',
         evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
     },
     {
-        id: 'clarify.write',
+        id: 'clarification.write',
         evaluate: v => v.effectiveRole === 'owner' || v.effectiveRole === 'maintainer',
     },
     { id: 'history.write', evaluate: v => v.effectiveRole === 'owner' },

package/dist/policy/checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/policy/checks.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,MAAM,GAA+B;IAChD,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACtE,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE;IACjE,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACrE;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACnE;QACE,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAA;YAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAA;YACnC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBACpB,OAAO,KAAK,CAAA;YACd,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI;gBAC1B,OAAO,KAAK,CAAA;YACd,IAAI,CAAC,CAAC,aAAa,KAAK,OAAO;gBAC7B,OAAO,IAAI,CAAA;YACb,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,OAA+C,CAAC,CAAA;YAC5F,IAAI,QAAQ;gBACV,OAAO,QAAQ,KAAK,OAAO,CAAA;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;QAC3D,CAAC;KACF;CACF,CAAA"}
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/policy/checks.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,MAAM,GAA+B;IAChD,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACtE,6DAA6D;IAC7D,mEAAmE;IACnE,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE;IACpE,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE;IACjE,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACrE;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY;KAC/E;IACD,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,EAAE;IACnE;QACE,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAA;YAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAA;YACnC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBACpB,OAAO,KAAK,CAAA;YACd,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI;gBAC1B,OAAO,KAAK,CAAA;YACd,IAAI,CAAC,CAAC,aAAa,KAAK,OAAO;gBAC7B,OAAO,IAAI,CAAA;YACb,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,OAA+C,CAAC,CAAA;YAC5F,IAAI,QAAQ;gBACV,OAAO,QAAQ,KAAK,OAAO,CAAA;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;QAC3D,CAAC;KACF;CACF,CAAA"}

package/dist/policy/defaultRegistry.d.ts

@@ -1,9 +1,8 @@
 import { PermissionRegistry } from './PermissionRegistry.js';
 /**
- * Default registry preloaded with the platform's first-party
- * capabilities. Plugins that want to register their own checks should
- * call `register()` on this instance; tests can build a fresh registry
- * via `new PermissionRegistry()` to inject mocks.
+ * Default registry preloaded with the first-party capabilities.
+ * Plugins register their own checks, calling `register()` on this instance.
+ * Tests build a fresh `PermissionRegistry` instead, to inject mocks.
  */
 export declare function buildDefaultPermissionRegistry(): PermissionRegistry;
 export declare const defaultPermissionRegistry: PermissionRegistry;

package/dist/policy/defaultRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaultRegistry.d.ts","sourceRoot":"","sources":["../../src/policy/defaultRegistry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;;GAKG;AACH,wBAAgB,8BAA8B,IAAI,kBAAkB,CAKnE;AAED,eAAO,MAAM,yBAAyB,oBAAmC,CAAA"}
+{"version":3,"file":"defaultRegistry.d.ts","sourceRoot":"","sources":["../../src/policy/defaultRegistry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,kBAAkB,CAKnE;AAED,eAAO,MAAM,yBAAyB,oBAAmC,CAAA"}

package/dist/policy/defaultRegistry.js

@@ -1,10 +1,9 @@
 import { checks } from './checks.js';
 import { PermissionRegistry } from './PermissionRegistry.js';
 /**
- * Default registry preloaded with the platform's first-party
- * capabilities. Plugins that want to register their own checks should
- * call `register()` on this instance; tests can build a fresh registry
- * via `new PermissionRegistry()` to inject mocks.
+ * Default registry preloaded with the first-party capabilities.
+ * Plugins register their own checks, calling `register()` on this instance.
+ * Tests build a fresh `PermissionRegistry` instead, to inject mocks.
  */
 export function buildDefaultPermissionRegistry() {
     const registry = new PermissionRegistry();

package/dist/policy/defaultRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaultRegistry.js","sourceRoot":"","sources":["../../src/policy/defaultRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM;QACxB,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC1B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,EAAE,CAAA"}
+{"version":3,"file":"defaultRegistry.js","sourceRoot":"","sources":["../../src/policy/defaultRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;GAIG;AACH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM;QACxB,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC1B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,EAAE,CAAA"}

package/dist/policy/index.d.ts

@@ -1,8 +1,8 @@
-export type { Capability } from './Capability.js';
-export { CAPABILITY_IDS } from './Capability.js';
 export type { CapabilityCheck } from './CapabilityCheck.js';
 export { buildDefaultPermissionRegistry, defaultPermissionRegistry } from './defaultRegistry.js';
 export { PermissionRegistry } from './PermissionRegistry.js';
 export { resolveViewer } from './resolveViewer.js';
 export type { ViewerContext, ViewerResource } from './ViewerContext.js';
+export type { Capability } from '@braidhq/schema';
+export { CAPABILITY_IDS } from '@braidhq/schema';
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACvE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/policy/index.js

@@ -1,5 +1,5 @@
-export { CAPABILITY_IDS } from './Capability.js';
 export { buildDefaultPermissionRegistry, defaultPermissionRegistry } from './defaultRegistry.js';
 export { PermissionRegistry } from './PermissionRegistry.js';
 export { resolveViewer } from './resolveViewer.js';
+export { CAPABILITY_IDS } from '@braidhq/schema';
 //# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAGlD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/policy/resolveViewer.d.ts

@@ -1,16 +1,16 @@
 import type { User, WorkspaceMember } from '@braidhq/schema';
 import type { ViewerContext, ViewerResource } from './ViewerContext.js';
 /**
- * The sole place server-admin promotion happens. Every other layer
- * (middleware, capability checks, Studio mirror) consumes the resulting
- * `effectiveRole` and never re-derives it.
+ * The sole place server-admin promotion happens. Every other layer,
+ * including middleware, capability checks, and the Studio mirror,
+ * consumes the resulting `effectiveRole` and never re-derives it.
  *
- * Resolution:
- *   1. user.serverRole === 'admin'  → effectiveRole = 'owner'
- *      (the stored member.role, if any, is kept on `member` for
- *      display, but ignored by gates)
- *   2. member present                → effectiveRole = member.role
- *   3. otherwise                     → effectiveRole = null (no access)
+ * Resolution runs in order:
+ *   1. An admin serverRole yields an owner effectiveRole.
+ *      The stored member.role, if any, stays on `member` for display,
+ *      yet gates ignore it.
+ *   2. A present member yields effectiveRole = member.role.
+ *   3. Otherwise effectiveRole is null, meaning no access.
  */
 export declare function resolveViewer(user: User, member: WorkspaceMember | undefined, resource?: ViewerResource): ViewerContext;
 //# sourceMappingURL=resolveViewer.d.ts.map