@braidhq/server 0.1.0 → 0.2.1

package/dist/routes/sourceUnitObservations.js

@@ -0,0 +1,80 @@
+import { computeSourceDiff } from '@braidhq/core';
+import { SourceId, SourceUnitDiff, SourceUnitObservation } from '@braidhq/schema';
+import { createRoute, OpenAPIHono, z } from '@hono/zod-openapi';
+import { getWorkspaceId } from '../middleware/workspaceId.js';
+import { NotFoundResponse, ValidationFailureResponse, WorkspaceIdParam } from './_shared.js';
+const ListQuery = z.object({
+    sourceId: SourceId.optional().openapi({ description: 'Restrict to one source.' }),
+});
+const ListResponse = z.object({
+    items: z.array(SourceUnitObservation),
+}).openapi('SourceUnitObservationListResponse');
+const SourceIdParam = WorkspaceIdParam.extend({
+    sourceId: SourceId.openapi({ param: { name: 'sourceId', in: 'path' } }),
+});
+const DiffResponse = SourceUnitDiff.openapi('SourceUnitDiffResponse');
+const listRoute = createRoute({
+    method: 'get',
+    path: '/',
+    operationId: 'listSourceUnitObservations',
+    summary: 'List recorded observations per source unit for a workspace.',
+    description: 'Returns the framework\'s current view of each source unit '
+        + 'last seen by an extract run. One entry per (sourceId, path). Used '
+        + 'by Studio to display per-unit freshness and by Reactor to compute '
+        + 'what needs re-extraction.',
+    tags: ['source-unit-states'],
+    request: {
+        params: WorkspaceIdParam,
+        query: ListQuery,
+    },
+    responses: {
+        200: {
+            description: 'The recorded observations.',
+            content: { 'application/json': { schema: ListResponse } },
+        },
+        400: ValidationFailureResponse,
+    },
+});
+const diffRoute = createRoute({
+    method: 'get',
+    path: '/{sourceId}/diff',
+    operationId: 'getSourceUnitDiff',
+    summary: 'Diff a source\'s current units on disk against the recorded ledger.',
+    description: 'Returns the partition (`new`, `changed`, `unchanged`, `orphaned`) the Reactor uses internally to decide what to re-extract. Studio\'s Actions form consumes the same shape to render per-option badges on the source picker.',
+    tags: ['source-unit-states'],
+    request: { params: SourceIdParam },
+    responses: {
+        200: {
+            description: 'The diff partition.',
+            content: { 'application/json': { schema: DiffResponse } },
+        },
+        404: NotFoundResponse,
+    },
+});
+export function createSourceUnitObservationsRouter(deps) {
+    const router = new OpenAPIHono();
+    router.openapi(listRoute, async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const { sourceId } = context.req.valid('query');
+        const items = sourceId
+            ? await deps.sourceUnitObservationService.listBySource(workspaceId, sourceId)
+            : await deps.sourceUnitObservationService.listByWorkspace(workspaceId);
+        return context.json({ items: [...items] }, 200);
+    });
+    if (deps.diffSupport) {
+        const { workspaceService, unitLister, digest } = deps.diffSupport;
+        router.openapi(diffRoute, async (context) => {
+            const workspaceId = getWorkspaceId(context);
+            const { sourceId } = context.req.valid('param');
+            const workspace = await workspaceService.findById(workspaceId);
+            const diff = await computeSourceDiff({
+                unitLister,
+                digest,
+                sourceUnitObservationService: deps.sourceUnitObservationService,
+            }, workspace, sourceId);
+            return context.json(diff, 200);
+        });
+    }
+    return router;
+}
+//# sourceMappingURL=sourceUnitObservations.js.map

package/dist/routes/sourceUnitObservations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceUnitObservations.js","sourceRoot":"","sources":["../../src/routes/sourceUnitObservations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACjF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE5F,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;CAClF,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACtC,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAA;AAE/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CACxE,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;AAmBrE,MAAM,SAAS,GAAG,WAAW,CAAC;IAC5B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,4BAA4B;IACzC,OAAO,EAAE,6DAA6D;IACtE,WAAW,EAAE,4DAA4D;UACrE,oEAAoE;UACpE,oEAAoE;UACpE,2BAA2B;IAC/B,IAAI,EAAE,CAAC,oBAAoB,CAAC;IAC5B,OAAO,EAAE;QACP,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,SAAS;KACjB;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,4BAA4B;YACzC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;SAC1D;QACD,GAAG,EAAE,yBAAyB;KAC/B;CACF,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,WAAW,CAAC;IAC5B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,mBAAmB;IAChC,OAAO,EAAE,qEAAqE;IAC9E,WAAW,EAAE,8NAA8N;IAC3O,IAAI,EAAE,CAAC,oBAAoB,CAAC;IAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;IAClC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;SAC1D;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,kCAAkC,CAAC,IAAsC;IACvF,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1C,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,QAAQ;YACpB,CAAC,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC;YAC7E,CAAC,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;QACxE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAA;QACjE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1C,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YAC3C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;YAC9D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAClC;gBACE,UAAU;gBACV,MAAM;gBACN,4BAA4B,EAAE,IAAI,CAAC,4BAA4B;aAChE,EACD,SAAS,EACT,QAAQ,CACT,CAAA;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/sourceWebhooks.d.ts

@@ -0,0 +1,26 @@
+import type { PluginRegistry, SourceLoaderRunner, WorkspaceService } from '@braidhq/core';
+import type { SecretStore } from '../infrastructure/secrets/SecretStore.js';
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { Hono } from 'hono';
+export interface GithubWebhookReceiverDeps {
+    readonly workspaceService: WorkspaceService;
+    readonly sourceLoaderRunner: SourceLoaderRunner;
+    readonly secretStore: SecretStore;
+    readonly pluginRegistry: PluginRegistry;
+}
+export declare function createGithubWebhookReceiver(deps: GithubWebhookReceiverDeps): Hono;
+export interface SourceWebhooksAdminDeps {
+    readonly workspaceService: WorkspaceService;
+    readonly secretStore: SecretStore;
+    readonly pluginRegistry: PluginRegistry;
+    /**
+     * Base URL under which the public webhook receiver is reachable.
+     * Required so the admin response can return an absolute URL,
+     * that the user pastes straight into GitHub's webhook settings.
+     * When unset (composeApp in tests), the admin endpoints return 503.
+     * Better than returning a relative path Studio would render verbatim.
+     */
+    readonly apiUrl?: string;
+}
+export declare function createSourceWebhooksAdminRouter(deps: SourceWebhooksAdminDeps): OpenAPIHono;
+//# sourceMappingURL=sourceWebhooks.d.ts.map

package/dist/routes/sourceWebhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceWebhooks.d.ts","sourceRoot":"","sources":["../../src/routes/sourceWebhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAA;AAK3E,OAAO,EAAe,WAAW,EAAK,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AA0C3B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAA;IAC/C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;CACxC;AA6FD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,yBAAyB,GAAG,IAAI,CAgFjF;AAYD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AA2DD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,uBAAuB,GAAG,WAAW,CAoC1F"}

package/dist/routes/sourceWebhooks.js

@@ -0,0 +1,301 @@
+import { Buffer } from 'node:buffer';
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createLogger, NotFoundError, ServiceUnavailableError, UnauthorizedError, ValidationError } from '@braidhq/core';
+import { SourceId, WorkspaceId } from '@braidhq/schema';
+import { createRoute, OpenAPIHono, z } from '@hono/zod-openapi';
+import { Hono } from 'hono';
+import { WorkspaceIdParam } from './_shared.js';
+/**
+ * GitHub webhook plumbing for filesystem sources,
+ * whose loader plugin declares a `webhook` capability.
+ *
+ * Two routers.
+ *
+ *   `createGithubWebhookReceiver` is public (no Bearer auth).
+ *   GitHub POSTs deliveries here.
+ *   We verify the HMAC, confirm the payload names the claimed repo,
+ *   ask the plugin whether the event is worth a `syncOne`,
+ *   and dispatch in the background. The response returns immediately,
+ *   so GitHub's ~10s delivery timeout never trips on a slow loader.
+ *
+ *   `createSourceWebhooksAdminRouter` is workspace-scoped,
+ *   and gated by the existing auth middleware.
+ *   Studio uses it to display the webhook URL and rotate the secret.
+ *
+ * The receiver is loader-agnostic and does not switch on `loader.kind`.
+ * A new loader extends the webhook surface from its plugin definition,
+ * via `webhook: { repoIdentity, shouldDispatch }`.
+ *
+ * Secrets live in the existing `SecretStore`,
+ * under namespace `webhook-github`, keyed by `<workspaceId>--<sourceId>`.
+ * That mirrors the OAuth namespaces (oauth-google, oauth-github),
+ * which already use the same `--` separator.
+ */
+const SECRET_NAMESPACE = 'webhook-github';
+const PROVIDER = 'github';
+function secretKey(workspaceId, sourceId) {
+    return `${workspaceId}--${sourceId}`;
+}
+const receiverLogger = createLogger('webhooks.github.receiver');
+// Verify GitHub's `X-Hub-Signature-256` header.
+// GitHub computes `sha256=<hex>` over the raw body with the secret.
+// We recompute and compare in constant time.
+// The prefix check is case-insensitive,
+// because some proxies and WAFs normalise headers.
+function verifySignature(rawBody, header, secret) {
+    if (!header || !header.toLowerCase().startsWith('sha256='))
+        return false;
+    // Normalise the hex digest to lowercase,
+    // so the timing-safe compare still accepts an uppercased hex,
+    // (rare but valid).
+    const provided = `sha256=${header.slice('sha256='.length).toLowerCase()}`;
+    const expected = `sha256=${createHmac('sha256', secret).update(rawBody).digest('hex')}`;
+    const a = Buffer.from(expected);
+    const b = Buffer.from(provided);
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+// Look up the loader plugin's `webhook` capability for a source.
+// Returns undefined when the source is not webhook-capable, never throws.
+function resolveWebhookCapability(pluginRegistry, source) {
+    if (source.kind !== 'filesystem' || !source.loader)
+        return undefined;
+    const plugin = pluginRegistry.findSourceLoader(source.loader.kind);
+    if (!plugin?.webhook)
+        return undefined;
+    return { capability: plugin.webhook, config: source.loader.config };
+}
+// Uniform anonymous response for any pre-signature failure,
+// (missing workspace, source, webhook capability, secret, or HMAC).
+// Distinct error bodies would leak which pairs exist,
+// and which are webhook-armed, to an unauthenticated caller.
+// That recon ladder we deliberately close off.
+function unauthorized() {
+    throw new UnauthorizedError('Invalid webhook signature.');
+}
+// Run the full pre-signature pipeline inside a single try/catch,
+// (header presence, body read, workspace and source lookup,
+// plugin webhook capability, repo identity, secret read, HMAC verify).
+// Returns the trusted state on success and `undefined` on any failure.
+// The caller collapses every failure mode to a 401.
+async function verifyDelivery(deps, context, workspaceId, sourceId) {
+    try {
+        const signature = context.req.header('X-Hub-Signature-256');
+        if (!signature)
+            return undefined;
+        const rawBody = await context.req.text();
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const source = workspace.sources.find(s => s.id === sourceId);
+        if (!source)
+            return undefined;
+        const resolved = resolveWebhookCapability(deps.pluginRegistry, source);
+        if (!resolved)
+            return undefined;
+        const identity = resolved.capability.repoIdentity(resolved.config);
+        if (!identity || identity.provider !== PROVIDER)
+            return undefined;
+        const record = await deps.secretStore.read(SECRET_NAMESPACE, secretKey(workspaceId, sourceId));
+        if (!record)
+            return undefined;
+        if (!verifySignature(rawBody, signature, record.secret))
+            return undefined;
+        return { workspace, resolved, identity, rawBody };
+    }
+    catch (err) {
+        receiverLogger.warn({ workspaceId, sourceId, err: err instanceof Error ? err.message : String(err) }, 'webhook: pre-signature check failed');
+        return undefined;
+    }
+}
+export function createGithubWebhookReceiver(deps) {
+    const router = new Hono();
+    // `:workspaceId/:sourceId` is the routing identity,
+    // the user installs on the GitHub side.
+    // We accept the request, verify, and return 202 immediately.
+    // Sync runs in the background,
+    // so a slow loader never blocks GitHub's delivery worker.
+    // GitHub times deliveries out at ~10s.
+    router.post('/github/:workspaceId/:sourceId', async (context) => {
+        const workspaceId = WorkspaceId.parse(context.req.param('workspaceId'));
+        const sourceId = SourceId.parse(context.req.param('sourceId'));
+        // The verifyDelivery call returns either the trusted state or undefined,
+        // (workspace, resolved capability, repository identity, raw body).
+        // On undefined we always return a uniform 401,
+        // so distinct errors never tell an anonymous caller apart,
+        // "no such workspace", "no secret yet", and "bad signature".
+        const verified = await verifyDelivery(deps, context, workspaceId, sourceId);
+        if (!verified)
+            return unauthorized();
+        const { workspace, resolved, identity, rawBody } = verified;
+        // Parse the body only after the signature check,
+        // so an attacker who can't forge the HMAC, never reaches our JSON parser.
+        let payload;
+        try {
+            payload = JSON.parse(rawBody);
+        }
+        catch {
+            throw new ValidationError('Invalid JSON payload.');
+        }
+        const fullName = extractFullName(payload);
+        const expectedFullName = `${identity.owner}/${identity.repo}`.toLowerCase();
+        // GitHub repo names are case-insensitive,
+        // (a stored `Owner/Repo` may arrive as `owner/repo`, or vice versa).
+        // Compare normalised. Also REQUIRE full_name to be present.
+        // A verified delivery without one is rejected,
+        // since this receiver is per-source,
+        // (some org-level or installation events omit it).
+        if (typeof fullName !== 'string' || fullName.toLowerCase() !== expectedFullName)
+            throw new ValidationError(`Payload repository "${fullName ?? '(missing)'}" does not match configured "${expectedFullName}".`);
+        // X-GitHub-Event must be present on real deliveries.
+        // Treating an absent header as "unknown",
+        // would let a stripping proxy silently drop every event,
+        // since loaders default to skipping unknown events.
+        const event = context.req.header('X-GitHub-Event');
+        if (!event)
+            throw new ValidationError('Missing X-GitHub-Event header.');
+        const shouldDispatch = resolved.capability.shouldDispatch?.(resolved.config, { event, payload }) ?? true;
+        if (!shouldDispatch) {
+            // Return 202 so GitHub does not treat the delivery as a failure,
+            // and back off retries, deliberately accepting and dropping.
+            return context.json({ accepted: true, event, workspaceId, sourceId, skipped: true }, 202);
+        }
+        // Fire-and-forget. Deliveries time out at ~10s,
+        // and a clean repo with many issues can take minutes to poll.
+        // Errors are logged so a failing sync doesn't silently disappear,
+        // the next delivery retries.
+        // Concurrent deliveries are allowed to race, loaders are idempotent,
+        // (last-writer-wins per file) so the result still converges,
+        // to the latest remote state.
+        void deps.sourceLoaderRunner.syncOne(workspace, sourceId).catch((err) => {
+            receiverLogger.warn({
+                workspaceId,
+                sourceId,
+                err: err instanceof Error ? err.message : String(err),
+            }, 'background syncOne triggered by github webhook failed');
+        });
+        return context.json({ accepted: true, event, workspaceId, sourceId, skipped: false }, 202);
+    });
+    return router;
+}
+function extractFullName(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        return undefined;
+    const repository = payload.repository;
+    if (typeof repository !== 'object' || repository === null)
+        return undefined;
+    const fullName = repository.full_name;
+    return typeof fullName === 'string' ? fullName : undefined;
+}
+const adminLogger = createLogger('webhooks.github.admin');
+const SourceIdParam = WorkspaceIdParam.extend({
+    sourceId: SourceId.openapi({ param: { name: 'sourceId', in: 'path' } }),
+});
+const WebhookStatusResponse = z.object({
+    url: z.string(),
+    hasSecret: z.boolean(),
+    createdAt: z.string().optional(),
+}).openapi('GithubWebhookStatusResponse');
+const WebhookRotateResponse = z.object({
+    url: z.string(),
+    secret: z.string(),
+    createdAt: z.string(),
+}).openapi('GithubWebhookRotateResponse');
+const ErrorBody = z.object({ error: z.string() }).openapi('GithubWebhookErrorBody');
+const getStatusRoute = createRoute({
+    method: 'get',
+    path: '/{sourceId}/github',
+    operationId: 'getGithubWebhookStatus',
+    summary: 'Read the GitHub webhook URL and whether a secret has been provisioned for a source.',
+    tags: ['source-webhooks'],
+    request: { params: SourceIdParam },
+    responses: {
+        200: {
+            description: 'Webhook URL plus secret-presence flag (the secret itself is never returned on read).',
+            content: { 'application/json': { schema: WebhookStatusResponse } },
+        },
+        400: { description: 'Source is not webhook-capable.', content: { 'application/json': { schema: ErrorBody } } },
+        404: { description: 'Source not found.', content: { 'application/json': { schema: ErrorBody } } },
+        503: { description: 'Server was not configured with apiUrl.', content: { 'application/json': { schema: ErrorBody } } },
+    },
+});
+const rotateRoute = createRoute({
+    method: 'post',
+    path: '/{sourceId}/github/rotate',
+    operationId: 'rotateGithubWebhookSecret',
+    summary: 'Generate a fresh 32-byte hex secret for the GitHub webhook, returning it ONCE.',
+    description: 'The secret is shown exactly once in the rotate response so the user can copy it into GitHub. Subsequent GET requests return only `hasSecret` + `createdAt`.',
+    tags: ['source-webhooks'],
+    request: { params: SourceIdParam },
+    responses: {
+        200: {
+            description: 'New secret minted and stored.',
+            content: { 'application/json': { schema: WebhookRotateResponse } },
+        },
+        400: { description: 'Source is not webhook-capable.', content: { 'application/json': { schema: ErrorBody } } },
+        404: { description: 'Source not found.', content: { 'application/json': { schema: ErrorBody } } },
+        503: { description: 'Server was not configured with apiUrl.', content: { 'application/json': { schema: ErrorBody } } },
+    },
+});
+export function createSourceWebhooksAdminRouter(deps) {
+    const router = new OpenAPIHono();
+    router.openapi(getStatusRoute, async (context) => {
+        const { workspaceId, sourceId } = context.req.valid('param');
+        if (!deps.apiUrl)
+            throw new ServiceUnavailableError('Server is not configured with a public apiUrl. Webhook URLs cannot be rendered.');
+        await guardWebhookSource(deps, workspaceId, sourceId);
+        const record = await deps.secretStore.read(SECRET_NAMESPACE, secretKey(workspaceId, sourceId));
+        return context.json({
+            url: buildWebhookUrl(deps.apiUrl, workspaceId, sourceId),
+            hasSecret: record !== undefined,
+            ...(record?.createdAt ? { createdAt: record.createdAt } : {}),
+        }, 200);
+    });
+    router.openapi(rotateRoute, async (context) => {
+        const { workspaceId, sourceId } = context.req.valid('param');
+        if (!deps.apiUrl)
+            throw new ServiceUnavailableError('Server is not configured with a public apiUrl. Webhook URLs cannot be rendered.');
+        await guardWebhookSource(deps, workspaceId, sourceId);
+        // 32 bytes is the GitHub-recommended minimum,
+        // matching what their own webhook setup UI generates.
+        const secret = randomBytes(32).toString('hex');
+        const createdAt = new Date().toISOString();
+        const record = { secret, createdAt };
+        await deps.secretStore.write(SECRET_NAMESPACE, secretKey(workspaceId, sourceId), record);
+        return context.json({
+            url: buildWebhookUrl(deps.apiUrl, workspaceId, sourceId),
+            secret,
+            createdAt,
+        }, 200);
+    });
+    return router;
+}
+// Shared admin precondition check.
+// Returns undefined when the source is a webhook-capable github source,
+// otherwise returns the 4xx the caller should surface.
+// We never throw. On schema drift defineSourceLoaderPlugin's wrapper,
+// may throw ZodError, which we catch and translate to 400.
+async function guardWebhookSource(deps, workspaceId, sourceId) {
+    const workspace = await deps.workspaceService.findById(workspaceId);
+    const source = workspace.sources.find(s => s.id === sourceId);
+    if (!source)
+        throw new NotFoundError(`Source "${sourceId}" not found`);
+    const resolved = resolveWebhookCapability(deps.pluginRegistry, source);
+    if (!resolved)
+        throw new ValidationError(`Source "${sourceId}" has no webhook-capable loader.`);
+    try {
+        const identity = resolved.capability.repoIdentity(resolved.config);
+        if (!identity || identity.provider !== PROVIDER)
+            throw new ValidationError(`Source "${sourceId}" is not bound to a github repo.`);
+    }
+    catch (err) {
+        if (err instanceof ValidationError)
+            throw err;
+        adminLogger.warn({ workspaceId, sourceId, err: err instanceof Error ? err.message : String(err) }, 'admin: repoIdentity threw');
+        throw new ValidationError(`Source "${sourceId}" loader config does not match the loader's schema.`);
+    }
+}
+function buildWebhookUrl(apiUrl, workspaceId, sourceId) {
+    const base = apiUrl.replace(/\/$/, '');
+    return `${base}/webhooks/github/${workspaceId}/${sourceId}`;
+}
+//# sourceMappingURL=sourceWebhooks.js.map

package/dist/routes/sourceWebhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceWebhooks.js","sourceRoot":"","sources":["../../src/routes/sourceWebhooks.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACxH,OAAO,EAAyB,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC9E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,gBAAgB,GAAG,gBAAgB,CAAA;AACzC,MAAM,QAAQ,GAAG,QAAiB,CAAA;AAOlC,SAAS,SAAS,CAAC,WAAwB,EAAE,QAAkB;IAC7D,OAAO,GAAG,WAAW,KAAK,QAAQ,EAAE,CAAA;AACtC,CAAC;AASD,MAAM,cAAc,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAA;AAE/D,gDAAgD;AAChD,oEAAoE;AACpE,6CAA6C;AAC7C,wCAAwC;AACxC,mDAAmD;AACnD,SAAS,eAAe,CAAC,OAAe,EAAE,MAA0B,EAAE,MAAc;IAClF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QACxD,OAAO,KAAK,CAAA;IACd,yCAAyC;IACzC,8DAA8D;IAC9D,oBAAoB;IACpB,MAAM,QAAQ,GAAG,UAAU,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAA;IACzE,MAAM,QAAQ,GAAG,UAAU,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IACvF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACvB,OAAO,KAAK,CAAA;IACd,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,iEAAiE;AACjE,0EAA0E;AAC1E,SAAS,wBAAwB,CAC/B,cAA8B,EAC9B,MAAwB;IAExB,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,MAAM;QAChD,OAAO,SAAS,CAAA;IAClB,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,EAAE,OAAO;QAClB,OAAO,SAAS,CAAA;IAClB,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;AACrE,CAAC;AAED,4DAA4D;AAC5D,oEAAoE;AACpE,sDAAsD;AACtD,6DAA6D;AAC7D,+CAA+C;AAC/C,SAAS,YAAY;IACnB,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAA;AAC3D,CAAC;AASD,iEAAiE;AACjE,4DAA4D;AAC5D,uEAAuE;AACvE,uEAAuE;AACvE,oDAAoD;AACpD,KAAK,UAAU,cAAc,CAC3B,IAA+B,EAC/B,OAA4F,EAC5F,WAAwB,EACxB,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;QAC3D,IAAI,CAAC,SAAS;YACZ,OAAO,SAAS,CAAA;QAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;QAC7D,IAAI,CAAC,MAAM;YACT,OAAO,SAAS,CAAA;QAClB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACtE,IAAI,CAAC,QAAQ;YACX,OAAO,SAAS,CAAA;QAClB,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC7C,OAAO,SAAS,CAAA;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAsB,gBAAgB,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAA;QACnH,IAAI,CAAC,MAAM;YACT,OAAO,SAAS,CAAA;QAClB,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACrD,OAAO,SAAS,CAAA;QAClB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,GAAG,EAAE,CAAC;QACX,cAAc,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAA;QAC5I,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IAEzB,oDAAoD;IACpD,wCAAwC;IACxC,6DAA6D;IAC7D,+BAA+B;IAC/B,0DAA0D;IAC1D,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;QACvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;QAC9D,yEAAyE;QACzE,mEAAmE;QACnE,+CAA+C;QAC/C,2DAA2D;QAC3D,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC3E,IAAI,CAAC,QAAQ;YACX,OAAO,YAAY,EAAE,CAAA;QACvB,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAA;QAE3D,iDAAiD;QACjD,0EAA0E;QAC1E,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,CAAC;YACL,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACzC,MAAM,gBAAgB,GAAG,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC3E,0CAA0C;QAC1C,qEAAqE;QACrE,4DAA4D;QAC5D,+CAA+C;QAC/C,qCAAqC;QACrC,mDAAmD;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB;YAC7E,MAAM,IAAI,eAAe,CAAC,uBAAuB,QAAQ,IAAI,WAAW,gCAAgC,gBAAgB,IAAI,CAAC,CAAA;QAE/H,qDAAqD;QACrD,0CAA0C;QAC1C,yDAAyD;QACzD,oDAAoD;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAA;QAE7D,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,IAAI,IAAI,CAAA;QACxG,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,iEAAiE;YACjE,6DAA6D;YAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;QAC3F,CAAC;QAED,gDAAgD;QAChD,8DAA8D;QAC9D,kEAAkE;QAClE,6BAA6B;QAC7B,qEAAqE;QACrE,6DAA6D;QAC7D,8BAA8B;QAC9B,KAAK,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,IAAI,CACjB;gBACE,WAAW;gBACX,QAAQ;gBACR,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACtD,EACD,uDAAuD,CACxD,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QACjD,OAAO,SAAS,CAAA;IAClB,MAAM,UAAU,GAAI,OAAoC,CAAC,UAAU,CAAA;IACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QACvD,OAAO,SAAS,CAAA;IAClB,MAAM,QAAQ,GAAI,UAAsC,CAAC,SAAS,CAAA;IAClE,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC;AAgBD,MAAM,WAAW,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CACxE,CAAC,CAAA;AAEF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;AAEzC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;AAEzC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;AAEnF,MAAM,cAAc,GAAG,WAAW,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,qFAAqF;IAC9F,IAAI,EAAE,CAAC,iBAAiB,CAAC;IACzB,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;IAClC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,sFAAsF;YACnG,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE;SACnE;QACD,GAAG,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QAC9G,GAAG,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QACjG,GAAG,EAAE,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;KACvH;CACF,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,WAAW,CAAC;IAC9B,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,2BAA2B;IACjC,WAAW,EAAE,2BAA2B;IACxC,OAAO,EAAE,gFAAgF;IACzF,WAAW,EAAE,6JAA6J;IAC1K,IAAI,EAAE,CAAC,iBAAiB,CAAC;IACzB,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;IAClC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE;SACnE;QACD,GAAG,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QAC9G,GAAG,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QACjG,GAAG,EAAE,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;KACvH;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,+BAA+B,CAAC,IAA6B;IAC3E,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YACd,MAAM,IAAI,uBAAuB,CAAC,iFAAiF,CAAC,CAAA;QACtH,MAAM,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAsB,gBAAgB,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAA;QACnH,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;YACxD,SAAS,EAAE,MAAM,KAAK,SAAS;YAC/B,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,EAAE,GAAG,CAAC,CAAA;IACT,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YACd,MAAM,IAAI,uBAAuB,CAAC,iFAAiF,CAAC,CAAA;QACtH,MAAM,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;QAErD,8CAA8C;QAC9C,sDAAsD;QACtD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC1C,MAAM,MAAM,GAAwB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzD,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QACxF,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;YACxD,MAAM;YACN,SAAS;SACV,EAAE,GAAG,CAAC,CAAA;IACT,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,mCAAmC;AACnC,wEAAwE;AACxE,uDAAuD;AACvD,sEAAsE;AACtE,2DAA2D;AAC3D,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,WAAwB,EACxB,QAAkB;IAElB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;IAC7D,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,aAAa,CAAC,WAAW,QAAQ,aAAa,CAAC,CAAA;IAC3D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IACtE,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,eAAe,CAAC,WAAW,QAAQ,kCAAkC,CAAC,CAAA;IAClF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC7C,MAAM,IAAI,eAAe,CAAC,WAAW,QAAQ,kCAAkC,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,eAAe;YAChC,MAAM,GAAG,CAAA;QACX,WAAW,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;QAC/H,MAAM,IAAI,eAAe,CAAC,WAAW,QAAQ,qDAAqD,CAAC,CAAA;IACrG,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,WAAwB,EAAE,QAAkB;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,OAAO,GAAG,IAAI,oBAAoB,WAAW,IAAI,QAAQ,EAAE,CAAA;AAC7D,CAAC"}

package/dist/routes/users.d.ts

@@ -1,9 +1,7 @@
-import type { Clock } from '@braidhq/core';
 import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
 import { OpenAPIHono } from '@hono/zod-openapi';
 export interface UsersRouterDeps {
     userRegistry: UserRegistryFile;
-    clock: Clock;
 }
 export declare function createUsersRouter(deps: UsersRouterDeps): OpenAPIHono;
 //# sourceMappingURL=users.d.ts.map

package/dist/routes/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AAGnF,OAAO,EAAe,WAAW,EAAK,MAAM,mBAAmB,CAAA;AAY/D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,gBAAgB,CAAA;IAC9B,KAAK,EAAE,KAAK,CAAA;CACb;AAoFD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CA2CpE"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AAGnF,OAAO,EAAe,WAAW,EAAK,MAAM,mBAAmB,CAAA;AAkB/D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,gBAAgB,CAAA;CAC/B;AAmED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CAmCpE"}

package/dist/routes/users.js

@@ -1,14 +1,19 @@
-import { newUserId, NotFoundError } from '@braidhq/core';
-import { User, UserDraft, UserId, UserPatch } from '@braidhq/schema';
+import { ForbiddenError, NotFoundError } from '@braidhq/core';
+import { User, UserId } from '@braidhq/schema';
 import { createRoute, OpenAPIHono, z } from '@hono/zod-openapi';
-import { getUserId } from '../middleware/userId.js';
-import { NotFoundResponse, ValidationFailureResponse } from './_shared.js';
+import { getUserId } from '../middleware/auth.js';
+import { ForbiddenResponse, NotFoundResponse } from './_shared.js';
 const UserIdParam = z.object({
     userId: UserId.openapi({ param: { name: 'userId', in: 'path' } }),
 });
 const UserListResponse = z.object({
     items: z.array(User),
 }).openapi('UserListResponse');
+// Self-service profile edit, only the display name.
+// Server-role changes go through the admin-gated `/admin/users` routes.
+const SelfProfileUpdate = z.object({
+    displayName: z.string().min(1),
+});
 const listUsersRoute = createRoute({
     method: 'get',
     path: '/',
@@ -51,38 +56,22 @@ const getUserRoute = createRoute({
         404: NotFoundResponse,
     },
 });
-const createUserRoute = createRoute({
-    method: 'post',
-    path: '/',
-    operationId: 'createUser',
-    summary: 'Create a user. Phase A: any caller; Phase B/C will gate by Admin role.',
-    tags: ['users'],
-    request: {
-        body: { content: { 'application/json': { schema: UserDraft } } },
-    },
-    responses: {
-        201: {
-            description: 'The created user.',
-            content: { 'application/json': { schema: User } },
-        },
-        400: ValidationFailureResponse,
-    },
-});
 const updateUserRoute = createRoute({
     method: 'patch',
     path: '/{userId}',
     operationId: 'updateUser',
-    summary: 'Patch a user record. Phase A: any caller; Phase B/C will gate by Admin role.',
+    summary: 'Update your own display name, role changes go through /admin.',
     tags: ['users'],
     request: {
         params: UserIdParam,
-        body: { content: { 'application/json': { schema: UserPatch } } },
+        body: { content: { 'application/json': { schema: SelfProfileUpdate } } },
     },
     responses: {
         200: {
             description: 'The updated user.',
             content: { 'application/json': { schema: User } },
         },
+        403: ForbiddenResponse,
         404: NotFoundResponse,
     },
 });
@@ -106,18 +95,11 @@ export function createUsersRouter(deps) {
             throw new NotFoundError(`User "${userId}" not found`);
         return context.json(user, 200);
     });
-    router.openapi(createUserRoute, async (context) => {
-        const draft = context.req.valid('json');
-        const created = await deps.userRegistry.create({
-            id: newUserId(),
-            ...draft,
-            serverRole: draft.serverRole ?? 'user',
-            createdAt: deps.clock.now(),
-        });
-        return context.json(created, 201);
-    });
     router.openapi(updateUserRoute, async (context) => {
         const { userId } = context.req.valid('param');
+        // Self-service only. Server-admin edits go through the admin routes.
+        if (userId !== getUserId(context))
+            throw new ForbiddenError('You can only update your own profile.');
         const patch = context.req.valid('json');
         const updated = await deps.userRegistry.update(userId, patch);
         return context.json(updated, 200);

package/dist/routes/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAA;AAE1E,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CAClE,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;CACrB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAO9B,MAAM,cAAc,GAAG,WAAW,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,WAAW;IACxB,OAAO,EAAE,gCAAgC;IACzC,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;SAC9D;KACF;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,WAAW,CAAC;IAC7B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,4DAA4D;IACrE,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,WAAW,CAAC;IAC/B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,SAAS;IACtB,OAAO,EAAE,4BAA4B;IACrC,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;IAChC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,wEAAwE;IACjF,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;KACjE;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,yBAAyB;KAC/B;CACF,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,8EAA8E;IACvF,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE;QACP,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;KACjE;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,iBAAiB,MAAM,yBAAyB,CAAC,CAAA;QAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,SAAS,MAAM,aAAa,CAAC,CAAA;QACvD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAC7C,EAAE,EAAE,SAAS,EAAE;YACf,GAAG,KAAK;YACR,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,MAAM;YACtC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC5B,CAAC,CAAA;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAElE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CAClE,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;CACrB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAE9B,oDAAoD;AACpD,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAA;AAMF,MAAM,cAAc,GAAG,WAAW,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,WAAW;IACxB,OAAO,EAAE,gCAAgC;IACzC,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;SAC9D;KACF;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,WAAW,CAAC;IAC7B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,4DAA4D;IACrE,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,WAAW,CAAC;IAC/B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,SAAS;IACtB,OAAO,EAAE,4BAA4B;IACrC,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;IAChC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,+DAA+D;IACxE,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE;QACP,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE;KACzE;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,iBAAiB,MAAM,yBAAyB,CAAC,CAAA;QAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,SAAS,MAAM,aAAa,CAAC,CAAA;QACvD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,qEAAqE;QACrE,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,CAAC;YAC/B,MAAM,IAAI,cAAc,CAAC,uCAAuC,CAAC,CAAA;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/workspaceEvents.d.ts

@@ -4,10 +4,11 @@ export interface WorkspaceEventsRouterDeps {
     readonly eventBus: WorkspaceEventBus;
 }
 /**
- * SSE endpoint the Studio opens once per workspace to invalidate
- * react-query caches in real time. Pure delivery: events are dropped if
- * no one is listening, and the route makes no attempt to backfill state
- * on connect. The client re-fetches list endpoints on `EventSource.open`
+ * SSE endpoint the Studio opens once per workspace,
+ * to invalidate react-query caches in real time.
+ * Delivery is best-effort, events are dropped when no one is listening,
+ * and the route makes no attempt to backfill state on connect.
+ * The client re-fetches list endpoints on `EventSource.open`,
  * so a fresh subscriber catches up.
  */
 export declare function createWorkspaceEventsRouter(deps: WorkspaceEventsRouterDeps): Hono;

package/dist/routes/workspaceEvents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceEvents.d.ts","sourceRoot":"","sources":["../../src/routes/workspaceEvents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAK3B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,yBAAyB,GAAG,IAAI,CA0BjF"}
+{"version":3,"file":"workspaceEvents.d.ts","sourceRoot":"","sources":["../../src/routes/workspaceEvents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAK3B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,yBAAyB,GAAG,IAAI,CA0BjF"}

package/dist/routes/workspaceEvents.js

@@ -1,12 +1,13 @@
 import { Hono } from 'hono';
 import { streamSSE } from 'hono/streaming';
-import { createAsyncQueue } from '../infrastructure/agent/asyncQueue.js';
+import { createAsyncQueue } from '../infrastructure/skill/asyncQueue.js';
 import { getWorkspaceId, workspaceIdMiddleware } from '../middleware/workspaceId.js';
 /**
- * SSE endpoint the Studio opens once per workspace to invalidate
- * react-query caches in real time. Pure delivery: events are dropped if
- * no one is listening, and the route makes no attempt to backfill state
- * on connect. The client re-fetches list endpoints on `EventSource.open`
+ * SSE endpoint the Studio opens once per workspace,
+ * to invalidate react-query caches in real time.
+ * Delivery is best-effort, events are dropped when no one is listening,
+ * and the route makes no attempt to backfill state on connect.
+ * The client re-fetches list endpoints on `EventSource.open`,
  * so a fresh subscriber catches up.
  */
 export function createWorkspaceEventsRouter(deps) {
@@ -18,7 +19,7 @@ export function createWorkspaceEventsRouter(deps) {
             const unsubscribe = deps.eventBus.subscribe(workspaceId, (event) => {
                 queue.push(event);
             });
-            // Initial comment so the client's EventSource.onopen fires
+            // Initial comment so the client's EventSource.onopen fires,
             // immediately even if no event has been published yet.
             await stream.writeSSE({ event: 'ready', data: JSON.stringify({ workspaceId }) });
             try {

package/dist/routes/workspaceEvents.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceEvents.js","sourceRoot":"","sources":["../../src/routes/workspaceEvents.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAMpF;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IAEzB,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1E,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,gBAAgB,EAAkB,CAAA;YAChD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACnB,CAAC,CAAC,CAAA;YACF,2DAA2D;YAC3D,uDAAuD;YACvD,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC1C,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC3E,CAAC;YACH,CAAC;oBACO,CAAC;gBACP,WAAW,EAAE,CAAA;gBACb,KAAK,CAAC,GAAG,EAAE,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"workspaceEvents.js","sourceRoot":"","sources":["../../src/routes/workspaceEvents.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAMpF;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IAEzB,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1E,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,gBAAgB,EAAkB,CAAA;YAChD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACnB,CAAC,CAAC,CAAA;YACF,4DAA4D;YAC5D,uDAAuD;YACvD,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC1C,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC3E,CAAC;YACH,CAAC;oBACO,CAAC;gBACP,WAAW,EAAE,CAAA;gBACb,KAAK,CAAC,GAAG,EAAE,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/workspaceMembers.d.ts

@@ -1,5 +1,5 @@
 import type { Clock, WorkspaceService } from '@braidhq/core';
-import type { WorkspaceRegistryFile } from '../infrastructure/fs/WorkspaceRegistryFile.js';
+import type { WorkspaceRegistryFile } from '../infrastructure/workspace/WorkspaceRegistryFile.js';
 import { Hono } from 'hono';
 export interface WorkspaceMembersRouterDeps {
     workspaceService: WorkspaceService;