@cat-factory/server 0.133.0 → 0.134.0

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAgF3C;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CA0H5E"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAiF3C;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CA8H5E"}

package/dist/app.js

@@ -66,6 +66,7 @@ import { serviceMountController } from './modules/services/ServiceMountControlle
 import { serviceSpecController } from './modules/serviceSpec/ServiceSpecController.js';
 import { linearOAuthController, taskSourceController, } from './modules/tasks/TaskSourceController.js';
 import { workspaceController } from './modules/workspaces/WorkspaceController.js';
+import { workspaceMemberController } from './modules/workspaces/WorkspaceMemberController.js';
 import { persistenceController } from './modules/persistence/PersistenceController.js';
 import { githubDelegationController } from './modules/persistence/GitHubDelegationController.js';
 import { publicApiController } from './modules/publicApi/PublicApiController.js';
@@ -136,6 +137,10 @@ export function registerCoreControllers(app) {
     app.route('/accounts/:accountId', fragmentLibraryController('account'));
     app.route('/accounts/:accountId', skillLibraryController());
     app.route('/', workspaceController());
+    // Workspace-membership roster + access-mode management (workspace-rbac). Absolute
+    // `/workspaces/:ws/members` + `/access-mode` paths (like the workspace root), so mounted at `/`;
+    // 503 until the facade wires the workspace-member repository. Writes require `members.manage`.
+    app.route('/', workspaceMemberController());
     // Real-time WebSocket event stream (self-authenticates via ?ticket=; the facade's
     // gate bypasses only its exact upgrade shape). The upgrade is delegated to the
     // facade's realtime gateway.

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AAC3E,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAA;AAC5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4DAA4D,CAAA;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAA;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAA;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAA;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,4DAA4D,CAAA;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8DAA8D,CAAA;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wEAAwE,CAAA;AAC1H,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAA;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAA;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAA;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAA;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAA;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAA;AACnG,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAA;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAA;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAA;AACjG,OAAO,EACL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAA;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qDAAqD,CAAA;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAA;AAEtF;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAmB,GAAY;IACpE,gFAAgF;IAChF,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACpC,wFAAwF;IACxF,yFAAyF;IACzF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC3C,0EAA0E;IAC1E,mFAAmF;IACnF,kFAAkF;IAClF,uCAAuC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IACpC,2FAA2F;IAC3F,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,cAAc;IACd,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,+FAA+F;IAC/F,6FAA6F;IAC7F,qFAAqF;IACrF,wFAAwF;IACxF,kFAAkF;IAClF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAA;IAC5C,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,yDAAyD;IACzD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,4FAA4F;IAC5F,+FAA+F;IAC/F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,wFAAwF;IACxF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;IACjC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnC,yFAAyF;IACzF,oDAAoD;IACpD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACjD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAChD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAC9C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAA;IACxC,oFAAoF;IACpF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gCAAgC,EAAE,CAAC,CAAA;IAClD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtC,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAA;IACzC,4FAA4F;IAC5F,+EAA+E;IAC/E,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAA;IACvE,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,kFAAkF;IAClF,+EAA+E;IAC/E,6BAA6B;IAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAClC,qBAAqB;IACrB,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACjE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACnE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,oFAAoF;IACpF,gDAAgD;IAChD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,4FAA4F;IAC5F,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC1E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAA;IAC7E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAC/C,2FAA2F;IAC3F,sFAAsF;IACtF,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACzC,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC3C,yEAAyE;IACzE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AAC3E,OAAO,EAAE,+BAA+B,EAAE,MAAM,4DAA4D,CAAA;AAC5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4DAA4D,CAAA;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAA;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAA;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAA;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,4DAA4D,CAAA;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8DAA8D,CAAA;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAA;AACvF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wEAAwE,CAAA;AAC1H,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAA;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAA;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAA;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAA;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,uDAAuD,CAAA;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAA;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAA;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAA;AACnG,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAA;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uDAAuD,CAAA;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAA;AACjG,OAAO,EACL,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAA;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAA;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qDAAqD,CAAA;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAA;AAEtF;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAmB,GAAY;IACpE,gFAAgF;IAChF,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACpC,wFAAwF;IACxF,yFAAyF;IACzF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC3C,0EAA0E;IAC1E,mFAAmF;IACnF,kFAAkF;IAClF,uCAAuC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IACpC,2FAA2F;IAC3F,sFAAsF;IACtF,wFAAwF;IACxF,sFAAsF;IACtF,cAAc;IACd,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,+FAA+F;IAC/F,6FAA6F;IAC7F,qFAAqF;IACrF,wFAAwF;IACxF,kFAAkF;IAClF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAA;IAC5C,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,yDAAyD;IACzD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACvC,4FAA4F;IAC5F,+FAA+F;IAC/F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,wFAAwF;IACxF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC1C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;IACjC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnC,yFAAyF;IACzF,oDAAoD;IACpD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACjD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAChD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,EAAE,CAAC,CAAA;IAC9C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAA;IACxC,oFAAoF;IACpF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gCAAgC,EAAE,CAAC,CAAA;IAClD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACtC,0FAA0F;IAC1F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAA;IACzC,4FAA4F;IAC5F,+EAA+E;IAC/E,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC7C,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAA;IACvE,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACrC,kFAAkF;IAClF,iGAAiG;IACjG,+FAA+F;IAC/F,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAC3C,kFAAkF;IAClF,+EAA+E;IAC/E,6BAA6B;IAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAClC,qBAAqB;IACrB,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACjE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACnE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,oFAAoF;IACpF,gDAAgD;IAChD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC3D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,4FAA4F;IAC5F,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC1E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACpE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,CAAC,CAAA;IAClE,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,sBAAsB,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC9D,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAA;IAC7E,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,CAAC,CAAA;IACxD,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAC/C,2FAA2F;IAC3F,sFAAsF;IACtF,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACzC,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAC3C,yEAAyE;IACzE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAA;AAC9C,CAAC"}

package/dist/http/workspaceAccess.d.ts

@@ -1,5 +1,6 @@
-import { type WorkspaceAccess } from '@cat-factory/kernel';
-import type { ServerContainer } from './env.js';
+import { type WorkspaceAccess, type WorkspacePermission } from '@cat-factory/kernel';
+import type { Context } from 'hono';
+import type { AppEnv, ServerContainer } from './env.js';
 /**
  * Resolve a signed-in user's effective access to one board, THROUGH the `workspaceAccess` cache.
  * Returns `null` when the board doesn't exist (the gate then lets the handler 404 on its own,
@@ -8,4 +9,20 @@ import type { ServerContainer } from './env.js';
  * caching), so a repeat request from the same user on the same board issues no repository reads.
  */
 export declare function loadWorkspaceAccess(container: ServerContainer, workspaceId: string, userId: string): Promise<WorkspaceAccess | null>;
+/**
+ * The admin-tier enforcement helper (workspace-rbac). The gate already ran the resolution + the
+ * method-shaped viewer write floor (any non-GET ⇒ ≥ member) before a controller executes; this
+ * adds the PERMISSION-shaped check for the admin route groups (`settings.manage` /
+ * `integrations.manage` / `secrets.manage` / `members.manage`). It CONSUMES the access the gate
+ * published — it never re-derives membership.
+ *
+ * Dev-open parity: with auth disabled there is no signed-in user AND no resolved access object, so
+ * the check allows everything (mirroring the gate's `if (!user) return next()` and the SPA's
+ * absent-access ⇒ allow-all). A signed-in user always has a resolved access object here (the gate
+ * set it, or already 404'd), so a missing object for a signed-in caller fails closed.
+ *
+ * Throws {@link ForbiddenError} (→ 403) on insufficiency — the caller already SEES the board, so
+ * only capability, not existence, is revealed (never the 404 the gate uses to hide a board).
+ */
+export declare function requirePermission<E extends AppEnv>(c: Context<E>, permission: WorkspacePermission): void;
 //# sourceMappingURL=workspaceAccess.d.ts.map

package/dist/http/workspaceAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAiB/C;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAKjC"}
+{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAiBvD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAKjC;AA6BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAChD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,UAAU,EAAE,mBAAmB,GAC9B,IAAI,CASN"}

package/dist/http/workspaceAccess.js

@@ -1,4 +1,4 @@
-import { resolveWorkspaceAccess } from '@cat-factory/kernel';
+import { ForbiddenError, resolveWorkspaceAccess, } from '@cat-factory/kernel';
 // ---------------------------------------------------------------------------
 // The single workspace-RBAC resolution point (workspace-rbac initiative). The auth gate
 // (`mountAuthGate`) calls this once per `/workspaces/:ws/*` request; controllers CONSUME
@@ -47,4 +47,30 @@ async function resolveWorkspaceAccessUncached(container, workspaceId, userId) {
     ]);
     return resolveWorkspaceAccess({ userId, workspace: accessRow, accountRoles, memberRole });
 }
+/**
+ * The admin-tier enforcement helper (workspace-rbac). The gate already ran the resolution + the
+ * method-shaped viewer write floor (any non-GET ⇒ ≥ member) before a controller executes; this
+ * adds the PERMISSION-shaped check for the admin route groups (`settings.manage` /
+ * `integrations.manage` / `secrets.manage` / `members.manage`). It CONSUMES the access the gate
+ * published — it never re-derives membership.
+ *
+ * Dev-open parity: with auth disabled there is no signed-in user AND no resolved access object, so
+ * the check allows everything (mirroring the gate's `if (!user) return next()` and the SPA's
+ * absent-access ⇒ allow-all). A signed-in user always has a resolved access object here (the gate
+ * set it, or already 404'd), so a missing object for a signed-in caller fails closed.
+ *
+ * Throws {@link ForbiddenError} (→ 403) on insufficiency — the caller already SEES the board, so
+ * only capability, not existence, is revealed (never the 404 the gate uses to hide a board).
+ */
+export function requirePermission(c, permission) {
+    const access = c.get('workspaceAccess');
+    if (!access) {
+        if (!c.get('user'))
+            return; // dev-open: no user, no access object ⇒ allow all
+        throw new ForbiddenError(`This action requires the ${permission} permission`, { permission });
+    }
+    if (!access.permissions.has(permission)) {
+        throw new ForbiddenError(`This action requires the ${permission} permission`, { permission });
+    }
+}
 //# sourceMappingURL=workspaceAccess.js.map

package/dist/http/workspaceAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAwB,MAAM,qBAAqB,CAAA;AAGlF,8EAA8E;AAC9E,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,uFAAuF;AACvF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,MAAM,8BAA8B,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7E,CAAC,CAAC,CAAA;IACH,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,8BAA8B,CAC3C,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA,CAAC,4DAA4D;IAExF,uFAAuF;IACvF,uDAAuD;IACvD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC;YAC5B,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;KAC7D,CAAC,CAAA;IACF,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3F,CAAC"}
+{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,qBAAqB,CAAA;AAI5B,8EAA8E;AAC9E,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,uFAAuF;AACvF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,MAAM,8BAA8B,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7E,CAAC,CAAC,CAAA;IACH,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,8BAA8B,CAC3C,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA,CAAC,4DAA4D;IAExF,uFAAuF;IACvF,uDAAuD;IACvD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC;YAC5B,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;KAC7D,CAAC,CAAA;IACF,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAa,EACb,UAA+B;IAE/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAM,CAAC,kDAAkD;QAC7E,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC"}

package/dist/modules/workspaces/WorkspaceMemberController.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../../http/env.js';
+export declare function workspaceMemberController(): Hono<AppEnv>;
+//# sourceMappingURL=WorkspaceMemberController.d.ts.map

package/dist/modules/workspaces/WorkspaceMemberController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceMemberController.d.ts","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberController.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAmB/C,wBAAgB,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,CAsDxD"}

package/dist/modules/workspaces/WorkspaceMemberController.js

@@ -0,0 +1,64 @@
+import { addWorkspaceMemberContract, listWorkspaceMembersContract, removeWorkspaceMemberContract, setWorkspaceAccessModeContract, setWorkspaceMemberRoleContract, } from '@cat-factory/contracts';
+import { buildHonoRoute } from '@toad-contracts/hono';
+import { Hono } from 'hono';
+import { param } from '../../http/params.js';
+import { requirePermission } from '../../http/workspaceAccess.js';
+// ---------------------------------------------------------------------------
+// Workspace-membership management (workspace-rbac initiative, slice 5). All routes are
+// mounted under `/workspaces/:workspaceId`, so the shared `mountAuthGate` has already
+// resolved the caller's effective access and enforced the method-shaped viewer write
+// floor. This controller adds ONLY the admin-tier permission check (`members.manage`)
+// for the roster/access-mode WRITES; the roster GET is open to any resolved role
+// (`workspace.read`, satisfied by the gate resolution itself).
+//
+// The service is present only when the facade wired the workspace-member repository (both
+// do); absent ⇒ every route reports 503 rather than 500-ing on an undefined service.
+// ---------------------------------------------------------------------------
+const unavailable = (c) => c.json({ error: { code: 'unavailable', message: 'Workspace membership is not configured' } }, 503);
+export function workspaceMemberController() {
+    const app = new Hono();
+    // Roster — any resolved role may read it (gate resolution already guaranteed ≥ viewer).
+    buildHonoRoute(app, listWorkspaceMembersContract, async (c) => {
+        const service = c.get('container').workspaceMemberService;
+        if (!service)
+            return unavailable(c);
+        return c.json(await service.list(param(c, 'workspaceId')), 200);
+    });
+    buildHonoRoute(app, addWorkspaceMemberContract, async (c) => {
+        const service = c.get('container').workspaceMemberService;
+        if (!service)
+            return unavailable(c);
+        requirePermission(c, 'members.manage');
+        const body = c.req.valid('json');
+        const member = await service.add(param(c, 'workspaceId'), body.userId, body.role, c.get('user')?.id ?? null);
+        return c.json(member, 201);
+    });
+    buildHonoRoute(app, setWorkspaceMemberRoleContract, async (c) => {
+        const service = c.get('container').workspaceMemberService;
+        if (!service)
+            return unavailable(c);
+        requirePermission(c, 'members.manage');
+        const { workspaceId, userId } = c.req.valid('param');
+        const member = await service.setRole(workspaceId, userId, c.req.valid('json').role);
+        return c.json(member, 200);
+    });
+    buildHonoRoute(app, removeWorkspaceMemberContract, async (c) => {
+        const service = c.get('container').workspaceMemberService;
+        if (!service)
+            return unavailable(c);
+        requirePermission(c, 'members.manage');
+        const { workspaceId, userId } = c.req.valid('param');
+        await service.remove(workspaceId, userId);
+        return c.body(null, 204);
+    });
+    buildHonoRoute(app, setWorkspaceAccessModeContract, async (c) => {
+        const service = c.get('container').workspaceMemberService;
+        if (!service)
+            return unavailable(c);
+        requirePermission(c, 'members.manage');
+        const workspace = await service.setAccessMode(param(c, 'workspaceId'), c.req.valid('json').accessMode);
+        return c.json(workspace, 200);
+    });
+    return app;
+}
+//# sourceMappingURL=WorkspaceMemberController.js.map

package/dist/modules/workspaces/WorkspaceMemberController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceMemberController.js","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAEjE,8EAA8E;AAC9E,uFAAuF;AACvF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,iFAAiF;AACjF,+DAA+D;AAC/D,EAAE;AACF,0FAA0F;AAC1F,qFAAqF;AACrF,8EAA8E;AAE9E,MAAM,WAAW,GAAG,CAAmB,CAAa,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAEpG,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,wFAAwF;IACxF,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACnC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,EACT,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,CAC1B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACnC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAA;QACnF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACnC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAA;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACnC,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAC3C,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EACvB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAC/B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/persistence/rpc.d.ts

@@ -185,10 +185,10 @@ export type PersistenceMethodTable = Record<string, Record<string, MethodSpec>>;
  * slice adds a role dimension to the scope (or routes them through the service). Only the
  * account/membership READS a board load needs are remotely callable. Board-level mutations
  * (`workspaceRepository.rename`/`setDescription`, block/pipeline/execution CRUD) are
- * member-level in the service layer, so they remain. The one board mutation that stays OUT is
- * `workspaceRepository.setAccessMode` — the workspace-RBAC access-mode flip is `members.manage`
- * (admin-tier), so like the account/membership admin mutations it must not be reachable over the
- * role-blind machine RPC.
+ * member-level in the service layer, so they remain. The board mutations that stay OUT are
+ * `workspaceRepository.setAccessMode` (the access-mode flip) and `linkAccount` (the legacy-board
+ * auto-heal that adopts a board into an account) — both are `members.manage` (admin-tier), so like
+ * the account/membership admin mutations they must not be reachable over the role-blind machine RPC.
  */
 export declare const REMOTE_PERSISTENCE_METHODS: PersistenceMethodTable;
 /** A repository registry the mothership reflects over: repo name → repo instance. */

package/dist/persistence/rpc.js

@@ -43,10 +43,10 @@ export function statusForPersistenceError(code) {
  * slice adds a role dimension to the scope (or routes them through the service). Only the
  * account/membership READS a board load needs are remotely callable. Board-level mutations
  * (`workspaceRepository.rename`/`setDescription`, block/pipeline/execution CRUD) are
- * member-level in the service layer, so they remain. The one board mutation that stays OUT is
- * `workspaceRepository.setAccessMode` — the workspace-RBAC access-mode flip is `members.manage`
- * (admin-tier), so like the account/membership admin mutations it must not be reachable over the
- * role-blind machine RPC.
+ * member-level in the service layer, so they remain. The board mutations that stay OUT are
+ * `workspaceRepository.setAccessMode` (the access-mode flip) and `linkAccount` (the legacy-board
+ * auto-heal that adopts a board into an account) — both are `members.manage` (admin-tier), so like
+ * the account/membership admin mutations they must not be reachable over the role-blind machine RPC.
  */
 export const REMOTE_PERSISTENCE_METHODS = {
     workspaceRepository: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.133.0",
+  "version": "0.134.0",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -31,13 +31,13 @@
     "p-map": "^7.0.5",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/agents": "0.62.5",
-    "@cat-factory/contracts": "0.144.0",
-    "@cat-factory/integrations": "0.85.2",
-    "@cat-factory/kernel": "0.137.1",
-    "@cat-factory/orchestration": "0.120.2",
-    "@cat-factory/prompt-fragments": "0.13.33",
-    "@cat-factory/spend": "0.12.46"
+    "@cat-factory/agents": "0.62.6",
+    "@cat-factory/contracts": "0.145.0",
+    "@cat-factory/integrations": "0.85.3",
+    "@cat-factory/kernel": "0.138.0",
+    "@cat-factory/orchestration": "0.121.0",
+    "@cat-factory/prompt-fragments": "0.13.34",
+    "@cat-factory/spend": "0.12.47"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",